bytecompiler/NodesCodegen.cpp

   1 /*
   2 *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
   3 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
   4 *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
   5 *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
   6 *  Copyright (C) 2007 Maks Orlovich
   7 *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
   8 *
   9 *  This library is free software; you can redistribute it and/or
  10 *  modify it under the terms of the GNU Library General Public
  11 *  License as published by the Free Software Foundation; either
  12 *  version 2 of the License, or (at your option) any later version.
  13 *
  14 *  This library is distributed in the hope that it will be useful,
  15 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17 *  Library General Public License for more details.
  18 *
  19 *  You should have received a copy of the GNU Library General Public License
  20 *  along with this library; see the file COPYING.LIB.  If not, write to
  21 *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  22 *  Boston, MA 02110-1301, USA.
  23 *
  24 */
  25
  26 #include "config.h"
  27 #include "Nodes.h"
  28 #include "NodeConstructors.h"
  29
  30 #include "BytecodeGenerator.h"
  31 #include "CallFrame.h"
  32 #include "Debugger.h"
  33 #include "JIT.h"
  34 #include "JSFunction.h"
  35 #include "JSGlobalObject.h"
  36 #include "JSStaticScopeObject.h"
  37 #include "LabelScope.h"
  38 #include "Lexer.h"
  39 #include "Operations.h"
  40 #include "Parser.h"
  41 #include "PropertyNameArray.h"
  42 #include "RegExpCache.h"
  43 #include "RegExpObject.h"
  44 #include "SamplingTool.h"
  45 #include <wtf/Assertions.h>
  46 #include <wtf/RefCountedLeakCounter.h>
  47 #include <wtf/Threading.h>
  48
  49 using namespace WTF;
  50
  51 namespace JSC {
  52
  53 /*
  54     Details of the emitBytecode function.
  55
  56     Return value: The register holding the production's value.
  57              dst: An optional parameter specifying the most efficient destination at
  58                   which to store the production's value. The callee must honor dst.
  59
  60     The dst argument provides for a crude form of copy propagation. For example,
  61
  62         x = 1
  63
  64     becomes
  65
  66         load r[x], 1
  67
  68     instead of
  69
  70         load r0, 1
  71         mov r[x], r0
  72
  73     because the assignment node, "x =", passes r[x] as dst to the number node, "1".
  74 */
  75
  76 // ------------------------------ ThrowableExpressionData --------------------------------
  77
  78 static void substitute(UString& string, const UString& substring)
  79 {
  80     unsigned position = string.find("%s");
  81     ASSERT(position != UString::NotFound);
  82     string = makeString(string.substr(0, position), substring, string.substr(position + 2));
  83 }
  84
  85 RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* message)
  86 {
  87     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
  88     RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
  89     generator.emitThrow(exception);
  90     return exception;
  91 }
  92
  93 RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const UString& label)
  94 {
  95     UString message = messageTemplate;
  96     substitute(message, label);
  97     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
  98     RegisterID* exception = generator.emitNewError(generator.newTemporary(), type, jsString(generator.globalData(), message));
  99     generator.emitThrow(exception);
 100     return exception;
 101 }
 102
 103 inline RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, ErrorType type, const char* messageTemplate, const Identifier& label)
 104 {
 105     return emitThrowError(generator, type, messageTemplate, label.ustring());
 106 }
 107
 108 // ------------------------------ NullNode -------------------------------------
 109
 110 RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 111 {
 112     if (dst == generator.ignoredResult())
 113         return 0;
 114     return generator.emitLoad(dst, jsNull());
 115 }
 116
 117 // ------------------------------ BooleanNode ----------------------------------
 118
 119 RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 120 {
 121     if (dst == generator.ignoredResult())
 122         return 0;
 123     return generator.emitLoad(dst, m_value);
 124 }
 125
 126 // ------------------------------ NumberNode -----------------------------------
 127
 128 RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 129 {
 130     if (dst == generator.ignoredResult())
 131         return 0;
 132     return generator.emitLoad(dst, m_value);
 133 }
 134
 135 // ------------------------------ StringNode -----------------------------------
 136
 137 RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 138 {
 139     if (dst == generator.ignoredResult())
 140         return 0;
 141     return generator.emitLoad(dst, m_value);
 142 }
 143
 144 // ------------------------------ RegExpNode -----------------------------------
 145
 146 RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 147 {
 148     RefPtr<RegExp> regExp = generator.globalData()->regExpCache()->lookupOrCreate(m_pattern.ustring(), m_flags.ustring());
 149     if (!regExp->isValid())
 150         return emitThrowError(generator, SyntaxError, "Invalid regular expression: %s", regExp->errorMessage());
 151     if (dst == generator.ignoredResult())
 152         return 0;
 153     return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
 154 }
 155
 156 // ------------------------------ ThisNode -------------------------------------
 157
 158 RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 159 {
 160     if (dst == generator.ignoredResult())
 161         return 0;
 162     return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
 163 }
 164
 165 // ------------------------------ ResolveNode ----------------------------------
 166
 167 bool ResolveNode::isPure(BytecodeGenerator& generator) const
 168 {
 169     return generator.isLocal(m_ident);
 170 }
 171
 172 RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 173 {
 174     if (RegisterID* local = generator.registerFor(m_ident)) {
 175         if (dst == generator.ignoredResult())
 176             return 0;
 177         return generator.moveToDestinationIfNeeded(dst, local);
 178     }
 179
 180     generator.emitExpressionInfo(m_startOffset + m_ident.size(), m_ident.size(), 0);
 181     return generator.emitResolve(generator.finalDestination(dst), m_ident);
 182 }
 183
 184 // ------------------------------ ArrayNode ------------------------------------
 185
 186 RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 187 {
 188     // FIXME: Should we put all of this code into emitNewArray?
 189
 190     unsigned length = 0;
 191     ElementNode* firstPutElement;
 192     for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
 193         if (firstPutElement->elision())
 194             break;
 195         ++length;
 196     }
 197
 198     if (!firstPutElement && !m_elision)
 199         return generator.emitNewArray(generator.finalDestination(dst), m_element);
 200
 201     RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
 202
 203     for (ElementNode* n = firstPutElement; n; n = n->next()) {
 204         RegisterID* value = generator.emitNode(n->value());
 205         length += n->elision();
 206         generator.emitPutByIndex(array.get(), length++, value);
 207     }
 208
 209     if (m_elision) {
 210         RegisterID* value = generator.emitLoad(0, jsNumber(generator.globalData(), m_elision + length));
 211         generator.emitPutById(array.get(), generator.propertyNames().length, value);
 212     }
 213
 214     return generator.moveToDestinationIfNeeded(dst, array.get());
 215 }
 216
 217 bool ArrayNode::isSimpleArray() const
 218 {
 219     if (m_elision || m_optional)
 220         return false;
 221     for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
 222         if (ptr->elision())
 223             return false;
 224     }
 225     return true;
 226 }
 227
 228 ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
 229 {
 230     ASSERT(!m_elision && !m_optional);
 231     ElementNode* ptr = m_element;
 232     if (!ptr)
 233         return 0;
 234     ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
 235     ArgumentListNode* tail = head;
 236     ptr = ptr->next();
 237     for (; ptr; ptr = ptr->next()) {
 238         ASSERT(!ptr->elision());
 239         tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
 240     }
 241     return head;
 242 }
 243
 244 // ------------------------------ ObjectLiteralNode ----------------------------
 245
 246 RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 247 {
 248      if (!m_list) {
 249          if (dst == generator.ignoredResult())
 250              return 0;
 251          return generator.emitNewObject(generator.finalDestination(dst));
 252      }
 253      return generator.emitNode(dst, m_list);
 254 }
 255
 256 // ------------------------------ PropertyListNode -----------------------------
 257
 258 RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 259 {
 260     RefPtr<RegisterID> newObj = generator.tempDestination(dst);
 261
 262     generator.emitNewObject(newObj.get());
 263
 264     for (PropertyListNode* p = this; p; p = p->m_next) {
 265         RegisterID* value = generator.emitNode(p->m_node->m_assign);
 266
 267         switch (p->m_node->m_type) {
 268             case PropertyNode::Constant: {
 269                 generator.emitDirectPutById(newObj.get(), p->m_node->name(), value);
 270                 break;
 271             }
 272             case PropertyNode::Getter: {
 273                 generator.emitPutGetter(newObj.get(), p->m_node->name(), value);
 274                 break;
 275             }
 276             case PropertyNode::Setter: {
 277                 generator.emitPutSetter(newObj.get(), p->m_node->name(), value);
 278                 break;
 279             }
 280             default:
 281                 ASSERT_NOT_REACHED();
 282         }
 283     }
 284
 285     return generator.moveToDestinationIfNeeded(dst, newObj.get());
 286 }
 287
 288 // ------------------------------ BracketAccessorNode --------------------------------
 289
 290 RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 291 {
 292     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
 293     RegisterID* property = generator.emitNode(m_subscript);
 294     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 295     return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
 296 }
 297
 298 // ------------------------------ DotAccessorNode --------------------------------
 299
 300 RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 301 {
 302     RegisterID* base = generator.emitNode(m_base);
 303     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 304     return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
 305 }
 306
 307 // ------------------------------ ArgumentListNode -----------------------------
 308
 309 RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 310 {
 311     ASSERT(m_expr);
 312     return generator.emitNode(dst, m_expr);
 313 }
 314
 315 // ------------------------------ NewExprNode ----------------------------------
 316
 317 RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 318 {
 319     RefPtr<RegisterID> func = generator.emitNode(m_expr);
 320     return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
 321 }
 322
 323 // ------------------------------ EvalFunctionCallNode ----------------------------------
 324
 325 RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 326 {
 327     RefPtr<RegisterID> func = generator.tempDestination(dst);
 328     RefPtr<RegisterID> thisRegister = generator.newTemporary();
 329     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
 330     generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
 331     return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 332 }
 333
 334 // ------------------------------ FunctionCallValueNode ----------------------------------
 335
 336 RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 337 {
 338     RefPtr<RegisterID> func = generator.emitNode(m_expr);
 339     RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
 340     return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 341 }
 342
 343 // ------------------------------ FunctionCallResolveNode ----------------------------------
 344
 345 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 346 {
 347     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
 348         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
 349         return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 350     }
 351
 352     int index = 0;
 353     size_t depth = 0;
 354     JSObject* globalObject = 0;
 355     bool requiresDynamicChecks = false;
 356     if (generator.findScopedProperty(m_ident, index, depth, false, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
 357         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
 358         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
 359         return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 360     }
 361
 362     RefPtr<RegisterID> func = generator.newTemporary();
 363     RefPtr<RegisterID> thisRegister = generator.newTemporary();
 364     int identifierStart = divot() - startOffset();
 365     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
 366     generator.emitResolveWithBase(thisRegister.get(), func.get(), m_ident);
 367     return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 368 }
 369
 370 // ------------------------------ FunctionCallBracketNode ----------------------------------
 371
 372 RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 373 {
 374     RefPtr<RegisterID> base = generator.emitNode(m_base);
 375     RegisterID* property = generator.emitNode(m_subscript);
 376     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 377     RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
 378     RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
 379     return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 380 }
 381
 382 // ------------------------------ FunctionCallDotNode ----------------------------------
 383
 384 RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 385 {
 386     RefPtr<RegisterID> function = generator.tempDestination(dst);
 387     RefPtr<RegisterID> thisRegister = generator.newTemporary();
 388     generator.emitNode(thisRegister.get(), m_base);
 389     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 390     generator.emitMethodCheck();
 391     generator.emitGetById(function.get(), thisRegister.get(), m_ident);
 392     return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 393 }
 394
 395 RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 396 {
 397     RefPtr<Label> realCall = generator.newLabel();
 398     RefPtr<Label> end = generator.newLabel();
 399     RefPtr<RegisterID> base = generator.emitNode(m_base);
 400     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 401     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
 402     RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
 403     generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
 404     {
 405         RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
 406         RefPtr<RegisterID> thisRegister = generator.newTemporary();
 407         ArgumentListNode* oldList = m_args->m_listNode;
 408         if (m_args->m_listNode && m_args->m_listNode->m_expr) {
 409             generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
 410             m_args->m_listNode = m_args->m_listNode->m_next;
 411         } else
 412             generator.emitLoad(thisRegister.get(), jsNull());
 413
 414         generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 415         generator.emitJump(end.get());
 416         m_args->m_listNode = oldList;
 417     }
 418     generator.emitLabel(realCall.get());
 419     {
 420         RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
 421         generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 422     }
 423     generator.emitLabel(end.get());
 424     return finalDestination.get();
 425 }
 426
 427 static bool areTrivialApplyArguments(ArgumentsNode* args)
 428 {
 429     return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
 430         || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
 431 }
 432
 433 RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 434 {
 435     // A few simple cases can be trivially handled as ordinary function calls.
 436     // function.apply(), function.apply(arg) -> identical to function.call
 437     // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
 438     bool mayBeCall = areTrivialApplyArguments(m_args);
 439
 440     RefPtr<Label> realCall = generator.newLabel();
 441     RefPtr<Label> end = generator.newLabel();
 442     RefPtr<RegisterID> base = generator.emitNode(m_base);
 443     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 444     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
 445     RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
 446     generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
 447     {
 448         if (mayBeCall) {
 449             RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
 450             RefPtr<RegisterID> thisRegister = generator.newTemporary();
 451             ArgumentListNode* oldList = m_args->m_listNode;
 452             if (m_args->m_listNode && m_args->m_listNode->m_expr) {
 453                 generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
 454                 m_args->m_listNode = m_args->m_listNode->m_next;
 455                 if (m_args->m_listNode) {
 456                     ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
 457                     ASSERT(!m_args->m_listNode->m_next);
 458                     m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
 459                 }
 460             } else
 461                 generator.emitLoad(thisRegister.get(), jsNull());
 462             generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 463             m_args->m_listNode = oldList;
 464         } else {
 465             ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
 466             RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
 467             RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
 468             RefPtr<RegisterID> thisRegister = generator.newTemporary();
 469             RefPtr<RegisterID> argsRegister = generator.newTemporary();
 470             generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
 471             ArgumentListNode* args = m_args->m_listNode->m_next;
 472             bool isArgumentsApply = false;
 473             if (args->m_expr->isResolveNode()) {
 474                 ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
 475                 isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
 476                 if (isArgumentsApply)
 477                     generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
 478             }
 479             if (!isArgumentsApply)
 480                 generator.emitNode(argsRegister.get(), args->m_expr);
 481             while ((args = args->m_next))
 482                 generator.emitNode(args->m_expr);
 483
 484             generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
 485             generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
 486         }
 487         generator.emitJump(end.get());
 488     }
 489     generator.emitLabel(realCall.get());
 490     {
 491         RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
 492         generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 493     }
 494     generator.emitLabel(end.get());
 495     return finalDestination.get();
 496 }
 497
 498 // ------------------------------ PostfixResolveNode ----------------------------------
 499
 500 static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
 501 {
 502     return (oper == OpPlusPlus) ? generator.emitPreInc(srcDst) : generator.emitPreDec(srcDst);
 503 }
 504
 505 static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
 506 {
 507     if (srcDst == dst)
 508         return generator.emitToJSNumber(dst, srcDst);
 509     return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
 510 }
 511
 512 RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 513 {
 514     if (RegisterID* local = generator.registerFor(m_ident)) {
 515         if (generator.isLocalConstant(m_ident)) {
 516             if (dst == generator.ignoredResult())
 517                 return 0;
 518             return generator.emitToJSNumber(generator.finalDestination(dst), local);
 519         }
 520
 521         if (dst == generator.ignoredResult())
 522             return emitPreIncOrDec(generator, local, m_operator);
 523         return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
 524     }
 525
 526     int index = 0;
 527     size_t depth = 0;
 528     JSObject* globalObject = 0;
 529     bool requiresDynamicChecks = false;
 530     if (generator.findScopedProperty(m_ident, index, depth, true, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
 531         RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
 532         RegisterID* oldValue;
 533         if (dst == generator.ignoredResult()) {
 534             oldValue = 0;
 535             emitPreIncOrDec(generator, value.get(), m_operator);
 536         } else {
 537             oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
 538         }
 539         generator.emitPutScopedVar(depth, index, value.get(), globalObject);
 540         return oldValue;
 541     }
 542
 543     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 544     RefPtr<RegisterID> value = generator.newTemporary();
 545     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
 546     RegisterID* oldValue;
 547     if (dst == generator.ignoredResult()) {
 548         oldValue = 0;
 549         emitPreIncOrDec(generator, value.get(), m_operator);
 550     } else {
 551         oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
 552     }
 553     generator.emitPutById(base.get(), m_ident, value.get());
 554     return oldValue;
 555 }
 556
 557 // ------------------------------ PostfixBracketNode ----------------------------------
 558
 559 RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 560 {
 561     RefPtr<RegisterID> base = generator.emitNode(m_base);
 562     RefPtr<RegisterID> property = generator.emitNode(m_subscript);
 563
 564     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 565     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
 566     RegisterID* oldValue;
 567     if (dst == generator.ignoredResult()) {
 568         oldValue = 0;
 569         if (m_operator == OpPlusPlus)
 570             generator.emitPreInc(value.get());
 571         else
 572             generator.emitPreDec(value.get());
 573     } else {
 574         oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
 575     }
 576     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 577     generator.emitPutByVal(base.get(), property.get(), value.get());
 578     return oldValue;
 579 }
 580
 581 // ------------------------------ PostfixDotNode ----------------------------------
 582
 583 RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 584 {
 585     RefPtr<RegisterID> base = generator.emitNode(m_base);
 586
 587     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
 588     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
 589     RegisterID* oldValue;
 590     if (dst == generator.ignoredResult()) {
 591         oldValue = 0;
 592         if (m_operator == OpPlusPlus)
 593             generator.emitPreInc(value.get());
 594         else
 595             generator.emitPreDec(value.get());
 596     } else {
 597         oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
 598     }
 599     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 600     generator.emitPutById(base.get(), m_ident, value.get());
 601     return oldValue;
 602 }
 603
 604 // ------------------------------ PostfixErrorNode -----------------------------------
 605
 606 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 607 {
 608     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
 609         ? "Postfix ++ operator applied to value that is not a reference."
 610         : "Postfix -- operator applied to value that is not a reference.");
 611 }
 612
 613 // ------------------------------ DeleteResolveNode -----------------------------------
 614
 615 RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 616 {
 617     if (generator.registerFor(m_ident))
 618         return generator.emitLoad(generator.finalDestination(dst), false);
 619
 620     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 621     RegisterID* base = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
 622     return generator.emitDeleteById(generator.finalDestination(dst, base), base, m_ident);
 623 }
 624
 625 // ------------------------------ DeleteBracketNode -----------------------------------
 626
 627 RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 628 {
 629     RefPtr<RegisterID> r0 = generator.emitNode(m_base);
 630     RegisterID* r1 = generator.emitNode(m_subscript);
 631
 632     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 633     return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
 634 }
 635
 636 // ------------------------------ DeleteDotNode -----------------------------------
 637
 638 RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 639 {
 640     RegisterID* r0 = generator.emitNode(m_base);
 641
 642     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 643     return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
 644 }
 645
 646 // ------------------------------ DeleteValueNode -----------------------------------
 647
 648 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 649 {
 650     generator.emitNode(generator.ignoredResult(), m_expr);
 651
 652     // delete on a non-location expression ignores the value and returns true
 653     return generator.emitLoad(generator.finalDestination(dst), true);
 654 }
 655
 656 // ------------------------------ VoidNode -------------------------------------
 657
 658 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 659 {
 660     if (dst == generator.ignoredResult()) {
 661         generator.emitNode(generator.ignoredResult(), m_expr);
 662         return 0;
 663     }
 664     RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
 665     return generator.emitLoad(dst, jsUndefined());
 666 }
 667
 668 // ------------------------------ TypeOfValueNode -----------------------------------
 669
 670 RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 671 {
 672     if (RegisterID* local = generator.registerFor(m_ident)) {
 673         if (dst == generator.ignoredResult())
 674             return 0;
 675         return generator.emitTypeOf(generator.finalDestination(dst), local);
 676     }
 677
 678     RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
 679     generator.emitGetById(scratch.get(), scratch.get(), m_ident);
 680     if (dst == generator.ignoredResult())
 681         return 0;
 682     return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
 683 }
 684
 685 // ------------------------------ TypeOfValueNode -----------------------------------
 686
 687 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 688 {
 689     if (dst == generator.ignoredResult()) {
 690         generator.emitNode(generator.ignoredResult(), m_expr);
 691         return 0;
 692     }
 693     RefPtr<RegisterID> src = generator.emitNode(m_expr);
 694     return generator.emitTypeOf(generator.finalDestination(dst), src.get());
 695 }
 696
 697 // ------------------------------ PrefixResolveNode ----------------------------------
 698
 699 RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 700 {
 701     if (RegisterID* local = generator.registerFor(m_ident)) {
 702         if (generator.isLocalConstant(m_ident)) {
 703             if (dst == generator.ignoredResult())
 704                 return 0;
 705             RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
 706             return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
 707         }
 708
 709         emitPreIncOrDec(generator, local, m_operator);
 710         return generator.moveToDestinationIfNeeded(dst, local);
 711     }
 712
 713     int index = 0;
 714     size_t depth = 0;
 715     JSObject* globalObject = 0;
 716     bool requiresDynamicChecks = false;
 717     if (generator.findScopedProperty(m_ident, index, depth, false, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
 718         RefPtr<RegisterID> propDst = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
 719         emitPreIncOrDec(generator, propDst.get(), m_operator);
 720         generator.emitPutScopedVar(depth, index, propDst.get(), globalObject);
 721         return generator.moveToDestinationIfNeeded(dst, propDst.get());
 722     }
 723
 724     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 725     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 726     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), m_ident);
 727     emitPreIncOrDec(generator, propDst.get(), m_operator);
 728     generator.emitPutById(base.get(), m_ident, propDst.get());
 729     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 730 }
 731
 732 // ------------------------------ PrefixBracketNode ----------------------------------
 733
 734 RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 735 {
 736     RefPtr<RegisterID> base = generator.emitNode(m_base);
 737     RefPtr<RegisterID> property = generator.emitNode(m_subscript);
 738     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 739
 740     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
 741     RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
 742     if (m_operator == OpPlusPlus)
 743         generator.emitPreInc(value);
 744     else
 745         generator.emitPreDec(value);
 746     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 747     generator.emitPutByVal(base.get(), property.get(), value);
 748     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 749 }
 750
 751 // ------------------------------ PrefixDotNode ----------------------------------
 752
 753 RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 754 {
 755     RefPtr<RegisterID> base = generator.emitNode(m_base);
 756     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 757
 758     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
 759     RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
 760     if (m_operator == OpPlusPlus)
 761         generator.emitPreInc(value);
 762     else
 763         generator.emitPreDec(value);
 764     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 765     generator.emitPutById(base.get(), m_ident, value);
 766     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 767 }
 768
 769 // ------------------------------ PrefixErrorNode -----------------------------------
 770
 771 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 772 {
 773     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus
 774         ? "Prefix ++ operator applied to value that is not a reference."
 775         : "Prefix -- operator applied to value that is not a reference.");
 776 }
 777
 778 // ------------------------------ Unary Operation Nodes -----------------------------------
 779
 780 RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 781 {
 782     RegisterID* src = generator.emitNode(m_expr);
 783     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
 784 }
 785
 786
 787 // ------------------------------ LogicalNotNode -----------------------------------
 788
 789 void LogicalNotNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
 790 {
 791     ASSERT(expr()->hasConditionContextCodegen());
 792
 793     // reverse the true and false targets
 794     generator.emitNodeInConditionContext(expr(), falseTarget, trueTarget, !fallThroughMeansTrue);
 795 }
 796
 797
 798 // ------------------------------ Binary Operation Nodes -----------------------------------
 799
 800 // BinaryOpNode::emitStrcat:
 801 //
 802 // This node generates an op_strcat operation.  This opcode can handle concatenation of three or
 803 // more values, where we can determine a set of separate op_add operations would be operating on
 804 // string values.
 805 //
 806 // This function expects to be operating on a graph of AST nodes looking something like this:
 807 //
 808 //     (a)...     (b)
 809 //          \   /
 810 //           (+)     (c)
 811 //              \   /
 812 //      [d]     ((+))
 813 //         \    /
 814 //          [+=]
 815 //
 816 // The assignment operation is optional, if it exists the register holding the value on the
 817 // lefthand side of the assignment should be passing as the optional 'lhs' argument.
 818 //
 819 // The method should be called on the node at the root of the tree of regular binary add
 820 // operations (marked in the diagram with a double set of parentheses).  This node must
 821 // be performing a string concatenation (determined by statically detecting that at least
 822 // one child must be a string).
 823 //
 824 // Since the minimum number of values being concatenated together is expected to be 3, if
 825 // a lhs to a concatenating assignment is not provided then the  root add should have at
 826 // least one left child that is also an add that can be determined to be operating on strings.
 827 //
 828 RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
 829 {
 830     ASSERT(isAdd());
 831     ASSERT(resultDescriptor().definitelyIsString());
 832
 833     // Create a list of expressions for all the adds in the tree of nodes we can convert into
 834     // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
 835     // added first, and the leftmost child is never added, so the vector produced for the
 836     // example above will be [ c, b ].
 837     Vector<ExpressionNode*, 16> reverseExpressionList;
 838     reverseExpressionList.append(m_expr2);
 839
 840     // Examine the left child of the add.  So long as this is a string add, add its right-child
 841     // to the list, and keep processing along the left fork.
 842     ExpressionNode* leftMostAddChild = m_expr1;
 843     while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
 844         reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
 845         leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
 846     }
 847
 848     Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
 849
 850     // If there is an assignment, allocate a temporary to hold the lhs after conversion.
 851     // We could possibly avoid this (the lhs is converted last anyway, we could let the
 852     // op_strcat node handle its conversion if required).
 853     if (lhs)
 854         temporaryRegisters.append(generator.newTemporary());
 855
 856     // Emit code for the leftmost node ((a) in the example).
 857     temporaryRegisters.append(generator.newTemporary());
 858     RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
 859     generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
 860
 861     // Note on ordering of conversions:
 862     //
 863     // We maintain the same ordering of conversions as we would see if the concatenations
 864     // was performed as a sequence of adds (otherwise this optimization could change
 865     // behaviour should an object have been provided a valueOf or toString method).
 866     //
 867     // Considering the above example, the sequnce of execution is:
 868     //     * evaluate operand (a)
 869     //     * evaluate operand (b)
 870     //     * convert (a) to primitive   <-  (this would be triggered by the first add)
 871     //     * convert (b) to primitive   <-  (ditto)
 872     //     * evaluate operand (c)
 873     //     * convert (c) to primitive   <-  (this would be triggered by the second add)
 874     // And optionally, if there is an assignment:
 875     //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
 876     //
 877     // As such we do not plant an op to convert the leftmost child now.  Instead, use
 878     // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
 879     // once the second node has been generated.  However, if the leftmost child is an
 880     // immediate we can trivially determine that no conversion will be required.
 881     // If this is the case
 882     if (leftMostAddChild->isString())
 883         leftMostAddChildTempRegister = 0;
 884
 885     while (reverseExpressionList.size()) {
 886         ExpressionNode* node = reverseExpressionList.last();
 887         reverseExpressionList.removeLast();
 888
 889         // Emit the code for the current node.
 890         temporaryRegisters.append(generator.newTemporary());
 891         generator.emitNode(temporaryRegisters.last().get(), node);
 892
 893         // On the first iteration of this loop, when we first reach this point we have just
 894         // generated the second node, which means it is time to convert the leftmost operand.
 895         if (leftMostAddChildTempRegister) {
 896             generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
 897             leftMostAddChildTempRegister = 0; // Only do this once.
 898         }
 899         // Plant a conversion for this node, if necessary.
 900         if (!node->isString())
 901             generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
 902     }
 903     ASSERT(temporaryRegisters.size() >= 3);
 904
 905     // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
 906     // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
 907     if (emitExpressionInfoForMe)
 908         generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
 909
 910     // If there is an assignment convert the lhs now.  This will also copy lhs to
 911     // the temporary register we allocated for it.
 912     if (lhs)
 913         generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
 914
 915     return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
 916 }
 917
 918 RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 919 {
 920     OpcodeID opcodeID = this->opcodeID();
 921
 922     if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
 923         return emitStrcat(generator, dst);
 924
 925     if (opcodeID == op_neq) {
 926         if (m_expr1->isNull() || m_expr2->isNull()) {
 927             RefPtr<RegisterID> src = generator.tempDestination(dst);
 928             generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
 929             return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
 930         }
 931     }
 932
 933     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 934     RegisterID* src2 = generator.emitNode(m_expr2);
 935     return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 936 }
 937
 938 RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 939 {
 940     if (m_expr1->isNull() || m_expr2->isNull()) {
 941         RefPtr<RegisterID> src = generator.tempDestination(dst);
 942         generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
 943         return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
 944     }
 945
 946     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 947     RegisterID* src2 = generator.emitNode(m_expr2);
 948     return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 949 }
 950
 951 RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 952 {
 953     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 954     RegisterID* src2 = generator.emitNode(m_expr2);
 955     return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 956 }
 957
 958 RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 959 {
 960     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 961     RegisterID* src2 = generator.emitNode(m_expr2);
 962     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
 963 }
 964
 965 RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 966 {
 967     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 968     RegisterID* src2 = generator.emitNode(m_expr2);
 969     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 970     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 971 }
 972
 973 RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 974 {
 975     RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
 976     RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
 977
 978     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 979     generator.emitGetByIdExceptionInfo(op_instanceof);
 980     RegisterID* src2Prototype = generator.emitGetById(generator.newTemporary(), src2.get(), generator.globalData()->propertyNames->prototype);
 981
 982     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
 983     return generator.emitInstanceOf(generator.finalDestination(dst, src1.get()), src1.get(), src2.get(), src2Prototype);
 984 }
 985
 986 // ------------------------------ LogicalOpNode ----------------------------
 987
 988 RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 989 {
 990     RefPtr<RegisterID> temp = generator.tempDestination(dst);
 991     RefPtr<Label> target = generator.newLabel();
 992
 993     generator.emitNode(temp.get(), m_expr1);
 994     if (m_operator == OpLogicalAnd)
 995         generator.emitJumpIfFalse(temp.get(), target.get());
 996     else
 997         generator.emitJumpIfTrue(temp.get(), target.get());
 998     generator.emitNode(temp.get(), m_expr2);
 999     generator.emitLabel(target.get());
1000
1001     return generator.moveToDestinationIfNeeded(dst, temp.get());
1002 }
1003
1004 void LogicalOpNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label* trueTarget, Label* falseTarget, bool fallThroughMeansTrue)
1005 {
1006     if (m_expr1->hasConditionContextCodegen()) {
1007         RefPtr<Label> afterExpr1 = generator.newLabel();
1008         if (m_operator == OpLogicalAnd)
1009             generator.emitNodeInConditionContext(m_expr1, afterExpr1.get(), falseTarget, true);
1010         else
1011             generator.emitNodeInConditionContext(m_expr1, trueTarget, afterExpr1.get(), false);
1012         generator.emitLabel(afterExpr1.get());
1013     } else {
1014         RegisterID* temp = generator.emitNode(m_expr1);
1015         if (m_operator == OpLogicalAnd)
1016             generator.emitJumpIfFalse(temp, falseTarget);
1017         else
1018             generator.emitJumpIfTrue(temp, trueTarget);
1019     }
1020
1021     if (m_expr2->hasConditionContextCodegen())
1022         generator.emitNodeInConditionContext(m_expr2, trueTarget, falseTarget, fallThroughMeansTrue);
1023     else {
1024         RegisterID* temp = generator.emitNode(m_expr2);
1025         if (fallThroughMeansTrue)
1026             generator.emitJumpIfFalse(temp, falseTarget);
1027         else
1028             generator.emitJumpIfTrue(temp, trueTarget);
1029     }
1030 }
1031
1032 // ------------------------------ ConditionalNode ------------------------------
1033
1034 RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1035 {
1036     RefPtr<RegisterID> newDst = generator.finalDestination(dst);
1037     RefPtr<Label> beforeElse = generator.newLabel();
1038     RefPtr<Label> afterElse = generator.newLabel();
1039
1040     if (m_logical->hasConditionContextCodegen()) {
1041         RefPtr<Label> beforeThen = generator.newLabel();
1042         generator.emitNodeInConditionContext(m_logical, beforeThen.get(), beforeElse.get(), true);
1043         generator.emitLabel(beforeThen.get());
1044     } else {
1045         RegisterID* cond = generator.emitNode(m_logical);
1046         generator.emitJumpIfFalse(cond, beforeElse.get());
1047     }
1048
1049     generator.emitNode(newDst.get(), m_expr1);
1050     generator.emitJump(afterElse.get());
1051
1052     generator.emitLabel(beforeElse.get());
1053     generator.emitNode(newDst.get(), m_expr2);
1054
1055     generator.emitLabel(afterElse.get());
1056
1057     return newDst.get();
1058 }
1059
1060 // ------------------------------ ReadModifyResolveNode -----------------------------------
1061
1062 // FIXME: should this be moved to be a method on BytecodeGenerator?
1063 static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
1064 {
1065     OpcodeID opcodeID;
1066     switch (oper) {
1067         case OpMultEq:
1068             opcodeID = op_mul;
1069             break;
1070         case OpDivEq:
1071             opcodeID = op_div;
1072             break;
1073         case OpPlusEq:
1074             if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
1075                 return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
1076             opcodeID = op_add;
1077             break;
1078         case OpMinusEq:
1079             opcodeID = op_sub;
1080             break;
1081         case OpLShift:
1082             opcodeID = op_lshift;
1083             break;
1084         case OpRShift:
1085             opcodeID = op_rshift;
1086             break;
1087         case OpURShift:
1088             opcodeID = op_urshift;
1089             break;
1090         case OpAndEq:
1091             opcodeID = op_bitand;
1092             break;
1093         case OpXOrEq:
1094             opcodeID = op_bitxor;
1095             break;
1096         case OpOrEq:
1097             opcodeID = op_bitor;
1098             break;
1099         case OpModEq:
1100             opcodeID = op_mod;
1101             break;
1102         default:
1103             ASSERT_NOT_REACHED();
1104             return dst;
1105     }
1106
1107     RegisterID* src2 = generator.emitNode(m_right);
1108
1109     // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
1110     // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
1111     if (emitExpressionInfoForMe)
1112         generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
1113
1114     return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
1115 }
1116
1117 RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1118 {
1119     if (RegisterID* local = generator.registerFor(m_ident)) {
1120         if (generator.isLocalConstant(m_ident)) {
1121             return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1122         }
1123
1124         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
1125             RefPtr<RegisterID> result = generator.newTemporary();
1126             generator.emitMove(result.get(), local);
1127             emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1128             generator.emitMove(local, result.get());
1129             return generator.moveToDestinationIfNeeded(dst, result.get());
1130         }
1131
1132         RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1133         return generator.moveToDestinationIfNeeded(dst, result);
1134     }
1135
1136     int index = 0;
1137     size_t depth = 0;
1138     JSObject* globalObject = 0;
1139     bool requiresDynamicChecks = false;
1140     if (generator.findScopedProperty(m_ident, index, depth, true, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
1141         RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
1142         RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1143         generator.emitPutScopedVar(depth, index, result, globalObject);
1144         return result;
1145     }
1146
1147     RefPtr<RegisterID> src1 = generator.tempDestination(dst);
1148     generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
1149     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
1150     RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
1151     return generator.emitPutById(base.get(), m_ident, result);
1152 }
1153
1154 // ------------------------------ AssignResolveNode -----------------------------------
1155
1156 RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1157 {
1158     if (RegisterID* local = generator.registerFor(m_ident)) {
1159         if (generator.isLocalConstant(m_ident))
1160             return generator.emitNode(dst, m_right);
1161
1162         RegisterID* result = generator.emitNode(local, m_right);
1163         return generator.moveToDestinationIfNeeded(dst, result);
1164     }
1165
1166     int index = 0;
1167     size_t depth = 0;
1168     JSObject* globalObject = 0;
1169     bool requiresDynamicChecks = false;
1170     if (generator.findScopedProperty(m_ident, index, depth, true, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
1171         if (dst == generator.ignoredResult())
1172             dst = 0;
1173         RegisterID* value = generator.emitNode(dst, m_right);
1174         generator.emitPutScopedVar(depth, index, value, globalObject);
1175         return value;
1176     }
1177
1178     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
1179     if (dst == generator.ignoredResult())
1180         dst = 0;
1181     RegisterID* value = generator.emitNode(dst, m_right);
1182     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1183     return generator.emitPutById(base.get(), m_ident, value);
1184 }
1185
1186 // ------------------------------ AssignDotNode -----------------------------------
1187
1188 RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1189 {
1190     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
1191     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
1192     RegisterID* result = generator.emitNode(value.get(), m_right);
1193     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1194     generator.emitPutById(base.get(), m_ident, result);
1195     return generator.moveToDestinationIfNeeded(dst, result);
1196 }
1197
1198 // ------------------------------ ReadModifyDotNode -----------------------------------
1199
1200 RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1201 {
1202     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
1203
1204     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
1205     RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
1206     RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1207
1208     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1209     return generator.emitPutById(base.get(), m_ident, updatedValue);
1210 }
1211
1212 // ------------------------------ AssignErrorNode -----------------------------------
1213
1214 RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1215 {
1216     return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
1217 }
1218
1219 // ------------------------------ AssignBracketNode -----------------------------------
1220
1221 RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1222 {
1223     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
1224     RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
1225     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
1226     RegisterID* result = generator.emitNode(value.get(), m_right);
1227
1228     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1229     generator.emitPutByVal(base.get(), property.get(), result);
1230     return generator.moveToDestinationIfNeeded(dst, result);
1231 }
1232
1233 // ------------------------------ ReadModifyBracketNode -----------------------------------
1234
1235 RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1236 {
1237     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
1238     RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
1239
1240     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
1241     RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
1242     RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
1243
1244     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1245     generator.emitPutByVal(base.get(), property.get(), updatedValue);
1246
1247     return updatedValue;
1248 }
1249
1250 // ------------------------------ CommaNode ------------------------------------
1251
1252 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1253 {
1254     ASSERT(m_expressions.size() > 1);
1255     for (size_t i = 0; i < m_expressions.size() - 1; i++)
1256         generator.emitNode(generator.ignoredResult(), m_expressions[i]);
1257     return generator.emitNode(dst, m_expressions.last());
1258 }
1259
1260 // ------------------------------ ConstDeclNode ------------------------------------
1261
1262 RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
1263 {
1264     if (RegisterID* local = generator.constRegisterFor(m_ident)) {
1265         if (!m_init)
1266             return local;
1267
1268         return generator.emitNode(local, m_init);
1269     }
1270
1271     if (generator.codeType() != EvalCode) {
1272         if (m_init)
1273             return generator.emitNode(m_init);
1274         else
1275             return generator.emitResolve(generator.newTemporary(), m_ident);
1276     }
1277     // FIXME: While this code should only be hit in eval code, it will potentially
1278     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
1279     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
1280     RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
1281     return generator.emitPutById(base.get(), m_ident, value);
1282 }
1283
1284 RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1285 {
1286     RegisterID* result = 0;
1287     for (ConstDeclNode* n = this; n; n = n->m_next)
1288         result = n->emitCodeSingle(generator);
1289
1290     return result;
1291 }
1292
1293 // ------------------------------ ConstStatementNode -----------------------------
1294
1295 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1296 {
1297     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1298     return generator.emitNode(m_next);
1299 }
1300
1301 // ------------------------------ SourceElements -------------------------------
1302
1303
1304 inline StatementNode* SourceElements::lastStatement() const
1305 {
1306     size_t size = m_statements.size();
1307     return size ? m_statements[size - 1] : 0;
1308 }
1309
1310 inline void SourceElements::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1311 {
1312     size_t size = m_statements.size();
1313     for (size_t i = 0; i < size; ++i)
1314         generator.emitNode(dst, m_statements[i]);
1315 }
1316
1317 // ------------------------------ BlockNode ------------------------------------
1318
1319 inline StatementNode* BlockNode::lastStatement() const
1320 {
1321     return m_statements ? m_statements->lastStatement() : 0;
1322 }
1323
1324 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1325 {
1326     if (m_statements)
1327         m_statements->emitBytecode(generator, dst);
1328     return 0;
1329 }
1330
1331 // ------------------------------ EmptyStatementNode ---------------------------
1332
1333 RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1334 {
1335     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1336     return dst;
1337 }
1338
1339 // ------------------------------ DebuggerStatementNode ---------------------------
1340
1341 RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1342 {
1343     generator.emitDebugHook(DidReachBreakpoint, firstLine(), lastLine());
1344     return dst;
1345 }
1346
1347 // ------------------------------ ExprStatementNode ----------------------------
1348
1349 RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1350 {
1351     ASSERT(m_expr);
1352     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1353     return generator.emitNode(dst, m_expr);
1354 }
1355
1356 // ------------------------------ VarStatementNode ----------------------------
1357
1358 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1359 {
1360     ASSERT(m_expr);
1361     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1362     return generator.emitNode(m_expr);
1363 }
1364
1365 // ------------------------------ IfNode ---------------------------------------
1366
1367 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1368 {
1369     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1370
1371     RefPtr<Label> afterThen = generator.newLabel();
1372
1373     if (m_condition->hasConditionContextCodegen()) {
1374         RefPtr<Label> beforeThen = generator.newLabel();
1375         generator.emitNodeInConditionContext(m_condition, beforeThen.get(), afterThen.get(), true);
1376         generator.emitLabel(beforeThen.get());
1377     } else {
1378         RegisterID* cond = generator.emitNode(m_condition);
1379         generator.emitJumpIfFalse(cond, afterThen.get());
1380     }
1381
1382     generator.emitNode(dst, m_ifBlock);
1383     generator.emitLabel(afterThen.get());
1384
1385     // FIXME: This should return the last statement executed so that it can be returned as a Completion.
1386     return 0;
1387 }
1388
1389 // ------------------------------ IfElseNode ---------------------------------------
1390
1391 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1392 {
1393     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1394
1395     RefPtr<Label> beforeElse = generator.newLabel();
1396     RefPtr<Label> afterElse = generator.newLabel();
1397
1398     if (m_condition->hasConditionContextCodegen()) {
1399         RefPtr<Label> beforeThen = generator.newLabel();
1400         generator.emitNodeInConditionContext(m_condition, beforeThen.get(), beforeElse.get(), true);
1401         generator.emitLabel(beforeThen.get());
1402     } else {
1403         RegisterID* cond = generator.emitNode(m_condition);
1404         generator.emitJumpIfFalse(cond, beforeElse.get());
1405     }
1406
1407     generator.emitNode(dst, m_ifBlock);
1408     generator.emitJump(afterElse.get());
1409
1410     generator.emitLabel(beforeElse.get());
1411
1412     generator.emitNode(dst, m_elseBlock);
1413
1414     generator.emitLabel(afterElse.get());
1415
1416     // FIXME: This should return the last statement executed so that it can be returned as a Completion.
1417     return 0;
1418 }
1419
1420 // ------------------------------ DoWhileNode ----------------------------------
1421
1422 RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1423 {
1424     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
1425
1426     RefPtr<Label> topOfLoop = generator.newLabel();
1427     generator.emitLabel(topOfLoop.get());
1428
1429     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1430
1431     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
1432
1433     generator.emitLabel(scope->continueTarget());
1434     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
1435     if (m_expr->hasConditionContextCodegen())
1436         generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
1437     else {
1438         RegisterID* cond = generator.emitNode(m_expr);
1439         generator.emitJumpIfTrue(cond, topOfLoop.get());
1440     }
1441
1442     generator.emitLabel(scope->breakTarget());
1443     return result.get();
1444 }
1445
1446 // ------------------------------ WhileNode ------------------------------------
1447
1448 RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1449 {
1450     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
1451
1452     generator.emitJump(scope->continueTarget());
1453
1454     RefPtr<Label> topOfLoop = generator.newLabel();
1455     generator.emitLabel(topOfLoop.get());
1456
1457     generator.emitNode(dst, m_statement);
1458
1459     generator.emitLabel(scope->continueTarget());
1460     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
1461
1462     if (m_expr->hasConditionContextCodegen())
1463         generator.emitNodeInConditionContext(m_expr, topOfLoop.get(), scope->breakTarget(), false);
1464     else {
1465         RegisterID* cond = generator.emitNode(m_expr);
1466         generator.emitJumpIfTrue(cond, topOfLoop.get());
1467     }
1468
1469     generator.emitLabel(scope->breakTarget());
1470
1471     // FIXME: This should return the last statement executed so that it can be returned as a Completion
1472     return 0;
1473 }
1474
1475 // ------------------------------ ForNode --------------------------------------
1476
1477 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1478 {
1479     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
1480
1481     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1482
1483     if (m_expr1)
1484         generator.emitNode(generator.ignoredResult(), m_expr1);
1485
1486     RefPtr<Label> condition = generator.newLabel();
1487     generator.emitJump(condition.get());
1488
1489     RefPtr<Label> topOfLoop = generator.newLabel();
1490     generator.emitLabel(topOfLoop.get());
1491
1492     RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
1493
1494     generator.emitLabel(scope->continueTarget());
1495     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1496     if (m_expr3)
1497         generator.emitNode(generator.ignoredResult(), m_expr3);
1498
1499     generator.emitLabel(condition.get());
1500     if (m_expr2) {
1501         if (m_expr2->hasConditionContextCodegen())
1502             generator.emitNodeInConditionContext(m_expr2, topOfLoop.get(), scope->breakTarget(), false);
1503         else {
1504             RegisterID* cond = generator.emitNode(m_expr2);
1505             generator.emitJumpIfTrue(cond, topOfLoop.get());
1506         }
1507     } else
1508         generator.emitJump(topOfLoop.get());
1509
1510     generator.emitLabel(scope->breakTarget());
1511     return result.get();
1512 }
1513
1514 // ------------------------------ ForInNode ------------------------------------
1515
1516 RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1517 {
1518     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
1519
1520     if (!m_lexpr->isLocation())
1521         return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
1522
1523     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1524
1525     if (m_init)
1526         generator.emitNode(generator.ignoredResult(), m_init);
1527
1528     RefPtr<RegisterID> base = generator.newTemporary();
1529     generator.emitNode(base.get(), m_expr);
1530     RefPtr<RegisterID> i = generator.newTemporary();
1531     RefPtr<RegisterID> size = generator.newTemporary();
1532     RefPtr<RegisterID> expectedSubscript;
1533     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
1534     generator.emitJump(scope->continueTarget());
1535
1536     RefPtr<Label> loopStart = generator.newLabel();
1537     generator.emitLabel(loopStart.get());
1538
1539     RegisterID* propertyName;
1540     bool optimizedForinAccess = false;
1541     if (m_lexpr->isResolveNode()) {
1542         const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
1543         propertyName = generator.registerFor(ident);
1544         if (!propertyName) {
1545             propertyName = generator.newTemporary();
1546             RefPtr<RegisterID> protect = propertyName;
1547             RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
1548
1549             generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1550             generator.emitPutById(base, ident, propertyName);
1551         } else {
1552             expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
1553             generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
1554             optimizedForinAccess = true;
1555         }
1556     } else if (m_lexpr->isDotAccessorNode()) {
1557         DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
1558         const Identifier& ident = assignNode->identifier();
1559         propertyName = generator.newTemporary();
1560         RefPtr<RegisterID> protect = propertyName;
1561         RegisterID* base = generator.emitNode(assignNode->base());
1562
1563         generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
1564         generator.emitPutById(base, ident, propertyName);
1565     } else {
1566         ASSERT(m_lexpr->isBracketAccessorNode());
1567         BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
1568         propertyName = generator.newTemporary();
1569         RefPtr<RegisterID> protect = propertyName;
1570         RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
1571         RegisterID* subscript = generator.emitNode(assignNode->subscript());
1572
1573         generator.emitExpressionInfo(assignNode->divot(), assignNode->startOffset(), assignNode->endOffset());
1574         generator.emitPutByVal(base.get(), subscript, propertyName);
1575     }
1576
1577     generator.emitNode(dst, m_statement);
1578
1579     if (optimizedForinAccess)
1580         generator.popOptimisedForIn();
1581
1582     generator.emitLabel(scope->continueTarget());
1583     generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
1584     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1585     generator.emitLabel(scope->breakTarget());
1586     return dst;
1587 }
1588
1589 // ------------------------------ ContinueNode ---------------------------------
1590
1591 // ECMA 12.7
1592 RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1593 {
1594     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1595
1596     LabelScope* scope = generator.continueTarget(m_ident);
1597
1598     if (!scope)
1599         return m_ident.isEmpty()
1600             ? emitThrowError(generator, SyntaxError, "Invalid continue statement.")
1601             : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
1602
1603     generator.emitJumpScopes(scope->continueTarget(), scope->scopeDepth());
1604     return dst;
1605 }
1606
1607 // ------------------------------ BreakNode ------------------------------------
1608
1609 // ECMA 12.8
1610 RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1611 {
1612     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1613
1614     LabelScope* scope = generator.breakTarget(m_ident);
1615
1616     if (!scope)
1617         return m_ident.isEmpty()
1618             ? emitThrowError(generator, SyntaxError, "Invalid break statement.")
1619             : emitThrowError(generator, SyntaxError, "Undefined label: '%s'.", m_ident);
1620
1621     generator.emitJumpScopes(scope->breakTarget(), scope->scopeDepth());
1622     return dst;
1623 }
1624
1625 // ------------------------------ ReturnNode -----------------------------------
1626
1627 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1628 {
1629     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1630     if (generator.codeType() != FunctionCode)
1631         return emitThrowError(generator, SyntaxError, "Invalid return statement.");
1632
1633     if (dst == generator.ignoredResult())
1634         dst = 0;
1635     RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
1636     RefPtr<RegisterID> returnRegister;
1637     if (generator.scopeDepth()) {
1638         RefPtr<Label> l0 = generator.newLabel();
1639         if (generator.hasFinaliser() && !r0->isTemporary()) {
1640             returnRegister = generator.emitMove(generator.newTemporary(), r0);
1641             r0 = returnRegister.get();
1642         }
1643         generator.emitJumpScopes(l0.get(), 0);
1644         generator.emitLabel(l0.get());
1645     }
1646     generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
1647     return generator.emitReturn(r0);
1648 }
1649
1650 // ------------------------------ WithNode -------------------------------------
1651
1652 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1653 {
1654     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1655
1656     RefPtr<RegisterID> scope = generator.newTemporary();
1657     generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
1658     generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
1659     generator.emitPushScope(scope.get());
1660     RegisterID* result = generator.emitNode(dst, m_statement);
1661     generator.emitPopScope();
1662     return result;
1663 }
1664
1665 // ------------------------------ CaseClauseNode --------------------------------
1666
1667 inline void CaseClauseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1668 {
1669     if (m_statements)
1670         m_statements->emitBytecode(generator, dst);
1671 }
1672
1673 // ------------------------------ CaseBlockNode --------------------------------
1674
1675 enum SwitchKind {
1676     SwitchUnset = 0,
1677     SwitchNumber = 1,
1678     SwitchString = 2,
1679     SwitchNeither = 3
1680 };
1681
1682 static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>& literalVector, SwitchKind& typeForTable, bool& singleCharacterSwitch, int32_t& min_num, int32_t& max_num)
1683 {
1684     for (; list; list = list->getNext()) {
1685         ExpressionNode* clauseExpression = list->getClause()->expr();
1686         literalVector.append(clauseExpression);
1687         if (clauseExpression->isNumber()) {
1688             double value = static_cast<NumberNode*>(clauseExpression)->value();
1689             int32_t intVal = static_cast<int32_t>(value);
1690             if ((typeForTable & ~SwitchNumber) || (intVal != value)) {
1691                 typeForTable = SwitchNeither;
1692                 break;
1693             }
1694             if (intVal < min_num)
1695                 min_num = intVal;
1696             if (intVal > max_num)
1697                 max_num = intVal;
1698             typeForTable = SwitchNumber;
1699             continue;
1700         }
1701         if (clauseExpression->isString()) {
1702             if (typeForTable & ~SwitchString) {
1703                 typeForTable = SwitchNeither;
1704                 break;
1705             }
1706             const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
1707             if (singleCharacterSwitch &= value.size() == 1) {
1708                 int32_t intVal = value.rep()->characters()[0];
1709                 if (intVal < min_num)
1710                     min_num = intVal;
1711                 if (intVal > max_num)
1712                     max_num = intVal;
1713             }
1714             typeForTable = SwitchString;
1715             continue;
1716         }
1717         typeForTable = SwitchNeither;
1718         break;
1719     }
1720 }
1721
1722 SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num)
1723 {
1724     SwitchKind typeForTable = SwitchUnset;
1725     bool singleCharacterSwitch = true;
1726
1727     processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
1728     processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
1729
1730     if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
1731         return SwitchInfo::SwitchNone;
1732
1733     if (typeForTable == SwitchNumber) {
1734         int32_t range = max_num - min_num;
1735         if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
1736             return SwitchInfo::SwitchImmediate;
1737         return SwitchInfo::SwitchNone;
1738     }
1739
1740     ASSERT(typeForTable == SwitchString);
1741
1742     if (singleCharacterSwitch) {
1743         int32_t range = max_num - min_num;
1744         if (min_num <= max_num && range <= 1000 && (range / literalVector.size()) < 10)
1745             return SwitchInfo::SwitchCharacter;
1746     }
1747
1748     return SwitchInfo::SwitchString;
1749 }
1750
1751 RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, RegisterID* switchExpression, RegisterID* dst)
1752 {
1753     RefPtr<Label> defaultLabel;
1754     Vector<RefPtr<Label>, 8> labelVector;
1755     Vector<ExpressionNode*, 8> literalVector;
1756     int32_t min_num = std::numeric_limits<int32_t>::max();
1757     int32_t max_num = std::numeric_limits<int32_t>::min();
1758     SwitchInfo::SwitchType switchType = tryOptimizedSwitch(literalVector, min_num, max_num);
1759
1760     if (switchType != SwitchInfo::SwitchNone) {
1761         // Prepare the various labels
1762         for (uint32_t i = 0; i < literalVector.size(); i++)
1763             labelVector.append(generator.newLabel());
1764         defaultLabel = generator.newLabel();
1765         generator.beginSwitch(switchExpression, switchType);
1766     } else {
1767         // Setup jumps
1768         for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
1769             RefPtr<RegisterID> clauseVal = generator.newTemporary();
1770             generator.emitNode(clauseVal.get(), list->getClause()->expr());
1771             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
1772             labelVector.append(generator.newLabel());
1773             generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
1774         }
1775
1776         for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
1777             RefPtr<RegisterID> clauseVal = generator.newTemporary();
1778             generator.emitNode(clauseVal.get(), list->getClause()->expr());
1779             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
1780             labelVector.append(generator.newLabel());
1781             generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
1782         }
1783         defaultLabel = generator.newLabel();
1784         generator.emitJump(defaultLabel.get());
1785     }
1786
1787     RegisterID* result = 0;
1788
1789     size_t i = 0;
1790     for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
1791         generator.emitLabel(labelVector[i++].get());
1792         list->getClause()->emitBytecode(generator, dst);
1793     }
1794
1795     if (m_defaultClause) {
1796         generator.emitLabel(defaultLabel.get());
1797         m_defaultClause->emitBytecode(generator, dst);
1798     }
1799
1800     for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
1801         generator.emitLabel(labelVector[i++].get());
1802         list->getClause()->emitBytecode(generator, dst);
1803     }
1804     if (!m_defaultClause)
1805         generator.emitLabel(defaultLabel.get());
1806
1807     ASSERT(i == labelVector.size());
1808     if (switchType != SwitchInfo::SwitchNone) {
1809         ASSERT(labelVector.size() == literalVector.size());
1810         generator.endSwitch(labelVector.size(), labelVector.data(), literalVector.data(), defaultLabel.get(), min_num, max_num);
1811     }
1812     return result;
1813 }
1814
1815 // ------------------------------ SwitchNode -----------------------------------
1816
1817 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1818 {
1819     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1820
1821     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
1822
1823     RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
1824     RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
1825
1826     generator.emitLabel(scope->breakTarget());
1827     return r1;
1828 }
1829
1830 // ------------------------------ LabelNode ------------------------------------
1831
1832 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1833 {
1834     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1835
1836     if (generator.breakTarget(m_name))
1837         return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
1838
1839     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
1840     RegisterID* r0 = generator.emitNode(dst, m_statement);
1841
1842     generator.emitLabel(scope->breakTarget());
1843     return r0;
1844 }
1845
1846 // ------------------------------ ThrowNode ------------------------------------
1847
1848 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1849 {
1850     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1851
1852     if (dst == generator.ignoredResult())
1853         dst = 0;
1854     RefPtr<RegisterID> expr = generator.emitNode(m_expr);
1855     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
1856     generator.emitThrow(expr.get());
1857     return 0;
1858 }
1859
1860 // ------------------------------ TryNode --------------------------------------
1861
1862 RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1863 {
1864     // NOTE: The catch and finally blocks must be labeled explicitly, so the
1865     // optimizer knows they may be jumped to from anywhere.
1866
1867     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
1868
1869     RefPtr<Label> tryStartLabel = generator.newLabel();
1870     RefPtr<Label> finallyStart;
1871     RefPtr<RegisterID> finallyReturnAddr;
1872     if (m_finallyBlock) {
1873         finallyStart = generator.newLabel();
1874         finallyReturnAddr = generator.newTemporary();
1875         generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
1876     }
1877
1878     generator.emitLabel(tryStartLabel.get());
1879     generator.emitNode(dst, m_tryBlock);
1880
1881     if (m_catchBlock) {
1882         RefPtr<Label> catchEndLabel = generator.newLabel();
1883
1884         // Normal path: jump over the catch block.
1885         generator.emitJump(catchEndLabel.get());
1886
1887         // Uncaught exception path: the catch block.
1888         RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
1889         RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
1890         if (m_catchHasEval) {
1891             RefPtr<RegisterID> dynamicScopeObject = generator.emitNewObject(generator.newTemporary());
1892             generator.emitPutById(dynamicScopeObject.get(), m_exceptionIdent, exceptionRegister.get());
1893             generator.emitMove(exceptionRegister.get(), dynamicScopeObject.get());
1894             generator.emitPushScope(exceptionRegister.get());
1895         } else
1896             generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
1897         generator.emitNode(dst, m_catchBlock);
1898         generator.emitPopScope();
1899         generator.emitLabel(catchEndLabel.get());
1900     }
1901
1902     if (m_finallyBlock) {
1903         generator.popFinallyContext();
1904         // there may be important registers live at the time we jump
1905         // to a finally block (such as for a return or throw) so we
1906         // ref the highest register ever used as a conservative
1907         // approach to not clobbering anything important
1908         RefPtr<RegisterID> highestUsedRegister = generator.highestUsedRegister();
1909         RefPtr<Label> finallyEndLabel = generator.newLabel();
1910
1911         // Normal path: invoke the finally block, then jump over it.
1912         generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
1913         generator.emitJump(finallyEndLabel.get());
1914
1915         // Uncaught exception path: invoke the finally block, then re-throw the exception.
1916         RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
1917         RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
1918         generator.emitJumpSubroutine(finallyReturnAddr.get(), finallyStart.get());
1919         generator.emitThrow(tempExceptionRegister.get());
1920
1921         // The finally block.
1922         generator.emitLabel(finallyStart.get());
1923         generator.emitNode(dst, m_finallyBlock);
1924         generator.emitSubroutineReturn(finallyReturnAddr.get());
1925
1926         generator.emitLabel(finallyEndLabel.get());
1927     }
1928
1929     return dst;
1930 }
1931
1932 // ------------------------------ ScopeNode -----------------------------
1933
1934 inline void ScopeNode::emitStatementsBytecode(BytecodeGenerator& generator, RegisterID* dst)
1935 {
1936     if (m_data->m_statements)
1937         m_data->m_statements->emitBytecode(generator, dst);
1938 }
1939
1940 // ------------------------------ ProgramNode -----------------------------
1941
1942 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1943 {
1944     generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
1945
1946     RefPtr<RegisterID> dstRegister = generator.newTemporary();
1947     generator.emitLoad(dstRegister.get(), jsUndefined());
1948     emitStatementsBytecode(generator, dstRegister.get());
1949
1950     generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
1951     generator.emitEnd(dstRegister.get());
1952     return 0;
1953 }
1954
1955 // ------------------------------ EvalNode -----------------------------
1956
1957 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1958 {
1959     generator.emitDebugHook(WillExecuteProgram, firstLine(), lastLine());
1960
1961     RefPtr<RegisterID> dstRegister = generator.newTemporary();
1962     generator.emitLoad(dstRegister.get(), jsUndefined());
1963     emitStatementsBytecode(generator, dstRegister.get());
1964
1965     generator.emitDebugHook(DidExecuteProgram, firstLine(), lastLine());
1966     generator.emitEnd(dstRegister.get());
1967     return 0;
1968 }
1969
1970 // ------------------------------ FunctionBodyNode -----------------------------
1971
1972 RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
1973 {
1974     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
1975     emitStatementsBytecode(generator, generator.ignoredResult());
1976     StatementNode* singleStatement = this->singleStatement();
1977     if (singleStatement && singleStatement->isBlock()) {
1978         StatementNode* lastStatementInBlock = static_cast<BlockNode*>(singleStatement)->lastStatement();
1979         if (lastStatementInBlock && lastStatementInBlock->isReturnNode())
1980             return 0;
1981     }
1982
1983     RegisterID* r0 = generator.emitLoad(0, jsUndefined());
1984     generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
1985     generator.emitReturn(r0);
1986     return 0;
1987 }
1988
1989 // ------------------------------ FuncDeclNode ---------------------------------
1990
1991 RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
1992 {
1993     if (dst == generator.ignoredResult())
1994         dst = 0;
1995     return dst;
1996 }
1997
1998 // ------------------------------ FuncExprNode ---------------------------------
1999
2000 RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
2001 {
2002     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
2003 }
2004
2005 } // namespace JSC