ConstantBufferKey()

: m_codeBlock(0)

, m_index(0)

{

}

ConstantBufferKey(WTF::HashTableDeletedValueType)

: m_codeBlock(0)

, m_index(1)

{

}

ConstantBufferKey(CodeBlock* codeBlock, unsigned index)

: m_codeBlock(codeBlock)

, m_index(index)

{

}

bool operator==(const ConstantBufferKey& other) const

{

return m_codeBlock == other.m_codeBlock

&& m_index == other.m_index;

}

unsigned hash() const

{

return WTF::PtrHash<CodeBlock*>::hash(m_codeBlock) ^ m_index;

}

bool isHashTableDeletedValue() const

{

return !m_codeBlock && m_index;

}

CodeBlock* codeBlock() const { return m_codeBlock; }

unsigned index() const { return m_index; }

CodeBlock* m_codeBlock;

unsigned m_index;

static unsigned hash(const ConstantBufferKey& key) { return key.hash(); }

static bool equal(const ConstantBufferKey& a, const ConstantBufferKey& b)

{

return a == b;

}

static const bool safeToCompareToEmptyOrDeleted = true;

ByteCodeParser(Graph& graph)

: m_vm(&graph.m_vm)

, m_codeBlock(graph.m_codeBlock)

, m_profiledBlock(graph.m_profiledBlock)

, m_graph(graph)

, m_currentBlock(0)

, m_currentIndex(0)

, m_constantUndefined(UINT_MAX)

, m_constantNull(UINT_MAX)

, m_constantNaN(UINT_MAX)

, m_constant1(UINT_MAX)

, m_constants(m_codeBlock->numberOfConstantRegisters())

, m_numArguments(m_codeBlock->numParameters())

, m_numLocals(m_codeBlock->m_numCalleeRegisters)

, m_parameterSlots(0)

, m_numPassedVarArgs(0)

, m_inlineStackTop(0)

, m_haveBuiltOperandMaps(false)

, m_emptyJSValueIndex(UINT_MAX)

, m_currentInstruction(0)

{

ASSERT(m_profiledBlock);

}

// Parse a full CodeBlock of bytecode.

bool parse();

struct InlineStackEntry;

// Just parse from m_currentIndex to the end of the current CodeBlock.

void parseCodeBlock();

// Helper for min and max.

bool handleMinMax(int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis);

// Handle calls. This resolves issues surrounding inlining and intrinsics.

void handleCall(Instruction* currentInstruction, NodeType op, CodeSpecializationKind);

void emitFunctionChecks(const CallLinkStatus&, Node* callTarget, int registerOffset, CodeSpecializationKind);

void emitArgumentPhantoms(int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind);

// Handle inlining. Return true if it succeeded, false if we need to plant a call.

bool handleInlining(Node* callTargetNode, int resultOperand, const CallLinkStatus&, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, CodeSpecializationKind);

// Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.

bool handleIntrinsic(int resultOperand, Intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction);

bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType);

bool handleConstantInternalFunction(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, CodeSpecializationKind);

Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, Node* value);

Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset);

void handleGetByOffset(

int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber,

PropertyOffset);

void handleGetById(

int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber,

const GetByIdStatus&);

Node* getScope(bool skipTop, unsigned skipCount);

// Prepare to parse a block.

void prepareToParseBlock();

// Parse a single basic block of bytecode instructions.

bool parseBlock(unsigned limit);

// Link block successors.

void linkBlock(BasicBlock*, Vector<BasicBlock*>& possibleTargets);

void linkBlocks(Vector<UnlinkedBlock>& unlinkedBlocks, Vector<BasicBlock*>& possibleTargets);

VariableAccessData* newVariableAccessData(VirtualRegister operand, bool isCaptured)

{

ASSERT(!operand.isConstant());

m_graph.m_variableAccessData.append(VariableAccessData(operand, isCaptured));

return &m_graph.m_variableAccessData.last();

}

// Get/Set the operands/result of a bytecode instruction.

Node* getDirect(VirtualRegister operand)

{

// Is this a constant?

if (operand.isConstant()) {

unsigned constant = operand.toConstantIndex();

ASSERT(constant < m_constants.size());

return getJSConstant(constant);

}

// Is this an argument?

if (operand.isArgument())

return getArgument(operand);

// Must be a local.

return getLocal(operand);

}

Node* get(VirtualRegister operand)

{

if (inlineCallFrame()) {

if (!inlineCallFrame()->isClosureCall) {

JSFunction* callee = inlineCallFrame()->calleeConstant();

if (operand.offset() == JSStack::Callee)

return cellConstant(callee);

if (operand.offset() == JSStack::ScopeChain)

return cellConstant(callee->scope());

}

} else if (operand.offset() == JSStack::Callee)

return addToGraph(GetCallee);

else if (operand.offset() == JSStack::ScopeChain)

return addToGraph(GetMyScope);

return getDirect(m_inlineStackTop->remapOperand(operand));

}

enum SetMode { NormalSet, ImmediateSet };

Node* setDirect(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)

{

addToGraph(MovHint, OpInfo(operand.offset()), value);

DelayedSetLocal delayed = DelayedSetLocal(operand, value);

if (setMode == NormalSet) {

m_setLocalQueue.append(delayed);

return 0;

}

return delayed.execute(this, setMode);

}

Node* set(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)

{

return setDirect(m_inlineStackTop->remapOperand(operand), value, setMode);

}

Node* injectLazyOperandSpeculation(Node* node)

{

ASSERT(node->op() == GetLocal);

ASSERT(node->codeOrigin.bytecodeIndex == m_currentIndex);

ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

LazyOperandValueProfileKey key(m_currentIndex, node->local());

SpeculatedType prediction = m_inlineStackTop->m_lazyOperands.prediction(locker, key);

node->variableAccessData()->predict(prediction);

return node;

}

// Used in implementing get/set, above, where the operand is a local variable.

Node* getLocal(VirtualRegister operand)

{

unsigned local = operand.toLocal();

if (local < m_localWatchpoints.size()) {

if (VariableWatchpointSet* set = m_localWatchpoints[local]) {

if (JSValue value = set->inferredValue()) {

addToGraph(FunctionReentryWatchpoint, OpInfo(m_codeBlock->symbolTable()));

addToGraph(VariableWatchpoint, OpInfo(set));

// Note: this is very special from an OSR exit standpoint. We wouldn't be

// able to do this for most locals, but it works here because we're dealing

// with a flushed local. For most locals we would need to issue a GetLocal

// here and ensure that we have uses in DFG IR wherever there would have

// been uses in bytecode. Clearly this optimization does not do this. But

// that's fine, because we don't need to track liveness for captured

// locals, and this optimization only kicks in for captured locals.

return inferredConstant(value);

}

}

}

Node* node = m_currentBlock->variablesAtTail.local(local);

bool isCaptured = m_codeBlock->isCaptured(operand, inlineCallFrame());

// This has two goals: 1) link together variable access datas, and 2)

// try to avoid creating redundant GetLocals. (1) is required for

// correctness - no other phase will ensure that block-local variable

// access data unification is done correctly. (2) is purely opportunistic

// and is meant as an compile-time optimization only.

VariableAccessData* variable;

if (node) {

variable = node->variableAccessData();

variable->mergeIsCaptured(isCaptured);

if (!isCaptured) {

switch (node->op()) {

case GetLocal:

return node;

case SetLocal:

return node->child1().node();

default:

break;

}

}

} else

variable = newVariableAccessData(operand, isCaptured);

node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));

m_currentBlock->variablesAtTail.local(local) = node;

return node;

}

Node* setLocal(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)

{

unsigned local = operand.toLocal();

bool isCaptured = m_codeBlock->isCaptured(operand, inlineCallFrame());

if (setMode == NormalSet) {

ArgumentPosition* argumentPosition = findArgumentPositionForLocal(operand);

if (isCaptured || argumentPosition)

flushDirect(operand, argumentPosition);

}

VariableAccessData* variableAccessData = newVariableAccessData(operand, isCaptured);

variableAccessData->mergeStructureCheckHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCacheWatchpoint));

variableAccessData->mergeCheckArrayHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIndexingType));

Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);

m_currentBlock->variablesAtTail.local(local) = node;

return node;

}

// Used in implementing get/set, above, where the operand is an argument.

Node* getArgument(VirtualRegister operand)

{

unsigned argument = operand.toArgument();

ASSERT(argument < m_numArguments);

Node* node = m_currentBlock->variablesAtTail.argument(argument);

bool isCaptured = m_codeBlock->isCaptured(operand);

VariableAccessData* variable;

if (node) {

variable = node->variableAccessData();

variable->mergeIsCaptured(isCaptured);

switch (node->op()) {

case GetLocal:

return node;

case SetLocal:

return node->child1().node();

default:

break;

}

} else

variable = newVariableAccessData(operand, isCaptured);

node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));

m_currentBlock->variablesAtTail.argument(argument) = node;

return node;

}

Node* setArgument(VirtualRegister operand, Node* value, SetMode setMode = NormalSet)

{

unsigned argument = operand.toArgument();

ASSERT(argument < m_numArguments);

bool isCaptured = m_codeBlock->isCaptured(operand);

VariableAccessData* variableAccessData = newVariableAccessData(operand, isCaptured);

// Always flush arguments, except for 'this'. If 'this' is created by us,

// then make sure that it's never unboxed.

if (argument) {

if (setMode == NormalSet)

flushDirect(operand);

} else if (m_codeBlock->specializationKind() == CodeForConstruct)

variableAccessData->mergeShouldNeverUnbox(true);

variableAccessData->mergeStructureCheckHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCacheWatchpoint));

variableAccessData->mergeCheckArrayHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIndexingType));

Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);

m_currentBlock->variablesAtTail.argument(argument) = node;

return node;

}

ArgumentPosition* findArgumentPositionForArgument(int argument)

{

InlineStackEntry* stack = m_inlineStackTop;

while (stack->m_inlineCallFrame)

stack = stack->m_caller;

return stack->m_argumentPositions[argument];

}

ArgumentPosition* findArgumentPositionForLocal(VirtualRegister operand)

{

for (InlineStackEntry* stack = m_inlineStackTop; ; stack = stack->m_caller) {

InlineCallFrame* inlineCallFrame = stack->m_inlineCallFrame;

if (!inlineCallFrame)

break;

if (operand.offset() < static_cast<int>(inlineCallFrame->stackOffset + JSStack::CallFrameHeaderSize))

continue;

if (operand.offset() == inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset())

continue;

if (operand.offset() >= static_cast<int>(inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset() + inlineCallFrame->arguments.size()))

continue;

int argument = VirtualRegister(operand.offset() - inlineCallFrame->stackOffset).toArgument();

return stack->m_argumentPositions[argument];

}

return 0;

}

ArgumentPosition* findArgumentPosition(VirtualRegister operand)

{

if (operand.isArgument())

return findArgumentPositionForArgument(operand.toArgument());

return findArgumentPositionForLocal(operand);

}

void addConstant(JSValue value)

{

unsigned constantIndex = m_codeBlock->addConstantLazily();

initializeLazyWriteBarrierForConstant(

m_graph.m_plan.writeBarriers,

m_codeBlock->constants()[constantIndex],

m_codeBlock,

constantIndex,

m_codeBlock->ownerExecutable(),

value);

}

void flush(VirtualRegister operand)

{

flushDirect(m_inlineStackTop->remapOperand(operand));

}

void flushDirect(VirtualRegister operand)

{

flushDirect(operand, findArgumentPosition(operand));

}

void flushDirect(VirtualRegister operand, ArgumentPosition* argumentPosition)

{

bool isCaptured = m_codeBlock->isCaptured(operand, inlineCallFrame());

ASSERT(!operand.isConstant());

Node* node = m_currentBlock->variablesAtTail.operand(operand);

VariableAccessData* variable;

if (node) {

variable = node->variableAccessData();

variable->mergeIsCaptured(isCaptured);

} else

variable = newVariableAccessData(operand, isCaptured);

node = addToGraph(Flush, OpInfo(variable));

m_currentBlock->variablesAtTail.operand(operand) = node;

if (argumentPosition)

argumentPosition->addVariable(variable);

}

void flush(InlineStackEntry* inlineStackEntry)

{

int numArguments;

if (InlineCallFrame* inlineCallFrame = inlineStackEntry->m_inlineCallFrame) {

numArguments = inlineCallFrame->arguments.size();

if (inlineCallFrame->isClosureCall) {

flushDirect(inlineStackEntry->remapOperand(VirtualRegister(JSStack::Callee)));

flushDirect(inlineStackEntry->remapOperand(VirtualRegister(JSStack::ScopeChain)));

}

} else

numArguments = inlineStackEntry->m_codeBlock->numParameters();

for (unsigned argument = numArguments; argument-- > 1;)

flushDirect(inlineStackEntry->remapOperand(virtualRegisterForArgument(argument)));

for (int local = 0; local < inlineStackEntry->m_codeBlock->m_numVars; ++local) {

if (!inlineStackEntry->m_codeBlock->isCaptured(virtualRegisterForLocal(local)))

continue;

flushDirect(inlineStackEntry->remapOperand(virtualRegisterForLocal(local)));

}

}

void flushAllArgumentsAndCapturedVariablesInInlineStack()

{

for (InlineStackEntry* inlineStackEntry = m_inlineStackTop; inlineStackEntry; inlineStackEntry = inlineStackEntry->m_caller)

flush(inlineStackEntry);

}

void flushArgumentsAndCapturedVariables()

{

flush(m_inlineStackTop);

}

// Get an operand, and perform a ToInt32/ToNumber conversion on it.

Node* getToInt32(int operand)

{

return toInt32(get(VirtualRegister(operand)));

}

// Perform an ES5 ToInt32 operation - returns a node of type NodeResultInt32.

Node* toInt32(Node* node)

{

if (node->hasInt32Result())

return node;

// Check for numeric constants boxed as JSValues.

if (canFold(node)) {

JSValue v = valueOfJSConstant(node);

if (v.isInt32())

return getJSConstant(node->constantNumber());

if (v.isNumber())

return getJSConstantForValue(JSValue(JSC::toInt32(v.asNumber())));

}

return addToGraph(ValueToInt32, node);

}

// NOTE: Only use this to construct constants that arise from non-speculative

// constant folding. I.e. creating constants using this if we had constant

// field inference would be a bad idea, since the bytecode parser's folding

// doesn't handle liveness preservation.

Node* getJSConstantForValue(JSValue constantValue, NodeFlags flags = NodeIsStaticConstant)

{

unsigned constantIndex;

if (!m_codeBlock->findConstant(constantValue, constantIndex)) {

addConstant(constantValue);

m_constants.append(ConstantRecord());

}

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

return getJSConstant(constantIndex, flags);

}

Node* getJSConstant(unsigned constant, NodeFlags flags = NodeIsStaticConstant)

{

Node* node = m_constants[constant].asJSValue;

if (node)

return node;

Node* result = addToGraph(JSConstant, OpInfo(constant));

result->mergeFlags(flags);

m_constants[constant].asJSValue = result;

return result;

}

// Helper functions to get/set the this value.

Node* getThis()

{

return get(m_inlineStackTop->m_codeBlock->thisRegister());

}

void setThis(Node* value)

{

set(m_inlineStackTop->m_codeBlock->thisRegister(), value);

}

// Convenience methods for checking nodes for constants.

bool isJSConstant(Node* node)

{

return node->op() == JSConstant;

}

bool isInt32Constant(Node* node)

{

return isJSConstant(node) && valueOfJSConstant(node).isInt32();

}

// Convenience methods for getting constant values.

JSValue valueOfJSConstant(Node* node)

{

ASSERT(isJSConstant(node));

return m_codeBlock->getConstant(FirstConstantRegisterIndex + node->constantNumber());

}

int32_t valueOfInt32Constant(Node* node)

{

ASSERT(isInt32Constant(node));

return valueOfJSConstant(node).asInt32();

}

// This method returns a JSConstant with the value 'undefined'.

Node* constantUndefined()

{

// Has m_constantUndefined been set up yet?

if (m_constantUndefined == UINT_MAX) {

// Search the constant pool for undefined, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantUndefined = 0; m_constantUndefined < numberOfConstants; ++m_constantUndefined) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined);

if (testMe.isUndefined())

return getJSConstant(m_constantUndefined);

}

// Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

addConstant(jsUndefined());

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantUndefined must refer to an entry in the CodeBlock's constant pool that has the value 'undefined'.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined).isUndefined());

return getJSConstant(m_constantUndefined);

}

// This method returns a JSConstant with the value 'null'.

Node* constantNull()

{

// Has m_constantNull been set up yet?

if (m_constantNull == UINT_MAX) {

// Search the constant pool for null, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantNull = 0; m_constantNull < numberOfConstants; ++m_constantNull) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull);

if (testMe.isNull())

return getJSConstant(m_constantNull);

}

// Add null to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

addConstant(jsNull());

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantNull must refer to an entry in the CodeBlock's constant pool that has the value 'null'.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull).isNull());

return getJSConstant(m_constantNull);

}

// This method returns a DoubleConstant with the value 1.

Node* one()

{

// Has m_constant1 been set up yet?

if (m_constant1 == UINT_MAX) {

// Search the constant pool for the value 1, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constant1 = 0; m_constant1 < numberOfConstants; ++m_constant1) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1);

if (testMe.isInt32() && testMe.asInt32() == 1)

return getJSConstant(m_constant1);

}

// Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

addConstant(jsNumber(1));

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constant1 must refer to an entry in the CodeBlock's constant pool that has the integer value 1.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).isInt32());

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).asInt32() == 1);

return getJSConstant(m_constant1);

}

// This method returns a DoubleConstant with the value NaN.

Node* constantNaN()

{

JSValue nan = jsNaN();

// Has m_constantNaN been set up yet?

if (m_constantNaN == UINT_MAX) {

// Search the constant pool for the value NaN, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantNaN = 0; m_constantNaN < numberOfConstants; ++m_constantNaN) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN);

if (JSValue::encode(testMe) == JSValue::encode(nan))

return getJSConstant(m_constantNaN);

}

// Add the value nan to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

addConstant(nan);

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantNaN must refer to an entry in the CodeBlock's constant pool that has the value nan.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN).isDouble());

ASSERT(std::isnan(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN).asDouble()));

return getJSConstant(m_constantNaN);

}

Node* cellConstant(JSCell* cell)

{

HashMap<JSCell*, Node*>::AddResult result = m_cellConstantNodes.add(cell, nullptr);

if (result.isNewEntry)

result.iterator->value = addToGraph(WeakJSConstant, OpInfo(cell));

return result.iterator->value;

}

Node* inferredConstant(JSValue value)

{

if (value.isCell())

return cellConstant(value.asCell());

return getJSConstantForValue(value, 0);

}

InlineCallFrame* inlineCallFrame()

{

return m_inlineStackTop->m_inlineCallFrame;

}

CodeOrigin currentCodeOrigin()

{

return CodeOrigin(m_currentIndex, inlineCallFrame());

}

bool canFold(Node* node)

{

if (Options::validateFTLOSRExitLiveness()) {

// The static folding that the bytecode parser does results in the DFG

// being able to do some DCE that the bytecode liveness analysis would

// miss. Hence, we disable the static folding if we're validating FTL OSR

// exit liveness. This may be brutish, but this validator is powerful

// enough that it's worth it.

return false;

}

return node->isStronglyProvedConstantIn(inlineCallFrame());

}

// Our codegen for constant strict equality performs a bitwise comparison,

// so we can only select values that have a consistent bitwise identity.

bool isConstantForCompareStrictEq(Node* node)

{

if (!node->isConstant())

return false;

JSValue value = valueOfJSConstant(node);

return value.isBoolean() || value.isUndefinedOrNull();

}

Node* addToGraph(NodeType op, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)

{

Node* result = m_graph.addNode(

SpecNone, op, currentCodeOrigin(), Edge(child1), Edge(child2), Edge(child3));

ASSERT(op != Phi);

m_currentBlock->append(result);

return result;

}

Node* addToGraph(NodeType op, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())

{

Node* result = m_graph.addNode(

SpecNone, op, currentCodeOrigin(), child1, child2, child3);

ASSERT(op != Phi);

m_currentBlock->append(result);

return result;

}

Node* addToGraph(NodeType op, OpInfo info, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)

{

Node* result = m_graph.addNode(

SpecNone, op, currentCodeOrigin(), info, Edge(child1), Edge(child2), Edge(child3));

ASSERT(op != Phi);

m_currentBlock->append(result);

return result;

}

Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)

{

Node* result = m_graph.addNode(

SpecNone, op, currentCodeOrigin(), info1, info2,

Edge(child1), Edge(child2), Edge(child3));

ASSERT(op != Phi);

m_currentBlock->append(result);

return result;

}

Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2)

{

Node* result = m_graph.addNode(

SpecNone, Node::VarArg, op, currentCodeOrigin(), info1, info2,

m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs);

ASSERT(op != Phi);

m_currentBlock->append(result);

m_numPassedVarArgs = 0;

return result;

}

void addVarArgChild(Node* child)

{

m_graph.m_varArgChildren.append(Edge(child));

m_numPassedVarArgs++;

}

Node* addCall(Instruction* currentInstruction, NodeType op)

{

SpeculatedType prediction = getPrediction();

addVarArgChild(get(VirtualRegister(currentInstruction[2].u.operand)));

int argCount = currentInstruction[3].u.operand;

if (JSStack::ThisArgument + (unsigned)argCount > m_parameterSlots)

m_parameterSlots = JSStack::ThisArgument + argCount;

int registerOffset = -currentInstruction[4].u.operand;

int dummyThisArgument = op == Call ? 0 : 1;

for (int i = 0 + dummyThisArgument; i < argCount; ++i)

addVarArgChild(get(virtualRegisterForArgument(i, registerOffset)));

Node* call = addToGraph(Node::VarArg, op, OpInfo(0), OpInfo(prediction));

set(VirtualRegister(currentInstruction[1].u.operand), call);

return call;

}

Node* cellConstantWithStructureCheck(JSCell* object, Structure* structure)

{

Node* objectNode = cellConstant(object);

addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structure)), objectNode);

return objectNode;

}

Node* cellConstantWithStructureCheck(JSCell* object)

{

return cellConstantWithStructureCheck(object, object->structure());

}

SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)

{

ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

return m_inlineStackTop->m_profiledBlock->valueProfilePredictionForBytecodeOffset(locker, bytecodeIndex);

}

SpeculatedType getPrediction(unsigned bytecodeIndex)

{

SpeculatedType prediction = getPredictionWithoutOSRExit(bytecodeIndex);

if (prediction == SpecNone) {

// We have no information about what values this node generates. Give up

// on executing this code, since we're likely to do more damage than good.

addToGraph(ForceOSRExit);

}

return prediction;

}

SpeculatedType getPredictionWithoutOSRExit()

{

return getPredictionWithoutOSRExit(m_currentIndex);

}

SpeculatedType getPrediction()

{

return getPrediction(m_currentIndex);

}

ArrayMode getArrayMode(ArrayProfile* profile, Array::Action action)

{

ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

profile->computeUpdatedPrediction(locker, m_inlineStackTop->m_profiledBlock);

return ArrayMode::fromObserved(locker, profile, action, false);

}

ArrayMode getArrayMode(ArrayProfile* profile)

{

return getArrayMode(profile, Array::Read);

}

ArrayMode getArrayModeConsideringSlowPath(ArrayProfile* profile, Array::Action action)

{

ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

profile->computeUpdatedPrediction(locker, m_inlineStackTop->m_profiledBlock);

bool makeSafe =

m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)

|| profile->outOfBounds(locker);

ArrayMode result = ArrayMode::fromObserved(locker, profile, action, makeSafe);

return result;

}

Node* makeSafe(Node* node)

{

bool likelyToTakeSlowCase;

if (!isX86() && node->op() == ArithMod)

likelyToTakeSlowCase = false;

else

likelyToTakeSlowCase = m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex);

if (!likelyToTakeSlowCase

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))

return node;

switch (node->op()) {

case UInt32ToNumber:

case ArithAdd:

case ArithSub:

case ValueAdd:

case ArithMod: // for ArithMod "MayOverflow" means we tried to divide by zero, or we saw double.

node->mergeFlags(NodeMayOverflow);

break;

case ArithNegate:

// Currently we can't tell the difference between a negation overflowing

// (i.e. -(1 << 31)) or generating negative zero (i.e. -0). If it took slow

// path then we assume that it did both of those things.

node->mergeFlags(NodeMayOverflow);

node->mergeFlags(NodeMayNegZero);

break;

case ArithMul:

if (m_inlineStackTop->m_profiledBlock->likelyToTakeDeepestSlowCase(m_currentIndex)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow))

node->mergeFlags(NodeMayOverflow | NodeMayNegZero);

else if (m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))

node->mergeFlags(NodeMayNegZero);

break;

default:

RELEASE_ASSERT_NOT_REACHED();

break;

}

return node;

}

Node* makeDivSafe(Node* node)

{

ASSERT(node->op() == ArithDiv);

// The main slow case counter for op_div in the old JIT counts only when

// the operands are not numbers. We don't care about that since we already

// have speculations in place that take care of that separately. We only

// care about when the outcome of the division is not an integer, which

// is what the special fast case counter tells us.

if (!m_inlineStackTop->m_profiledBlock->couldTakeSpecialFastCase(m_currentIndex)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))

return node;

// FIXME: It might be possible to make this more granular. The DFG certainly can

// distinguish between negative zero and overflow in its exit profiles.

node->mergeFlags(NodeMayOverflow | NodeMayNegZero);

return node;

}

bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)

{

if (direct)

return true;

if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())

return false;

for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {

if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())

return false;

}

return true;

}

void buildOperandMapsIfNecessary();

VM* m_vm;

CodeBlock* m_codeBlock;

CodeBlock* m_profiledBlock;

Graph& m_graph;

// The current block being generated.

BasicBlock* m_currentBlock;

// The bytecode index of the current instruction being generated.

unsigned m_currentIndex;

// We use these values during code generation, and to avoid the need for

// special handling we make sure they are available as constants in the

// CodeBlock's constant pool. These variables are initialized to

// UINT_MAX, and lazily updated to hold an index into the CodeBlock's

// constant pool, as necessary.

unsigned m_constantUndefined;

unsigned m_constantNull;

unsigned m_constantNaN;

unsigned m_constant1;

HashMap<JSCell*, unsigned> m_cellConstants;

HashMap<JSCell*, Node*> m_cellConstantNodes;

// A constant in the constant pool may be represented by more than one

// node in the graph, depending on the context in which it is being used.

struct ConstantRecord {

ConstantRecord()

: asInt32(0)