JavaScriptCore-7601.1.46.3.tar.gz

[apple/javascriptcore.git] / dfg / DFGSafeToExecute.h

diff --git a/dfg/DFGSafeToExecute.h b/dfg/DFGSafeToExecute.h
index 52bbfe4799f8df9f318df33b8eafa47e517fc929..953b54c21f739d07de4645db6b7475c1f07bae61 100644 (file)
--- a/dfg/DFGSafeToExecute.h
+++ b/dfg/DFGSafeToExecute.h
@@ -1,5 +1,5 @@
 /*
 /*

- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.

  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions


@@ -50,9 +50,11 @@ public:
         case DoubleRepRealUse:
         case Int52RepUse:
         case NumberUse:
         case DoubleRepRealUse:
         case Int52RepUse:
         case NumberUse:

+        case RealNumberUse:

         case BooleanUse:
         case CellUse:
         case ObjectUse:
         case BooleanUse:
         case CellUse:
         case ObjectUse:

+        case FunctionUse:

         case FinalObjectUse:
         case ObjectOrOtherUse:
         case StringIdentUse:
         case FinalObjectUse:
         case ObjectOrOtherUse:
         case StringIdentUse:


@@ -111,18 +113,19 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case JSConstant:
     case DoubleConstant:
     case Int52Constant:
     case JSConstant:
     case DoubleConstant:
     case Int52Constant:

-    case WeakJSConstant:

     case Identity:
     case ToThis:
     case CreateThis:
     case GetCallee:
     case Identity:
     case ToThis:
     case CreateThis:
     case GetCallee:

+    case GetArgumentCount:

     case GetLocal:
     case SetLocal:
     case GetLocal:
     case SetLocal:

+    case PutStack:
+    case KillStack:
+    case GetStack:

     case MovHint:
     case ZombieHint:
     case MovHint:
     case ZombieHint:

-    case GetArgument:

     case Phantom:
     case Phantom:

-    case HardPhantom:

     case Upsilon:
     case Phi:
     case Flush:
     case Upsilon:
     case Phi:
     case Flush:


@@ -139,6 +142,7 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case UInt32ToNumber:
     case DoubleAsInt32:
     case ArithAdd:
     case UInt32ToNumber:
     case DoubleAsInt32:
     case ArithAdd:

+    case ArithClz32:

     case ArithSub:
     case ArithNegate:
     case ArithMul:
     case ArithSub:
     case ArithNegate:
     case ArithMul:


@@ -148,10 +152,13 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case ArithAbs:
     case ArithMin:
     case ArithMax:
     case ArithAbs:
     case ArithMin:
     case ArithMax:

+    case ArithPow:

     case ArithSqrt:
     case ArithFRound:
     case ArithSqrt:
     case ArithFRound:

+    case ArithRound:

     case ArithSin:
     case ArithCos:
     case ArithSin:
     case ArithCos:

+    case ArithLog:

     case ValueAdd:
     case GetById:
     case GetByIdFlush:
     case ValueAdd:
     case GetById:
     case GetByIdFlush:


@@ -159,24 +166,21 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case PutByIdFlush:
     case PutByIdDirect:
     case CheckStructure:
     case PutByIdFlush:
     case PutByIdDirect:
     case CheckStructure:

-    case CheckExecutable:
+    case GetExecutable:

     case GetButterfly:
     case CheckArray:
     case Arrayify:
     case ArrayifyToStructure:
     case GetScope:
     case GetButterfly:
     case CheckArray:
     case Arrayify:
     case ArrayifyToStructure:
     case GetScope:

-    case GetMyScope:
-    case SkipTopScope:

     case SkipScope:
     case SkipScope:

-    case GetClosureRegisters:

     case GetClosureVar:
     case PutClosureVar:
     case GetGlobalVar:
     case PutGlobalVar:
     case GetClosureVar:
     case PutClosureVar:
     case GetGlobalVar:
     case PutGlobalVar:

-    case VariableWatchpoint:

     case VarInjectionWatchpoint:
     case VarInjectionWatchpoint:

-    case CheckFunction:
-    case AllocationProfileWatchpoint:
+    case CheckCell:
+    case CheckBadCell:
+    case CheckNotEmpty:

     case RegExpExec:
     case RegExpTest:
     case CompareLess:
     case RegExpExec:
     case RegExpTest:
     case CompareLess:


@@ -188,6 +192,11 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case CompareStrictEq:
     case Call:
     case Construct:
     case CompareStrictEq:
     case Call:
     case Construct:

+    case CallVarargs:
+    case ConstructVarargs:
+    case LoadVarargs:
+    case CallForwardVarargs:
+    case ConstructForwardVarargs:

     case NewObject:
     case NewArray:
     case NewArrayWithSize:
     case NewObject:
     case NewArray:
     case NewArrayWithSize:


@@ -196,6 +205,8 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case Breakpoint:
     case ProfileWillCall:
     case ProfileDidCall:
     case Breakpoint:
     case ProfileWillCall:
     case ProfileDidCall:

+    case ProfileType:
+    case ProfileControlFlow:

     case CheckHasInstance:
     case InstanceOf:
     case IsUndefined:
     case CheckHasInstance:
     case InstanceOf:
     case IsUndefined:


@@ -203,27 +214,23 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case IsNumber:
     case IsString:
     case IsObject:
     case IsNumber:
     case IsString:
     case IsObject:

+    case IsObjectOrNull:

     case IsFunction:
     case TypeOf:
     case LogicalNot:
     case ToPrimitive:
     case ToString:
     case IsFunction:
     case TypeOf:
     case LogicalNot:
     case ToPrimitive:
     case ToString:

+    case CallStringConstructor:

     case NewStringObject:
     case MakeRope:
     case In:
     case CreateActivation:
     case NewStringObject:
     case MakeRope:
     case In:
     case CreateActivation:

-    case TearOffActivation:
-    case CreateArguments:
-    case PhantomArguments:
-    case TearOffArguments:
-    case GetMyArgumentsLength:
-    case GetMyArgumentByVal:
-    case GetMyArgumentsLengthSafe:
-    case GetMyArgumentByValSafe:
-    case CheckArgumentsNotCreated:
-    case NewFunctionNoCheck:
+    case CreateDirectArguments:
+    case CreateScopedArguments:
+    case CreateClonedArguments:
+    case GetFromArguments:
+    case PutToArguments:

     case NewFunction:
     case NewFunction:

-    case NewFunctionExpression:

     case Jump:
     case Branch:
     case Switch:
     case Jump:
     case Branch:
     case Switch:


@@ -240,13 +247,11 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case CheckTierUpInLoop:
     case CheckTierUpAtReturn:
     case CheckTierUpAndOSREnter:
     case CheckTierUpInLoop:
     case CheckTierUpAtReturn:
     case CheckTierUpAndOSREnter:

+    case CheckTierUpWithNestedTriggerAndOSREnter:

     case LoopHint:
     case StoreBarrier:
     case LoopHint:
     case StoreBarrier:

-    case StoreBarrierWithNullCheck:

     case InvalidationPoint:
     case NotifyWrite:
     case InvalidationPoint:
     case NotifyWrite:

-    case FunctionReentryWatchpoint:
-    case TypedArrayWatchpoint:

     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:
     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:


@@ -257,8 +262,39 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
     case Int52Rep:
     case BooleanToNumber:
     case FiatInt52:
     case Int52Rep:
     case BooleanToNumber:
     case FiatInt52:

+    case GetGetter:
+    case GetSetter:
+    case GetEnumerableLength:
+    case HasGenericProperty:
+    case HasStructureProperty:
+    case HasIndexedProperty:
+    case GetDirectPname:
+    case GetPropertyEnumerator:
+    case GetEnumeratorStructurePname:
+    case GetEnumeratorGenericPname:
+    case ToIndexString:
+    case PhantomNewObject:
+    case PhantomNewFunction:
+    case PhantomCreateActivation:
+    case PutHint:
+    case CheckStructureImmediate:
+    case MaterializeNewObject:
+    case MaterializeCreateActivation:
+    case PhantomDirectArguments:
+    case PhantomClonedArguments:
+    case GetMyArgumentByVal:
+    case ForwardVarargs:

         return true;
         return true;

-        
+
+    case NativeCall:
+    case NativeConstruct:
+        return false; // TODO: add a check for already checked.  https://bugs.webkit.org/show_bug.cgi?id=133769
+
+    case BottomValue:
+        // If in doubt, assume that this isn't safe to execute, just because we have no way of
+        // compiling this node.
+        return false;
+

     case GetByVal:
     case GetIndexedPropertyStorage:
     case GetArrayLength:
     case GetByVal:
     case GetIndexedPropertyStorage:
     case GetArrayLength:


@@ -277,21 +313,25 @@ bool safeToExecute(AbstractStateType& state, Graph& graph, Node* node)
         return node->arrayMode().modeForPut().alreadyChecked(
             graph, node, state.forNode(graph.varArgChild(node, 0)));
 
         return node->arrayMode().modeForPut().alreadyChecked(
             graph, node, state.forNode(graph.varArgChild(node, 0)));
 

-    case StructureTransitionWatchpoint:
-        return state.forNode(node->child1()).m_futurePossibleStructure.isSubsetOf(
-            StructureSet(node->structure()));
-        

     case PutStructure:
     case PutStructure:

-    case PhantomPutStructure:

     case AllocatePropertyStorage:
     case ReallocatePropertyStorage:
     case AllocatePropertyStorage:
     case ReallocatePropertyStorage:

-        return state.forNode(node->child1()).m_currentKnownStructure.isSubsetOf(
-            StructureSet(node->structureTransitionData().previousStructure));
+        return state.forNode(node->child1()).m_structure.isSubsetOf(
+            StructureSet(node->transition()->previous));

         
     case GetByOffset:
         
     case GetByOffset:

-    case PutByOffset:
-        return state.forNode(node->child1()).m_currentKnownStructure.isValidOffset(
-            graph.m_storageAccessData[node->storageAccessDataIndex()].offset);
+    case GetGetterSetterByOffset:
+    case PutByOffset: {
+        StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+        if (value.isTop())
+            return false;
+        PropertyOffset offset = node->storageAccessData().offset;
+        for (unsigned i = value.size(); i--;) {
+            if (!value[i]->isValidOffset(offset))
+                return false;
+        }
+        return true;
+    }

         
     case LastNodeType:
         RELEASE_ASSERT_NOT_REACHED();
         
     case LastNodeType:
         RELEASE_ASSERT_NOT_REACHED();