[apple/javascriptcore.git] / dfg / DFGFixupPhase.cpp

/*
 * Copyright (C) 2012 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGFixupPhase.h"

#if ENABLE(DFG_JIT)

#include "DFGGraph.h"
#include "DFGInsertionSet.h"
#include "DFGPhase.h"

namespace JSC { namespace DFG {

class FixupPhase : public Phase {
public:
    FixupPhase(Graph& graph)
        : Phase(graph, "fixup")
    {
    }
    
    void run()
    {
        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)
            fixupBlock(m_graph.m_blocks[blockIndex].get());
    }

private:
    void fixupBlock(BasicBlock* block)
    {
        for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
            m_compileIndex = block->at(m_indexInBlock);
            fixupNode(m_graph[m_compileIndex]);
        }
        m_insertionSet.execute(*block);
    }
    
    void fixupNode(Node& node)
    {
        if (!node.shouldGenerate())
            return;
        
        NodeType op = node.op();

#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("   %s @%u: ", Graph::opName(op), m_compileIndex);
#endif
        
        switch (op) {
        case GetById: {
            if (!isInt32Prediction(m_graph[m_compileIndex].prediction()))
                break;
            if (codeBlock()->identifier(node.identifierNumber()) != globalData().propertyNames->length)
                break;
            bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
            bool isString = isStringPrediction(m_graph[node.child1()].prediction());
            bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
            bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
            bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
            bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
            bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
            bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
            bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
            bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
            bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
            if (!isArray && !isString && !isInt8Array && !isInt16Array && !isInt32Array && !isUint8Array && !isUint8ClampedArray && !isUint16Array && !isUint32Array && !isFloat32Array && !isFloat64Array)
                break;
            
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
#endif
            if (isArray)
                node.setOp(GetArrayLength);
            else if (isString)
                node.setOp(GetStringLength);
            else if (isInt8Array)
                node.setOp(GetInt8ArrayLength);
            else if (isInt16Array)
                node.setOp(GetInt16ArrayLength);
            else if (isInt32Array)
                node.setOp(GetInt32ArrayLength);
            else if (isUint8Array)
                node.setOp(GetUint8ArrayLength);
            else if (isUint8ClampedArray)
                node.setOp(GetUint8ClampedArrayLength);
            else if (isUint16Array)
                node.setOp(GetUint16ArrayLength);
            else if (isUint32Array)
                node.setOp(GetUint32ArrayLength);
            else if (isFloat32Array)
                node.setOp(GetFloat32ArrayLength);
            else if (isFloat64Array)
                node.setOp(GetFloat64ArrayLength);
            else
                ASSERT_NOT_REACHED();
            // No longer MustGenerate
            ASSERT(node.flags() & NodeMustGenerate);
            node.clearFlags(NodeMustGenerate);
            m_graph.deref(m_compileIndex);
            break;
        }
        case GetIndexedPropertyStorage: {
            PredictedType basePrediction = m_graph[node.child2()].prediction();
            if (!(basePrediction & PredictInt32) && basePrediction) {
                node.setOpAndDefaultFlags(Nop);
                m_graph.clearAndDerefChild1(node);
                m_graph.clearAndDerefChild2(node);
                m_graph.clearAndDerefChild3(node);
                node.setRefCount(0);
            }
            break;
        }
        case GetByVal:
        case StringCharAt:
        case StringCharCodeAt: {
            if (!!node.child3() && m_graph[node.child3()].op() == Nop)
                node.children.child3() = Edge();
            break;
        }
            
        case ValueToInt32: {
            if (m_graph[node.child1()].shouldSpeculateNumber()) {
                node.clearFlags(NodeMustGenerate);
                m_graph.deref(m_compileIndex);
            }
            break;
        }
            
        case BitAnd:
        case BitOr:
        case BitXor:
        case BitRShift:
        case BitLShift:
        case BitURShift: {
            fixIntEdge(node.children.child1());
            fixIntEdge(node.children.child2());
            break;
        }
            
        case CompareEq:
        case CompareLess:
        case CompareLessEq:
        case CompareGreater:
        case CompareGreaterEq:
        case CompareStrictEq: {
            if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()]))
                break;
            if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
                break;
            fixDoubleEdge(0);
            fixDoubleEdge(1);
            break;
        }
            
        case LogicalNot: {
            if (m_graph[node.child1()].shouldSpeculateInteger())
                break;
            if (!m_graph[node.child1()].shouldSpeculateNumber())
                break;
            fixDoubleEdge(0);
            break;
        }
            
        case Branch: {
            if (!m_graph[node.child1()].shouldSpeculateInteger()
                && m_graph[node.child1()].shouldSpeculateNumber())
                fixDoubleEdge(0);

            Node& myNode = m_graph[m_compileIndex]; // reload because the graph may have changed
            Edge logicalNotEdge = myNode.child1();
            Node& logicalNot = m_graph[logicalNotEdge];
            if (logicalNot.op() == LogicalNot
                && logicalNot.adjustedRefCount() == 1) {
                Edge newChildEdge = logicalNot.child1();
                if (m_graph[newChildEdge].hasBooleanResult()) {
                    m_graph.ref(newChildEdge);
                    m_graph.deref(logicalNotEdge);
                    myNode.children.setChild1(newChildEdge);
                    
                    BlockIndex toBeTaken = myNode.notTakenBlockIndex();
                    BlockIndex toBeNotTaken = myNode.takenBlockIndex();
                    myNode.setTakenBlockIndex(toBeTaken);
                    myNode.setNotTakenBlockIndex(toBeNotTaken);
                }
            }
            break;
        }
            
        case SetLocal: {
            if (m_graph.isCaptured(node.local()))
                break;
            if (!node.variableAccessData()->shouldUseDoubleFormat())
                break;
            fixDoubleEdge(0);
            break;
        }
            
        case ArithAdd:
        case ValueAdd: {
            if (m_graph.addShouldSpeculateInteger(node))
                break;
            if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
                break;
            fixDoubleEdge(0);
            fixDoubleEdge(1);
            break;
        }
            
        case ArithSub: {
            if (m_graph.addShouldSpeculateInteger(node)
                && node.canSpeculateInteger())
                break;
            fixDoubleEdge(0);
            fixDoubleEdge(1);
            break;
        }
            
        case ArithNegate: {
            if (m_graph.negateShouldSpeculateInteger(node))
                break;
            fixDoubleEdge(0);
            break;
        }
            
        case ArithMin:
        case ArithMax:
        case ArithMul:
        case ArithMod: {
            if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
                && node.canSpeculateInteger())
                break;
            fixDoubleEdge(0);
            fixDoubleEdge(1);
            break;
        }
            
        case ArithDiv: {
            if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
                && node.canSpeculateInteger()) {
                if (isX86())
                    break;
                fixDoubleEdge(0);
                fixDoubleEdge(1);
                
                Node& oldDivision = m_graph[m_compileIndex];
                
                Node newDivision = oldDivision;
                newDivision.setRefCount(2);
                newDivision.predict(PredictDouble);
                NodeIndex newDivisionIndex = m_graph.size();
                
                oldDivision.setOp(DoubleAsInt32);
                oldDivision.children.initialize(Edge(newDivisionIndex, DoubleUse), Edge(), Edge());
                
                m_graph.append(newDivision);
                m_insertionSet.append(m_indexInBlock, newDivisionIndex);
                
                break;
            }
            fixDoubleEdge(0);
            fixDoubleEdge(1);
            break;
        }
            
        case ArithAbs: {
            if (m_graph[node.child1()].shouldSpeculateInteger()
                && node.canSpeculateInteger())
                break;
            fixDoubleEdge(0);
            break;
        }
            
        case ArithSqrt: {
            fixDoubleEdge(0);
            break;
        }
            
        case PutByVal: {
            if (!m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction())
                break;
            if (!m_graph[node.child2()].shouldSpeculateInteger())
                break;
            if (isActionableIntMutableArrayPrediction(m_graph[node.child1()].prediction())) {
                if (m_graph[node.child3()].isConstant())
                    break;
                if (m_graph[node.child3()].shouldSpeculateInteger())
                    break;
                fixDoubleEdge(2);
                break;
            }
            if (isActionableFloatMutableArrayPrediction(m_graph[node.child1()].prediction())) {
                fixDoubleEdge(2);
                break;
            }
            break;
        }
            
        default:
            break;
        }

#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        if (!(node.flags() & NodeHasVarArgs)) {
            dataLog("new children: ");
            node.dumpChildren(WTF::dataFile());
        }
        dataLog("\n");
#endif
    }
    
    void fixIntEdge(Edge& edge)
    {
        Node& node = m_graph[edge];
        if (node.op() != ValueToInt32)
            return;
        
        if (!m_graph[node.child1()].shouldSpeculateInteger())
            return;
        
        Edge oldEdge = edge;
        Edge newEdge = node.child1();
        
        m_graph.ref(newEdge);
        m_graph.deref(oldEdge);
        
        edge = newEdge;
    }
    
    void fixDoubleEdge(unsigned childIndex)
    {
        Node& source = m_graph[m_compileIndex];
        Edge& edge = source.children.child(childIndex);
        
        if (!m_graph[edge].shouldSpeculateInteger()) {
            edge.setUseKind(DoubleUse);
            return;
        }
        
        NodeIndex resultIndex = (NodeIndex)m_graph.size();
        
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("(replacing @%u->@%u with @%u->@%u) ",
                m_compileIndex, edge.index(), m_compileIndex, resultIndex);
#endif
        
        // Fix the edge up here because it's a reference that will be clobbered by
        // the append() below.
        NodeIndex oldIndex = edge.index();
        edge = Edge(resultIndex, DoubleUse);

        m_graph.append(Node(Int32ToDouble, source.codeOrigin, oldIndex));
        m_insertionSet.append(m_indexInBlock, resultIndex);
        
        Node& int32ToDouble = m_graph[resultIndex];
        int32ToDouble.predict(PredictDouble);
        int32ToDouble.ref();
    }
    
    unsigned m_indexInBlock;
    NodeIndex m_compileIndex;
    InsertionSet<NodeIndex> m_insertionSet;
};
    
void performFixup(Graph& graph)
{
    runPhase<FixupPhase>(graph);
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)
Commit	Line	Data
6fe7ccc8 A	1	/*
	2	* Copyright (C) 2012 Apple Inc. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
	14	* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	15	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
	16	* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
	17	* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	18	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
	19	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
	20	* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
	21	* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	23	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "config.h"
	27	#include "DFGFixupPhase.h"
	28
	29	#if ENABLE(DFG_JIT)
	30
	31	#include "DFGGraph.h"
	32	#include "DFGInsertionSet.h"
	33	#include "DFGPhase.h"
	34
	35	namespace JSC { namespace DFG {
	36
	37	class FixupPhase : public Phase {
	38	public:
	39	FixupPhase(Graph& graph)
	40	: Phase(graph, "fixup")
	41	{
	42	}
	43
	44	void run()
	45	{
	46	for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)
	47	fixupBlock(m_graph.m_blocks[blockIndex].get());
	48	}
	49
	50	private:
	51	void fixupBlock(BasicBlock* block)
	52	{
	53	for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
	54	m_compileIndex = block->at(m_indexInBlock);
	55	fixupNode(m_graph[m_compileIndex]);
	56	}
	57	m_insertionSet.execute(*block);
	58	}
	59
	60	void fixupNode(Node& node)
	61	{
	62	if (!node.shouldGenerate())
	63	return;
	64
65	NodeType op = node.op();
66
67	#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
68	dataLog(" %s @%u: ", Graph::opName(op), m_compileIndex);
69	#endif
70
71	switch (op) {
72	case GetById: {
73	if (!isInt32Prediction(m_graph[m_compileIndex].prediction()))
74	break;
75	if (codeBlock()->identifier(node.identifierNumber()) != globalData().propertyNames->length)
76	break;
77	bool isArray = isArrayPrediction(m_graph[node.child1()].prediction());
78	bool isString = isStringPrediction(m_graph[node.child1()].prediction());
79	bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
80	bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
81	bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
82	bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
83	bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
84	bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
85	bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
86	bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
87	bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
88	if (!isArray && !isString && !isInt8Array && !isInt16Array && !isInt32Array && !isUint8Array && !isUint8ClampedArray && !isUint16Array && !isUint32Array && !isFloat32Array && !isFloat64Array)
89	break;
90
91	#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
92	dataLog(" @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
93	#endif
94	if (isArray)
95	node.setOp(GetArrayLength);
96	else if (isString)
97	node.setOp(GetStringLength);
98	else if (isInt8Array)
99	node.setOp(GetInt8ArrayLength);
100	else if (isInt16Array)
101	node.setOp(GetInt16ArrayLength);
102	else if (isInt32Array)
103	node.setOp(GetInt32ArrayLength);
104	else if (isUint8Array)
105	node.setOp(GetUint8ArrayLength);
106	else if (isUint8ClampedArray)
107	node.setOp(GetUint8ClampedArrayLength);
108	else if (isUint16Array)
109	node.setOp(GetUint16ArrayLength);
110	else if (isUint32Array)
111	node.setOp(GetUint32ArrayLength);
112	else if (isFloat32Array)
113	node.setOp(GetFloat32ArrayLength);
114	else if (isFloat64Array)
115	node.setOp(GetFloat64ArrayLength);
116	else
117	ASSERT_NOT_REACHED();
118	// No longer MustGenerate
119	ASSERT(node.flags() & NodeMustGenerate);
120	node.clearFlags(NodeMustGenerate);
121	m_graph.deref(m_compileIndex);
122	break;
123	}
124	case GetIndexedPropertyStorage: {
125	PredictedType basePrediction = m_graph[node.child2()].prediction();
126	if (!(basePrediction & PredictInt32) && basePrediction) {
127	node.setOpAndDefaultFlags(Nop);
128	m_graph.clearAndDerefChild1(node);
129	m_graph.clearAndDerefChild2(node);
130	m_graph.clearAndDerefChild3(node);
131	node.setRefCount(0);
132	}
133	break;
134	}
135	case GetByVal:
136	case StringCharAt:
137	case StringCharCodeAt: {
138	if (!!node.child3() && m_graph[node.child3()].op() == Nop)
139	node.children.child3() = Edge();
140	break;
141	}
142
143	case ValueToInt32: {
144	if (m_graph[node.child1()].shouldSpeculateNumber()) {
145	node.clearFlags(NodeMustGenerate);
146	m_graph.deref(m_compileIndex);
147	}
148	break;
149	}
150
151	case BitAnd:
152	case BitOr:
153	case BitXor:
154	case BitRShift:
155	case BitLShift:
156	case BitURShift: {
157	fixIntEdge(node.children.child1());
158	fixIntEdge(node.children.child2());
159	break;
160	}
161
162	case CompareEq:
163	case CompareLess:
164	case CompareLessEq:
165	case CompareGreater:
166	case CompareGreaterEq:
167	case CompareStrictEq: {
168	if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()]))
169	break;
170	if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
171	break;
172	fixDoubleEdge(0);
173	fixDoubleEdge(1);
174	break;
175	}
176
177	case LogicalNot: {
178	if (m_graph[node.child1()].shouldSpeculateInteger())
179	break;
180	if (!m_graph[node.child1()].shouldSpeculateNumber())
181	break;
182	fixDoubleEdge(0);
183	break;
184	}
185
186	case Branch: {
187	if (!m_graph[node.child1()].shouldSpeculateInteger()
188	&& m_graph[node.child1()].shouldSpeculateNumber())
189	fixDoubleEdge(0);
190
191	Node& myNode = m_graph[m_compileIndex]; // reload because the graph may have changed
192	Edge logicalNotEdge = myNode.child1();
193	Node& logicalNot = m_graph[logicalNotEdge];
194	if (logicalNot.op() == LogicalNot
195	&& logicalNot.adjustedRefCount() == 1) {
196	Edge newChildEdge = logicalNot.child1();
197	if (m_graph[newChildEdge].hasBooleanResult()) {
198	m_graph.ref(newChildEdge);
199	m_graph.deref(logicalNotEdge);
200	myNode.children.setChild1(newChildEdge);
201
202	BlockIndex toBeTaken = myNode.notTakenBlockIndex();
203	BlockIndex toBeNotTaken = myNode.takenBlockIndex();
204	myNode.setTakenBlockIndex(toBeTaken);
205	myNode.setNotTakenBlockIndex(toBeNotTaken);
206	}
207	}
208	break;
209	}
210
211	case SetLocal: {
212	if (m_graph.isCaptured(node.local()))
213	break;
214	if (!node.variableAccessData()->shouldUseDoubleFormat())
215	break;
216	fixDoubleEdge(0);
217	break;
218	}
219
220	case ArithAdd:
221	case ValueAdd: {
222	if (m_graph.addShouldSpeculateInteger(node))
223	break;
224	if (!Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()]))
225	break;
226	fixDoubleEdge(0);
227	fixDoubleEdge(1);
228	break;
229	}
230
231	case ArithSub: {
232	if (m_graph.addShouldSpeculateInteger(node)
233	&& node.canSpeculateInteger())
234	break;
235	fixDoubleEdge(0);
236	fixDoubleEdge(1);
237	break;
238	}
239
240	case ArithNegate: {
241	if (m_graph.negateShouldSpeculateInteger(node))
242	break;
243	fixDoubleEdge(0);
244	break;
245	}
246
247	case ArithMin:
248	case ArithMax:
249	case ArithMul:
250	case ArithMod: {
251	if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
252	&& node.canSpeculateInteger())
253	break;
254	fixDoubleEdge(0);
255	fixDoubleEdge(1);
256	break;
257	}
258
259	case ArithDiv: {
260	if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()])
261	&& node.canSpeculateInteger()) {
262	if (isX86())
263	break;
264	fixDoubleEdge(0);
265	fixDoubleEdge(1);
266
267	Node& oldDivision = m_graph[m_compileIndex];
268
269	Node newDivision = oldDivision;
270	newDivision.setRefCount(2);
271	newDivision.predict(PredictDouble);
272	NodeIndex newDivisionIndex = m_graph.size();
273
274	oldDivision.setOp(DoubleAsInt32);
275	oldDivision.children.initialize(Edge(newDivisionIndex, DoubleUse), Edge(), Edge());
276
277	m_graph.append(newDivision);
278	m_insertionSet.append(m_indexInBlock, newDivisionIndex);
279
280	break;
281	}
282	fixDoubleEdge(0);
283	fixDoubleEdge(1);
284	break;
285	}
286
287	case ArithAbs: {
288	if (m_graph[node.child1()].shouldSpeculateInteger()
289	&& node.canSpeculateInteger())
290	break;
291	fixDoubleEdge(0);
292	break;
293	}
294
295	case ArithSqrt: {
296	fixDoubleEdge(0);
297	break;
298	}
299
300	case PutByVal: {
301	if (!m_graph[node.child1()].prediction() \|\| !m_graph[node.child2()].prediction())
302	break;
303	if (!m_graph[node.child2()].shouldSpeculateInteger())
304	break;
305	if (isActionableIntMutableArrayPrediction(m_graph[node.child1()].prediction())) {
306	if (m_graph[node.child3()].isConstant())
307	break;
308	if (m_graph[node.child3()].shouldSpeculateInteger())
309	break;
310	fixDoubleEdge(2);
311	break;
312	}
313	if (isActionableFloatMutableArrayPrediction(m_graph[node.child1()].prediction())) {
314	fixDoubleEdge(2);
315	break;
316	}
317	break;
318	}
319
320	default:
321	break;
322	}
323
324	#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
325	if (!(node.flags() & NodeHasVarArgs)) {
326	dataLog("new children: ");
327	node.dumpChildren(WTF::dataFile());
328	}
329	dataLog("\n");
330	#endif
331	}
332
333	void fixIntEdge(Edge& edge)
334	{
335	Node& node = m_graph[edge];
336	if (node.op() != ValueToInt32)
337	return;
338
339	if (!m_graph[node.child1()].shouldSpeculateInteger())
340	return;
341
342	Edge oldEdge = edge;
343	Edge newEdge = node.child1();
344
345	m_graph.ref(newEdge);
346	m_graph.deref(oldEdge);
347
348	edge = newEdge;
349	}
350
351	void fixDoubleEdge(unsigned childIndex)
352	{
353	Node& source = m_graph[m_compileIndex];
354	Edge& edge = source.children.child(childIndex);
355
356	if (!m_graph[edge].shouldSpeculateInteger()) {
357	edge.setUseKind(DoubleUse);
358	return;
359	}
360
361	NodeIndex resultIndex = (NodeIndex)m_graph.size();
362
363	#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
364	dataLog("(replacing @%u->@%u with @%u->@%u) ",
365	m_compileIndex, edge.index(), m_compileIndex, resultIndex);
366	#endif
367
368	// Fix the edge up here because it's a reference that will be clobbered by
369	// the append() below.
370	NodeIndex oldIndex = edge.index();
371	edge = Edge(resultIndex, DoubleUse);
372
373	m_graph.append(Node(Int32ToDouble, source.codeOrigin, oldIndex));
374	m_insertionSet.append(m_indexInBlock, resultIndex);
375
376	Node& int32ToDouble = m_graph[resultIndex];
377	int32ToDouble.predict(PredictDouble);
378	int32ToDouble.ref();
379	}
380
381	unsigned m_indexInBlock;
382	NodeIndex m_compileIndex;
383	InsertionSet<NodeIndex> m_insertionSet;
384	};
385
386	void performFixup(Graph& graph)
387	{
388	runPhase<FixupPhase>(graph);
389	}
390
391	} } // namespace JSC::DFG
392
393	#endif // ENABLE(DFG_JIT)
394