/*

* Copyright (C) 2011 Apple Inc. All rights reserved.

* Copyright (C) 2011 Intel Corporation. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGSpeculativeJIT.h"

#if ENABLE(DFG_JIT)

#include "JSByteArray.h"

namespace JSC { namespace DFG {

#if USE(JSVALUE32_64)

GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat)

{

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (info.registerFormat() == DataFormatNone) {

GPRReg gpr = allocate();

if (node.hasConstant()) {

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

if (isInt32Constant(nodeIndex))

m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);

else if (isNumberConstant(nodeIndex))

ASSERT_NOT_REACHED();

else {

ASSERT(isJSConstant(nodeIndex));

JSValue jsValue = valueOfJSConstant(nodeIndex);

m_jit.move(MacroAssembler::Imm32(jsValue.payload()), gpr);

}

} else {

ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger || info.spillFormat() == DataFormatInteger);

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);

}

info.fillInteger(gpr);

returnFormat = DataFormatInteger;

return gpr;

}

switch (info.registerFormat()) {

case DataFormatNone:

// Should have filled, above.

case DataFormatJSDouble:

case DataFormatDouble:

case DataFormatJS:

case DataFormatCell:

case DataFormatJSCell:

case DataFormatBoolean:

case DataFormatJSBoolean:

case DataFormatStorage:

// Should only be calling this function if we know this operand to be integer.

ASSERT_NOT_REACHED();

case DataFormatJSInteger: {

GPRReg tagGPR = info.tagGPR();

GPRReg payloadGPR = info.payloadGPR();

m_gprs.lock(tagGPR);

m_jit.jitAssertIsJSInt32(tagGPR);

m_gprs.unlock(tagGPR);

m_gprs.lock(payloadGPR);

m_gprs.release(tagGPR);

m_gprs.release(payloadGPR);

m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);

info.fillInteger(payloadGPR);

returnFormat = DataFormatInteger;

return payloadGPR;

}

case DataFormatInteger: {

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

m_jit.jitAssertIsInt32(gpr);

returnFormat = DataFormatInteger;

return gpr;

}

}

ASSERT_NOT_REACHED();

return InvalidGPRReg;

}

FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)

{

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (info.registerFormat() == DataFormatNone) {

if (node.hasConstant()) {

if (isInt32Constant(nodeIndex)) {

// FIXME: should not be reachable?

GPRReg gpr = allocate();

m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

info.fillInteger(gpr);

unlock(gpr);

} else if (isNumberConstant(nodeIndex)) {

FPRReg fpr = fprAllocate();

m_jit.loadDouble(addressOfDoubleConstant(nodeIndex), fpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

return fpr;

} else {

// FIXME: should not be reachable?

ASSERT_NOT_REACHED();

}

} else {

DataFormat spillFormat = info.spillFormat();

ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);

if (spillFormat == DataFormatJSDouble) {

FPRReg fpr = fprAllocate();

m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);

info.fillDouble(fpr);

return fpr;

}

FPRReg fpr = fprAllocate();

JITCompiler::Jump hasUnboxedDouble;

if (spillFormat != DataFormatJSInteger && spillFormat != DataFormatInteger) {

JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag));

m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);

hasUnboxedDouble = m_jit.jump();

isInteger.link(&m_jit);

}

m_jit.convertInt32ToDouble(JITCompiler::payloadFor(virtualRegister), fpr);

if (hasUnboxedDouble.isSet())

hasUnboxedDouble.link(&m_jit);

m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);

info.fillDouble(fpr);

return fpr;

}

}

switch (info.registerFormat()) {

case DataFormatNone:

// Should have filled, above.

case DataFormatCell:

case DataFormatJSCell:

case DataFormatBoolean:

case DataFormatJSBoolean:

case DataFormatStorage:

// Should only be calling this function if we know this operand to be numeric.

ASSERT_NOT_REACHED();

case DataFormatJSInteger:

case DataFormatJS: {

GPRReg tagGPR = info.tagGPR();

GPRReg payloadGPR = info.payloadGPR();

FPRReg fpr = fprAllocate();

m_gprs.lock(tagGPR);

m_gprs.lock(payloadGPR);

JITCompiler::Jump hasUnboxedDouble;

if (info.registerFormat() != DataFormatJSInteger) {

FPRTemporary scratch(this);

JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

m_jit.jitAssertIsJSDouble(tagGPR);

unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());

hasUnboxedDouble = m_jit.jump();

isInteger.link(&m_jit);

}

m_jit.convertInt32ToDouble(payloadGPR, fpr);

if (hasUnboxedDouble.isSet())

hasUnboxedDouble.link(&m_jit);

m_gprs.release(tagGPR);

m_gprs.release(payloadGPR);

m_gprs.unlock(tagGPR);

m_gprs.unlock(payloadGPR);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

info.killSpilled();

return fpr;

}

case DataFormatInteger: {

FPRReg fpr = fprAllocate();

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

m_jit.convertInt32ToDouble(gpr, fpr);

m_gprs.unlock(gpr);

return fpr;

}

case DataFormatJSDouble:

case DataFormatDouble: {

FPRReg fpr = info.fpr();

m_fprs.lock(fpr);

return fpr;

}

}

ASSERT_NOT_REACHED();

return InvalidFPRReg;

}

bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)

{

// FIXME: For double we could fill with a FPR.

UNUSED_PARAM(fpr);

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

switch (info.registerFormat()) {

case DataFormatNone: {

if (node.hasConstant()) {

tagGPR = allocate();

payloadGPR = allocate();

m_jit.move(Imm32(valueOfJSConstant(nodeIndex).tag()), tagGPR);

m_jit.move(Imm32(valueOfJSConstant(nodeIndex).payload()), payloadGPR);

m_gprs.retain(tagGPR, virtualRegister, SpillOrderConstant);

m_gprs.retain(payloadGPR, virtualRegister, SpillOrderConstant);

info.fillJSValue(tagGPR, payloadGPR, isInt32Constant(nodeIndex) ? DataFormatJSInteger : DataFormatJS);

} else {

DataFormat spillFormat = info.spillFormat();

ASSERT(spillFormat != DataFormatNone && spillFormat != DataFormatStorage);

tagGPR = allocate();

payloadGPR = allocate();

switch (spillFormat) {

case DataFormatInteger:

m_jit.move(TrustedImm32(JSValue::Int32Tag), tagGPR);

spillFormat = DataFormatJSInteger; // This will be used as the new register format.

break;

case DataFormatCell:

m_jit.move(TrustedImm32(JSValue::CellTag), tagGPR);

spillFormat = DataFormatJSCell; // This will be used as the new register format.

break;

case DataFormatBoolean:

m_jit.move(TrustedImm32(JSValue::BooleanTag), tagGPR);

spillFormat = DataFormatJSBoolean; // This will be used as the new register format.

break;

default:

m_jit.load32(JITCompiler::tagFor(virtualRegister), tagGPR);

break;

}

m_jit.load32(JITCompiler::payloadFor(virtualRegister), payloadGPR);

m_gprs.retain(tagGPR, virtualRegister, SpillOrderSpilled);

m_gprs.retain(payloadGPR, virtualRegister, SpillOrderSpilled);

info.fillJSValue(tagGPR, payloadGPR, spillFormat == DataFormatJSDouble ? DataFormatJS : spillFormat);

}

return true;

}

case DataFormatInteger:

case DataFormatCell:

case DataFormatBoolean: {

GPRReg gpr = info.gpr();

// If the register has already been locked we need to take a copy.

if (m_gprs.isLocked(gpr)) {

payloadGPR = allocate();

m_jit.move(gpr, payloadGPR);

} else {

payloadGPR = gpr;

m_gprs.lock(gpr);

}

tagGPR = allocate();

uint32_t tag = JSValue::EmptyValueTag;

DataFormat fillFormat = DataFormatJS;

switch (info.registerFormat()) {

case DataFormatInteger:

tag = JSValue::Int32Tag;

fillFormat = DataFormatJSInteger;

break;

case DataFormatCell:

tag = JSValue::CellTag;

fillFormat = DataFormatJSCell;

break;

case DataFormatBoolean:

tag = JSValue::BooleanTag;

fillFormat = DataFormatJSBoolean;

break;

default:

ASSERT_NOT_REACHED();

break;

}

m_jit.move(TrustedImm32(tag), tagGPR);

m_gprs.release(gpr);

m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);

m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);

info.fillJSValue(tagGPR, payloadGPR, fillFormat);

return true;

}

case DataFormatJSDouble:

case DataFormatDouble: {

FPRReg oldFPR = info.fpr();

m_fprs.lock(oldFPR);

tagGPR = allocate();

payloadGPR = allocate();

boxDouble(oldFPR, tagGPR, payloadGPR);

m_fprs.unlock(oldFPR);

m_fprs.release(oldFPR);

m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);

m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);

info.fillJSValue(tagGPR, payloadGPR, DataFormatJS);

return true;

}

case DataFormatJS:

case DataFormatJSInteger:

case DataFormatJSCell:

case DataFormatJSBoolean: {

tagGPR = info.tagGPR();

payloadGPR = info.payloadGPR();

m_gprs.lock(tagGPR);

m_gprs.lock(payloadGPR);

return true;

}

case DataFormatStorage:

// this type currently never occurs

ASSERT_NOT_REACHED();

}

ASSERT_NOT_REACHED();

return true;

}

void SpeculativeJIT::nonSpeculativeValueToNumber(Node& node)

{

if (isKnownNumeric(node.child1().index())) {

JSValueOperand op1(this, node.child1());

op1.fill();

if (op1.isDouble()) {

FPRTemporary result(this, op1);

m_jit.moveDouble(op1.fpr(), result.fpr());

doubleResult(result.fpr(), m_compileIndex);

} else {

GPRTemporary resultTag(this, op1);

GPRTemporary resultPayload(this, op1, false);

m_jit.move(op1.tagGPR(), resultTag.gpr());

m_jit.move(op1.payloadGPR(), resultPayload.gpr());

jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);

}

return;

}

JSValueOperand op1(this, node.child1());

GPRTemporary resultTag(this, op1);

GPRTemporary resultPayload(this, op1, false);

ASSERT(!isInt32Constant(node.child1().index()));

ASSERT(!isNumberConstant(node.child1().index()));

GPRReg tagGPR = op1.tagGPR();

GPRReg payloadGPR = op1.payloadGPR();

GPRReg resultTagGPR = resultTag.gpr();

GPRReg resultPayloadGPR = resultPayload.gpr();

op1.use();

JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

JITCompiler::Jump nonNumeric = m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag));

// First, if we get here we have a double encoded as a JSValue

JITCompiler::Jump hasUnboxedDouble = m_jit.jump();

// Next handle cells (& other JS immediates)

nonNumeric.link(&m_jit);

silentSpillAllRegisters(resultTagGPR, resultPayloadGPR);

callOperation(dfgConvertJSValueToNumber, FPRInfo::returnValueFPR, tagGPR, payloadGPR);

boxDouble(FPRInfo::returnValueFPR, resultTagGPR, resultPayloadGPR);

silentFillAllRegisters(resultTagGPR, resultPayloadGPR);

JITCompiler::Jump hasCalledToNumber = m_jit.jump();

// Finally, handle integers.

isInteger.link(&m_jit);

hasUnboxedDouble.link(&m_jit);

m_jit.move(tagGPR, resultTagGPR);

m_jit.move(payloadGPR, resultPayloadGPR);

hasCalledToNumber.link(&m_jit);

jsValueResult(resultTagGPR, resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::nonSpeculativeValueToInt32(Node& node)

{

ASSERT(!isInt32Constant(node.child1().index()));

if (isKnownInteger(node.child1().index())) {

IntegerOperand op1(this, node.child1());

GPRTemporary result(this, op1);

m_jit.move(op1.gpr(), result.gpr());

integerResult(result.gpr(), m_compileIndex);

return;

}

GenerationInfo& childInfo = m_generationInfo[at(node.child1()).virtualRegister()];

if (childInfo.isJSDouble()) {

DoubleOperand op1(this, node.child1());

GPRTemporary result(this);

FPRReg fpr = op1.fpr();

GPRReg gpr = result.gpr();

op1.use();

JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateSuccessful);

silentSpillAllRegisters(gpr);

callOperation(toInt32, gpr, fpr);

silentFillAllRegisters(gpr);

truncatedToInteger.link(&m_jit);

integerResult(gpr, m_compileIndex, UseChildrenCalledExplicitly);

return;

}

JSValueOperand op1(this, node.child1());

GPRTemporary result(this);

GPRReg tagGPR = op1.tagGPR();

GPRReg payloadGPR = op1.payloadGPR();

GPRReg resultGPR = result.gpr();

op1.use();

JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

// First handle non-integers

silentSpillAllRegisters(resultGPR);

callOperation(dfgConvertJSValueToInt32, GPRInfo::returnValueGPR, tagGPR, payloadGPR);

m_jit.move(GPRInfo::returnValueGPR, resultGPR);

silentFillAllRegisters(resultGPR);

JITCompiler::Jump hasCalledToInt32 = m_jit.jump();

// Then handle integers.

isInteger.link(&m_jit);

m_jit.move(payloadGPR, resultGPR);

hasCalledToInt32.link(&m_jit);

integerResult(resultGPR, m_compileIndex, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::nonSpeculativeUInt32ToNumber(Node& node)

{

IntegerOperand op1(this, node.child1());

FPRTemporary boxer(this);

GPRTemporary resultTag(this, op1);

GPRTemporary resultPayload(this);

JITCompiler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, op1.gpr(), TrustedImm32(0));

m_jit.convertInt32ToDouble(op1.gpr(), boxer.fpr());

m_jit.move(JITCompiler::TrustedImmPtr(&AssemblyHelpers::twoToThe32), resultPayload.gpr()); // reuse resultPayload register here.

m_jit.addDouble(JITCompiler::Address(resultPayload.gpr(), 0), boxer.fpr());

boxDouble(boxer.fpr(), resultTag.gpr(), resultPayload.gpr());

JITCompiler::Jump done = m_jit.jump();

positive.link(&m_jit);

m_jit.move(TrustedImm32(JSValue::Int32Tag), resultTag.gpr());

m_jit.move(op1.gpr(), resultPayload.gpr());

done.link(&m_jit);

jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);

}

JITCompiler::Call SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseTagGPROrNone, GPRReg basePayloadGPR, GPRReg resultTagGPR, GPRReg resultPayloadGPR, GPRReg scratchGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)

{

m_jit.beginUninterruptedSequence();

JITCompiler::DataLabelPtr structureToCompare;

JITCompiler::Jump structureCheck = m_jit.branchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(basePayloadGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));

m_jit.endUninterruptedSequence();

m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), resultPayloadGPR);

JITCompiler::DataLabelCompact tagLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);

JITCompiler::DataLabelCompact payloadLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);

JITCompiler::Jump done = m_jit.jump();

structureCheck.link(&m_jit);

if (slowPathTarget.isSet())

slowPathTarget.link(&m_jit);

JITCompiler::Label slowCase = m_jit.label();

if (spillMode == NeedToSpill)

silentSpillAllRegisters(resultTagGPR, resultPayloadGPR);

JITCompiler::Call functionCall;

if (baseTagGPROrNone == InvalidGPRReg)

functionCall = callOperation(operationGetByIdOptimize, resultTagGPR, resultPayloadGPR, JSValue::CellTag, basePayloadGPR, identifier(identifierNumber));

else

functionCall = callOperation(operationGetByIdOptimize, resultTagGPR, resultPayloadGPR, baseTagGPROrNone, basePayloadGPR, identifier(identifierNumber));

if (spillMode == NeedToSpill)

silentFillAllRegisters(resultTagGPR, resultPayloadGPR);

done.link(&m_jit);

JITCompiler::Label doneLabel = m_jit.label();

m_jit.addPropertyAccess(PropertyAccessRecord(codeOrigin, structureToCompare, functionCall, structureCheck, tagLoadWithPatch, payloadLoadWithPatch, slowCase, doneLabel, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR), safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR), spillMode == NeedToSpill ? PropertyAccessRecord::RegistersInUse : PropertyAccessRecord::RegistersFlushed));

return functionCall;

}

void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR, GPRReg valueTagGPR, GPRReg valuePayloadGPR, NodeUse valueUse, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget)

{

m_jit.beginUninterruptedSequence();

JITCompiler::DataLabelPtr structureToCompare;

JITCompiler::Jump structureCheck = m_jit.branchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(basePayloadGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));

m_jit.endUninterruptedSequence();

writeBarrier(basePayloadGPR, valueTagGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);

m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);

JITCompiler::DataLabel32 tagStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valueTagGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));

JITCompiler::DataLabel32 payloadStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valuePayloadGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));

JITCompiler::Jump done = m_jit.jump();

structureCheck.link(&m_jit);

if (slowPathTarget.isSet())

slowPathTarget.link(&m_jit);

JITCompiler::Label slowCase = m_jit.label();

silentSpillAllRegisters(InvalidGPRReg);

V_DFGOperation_EJCI optimizedCall;

if (m_jit.strictModeFor(at(m_compileIndex).codeOrigin)) {

if (putKind == Direct)

optimizedCall = operationPutByIdDirectStrictOptimize;

else

optimizedCall = operationPutByIdStrictOptimize;

} else {

if (putKind == Direct)

optimizedCall = operationPutByIdDirectNonStrictOptimize;

else

optimizedCall = operationPutByIdNonStrictOptimize;

}

JITCompiler::Call functionCall = callOperation(optimizedCall, valueTagGPR, valuePayloadGPR, basePayloadGPR, identifier(identifierNumber));

silentFillAllRegisters(InvalidGPRReg);

done.link(&m_jit);

JITCompiler::Label doneLabel = m_jit.label();

m_jit.addPropertyAccess(PropertyAccessRecord(codeOrigin, structureToCompare, functionCall, structureCheck, JITCompiler::DataLabelCompact(tagStoreWithPatch.label()), JITCompiler::DataLabelCompact(payloadStoreWithPatch.label()), slowCase, doneLabel, safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(valueTagGPR), safeCast<int8_t>(valuePayloadGPR), safeCast<int8_t>(scratchGPR)));

}

void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull(NodeUse operand, bool invert)

{

JSValueOperand arg(this, operand);

GPRReg argTagGPR = arg.tagGPR();

GPRReg argPayloadGPR = arg.payloadGPR();

GPRTemporary resultPayload(this, arg, false);

GPRReg resultPayloadGPR = resultPayload.gpr();

JITCompiler::Jump notCell;

if (!isKnownCell(operand.index()))

notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));

m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureOffset()), resultPayloadGPR);

m_jit.test8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultPayloadGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), resultPayloadGPR);

if (!isKnownCell(operand.index())) {

JITCompiler::Jump done = m_jit.jump();

notCell.link(&m_jit);

// null or undefined?

COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);

m_jit.move(argTagGPR, resultPayloadGPR);

m_jit.or32(TrustedImm32(1), resultPayloadGPR);

m_jit.compare32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultPayloadGPR, TrustedImm32(JSValue::NullTag), resultPayloadGPR);

done.link(&m_jit);

}

booleanResult(resultPayloadGPR, m_compileIndex);

}

void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex branchNodeIndex, bool invert)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

if (taken == (m_block + 1)) {

invert = !invert;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg(this, operand);

GPRReg argTagGPR = arg.tagGPR();

GPRReg argPayloadGPR = arg.payloadGPR();

GPRTemporary result(this, arg);

GPRReg resultGPR = result.gpr();

JITCompiler::Jump notCell;

if (!isKnownCell(operand.index()))

notCell = m_jit.branch32(MacroAssembler::NotEqual, argTagGPR, TrustedImm32(JSValue::CellTag));

m_jit.loadPtr(JITCompiler::Address(argPayloadGPR, JSCell::structureOffset()), resultGPR);

branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), taken);

if (!isKnownCell(operand.index())) {

jump(notTaken, ForceJump);

notCell.link(&m_jit);

// null or undefined?

COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);

m_jit.move(argTagGPR, resultGPR);

m_jit.or32(TrustedImm32(1), resultGPR);

branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(JSValue::NullTag), taken);

}

jump(notTaken);

}

bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)

{

NodeIndex branchNodeIndex = detectPeepHoleBranch();

if (branchNodeIndex != NoNode) {

ASSERT(node.adjustedRefCount() == 1);

nonSpeculativePeepholeBranchNull(operand, branchNodeIndex, invert);

use(node.child1());

use(node.child2());

m_compileIndex = branchNodeIndex;

return true;

}

nonSpeculativeNonPeepholeCompareNull(operand, invert);

return false;

}

void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNodeIndex, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

JITCompiler::ResultCondition callResultCondition = JITCompiler::NonZero;

// The branch instruction will branch to the taken block.

// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.

if (taken == (m_block + 1)) {

cond = JITCompiler::invert(cond);

callResultCondition = JITCompiler::Zero;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1TagGPR = arg1.tagGPR();

GPRReg arg1PayloadGPR = arg1.payloadGPR();

GPRReg arg2TagGPR = arg2.tagGPR();

GPRReg arg2PayloadGPR = arg2.payloadGPR();

JITCompiler::JumpList slowPath;

if (isKnownNotInteger(node.child1().index()) || isKnownNotInteger(node.child2().index())) {

GPRResult result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

flushRegisters();

callOperation(helperFunction, resultGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

branchTest32(callResultCondition, resultGPR, taken);

} else {

GPRTemporary result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

if (!isKnownInteger(node.child1().index()))

slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg1TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));

if (!isKnownInteger(node.child2().index()))

slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg2TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));

branch32(cond, arg1PayloadGPR, arg2PayloadGPR, taken);

if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {

jump(notTaken, ForceJump);

slowPath.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(helperFunction, resultGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultGPR);

branchTest32(callResultCondition, resultGPR, taken);

}

}

jump(notTaken);

}

void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)

{

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1TagGPR = arg1.tagGPR();

GPRReg arg1PayloadGPR = arg1.payloadGPR();

GPRReg arg2TagGPR = arg2.tagGPR();

GPRReg arg2PayloadGPR = arg2.payloadGPR();

JITCompiler::JumpList slowPath;

if (isKnownNotInteger(node.child1().index()) || isKnownNotInteger(node.child2().index())) {

GPRResult result(this);

GPRReg resultPayloadGPR = result.gpr();

arg1.use();

arg2.use();

flushRegisters();

callOperation(helperFunction, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

booleanResult(resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);

} else {

GPRTemporary resultPayload(this, arg1, false);

GPRReg resultPayloadGPR = resultPayload.gpr();

arg1.use();

arg2.use();

if (!isKnownInteger(node.child1().index()))

slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg1TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));

if (!isKnownInteger(node.child2().index()))

slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, arg2TagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag)));

m_jit.compare32(cond, arg1PayloadGPR, arg2PayloadGPR, resultPayloadGPR);

if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {

JITCompiler::Jump haveResult = m_jit.jump();

slowPath.link(&m_jit);

silentSpillAllRegisters(resultPayloadGPR);

callOperation(helperFunction, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultPayloadGPR);

m_jit.andPtr(TrustedImm32(1), resultPayloadGPR);

haveResult.link(&m_jit);

}

booleanResult(resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);

}

}

void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branchNodeIndex, bool invert)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

// The branch instruction will branch to the taken block.

// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.

if (taken == (m_block + 1)) {

invert = !invert;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1TagGPR = arg1.tagGPR();

GPRReg arg1PayloadGPR = arg1.payloadGPR();

GPRReg arg2TagGPR = arg2.tagGPR();

GPRReg arg2PayloadGPR = arg2.payloadGPR();

GPRTemporary resultPayload(this, arg1, false);

GPRReg resultPayloadGPR = resultPayload.gpr();

arg1.use();

arg2.use();

if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {

// see if we get lucky: if the arguments are cells and they reference the same

// cell, then they must be strictly equal.

branchPtr(JITCompiler::Equal, arg1PayloadGPR, arg2PayloadGPR, invert ? notTaken : taken);

silentSpillAllRegisters(resultPayloadGPR);

callOperation(operationCompareStrictEqCell, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultPayloadGPR);

branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);

} else {

// FIXME: Add fast paths for twoCells, number etc.

silentSpillAllRegisters(resultPayloadGPR);

callOperation(operationCompareStrictEq, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultPayloadGPR);

branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultPayloadGPR, taken);

}

jump(notTaken);

}

void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)

{

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1TagGPR = arg1.tagGPR();

GPRReg arg1PayloadGPR = arg1.payloadGPR();

GPRReg arg2TagGPR = arg2.tagGPR();

GPRReg arg2PayloadGPR = arg2.payloadGPR();

GPRTemporary resultPayload(this, arg1, false);

GPRReg resultPayloadGPR = resultPayload.gpr();

arg1.use();

arg2.use();

if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {

// see if we get lucky: if the arguments are cells and they reference the same

// cell, then they must be strictly equal.

JITCompiler::Jump notEqualCase = m_jit.branchPtr(JITCompiler::NotEqual, arg1PayloadGPR, arg2PayloadGPR);

m_jit.move(JITCompiler::TrustedImm32(!invert), resultPayloadGPR);

JITCompiler::Jump done = m_jit.jump();

notEqualCase.link(&m_jit);

silentSpillAllRegisters(resultPayloadGPR);

callOperation(operationCompareStrictEqCell, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultPayloadGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(1), resultPayloadGPR);

done.link(&m_jit);

} else {

// FIXME: Add fast paths.

silentSpillAllRegisters(resultPayloadGPR);

callOperation(operationCompareStrictEq, resultPayloadGPR, arg1TagGPR, arg1PayloadGPR, arg2TagGPR, arg2PayloadGPR);

silentFillAllRegisters(resultPayloadGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(1), resultPayloadGPR);

}

booleanResult(resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::emitCall(Node& node)

{

P_DFGOperation_E slowCallFunction;

if (node.op == Call)

slowCallFunction = operationLinkCall;

else {

ASSERT(node.op == Construct);

slowCallFunction = operationLinkConstruct;

}

// For constructors, the this argument is not passed but we have to make space

// for it.

int dummyThisArgument = node.op == Call ? 0 : 1;

CallLinkInfo::CallType callType = node.op == Call ? CallLinkInfo::Call : CallLinkInfo::Construct;

NodeUse calleeNodeUse = m_jit.graph().m_varArgChildren[node.firstChild()];

JSValueOperand callee(this, calleeNodeUse);

GPRReg calleeTagGPR = callee.tagGPR();

GPRReg calleePayloadGPR = callee.payloadGPR();

use(calleeNodeUse);

// The call instruction's first child is either the function (normal call) or the

// receiver (method call). subsequent children are the arguments.

int numPassedArgs = node.numChildren() - 1;

m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs + dummyThisArgument), callFramePayloadSlot(RegisterFile::ArgumentCount));

m_jit.storePtr(GPRInfo::callFrameRegister, callFramePayloadSlot(RegisterFile::CallerFrame));

m_jit.store32(calleePayloadGPR, callFramePayloadSlot(RegisterFile::Callee));

m_jit.store32(calleeTagGPR, callFrameTagSlot(RegisterFile::Callee));

for (int i = 0; i < numPassedArgs; i++) {

NodeUse argNodeUse = m_jit.graph().m_varArgChildren[node.firstChild() + 1 + i];

JSValueOperand arg(this, argNodeUse);

GPRReg argTagGPR = arg.tagGPR();

GPRReg argPayloadGPR = arg.payloadGPR();

use(argNodeUse);

m_jit.store32(argTagGPR, argumentTagSlot(i + dummyThisArgument));

m_jit.store32(argPayloadGPR, argumentPayloadSlot(i + dummyThisArgument));

}

flushRegisters();

GPRResult resultPayload(this);

GPRResult2 resultTag(this);

GPRReg resultPayloadGPR = resultPayload.gpr();

GPRReg resultTagGPR = resultTag.gpr();

JITCompiler::DataLabelPtr targetToCheck;

JITCompiler::JumpList slowPath;

slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));

slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));

m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultPayloadGPR);

m_jit.storePtr(resultPayloadGPR, callFramePayloadSlot(RegisterFile::ScopeChain));

m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), callFrameTagSlot(RegisterFile::ScopeChain));

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);

CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;

CallBeginToken token = m_jit.beginJSCall();

JITCompiler::Call fastCall = m_jit.nearCall();

m_jit.notifyCall(fastCall, codeOrigin, token);

JITCompiler::Jump done = m_jit.jump();

slowPath.link(&m_jit);

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);

m_jit.poke(GPRInfo::argumentGPR0);

token = m_jit.beginCall();

JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);

m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);

token = m_jit.beginJSCall();

JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);

m_jit.notifyCall(theCall, codeOrigin, token);

done.link(&m_jit);

m_jit.setupResults(resultPayloadGPR, resultTagGPR);

jsValueResult(resultTagGPR, resultPayloadGPR, m_compileIndex, DataFormatJS, UseChildrenCalledExplicitly);

m_jit.addJSCall(fastCall, slowCall, targetToCheck, callType, at(m_compileIndex).codeOrigin);

}

template<bool strict>

GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)

{

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("SpecInt@%d ", nodeIndex);

#endif

if (isKnownNotInteger(nodeIndex)) {

terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);

returnFormat = DataFormatInteger;

return allocate();

}

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

switch (info.registerFormat()) {

case DataFormatNone: {

if (node.hasConstant()) {

ASSERT(isInt32Constant(nodeIndex));