/*

* Copyright (C) 2011 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGSpeculativeJIT.h"

#if ENABLE(DFG_JIT)

#include "JSByteArray.h"

#include "LinkBuffer.h"

namespace JSC { namespace DFG {

// On Windows we need to wrap fmod; on other platforms we can call it directly.

// On ARMv7 we assert that all function pointers have to low bit set (point to thumb code).

#if CALLING_CONVENTION_IS_STDCALL || CPU(ARM_THUMB2)

static double DFG_OPERATION fmodAsDFGOperation(double x, double y)

{

return fmod(x, y);

}

#else

#define fmodAsDFGOperation fmod

#endif

void SpeculativeJIT::clearGenerationInfo()

{

for (unsigned i = 0; i < m_generationInfo.size(); ++i)

m_generationInfo[i] = GenerationInfo();

m_gprs = RegisterBank<GPRInfo>();

m_fprs = RegisterBank<FPRInfo>();

}

GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

switch (info.registerFormat()) {

case DataFormatNone: {

GPRReg gpr = allocate();

ASSERT(info.spillFormat() == DataFormatStorage);

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);

info.fillStorage(gpr);

return gpr;

}

case DataFormatStorage: {

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

return gpr;

}

default:

ASSERT_NOT_REACHED();

}

return InvalidGPRReg;

}

void SpeculativeJIT::useChildren(Node& node)

{

if (node.op & NodeHasVarArgs) {

for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)

use(m_jit.graph().m_varArgChildren[childIdx]);

} else {

NodeUse child1 = node.child1();

if (!child1) {

ASSERT(!node.child2() && !node.child3());

return;

}

use(child1);

NodeUse child2 = node.child2();

if (!child2) {

ASSERT(!node.child3());

return;

}

use(child2);

NodeUse child3 = node.child3();

if (!child3)

return;

use(child3);

}

}

bool SpeculativeJIT::isStrictInt32(NodeIndex nodeIndex)

{

if (isInt32Constant(nodeIndex))

return true;

Node& node = m_jit.graph()[nodeIndex];

GenerationInfo& info = m_generationInfo[node.virtualRegister()];

return info.registerFormat() == DataFormatInteger;

}

bool SpeculativeJIT::isKnownInteger(NodeIndex nodeIndex)

{

if (isInt32Constant(nodeIndex))

return true;

Node& node = m_jit.graph()[nodeIndex];

if (node.hasInt32Result())

return true;

GenerationInfo& info = m_generationInfo[node.virtualRegister()];

return info.isJSInteger();

}

bool SpeculativeJIT::isKnownNumeric(NodeIndex nodeIndex)

{

if (isInt32Constant(nodeIndex) || isNumberConstant(nodeIndex))

return true;

Node& node = m_jit.graph()[nodeIndex];

if (node.hasNumberResult())

return true;

GenerationInfo& info = m_generationInfo[node.virtualRegister()];

return info.isJSInteger() || info.isJSDouble();

}

bool SpeculativeJIT::isKnownCell(NodeIndex nodeIndex)

{

return m_generationInfo[m_jit.graph()[nodeIndex].virtualRegister()].isJSCell();

}

bool SpeculativeJIT::isKnownNotCell(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (node.hasConstant() && !valueOfJSConstant(nodeIndex).isCell())

return true;

return !(info.isJSCell() || info.isUnknownJS());

}

bool SpeculativeJIT::isKnownNotInteger(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

return info.isJSDouble() || info.isJSCell() || info.isJSBoolean()

|| (node.hasConstant() && !valueOfJSConstant(nodeIndex).isInt32());

}

bool SpeculativeJIT::isKnownNotNumber(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

return (!info.isJSDouble() && !info.isJSInteger() && !info.isUnknownJS())

|| (node.hasConstant() && !isNumberConstant(nodeIndex));

}

bool SpeculativeJIT::isKnownBoolean(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

if (node.hasBooleanResult())

return true;

if (isBooleanConstant(nodeIndex))

return true;

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

return info.isJSBoolean();

}

bool SpeculativeJIT::isKnownNotBoolean(NodeIndex nodeIndex)

{

Node& node = m_jit.graph()[nodeIndex];

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (node.hasConstant() && !valueOfJSConstant(nodeIndex).isBoolean())

return true;

return !(info.isJSBoolean() || info.isUnknownJS());

}

void SpeculativeJIT::writeBarrier(MacroAssembler& jit, GPRReg owner, GPRReg scratch1, GPRReg scratch2, WriteBarrierUseKind useKind)

{

UNUSED_PARAM(jit);

UNUSED_PARAM(owner);

UNUSED_PARAM(scratch1);

UNUSED_PARAM(scratch2);

UNUSED_PARAM(useKind);

ASSERT(owner != scratch1);

ASSERT(owner != scratch2);

ASSERT(scratch1 != scratch2);

#if ENABLE(WRITE_BARRIER_PROFILING)

JITCompiler::emitCount(jit, WriteBarrierCounters::jitCounterFor(useKind));

#endif

markCellCard(jit, owner, scratch1, scratch2);

}

void SpeculativeJIT::markCellCard(MacroAssembler& jit, GPRReg owner, GPRReg scratch1, GPRReg scratch2)

{

UNUSED_PARAM(jit);

UNUSED_PARAM(owner);

UNUSED_PARAM(scratch1);

UNUSED_PARAM(scratch2);

#if ENABLE(GGC)

jit.move(owner, scratch1);

jit.andPtr(TrustedImm32(static_cast<int32_t>(MarkedBlock::blockMask)), scratch1);

jit.move(owner, scratch2);

// consume additional 8 bits as we're using an approximate filter

jit.rshift32(TrustedImm32(MarkedBlock::atomShift + 8), scratch2);

jit.andPtr(TrustedImm32(MarkedBlock::atomMask >> 8), scratch2);

MacroAssembler::Jump filter = jit.branchTest8(MacroAssembler::Zero, MacroAssembler::BaseIndex(scratch1, scratch2, MacroAssembler::TimesOne, MarkedBlock::offsetOfMarks()));

jit.move(owner, scratch2);

jit.rshift32(TrustedImm32(MarkedBlock::cardShift), scratch2);

jit.andPtr(TrustedImm32(MarkedBlock::cardMask), scratch2);

jit.store8(TrustedImm32(1), MacroAssembler::BaseIndex(scratch1, scratch2, MacroAssembler::TimesOne, MarkedBlock::offsetOfCards()));

filter.link(&jit);

#endif

}

void SpeculativeJIT::writeBarrier(GPRReg ownerGPR, GPRReg valueGPR, NodeUse valueUse, WriteBarrierUseKind useKind, GPRReg scratch1, GPRReg scratch2)

{

UNUSED_PARAM(ownerGPR);

UNUSED_PARAM(valueGPR);

UNUSED_PARAM(scratch1);

UNUSED_PARAM(scratch2);

UNUSED_PARAM(useKind);

if (isKnownNotCell(valueUse.index()))

return;

#if ENABLE(WRITE_BARRIER_PROFILING)

JITCompiler::emitCount(m_jit, WriteBarrierCounters::jitCounterFor(useKind));

#endif

#if ENABLE(GGC)

GPRTemporary temp1;

GPRTemporary temp2;

if (scratch1 == InvalidGPRReg) {

GPRTemporary scratchGPR(this);

temp1.adopt(scratchGPR);

scratch1 = temp1.gpr();

}

if (scratch2 == InvalidGPRReg) {

GPRTemporary scratchGPR(this);

temp2.adopt(scratchGPR);

scratch2 = temp2.gpr();

}

JITCompiler::Jump rhsNotCell;

bool hadCellCheck = false;

if (!isKnownCell(valueUse.index()) && !isCellPrediction(m_jit.getPrediction(valueUse.index()))) {

hadCellCheck = true;

rhsNotCell = m_jit.branchIfNotCell(valueGPR);

}

markCellCard(m_jit, ownerGPR, scratch1, scratch2);

if (hadCellCheck)

rhsNotCell.link(&m_jit);

#endif

}

void SpeculativeJIT::writeBarrier(GPRReg ownerGPR, JSCell* value, WriteBarrierUseKind useKind, GPRReg scratch1, GPRReg scratch2)

{

UNUSED_PARAM(ownerGPR);

UNUSED_PARAM(value);

UNUSED_PARAM(scratch1);

UNUSED_PARAM(scratch2);

UNUSED_PARAM(useKind);

if (Heap::isMarked(value))

return;

#if ENABLE(WRITE_BARRIER_PROFILING)

JITCompiler::emitCount(m_jit, WriteBarrierCounters::jitCounterFor(useKind));

#endif

#if ENABLE(GGC)

GPRTemporary temp1;

GPRTemporary temp2;

if (scratch1 == InvalidGPRReg) {

GPRTemporary scratchGPR(this);

temp1.adopt(scratchGPR);

scratch1 = temp1.gpr();

}

if (scratch2 == InvalidGPRReg) {

GPRTemporary scratchGPR(this);

temp2.adopt(scratchGPR);

scratch2 = temp2.gpr();

}

markCellCard(m_jit, ownerGPR, scratch1, scratch2);

#endif

}

void SpeculativeJIT::writeBarrier(JSCell* owner, GPRReg valueGPR, NodeUse valueUse, WriteBarrierUseKind useKind, GPRReg scratch)

{

UNUSED_PARAM(owner);

UNUSED_PARAM(valueGPR);

UNUSED_PARAM(scratch);

UNUSED_PARAM(useKind);

if (isKnownNotCell(valueUse.index()))

return;

#if ENABLE(WRITE_BARRIER_PROFILING)

JITCompiler::emitCount(m_jit, WriteBarrierCounters::jitCounterFor(useKind));

#endif

#if ENABLE(GGC)

JITCompiler::Jump rhsNotCell;

bool hadCellCheck = false;

if (!isKnownCell(valueUse.index()) && !isCellPrediction(m_jit.getPrediction(valueUse.index()))) {

hadCellCheck = true;

rhsNotCell = m_jit.branchIfNotCell(valueGPR);

}

GPRTemporary temp;

if (scratch == InvalidGPRReg) {

GPRTemporary scratchGPR(this);

temp.adopt(scratchGPR);

scratch = temp.gpr();

}

uint8_t* cardAddress = Heap::addressOfCardFor(owner);

m_jit.move(JITCompiler::TrustedImmPtr(cardAddress), scratch);

m_jit.store8(JITCompiler::TrustedImm32(1), JITCompiler::Address(scratch));

if (hadCellCheck)

rhsNotCell.link(&m_jit);

#endif

}

bool SpeculativeJIT::nonSpeculativeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)

{

NodeIndex branchNodeIndex = detectPeepHoleBranch();

if (branchNodeIndex != NoNode) {

ASSERT(node.adjustedRefCount() == 1);

nonSpeculativePeepholeBranch(node, branchNodeIndex, cond, helperFunction);

m_compileIndex = branchNodeIndex;

return true;

}

nonSpeculativeNonPeepholeCompare(node, cond, helperFunction);

return false;

}

bool SpeculativeJIT::nonSpeculativeStrictEq(Node& node, bool invert)

{

if (!invert && (isKnownNumeric(node.child1().index()) || isKnownNumeric(node.child2().index())))

return nonSpeculativeCompare(node, MacroAssembler::Equal, operationCompareStrictEq);

NodeIndex branchNodeIndex = detectPeepHoleBranch();

if (branchNodeIndex != NoNode) {

ASSERT(node.adjustedRefCount() == 1);

nonSpeculativePeepholeStrictEq(node, branchNodeIndex, invert);

m_compileIndex = branchNodeIndex;

return true;

}

nonSpeculativeNonPeepholeStrictEq(node, invert);

return false;

}

#ifndef NDEBUG

static const char* dataFormatString(DataFormat format)

{

// These values correspond to the DataFormat enum.

const char* strings[] = {

"[ ]",

"[ i]",

"[ d]",

"[ c]",

"Err!",

"Err!",

"Err!",

"Err!",

"[J ]",

"[Ji]",

"[Jd]",

"[Jc]",

"Err!",

"Err!",

"Err!",

"Err!",

};

return strings[format];

}

void SpeculativeJIT::dump(const char* label)

{

if (label)

dataLog("<%s>\n", label);

dataLog(" gprs:\n");

m_gprs.dump();

dataLog(" fprs:\n");

m_fprs.dump();

dataLog(" VirtualRegisters:\n");

for (unsigned i = 0; i < m_generationInfo.size(); ++i) {

GenerationInfo& info = m_generationInfo[i];

if (info.alive())

dataLog(" % 3d:%s%s", i, dataFormatString(info.registerFormat()), dataFormatString(info.spillFormat()));

else

dataLog(" % 3d:[__][__]", i);

if (info.registerFormat() == DataFormatDouble)

dataLog(":fpr%d\n", info.fpr());

else if (info.registerFormat() != DataFormatNone

#if USE(JSVALUE32_64)

&& !(info.registerFormat() & DataFormatJS)

#endif

) {

ASSERT(info.gpr() != InvalidGPRReg);

dataLog(":%s\n", GPRInfo::debugName(info.gpr()));

} else

dataLog("\n");

}

if (label)

dataLog("</%s>\n", label);

}

#endif

#if DFG_ENABLE(CONSISTENCY_CHECK)

void SpeculativeJIT::checkConsistency()

{

bool failed = false;

for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {

if (iter.isLocked()) {

dataLog("DFG_CONSISTENCY_CHECK failed: gpr %s is locked.\n", iter.debugName());

failed = true;

}

}

for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {

if (iter.isLocked()) {

dataLog("DFG_CONSISTENCY_CHECK failed: fpr %s is locked.\n", iter.debugName());

failed = true;

}

}

for (unsigned i = 0; i < m_generationInfo.size(); ++i) {

VirtualRegister virtualRegister = (VirtualRegister)i;

GenerationInfo& info = m_generationInfo[virtualRegister];

if (!info.alive())

continue;

switch (info.registerFormat()) {

case DataFormatNone:

break;

case DataFormatJS:

case DataFormatJSInteger:

case DataFormatJSDouble:

case DataFormatJSCell:

case DataFormatJSBoolean:

#if USE(JSVALUE32_64)

break;

#endif

case DataFormatInteger:

case DataFormatCell:

case DataFormatBoolean:

case DataFormatStorage: {

GPRReg gpr = info.gpr();

ASSERT(gpr != InvalidGPRReg);

if (m_gprs.name(gpr) != virtualRegister) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (gpr %s).\n", virtualRegister, GPRInfo::debugName(gpr));

failed = true;

}

break;

}

case DataFormatDouble: {

FPRReg fpr = info.fpr();

ASSERT(fpr != InvalidFPRReg);

if (m_fprs.name(fpr) != virtualRegister) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for virtual register %d (fpr %s).\n", virtualRegister, FPRInfo::debugName(fpr));

failed = true;

}

break;

}

}

}

for (gpr_iterator iter = m_gprs.begin(); iter != m_gprs.end(); ++iter) {

VirtualRegister virtualRegister = iter.name();

if (virtualRegister == InvalidVirtualRegister)

continue;

GenerationInfo& info = m_generationInfo[virtualRegister];

#if USE(JSVALUE64)

if (iter.regID() != info.gpr()) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);

failed = true;

}

#else

if (!(info.registerFormat() & DataFormatJS)) {

if (iter.regID() != info.gpr()) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);

failed = true;

}

} else {

if (iter.regID() != info.tagGPR() && iter.regID() != info.payloadGPR()) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for gpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);

failed = true;

}

}

#endif

}

for (fpr_iterator iter = m_fprs.begin(); iter != m_fprs.end(); ++iter) {

VirtualRegister virtualRegister = iter.name();

if (virtualRegister == InvalidVirtualRegister)

continue;

GenerationInfo& info = m_generationInfo[virtualRegister];

if (iter.regID() != info.fpr()) {

dataLog("DFG_CONSISTENCY_CHECK failed: name mismatch for fpr %s (virtual register %d).\n", iter.debugName(), virtualRegister);

failed = true;

}

}

if (failed) {

dump();

CRASH();

}

}

#endif

GPRTemporary::GPRTemporary()

: m_jit(0)

, m_gpr(InvalidGPRReg)

{

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, GPRReg specific)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

m_gpr = m_jit->allocate(specific);

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, SpeculateIntegerOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, SpeculateIntegerOperand& op1, SpeculateIntegerOperand& op2)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else if (m_jit->canReuse(op2.index()))

m_gpr = m_jit->reuse(op2.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, SpeculateStrictInt32Operand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, IntegerOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, IntegerOperand& op1, IntegerOperand& op2)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else if (m_jit->canReuse(op2.index()))

m_gpr = m_jit->reuse(op2.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, SpeculateCellOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, SpeculateBooleanOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

#if USE(JSVALUE64)

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

#else

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1, bool tag)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (!op1.isDouble() && m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(tag ? op1.tagGPR() : op1.payloadGPR());

else

m_gpr = m_jit->allocate();

}

#endif

GPRTemporary::GPRTemporary(SpeculativeJIT* jit, StorageOperand& op1)

: m_jit(jit)

, m_gpr(InvalidGPRReg)

{

if (m_jit->canReuse(op1.index()))

m_gpr = m_jit->reuse(op1.gpr());

else

m_gpr = m_jit->allocate();

}

void GPRTemporary::adopt(GPRTemporary& other)

{

ASSERT(!m_jit);

ASSERT(m_gpr == InvalidGPRReg);

ASSERT(other.m_jit);

ASSERT(other.m_gpr != InvalidGPRReg);

m_jit = other.m_jit;

m_gpr = other.m_gpr;

other.m_jit = 0;

other.m_gpr = InvalidGPRReg;

}

FPRTemporary::FPRTemporary(SpeculativeJIT* jit)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

m_fpr = m_jit->fprAllocate();

}

FPRTemporary::FPRTemporary(SpeculativeJIT* jit, DoubleOperand& op1)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

if (m_jit->canReuse(op1.index()))

m_fpr = m_jit->reuse(op1.fpr());

else

m_fpr = m_jit->fprAllocate();

}

FPRTemporary::FPRTemporary(SpeculativeJIT* jit, DoubleOperand& op1, DoubleOperand& op2)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

if (m_jit->canReuse(op1.index()))

m_fpr = m_jit->reuse(op1.fpr());

else if (m_jit->canReuse(op2.index()))

m_fpr = m_jit->reuse(op2.fpr());

else

m_fpr = m_jit->fprAllocate();

}

FPRTemporary::FPRTemporary(SpeculativeJIT* jit, SpeculateDoubleOperand& op1)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

if (m_jit->canReuse(op1.index()))

m_fpr = m_jit->reuse(op1.fpr());

else

m_fpr = m_jit->fprAllocate();

}

FPRTemporary::FPRTemporary(SpeculativeJIT* jit, SpeculateDoubleOperand& op1, SpeculateDoubleOperand& op2)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

if (m_jit->canReuse(op1.index()))

m_fpr = m_jit->reuse(op1.fpr());

else if (m_jit->canReuse(op2.index()))

m_fpr = m_jit->reuse(op2.fpr());

else

m_fpr = m_jit->fprAllocate();

}

#if USE(JSVALUE32_64)

FPRTemporary::FPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1)

: m_jit(jit)

, m_fpr(InvalidFPRReg)

{

if (op1.isDouble() && m_jit->canReuse(op1.index()))

m_fpr = m_jit->reuse(op1.fpr());

else

m_fpr = m_jit->fprAllocate();

}

#endif

#ifndef NDEBUG

void ValueSource::dump(FILE* out) const

{

switch (kind()) {

case SourceNotSet:

fprintf(out, "NotSet");

break;

case ValueInRegisterFile:

fprintf(out, "InRegFile");

break;

case Int32InRegisterFile:

fprintf(out, "Int32");

break;

case CellInRegisterFile:

fprintf(out, "Cell");

break;

case BooleanInRegisterFile:

fprintf(out, "Bool");

break;

case DoubleInRegisterFile:

fprintf(out, "Double");

break;

case HaveNode:

fprintf(out, "Node(%d)", m_nodeIndex);

break;

}

}

#endif

void SpeculativeJIT::compilePeepHoleDoubleBranch(Node& node, NodeIndex branchNodeIndex, JITCompiler::DoubleCondition condition)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

SpeculateDoubleOperand op1(this, node.child1());

SpeculateDoubleOperand op2(this, node.child2());

branchDouble(condition, op1.fpr(), op2.fpr(), taken);

jump(notTaken);

}

void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex, const ClassInfo* classInfo, PredictionChecker predictionCheck)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

MacroAssembler::RelationalCondition condition = MacroAssembler::Equal;

if (taken == (m_block + 1)) {

condition = MacroAssembler::NotEqual;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

SpeculateCellOperand op1(this, node.child1());

SpeculateCellOperand op2(this, node.child2());

GPRReg op1GPR = op1.gpr();

GPRReg op2GPR = op2.gpr();

if (!predictionCheck(m_state.forNode(node.child1()).m_type))

speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));

if (!predictionCheck(m_state.forNode(node.child2()).m_type))

speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));

branchPtr(condition, op1GPR, op2GPR, taken);

jump(notTaken);

}

void SpeculativeJIT::compilePeepHoleIntegerBranch(Node& node, NodeIndex branchNodeIndex, JITCompiler::RelationalCondition condition)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

// The branch instruction will branch to the taken block.

// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.

if (taken == (m_block + 1)) {

condition = JITCompiler::invert(condition);

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

if (isInt32Constant(node.child1().index())) {

int32_t imm = valueOfInt32Constant(node.child1().index());

SpeculateIntegerOperand op2(this, node.child2());

branch32(condition, JITCompiler::Imm32(imm), op2.gpr(), taken);

} else if (isInt32Constant(node.child2().index())) {

SpeculateIntegerOperand op1(this, node.child1());

int32_t imm = valueOfInt32Constant(node.child2().index());

branch32(condition, op1.gpr(), JITCompiler::Imm32(imm), taken);

} else {

SpeculateIntegerOperand op1(this, node.child1());

SpeculateIntegerOperand op2(this, node.child2());

branch32(condition, op1.gpr(), op2.gpr(), taken);

}

jump(notTaken);

}

// Returns true if the compare is fused with a subsequent branch.

bool SpeculativeJIT::compilePeepHoleBranch(Node& node, MacroAssembler::RelationalCondition condition, MacroAssembler::DoubleCondition doubleCondition, S_DFGOperation_EJJ operation)

{

// Fused compare & branch.

NodeIndex branchNodeIndex = detectPeepHoleBranch();

if (branchNodeIndex != NoNode) {

// detectPeepHoleBranch currently only permits the branch to be the very next node,

// so can be no intervening nodes to also reference the compare.

ASSERT(node.adjustedRefCount() == 1);

if (Node::shouldSpeculateInteger(at(node.child1()), at(node.child2()))) {

compilePeepHoleIntegerBranch(node, branchNodeIndex, condition);

use(node.child1());

use(node.child2());

} else if (Node::shouldSpeculateNumber(at(node.child1()), at(node.child2()))) {

compilePeepHoleDoubleBranch(node, branchNodeIndex, doubleCondition);

use(node.child1());

use(node.child2());

} else if (node.op == CompareEq && Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {

compilePeepHoleObjectEquality(node, branchNodeIndex, &JSFinalObject::s_info, isFinalObjectPrediction);

use(node.child1());

use(node.child2());

} else if (node.op == CompareEq && Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {

compilePeepHoleObjectEquality(node, branchNodeIndex, &JSArray::s_info, isArrayPrediction);

use(node.child1());

use(node.child2());

} else

nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);

m_compileIndex = branchNodeIndex;

return true;

}

return false;

}

void SpeculativeJIT::compileMovHint(Node& node)

{

ASSERT(node.op == SetLocal);

setNodeIndexForOperand(node.child1().index(), node.local());

m_lastSetOperand = node.local();

}

void SpeculativeJIT::compile(BasicBlock& block)

{

ASSERT(m_compileOkay);

ASSERT(m_compileIndex == block.begin);

if (!block.isReachable) {

m_compileIndex = block.end;

return;

}

m_blockHeads[m_block] = m_jit.label();

#if DFG_ENABLE(JIT_BREAK_ON_EVERY_BLOCK)

m_jit.breakpoint();

#endif

ASSERT(m_arguments.size() == block.variablesAtHead.numberOfArguments());

for (size_t i = 0; i < m_arguments.size(); ++i) {

NodeIndex nodeIndex = block.variablesAtHead.argument(i);

if (nodeIndex == NoNode)

m_arguments[i] = ValueSource(ValueInRegisterFile);

else

m_arguments[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());

}

m_state.reset();

m_state.beginBasicBlock(&block);

ASSERT(m_variables.size() == block.variablesAtHead.numberOfLocals());

for (size_t i = 0; i < m_variables.size(); ++i) {

NodeIndex nodeIndex = block.variablesAtHead.local(i);

if (nodeIndex == NoNode)

m_variables[i] = ValueSource(ValueInRegisterFile);

else if (at(nodeIndex).variableAccessData()->shouldUseDoubleFormat())

m_variables[i] = ValueSource(DoubleInRegisterFile);

else

m_variables[i] = ValueSource::forPrediction(at(nodeIndex).variableAccessData()->prediction());

}

m_lastSetOperand = std::numeric_limits<int>::max();

m_codeOriginForOSR = CodeOrigin();

if (DFG_ENABLE_EDGE_CODE_VERIFICATION) {

JITCompiler::Jump verificationSucceeded =

m_jit.branch32(JITCompiler::Equal, GPRInfo::regT0, Imm32(m_block));

m_jit.breakpoint();

verificationSucceeded.link(&m_jit);

}

for (; m_compileIndex < block.end; ++m_compileIndex) {

Node& node = at(m_compileIndex);

m_codeOriginForOSR = node.codeOrigin;

if (!node.shouldGenerate()) {

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("SpeculativeJIT skipping Node @%d (bc#%u) at JIT offset 0x%x ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());

#endif

switch (node.op) {

case SetLocal:

compileMovHint(node);

break;

case InlineStart: {

InlineCallFrame* inlineCallFrame = node.codeOrigin.inlineCallFrame;

int argumentCountIncludingThis = inlineCallFrame->arguments.size();

for (int i = 0; i < argumentCountIncludingThis; ++i) {

ValueRecovery recovery = computeValueRecoveryFor(m_variables[inlineCallFrame->stackOffset + CallFrame::argumentOffsetIncludingThis(i)]);

// The recovery cannot point to registers, since the call frame reification isn't

// as smart as OSR, so it can't handle that. The exception is the this argument,

// which we don't really need to be able to recover.

ASSERT(!i || !recovery.isInRegisters());

inlineCallFrame->arguments[i] = recovery;

}

break;

}

default:

break;

}

} else {

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());

#endif

#if DFG_ENABLE(JIT_BREAK_ON_EVERY_NODE)

m_jit.breakpoint();

#endif

#if DFG_ENABLE(XOR_DEBUG_AID)