git.saurik.com Git - apple/javascriptcore.git/blob

1 /*

3 *

4 * Redistribution and use in source and binary forms, with or without

5 * modification, are permitted provided that the following conditions

6 * are met:

7 * 1. Redistributions of source code must retain the above copyright

8 * notice, this list of conditions and the following disclaimer.

9 * 2. Redistributions in binary form must reproduce the above copyright

10 * notice, this list of conditions and the following disclaimer in the

11 * documentation and/or other materials provided with the distribution.

12 *

13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

24 */

26 #include "config.h"

27 #include "DFGFixupPhase.h"

29 #if ENABLE(DFG_JIT)

31 #include "ArrayPrototype.h"

32 #include "DFGGraph.h"

33 #include "DFGInsertionSet.h"

34 #include "DFGPhase.h"

35 #include "DFGPredictionPropagationPhase.h"

36 #include "DFGVariableAccessDataDump.h"

37 #include "JSCInlines.h"

38 #include "TypeLocation.h"

40 namespace JSC { namespace DFG {

42 class FixupPhase : public Phase {

43 public:

44 FixupPhase(Graph& graph)

         : Phase(graph, "fixup")

46 , m_insertionSet(graph)

47 {

48 }

50 bool run()

51 {

         ASSERT(m_graph.m_fixpointState == BeforeFixpoint);

         ASSERT(m_graph.m_form == ThreadedCPS);

55 m_profitabilityChanged = false;

         for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

             fixupBlock(m_graph.block(blockIndex));

59 while (m_profitabilityChanged) {

60 m_profitabilityChanged = false;

             for (unsigned i = m_graph.m_argumentPositions.size(); i--;)

                 m_graph.m_argumentPositions[i].mergeArgumentUnboxingAwareness();

             for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

                 fixupGetAndSetLocalsInBlock(m_graph.block(blockIndex));

67 }

         for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

             injectTypeConversionsInBlock(m_graph.block(blockIndex));

         m_graph.m_planStage = PlanStage::AfterFixup;

74 return true;

75 }

77 private:

     void fixupBlock(BasicBlock* block)

79 {

80 if (!block)

81 return;

82 ASSERT(block->isReachable);

83 m_block = block;

         for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {

             m_currentNode = block->at(m_indexInBlock);

86 fixupNode(m_currentNode);

87 }

88 m_insertionSet.execute(block);

89 }

     void fixupNode(Node* node)

92 {

93 NodeType op = node->op();

95 switch (op) {

96 case SetLocal: {

97 // This gets handled by fixupGetAndSetLocalsInBlock().

98 return;

99 }

100

101 case BitAnd:

102 case BitOr:

103 case BitXor:

104 case BitRShift:

105 case BitLShift:

106 case BitURShift: {

             fixIntConvertingEdge(node->child1());

             fixIntConvertingEdge(node->child2());

109 break;

110 }

111

112 case ArithIMul: {

             fixIntConvertingEdge(node->child1());

             fixIntConvertingEdge(node->child2());

115 node->setOp(ArithMul);

             node->setArithMode(Arith::Unchecked);

             node->child1().setUseKind(Int32Use);

             node->child2().setUseKind(Int32Use);

119 break;

120 }

121

122 case ArithClz32: {

             fixIntConvertingEdge(node->child1());

             node->setArithMode(Arith::Unchecked);

125 break;

126 }

127

128 case UInt32ToNumber: {

             fixIntConvertingEdge(node->child1());

             if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

131 node->convertToIdentity();

             else if (node->canSpeculateInt32(FixupPass))

                 node->setArithMode(Arith::CheckOverflow);

134 else {

                 node->setArithMode(Arith::DoOverflow);

136 node->setResult(NodeResultDouble);

137 }

138 break;

139 }

140

141 case ValueAdd: {

             if (attemptToMakeIntegerAdd(node)) {

143 node->setOp(ArithAdd);

144 break;

145 }

             if (Node::shouldSpeculateNumberOrBooleanExpectingDefined(node->child1().node(), node->child2().node())) {

                 fixDoubleOrBooleanEdge(node->child1());

                 fixDoubleOrBooleanEdge(node->child2());

149 node->setOp(ArithAdd);

150 node->setResult(NodeResultDouble);

151 break;

152 }

153

154 // FIXME: Optimize for the case where one of the operands is the

155 // empty string. Also consider optimizing for the case where we don't

156 // believe either side is the emtpy string. Both of these things should

157 // be easy.

158

             if (node->child1()->shouldSpeculateString()

                 && attemptToMakeFastStringAdd<StringUse>(node, node->child1(), node->child2()))

161 break;

             if (node->child2()->shouldSpeculateString()

                 && attemptToMakeFastStringAdd<StringUse>(node, node->child2(), node->child1()))

164 break;

             if (node->child1()->shouldSpeculateStringObject()

                 && attemptToMakeFastStringAdd<StringObjectUse>(node, node->child1(), node->child2()))

167 break;

             if (node->child2()->shouldSpeculateStringObject()

                 && attemptToMakeFastStringAdd<StringObjectUse>(node, node->child2(), node->child1()))

170 break;

             if (node->child1()->shouldSpeculateStringOrStringObject()

                 && attemptToMakeFastStringAdd<StringOrStringObjectUse>(node, node->child1(), node->child2()))

173 break;

             if (node->child2()->shouldSpeculateStringOrStringObject()

                 && attemptToMakeFastStringAdd<StringOrStringObjectUse>(node, node->child2(), node->child1()))

176 break;

177 break;

178 }

179

180 case MakeRope: {

181 fixupMakeRope(node);

182 break;

183 }

184

185 case ArithAdd:

186 case ArithSub: {

             if (attemptToMakeIntegerAdd(node))

188 break;

             fixDoubleOrBooleanEdge(node->child1());

             fixDoubleOrBooleanEdge(node->child2());

191 node->setResult(NodeResultDouble);

192 break;

193 }

194

195 case ArithNegate: {

             if (m_graph.negateShouldSpeculateInt32(node, FixupPass)) {

                 fixIntOrBooleanEdge(node->child1());

                 if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

                     node->setArithMode(Arith::Unchecked);

                 else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithMode(Arith::CheckOverflow);

202 else

                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);

204 break;

205 }

             if (m_graph.negateShouldSpeculateMachineInt(node, FixupPass)) {

                 fixEdge<Int52RepUse>(node->child1());

                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithMode(Arith::CheckOverflow);

210 else

                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);

212 node->setResult(NodeResultInt52);

213 break;

214 }

             fixDoubleOrBooleanEdge(node->child1());

216 node->setResult(NodeResultDouble);

217 break;

218 }

219

220 case ArithMul: {

             if (m_graph.mulShouldSpeculateInt32(node, FixupPass)) {

                 fixIntOrBooleanEdge(node->child1());

                 fixIntOrBooleanEdge(node->child2());

                 if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

                     node->setArithMode(Arith::Unchecked);

                 else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithMode(Arith::CheckOverflow);

228 else

                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);

230 break;

231 }

             if (m_graph.mulShouldSpeculateMachineInt(node, FixupPass)) {

                 fixEdge<Int52RepUse>(node->child1());

                 fixEdge<Int52RepUse>(node->child2());

                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithMode(Arith::CheckOverflow);

237 else

                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);

239 node->setResult(NodeResultInt52);

240 break;

241 }

             fixDoubleOrBooleanEdge(node->child1());

             fixDoubleOrBooleanEdge(node->child2());

244 node->setResult(NodeResultDouble);

245 break;

246 }

247

248 case ArithDiv:

249 case ArithMod: {

             if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())

                 && node->canSpeculateInt32(FixupPass)) {

                 if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {

                     fixIntOrBooleanEdge(node->child1());

                     fixIntOrBooleanEdge(node->child2());

                     if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

                         node->setArithMode(Arith::Unchecked);

                     else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                         node->setArithMode(Arith::CheckOverflow);

259 else

                         node->setArithMode(Arith::CheckOverflowAndNegativeZero);

261 break;

262 }

263

264 // This will cause conversion nodes to be inserted later.

                 fixDoubleOrBooleanEdge(node->child1());

                 fixDoubleOrBooleanEdge(node->child2());

267

268 // We don't need to do ref'ing on the children because we're stealing them from

269 // the original division.

                 Node* newDivision = m_insertionSet.insertNode(

271 m_indexInBlock, SpecBytecodeDouble, *node);

272 newDivision->setResult(NodeResultDouble);

273

274 node->setOp(DoubleAsInt32);

                 node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());

                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithMode(Arith::CheckOverflow);

278 else

                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);

280 break;

281 }

             fixDoubleOrBooleanEdge(node->child1());

             fixDoubleOrBooleanEdge(node->child2());

284 node->setResult(NodeResultDouble);

285 break;

286 }

287

288 case ArithMin:

289 case ArithMax: {

             if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())

                 && node->canSpeculateInt32(FixupPass)) {

                 fixIntOrBooleanEdge(node->child1());

                 fixIntOrBooleanEdge(node->child2());

294 break;

295 }

             fixDoubleOrBooleanEdge(node->child1());

             fixDoubleOrBooleanEdge(node->child2());

298 node->setResult(NodeResultDouble);

299 break;

300 }

301

302 case ArithAbs: {

             if (node->child1()->shouldSpeculateInt32OrBooleanForArithmetic()

                 && node->canSpeculateInt32(FixupPass)) {

                 fixIntOrBooleanEdge(node->child1());

306 break;

307 }

             fixDoubleOrBooleanEdge(node->child1());

309 node->setResult(NodeResultDouble);

310 break;

311 }

312

313 case ArithPow: {

314 node->setResult(NodeResultDouble);

             if (node->child2()->shouldSpeculateInt32OrBooleanForArithmetic()) {

                 fixDoubleOrBooleanEdge(node->child1());

                 fixIntOrBooleanEdge(node->child2());

318 break;

319 }

320

             fixDoubleOrBooleanEdge(node->child1());

             fixDoubleOrBooleanEdge(node->child2());

323 break;

324 }

325

326 case ArithRound: {

             if (node->child1()->shouldSpeculateInt32OrBooleanForArithmetic() && node->canSpeculateInt32(FixupPass)) {

                 fixIntOrBooleanEdge(node->child1());

                 insertCheck<Int32Use>(m_indexInBlock, node->child1().node());

330 node->convertToIdentity();

331 break;

332 }

             fixDoubleOrBooleanEdge(node->child1());

334

             if (isInt32OrBooleanSpeculation(node->getHeapPrediction()) && m_graph.roundShouldSpeculateInt32(node, FixupPass)) {

336 node->setResult(NodeResultInt32);

                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                     node->setArithRoundingMode(Arith::RoundingMode::Int32);

339 else

                     node->setArithRoundingMode(Arith::RoundingMode::Int32WithNegativeZeroCheck);

341 } else {

342 node->setResult(NodeResultDouble);

                 node->setArithRoundingMode(Arith::RoundingMode::Double);

344 }

345 break;

346 }

347

348 case ArithSqrt:

349 case ArithFRound:

350 case ArithSin:

351 case ArithCos:

352 case ArithLog: {

             fixDoubleOrBooleanEdge(node->child1());

354 node->setResult(NodeResultDouble);

355 break;

356 }

357

358 case LogicalNot: {

             if (node->child1()->shouldSpeculateBoolean())

                 fixEdge<BooleanUse>(node->child1());

             else if (node->child1()->shouldSpeculateObjectOrOther())

                 fixEdge<ObjectOrOtherUse>(node->child1());

             else if (node->child1()->shouldSpeculateInt32OrBoolean())

                 fixIntOrBooleanEdge(node->child1());

             else if (node->child1()->shouldSpeculateNumber())

                 fixEdge<DoubleRepUse>(node->child1());

             else if (node->child1()->shouldSpeculateString())

                 fixEdge<StringUse>(node->child1());

369 break;

370 }

371

372 case CompareEqConstant: {

373 break;

374 }

375

376 case CompareEq:

377 case CompareLess:

378 case CompareLessEq:

379 case CompareGreater:

380 case CompareGreaterEq: {

             if (node->op() == CompareEq

                 && Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {

                 fixEdge<BooleanUse>(node->child1());

                 fixEdge<BooleanUse>(node->child2());

385 node->clearFlags(NodeMustGenerate);

386 break;

387 }

             if (Node::shouldSpeculateInt32OrBoolean(node->child1().node(), node->child2().node())) {

                 fixIntOrBooleanEdge(node->child1());

                 fixIntOrBooleanEdge(node->child2());

391 node->clearFlags(NodeMustGenerate);

392 break;

393 }

394 if (enableInt52()

                 && Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {

                 fixEdge<Int52RepUse>(node->child1());

                 fixEdge<Int52RepUse>(node->child2());

398 node->clearFlags(NodeMustGenerate);

399 break;

400 }

             if (Node::shouldSpeculateNumberOrBoolean(node->child1().node(), node->child2().node())) {

                 fixDoubleOrBooleanEdge(node->child1());

                 fixDoubleOrBooleanEdge(node->child2());

404 node->clearFlags(NodeMustGenerate);

405 break;

406 }

             if (node->op() != CompareEq)

408 break;

             if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {

                 fixEdge<StringIdentUse>(node->child1());

                 fixEdge<StringIdentUse>(node->child2());

412 node->clearFlags(NodeMustGenerate);

413 break;

414 }

             if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && GPRInfo::numberOfRegisters >= 7) {

                 fixEdge<StringUse>(node->child1());

                 fixEdge<StringUse>(node->child2());

418 node->clearFlags(NodeMustGenerate);

419 break;

420 }

             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

                 fixEdge<ObjectUse>(node->child1());

                 fixEdge<ObjectUse>(node->child2());

424 node->clearFlags(NodeMustGenerate);

425 break;

426 }

             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {

                 fixEdge<ObjectUse>(node->child1());

                 fixEdge<ObjectOrOtherUse>(node->child2());

430 node->clearFlags(NodeMustGenerate);

431 break;

432 }

             if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {

                 fixEdge<ObjectOrOtherUse>(node->child1());

                 fixEdge<ObjectUse>(node->child2());

436 node->clearFlags(NodeMustGenerate);

437 break;

438 }

439 break;

440 }

441

442 case CompareStrictEq: {

             if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {

                 fixEdge<BooleanUse>(node->child1());

                 fixEdge<BooleanUse>(node->child2());

446 break;

447 }

             if (Node::shouldSpeculateInt32(node->child1().node(), node->child2().node())) {

                 fixEdge<Int32Use>(node->child1());

                 fixEdge<Int32Use>(node->child2());

451 break;

452 }

453 if (enableInt52()

                 && Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {

                 fixEdge<Int52RepUse>(node->child1());

                 fixEdge<Int52RepUse>(node->child2());

457 break;

458 }

             if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {

                 fixEdge<DoubleRepUse>(node->child1());

                 fixEdge<DoubleRepUse>(node->child2());

462 break;

463 }

             if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {

                 fixEdge<StringIdentUse>(node->child1());

                 fixEdge<StringIdentUse>(node->child2());

467 break;

468 }

             if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 7) || isFTL(m_graph.m_plan.mode))) {

                 fixEdge<StringUse>(node->child1());

                 fixEdge<StringUse>(node->child2());

472 break;

473 }

             WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();

             if (masqueradesAsUndefinedWatchpoint->isStillValid()) {

476

                 if (node->child1()->shouldSpeculateObject()) {

                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);

                     fixEdge<ObjectUse>(node->child1());

480 break;

481 }

                 if (node->child2()->shouldSpeculateObject()) {

                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);

                     fixEdge<ObjectUse>(node->child2());

485 break;

486 }

487

             } else if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

                 fixEdge<ObjectUse>(node->child1());

                 fixEdge<ObjectUse>(node->child2());

491 break;

492 }

             if (node->child1()->shouldSpeculateMisc()) {

                 fixEdge<MiscUse>(node->child1());

495 break;

496 }

             if (node->child2()->shouldSpeculateMisc()) {

                 fixEdge<MiscUse>(node->child2());

499 break;

500 }

             if (node->child1()->shouldSpeculateStringIdent()

                 && node->child2()->shouldSpeculateNotStringVar()) {

                 fixEdge<StringIdentUse>(node->child1());

                 fixEdge<NotStringVarUse>(node->child2());

505 break;

506 }

             if (node->child2()->shouldSpeculateStringIdent()

                 && node->child1()->shouldSpeculateNotStringVar()) {

                 fixEdge<StringIdentUse>(node->child2());

                 fixEdge<NotStringVarUse>(node->child1());

511 break;

512 }

             if (node->child1()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {

                 fixEdge<StringUse>(node->child1());

515 break;

516 }

             if (node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {

                 fixEdge<StringUse>(node->child2());

519 break;

520 }

521 break;

522 }

523

524 case StringFromCharCode:

             fixEdge<Int32Use>(node->child1());

526 break;

527

528 case StringCharAt:

529 case StringCharCodeAt: {

530 // Currently we have no good way of refining these.

             ASSERT(node->arrayMode() == ArrayMode(Array::String));

             blessArrayOperation(node->child1(), node->child2(), node->child3());

             fixEdge<KnownCellUse>(node->child1());

             fixEdge<Int32Use>(node->child2());

535 break;

536 }

537

538 case GetByVal: {

             if (!node->prediction()) {

540 m_insertionSet.insertNode(

                     m_indexInBlock, SpecNone, ForceOSRExit, node->origin);

542 }

543

544 node->setArrayMode(

                 node->arrayMode().refine(

546 m_graph, node,

                     node->child1()->prediction(),

                     node->child2()->prediction(),

549 SpecNone));

550

             blessArrayOperation(node->child1(), node->child2(), node->child3());

552

553 ArrayMode arrayMode = node->arrayMode();

             switch (arrayMode.type()) {

555 case Array::Contiguous:

556 case Array::Double:

                 if (arrayMode.arrayClass() == Array::OriginalArray

                     && arrayMode.speculation() == Array::InBounds) {

                     JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);

                     if (globalObject->arrayPrototypeChainIsSane()) {

561 // Check if SaneChain will work on a per-type basis. Note that:

562 //

563 // 1) We don't want double arrays to sometimes return undefined, since

564 // that would require a change to the return type and it would pessimise

565 // things a lot. So, we'd only want to do that if we actually had

566 // evidence that we could read from a hole. That's pretty annoying.

567 // Likely the best way to handle that case is with an equivalent of

568 // SaneChain for OutOfBounds. For now we just detect when Undefined and

569 // NaN are indistinguishable according to backwards propagation, and just

570 // use SaneChain in that case. This happens to catch a lot of cases.

571 //

572 // 2) We don't want int32 array loads to have to do a hole check just to

573 // coerce to Undefined, since that would mean twice the checks.

574 //

575 // This has two implications. First, we have to do more checks than we'd

576 // like. It's unfortunate that we have to do the hole check. Second,

577 // some accesses that hit a hole will now need to take the full-blown

578 // out-of-bounds slow path. We can fix that with:

579 // https://bugs.webkit.org/show_bug.cgi?id=144668

580

581 bool canDoSaneChain = false;

                         switch (arrayMode.type()) {

583 case Array::Contiguous:

584 // This is happens to be entirely natural. We already would have

585 // returned any JSValue, and now we'll return Undefined. We still do

586 // the check but it doesn't require taking any kind of slow path.

587 canDoSaneChain = true;

588 break;

589

590 case Array::Double:

                             if (!(node->flags() & NodeBytecodeUsesAsOther)) {

592 // Holes look like NaN already, so if the user doesn't care

593 // about the difference between Undefined and NaN then we can

594 // do this.

595 canDoSaneChain = true;

596 }

597 break;

598

599 default:

600 break;

601 }

602

603 if (canDoSaneChain) {

                             m_graph.watchpoints().addLazily(

                                 globalObject->arrayPrototype()->structure()->transitionWatchpointSet());

                             m_graph.watchpoints().addLazily(

                                 globalObject->objectPrototype()->structure()->transitionWatchpointSet());

                             node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));

609 }

610 }

611 }

612 break;

613

614 case Array::String:

                 if ((node->prediction() & ~SpecString)

                     || m_graph.hasExitSite(node->origin.semantic, OutOfBounds))

                     node->setArrayMode(arrayMode.withSpeculation(Array::OutOfBounds));

618 break;

619

620 default:

621 break;

622 }

623

624 arrayMode = node->arrayMode();

             switch (arrayMode.type()) {

626 case Array::SelectUsingPredictions:

627 case Array::Unprofiled:

628 case Array::Undecided:

629 RELEASE_ASSERT_NOT_REACHED();

630 break;

631 case Array::Generic:

632 #if USE(JSVALUE32_64)

                 fixEdge<CellUse>(node->child1()); // Speculating cell due to register pressure on 32-bit.

634 #endif

635 break;

636 case Array::ForceExit:

637 break;

638 default:

                 fixEdge<KnownCellUse>(node->child1());

                 fixEdge<Int32Use>(node->child2());

641 break;

642 }

643

             switch (arrayMode.type()) {

645 case Array::Double:

                 if (!arrayMode.isOutOfBounds())

647 node->setResult(NodeResultDouble);

648 break;

649

650 case Array::Float32Array:

651 case Array::Float64Array:

652 node->setResult(NodeResultDouble);

653 break;

654

655 case Array::Uint32Array:

                 if (node->shouldSpeculateInt32())

657 break;

                 if (node->shouldSpeculateMachineInt() && enableInt52())

659 node->setResult(NodeResultInt52);

660 else

661 node->setResult(NodeResultDouble);

662 break;

663

664 default:

665 break;

666 }

667

668 break;

669 }

670

671 case PutByValDirect:

672 case PutByVal:

673 case PutByValAlias: {

             Edge& child1 = m_graph.varArgChild(node, 0);

             Edge& child2 = m_graph.varArgChild(node, 1);

             Edge& child3 = m_graph.varArgChild(node, 2);

677

678 node->setArrayMode(

                 node->arrayMode().refine(

680 m_graph, node,

681 child1->prediction(),

682 child2->prediction(),

683 child3->prediction()));

684

             blessArrayOperation(child1, child2, m_graph.varArgChild(node, 3));

686

             switch (node->arrayMode().modeForPut().type()) {

688 case Array::SelectUsingPredictions:

689 case Array::Unprofiled:

690 case Array::Undecided:

691 RELEASE_ASSERT_NOT_REACHED();

692 break;

693 case Array::ForceExit:

694 case Array::Generic:

695 #if USE(JSVALUE32_64)

696 // Due to register pressure on 32-bit, we speculate cell and

697 // ignore the base-is-not-cell case entirely by letting the

698 // baseline JIT handle it.

699 fixEdge<CellUse>(child1);

700 #endif

701 break;

702 case Array::Int32:

703 fixEdge<KnownCellUse>(child1);

704 fixEdge<Int32Use>(child2);

705 fixEdge<Int32Use>(child3);

706 break;

707 case Array::Double:

708 fixEdge<KnownCellUse>(child1);

709 fixEdge<Int32Use>(child2);

710 fixEdge<DoubleRepRealUse>(child3);

711 break;

712 case Array::Int8Array:

713 case Array::Int16Array:

714 case Array::Int32Array:

715 case Array::Uint8Array:

716 case Array::Uint8ClampedArray:

717 case Array::Uint16Array:

718 case Array::Uint32Array:

719 fixEdge<KnownCellUse>(child1);

720 fixEdge<Int32Use>(child2);

                 if (child3->shouldSpeculateInt32())

722 fixIntOrBooleanEdge(child3);

                 else if (child3->shouldSpeculateMachineInt())

724 fixEdge<Int52RepUse>(child3);

725 else

726 fixDoubleOrBooleanEdge(child3);

727 break;

728 case Array::Float32Array:

729 case Array::Float64Array:

730 fixEdge<KnownCellUse>(child1);

731 fixEdge<Int32Use>(child2);

732 fixDoubleOrBooleanEdge(child3);

733 break;

734 case Array::Contiguous:

735 case Array::ArrayStorage:

736 case Array::SlowPutArrayStorage:

737 fixEdge<KnownCellUse>(child1);

738 fixEdge<Int32Use>(child2);

739 speculateForBarrier(child3);

740 break;

741 default:

742 fixEdge<KnownCellUse>(child1);

743 fixEdge<Int32Use>(child2);

744 break;

745 }

746 break;

747 }

748

749 case ArrayPush: {

750 // May need to refine the array mode in case the value prediction contravenes

751 // the array prediction. For example, we may have evidence showing that the

752 // array is in Int32 mode, but the value we're storing is likely to be a double.

753 // Then we should turn this into a conversion to Double array followed by the

754 // push. On the other hand, we absolutely don't want to refine based on the

755 // base prediction. If it has non-cell garbage in it, then we want that to be

756 // ignored. That's because ArrayPush can't handle any array modes that aren't

757 // array-related - so if refine() turned this into a "Generic" ArrayPush then

758 // that would break things.

759 node->setArrayMode(

                 node->arrayMode().refine(

761 m_graph, node,

                     node->child1()->prediction() & SpecCell,

763 SpecInt32,

                     node->child2()->prediction()));

             blessArrayOperation(node->child1(), Edge(), node->child3());

             fixEdge<KnownCellUse>(node->child1());

767

             switch (node->arrayMode().type()) {

769 case Array::Int32:

                 fixEdge<Int32Use>(node->child2());

771 break;

772 case Array::Double:

                 fixEdge<DoubleRepRealUse>(node->child2());

774 break;

775 case Array::Contiguous:

776 case Array::ArrayStorage:

                 speculateForBarrier(node->child2());

778 break;

779 default:

780 break;

781 }

782 break;

783 }

784

785 case ArrayPop: {

             blessArrayOperation(node->child1(), Edge(), node->child2());

             fixEdge<KnownCellUse>(node->child1());

788 break;

789 }

790

791 case RegExpExec:

792 case RegExpTest: {

             fixEdge<CellUse>(node->child1());

             fixEdge<CellUse>(node->child2());

795 break;

796 }

797

798 case Branch: {

             if (node->child1()->shouldSpeculateBoolean())

                 fixEdge<BooleanUse>(node->child1());

             else if (node->child1()->shouldSpeculateObjectOrOther())

                 fixEdge<ObjectOrOtherUse>(node->child1());

             else if (node->child1()->shouldSpeculateInt32OrBoolean())

                 fixIntOrBooleanEdge(node->child1());

             else if (node->child1()->shouldSpeculateNumber())

                 fixEdge<DoubleRepUse>(node->child1());

             else if (node->child1()->shouldSpeculateString())

                 fixEdge<StringUse>(node->child1());

809 break;

810 }

811

812 case Switch: {

             SwitchData* data = node->switchData();

814 switch (data->kind) {

815 case SwitchImm:

                 if (node->child1()->shouldSpeculateInt32())

                     fixEdge<Int32Use>(node->child1());

818 break;

819 case SwitchChar:

                 if (node->child1()->shouldSpeculateString())

                     fixEdge<StringUse>(node->child1());

822 break;

823 case SwitchString:

                 if (node->child1()->shouldSpeculateStringIdent())

                     fixEdge<StringIdentUse>(node->child1());

                 else if (node->child1()->shouldSpeculateString())

                     fixEdge<StringUse>(node->child1());

828 break;

829 case SwitchCell:

                 if (node->child1()->shouldSpeculateCell())

                     fixEdge<CellUse>(node->child1());

832 // else it's fine for this to have UntypedUse; we will handle this by just making

833 // non-cells take the default case.

834 break;

835 }

836 break;

837 }

838

839 case ToPrimitive: {

840 fixupToPrimitive(node);

841 break;

842 }

843

844 case ToString:

845 case CallStringConstructor: {

846 fixupToStringOrCallStringConstructor(node);

847 break;

848 }

849

850 case NewStringObject: {

             fixEdge<KnownStringUse>(node->child1());

852 break;

853 }

854

855 case NewArray: {

             for (unsigned i = m_graph.varArgNumChildren(node); i--;) {

857 node->setIndexingType(

858 leastUpperBoundOfIndexingTypeAndType(

                         node->indexingType(), m_graph.varArgChild(node, i)->prediction()));

860 }

             switch (node->indexingType()) {

862 case ALL_BLANK_INDEXING_TYPES:

863 CRASH();

864 break;

865 case ALL_UNDECIDED_INDEXING_TYPES:

                 if (node->numChildren()) {

867 // This will only happen if the children have no type predictions. We

868 // would have already exited by now, but insert a forced exit just to

869 // be safe.

870 m_insertionSet.insertNode(

                         m_indexInBlock, SpecNone, ForceOSRExit, node->origin);

872 }

873 break;

874 case ALL_INT32_INDEXING_TYPES:

                 for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                     fixEdge<Int32Use>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);

877 break;

878 case ALL_DOUBLE_INDEXING_TYPES:

                 for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                     fixEdge<DoubleRepRealUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);

881 break;

882 case ALL_CONTIGUOUS_INDEXING_TYPES:

883 case ALL_ARRAY_STORAGE_INDEXING_TYPES:

884 break;

885 default:

886 CRASH();

887 break;

888 }

889 break;

890 }

891

892 case NewTypedArray: {

             if (node->child1()->shouldSpeculateInt32()) {

                 fixEdge<Int32Use>(node->child1());

895 node->clearFlags(NodeMustGenerate);

896 break;

897 }

898 break;

899 }

900

901 case NewArrayWithSize: {

             fixEdge<Int32Use>(node->child1());

903 break;

904 }

905

906 case ToThis: {

             ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;

908

             if (node->child1()->shouldSpeculateOther()) {

910 if (ecmaMode == StrictMode) {

                     fixEdge<OtherUse>(node->child1());

912 node->convertToIdentity();

913 break;

914 }

915

916 m_insertionSet.insertNode(

                     m_indexInBlock, SpecNone, Check, node->origin,

                     Edge(node->child1().node(), OtherUse));

                 observeUseKindOnNode<OtherUse>(node->child1().node());

920 m_graph.convertToConstant(

                     node, m_graph.globalThisObjectFor(node->origin.semantic));

922 break;

923 }

924

             if (isFinalObjectSpeculation(node->child1()->prediction())) {

                 fixEdge<FinalObjectUse>(node->child1());

927 node->convertToIdentity();

928 break;

929 }

930

931 break;

932 }

933

934 case PutStructure: {

             fixEdge<KnownCellUse>(node->child1());

936 break;

937 }

938

939 case GetClosureVar:

940 case GetFromArguments: {

             fixEdge<KnownCellUse>(node->child1());

942 break;

943 }

944

945 case PutClosureVar:

946 case PutToArguments: {

             fixEdge<KnownCellUse>(node->child1());

             speculateForBarrier(node->child2());

949 break;

950 }

951

952 case SkipScope:

953 case GetScope:

954 case GetGetter:

955 case GetSetter: {

             fixEdge<KnownCellUse>(node->child1());

957 break;

958 }

959

960 case AllocatePropertyStorage:

961 case ReallocatePropertyStorage: {

             fixEdge<KnownCellUse>(node->child1());

963 break;

964 }

965

966 case GetById:

967 case GetByIdFlush: {

             if (!node->child1()->shouldSpeculateCell())

969 break;

970

971 // If we hadn't exited because of BadCache, BadIndexingType, or ExoticObjectMode, then

972 // leave this as a GetById.

             if (!m_graph.hasExitSite(node->origin.semantic, BadCache)

                 && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)

                 && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {

                 auto uid = m_graph.identifiers()[node->identifierNumber()];

                 if (uid == vm().propertyNames->length.impl()) {

978 attemptToMakeGetArrayLength(node);

979 break;

980 }

                 if (uid == vm().propertyNames->byteLength.impl()) {

982 attemptToMakeGetTypedArrayByteLength(node);

983 break;

984 }

                 if (uid == vm().propertyNames->byteOffset.impl()) {

986 attemptToMakeGetTypedArrayByteOffset(node);

987 break;

988 }

989 }

             fixEdge<CellUse>(node->child1());

991 break;

992 }

993

994 case PutById:

995 case PutByIdFlush:

996 case PutByIdDirect: {

             fixEdge<CellUse>(node->child1());

             speculateForBarrier(node->child2());

999 break;

1000 }

1001

1002 case GetExecutable: {

             fixEdge<FunctionUse>(node->child1());

1004 break;

1005 }

1006

1007 case CheckStructure:

1008 case CheckCell:

1009 case CheckHasInstance:

1010 case CreateThis:

1011 case GetButterfly: {

             fixEdge<CellUse>(node->child1());

1013 break;

1014 }

1015

1016 case Arrayify:

1017 case ArrayifyToStructure: {

             fixEdge<CellUse>(node->child1());

             if (node->child2())

                 fixEdge<Int32Use>(node->child2());

1021 break;

1022 }

1023

1024 case GetByOffset:

1025 case GetGetterSetterByOffset: {

             if (!node->child1()->hasStorageResult())

                 fixEdge<KnownCellUse>(node->child1());

             fixEdge<KnownCellUse>(node->child2());

1029 break;

1030 }

1031

1032 case MultiGetByOffset: {

             fixEdge<CellUse>(node->child1());

1034 break;

1035 }

1036

1037 case PutByOffset: {

             if (!node->child1()->hasStorageResult())

                 fixEdge<KnownCellUse>(node->child1());

             fixEdge<KnownCellUse>(node->child2());

             speculateForBarrier(node->child3());

1042 break;

1043 }

1044

1045 case MultiPutByOffset: {

             fixEdge<CellUse>(node->child1());

             speculateForBarrier(node->child2());

1048 break;

1049 }

1050

1051 case InstanceOf: {

             if (!(node->child1()->prediction() & ~SpecCell))

                 fixEdge<CellUse>(node->child1());

             fixEdge<CellUse>(node->child2());

1055 break;

1056 }

1057

1058 case In: {

1059 // FIXME: We should at some point have array profiling on op_in, in which

1060 // case we would be able to turn this into a kind of GetByVal.

1061

             fixEdge<CellUse>(node->child2());

1063 break;

1064 }

1065

1066 case Check: {

1067 m_graph.doToChildren(

1068 node,

1069 [&] (Edge& edge) {

                     switch (edge.useKind()) {

1071 case NumberUse:

                         if (edge->shouldSpeculateInt32ForArithmetic())

1073 edge.setUseKind(Int32Use);

1074 break;

1075 default:

1076 break;

1077 }

1078 observeUseKindOnEdge(edge);

1079 });

1080 break;

1081 }

1082

1083 case Phantom:

1084 // Phantoms are meaningless past Fixup. We recreate them on-demand in the backend.

1085 node->remove();

1086 break;

1087

1088 case FiatInt52: {

1089 RELEASE_ASSERT(enableInt52());

1090 node->convertToIdentity();

             fixEdge<Int52RepUse>(node->child1());

1092 node->setResult(NodeResultInt52);

1093 break;

1094 }

1095

1096 case GetArrayLength:

1097 case Phi:

1098 case Upsilon:

1099 case GetIndexedPropertyStorage:

1100 case GetTypedArrayByteOffset:

1101 case LastNodeType:

1102 case CheckTierUpInLoop:

1103 case CheckTierUpAtReturn:

1104 case CheckTierUpAndOSREnter:

1105 case CheckTierUpWithNestedTriggerAndOSREnter:

1106 case InvalidationPoint:

1107 case CheckArray:

1108 case CheckInBounds:

1109 case ConstantStoragePointer:

1110 case DoubleAsInt32:

1111 case ValueToInt32:

1112 case DoubleRep:

1113 case ValueRep:

1114 case Int52Rep:

1115 case Int52Constant:

1116 case Identity: // This should have been cleaned up.

1117 case BooleanToNumber:

1118 case PhantomNewObject:

1119 case PhantomNewFunction:

1120 case PhantomCreateActivation:

1121 case PhantomDirectArguments:

1122 case PhantomClonedArguments:

1123 case ForwardVarargs:

1124 case GetMyArgumentByVal:

1125 case PutHint:

1126 case CheckStructureImmediate:

1127 case MaterializeNewObject:

1128 case MaterializeCreateActivation:

1129 case PutStack:

1130 case KillStack:

1131 case GetStack:

1132 case StoreBarrier:

1133 // These are just nodes that we don't currently expect to see during fixup.

1134 // If we ever wanted to insert them prior to fixup, then we just have to create

1135 // fixup rules for them.

             DFG_CRASH(m_graph, node, "Unexpected node during fixup");

1137 break;

1138

1139 case PutGlobalVar: {

             fixEdge<CellUse>(node->child1());

             speculateForBarrier(node->child2());

1142 break;

1143 }

1144

1145 case IsString:

             if (node->child1()->shouldSpeculateString()) {

1147 m_insertionSet.insertNode(

                     m_indexInBlock, SpecNone, Check, node->origin,

                     Edge(node->child1().node(), StringUse));

                 m_graph.convertToConstant(node, jsBoolean(true));

1151 observeUseKindOnNode<StringUse>(node);

1152 }

1153 break;

1154

1155 case IsObject:

             if (node->child1()->shouldSpeculateObject()) {

1157 m_insertionSet.insertNode(

                     m_indexInBlock, SpecNone, Check, node->origin,

                     Edge(node->child1().node(), ObjectUse));

                 m_graph.convertToConstant(node, jsBoolean(true));

1161 observeUseKindOnNode<ObjectUse>(node);

1162 }

1163 break;

1164

1165 case GetEnumerableLength: {

             fixEdge<CellUse>(node->child1());

1167 break;

1168 }

1169 case HasGenericProperty: {

             fixEdge<CellUse>(node->child2());

1171 break;

1172 }

1173 case HasStructureProperty: {

             fixEdge<StringUse>(node->child2());

             fixEdge<KnownCellUse>(node->child3());

1176 break;

1177 }

1178 case HasIndexedProperty: {

1179 node->setArrayMode(

                 node->arrayMode().refine(

1181 m_graph, node,

                     node->child1()->prediction(),

                     node->child2()->prediction(),

1184 SpecNone));

1185

             blessArrayOperation(node->child1(), node->child2(), node->child3());

             fixEdge<CellUse>(node->child1());

             fixEdge<KnownInt32Use>(node->child2());

1189 break;

1190 }

1191 case GetDirectPname: {

             Edge& base = m_graph.varArgChild(node, 0);

             Edge& property = m_graph.varArgChild(node, 1);

             Edge& index = m_graph.varArgChild(node, 2);

             Edge& enumerator = m_graph.varArgChild(node, 3);

1196 fixEdge<CellUse>(base);

1197 fixEdge<KnownCellUse>(property);

1198 fixEdge<KnownInt32Use>(index);

1199 fixEdge<KnownCellUse>(enumerator);

1200 break;

1201 }

1202 case GetPropertyEnumerator: {

             fixEdge<CellUse>(node->child1());

1204 break;

1205 }

1206 case GetEnumeratorStructurePname: {

             fixEdge<KnownCellUse>(node->child1());

             fixEdge<KnownInt32Use>(node->child2());

1209 break;

1210 }

1211 case GetEnumeratorGenericPname: {

             fixEdge<KnownCellUse>(node->child1());

             fixEdge<KnownInt32Use>(node->child2());

1214 break;

1215 }

1216 case ToIndexString: {

             fixEdge<KnownInt32Use>(node->child1());

1218 break;

1219 }

1220 case ProfileType: {

1221 // We want to insert type checks based on the instructionTypeSet of the TypeLocation, not the globalTypeSet.

1222 // Because the instructionTypeSet is contained in globalTypeSet, if we produce a type check for

1223 // type T for the instructionTypeSet, the global type set must also have information for type T.

1224 // So if it the type check succeeds for type T in the instructionTypeSet, a type check for type T

1225 // in the globalTypeSet would've also succeeded.

1226 // (The other direction does not hold in general).

1227

             RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;

1229 RuntimeTypeMask seenTypes = typeSet->seenTypes();

             if (typeSet->doesTypeConformTo(TypeMachineInt)) {

                 if (node->child1()->shouldSpeculateInt32())

                     fixEdge<Int32Use>(node->child1());

1233 else

                     fixEdge<MachineIntUse>(node->child1());

1235 node->remove();

             } else if (typeSet->doesTypeConformTo(TypeNumber | TypeMachineInt)) {

                 fixEdge<NumberUse>(node->child1());

1238 node->remove();

             } else if (typeSet->doesTypeConformTo(TypeString)) {

                 fixEdge<StringUse>(node->child1());

1241 node->remove();

             } else if (typeSet->doesTypeConformTo(TypeBoolean)) {

                 fixEdge<BooleanUse>(node->child1());

1244 node->remove();

             } else if (typeSet->doesTypeConformTo(TypeUndefined | TypeNull) && (seenTypes & TypeUndefined) && (seenTypes & TypeNull)) {

                 fixEdge<OtherUse>(node->child1());

1247 node->remove();

             } else if (typeSet->doesTypeConformTo(TypeObject)) {

1249 StructureSet set = typeSet->structureSet();

                 if (!set.isEmpty()) {

                     fixEdge<CellUse>(node->child1());

                     node->convertToCheckStructure(m_graph.addStructureSet(set));

1253 }

1254 }

1255

1256 break;

1257 }

1258

1259 case CreateScopedArguments:

1260 case CreateActivation:

1261 case NewFunction: {

             fixEdge<CellUse>(node->child1());

1263 break;

1264 }

1265

1266 #if !ASSERT_DISABLED

1267 // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.

1268 case SetArgument:

1269 case JSConstant:

1270 case DoubleConstant:

1271 case GetLocal:

1272 case GetCallee:

1273 case GetArgumentCount:

1274 case Flush:

1275 case PhantomLocal:

1276 case GetLocalUnlinked:

1277 case GetGlobalVar:

1278 case NotifyWrite:

1279 case VarInjectionWatchpoint:

1280 case Call:

1281 case Construct:

1282 case CallVarargs:

1283 case ConstructVarargs:

1284 case CallForwardVarargs:

1285 case ConstructForwardVarargs:

1286 case LoadVarargs:

1287 case ProfileControlFlow:

1288 case NativeCall:

1289 case NativeConstruct:

1290 case NewObject:

1291 case NewArrayBuffer:

1292 case NewRegexp:

1293 case Breakpoint:

1294 case ProfileWillCall:

1295 case ProfileDidCall:

1296 case IsUndefined:

1297 case IsBoolean:

1298 case IsNumber:

1299 case IsObjectOrNull:

1300 case IsFunction:

1301 case CreateDirectArguments:

1302 case CreateClonedArguments:

1303 case Jump:

1304 case Return:

1305 case Throw:

1306 case ThrowReferenceError:

1307 case CountExecution:

1308 case ForceOSRExit:

1309 case CheckBadCell:

1310 case CheckNotEmpty:

1311 case CheckWatchdogTimer:

1312 case Unreachable:

1313 case ExtractOSREntryLocal:

1314 case LoopHint:

1315 case MovHint:

1316 case ZombieHint:

1317 case BottomValue:

1318 case TypeOf:

1319 break;

1320 #else

1321 default:

1322 break;

1323 #endif

1324 }

1325 }

1326

1327 template<UseKind useKind>

     void createToString(Node* node, Edge& edge)

1329 {

         edge.setNode(m_insertionSet.insertNode(

             m_indexInBlock, SpecString, ToString, node->origin,

             Edge(edge.node(), useKind)));

1333 }

1334

1335 template<UseKind useKind>

     void attemptToForceStringArrayModeByToStringConversion(ArrayMode& arrayMode, Node* node)

1337 {

         ASSERT(arrayMode == ArrayMode(Array::Generic));

1339

         if (!canOptimizeStringObjectAccess(node->origin.semantic))

1341 return;

1342

         createToString<useKind>(node, node->child1());

         arrayMode = ArrayMode(Array::String);

1345 }

1346

1347 template<UseKind useKind>

1348 bool isStringObjectUse()

1349 {

1350 switch (useKind) {

1351 case StringObjectUse:

1352 case StringOrStringObjectUse:

1353 return true;

1354 default:

1355 return false;

1356 }

1357 }

1358

1359 template<UseKind useKind>

     void convertStringAddUse(Node* node, Edge& edge)

1361 {

1362 if (useKind == StringUse) {

1363 // This preserves the binaryUseKind() invariant ot ValueAdd: ValueAdd's

1364 // two edges will always have identical use kinds, which makes the

1365 // decision process much easier.

             observeUseKindOnNode<StringUse>(edge.node());

1367 m_insertionSet.insertNode(

                 m_indexInBlock, SpecNone, Check, node->origin,

                 Edge(edge.node(), StringUse));

1370 edge.setUseKind(KnownStringUse);

1371 return;

1372 }

1373

1374 // FIXME: We ought to be able to have a ToPrimitiveToString node.

1375

         observeUseKindOnNode<useKind>(edge.node());

1377 createToString<useKind>(node, edge);

1378 }

1379

     void convertToMakeRope(Node* node)

1381 {

1382 node->setOpAndDefaultFlags(MakeRope);

1383 fixupMakeRope(node);

1384 }

1385

     void fixupMakeRope(Node* node)

1387 {

         for (unsigned i = 0; i < AdjacencyList::Size; ++i) {

             Edge& edge = node->children.child(i);

1390 if (!edge)

1391 break;

1392 edge.setUseKind(KnownStringUse);

             JSString* string = edge->dynamicCastConstant<JSString*>();

1394 if (!string)

1395 continue;

             if (string->length())

1397 continue;

1398

1399 // Don't allow the MakeRope to have zero children.

             if (!i && !node->child2())

1401 break;

1402

             node->children.removeEdge(i--);

1404 }

1405

         if (!node->child2()) {

             ASSERT(!node->child3());

1408 node->convertToIdentity();

1409 }

1410 }

1411

     void fixupToPrimitive(Node* node)

1413 {

         if (node->child1()->shouldSpeculateInt32()) {

             fixEdge<Int32Use>(node->child1());

1416 node->convertToIdentity();

1417 return;

1418 }

1419

         if (node->child1()->shouldSpeculateString()) {

             fixEdge<StringUse>(node->child1());

1422 node->convertToIdentity();

1423 return;

1424 }

1425

         if (node->child1()->shouldSpeculateStringObject()

             && canOptimizeStringObjectAccess(node->origin.semantic)) {

             fixEdge<StringObjectUse>(node->child1());

1429 node->convertToToString();

1430 return;

1431 }

1432

         if (node->child1()->shouldSpeculateStringOrStringObject()

             && canOptimizeStringObjectAccess(node->origin.semantic)) {

             fixEdge<StringOrStringObjectUse>(node->child1());

1436 node->convertToToString();

1437 return;

1438 }

1439 }

1440

     void fixupToStringOrCallStringConstructor(Node* node)

1442 {

         if (node->child1()->shouldSpeculateString()) {

             fixEdge<StringUse>(node->child1());

1445 node->convertToIdentity();

1446 return;

1447 }

1448

         if (node->child1()->shouldSpeculateStringObject()

             && canOptimizeStringObjectAccess(node->origin.semantic)) {

             fixEdge<StringObjectUse>(node->child1());

1452 return;

1453 }

1454

         if (node->child1()->shouldSpeculateStringOrStringObject()

             && canOptimizeStringObjectAccess(node->origin.semantic)) {

             fixEdge<StringOrStringObjectUse>(node->child1());

1458 return;

1459 }

1460

         if (node->child1()->shouldSpeculateCell()) {

             fixEdge<CellUse>(node->child1());

1463 return;

1464 }

1465 }

1466

1467 template<UseKind leftUseKind>

     bool attemptToMakeFastStringAdd(Node* node, Edge& left, Edge& right)

1469 {

         ASSERT(leftUseKind == StringUse || leftUseKind == StringObjectUse || leftUseKind == StringOrStringObjectUse);

1471

         if (isStringObjectUse<leftUseKind>() && !canOptimizeStringObjectAccess(node->origin.semantic))

1473 return false;

1474

1475 convertStringAddUse<leftUseKind>(node, left);

1476

         if (right->shouldSpeculateString())

1478 convertStringAddUse<StringUse>(node, right);

         else if (right->shouldSpeculateStringObject() && canOptimizeStringObjectAccess(node->origin.semantic))

1480 convertStringAddUse<StringObjectUse>(node, right);

         else if (right->shouldSpeculateStringOrStringObject() && canOptimizeStringObjectAccess(node->origin.semantic))

1482 convertStringAddUse<StringOrStringObjectUse>(node, right);

1483 else {

1484 // At this point we know that the other operand is something weird. The semantically correct

1485 // way of dealing with this is:

1486 //

1487 // MakeRope(@left, ToString(ToPrimitive(@right)))

1488 //

1489 // So that's what we emit. NB, we need to do all relevant type checks on @left before we do

1490 // anything to @right, since ToPrimitive may be effectful.

1491

             Node* toPrimitive = m_insertionSet.insertNode(

                 m_indexInBlock, resultOfToPrimitive(right->prediction()), ToPrimitive,

                 node->origin, Edge(right.node()));

             Node* toString = m_insertionSet.insertNode(

                 m_indexInBlock, SpecString, ToString, node->origin, Edge(toPrimitive));

1497

1498 fixupToPrimitive(toPrimitive);

1499

1500 // Don't fix up ToString. ToString and ToPrimitive are originated from the same bytecode and

1501 // ToPrimitive may have an observable side effect. ToString should not be converted into Check

1502 // with speculative type check because OSR exit reproduce an observable side effect done in

1503 // ToPrimitive.

1504

1505 right.setNode(toString);

1506 }

1507

1508 convertToMakeRope(node);

1509 return true;

1510 }

1511

1512 bool isStringPrototypeMethodSane(

         JSObject* stringPrototype, Structure* stringPrototypeStructure, UniquedStringImpl* uid)

1514 {

1515 unsigned attributesUnused;

1516 PropertyOffset offset =

             stringPrototypeStructure->getConcurrently(uid, attributesUnused);

         if (!isValidOffset(offset))

1519 return false;

1520

1521 JSValue value = m_graph.tryGetConstantProperty(

1522 stringPrototype, stringPrototypeStructure, offset);

1523 if (!value)

1524 return false;

1525

         JSFunction* function = jsDynamicCast<JSFunction*>(value);

1527 if (!function)

1528 return false;

1529

         if (function->executable()->intrinsicFor(CodeForCall) != StringPrototypeValueOfIntrinsic)

1531 return false;

1532

1533 return true;

1534 }

1535

     bool canOptimizeStringObjectAccess(const CodeOrigin& codeOrigin)

1537 {

         if (m_graph.hasExitSite(codeOrigin, NotStringObject))

1539 return false;

1540

         Structure* stringObjectStructure = m_graph.globalObjectFor(codeOrigin)->stringObjectStructure();

         ASSERT(stringObjectStructure->storedPrototype().isObject());

         ASSERT(stringObjectStructure->storedPrototype().asCell()->classInfo() == StringPrototype::info());

1544

         JSObject* stringPrototypeObject = asObject(stringObjectStructure->storedPrototype());

         Structure* stringPrototypeStructure = stringPrototypeObject->structure();

         if (m_graph.registerStructure(stringPrototypeStructure) != StructureRegisteredAndWatched)

1548 return false;

1549

         if (stringPrototypeStructure->isDictionary())

1551 return false;

1552

1553 // We're being conservative here. We want DFG's ToString on StringObject to be

1554 // used in both numeric contexts (that would call valueOf()) and string contexts

1555 // (that would call toString()). We don't want the DFG to have to distinguish

1556 // between the two, just because that seems like it would get confusing. So we

1557 // just require both methods to be sane.

         if (!isStringPrototypeMethodSane(stringPrototypeObject, stringPrototypeStructure, vm().propertyNames->valueOf.impl()))

1559 return false;

         if (!isStringPrototypeMethodSane(stringPrototypeObject, stringPrototypeStructure, vm().propertyNames->toString.impl()))

1561 return false;

1562

1563 return true;

1564 }

1565

     void fixupGetAndSetLocalsInBlock(BasicBlock* block)

1567 {

1568 if (!block)

1569 return;

1570 ASSERT(block->isReachable);

1571 m_block = block;

         for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {

             Node* node = m_currentNode = block->at(m_indexInBlock);

             if (node->op() != SetLocal && node->op() != GetLocal)

1575 continue;

1576

             VariableAccessData* variable = node->variableAccessData();

             switch (node->op()) {

1579 case GetLocal:

                 switch (variable->flushFormat()) {

1581 case FlushedDouble:

1582 node->setResult(NodeResultDouble);

1583 break;

1584 case FlushedInt52:

1585 node->setResult(NodeResultInt52);

1586 break;

1587 default:

1588 break;

1589 }

1590 break;

1591

1592 case SetLocal:

                 switch (variable->flushFormat()) {

1594 case FlushedJSValue:

1595 break;

1596 case FlushedDouble:

                     fixEdge<DoubleRepUse>(node->child1());

1598 break;

1599 case FlushedInt32:

                     fixEdge<Int32Use>(node->child1());

1601 break;

1602 case FlushedInt52:

                     fixEdge<Int52RepUse>(node->child1());

1604 break;

1605 case FlushedCell:

                     fixEdge<CellUse>(node->child1());

1607 break;

1608 case FlushedBoolean:

                     fixEdge<BooleanUse>(node->child1());

1610 break;

1611 default:

1612 RELEASE_ASSERT_NOT_REACHED();

1613 break;

1614 }

1615 break;

1616

1617 default:

1618 RELEASE_ASSERT_NOT_REACHED();

1619 break;

1620 }

1621 }

1622 m_insertionSet.execute(block);

1623 }

1624

     Node* checkArray(ArrayMode arrayMode, const NodeOrigin& origin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)

1626 {

         ASSERT(arrayMode.isSpecific());

1628

         if (arrayMode.type() == Array::String) {

1630 m_insertionSet.insertNode(

                 m_indexInBlock, SpecNone, Check, origin, Edge(array, StringUse));

1632 } else {

1633 // Note that we only need to be using a structure check if we opt for SaneChain, since

1634 // that needs to protect against JSArray's __proto__ being changed.

             Structure* structure = arrayMode.originalArrayStructure(m_graph, origin.semantic);

1636

             Edge indexEdge = index ? Edge(index, Int32Use) : Edge();

1638

             if (arrayMode.doesConversion()) {

1640 if (structure) {

1641 m_insertionSet.insertNode(

1642 m_indexInBlock, SpecNone, ArrayifyToStructure, origin,

                         OpInfo(structure), OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);

1644 } else {

1645 m_insertionSet.insertNode(

1646 m_indexInBlock, SpecNone, Arrayify, origin,

                         OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);

1648 }

1649 } else {

1650 if (structure) {

1651 m_insertionSet.insertNode(

1652 m_indexInBlock, SpecNone, CheckStructure, origin,

                         OpInfo(m_graph.addStructureSet(structure)), Edge(array, CellUse));

1654 } else {

1655 m_insertionSet.insertNode(

1656 m_indexInBlock, SpecNone, CheckArray, origin,

                         OpInfo(arrayMode.asWord()), Edge(array, CellUse));

1658 }

1659 }

1660 }

1661

         if (!storageCheck(arrayMode))

1663 return 0;

1664

         if (arrayMode.usesButterfly()) {

1666 return m_insertionSet.insertNode(

                 m_indexInBlock, SpecNone, GetButterfly, origin, Edge(array, CellUse));

1668 }

1669

1670 return m_insertionSet.insertNode(

1671 m_indexInBlock, SpecNone, GetIndexedPropertyStorage, origin,

             OpInfo(arrayMode.asWord()), Edge(array, KnownCellUse));

1673 }

1674

     void blessArrayOperation(Edge base, Edge index, Edge& storageChild)

1676 {

1677 Node* node = m_currentNode;

1678

         switch (node->arrayMode().type()) {

1680 case Array::ForceExit: {

1681 m_insertionSet.insertNode(

                 m_indexInBlock, SpecNone, ForceOSRExit, node->origin);

1683 return;

1684 }

1685

1686 case Array::SelectUsingPredictions:

1687 case Array::Unprofiled:

1688 RELEASE_ASSERT_NOT_REACHED();

1689 return;

1690

1691 case Array::Generic:

1692 return;

1693

1694 default: {

             Node* storage = checkArray(node->arrayMode(), node->origin, base.node(), index.node());

1696 if (!storage)

1697 return;

1698

1699 storageChild = Edge(storage);

1700 return;

1701 } }

1702 }

1703

1704 bool alwaysUnboxSimplePrimitives()

1705 {

1706 #if USE(JSVALUE64)

1707 return false;

1708 #else

1709 // Any boolean, int, or cell value is profitable to unbox on 32-bit because it

1710 // reduces traffic.

1711 return true;

1712 #endif

1713 }

1714

1715 template<UseKind useKind>

     void observeUseKindOnNode(Node* node)

1717 {

1718 if (useKind == UntypedUse)

1719 return;

1720 observeUseKindOnNode(node, useKind);

1721 }

1722

1723 void observeUseKindOnEdge(Edge edge)

1724 {

         observeUseKindOnNode(edge.node(), edge.useKind());

1726 }

1727

     void observeUseKindOnNode(Node* node, UseKind useKind)

1729 {

         if (node->op() != GetLocal)

1731 return;

1732

1733 // FIXME: The way this uses alwaysUnboxSimplePrimitives() is suspicious.

1734 // https://bugs.webkit.org/show_bug.cgi?id=121518

1735

         VariableAccessData* variable = node->variableAccessData();

1737 switch (useKind) {

1738 case Int32Use:

1739 if (alwaysUnboxSimplePrimitives()

                 || isInt32Speculation(variable->prediction()))

                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);

1742 break;

1743 case NumberUse:

1744 case RealNumberUse:

1745 case DoubleRepUse:

1746 case DoubleRepRealUse:

             if (variable->doubleFormatState() == UsingDoubleFormat)

                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);

1749 break;

1750 case BooleanUse:

1751 if (alwaysUnboxSimplePrimitives()

                 || isBooleanSpeculation(variable->prediction()))

                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);

1754 break;

1755 case Int52RepUse:

             if (isMachineIntSpeculation(variable->prediction()))

                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);

1758 break;

1759 case CellUse:

1760 case KnownCellUse:

1761 case ObjectUse:

1762 case FunctionUse:

1763 case StringUse:

1764 case KnownStringUse:

1765 case StringObjectUse:

1766 case StringOrStringObjectUse:

1767 if (alwaysUnboxSimplePrimitives()

                 || isCellSpeculation(variable->prediction()))

                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);

1770 break;

1771 default:

1772 break;

1773 }

1774 }

1775

1776 template<UseKind useKind>

     void fixEdge(Edge& edge)

1778 {

         observeUseKindOnNode<useKind>(edge.node());

1780 edge.setUseKind(useKind);

1781 }

1782

1783 void speculateForBarrier(Edge value)

1784 {

1785 // Currently, the DFG won't take advantage of this speculation. But, we want to do it in

1786 // the DFG anyway because if such a speculation would be wrong, we want to know before

1787 // we do an expensive compile.

1788

         if (value->shouldSpeculateInt32()) {

             insertCheck<Int32Use>(m_indexInBlock, value.node());

1791 return;

1792 }

1793

         if (value->shouldSpeculateBoolean()) {

             insertCheck<BooleanUse>(m_indexInBlock, value.node());

1796 return;

1797 }

1798

         if (value->shouldSpeculateOther()) {

             insertCheck<OtherUse>(m_indexInBlock, value.node());

1801 return;

1802 }

1803

         if (value->shouldSpeculateNumber()) {

             insertCheck<NumberUse>(m_indexInBlock, value.node());

1806 return;

1807 }

1808

         if (value->shouldSpeculateNotCell()) {

             insertCheck<NotCellUse>(m_indexInBlock, value.node());

1811 return;

1812 }

1813 }

1814

1815 template<UseKind useKind>

     void insertCheck(unsigned indexInBlock, Node* node)

1817 {

1818 observeUseKindOnNode<useKind>(node);

1819 m_insertionSet.insertNode(

             indexInBlock, SpecNone, Check, m_currentNode->origin, Edge(node, useKind));

1821 }

1822

     void fixIntConvertingEdge(Edge& edge)

1824 {

         Node* node = edge.node();

         if (node->shouldSpeculateInt32OrBoolean()) {

1827 fixIntOrBooleanEdge(edge);

1828 return;

1829 }

1830

1831 UseKind useKind;

         if (node->shouldSpeculateMachineInt())

1833 useKind = Int52RepUse;

         else if (node->shouldSpeculateNumber())

1835 useKind = DoubleRepUse;

1836 else

1837 useKind = NotCellUse;

         Node* newNode = m_insertionSet.insertNode(

             m_indexInBlock, SpecInt32, ValueToInt32, m_currentNode->origin,

1840 Edge(node, useKind));

1841 observeUseKindOnNode(node, useKind);

1842

         edge = Edge(newNode, KnownInt32Use);

1844 }

1845

     void fixIntOrBooleanEdge(Edge& edge)

1847 {

         Node* node = edge.node();

         if (!node->sawBooleans()) {

1850 fixEdge<Int32Use>(edge);

1851 return;

1852 }

1853

1854 UseKind useKind;

         if (node->shouldSpeculateBoolean())

1856 useKind = BooleanUse;

1857 else

1858 useKind = UntypedUse;

         Node* newNode = m_insertionSet.insertNode(

             m_indexInBlock, SpecInt32, BooleanToNumber, m_currentNode->origin,

1861 Edge(node, useKind));

1862 observeUseKindOnNode(node, useKind);

1863

         edge = Edge(newNode, Int32Use);

1865 }

1866

     void fixDoubleOrBooleanEdge(Edge& edge)

1868 {

         Node* node = edge.node();

         if (!node->sawBooleans()) {

1871 fixEdge<DoubleRepUse>(edge);

1872 return;

1873 }

1874

1875 UseKind useKind;

         if (node->shouldSpeculateBoolean())

1877 useKind = BooleanUse;

1878 else

1879 useKind = UntypedUse;

         Node* newNode = m_insertionSet.insertNode(

             m_indexInBlock, SpecInt32, BooleanToNumber, m_currentNode->origin,

1882 Edge(node, useKind));

1883 observeUseKindOnNode(node, useKind);

1884

         edge = Edge(newNode, DoubleRepUse);

1886 }

1887

     void truncateConstantToInt32(Edge& edge)

1889 {

         Node* oldNode = edge.node();

1891

1892 JSValue value = oldNode->asJSValue();

         if (value.isInt32())

1894 return;

1895

         value = jsNumber(JSC::toInt32(value.asNumber()));

         ASSERT(value.isInt32());

         edge.setNode(m_insertionSet.insertNode(

             m_indexInBlock, SpecInt32, JSConstant, m_currentNode->origin,

             OpInfo(m_graph.freeze(value))));

1901 }

1902

     void truncateConstantsIfNecessary(Node* node, AddSpeculationMode mode)

1904 {

1905 if (mode != SpeculateInt32AndTruncateConstants)

1906 return;

1907

         ASSERT(node->child1()->hasConstant() || node->child2()->hasConstant());

         if (node->child1()->hasConstant())

             truncateConstantToInt32(node->child1());

1911 else

             truncateConstantToInt32(node->child2());

1913 }

1914

     bool attemptToMakeIntegerAdd(Node* node)

1916 {

         AddSpeculationMode mode = m_graph.addSpeculationMode(node, FixupPass);

1918 if (mode != DontSpeculateInt32) {

1919 truncateConstantsIfNecessary(node, mode);

             fixIntOrBooleanEdge(node->child1());

             fixIntOrBooleanEdge(node->child2());

             if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

                 node->setArithMode(Arith::Unchecked);

1924 else

                 node->setArithMode(Arith::CheckOverflow);

1926 return true;

1927 }

1928

         if (m_graph.addShouldSpeculateMachineInt(node)) {

             fixEdge<Int52RepUse>(node->child1());

             fixEdge<Int52RepUse>(node->child2());

             node->setArithMode(Arith::CheckOverflow);

1933 node->setResult(NodeResultInt52);

1934 return true;

1935 }

1936

1937 return false;

1938 }

1939

     bool attemptToMakeGetArrayLength(Node* node)

1941 {

         if (!isInt32Speculation(node->prediction()))

1943 return false;

         CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);

1945 ArrayProfile* arrayProfile =

             profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex);

         ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);

1948 if (arrayProfile) {

1949 ConcurrentJITLocker locker(profiledBlock->m_lock);

             arrayProfile->computeUpdatedPrediction(locker, profiledBlock);

             arrayMode = ArrayMode::fromObserved(locker, arrayProfile, Array::Read, false);

             if (arrayMode.type() == Array::Unprofiled) {

1953 // For normal array operations, it makes sense to treat Unprofiled

1954 // accesses as ForceExit and get more data rather than using

1955 // predictions and then possibly ending up with a Generic. But here,

1956 // we treat anything that is Unprofiled as Generic and keep the

1957 // GetById. I.e. ForceExit = Generic. So, there is no harm - and only

1958 // profit - from treating the Unprofiled case as

1959 // SelectUsingPredictions.

                 arrayMode = ArrayMode(Array::SelectUsingPredictions);

1961 }

1962 }

1963

1964 arrayMode = arrayMode.refine(

             m_graph, node, node->child1()->prediction(), node->prediction());

1966

         if (arrayMode.type() == Array::Generic) {

1968 // Check if the input is something that we can't get array length for, but for which we

1969 // could insert some conversions in order to transform it into something that we can do it

1970 // for.

             if (node->child1()->shouldSpeculateStringObject())

1972 attemptToForceStringArrayModeByToStringConversion<StringObjectUse>(arrayMode, node);

             else if (node->child1()->shouldSpeculateStringOrStringObject())

1974 attemptToForceStringArrayModeByToStringConversion<StringOrStringObjectUse>(arrayMode, node);

1975 }

1976

         if (!arrayMode.supportsLength())

1978 return false;

1979

1980 convertToGetArrayLength(node, arrayMode);

1981 return true;

1982 }

1983

     bool attemptToMakeGetTypedArrayByteLength(Node* node)

1985 {

         if (!isInt32Speculation(node->prediction()))

1987 return false;

1988

         TypedArrayType type = typedArrayTypeFromSpeculation(node->child1()->prediction());

         if (!isTypedView(type))

1991 return false;

1992

         if (elementSize(type) == 1) {

             convertToGetArrayLength(node, ArrayMode(toArrayType(type)));

1995 return true;

1996 }

1997

1998 Node* length = prependGetArrayLength(

             node->origin, node->child1().node(), ArrayMode(toArrayType(type)));

2000

         Node* shiftAmount = m_insertionSet.insertNode(

             m_indexInBlock, SpecInt32, JSConstant, node->origin,

             OpInfo(m_graph.freeze(jsNumber(logElementSize(type)))));

2004

2005 // We can use a BitLShift here because typed arrays will never have a byteLength

2006 // that overflows int32.

2007 node->setOp(BitLShift);

2008 node->clearFlags(NodeMustGenerate);

2009 observeUseKindOnNode(length, Int32Use);

2010 observeUseKindOnNode(shiftAmount, Int32Use);

         node->child1() = Edge(length, Int32Use);

         node->child2() = Edge(shiftAmount, Int32Use);

2013 return true;

2014 }

2015

     void convertToGetArrayLength(Node* node, ArrayMode arrayMode)

2017 {

2018 node->setOp(GetArrayLength);

2019 node->clearFlags(NodeMustGenerate);

         fixEdge<KnownCellUse>(node->child1());

2021 node->setArrayMode(arrayMode);

2022

         Node* storage = checkArray(arrayMode, node->origin, node->child1().node(), 0, lengthNeedsStorage);

2024 if (!storage)

2025 return;

2026

         node->child2() = Edge(storage);

2028 }

2029

     Node* prependGetArrayLength(NodeOrigin origin, Node* child, ArrayMode arrayMode)

2031 {

         Node* storage = checkArray(arrayMode, origin, child, 0, lengthNeedsStorage);

2033 return m_insertionSet.insertNode(

2034 m_indexInBlock, SpecInt32, GetArrayLength, origin,

             OpInfo(arrayMode.asWord()), Edge(child, KnownCellUse), Edge(storage));

2036 }

2037

     bool attemptToMakeGetTypedArrayByteOffset(Node* node)

2039 {

         if (!isInt32Speculation(node->prediction()))

2041 return false;

2042

         TypedArrayType type = typedArrayTypeFromSpeculation(node->child1()->prediction());

         if (!isTypedView(type))

2045 return false;

2046

2047 checkArray(

             ArrayMode(toArrayType(type)), node->origin, node->child1().node(),

2049 0, neverNeedsStorage);

2050

2051 node->setOp(GetTypedArrayByteOffset);

2052 node->clearFlags(NodeMustGenerate);

         fixEdge<KnownCellUse>(node->child1());

2054 return true;

2055 }

2056

     void injectTypeConversionsInBlock(BasicBlock* block)

2058 {

2059 if (!block)

2060 return;

2061 ASSERT(block->isReachable);

2062 m_block = block;

         for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {

             m_currentNode = block->at(m_indexInBlock);

2065 tryToRelaxRepresentation(m_currentNode);

             DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, injectTypeConversionsForEdge);

2067 }

2068 m_insertionSet.execute(block);

2069 }

2070

     void tryToRelaxRepresentation(Node* node)

2072 {

2073 // Some operations may be able to operate more efficiently over looser representations.

2074 // Identify those here. This avoids inserting a redundant representation conversion.

2075 // Also, for some operations, like MovHint, this is a necessary optimization: inserting

2076 // an otherwise-dead conversion just for a MovHint would break OSR's understanding of

2077 // the IR.

2078

         switch (node->op()) {

2080 case MovHint:

2081 case Check:

             DFG_NODE_DO_TO_CHILDREN(m_graph, m_currentNode, fixEdgeRepresentation);

2083 break;

2084

2085 case ValueToInt32:

             if (node->child1().useKind() == DoubleRepUse

                 && !node->child1()->hasDoubleResult()) {

                 node->child1().setUseKind(NumberUse);

2089 break;

2090 }

2091 break;

2092

2093 default:

2094 break;

2095 }

2096 }

2097

     void fixEdgeRepresentation(Node*, Edge& edge)

2099 {

         switch (edge.useKind()) {

2101 case DoubleRepUse:

2102 case DoubleRepRealUse:

             if (edge->hasDoubleResult())

2104 break;

2105

             if (edge->hasInt52Result())

2107 edge.setUseKind(Int52RepUse);

             else if (edge.useKind() == DoubleRepUse)

2109 edge.setUseKind(NumberUse);

2110 break;

2111

2112 case Int52RepUse:

2113 // Nothing we can really do.

2114 break;

2115

2116 case UntypedUse:

2117 case NumberUse:

             if (edge->hasDoubleResult())

2119 edge.setUseKind(DoubleRepUse);

             else if (edge->hasInt52Result())

2121 edge.setUseKind(Int52RepUse);

2122 break;

2123

2124 case RealNumberUse:

             if (edge->hasDoubleResult())

2126 edge.setUseKind(DoubleRepRealUse);

             else if (edge->hasInt52Result())

2128 edge.setUseKind(Int52RepUse);

2129 break;

2130

2131 default:

2132 break;

2133 }

2134 }

2135

     void injectTypeConversionsForEdge(Node* node, Edge& edge)

2137 {

2138 ASSERT(node == m_currentNode);

2139 Node* result = nullptr;

2140

         switch (edge.useKind()) {

2142 case DoubleRepUse:

2143 case DoubleRepRealUse:

2144 case DoubleRepMachineIntUse: {

             if (edge->hasDoubleResult())

2146 break;

2147

             if (edge->isNumberConstant()) {

2149 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecBytecodeDouble, DoubleConstant, node->origin,

                     OpInfo(m_graph.freeze(jsDoubleNumber(edge->asNumber()))));

             } else if (edge->hasInt52Result()) {

2153 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecInt52AsDouble, DoubleRep, node->origin,

                     Edge(edge.node(), Int52RepUse));

2156 } else {

2157 UseKind useKind;

                 if (edge->shouldSpeculateDoubleReal())

2159 useKind = RealNumberUse;

                 else if (edge->shouldSpeculateNumber())

2161 useKind = NumberUse;

2162 else

2163 useKind = NotCellUse;

2164

2165 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecBytecodeDouble, DoubleRep, node->origin,

                     Edge(edge.node(), useKind));

2168 }

2169

2170 edge.setNode(result);

2171 break;

2172 }

2173

2174 case Int52RepUse: {

             if (edge->hasInt52Result())

2176 break;

2177

             if (edge->isMachineIntConstant()) {

2179 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecMachineInt, Int52Constant, node->origin,

                     OpInfo(edge->constant()));

             } else if (edge->hasDoubleResult()) {

2183 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecMachineInt, Int52Rep, node->origin,

                     Edge(edge.node(), DoubleRepMachineIntUse));

             } else if (edge->shouldSpeculateInt32ForArithmetic()) {

2187 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecInt32, Int52Rep, node->origin,

                     Edge(edge.node(), Int32Use));

2190 } else {

2191 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecMachineInt, Int52Rep, node->origin,

                     Edge(edge.node(), MachineIntUse));

2194 }

2195

2196 edge.setNode(result);

2197 break;

2198 }

2199

2200 default: {

             if (!edge->hasDoubleResult() && !edge->hasInt52Result())

2202 break;

2203

             if (edge->hasDoubleResult()) {

2205 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecBytecodeDouble, ValueRep, node->origin,

                     Edge(edge.node(), DoubleRepUse));

2208 } else {

2209 result = m_insertionSet.insertNode(

                     m_indexInBlock, SpecInt32 | SpecInt52AsDouble, ValueRep, node->origin,

                     Edge(edge.node(), Int52RepUse));

2212 }

2213

2214 edge.setNode(result);

2215 break;

2216 } }

2217 }

2218

2219 BasicBlock* m_block;

2220 unsigned m_indexInBlock;

2221 Node* m_currentNode;

2222 InsertionSet m_insertionSet;

2223 bool m_profitabilityChanged;

2224 };

2225

 bool performFixup(Graph& graph)

2227 {

2228 SamplingRegion samplingRegion("DFG Fixup Phase");

2229 return runPhase<FixupPhase>(graph);

2230 }

2231

2232 } } // namespace JSC::DFG

2233

2234 #endif // ENABLE(DFG_JIT)

2235