johnson 2.0.0.pre0 → 2.0.0.pre1

data/vendor/tracemonkey/nanojit/Allocator.h

@@ -0,0 +1,117 @@
+/* -*- Mode: C++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 4 -*- */
+/* vi: set ts=4 sw=4 expandtab: (add to ~/.vimrc: set modeline modelines=5) */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is [Open Source Virtual Machine].
+ *
+ * The Initial Developer of the Original Code is
+ * Adobe System Incorporated.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Adobe AS3 Team
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef __nanojit_Allocator__
+#define __nanojit_Allocator__
+
+namespace nanojit
+{
+    /**
+     * Allocator is a bump-pointer allocator with an SPI for getting more
+     * memory from embedder-implemented allocator, such as malloc()/free().
+     *
+     * allocations never return NULL.  The implementation of allocChunk()
+     * is expected to perform a longjmp or exception when an allocation can't
+     * proceed.
+     */
+    class Allocator {
+    public:
+        Allocator();
+        virtual ~Allocator();
+        void reset();
+
+        /** alloc memory, never return null. */
+        void* alloc(size_t nbytes) {
+            nbytes = (nbytes + 7) & ~7; // round up
+            if (current_top + nbytes <= current_limit) {
+                void *p = current_top;
+                current_top += nbytes;
+                return p;
+            }
+            return allocSlow(nbytes);
+        }
+
+    private:
+        void* allocSlow(size_t nbytes);
+        void fill(size_t minbytes);
+
+        class Chunk {
+        public:
+            Chunk* prev;
+            int64_t data[1]; // int64_t forces 8-byte alignment.
+        };
+
+        Chunk* current_chunk;
+        char* current_top;
+        char* current_limit;
+
+    // allocator SPI
+    private:
+        /** allocate another block from a host provided allocator */
+        void* allocChunk(size_t nbytes);
+
+        /** free back to the same allocator */
+        void freeChunk(void*);
+
+        /** hook for post-reset action. */
+        void postReset();
+    };
+}
+
+/** global new overload enabling this pattern:  new (allocator) T(...) */
+inline void* operator new(size_t size, nanojit::Allocator &a) {
+    return a.alloc(size);
+}
+
+/** global new overload enabling this pattern:  new (allocator) T(...) */
+inline void* operator new(size_t size, nanojit::Allocator *a) {
+    return a->alloc(size);
+}
+
+/** global new[] overload enabling this pattern: new (allocator) T[] */
+inline void* operator new[](size_t size, nanojit::Allocator& a) {
+    return a.alloc(size);
+}
+
+/** global new[] overload enabling this pattern: new (allocator) T[] */
+inline void* operator new[](size_t size, nanojit::Allocator* a) {
+    return a->alloc(size);
+}
+
+#endif // __nanojit_Allocator__

data/vendor/tracemonkey/nanojit/Assembler.cpp

@@ -1,4 +1,5 @@
-/* -*- Mode: C++; c-basic-offset: 4; indent-tabs-mode: t; tab-width: 4 -*- */
+/* -*- Mode: C++; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 4 -*- */
+/* vi: set ts=4 sw=4 expandtab: (add to ~/.vimrc: set modeline modelines=5) */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -40,206 +41,137 @@
 
 #ifdef FEATURE_NANOJIT
 
-#ifdef AVMPLUS_PORTING_API
-#include "portapi_nanojit.h"
-#endif
-
-#if defined(AVMPLUS_UNIX) && defined(AVMPLUS_ARM)
-#include <asm/unistd.h>
-extern "C" void __clear_cache(char *BEG, char *END);
-#endif
+namespace nanojit
+{
+#ifdef NJ_VERBOSE
+    /* A listing filter for LIR, going through backwards.  It merely
+       passes its input to its output, but notes it down too.  When
+       destructed, prints out what went through.  Is intended to be
+       used to print arbitrary intermediate transformation stages of
+       LIR. */
+    class ReverseLister : public LirFilter
+    {
+        Allocator&   _alloc;
+        LirNameMap*  _names;
+        const char*  _title;
+        StringList   _strs;
+        LogControl*  _logc;
+    public:
+        ReverseLister(LirFilter* in, Allocator& alloc,
+                      LirNameMap* names, LogControl* logc, const char* title)
+            : LirFilter(in)
+            , _alloc(alloc)
+            , _names(names)
+            , _title(title)
+            , _strs(alloc)
+            , _logc(logc)
+        { }
+
+        void finish()
+        {
+            _logc->printf("\n");
+            _logc->printf("=== BEGIN %s ===\n", _title);
+            int j = 0;
+            for (Seq<char*>* p = _strs.get(); p != NULL; p = p->tail)
+                _logc->printf("  %02d: %s\n", j++, p->head);
+            _logc->printf("=== END %s ===\n", _title);
+            _logc->printf("\n");
+        }
 
-#ifdef AVMPLUS_SPARC
-extern  "C"	void sync_instruction_memory(caddr_t v, u_int len);
+        LInsp read()
+        {
+            LInsp i = in->read();
+            const char* str = _names->formatIns(i);
+            char* cpy = new (_alloc) char[strlen(str)+1];
+            VMPI_strcpy(cpy, str);
+            _strs.insert(cpy);
+            return i;
+        }
+    };
 #endif
 
-namespace nanojit
-{
-	int UseSoftfloat = 0;
+    /**
+     * Need the following:
+     *
+     *    - merging paths ( build a graph? ), possibly use external rep to drive codegen
+     */
+    Assembler::Assembler(CodeAlloc& codeAlloc, Allocator& alloc, AvmCore* core, LogControl* logc)
+        : codeList(NULL)
+        , alloc(alloc)
+        , _codeAlloc(codeAlloc)
+        , _thisfrag(NULL)
+        , _branchStateMap(alloc)
+        , _patches(alloc)
+        , _labels(alloc)
+        , _epilogue(NULL)
+        , _err(None)
+        , config(core->config)
+    {
+        VMPI_memset(&_stats, 0, sizeof(_stats));
+        nInit(core);
+        (void)logc;
+        verbose_only( _logc = logc; )
+        verbose_only( _outputCache = 0; )
+        verbose_only( outlineEOL[0] = '\0'; )
+        verbose_only( outputAddr = false; )
+
+        reset();
+    }
 
-	class DeadCodeFilter: public LirFilter
-	{
-		const CallInfo *functions;
+    void Assembler::arReset()
+    {
+        _activation.lowwatermark = 0;
+        _activation.tos = 0;
 
-	    bool ignoreInstruction(LInsp ins)
-	    {
-            LOpcode op = ins->opcode();
-            if (ins->isStore() ||
-                op == LIR_loop ||
-                op == LIR_label ||
-                op == LIR_live ||
-                isRet(op)) {
-                return false;
-            }
-	        return ins->resv() == 0;
-	    }
-
-	public:
-		DeadCodeFilter(LirFilter *in, const CallInfo *f) : LirFilter(in), functions(f) {}
-		LInsp read() {
-			for (;;) {
-				LInsp i = in->read();
-				if (!i || i->isGuard() || i->isBranch()
-					|| (i->isCall() && !i->isCse(functions))
-					|| !ignoreInstruction(i))
-					return i;
-			}
-		}
-	};
+        for(uint32_t i=0; i<NJ_MAX_STACK_ENTRY; i++)
+            _activation.entry[i] = 0;
 
-#ifdef NJ_VERBOSE
-	class VerboseBlockReader: public LirFilter
-	{
-		Assembler *assm;
-		LirNameMap *names;
-		InsList block;
-        bool flushnext;
-	public:
-		VerboseBlockReader(LirFilter *in, Assembler *a, LirNameMap *n) 
-			: LirFilter(in), assm(a), names(n), block(a->_gc), flushnext(false)
-        {}
-
-		void flush() {
-            flushnext = false;
-            if (!block.isEmpty()) {
-			    for (int j=0,n=block.size(); j < n; j++) {
-					LIns *i = block[j];
-					assm->outputf("    %s", names->formatIns(i));
-				}
-			    block.clear();
-            }
-		}
+        _branchStateMap.clear();
+        _patches.clear();
+        _labels.clear();
+    }
 
-        void flush_add(LInsp i) {
-            flush();
-            block.add(i);
-        }
+    void Assembler::registerResetAll()
+    {
+        nRegisterResetAll(_allocator);
 
-		LInsp read() {
-			LInsp i = in->read();
-			if (!i) {
-				flush();
-				return i;
-			}
-            if (i->isGuard()) {
-				flush_add(i);
-				if (i->oprnd1())
-					block.add(i->oprnd1());
-            }
-            else if (isRet(i->opcode()) || i->isBranch()) {
-                flush_add(i);
-            }
-			else {
-                if (flushnext)
-                    flush();
-				block.add(i);//flush_add(i);
-                if (i->isop(LIR_label))
-                    flushnext = true;
-			}
-			return i;
-		}
-	};
+        // At start, should have some registers free and none active.
+        NanoAssert(0 != _allocator.free);
+        NanoAssert(0 == _allocator.countActive());
+#ifdef NANOJIT_IA32
+        debug_only(_fpuStkDepth = 0; )
 #endif
-	
-	/**
-	 * Need the following:
-	 *
-	 *	- merging paths ( build a graph? ), possibly use external rep to drive codegen
-	 */
-    Assembler::Assembler(Fragmento* frago)
-        : hasLoop(0)
-        , _frago(frago)
-        , _gc(frago->core()->gc)
-        , _labels(_gc)
-        , _patches(_gc)
-        , pending_lives(_gc)
-		, config(frago->core()->config)
-	{
-        AvmCore *core = frago->core();
-		nInit(core);
-		verbose_only( _verbose = !core->quiet_opt() && core->verbose() );
-		verbose_only( _outputCache = 0);
-		verbose_only( outlineEOL[0] = '\0');
-		
-		internalReset();
-		pageReset();		
-	}
+    }
 
-    void Assembler::arReset()
-	{
-		_activation.highwatermark = 0;
-		_activation.lowwatermark = 0;
-		_activation.tos = 0;
-
-		for(uint32_t i=0; i<NJ_MAX_STACK_ENTRY; i++)
-			_activation.entry[i] = 0;
-	}
-
- 	void Assembler::registerResetAll()
-	{
-		nRegisterResetAll(_allocator);
-
-		// keep a tally of the registers to check that our allocator works correctly
-		debug_only(_allocator.count = _allocator.countFree(); )
-		debug_only(_allocator.checkCount(); )
-		debug_only(_fpuStkDepth = 0; )
-	}
-
-	Register Assembler::registerAlloc(RegisterMask allow)
-	{
-		RegAlloc &regs = _allocator;
-//		RegisterMask prefer = livePastCall(_ins) ? saved : scratch;
-		RegisterMask prefer = SavedRegs & allow;
-		RegisterMask free = regs.free & allow;
-
-		RegisterMask set = prefer;
-		if (set == 0) set = allow;
-
-        if (free)
+    Register Assembler::registerAlloc(RegisterMask allow)
+    {
+        RegAlloc &regs = _allocator;
+        RegisterMask allowedAndFree = allow & regs.free;
+
+        if (allowedAndFree)
         {
-    		// at least one is free
-		    set &= free;
-
-		    // ok we have at least 1 free register so let's try to pick 
-		    // the best one given the profile of the instruction 
-		    if (!set)
-		    {
-			    // desired register class is not free so pick first of any class
-			    set = free;
-		    }
-		    NanoAssert((set & allow) != 0);
-		    Register r = nRegisterAllocFromSet(set);
-		    regs.used |= rmask(r);
-		    return r;
+            // At least one usable register is free -- no need to steal.  
+            // Pick a preferred one if possible.
+            RegisterMask preferredAndFree = allowedAndFree & SavedRegs;
+            RegisterMask set = ( preferredAndFree ? preferredAndFree : allowedAndFree );
+            Register r = nRegisterAllocFromSet(set);
+            return r;
         }
-		counter_increment(steals);
+        counter_increment(steals);
 
-		// nothing free, steal one 
-		// LSRA says pick the one with the furthest use
-		LIns* vic = findVictim(regs, allow);
-		NanoAssert(vic != NULL);
+        // nothing free, steal one
+        // LSRA says pick the one with the furthest use
+        LIns* vic = findVictim(allow);
+        NanoAssert(vic);
 
-	    Reservation* resv = getresv(vic);
-
-		// restore vic
-	    Register r = resv->reg;
+        // restore vic
+        Register r = vic->getReg();
         regs.removeActive(r);
-        resv->reg = UnknownReg;
-
-		asm_restore(vic, resv, r);
-		return r;
-	}
-
-	void Assembler::reserveReset()
-	{
-		_resvTable[0].arIndex = 0;
-		int i;
-        for(i=1; i<NJ_MAX_STACK_ENTRY; i++) {
-			_resvTable[i].arIndex = i-1;
-            _resvTable[i].used = 0;
-        }
-		_resvFree= i-1;
-	}
+        vic->setReg(UnknownReg);
+
+        asm_restore(vic, vic->resv(), r);
+        return r;
+    }
 
     /**
      * these instructions don't have to be saved & reloaded to spill,
@@ -249,192 +181,74 @@ namespace nanojit
         return i->isconst() || i->isconstq() || i->isop(LIR_alloc);
     }
 
-	Reservation* Assembler::reserveAlloc(LInsp i)
-	{
-		uint32_t item = _resvFree;
-		/* If there are no free reservations, mark the table as full and re-use an index.
-		 * This will clobber that reservation, but the error will be caught as soon as 
-		 * the current LIR instruction returns back to gen().
-		 */
-		if (!item) {
-			setError(ResvFull); 
-			item = 1;
-		}
-        Reservation *r = &_resvTable[item];
-		_resvFree = r->arIndex;
-		r->reg = UnknownReg;
-		r->arIndex = 0;
-        r->used = 1;
-        i->setresv(item);
-		return r;
-	}
-
-	void Assembler::reserveFree(LInsp i)
-	{
-        Reservation *rs = getresv(i);
-        NanoAssert(rs == &_resvTable[i->resv()]);
-		rs->arIndex = _resvFree;
-        rs->used = 0;
-		_resvFree = i->resv();
-        i->setresv(0);
-	}
-
-	void Assembler::internalReset()
-	{
-		// readies for a brand spanking new code generation pass.
-		registerResetAll();
-		reserveReset();
-		arReset();
-        pending_lives.clear();
-	}
-
-	NIns* Assembler::pageAlloc(bool exitPage)
-	{
-		Page*& list = (exitPage) ? _nativeExitPages : _nativePages;
-		Page* page = _frago->pageAlloc();
-		if (page)
-		{
-			page->next = list;
-			list = page;
-			nMarkExecute(page, PAGE_READ|PAGE_WRITE|PAGE_EXEC);
-			_stats.pages++;
-		}
-		else
-		{
-			// return a location that is 'safe' to write to while we are out of mem
-			setError(OutOMem);
-			return _startingIns;
-		}
-		return &page->code[sizeof(page->code)/sizeof(NIns)]; // just past the end
-	}
-	
-	void Assembler::pageReset()
-	{
-		pagesFree(_nativePages);		
-		pagesFree(_nativeExitPages);
-		
-		_nIns = 0;
-		_nExitIns = 0;
-		_startingIns = 0;
-		_stats.pages = 0;
-
-		nativePageReset();
-	}
-	
-	void Assembler::pagesFree(Page*& page)
-	{
-		while(page)
-		{
-			Page *next = page->next;  // pull next ptr prior to free
-			_frago->pageFree(page);
-			page = next;
-		}
-	}
-
-	#define bytesFromTop(x)		( (size_t)(x) - (size_t)pageTop(x) )
-	#define bytesToBottom(x)	( (size_t)pageBottom(x) - (size_t)(x) )
-	#define bytesBetween(x,y)	( (size_t)(x) - (size_t)(y) )
-	
-	int32_t Assembler::codeBytes()
-	{
-		// start and end on same page?
-		size_t exit = 0;
-		int32_t pages = _stats.pages;
-		if (_nExitIns-1 == _stats.codeExitStart)
-			;
-		else if (samepage(_nExitIns,_stats.codeExitStart))
-			exit = bytesBetween(_stats.codeExitStart, _nExitIns);
-		else
-		{
-			pages--;
-			exit = ((intptr_t)_stats.codeExitStart & (NJ_PAGE_SIZE-1)) ? bytesFromTop(_stats.codeExitStart)+1 : 0;
-			exit += bytesToBottom(_nExitIns)+1;
-		}
-
-		size_t main = 0;
-		if (_nIns-1 == _stats.codeStart)
-			;
-		else if (samepage(_nIns,_stats.codeStart))
-			main = bytesBetween(_stats.codeStart, _nIns);
-		else
-		{
-			pages--;
-			main = ((intptr_t)_stats.codeStart & (NJ_PAGE_SIZE-1)) ? bytesFromTop(_stats.codeStart)+1 : 0;
-			main += bytesToBottom(_nIns)+1;
-		}
-		//fprintf(stderr,"size %d, exit is %d, main is %d, page count %d, sizeof %d\n", (int)((pages) * NJ_PAGE_SIZE + main + exit),(int)exit, (int)main, (int)_stats.pages, (int)sizeof(Page));
-		return (pages) * NJ_PAGE_SIZE + main + exit;		
-	}
-
-	#undef bytesFromTop
-	#undef bytesToBottom
-	#undef byteBetween
-	
-	Page* Assembler::handoverPages(bool exitPages)
-	{
-		Page*& list = (exitPages) ? _nativeExitPages : _nativePages;
-		NIns*& ins =  (exitPages) ? _nExitIns : _nIns;
-		Page* start = list;
-		list = 0;
-		ins = 0;
-		return start;
-	}
-
-	#ifdef _DEBUG
-	bool Assembler::onPage(NIns* where, bool exitPages)
-	{
-		Page* page = (exitPages) ? _nativeExitPages : _nativePages;
-		bool on = false;
-		while(page)
-		{
-			if (samepage(where-1,page))
-				on = true;
-			page = page->next;
-		}
-		return on;
-	}
-	
-	void Assembler::pageValidate()
-	{
-		if (error()) return;
-		// _nIns and _nExitIns need to be at least on
-		// one of these pages
-		NanoAssertMsg( onPage(_nIns)&& onPage(_nExitIns,true), "Native instruction pointer overstep paging bounds; check overrideProtect for last instruction");
-	}
-	#endif
-
-	#ifdef _DEBUG
-	
-	void Assembler::resourceConsistencyCheck()
-	{
-		if (error()) return;
+    void Assembler::codeAlloc(NIns *&start, NIns *&end, NIns *&eip
+                              verbose_only(, size_t &nBytes))
+    {
+        // save the block we just filled
+        if (start)
+            CodeAlloc::add(codeList, start, end);
+
+        // CodeAlloc contract: allocations never fail
+        _codeAlloc.alloc(start, end);
+        verbose_only( nBytes += (end - start) * sizeof(NIns); )
+        NanoAssert(uintptr_t(end) - uintptr_t(start) >= (size_t)LARGEST_UNDERRUN_PROT);
+        eip = end;
+    }
+
+    void Assembler::reset()
+    {
+        _nIns = 0;
+        _nExitIns = 0;
+        codeStart = codeEnd = 0;
+        exitStart = exitEnd = 0;
+        _stats.pages = 0;
+        codeList = 0;
+
+        nativePageReset();
+        registerResetAll();
+        arReset();
+    }
+
+    #ifdef _DEBUG
+    void Assembler::pageValidate()
+    {
+        if (error()) return;
+        // _nIns needs to be at least on one of these pages
+        NanoAssertMsg(_inExit ? containsPtr(exitStart, exitEnd, _nIns) : containsPtr(codeStart, codeEnd, _nIns),
+                     "Native instruction pointer overstep paging bounds; check overrideProtect for last instruction");
+    }
+    #endif
+
+    #ifdef _DEBUG
+
+    void Assembler::resourceConsistencyCheck()
+    {
+        NanoAssert(!error());
 
 #ifdef NANOJIT_IA32
         NanoAssert((_allocator.active[FST0] && _fpuStkDepth == -1) ||
             (!_allocator.active[FST0] && _fpuStkDepth == 0));
 #endif
-		
+
         AR &ar = _activation;
-		// check AR entries
-		NanoAssert(ar.highwatermark < NJ_MAX_STACK_ENTRY);
-		LIns* ins = 0;
-		RegAlloc* regs = &_allocator;
-		for(uint32_t i = ar.lowwatermark; i < ar.tos; i++)
-		{
-			ins = ar.entry[i];
-			if ( !ins )
-				continue;
-			Reservation *r = getresv(ins);
-            NanoAssert(r != 0);
-			int32_t idx = r - _resvTable;
-			NanoAssertMsg(idx, "MUST have a resource for the instruction for it to have a stack location assigned to it");
-            if (r->arIndex) {
+        // check AR entries
+        NanoAssert(ar.tos < NJ_MAX_STACK_ENTRY);
+        LIns* ins = 0;
+        RegAlloc* regs = &_allocator;
+        for(uint32_t i = ar.lowwatermark; i < ar.tos; i++)
+        {
+            ins = ar.entry[i];
+            if ( !ins )
+                continue;
+            Register r = ins->getReg();
+            uint32_t arIndex = ins->getArIndex();
+            if (arIndex != 0) {
                 if (ins->isop(LIR_alloc)) {
                     int j=i+1;
                     for (int n = i + (ins->size()>>2); j < n; j++) {
                         NanoAssert(ar.entry[j]==ins);
                     }
-		        	NanoAssert(r->arIndex == (uint32_t)j-1);
+                    NanoAssert(arIndex == (uint32_t)j-1);
                     i = j-1;
                 }
                 else if (ins->isQuad()) {
@@ -442,248 +256,288 @@ namespace nanojit
                     i += 1; // skip high word
                 }
                 else {
-        			NanoAssertMsg(r->arIndex == i, "Stack record index mismatch");
+                    NanoAssertMsg(arIndex == i, "Stack record index mismatch");
                 }
             }
-			NanoAssertMsg( r->reg==UnknownReg || regs->isConsistent(r->reg,ins), "Register record mismatch");
-		}
-	
-		registerConsistencyCheck();
-				
-		// check resv table
-		int32_t inuseCount = 0;
-		int32_t notInuseCount = 0;
-        for(uint32_t i=1; i < sizeof(_resvTable)/sizeof(_resvTable[0]); i++) {
-            _resvTable[i].used ? inuseCount++ : notInuseCount++;
+            NanoAssertMsg( !isKnownReg(r) || regs->isConsistent(r,ins), "Register record mismatch");
         }
 
-		int32_t freeCount = 0;
-		uint32_t free = _resvFree;
-        while(free) {
-			free = _resvTable[free].arIndex;
-			freeCount++;
-		}
-		NanoAssert( ( freeCount==notInuseCount && inuseCount+notInuseCount==(NJ_MAX_STACK_ENTRY-1) ) );
-	}
-
-	void Assembler::registerConsistencyCheck()
-	{	
-		// check registers
-		RegAlloc *regs = &_allocator;
-		uint32_t managed = regs->managed;
-		Register r = FirstReg;
-		while(managed)
-		{
-			if (managed&1)
-			{
-				if (regs->isFree(r))
-				{
-					NanoAssert(regs->getActive(r)==0);
-				}
-				else
-				{
-					LIns* ins = regs->getActive(r);
-					// @todo we should be able to check across RegAlloc's somehow (to include savedGP...)
-					Reservation *v = getresv(ins);
-					NanoAssert(v != 0);
-					int32_t idx = v - _resvTable;
-					NanoAssert(idx >= 0 && idx < NJ_MAX_STACK_ENTRY);
-					NanoAssertMsg(idx, "MUST have a resource for the instruction for it to have a register assigned to it");
-					NanoAssertMsg( regs->getActive(v->reg)==ins, "Register record mismatch");
-				}			
-			}
-			
-			// next register in bitfield
-			r = nextreg(r);
-			managed >>= 1;
-		}
-	}
-	#endif /* _DEBUG */
-
-	void Assembler::findRegFor2(RegisterMask allow, LIns* ia, Reservation* &resva, LIns* ib, Reservation* &resvb)
-	{
-		if (ia == ib) 
-		{
-			findRegFor(ia, allow);
-			resva = resvb = getresv(ia);
-		}
-		else
-		{
-			Register rb = UnknownReg;
-            resvb = getresv(ib);
-            if (resvb && (rb = resvb->reg) != UnknownReg) {
-                if (allow & rmask(rb)) {
-                    // ib already assigned to an allowable reg, keep that one
-                    allow &= ~rmask(rb);
-                } else {
-                    // ib assigned to unusable reg, pick a different one below.
-                    rb = UnknownReg;
+        registerConsistencyCheck();
+    }
+
+    void Assembler::registerConsistencyCheck()
+    {
+        // check registers
+        RegAlloc *regs = &_allocator;
+        RegisterMask managed = regs->managed;
+        Register r = FirstReg;
+        while(managed)
+        {
+            if (managed&1)
+            {
+                if (regs->isFree(r))
+                {
+                    NanoAssertMsgf(regs->getActive(r)==0, "register %s is free but assigned to ins", gpn(r));
                 }
+                else
+                {
+                    LIns* ins = regs->getActive(r);
+                    // @todo we should be able to check across RegAlloc's somehow (to include savedGP...)
+                    Register r2 = ins->getReg();
+                    NanoAssertMsg(regs->getActive(r2)==ins, "Register record mismatch");
+                }
+            }
+
+            // next register in bitfield
+            r = nextreg(r);
+            managed >>= 1;
+        }
+    }
+    #endif /* _DEBUG */
+
+    void Assembler::findRegFor2(RegisterMask allow, LIns* ia, Reservation* &resva, LIns* ib, Reservation* &resvb)
+    {
+        if (ia == ib)
+        {
+            findRegFor(ia, allow);
+            resva = resvb = ia->resvUsed();
+        }
+        else
+        {
+            resvb = ib->resv();
+            bool rbDone = (resvb->used && isKnownReg(resvb->reg) && (allow & rmask(resvb->reg)));
+            if (rbDone) {
+                // ib already assigned to an allowable reg, keep that one
+                allow &= ~rmask(resvb->reg);
             }
             Register ra = findRegFor(ia, allow);
-            resva = getresv(ia);
-            NanoAssert(error() || (resva != 0 && ra != UnknownReg));
-            if (rb == UnknownReg)
-            {
+            resva = ia->resv();
+            NanoAssert(error() || (resva->used && isKnownReg(ra)));
+            if (!rbDone) {
                 allow &= ~rmask(ra);
                 findRegFor(ib, allow);
-                resvb = getresv(ib);
+                resvb = ib->resvUsed();
             }
-		}
-	}
+        }
+    }
+
+    // XXX: this will replace findRegFor2() once Reservations are fully removed
+    void Assembler::findRegFor2b(RegisterMask allow, LIns* ia, Register &ra, LIns* ib, Register &rb)
+    {
+        Reservation *resva, *resvb;
+        findRegFor2(allow, ia, resva, ib, resvb);
+        ra = resva->reg;
+        rb = resvb->reg;
+    }
 
-	Register Assembler::findSpecificRegFor(LIns* i, Register w)
-	{
-		return findRegFor(i, rmask(w));
-	}
+    Register Assembler::findSpecificRegFor(LIns* i, Register w)
+    {
+        return findRegFor(i, rmask(w));
+    }
 
     Register Assembler::getBaseReg(LIns *i, int &d, RegisterMask allow)
     {
         if (i->isop(LIR_alloc)) {
             d += findMemFor(i);
             return FP;
-        } else {
-            return findRegFor(i, allow);
         }
+        return findRegFor(i, allow);
     }
-			
-	Register Assembler::findRegFor(LIns* i, RegisterMask allow)
-	{
-        if (i->isop(LIR_alloc)) {
+
+    // Finds a register in 'allow' to hold the result of 'ins'.  Used when we
+    // encounter a use of 'ins'.  The actions depend on the prior state of
+    // 'ins':
+    // - If the result of 'ins' is not in any register, we find an allowed
+    //   one, evicting one if necessary.
+    // - If the result of 'ins' is already in an allowed register, we use that.
+    // - If the result of 'ins' is already in a not-allowed register, we find an
+    //   allowed one and move it.
+    //
+    Register Assembler::findRegFor(LIns* ins, RegisterMask allow)
+    {
+        if (ins->isop(LIR_alloc)) {
             // never allocate a reg for this w/out stack space too
-            findMemFor(i);
+            findMemFor(ins);
         }
 
-        Reservation* resv = getresv(i);
-		Register r;
-
-		// if we have an existing reservation and it has a non-unknown
-		// register allocated, and that register is in our allowed mask,
-		// return it.
-        if (resv && (r=resv->reg) != UnknownReg && (rmask(r) & allow)) {
+        Register r;
+
+        if (!ins->isUsed()) {
+            // No reservation.  Create one, and do a fresh allocation.
+            ins->markAsUsed();
+            RegisterMask prefer = hint(ins, allow);
+            r = registerAlloc(prefer);
+            ins->setReg(r);
+            _allocator.addActive(r, ins);
+
+        } else if (!ins->hasKnownReg()) {
+            // Existing reservation with an unknown register.  Do a fresh
+            // allocation.
+            RegisterMask prefer = hint(ins, allow);
+            r = registerAlloc(prefer);
+            ins->setReg(r);
+            _allocator.addActive(r, ins);
+
+        } else if (rmask(r = ins->getReg()) & allow) {
+            // Existing reservation with a known register allocated, and
+            // that register is allowed.  Use it.
             _allocator.useActive(r);
-			return r;
+
+        } else {
+            // Existing reservation with a known register allocated, but
+            // the register is not allowed.
+            RegisterMask prefer = hint(ins, allow);
+#ifdef NANOJIT_IA32
+            if (((rmask(r)&XmmRegs) && !(allow&XmmRegs)) ||
+                ((rmask(r)&x87Regs) && !(allow&x87Regs)))
+            {
+                // x87 <-> xmm copy required
+                //_nvprof("fpu-evict",1);
+                evict(r, ins);
+                r = registerAlloc(prefer);
+                ins->setReg(r);
+                _allocator.addActive(r, ins);
+            } else
+#elif defined(NANOJIT_PPC)
+            if (((rmask(r)&GpRegs) && !(allow&GpRegs)) ||
+                ((rmask(r)&FpRegs) && !(allow&FpRegs)))
+            {
+                evict(r, ins);
+                r = registerAlloc(prefer);
+                ins->setReg(r);
+                _allocator.addActive(r, ins);
+            } else
+#endif
+            {
+                // The post-state register holding 'ins' is 's', the pre-state
+                // register holding 'ins' is 'r'.  For example, if s=eax and
+                // r=ecx:
+                //
+                // pre-state:   ecx(ins)
+                // instruction: mov eax, ecx
+                // post-state:  eax(ins)
+                //
+                _allocator.retire(r);
+                Register s = r;
+                r = registerAlloc(prefer);
+                ins->setReg(r);
+                _allocator.addActive(r, ins);
+                if ((rmask(s) & GpRegs) && (rmask(r) & GpRegs)) {
+#ifdef NANOJIT_ARM
+                    MOV(s, r);  // ie. move 'ins' from its pre-state reg to its post-state reg
+#else
+                    MR(s, r);
+#endif
+                }
+                else {
+                    asm_nongp_copy(s, r);
+                }
+            }
         }
+        return r;
+    }
 
-		// figure out what registers are preferred for this instruction
-		RegisterMask prefer = hint(i, allow);
+    int Assembler::findMemFor(LIns *ins)
+    {
+        if (!ins->isUsed())
+            ins->markAsUsed();
+        if (!ins->getArIndex()) {
+            ins->setArIndex(arReserve(ins));
+            NanoAssert(ins->getArIndex() <= _activation.tos);
+        }
+        return disp(ins);
+    }
 
-		// if we didn't have a reservation, allocate one now
-        if (!resv)
-			resv = reserveAlloc(i);
+    Register Assembler::prepResultReg(LIns *ins, RegisterMask allow)
+    {
+        const bool pop = ins->isUnusedOrHasUnknownReg();
+        Register r = findRegFor(ins, allow);
+        freeRsrcOf(ins, pop);
+        return r;
+    }
 
-        r = resv->reg;
+    void Assembler::asm_spilli(LInsp ins, bool pop)
+    {
+        int d = disp(ins);
+        Register r = ins->getReg();
+        bool quad = ins->opcode() == LIR_iparam || ins->isQuad();
+        verbose_only( if (d && (_logc->lcbits & LC_RegAlloc)) {
+                         outputForEOL("  <= spill %s",
+                                      _thisfrag->lirbuf->names->formatRef(ins)); } )
+        asm_spill(r, d, pop, quad);
+    }
 
-#ifdef AVMPLUS_IA32
-        if (r != UnknownReg && 
-            (((rmask(r)&XmmRegs) && !(allow&XmmRegs)) ||
-                 ((rmask(r)&x87Regs) && !(allow&x87Regs))))
-        {
-            // x87 <-> xmm copy required
-            //_nvprof("fpu-evict",1);
-            evict(r);
-            r = UnknownReg;
+    // NOTE: Because this function frees slots on the stack, it is not safe to
+    // follow a call to this with a call to anything which might spill a
+    // register, as the stack can be corrupted. Refer to bug 495239 for a more
+    // detailed description.
+    void Assembler::freeRsrcOf(LIns *ins, bool pop)
+    {
+        Register r = ins->getReg();
+        if (isKnownReg(r)) {
+            asm_spilli(ins, pop);
+            _allocator.retire(r);   // free any register associated with entry
         }
-#endif
+        int arIndex = ins->getArIndex();
+        if (arIndex) {
+            NanoAssert(_activation.entry[arIndex] == ins);
+            arFree(arIndex);        // free any stack stack space associated with entry
+        }
+        ins->markAsClear();
+    }
 
-        if (r == UnknownReg)
-		{
-			r = resv->reg = registerAlloc(prefer);
-			_allocator.addActive(r, i);
-			return r;
-		}
-		else
-		{
-			// the already-allocated register isn't in the allowed mask;
-			// we need to grab a new one and then copy over the old
-			// contents to the new.
-			resv->reg = UnknownReg;
-			_allocator.retire(r);
-			Register s = resv->reg = registerAlloc(prefer);
-			_allocator.addActive(s, i);
-            if ((rmask(r) & GpRegs) && (rmask(s) & GpRegs)) {
-#ifdef NANOJIT_ARM
-				MOV(r, s);
-#else
-    			MR(r, s);
-#endif
-            } 
-            else {
-				asm_nongp_copy(r, s);
-			}
-			return s;
-		}
-	}
-
-	int Assembler::findMemFor(LIns *i)
-	{
-		Reservation* resv = getresv(i);
-		if (!resv)
-			resv = reserveAlloc(i);
-        if (!resv->arIndex) {
-			resv->arIndex = arReserve(i);
-            NanoAssert(resv->arIndex <= _activation.highwatermark);
+    // Frees 'r' in the RegAlloc state, if it's not already free.
+    void Assembler::evictIfActive(Register r)
+    {
+        if (LIns* vic = _allocator.getActive(r)) {
+            evict(r, vic);
         }
-		return disp(resv);
-	}
-
-	Register Assembler::prepResultReg(LIns *i, RegisterMask allow)
-	{
-		Reservation* resv = getresv(i);
-		const bool pop = !resv || resv->reg == UnknownReg;
-		Register rr = findRegFor(i, allow);
-		freeRsrcOf(i, pop);
-		return rr;
-	}
-
-	void Assembler::asm_spilli(LInsp i, Reservation *resv, bool pop)
-	{
-		int d = disp(resv);
-		Register rr = resv->reg;
-		bool quad = i->opcode() == LIR_param || i->isQuad();
-		verbose_only( if (d && _verbose) { outputForEOL("  <= spill %s", _thisfrag->lirbuf->names->formatRef(i)); } )
-		asm_spill(rr, d, pop, quad);
-	}
-
-	void Assembler::freeRsrcOf(LIns *i, bool pop)
-	{
-		Reservation* resv = getresv(i);
-		int index = resv->arIndex;
-		Register rr = resv->reg;
-
-		if (rr != UnknownReg)
-		{
-			asm_spilli(i, resv, pop);
-			_allocator.retire(rr);	// free any register associated with entry
-		}
-		if (index)
-            arFree(index);			// free any stack stack space associated with entry
-		reserveFree(i);		// clear fields of entry and add it to free list
-	}
-
-	void Assembler::evict(Register r)
-	{
-		registerAlloc(rmask(r));
-		_allocator.addFree(r);
-	}
+    }
+
+    // Frees 'r' (which currently holds the result of 'vic') in the RegAlloc
+    // state.  An example:
+    //
+    //   pre-state:     eax(ld1)
+    //   instruction:   mov ebx,-4(ebp) <= restore add1   # %ebx is dest
+    //   post-state:    eax(ld1) ebx(add1)
+    //
+    // At run-time we are *restoring* 'add1' into %ebx, hence the call to
+    // asm_restore().  But at regalloc-time we are moving backwards through
+    // the code, so in that sense we are *evicting* 'add1' from %ebx.
+    //
+    void Assembler::evict(Register r, LIns* vic)
+    {
+        // Not free, need to steal.
+        counter_increment(steals);
+
+        // Get vic's resv, check r matches.
+        NanoAssert(!_allocator.isFree(r));
+        NanoAssert(vic == _allocator.getActive(r));
+        NanoAssert(r == vic->getReg());
+
+        // Free r.
+        _allocator.retire(r);
+        vic->setReg(UnknownReg);
+
+        // Restore vic.
+        asm_restore(vic, vic->resv(), r);
+    }
 
     void Assembler::patch(GuardRecord *lr)
     {
         if (!lr->jmp) // the guard might have been eliminated as redundant
             return;
         Fragment *frag = lr->exit->target;
-		NanoAssert(frag->fragEntry != 0);
-		NIns* was = nPatchBranch((NIns*)lr->jmp, frag->fragEntry);
-		NanoAssert(frag->fragEntry != was);
-		verbose_only(verbose_outputf("patching jump at %p to target %p (was %p)\n",
-			lr->jmp, frag->fragEntry, was);)
-		(void)was;
+        NanoAssert(frag->fragEntry != 0);
+        nPatchBranch((NIns*)lr->jmp, frag->fragEntry);
+        verbose_only(verbose_outputf("patching jump at %p to target %p\n",
+            lr->jmp, frag->fragEntry);)
     }
 
     void Assembler::patch(SideExit *exit)
     {
         GuardRecord *rec = exit->guards;
-        AvmAssert(rec);
+        NanoAssert(rec);
         while (rec) {
             patch(rec);
             rec = rec->next;
@@ -693,325 +547,281 @@ namespace nanojit
 #ifdef NANOJIT_IA32
     void Assembler::patch(SideExit* exit, SwitchInfo* si)
     {
-		for (GuardRecord* lr = exit->guards; lr; lr = lr->next) {
-			Fragment *frag = lr->exit->target;
-			NanoAssert(frag->fragEntry != 0);
-			si->table[si->index] = frag->fragEntry;
-		}
+        for (GuardRecord* lr = exit->guards; lr; lr = lr->next) {
+            Fragment *frag = lr->exit->target;
+            NanoAssert(frag->fragEntry != 0);
+            si->table[si->index] = frag->fragEntry;
+        }
     }
 #endif
 
     NIns* Assembler::asm_exit(LInsp guard)
     {
-		SideExit *exit = guard->record()->exit;
-		NIns* at = 0;
-		if (!_branchStateMap->get(exit))
-		{
-			at = asm_leave_trace(guard);
-		}
-		else
-		{
-			RegAlloc* captured = _branchStateMap->get(exit);
-			intersectRegisterState(*captured);
-			verbose_only(
-				verbose_outputf("        merging trunk with %s",
-					_frago->labels->format(exit->target));
-				verbose_outputf("        %p:",_nIns);
-			)			
-			at = exit->target->fragEntry;
-			NanoAssert(at != 0);
-			_branchStateMap->remove(exit);
-		}
-		return at;
-	}
-	
-	NIns* Assembler::asm_leave_trace(LInsp guard)
-	{
-        verbose_only(bool priorVerbose = _verbose; )
-		verbose_only( _verbose = verbose_enabled() && _frago->core()->config.verbose_exits; )
+        SideExit *exit = guard->record()->exit;
+        NIns* at = 0;
+        if (!_branchStateMap.get(exit))
+        {
+            at = asm_leave_trace(guard);
+        }
+        else
+        {
+            RegAlloc* captured = _branchStateMap.get(exit);
+            intersectRegisterState(*captured);
+            at = exit->target->fragEntry;
+            NanoAssert(at != 0);
+            _branchStateMap.remove(exit);
+        }
+        return at;
+    }
+
+    NIns* Assembler::asm_leave_trace(LInsp guard)
+    {
         verbose_only( int32_t nativeSave = _stats.native );
-		verbose_only(verbose_outputf("--------------------------------------- end exit block %p", guard);)
+        verbose_only( verbose_outputf("----------------------------------- ## END exit block %p", guard);)
 
-		RegAlloc capture = _allocator;
+        RegAlloc capture = _allocator;
 
         // this point is unreachable.  so free all the registers.
-		// if an instruction has a stack entry we will leave it alone,
-		// otherwise we free it entirely.  intersectRegisterState will restore.
-		releaseRegisters();
-		
-		swapptrs();
-		_inExit = true;
-		
-		//verbose_only( verbose_outputf("         LIR_xend swapptrs, _nIns is now %08X(%08X), _nExitIns is now %08X(%08X)",_nIns, *_nIns,_nExitIns,*_nExitIns) );
-		debug_only( _sv_fpuStkDepth = _fpuStkDepth; _fpuStkDepth = 0; )
-
-		nFragExit(guard);
-
-		// restore the callee-saved register and parameters
-		assignSavedRegs();
-		assignParamRegs();
-
-		intersectRegisterState(capture);
-
-		// this can be useful for breaking whenever an exit is taken
-		//INT3();
-		//NOP();
-
-		// we are done producing the exit logic for the guard so demark where our exit block code begins
-		NIns* jmpTarget = _nIns;	 // target in exit path for our mainline conditional jump 
-
-		// swap back pointers, effectively storing the last location used in the exit path
-		swapptrs();
-		_inExit = false;
-		
-		//verbose_only( verbose_outputf("         LIR_xt/xf swapptrs, _nIns is now %08X(%08X), _nExitIns is now %08X(%08X)",_nIns, *_nIns,_nExitIns,*_nExitIns) );
-		verbose_only( verbose_outputf("        %p:",jmpTarget);)
-		verbose_only( verbose_outputf("--------------------------------------- exit block (LIR_xt|LIR_xf)") );
+        // if an instruction has a stack entry we will leave it alone,
+        // otherwise we free it entirely.  intersectRegisterState will restore.
+        releaseRegisters();
+
+        swapptrs();
+        _inExit = true;
 
 #ifdef NANOJIT_IA32
-		NanoAssertMsgf(_fpuStkDepth == _sv_fpuStkDepth, "LIR_xtf, _fpuStkDepth=%d, expect %d",_fpuStkDepth, _sv_fpuStkDepth);
-		debug_only( _fpuStkDepth = _sv_fpuStkDepth; _sv_fpuStkDepth = 9999; )
+        debug_only( _sv_fpuStkDepth = _fpuStkDepth; _fpuStkDepth = 0; )
+#endif
+
+        nFragExit(guard);
+
+        // restore the callee-saved register and parameters
+        assignSavedRegs();
+        assignParamRegs();
+
+        intersectRegisterState(capture);
+
+        // this can be useful for breaking whenever an exit is taken
+        //INT3();
+        //NOP();
+
+        // we are done producing the exit logic for the guard so demark where our exit block code begins
+        NIns* jmpTarget = _nIns;     // target in exit path for our mainline conditional jump
+
+        // swap back pointers, effectively storing the last location used in the exit path
+        swapptrs();
+        _inExit = false;
+
+        //verbose_only( verbose_outputf("         LIR_xt/xf swapptrs, _nIns is now %08X(%08X), _nExitIns is now %08X(%08X)",_nIns, *_nIns,_nExitIns,*_nExitIns) );
+        verbose_only( verbose_outputf("%010lx:", (unsigned long)jmpTarget);)
+        verbose_only( verbose_outputf("----------------------------------- ## BEGIN exit block (LIR_xt|LIR_xf)") );
+
+#ifdef NANOJIT_IA32
+        NanoAssertMsgf(_fpuStkDepth == _sv_fpuStkDepth, "LIR_xtf, _fpuStkDepth=%d, expect %d",_fpuStkDepth, _sv_fpuStkDepth);
+        debug_only( _fpuStkDepth = _sv_fpuStkDepth; _sv_fpuStkDepth = 9999; )
 #endif
 
-        verbose_only( _verbose = priorVerbose; )
         verbose_only(_stats.exitnative += (_stats.native-nativeSave));
 
         return jmpTarget;
     }
-	
-	void Assembler::beginAssembly(Fragment *frag, RegAllocMap* branchStateMap)
-	{
-		internalReset();
+
+    void Assembler::beginAssembly(Fragment *frag)
+    {
+        verbose_only( codeBytes = 0; )
+        verbose_only( exitBytes = 0; )
+
+        reset();
+
+        NanoAssert(codeList == 0);
+        NanoAssert(codeStart == 0);
+        NanoAssert(codeEnd == 0);
+        NanoAssert(exitStart == 0);
+        NanoAssert(exitEnd == 0);
+        NanoAssert(_nIns == 0);
+        NanoAssert(_nExitIns == 0);
 
         _thisfrag = frag;
-		_activation.lowwatermark = 1;
-		_activation.tos = _activation.lowwatermark;
-		_activation.highwatermark = _activation.tos;
-		
-		counter_reset(native);
-		counter_reset(exitnative);
-		counter_reset(steals);
-		counter_reset(spills);
-		counter_reset(remats);
-
-		setError(None);
-
-		// native code gen buffer setup
-		nativePageSetup();
-		
-		// When outOMem, nIns is set to startingIns and we overwrite the region until the error is handled
-		underrunProtect(LARGEST_UNDERRUN_PROT);  // the largest value passed to underrunProtect() 
-		_startingIns = _nIns;
-		
-	#ifdef AVMPLUS_PORTING_API
-		_endJit2Addr = _nExitIns;
-	#endif
-
-		// make sure we got memory at least one page
-		if (error()) return;
-			
+        _activation.lowwatermark = 1;
+        _activation.tos = _activation.lowwatermark;
+        _inExit = false;
+
+        counter_reset(native);
+        counter_reset(exitnative);
+        counter_reset(steals);
+        counter_reset(spills);
+        counter_reset(remats);
+
+        setError(None);
+
+        // native code gen buffer setup
+        nativePageSetup();
+
+        // make sure we got memory at least one page
+        if (error()) return;
+
 #ifdef PERFM
-		_stats.pages = 0;
-		_stats.codeStart = _nIns-1;
-		_stats.codeExitStart = _nExitIns-1;		
-		//fprintf(stderr,"pageReset %d start %x exit start %x\n", _stats.pages, (int)_stats.codeStart, (int)_stats.codeExitStart);
+        _stats.pages = 0;
+        _stats.codeStart = _nIns-1;
+        _stats.codeExitStart = _nExitIns-1;
 #endif /* PERFM */
 
-        _epilogue = genEpilogue();
-		_branchStateMap = branchStateMap;
-        _labels.clear();
-        _patches.clear();
+        _epilogue = NULL;
+
+        nBeginAssembly();
+    }
 
-		verbose_only( outputAddr=true; )
-		verbose_only( asm_output("[epilogue]"); )
-	}
-	
-	void Assembler::assemble(Fragment* frag,  NInsList& loopJumps)
-	{
-		if (error()) return;	
-		AvmCore *core = _frago->core();
+    void Assembler::assemble(Fragment* frag)
+    {
+        if (error()) return;
         _thisfrag = frag;
 
-		// set up backwards pipeline: assembler -> StackFilter -> LirReader
-		LirReader bufreader(frag->lastIns);
-		avmplus::GC *gc = core->gc;
-		StackFilter storefilter1(&bufreader, gc, frag->lirbuf, frag->lirbuf->sp);
-		StackFilter storefilter2(&storefilter1, gc, frag->lirbuf, frag->lirbuf->rp);
-		DeadCodeFilter deadfilter(&storefilter2, frag->lirbuf->_functions);
-		LirFilter* rdr = &deadfilter;
-		verbose_only(
-			VerboseBlockReader vbr(rdr, this, frag->lirbuf->names);
-			if (verbose_enabled())
-				rdr = &vbr;
-		)
-
-		verbose_only(_thisfrag->compileNbr++; )
-		verbose_only(_frago->_stats.compiles++; )
-		verbose_only(_frago->_stats.totalCompiles++; )
-		_inExit = false;	
-        gen(rdr, loopJumps);
-		frag->loopEntry = _nIns;
-		//frag->outbound = core->config.tree_opt? _latestGuard : 0;
-		//fprintf(stderr, "assemble frag %X entry %X\n", (int)frag, (int)frag->fragEntry);
+        // check the fragment is starting out with a sane profiling state
+        verbose_only( NanoAssert(frag->nStaticExits == 0); )
+        verbose_only( NanoAssert(frag->nCodeBytes == 0); )
+        verbose_only( NanoAssert(frag->nExitBytes == 0); )
+        verbose_only( NanoAssert(frag->profCount == 0); )
+        verbose_only( if (_logc->lcbits & LC_FragProfile)
+                          NanoAssert(frag->profFragID > 0);
+                      else
+                          NanoAssert(frag->profFragID == 0); )
+
+        // Used for debug printing, if needed
+        verbose_only(
+        ReverseLister *pp_init = NULL;
+        ReverseLister *pp_after_sf = NULL;
+        )
+
+        // set up backwards pipeline: assembler -> StackFilter -> LirReader
+        LirReader bufreader(frag->lastIns);
+
+        // Used to construct the pipeline
+        LirFilter* prev = &bufreader;
+
+        // The LIR passes through these filters as listed in this
+        // function, viz, top to bottom.
+
+        // INITIAL PRINTING
+        verbose_only( if (_logc->lcbits & LC_ReadLIR) {
+        pp_init = new (alloc) ReverseLister(prev, alloc, frag->lirbuf->names, _logc,
+                                    "Initial LIR");
+        prev = pp_init;
+        })
+
+        // STACKFILTER
+        StackFilter stackfilter(prev, alloc, frag->lirbuf, frag->lirbuf->sp, frag->lirbuf->rp);
+        prev = &stackfilter;
+
+        verbose_only( if (_logc->lcbits & LC_AfterSF) {
+        pp_after_sf = new (alloc) ReverseLister(prev, alloc, frag->lirbuf->names, _logc,
+                                                "After StackFilter");
+        prev = pp_after_sf;
+        })
+
+        _inExit = false;
+
+        gen(prev);
 
         if (!error()) {
-		    // patch all branches
-		    while(!_patches.isEmpty())
-		    {
-			    NIns* where = _patches.lastKey();
-			    LInsp targ = _patches.removeLast();
+            // patch all branches
+            NInsMap::Iter iter(_patches);
+            while (iter.next()) {
+                NIns* where = iter.key();
+                LIns* targ = iter.value();
                 LabelState *label = _labels.get(targ);
-			    NIns* ntarg = label->addr;
+                NIns* ntarg = label->addr;
                 if (ntarg) {
-				    nPatchBranch(where,ntarg);
-			    }
+                    nPatchBranch(where,ntarg);
+                }
                 else {
-				    setError(UnknownBranch);
-				    break;
-			    }
-		    }
+                    setError(UnknownBranch);
+                    break;
+                }
+            }
         }
-		else {
-			_nIns = _startingIns;  // in case of failure reset nIns ready for the next assembly run
-		}
-	}
-
-	void Assembler::endAssembly(Fragment* frag, NInsList& loopJumps)
-	{
-		// don't try to patch code if we are in an error state since we might have partially 
-		// overwritten the code cache already
-		if (error())
-			return;
-
-	    NIns* SOT = 0;
-	    if (frag->isRoot()) {
-	        SOT = frag->loopEntry;
-            verbose_only( verbose_outputf("        %p:",_nIns); )
-	    } else {
-	        SOT = frag->root->fragEntry;
-	    }
-        AvmAssert(SOT);
-		while(!loopJumps.isEmpty())
-		{
-			NIns* loopJump = (NIns*)loopJumps.removeLast();
-            verbose_only( verbose_outputf("patching %p to %p", loopJump, SOT); )
-			nPatchBranch(loopJump, SOT);
-		}
-
-		NIns* fragEntry = 0;
-		
-		if (!error())
-		{
-			fragEntry = genPrologue();
-			verbose_only( outputAddr=true; )
-			verbose_only( asm_output("[prologue]"); )
-		}
-		
-		// something bad happened?
-		if (!error())
-		{
-			// check for resource leaks 
-			debug_only( 
-				for(uint32_t i=_activation.lowwatermark;i<_activation.highwatermark; i++) {
-					NanoAssertMsgf(_activation.entry[i] == 0, "frame entry %d wasn't freed",-4*i);
-				}
-			)
-
-            frag->fragEntry = fragEntry;
-			NIns* code = _nIns;
-#ifdef PERFM
-			_nvprof("code", codeBytes());  // requires that all pages are released between begin/endAssembly()otherwise we double count
+
+        // If we were accumulating debug info in the various ReverseListers,
+        // call finish() to emit whatever contents they have accumulated.
+        verbose_only(
+        if (pp_init)        pp_init->finish();
+        if (pp_after_sf)    pp_after_sf->finish();
+        )
+    }
+
+    void Assembler::endAssembly(Fragment* frag)
+    {
+        // don't try to patch code if we are in an error state since we might have partially
+        // overwritten the code cache already
+        if (error()) {
+            // something went wrong, release all allocated code memory
+            _codeAlloc.freeAll(codeList);
+            _codeAlloc.free(exitStart, exitEnd);
+            _codeAlloc.free(codeStart, codeEnd);
+            return;
+        }
+
+        NIns* fragEntry = genPrologue();
+        verbose_only( outputAddr=true; )
+        verbose_only( asm_output("[prologue]"); )
+
+        // check for resource leaks
+        debug_only(
+            for (uint32_t i = _activation.lowwatermark; i < _activation.tos; i++) {
+                NanoAssertMsgf(_activation.entry[i] == 0, "frame entry %d wasn't freed\n",-4*i);
+            }
+        )
+
+        // save used parts of current block on fragment's code list, free the rest
+#ifdef NANOJIT_ARM
+        // [codeStart, _nSlot) ... gap ... [_nIns, codeEnd)
+        _codeAlloc.addRemainder(codeList, exitStart, exitEnd, _nExitSlot, _nExitIns);
+        _codeAlloc.addRemainder(codeList, codeStart, codeEnd, _nSlot, _nIns);
+        verbose_only( exitBytes -= (_nExitIns - _nExitSlot) * sizeof(NIns); )
+        verbose_only( codeBytes -= (_nIns - _nSlot) * sizeof(NIns); )
+#else
+        // [codeStart ... gap ... [_nIns, codeEnd))
+        _codeAlloc.addRemainder(codeList, exitStart, exitEnd, exitStart, _nExitIns);
+        _codeAlloc.addRemainder(codeList, codeStart, codeEnd, codeStart, _nIns);
+        verbose_only( exitBytes -= (_nExitIns - exitStart) * sizeof(NIns); )
+        verbose_only( codeBytes -= (_nIns - codeStart) * sizeof(NIns); )
 #endif
-			// let the fragment manage the pages if we're using trees and there are branches
-			Page* manage = (_frago->core()->config.tree_opt) ? handoverPages() : 0;			
-			frag->setCode(code, manage); // root of tree should manage all pages
-			//fprintf(stderr, "endAssembly frag %X entry %X\n", (int)frag, (int)frag->fragEntry);
-		}
-		else
-		{
-			_nIns = _startingIns;  // in case of failure reset nIns ready for the next assembly run
-		}
-		
-		NanoAssertMsgf(error() || _fpuStkDepth == 0,"_fpuStkDepth %d",_fpuStkDepth);
-
-		internalReset();  // clear the reservation tables and regalloc
-		NanoAssert( !_branchStateMap || _branchStateMap->isEmpty());
-		_branchStateMap = 0;
-
-        // Tell Valgrind that new code has been generated, and it must flush
-        // any translations it has for the memory range generated into.
-        VALGRIND_DISCARD_TRANSLATIONS(pageTop(_nIns-1),     NJ_PAGE_SIZE);
-        VALGRIND_DISCARD_TRANSLATIONS(pageTop(_nExitIns-1), NJ_PAGE_SIZE);
-
-#ifdef AVMPLUS_ARM
-		// If we've modified the code, we need to flush so we don't end up trying 
-		// to execute junk
-# if defined(UNDER_CE)
-		FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
-# elif defined(AVMPLUS_UNIX)
-		for (int i = 0; i < 2; i++) {
-			Page *p = (i == 0) ? _nativePages : _nativeExitPages;
-
-			Page *first = p;
-			while (p) {
-				if (!p->next || p->next != p+1) {
-					__clear_cache((char*)first, (char*)(p+1));
-					first = p->next;
-				}
-				p = p->next;
-			}
-		}
-# endif
+
+        // at this point all our new code is in the d-cache and not the i-cache,
+        // so flush the i-cache on cpu's that need it.
+        _codeAlloc.flushICache(codeList);
+
+        // save entry point pointers
+        frag->fragEntry = fragEntry;
+        frag->setCode(_nIns);
+        PERFM_NVPROF("code", CodeAlloc::size(codeList));
+
+#ifdef NANOJIT_IA32
+        NanoAssertMsgf(_fpuStkDepth == 0,"_fpuStkDepth %d\n",_fpuStkDepth);
 #endif
 
-#ifdef AVMPLUS_SPARC
-        // Clear Instruction Cache
-        for (int i = 0; i < 2; i++) {
-            Page *p = (i == 0) ? _nativePages : _nativeExitPages;
+        debug_only( pageValidate(); )
+        NanoAssert(_branchStateMap.isEmpty());
+    }
+
+    void Assembler::releaseRegisters()
+    {
+        for (Register r = FirstReg; r <= LastReg; r = nextreg(r))
+        {
+            LIns *ins = _allocator.getActive(r);
+            if (ins)
+            {
+                // clear reg allocation, preserve stack allocation.
+                _allocator.retire(r);
+                NanoAssert(r == ins->getReg());
+                ins->setReg(UnknownReg);
 
-            Page *first = p;
-            while (p) {
-                if (!p->next || p->next != p+1) {
-                    sync_instruction_memory((char *)first, NJ_PAGE_SIZE);
-                    first = p->next;
+                if (!ins->getArIndex())
+                {
+                    ins->markAsClear();
                 }
-                p = p->next;
             }
         }
-#endif
-
-# ifdef AVMPLUS_PORTING_API
-		NanoJIT_PortAPI_FlushInstructionCache(_nIns, _startingIns);
-		NanoJIT_PortAPI_FlushInstructionCache(_nExitIns, _endJit2Addr);
-# endif
-	}
-	
-	void Assembler::copyRegisters(RegAlloc* copyTo)
-	{
-		*copyTo = _allocator;
-	}
-
-	void Assembler::releaseRegisters()
-	{
-		for (Register r = FirstReg; r <= LastReg; r = nextreg(r))
-		{
-			LIns *i = _allocator.getActive(r);
-			if (i)
-			{
-				// clear reg allocation, preserve stack allocation.
-				Reservation* resv = getresv(i);
-				NanoAssert(resv != 0);
-				_allocator.retire(r);
-				if (r == resv->reg)
-					resv->reg = UnknownReg;
-
-				if (!resv->arIndex && resv->reg == UnknownReg)
-				{
-					reserveFree(i);
-				}
-			}
-		}
-	}
+    }
 
 #ifdef PERFM
 #define countlir_live() _nvprof("lir-live",1)
@@ -1037,7 +847,6 @@ namespace nanojit
 #define countlir_label() _nvprof("lir-label",1)
 #define countlir_xcc() _nvprof("lir-xcc",1)
 #define countlir_x() _nvprof("lir-x",1)
-#define countlir_loop() _nvprof("lir-loop",1)
 #define countlir_call() _nvprof("lir-call",1)
 #else
 #define countlir_live()
@@ -1063,61 +872,104 @@ namespace nanojit
 #define countlir_label()
 #define countlir_xcc()
 #define countlir_x()
-#define countlir_loop()
 #define countlir_call()
 #endif
 
-	void Assembler::gen(LirFilter* reader,  NInsList& loopJumps)
-	{
-		// trace must end with LIR_x, LIR_loop, LIR_ret, or LIR_xtbl
-		NanoAssert(reader->pos()->isop(LIR_x) ||
-		           reader->pos()->isop(LIR_loop) ||
-		           reader->pos()->isop(LIR_ret) ||
-				   reader->pos()->isop(LIR_xtbl));
-		 
-		for (LInsp ins = reader->read(); ins != 0 && !error(); ins = reader->read())
-		{
-			LOpcode op = ins->opcode();			
-			switch(op)
-			{
-				default:
-					NanoAssertMsgf(false, "unsupported LIR instruction: %d (~0x40: %d)", op, op&~LIR64);
-					break;
+    void Assembler::gen(LirFilter* reader)
+    {
+        NanoAssert(_thisfrag->nStaticExits == 0);
 
-                case LIR_live: {
-                    countlir_live();
-                    pending_lives.add(ins->oprnd1());
+        // trace must end with LIR_x, LIR_[f]ret, LIR_xtbl, or LIR_[f]live
+        NanoAssert(reader->pos()->isop(LIR_x) ||
+                   reader->pos()->isop(LIR_ret) ||
+                   reader->pos()->isop(LIR_fret) ||
+                   reader->pos()->isop(LIR_xtbl) ||
+                   reader->pos()->isop(LIR_flive) ||
+                   reader->pos()->isop(LIR_live));
+
+        InsList pending_lives(alloc);
+
+        for (LInsp ins = reader->read(); !ins->isop(LIR_start) && !error();
+                                         ins = reader->read())
+        {
+            /* What's going on here: we're visiting all the LIR instructions
+               in the buffer, working strictly backwards in buffer-order, and
+               generating machine instructions for them as we go.
+
+               For each LIns, we first determine whether it's actually
+               necessary, and if not skip it.  Otherwise we generate code for
+               it.  There are two kinds of "necessary" instructions:
+
+               - "Statement" instructions, which have side effects.  Anything
+                 that could change control flow or the state of memory.
+
+               - "Value" or "expression" instructions, which compute a value
+                 based only on the operands to the instruction (and, in the
+                 case of loads, the state of memory).  Because we visit
+                 instructions in reverse order, if some previously visited
+                 instruction uses the value computed by this instruction, then
+                 this instruction will already have a register assigned to
+                 hold that value.  Hence we can consult the Reservation to
+                 detect whether the value is in fact used (i.e. not dead).
+
+              Note that the backwards code traversal can make register
+              allocation confusing.  (For example, we restore a value before
+              we spill it!)  In particular, words like "before" and "after"
+              must be used very carefully -- their meaning at regalloc-time is
+              opposite to their meaning at run-time.  We use the term
+              "pre-state" to refer to the register allocation state that
+              occurs prior to an instruction's execution, and "post-state" to
+              refer to the state that occurs after an instruction's execution,
+              e.g.:
+
+                pre-state:     ebx(ins)
+                instruction:   mov eax, ebx     // mov dst, src
+                post-state:    eax(ins)
+
+              At run-time, the instruction updates the pre-state into the
+              post-state (and these states are the real machine's states).
+              But when allocating registers, because we go backwards, the
+              pre-state is constructed from the post-state (and these states
+              are those stored in RegAlloc).
+            */
+            bool required = ins->isStmt() || ins->isUsed();
+            if (!required)
+                continue;
+
+            LOpcode op = ins->opcode();
+            switch(op)
+            {
+                default:
+                    NanoAssertMsgf(false, "unsupported LIR instruction: %d (~0x40: %d)\n", op, op&~LIR64);
                     break;
-                }
 
-                case LIR_ret:  {
-                    countlir_ret();
-                    if (_nIns != _epilogue) {
-                        JMP(_epilogue);
+                case LIR_regfence:
+                    evictAllActiveRegs();
+                    break;
+
+                case LIR_flive:
+                case LIR_live: {
+                    countlir_live();
+                    LInsp op1 = ins->oprnd1();
+                    // alloca's are meant to live until the point of the LIR_live instruction, marking
+                    // other expressions as live ensures that they remain so at loop bottoms.
+                    // alloca areas require special treatment because they are accessed indirectly and
+                    // the indirect accesses are invisible to the assembler, other than via LIR_live.
+                    // other expression results are only accessed directly in ways that are visible to
+                    // the assembler, so extending those expression's lifetimes past the last loop edge
+                    // isn't necessary.
+                    if (op1->isop(LIR_alloc)) {
+                        findMemFor(op1);
+                    } else {
+                        pending_lives.add(ins);
                     }
-                    assignSavedRegs();
-#ifdef NANOJIT_ARM
-                    // the epilogue moves R2 to R0; we may want to do this
-                    // after assignSavedRegs
-                    findSpecificRegFor(ins->oprnd1(), R2);
-#else
-                    findSpecificRegFor(ins->oprnd1(), retRegs[0]);
-#endif
                     break;
                 }
 
-                case LIR_fret: {
+                case LIR_fret:
+                case LIR_ret:  {
                     countlir_ret();
-                    if (_nIns != _epilogue) {
-                        JMP(_epilogue);
-                    }
-                    assignSavedRegs();
-#ifdef NANOJIT_IA32
-                    findSpecificRegFor(ins->oprnd1(), FST0);
-#else
-                    NanoAssert(false);
-#endif
-                    fpu_pop();
+                    asm_ret(ins);
                     break;
                 }
 
@@ -1125,184 +977,191 @@ namespace nanojit
                 // is the address of the stack space.
                 case LIR_alloc: {
                     countlir_alloc();
-                    Reservation *resv = getresv(ins);
-                    NanoAssert(resv->arIndex != 0);
-                    Register r = resv->reg;
-                    if (r != UnknownReg) {
-    			        _allocator.retire(r);
-                        resv->reg = UnknownReg;
-                        asm_restore(ins, resv, r);
+                    NanoAssert(ins->getArIndex() != 0);
+                    Register r = ins->getReg();
+                    if (isKnownReg(r)) {
+                        _allocator.retire(r);
+                        ins->setReg(UnknownReg);
+                        asm_restore(ins, ins->resv(), r);
                     }
                     freeRsrcOf(ins, 0);
                     break;
                 }
-				case LIR_short:
-				{
-                    countlir_imm();
-					asm_short(ins);
-					break;
-				}
-				case LIR_int:
-				{
+                case LIR_int:
+                {
                     countlir_imm();
-					asm_int(ins);
-					break;
-				}
-				case LIR_quad:
-				{
+                    asm_int(ins);
+                    break;
+                }
+                case LIR_float:
+                case LIR_quad:
+                {
                     countlir_imm();
-					asm_quad(ins);
-					break;
-				}
+                    asm_quad(ins);
+                    break;
+                }
 #if !defined NANOJIT_64BIT
-				case LIR_callh:
-				{
-					// return result of quad-call in register
-					prepResultReg(ins, rmask(retRegs[1]));
+                case LIR_callh:
+                {
+                    // return result of quad-call in register
+                    prepResultReg(ins, rmask(retRegs[1]));
                     // if hi half was used, we must use the call to ensure it happens
                     findSpecificRegFor(ins->oprnd1(), retRegs[0]);
-					break;
-				}
+                    break;
+                }
 #endif
-				case LIR_param:
-				{
+                case LIR_param:
+                {
                     countlir_param();
-					asm_param(ins);
-					break;
-				}
-				case LIR_qlo:
+                    asm_param(ins);
+                    break;
+                }
+                case LIR_qlo:
                 {
                     countlir_qlo();
-					asm_qlo(ins);
-					break;
-				}
-				case LIR_qhi:
-				{
+                    asm_qlo(ins);
+                    break;
+                }
+                case LIR_qhi:
+                {
                     countlir_qhi();
-					asm_qhi(ins);
-					break;
-				}
-				case LIR_qcmov:
-				case LIR_cmov:
-				{
+                    asm_qhi(ins);
+                    break;
+                }
+                case LIR_qcmov:
+                case LIR_cmov:
+                {
                     countlir_cmov();
-					asm_cmov(ins);
-					break;
-				}				
-				case LIR_ld:
-				case LIR_ldc:
-				case LIR_ldcb:
-				case LIR_ldcs:
-				{
+                    asm_cmov(ins);
+                    break;
+                }
+                case LIR_ld:
+                case LIR_ldc:
+                case LIR_ldcb:
+                case LIR_ldcs:
+                {
                     countlir_ld();
-					asm_ld(ins);
-					break;
-				}
-				case LIR_ldq:
-				case LIR_ldqc:
-				{
+                    asm_ld(ins);
+                    break;
+                }
+                case LIR_ldq:
+                case LIR_ldqc:
+                {
                     countlir_ldq();
-					asm_load64(ins);
-					break;
-				}
-				case LIR_neg:
-				case LIR_not:
-				{
+                    asm_load64(ins);
+                    break;
+                }
+                case LIR_neg:
+                case LIR_not:
+                {
                     countlir_alu();
-					asm_neg_not(ins);
-					break;
-				}
-				case LIR_qjoin:
-				{
+                    asm_neg_not(ins);
+                    break;
+                }
+                case LIR_qjoin:
+                {
                     countlir_qjoin();
                     asm_qjoin(ins);
-					break;
-				}
+                    break;
+                }
 
 #if defined NANOJIT_64BIT
                 case LIR_qiadd:
                 case LIR_qiand:
                 case LIR_qilsh:
+                case LIR_qursh:
+                case LIR_qirsh:
                 case LIR_qior:
+                case LIR_qaddp:
+                case LIR_qxor:
                 {
                     asm_qbinop(ins);
                     break;
                 }
 #endif
 
-				case LIR_add:
-				case LIR_addp:
-				case LIR_sub:
-				case LIR_mul:
-				case LIR_and:
-				case LIR_or:
-				case LIR_xor:
-				case LIR_lsh:
-				case LIR_rsh:
-				case LIR_ush:
-				{
+                case LIR_add:
+                case LIR_iaddp:
+                case LIR_sub:
+                case LIR_mul:
+                case LIR_and:
+                case LIR_or:
+                case LIR_xor:
+                case LIR_lsh:
+                case LIR_rsh:
+                case LIR_ush:
+                case LIR_div:
+                case LIR_mod:
+                {
                     countlir_alu();
-					asm_arith(ins);
-					break;
-				}
-				case LIR_fneg:
-				{
+                    asm_arith(ins);
+                    break;
+                }
+#ifndef NJ_SOFTFLOAT
+                case LIR_fneg:
+                {
                     countlir_fpu();
-					asm_fneg(ins);
-					break;
-				}
-				case LIR_fadd:
-				case LIR_fsub:
-				case LIR_fmul:
-				case LIR_fdiv:
-				{
+                    asm_fneg(ins);
+                    break;
+                }
+                case LIR_fadd:
+                case LIR_fsub:
+                case LIR_fmul:
+                case LIR_fdiv:
+                {
                     countlir_fpu();
-					asm_fop(ins);
+                    asm_fop(ins);
                     break;
-				}
-				case LIR_i2f:
-				{
+                }
+                case LIR_i2f:
+                {
                     countlir_fpu();
-					asm_i2f(ins);
-					break;
-				}
-				case LIR_u2f:
-				{
+                    asm_i2f(ins);
+                    break;
+                }
+                case LIR_u2f:
+                {
                     countlir_fpu();
-					asm_u2f(ins);
-					break;
-				}
-				case LIR_st:
-				case LIR_sti:
-				{
+                    asm_u2f(ins);
+                    break;
+                }
+                case LIR_i2q:
+                case LIR_u2q:
+                {
+                    countlir_alu();
+                    asm_promote(ins);
+                    break;
+                }
+#endif // NJ_SOFTFLOAT
+                case LIR_sti:
+                {
                     countlir_st();
-                    asm_store32(ins->oprnd1(), ins->immdisp(), ins->oprnd2());
+                    asm_store32(ins->oprnd1(), ins->disp(), ins->oprnd2());
                     break;
-				}
-				case LIR_stq:
-				case LIR_stqi:
-				{
+                }
+                case LIR_stqi:
+                {
                     countlir_stq();
-					LIns* value = ins->oprnd1();
-					LIns* base = ins->oprnd2();
-					int dr = ins->immdisp();
-					if (value->isop(LIR_qjoin)) 
-					{
-						// this is correct for little-endian only
-						asm_store32(value->oprnd1(), dr, base);
-						asm_store32(value->oprnd2(), dr+4, base);
-					}
-					else 
-					{
-						asm_store64(value, dr, base);
-					}
+                    LIns* value = ins->oprnd1();
+                    LIns* base = ins->oprnd2();
+                    int dr = ins->disp();
+                    if (value->isop(LIR_qjoin))
+                    {
+                        // this is correct for little-endian only
+                        asm_store32(value->oprnd1(), dr, base);
+                        asm_store32(value->oprnd2(), dr+4, base);
+                    }
+                    else
+                    {
+                        asm_store64(value, dr, base);
+                    }
                     break;
-				}
+                }
 
-				case LIR_j:
-				{
+                case LIR_j:
+                {
                     countlir_jmp();
-					LInsp to = ins->getTarget();
+                    LInsp to = ins->getTarget();
                     LabelState *label = _labels.get(to);
                     // the jump is always taken so whatever register state we
                     // have from downstream code, is irrelevant to code before
@@ -1316,8 +1175,7 @@ namespace nanojit
                     }
                     else {
                         // backwards jump
-                        hasLoop = true;
-                        handleLoopCarriedExprs();
+                        handleLoopCarriedExprs(pending_lives);
                         if (!label) {
                             // save empty register state at loop header
                             _labels.add(to, 0, _allocator);
@@ -1326,200 +1184,247 @@ namespace nanojit
                             intersectRegisterState(label->regs);
                         }
                         JMP(0);
-    					_patches.put(_nIns, to);
+                        _patches.put(_nIns, to);
                     }
-					break;
-				}
+                    break;
+                }
 
-				case LIR_jt:
-				case LIR_jf:
-				{
+                case LIR_jt:
+                case LIR_jf:
+                {
                     countlir_jcc();
-					LInsp to = ins->getTarget();
-					LIns* cond = ins->oprnd1();
+                    LInsp to = ins->getTarget();
+                    LIns* cond = ins->oprnd1();
                     LabelState *label = _labels.get(to);
                     if (label && label->addr) {
                         // forward jump to known label.  need to merge with label's register state.
                         unionRegisterState(label->regs);
-    					asm_branch(op == LIR_jf, cond, label->addr, false);
+                        asm_branch(op == LIR_jf, cond, label->addr);
                     }
                     else {
                         // back edge.
-                        hasLoop = true;
-                        handleLoopCarriedExprs();
+                        handleLoopCarriedExprs(pending_lives);
                         if (!label) {
                             // evict all registers, most conservative approach.
-                            evictRegs(~_allocator.free);
+                            evictAllActiveRegs();
                             _labels.add(to, 0, _allocator);
-                        } 
+                        }
                         else {
                             // evict all registers, most conservative approach.
                             intersectRegisterState(label->regs);
                         }
-                        NIns *branch = asm_branch(op == LIR_jf, cond, 0, false);
-			            _patches.put(branch,to);
+                        NIns *branch = asm_branch(op == LIR_jf, cond, 0);
+                        _patches.put(branch,to);
                     }
-					break;
-				}					
-				case LIR_label:
-				{
+                    break;
+                }
+                case LIR_label:
+                {
                     countlir_label();
                     LabelState *label = _labels.get(ins);
+                    // add profiling inc, if necessary.
+                    verbose_only( if (_logc->lcbits & LC_FragProfile) {
+                        if (ins == _thisfrag->loopLabel)
+                            asm_inc_m32(& _thisfrag->profCount);
+                    })
                     if (!label) {
                         // label seen first, normal target of forward jump, save addr & allocator
-    					_labels.add(ins, _nIns, _allocator);
+                        _labels.add(ins, _nIns, _allocator);
                     }
                     else {
                         // we're at the top of a loop
-                        hasLoop = true;
-                        NanoAssert(label->addr == 0 && label->regs.isValid());
-                        //evictRegs(~_allocator.free);
+                        NanoAssert(label->addr == 0);
+                        //evictAllActiveRegs();
                         intersectRegisterState(label->regs);
                         label->addr = _nIns;
                     }
-					verbose_only( if (_verbose) { outputAddr=true; asm_output("[%s]", _thisfrag->lirbuf->names->formatRef(ins)); } )
-					break;
-				}
-				case LIR_xbarrier: {
-					break;
-				}
+                    verbose_only( if (_logc->lcbits & LC_Assembly) { 
+                        outputAddr=true; asm_output("[%s]", 
+                        _thisfrag->lirbuf->names->formatRef(ins)); 
+                    })
+                    break;
+                }
+                case LIR_xbarrier: {
+                    break;
+                }
 #ifdef NANOJIT_IA32
-				case LIR_xtbl: {
+                case LIR_xtbl: {
                     NIns* exit = asm_exit(ins); // does intersectRegisterState()
-					asm_switch(ins, exit);
-					break;
-				}
+                    asm_switch(ins, exit);
+                    break;
+                }
 #else
- 			    case LIR_xtbl:
-					NanoAssertMsg(0, "Not supported for this architecture");
-					break;
+                 case LIR_xtbl:
+                    NanoAssertMsg(0, "Not supported for this architecture");
+                    break;
 #endif
                 case LIR_xt:
-				case LIR_xf:
-				{
+                case LIR_xf:
+                {
+                    verbose_only( _thisfrag->nStaticExits++; )
                     countlir_xcc();
-					// we only support cmp with guard right now, also assume it is 'close' and only emit the branch
+                    // we only support cmp with guard right now, also assume it is 'close' and only emit the branch
                     NIns* exit = asm_exit(ins); // does intersectRegisterState()
-					LIns* cond = ins->oprnd1();
-					asm_branch(op == LIR_xf, cond, exit, false);
-					break;
-				}
-				case LIR_x:
-				{
+                    LIns* cond = ins->oprnd1();
+                    asm_branch(op == LIR_xf, cond, exit);
+                    break;
+                }
+                case LIR_x:
+                {
+                    verbose_only( _thisfrag->nStaticExits++; )
                     countlir_x();
-		            verbose_only(verbose_output(""));
-					// generate the side exit branch on the main trace.
+                    // generate the side exit branch on the main trace.
                     NIns *exit = asm_exit(ins);
-					JMP( exit ); 
-					break;
-				}
-				case LIR_loop:
-				{
-                    countlir_loop();
-					asm_loop(ins, loopJumps);
-			        assignSavedRegs();
-			        assignParamRegs();
-					break;
-				}
-
-				case LIR_feq:
-				case LIR_fle:
-				case LIR_flt:
-				case LIR_fgt:
-				case LIR_fge:
-				{
+                    JMP( exit );
+                    break;
+                }
+
+#ifndef NJ_SOFTFLOAT
+                case LIR_feq:
+                case LIR_fle:
+                case LIR_flt:
+                case LIR_fgt:
+                case LIR_fge:
+                {
                     countlir_fpu();
-					asm_fcond(ins);
-					break;
-				}
-				case LIR_eq:
+                    asm_fcond(ins);
+                    break;
+                }
+#endif
+                case LIR_eq:
                 case LIR_ov:
-                case LIR_cs:
-				case LIR_le:
-				case LIR_lt:
-				case LIR_gt:
-				case LIR_ge:
-				case LIR_ult:
-				case LIR_ule:
-				case LIR_ugt:
-				case LIR_uge:
-				{
-                    countlir_alu();
-					asm_cond(ins);
-					break;
-				}
-				
-				case LIR_fcall:
-				case LIR_fcalli:
-#if defined NANOJIT_64BIT
-				case LIR_callh:
+                case LIR_le:
+                case LIR_lt:
+                case LIR_gt:
+                case LIR_ge:
+                case LIR_ult:
+                case LIR_ule:
+                case LIR_ugt:
+                case LIR_uge:
+#ifdef NANOJIT_64BIT
+                case LIR_qeq:
+                case LIR_qle:
+                case LIR_qlt:
+                case LIR_qgt:
+                case LIR_qge:
+                case LIR_qult:
+                case LIR_qule:
+                case LIR_qugt:
+                case LIR_quge:
 #endif
-				case LIR_call:
-				case LIR_calli:
-				{
+                {
+                    countlir_alu();
+                    asm_cond(ins);
+                    break;
+                }
+
+            #ifndef NJ_SOFTFLOAT
+                case LIR_fcall:
+            #endif
+            #ifdef NANOJIT_64BIT
+                case LIR_qcall:
+            #endif
+                case LIR_icall:
+                {
                     countlir_call();
                     Register rr = UnknownReg;
-                    if ((op&LIR64))
+#ifndef NJ_SOFTFLOAT
+                    if (op == LIR_fcall)
                     {
-                        // fcall or fcalli
-						Reservation* rR = getresv(ins);
-						rr = asm_prep_fcall(rR, ins);
+                        // fcall
+                        rr = asm_prep_fcall(getresv(ins), ins);
                     }
                     else
+#endif
                     {
                         rr = retRegs[0];
-						prepResultReg(ins, rmask(rr));
+                        prepResultReg(ins, rmask(rr));
                     }
 
-					// do this after we've handled the call result, so we dont
-					// force the call result to be spilled unnecessarily.
-
-					evictScratchRegs();
-
-					asm_call(ins);
-				}
-			}
-
-			if (error())
-				return;
-
-			// check that all is well (don't check in exit paths since its more complicated)
-			debug_only( pageValidate(); )
-			debug_only( resourceConsistencyCheck();  )
-		}
-	}
-
-	/*
-	 * Write a jump table for the given SwitchInfo and store the table
-	 * address in the SwitchInfo. Every entry will initially point to
-	 * target.
-	 */
-	void Assembler::emitJumpTable(SwitchInfo* si, NIns* target)
-	{
-		underrunProtect(si->count * sizeof(NIns*) + 20);
-		// Align for platform. The branch should be optimized away and is
-		// required to select the compatible int type.
-		if (sizeof(NIns*) == 8) {
-			_nIns = (NIns*) (uint64(_nIns) & ~7);
-		} else if (sizeof(NIns*) == 4) {
-		    _nIns = (NIns*) (uint32(_nIns) & ~3);
-		}
-		for (uint32_t i = 0; i < si->count; ++i) {
-			_nIns = (NIns*) (((uint8*) _nIns) - sizeof(NIns*));
-			*(NIns**) _nIns = target;
-		}
-		si->table = (NIns**) _nIns;
-	}
+                    // do this after we've handled the call result, so we dont
+                    // force the call result to be spilled unnecessarily.
+
+                    evictScratchRegs();
+
+                    asm_call(ins);
+                }
+            }
+
+#ifdef NJ_VERBOSE
+            // We have to do final LIR printing inside this loop.  If we do it
+            // before this loop, we we end up printing a lot of dead LIR
+            // instructions.
+            //
+            // We print the LIns after generating the code.  This ensures that
+            // the LIns will appear in debug output *before* the generated
+            // code, because Assembler::outputf() prints everything in reverse.
+            //
+            // Note that some live LIR instructions won't be printed.  Eg. an
+            // immediate won't be printed unless it is explicitly loaded into
+            // a register (as opposed to being incorporated into an immediate
+            // field in another machine instruction).
+            //
+            if (_logc->lcbits & LC_Assembly) {
+                LirNameMap* names = _thisfrag->lirbuf->names;
+                outputf("    %s", names->formatIns(ins));
+                if (ins->isGuard() && ins->oprnd1()) {
+                    // Special case: code is generated for guard conditions at
+                    // the same time that code is generated for the guard
+                    // itself.  If the condition is only used by the guard, we
+                    // must print it now otherwise it won't get printed.  So
+                    // we do print it now, with an explanatory comment.  If
+                    // the condition *is* used again we'll end up printing it
+                    // twice, but that's ok.
+                    outputf("    %s       # codegen'd with the %s",
+                            names->formatIns(ins->oprnd1()), lirNames[op]);
+
+                } else if (ins->isop(LIR_cmov) || ins->isop(LIR_qcmov)) {
+                    // Likewise for cmov conditions.
+                    outputf("    %s       # codegen'd with the %s",
+                            names->formatIns(ins->oprnd1()), lirNames[op]);
+
+                } else if (ins->isop(LIR_mod)) {
+                    // There's a similar case when a div feeds into a mod.
+                    outputf("    %s       # codegen'd with the mod",
+                            names->formatIns(ins->oprnd1()));
+                }
+            }
+#endif
+
+            if (error())
+                return;
+
+            // check that all is well (don't check in exit paths since its more complicated)
+            debug_only( pageValidate(); )
+            debug_only( resourceConsistencyCheck();  )
+        }
+    }
+
+    /*
+     * Write a jump table for the given SwitchInfo and store the table
+     * address in the SwitchInfo. Every entry will initially point to
+     * target.
+     */
+    void Assembler::emitJumpTable(SwitchInfo* si, NIns* target)
+    {
+        underrunProtect(si->count * sizeof(NIns*) + 20);
+        _nIns = reinterpret_cast<NIns*>(uintptr_t(_nIns) & ~(sizeof(NIns*) - 1));
+        for (uint32_t i = 0; i < si->count; ++i) {
+            _nIns = (NIns*) (((intptr_t) _nIns) - sizeof(NIns*));
+            *(NIns**) _nIns = target;
+        }
+        si->table = (NIns**) _nIns;
+    }
 
     void Assembler::assignSavedRegs()
     {
         // restore saved regs
-		releaseRegisters();
+        releaseRegisters();
         LirBuffer *b = _thisfrag->lirbuf;
         for (int i=0, n = NumSavedRegs; i < n; i++) {
             LIns *p = b->savedRegs[i];
             if (p)
-                findSpecificRegFor(p, savedRegs[p->imm8()]);
+                findSpecificRegFor(p, savedRegs[p->paramArg()]);
         }
     }
 
@@ -1538,23 +1443,35 @@ namespace nanojit
     {
         LInsp state = _thisfrag->lirbuf->state;
         if (state)
-            findSpecificRegFor(state, argRegs[state->imm8()]); 
+            findSpecificRegFor(state, argRegs[state->paramArg()]);
         LInsp param1 = _thisfrag->lirbuf->param1;
         if (param1)
-            findSpecificRegFor(param1, argRegs[param1->imm8()]);
+            findSpecificRegFor(param1, argRegs[param1->paramArg()]);
     }
-    
-    void Assembler::handleLoopCarriedExprs()
+
+    void Assembler::handleLoopCarriedExprs(InsList& pending_lives)
     {
         // ensure that exprs spanning the loop are marked live at the end of the loop
         reserveSavedRegs();
-        for (int i=0, n=pending_lives.size(); i < n; i++) {
-            findMemFor(pending_lives[i]);
+        for (Seq<LIns*> *p = pending_lives.get(); p != NULL; p = p->tail) {
+            LIns *i = p->head;
+            NanoAssert(i->isop(LIR_live) || i->isop(LIR_flive));
+            LIns *op1 = i->oprnd1();
+            if (op1->isconst() || op1->isconstf() || op1->isconstq())
+                findMemFor(op1);
+            else
+                findRegFor(op1, i->isop(LIR_flive) ? FpRegs : GpRegs);
         }
+
+        // clear this list since we have now dealt with those lifetimes.  extending
+        // their lifetimes again later (earlier in the code) serves no purpose.
+        pending_lives.clear();
     }
 
-	void Assembler::arFree(uint32_t idx)
-	{
+    void Assembler::arFree(uint32_t idx)
+    {
+        verbose_only( printActivationState(" >FP"); )
+
         AR &ar = _activation;
         LIns *i = ar.entry[idx];
         NanoAssert(i != 0);
@@ -1562,55 +1479,47 @@ namespace nanojit
             ar.entry[idx] = 0;
             idx--;
         } while (ar.entry[idx] == i);
-	}
+    }
 
 #ifdef NJ_VERBOSE
-	void Assembler::printActivationState()
-	{
-		bool verbose_activation = false;
-		if (!verbose_activation)
-			return;
-			
-#ifdef NANOJIT_ARM
-		// @todo Why is there here?!?  This routine should be indep. of platform
-		verbose_only(
-			if (_verbose) {
-				char* s = &outline[0];
-				memset(s, ' ', 51);  s[51] = '\0';
-				s += strlen(s);
-				sprintf(s, " SP ");
-				s += strlen(s);
-				for(uint32_t i=_activation.lowwatermark; i<_activation.tos;i++) {
-					LInsp ins = _activation.entry[i];
-					if (ins && ins !=_activation.entry[i+1]) {
-						sprintf(s, "%d(%s) ", 4*i, _thisfrag->lirbuf->names->formatRef(ins));
-						s += strlen(s);
-					}
-				}
-				output(&outline[0]);
-			}
-		)
-#else
-		verbose_only(
-			char* s = &outline[0];
-			if (_verbose) {
-				memset(s, ' ', 51);  s[51] = '\0';
-				s += strlen(s);
-				sprintf(s, " ebp ");
-				s += strlen(s);
-
-				for(uint32_t i=_activation.lowwatermark; i<_activation.tos;i++) {
-					LInsp ins = _activation.entry[i];
-					if (ins) {
-						sprintf(s, "%d(%s) ", -4*i,_thisfrag->lirbuf->names->formatRef(ins));
-						s += strlen(s);
-					}
-				}
-				output(&outline[0]);
-			}
-		)
-#endif
-	}
+    void Assembler::printActivationState(const char* what)
+    {
+        if (!(_logc->lcbits & LC_Activation))
+            return;
+
+        char* s = &outline[0];
+        VMPI_memset(s, ' ', 45);  s[45] = '\0';
+        s += VMPI_strlen(s);
+        VMPI_sprintf(s, "%s", what);
+        s += VMPI_strlen(s);
+
+        int32_t max = _activation.tos < NJ_MAX_STACK_ENTRY ? _activation.tos : NJ_MAX_STACK_ENTRY;
+        for(int32_t i = _activation.lowwatermark; i < max; i++) {
+            LIns *ins = _activation.entry[i];
+            if (ins) {
+                const char* n = _thisfrag->lirbuf->names->formatRef(ins);
+                if (ins->isop(LIR_alloc)) {
+                    int32_t count = ins->size()>>2;
+                    VMPI_sprintf(s," %d-%d(%s)", 4*i, 4*(i+count-1), n);
+                    count += i-1;
+                    while (i < count) {
+                        NanoAssert(_activation.entry[i] == ins);
+                        i++;
+                    }
+                }
+                else if (ins->isQuad()) {
+                    VMPI_sprintf(s," %d+(%s)", 4*i, n);
+                    NanoAssert(_activation.entry[i+1] == ins);
+                    i++;
+                }
+                else {
+                    VMPI_sprintf(s," %d(%s)", 4*i, n);
+                }
+            }
+            s += VMPI_strlen(s);
+        }
+        output(&outline[0]);
+    }
 #endif
 
     bool canfit(int32_t size, int32_t loc, AR &ar) {
@@ -1620,18 +1529,16 @@ namespace nanojit
         }
         return true;
     }
-	
-	uint32_t Assembler::arReserve(LIns* l)
-	{
-		NanoAssert(!l->isTramp());
 
-		//verbose_only(printActivationState());
-        int32_t size = l->isop(LIR_alloc) ? (l->size()>>2) : l->isQuad() ? 2 : sizeof(intptr_t)>>2;
+    uint32_t Assembler::arReserve(LIns* l)
+    {
+        int32_t size = l->isop(LIR_alloc) ? (l->size()>>2) : l->isQuad() ? 2 : 1;
         AR &ar = _activation;
-		const int32_t tos = ar.tos;
-		int32_t start = ar.lowwatermark;
-		int32_t i = 0;
-		NanoAssert(start>0);
+        const int32_t tos = ar.tos;
+        int32_t start = ar.lowwatermark;
+        int32_t i = 0;
+        NanoAssert(start>0);
+        verbose_only( printActivationState(" <FP"); )
 
         if (size == 1) {
             // easy most common case -- find a hole, or make the frame bigger
@@ -1644,64 +1551,64 @@ namespace nanojit
             }
         }
         else if (size == 2) {
-			if ( (start&1)==1 ) start++;  // even 8 boundary
-			for (i=start; i < NJ_MAX_STACK_ENTRY; i+=2) {
+            if ( (start&1)==1 ) start++;  // even 8 boundary
+            for (i=start; i < NJ_MAX_STACK_ENTRY; i+=2) {
                 if ( (ar.entry[i+stack_direction(1)] == 0) && (i==tos || (ar.entry[i] == 0)) ) {
                     // found 2 adjacent aligned slots
-                    NanoAssert(_activation.entry[i] == 0);
-                    NanoAssert(_activation.entry[i+stack_direction(1)] == 0);
+                    NanoAssert(ar.entry[i] == 0);
+                    NanoAssert(ar.entry[i+stack_direction(1)] == 0);
                     ar.entry[i] = l;
                     ar.entry[i+stack_direction(1)] = l;
-                    break;   
+                    break;
                 }
-			}
-		}
+            }
+        }
         else {
             // alloc larger block on 8byte boundary.
             if (start < size) start = size;
             if ((start&1)==1) start++;
             for (i=start; i < NJ_MAX_STACK_ENTRY; i+=2) {
                 if (canfit(size, i, ar)) {
-		            // place the entry in the table and mark the instruction with it
+                    // place the entry in the table and mark the instruction with it
                     for (int32_t j=0; j < size; j++) {
-                        NanoAssert(_activation.entry[i+stack_direction(j)] == 0);
-                        _activation.entry[i+stack_direction(j)] = l;
+                        NanoAssert(ar.entry[i+stack_direction(j)] == 0);
+                        ar.entry[i+stack_direction(j)] = l;
                     }
                     break;
                 }
             }
-		}
+        }
         if (i >= (int32_t)ar.tos) {
-            ar.tos = ar.highwatermark = i+1;
+            ar.tos = i+1;
+        }
+        if (tos+size >= NJ_MAX_STACK_ENTRY) {
+            setError(StackFull);
         }
-		if (tos+size >= NJ_MAX_STACK_ENTRY) {	
-			setError(StackFull);
-		}
         return i;
-	}
+    }
 
     /**
      * move regs around so the SavedRegs contains the highest priority regs.
      */
     void Assembler::evictScratchRegs()
     {
-		// find the top GpRegs that are candidates to put in SavedRegs
+        // find the top GpRegs that are candidates to put in SavedRegs
 
         // tosave is a binary heap stored in an array.  the root is tosave[0],
-        // left child is at i+1, right child is at i+2.  
+        // left child is at i+1, right child is at i+2.
 
         Register tosave[LastReg-FirstReg+1];
         int len=0;
         RegAlloc *regs = &_allocator;
         for (Register r = FirstReg; r <= LastReg; r = nextreg(r)) {
-			if (rmask(r) & GpRegs) {
-				LIns *i = regs->getActive(r);
-				if (i) {
-					if (canRemat(i)) {
-						evict(r);
-					}
-					else {
-						int32_t pri = regs->getPriority(r);
+            if (rmask(r) & GpRegs) {
+                LIns *i = regs->getActive(r);
+                if (i) {
+                    if (canRemat(i)) {
+                        evict(r, i);
+                    }
+                    else {
+                        int32_t pri = regs->getPriority(r);
                         // add to heap by adding to end and bubbling up
                         int j = len++;
                         while (j > 0 && pri > regs->getPriority(tosave[j/2])) {
@@ -1710,13 +1617,13 @@ namespace nanojit
                         }
                         NanoAssert(size_t(j) < sizeof(tosave)/sizeof(tosave[0]));
                         tosave[j] = r;
-					}
-				}
+                    }
+                }
             }
         }
 
-        // now primap has the live exprs in priority order.  
-		// allocate each of the top priority exprs to a SavedReg
+        // now primap has the live exprs in priority order.
+        // allocate each of the top priority exprs to a SavedReg
 
         RegisterMask allow = SavedRegs;
         while (allow && len > 0) {
@@ -1725,7 +1632,7 @@ namespace nanojit
             if (!(rmask(hi) & SavedRegs)) {
                 LIns *i = regs->getActive(hi);
                 Register r = findRegFor(i, allow);
-			    allow &= ~rmask(r);
+                allow &= ~rmask(r);
             }
             else {
                 // hi is already in a saved reg, leave it alone.
@@ -1749,236 +1656,265 @@ namespace nanojit
             }
         }
 
-		// now evict everything else.
-		evictRegs(~SavedRegs);
+        // now evict everything else.
+        evictSomeActiveRegs(~SavedRegs);
     }
 
-	void Assembler::evictRegs(RegisterMask regs)
-	{
-		// generate code to restore callee saved registers 
-		// @todo speed this up
+    void Assembler::evictAllActiveRegs()
+    {
+        // generate code to restore callee saved registers
+        // @todo speed this up
         for (Register r = FirstReg; r <= LastReg; r = nextreg(r)) {
-            if ((rmask(r) & regs) && _allocator.getActive(r)) {
-				evict(r);
+            evictIfActive(r);
+        }
+    }
+
+    void Assembler::evictSomeActiveRegs(RegisterMask regs)
+    {
+        // generate code to restore callee saved registers
+        // @todo speed this up
+        for (Register r = FirstReg; r <= LastReg; r = nextreg(r)) {
+            if ((rmask(r) & regs)) {
+                evictIfActive(r);
             }
-		}
-	}
-	
-	/**
-	 * Merge the current state of the registers with a previously stored version
+        }
+    }
+
+    /**
+     * Merge the current state of the registers with a previously stored version
      * current == saved    skip
      * current & saved     evict current, keep saved
      * current & !saved    evict current  (unionRegisterState would keep)
      * !current & saved    keep saved
-	 */
-	void Assembler::intersectRegisterState(RegAlloc& saved)
-	{
-		// evictions and pops first
-		RegisterMask skip = 0;
-		verbose_only(bool shouldMention=false; )
-		for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
-		{
-			LIns * curins = _allocator.getActive(r);
-			LIns * savedins = saved.getActive(r);
-			if (curins == savedins)
-			{
-				//verbose_only( if (curins) verbose_outputf("                                              skip %s", regNames[r]); )
-				skip |= rmask(r);
-			}
-			else 
-			{
+     */
+    void Assembler::intersectRegisterState(RegAlloc& saved)
+    {
+        // evictions and pops first
+        RegisterMask skip = 0;
+        verbose_only(bool shouldMention=false; )
+        for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
+        {
+            LIns * curins = _allocator.getActive(r);
+            LIns * savedins = saved.getActive(r);
+            if (curins == savedins)
+            {
+                //verbose_only( if (curins) verbose_outputf("                                              skip %s", regNames[r]); )
+                skip |= rmask(r);
+            }
+            else
+            {
                 if (curins) {
                     //_nvprof("intersect-evict",1);
-					verbose_only( shouldMention=true; )
-					evict(r);
+                    verbose_only( shouldMention=true; )
+                    evict(r, curins);
+                }
+
+                #ifdef NANOJIT_IA32
+                if (savedins && (rmask(r) & x87Regs)) {
+                    verbose_only( shouldMention=true; )
+                    FSTP(r);
                 }
-				
-    			#ifdef NANOJIT_IA32
-				if (savedins && (rmask(r) & x87Regs)) {
-					verbose_only( shouldMention=true; )
-					FSTP(r);
-				}
-				#endif
-			}
-		}
+                #endif
+            }
+        }
         assignSaved(saved, skip);
-		verbose_only( if (shouldMention) verbose_outputf("                                              merging registers (intersect) with existing edge");  )
-	}
+        verbose_only(
+            if (shouldMention)
+                verbose_outputf("## merging registers (intersect) "
+                                "with existing edge");
+        )
+    }
 
-	/**
-	 * Merge the current state of the registers with a previously stored version.
-     * 
+    /**
+     * Merge the current state of the registers with a previously stored version.
+     *
      * current == saved    skip
      * current & saved     evict current, keep saved
      * current & !saved    keep current (intersectRegisterState would evict)
      * !current & saved    keep saved
-	 */
-	void Assembler::unionRegisterState(RegAlloc& saved)
-	{
-		// evictions and pops first
-		verbose_only(bool shouldMention=false; )
-		RegisterMask skip = 0;
-		for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
-		{
-			LIns * curins = _allocator.getActive(r);
-			LIns * savedins = saved.getActive(r);
-			if (curins == savedins)
-			{
-				//verbose_only( if (curins) verbose_outputf("                                              skip %s", regNames[r]); )
-				skip |= rmask(r);
-			}
-			else 
-			{
+     */
+    void Assembler::unionRegisterState(RegAlloc& saved)
+    {
+        // evictions and pops first
+        verbose_only(bool shouldMention=false; )
+        RegisterMask skip = 0;
+        for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
+        {
+            LIns * curins = _allocator.getActive(r);
+            LIns * savedins = saved.getActive(r);
+            if (curins == savedins)
+            {
+                //verbose_only( if (curins) verbose_outputf("                                              skip %s", regNames[r]); )
+                skip |= rmask(r);
+            }
+            else
+            {
                 if (curins && savedins) {
                     //_nvprof("union-evict",1);
-					verbose_only( shouldMention=true; )
-					evict(r);
+                    verbose_only( shouldMention=true; )
+                    evict(r, curins);
                 }
-				
-    			#ifdef NANOJIT_IA32
-				if (rmask(r) & x87Regs) {
-					if (savedins) {
-						FSTP(r);
-					}
-					else {
-						// saved state did not have fpu reg allocated,
-						// so we must evict here to keep x87 stack balanced.
-						evict(r);
-					}
-					verbose_only( shouldMention=true; )
-				}
-				#endif
-			}
-		}
+
+                #ifdef NANOJIT_IA32
+                if (rmask(r) & x87Regs) {
+                    if (savedins) {
+                        FSTP(r);
+                    }
+                    else {
+                        // saved state did not have fpu reg allocated,
+                        // so we must evict here to keep x87 stack balanced.
+                        evictIfActive(r);
+                    }
+                    verbose_only( shouldMention=true; )
+                }
+                #endif
+            }
+        }
         assignSaved(saved, skip);
-		verbose_only( if (shouldMention) verbose_outputf("                                              merging registers (union) with existing edge");  )
+        verbose_only( if (shouldMention) verbose_outputf("                                              merging registers (union) with existing edge");  )
     }
 
     void Assembler::assignSaved(RegAlloc &saved, RegisterMask skip)
     {
-		// now reassign mainline registers
-		for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
-		{
-			LIns *i = saved.getActive(r);
-			if (i && !(skip&rmask(r)))
-				findSpecificRegFor(i, r);
-		}
-		debug_only(saved.used = 0);  // marker that we are no longer in exit path
-	}
-	
-	void Assembler::setCallTable(const CallInfo* functions)
-	{
-		_functions = functions;
-	}
-
-	#ifdef NJ_VERBOSE
-		char Assembler::outline[8192];
-		char Assembler::outlineEOL[512];
-
-		void Assembler::outputForEOL(const char* format, ...)
-		{
-			va_list args;
-			va_start(args, format);
-			outlineEOL[0] = '\0';
-			vsprintf(outlineEOL, format, args);
-		}
-
-		void Assembler::outputf(const char* format, ...)
-		{
-			va_list args;
-			va_start(args, format);
-			outline[0] = '\0';
-			vsprintf(outline, format, args);
-			output(outline);
-		}
-
-		void Assembler::output(const char* s)
-		{
-			if (_outputCache)
-			{
-				char* str = (char*)_gc->Alloc(strlen(s)+1);
-				strcpy(str, s);
-				_outputCache->add(str);
-			}
-			else
-			{
-				_frago->core()->console << s << "\n";
-			}
-		}
-
-		void Assembler::output_asm(const char* s)
-		{
-			if (!verbose_enabled())
-				return;
-				output(s);
-		}
-
-		char* Assembler::outputAlign(char *s, int col) 
-		{
-			int len = strlen(s);
-			int add = ((col-len)>0) ? col-len : 1;
-			memset(&s[len], ' ', add);
-			s[col] = '\0';
-			return &s[col];
-		}
-	#endif // verbose
-
-	#endif /* FEATURE_NANOJIT */
-
-#if defined(FEATURE_NANOJIT) || defined(NJ_VERBOSE)
-	uint32_t CallInfo::_count_args(uint32_t mask) const
-	{
-		uint32_t argc = 0;
-		uint32_t argt = _argtypes;
-		for (uint32_t i = 0; i < MAXARGS; ++i) {
-			argt >>= 2;
+        // now reassign mainline registers
+        for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
+        {
+            LIns *i = saved.getActive(r);
+            if (i && !(skip&rmask(r)))
+                findSpecificRegFor(i, r);
+        }
+    }
+
+    // Scan table for instruction with the lowest priority, meaning it is used
+    // furthest in the future.
+    LIns* Assembler::findVictim(RegisterMask allow)
+    {
+        NanoAssert(allow != 0);
+        LIns *i, *a=0;
+        int allow_pri = 0x7fffffff;
+        for (Register r=FirstReg; r <= LastReg; r = nextreg(r))
+        {
+            if ((allow & rmask(r)) && (i = _allocator.getActive(r)) != 0)
+            {
+                int pri = canRemat(i) ? 0 : _allocator.getPriority(r);
+                if (!a || pri < allow_pri) {
+                    a = i;
+                    allow_pri = pri;
+                }
+            }
+        }
+        NanoAssert(a != 0);
+        return a;
+    }
+
+#ifdef NJ_VERBOSE
+    // "outline" must be able to hold the output line in addition to the
+    // outlineEOL buffer, which is concatenated onto outline just before it
+    // is printed.
+    char Assembler::outline[8192];
+    char Assembler::outlineEOL[512];
+
+    void Assembler::outputForEOL(const char* format, ...)
+    {
+        va_list args;
+        va_start(args, format);
+        outlineEOL[0] = '\0';
+        vsprintf(outlineEOL, format, args);
+    }
+
+    void Assembler::outputf(const char* format, ...)
+    {
+        va_list     args;
+        va_start(args, format);
+        outline[0] = '\0';
+
+        // Format the output string and remember the number of characters
+        // that were written.
+        uint32_t outline_len = vsprintf(outline, format, args);
+
+        // Add the EOL string to the output, ensuring that we leave enough
+        // space for the terminating NULL character, then reset it so it
+        // doesn't repeat on the next outputf.
+        VMPI_strncat(outline, outlineEOL, sizeof(outline)-(outline_len+1));
+        outlineEOL[0] = '\0';
+
+        output(outline);
+    }
+
+    void Assembler::output(const char* s)
+    {
+        if (_outputCache)
+        {
+            char* str = new (alloc) char[VMPI_strlen(s)+1];
+            VMPI_strcpy(str, s);
+            _outputCache->insert(str);
+        }
+        else
+        {
+            _logc->printf("%s\n", s);
+        }
+    }
+
+    void Assembler::output_asm(const char* s)
+    {
+        if (!(_logc->lcbits & LC_Assembly))
+            return;
+
+        // Add the EOL string to the output, ensuring that we leave enough
+        // space for the terminating NULL character, then reset it so it
+        // doesn't repeat on the next outputf.
+        VMPI_strncat(outline, outlineEOL, sizeof(outline)-(strlen(outline)+1));
+        outlineEOL[0] = '\0';
+
+        output(s);
+    }
+
+    char* Assembler::outputAlign(char *s, int col)
+    {
+        int len = (int)VMPI_strlen(s);
+        int add = ((col-len)>0) ? col-len : 1;
+        VMPI_memset(&s[len], ' ', add);
+        s[col] = '\0';
+        return &s[col];
+    }
+#endif // NJ_VERBOSE
+
+    uint32_t CallInfo::_count_args(uint32_t mask) const
+    {
+        uint32_t argc = 0;
+        uint32_t argt = _argtypes;
+        for (uint32_t i = 0; i < MAXARGS; ++i) {
+            argt >>= ARGSIZE_SHIFT;
             if (!argt)
                 break;
-			argc += (argt & mask) != 0;
-		}
-		return argc;
-	}
+            argc += (argt & mask) != 0;
+        }
+        return argc;
+    }
 
     uint32_t CallInfo::get_sizes(ArgSize* sizes) const
     {
-		uint32_t argt = _argtypes;
-		uint32_t argc = 0;
-		for (uint32_t i = 0; i < MAXARGS; i++) {
-			argt >>= 2;
-			ArgSize a = ArgSize(argt&3);
+        uint32_t argt = _argtypes;
+        uint32_t argc = 0;
+        for (uint32_t i = 0; i < MAXARGS; i++) {
+            argt >>= ARGSIZE_SHIFT;
+            ArgSize a = ArgSize(argt & ARGSIZE_MASK_ANY);
             if (a != ARGSIZE_NONE) {
                 sizes[argc++] = a;
             } else {
                 break;
             }
-		}
-        if (isIndirect()) {
-            // add one more arg for indirect call address
-            argc++;
         }
         return argc;
     }
 
     void LabelStateMap::add(LIns *label, NIns *addr, RegAlloc &regs) {
-        LabelState *st = NJ_NEW(gc, LabelState)(addr, regs);
+        LabelState *st = new (alloc) LabelState(addr, regs);
         labels.put(label, st);
     }
 
-    LabelStateMap::~LabelStateMap() {
-        clear();
-    }
-
-    void LabelStateMap::clear() {
-        LabelState *st;
-
-        while (!labels.isEmpty()) {
-            st = labels.removeLast();
-            delete st;
-        }
-    }
-
     LabelState* LabelStateMap::get(LIns *label) {
         return labels.get(label);
     }
 }
-#endif // FEATURE_NANOJIT
+#endif /* FEATURE_NANOJIT */