/*

* Copyright (C) 2011 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGByteCodeParser.h"

#if ENABLE(DFG_JIT)

#include "CallLinkStatus.h"

#include "CodeBlock.h"

#include "DFGByteCodeCache.h"

#include "DFGCapabilities.h"

#include "GetByIdStatus.h"

#include "MethodCallLinkStatus.h"

#include "PutByIdStatus.h"

#include <wtf/HashMap.h>

#include <wtf/MathExtras.h>

namespace JSC { namespace DFG {

// === ByteCodeParser ===

//

// This class is used to compile the dataflow graph from a CodeBlock.

class ByteCodeParser {

public:

ByteCodeParser(JSGlobalData* globalData, CodeBlock* codeBlock, CodeBlock* profiledBlock, Graph& graph)

: m_globalData(globalData)

, m_codeBlock(codeBlock)

, m_profiledBlock(profiledBlock)

, m_graph(graph)

, m_currentBlock(0)

, m_currentIndex(0)

, m_currentProfilingIndex(0)

, m_constantUndefined(UINT_MAX)

, m_constantNull(UINT_MAX)

, m_constantNaN(UINT_MAX)

, m_constant1(UINT_MAX)

, m_constants(codeBlock->numberOfConstantRegisters())

, m_numArguments(codeBlock->numParameters())

, m_numLocals(codeBlock->m_numCalleeRegisters)

, m_preservedVars(codeBlock->m_numVars)

, m_parameterSlots(0)

, m_numPassedVarArgs(0)

, m_globalResolveNumber(0)

, m_inlineStackTop(0)

, m_haveBuiltOperandMaps(false)

{

ASSERT(m_profiledBlock);

for (int i = 0; i < codeBlock->m_numVars; ++i)

m_preservedVars.set(i);

}

// Parse a full CodeBlock of bytecode.

bool parse();

private:

// Just parse from m_currentIndex to the end of the current CodeBlock.

void parseCodeBlock();

// Helper for min and max.

bool handleMinMax(bool usesResult, int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis);

// Handle calls. This resolves issues surrounding inlining and intrinsics.

void handleCall(Interpreter*, Instruction* currentInstruction, NodeType op, CodeSpecializationKind);

void emitFunctionCheck(JSFunction* expectedFunction, NodeIndex callTarget, int registerOffset, CodeSpecializationKind);

// Handle inlining. Return true if it succeeded, false if we need to plant a call.

bool handleInlining(bool usesResult, int callTarget, NodeIndex callTargetNodeIndex, int resultOperand, bool certainAboutExpectedFunction, JSFunction*, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, CodeSpecializationKind);

// Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.

bool handleIntrinsic(bool usesResult, int resultOperand, Intrinsic, int registerOffset, int argumentCountIncludingThis, PredictedType prediction);

// Prepare to parse a block.

void prepareToParseBlock();

// Parse a single basic block of bytecode instructions.

bool parseBlock(unsigned limit);

// Find reachable code and setup predecessor links in the graph's BasicBlocks.

void determineReachability();

// Enqueue a block onto the worklist, if necessary.

void handleSuccessor(Vector<BlockIndex, 16>& worklist, BlockIndex, BlockIndex successor);

// Link block successors.

void linkBlock(BasicBlock*, Vector<BlockIndex>& possibleTargets);

void linkBlocks(Vector<UnlinkedBlock>& unlinkedBlocks, Vector<BlockIndex>& possibleTargets);

// Link GetLocal & SetLocal nodes, to ensure live values are generated.

enum PhiStackType {

LocalPhiStack,

ArgumentPhiStack

};

template<PhiStackType stackType>

void processPhiStack();

// Add spill locations to nodes.

void allocateVirtualRegisters();

VariableAccessData* newVariableAccessData(int operand)

{

ASSERT(operand < FirstConstantRegisterIndex);

m_graph.m_variableAccessData.append(VariableAccessData(static_cast<VirtualRegister>(operand)));

return &m_graph.m_variableAccessData.last();

}

// Get/Set the operands/result of a bytecode instruction.

NodeIndex getDirect(int operand)

{

// Is this a constant?

if (operand >= FirstConstantRegisterIndex) {

unsigned constant = operand - FirstConstantRegisterIndex;

ASSERT(constant < m_constants.size());

return getJSConstant(constant);

}

// Is this an argument?

if (operandIsArgument(operand))

return getArgument(operand);

// Must be a local.

return getLocal((unsigned)operand);

}

NodeIndex get(int operand)

{

return getDirect(m_inlineStackTop->remapOperand(operand));

}

void setDirect(int operand, NodeIndex value)

{

// Is this an argument?

if (operandIsArgument(operand)) {

setArgument(operand, value);

return;

}

// Must be a local.

setLocal((unsigned)operand, value);

}

void set(int operand, NodeIndex value)

{

setDirect(m_inlineStackTop->remapOperand(operand), value);

}

// Used in implementing get/set, above, where the operand is a local variable.

NodeIndex getLocal(unsigned operand)

{

NodeIndex nodeIndex = m_currentBlock->variablesAtTail.local(operand);

if (nodeIndex != NoNode) {

Node* nodePtr = &m_graph[nodeIndex];

if (nodePtr->op == Flush) {

// Two possibilities: either the block wants the local to be live

// but has not loaded its value, or it has loaded its value, in

// which case we're done.

Node& flushChild = m_graph[nodePtr->child1()];

if (flushChild.op == Phi) {

VariableAccessData* variableAccessData = flushChild.variableAccessData();

nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index());

m_currentBlock->variablesAtTail.local(operand) = nodeIndex;

return nodeIndex;

}

nodePtr = &flushChild;

}

if (nodePtr->op == GetLocal)

return nodeIndex;

ASSERT(nodePtr->op == SetLocal);

return nodePtr->child1().index();

}

// Check for reads of temporaries from prior blocks,

// expand m_preservedVars to cover these.

m_preservedVars.set(operand);

VariableAccessData* variableAccessData = newVariableAccessData(operand);

NodeIndex phi = addToGraph(Phi, OpInfo(variableAccessData));

m_localPhiStack.append(PhiStackEntry(m_currentBlock, phi, operand));

nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), phi);

m_currentBlock->variablesAtTail.local(operand) = nodeIndex;

m_currentBlock->variablesAtHead.setLocalFirstTime(operand, nodeIndex);

return nodeIndex;

}

void setLocal(unsigned operand, NodeIndex value)

{

m_currentBlock->variablesAtTail.local(operand) = addToGraph(SetLocal, OpInfo(newVariableAccessData(operand)), value);

}

// Used in implementing get/set, above, where the operand is an argument.

NodeIndex getArgument(unsigned operand)

{

unsigned argument = operandToArgument(operand);

ASSERT(argument < m_numArguments);

NodeIndex nodeIndex = m_currentBlock->variablesAtTail.argument(argument);

if (nodeIndex != NoNode) {

Node* nodePtr = &m_graph[nodeIndex];

if (nodePtr->op == Flush) {

// Two possibilities: either the block wants the local to be live

// but has not loaded its value, or it has loaded its value, in

// which case we're done.

Node& flushChild = m_graph[nodePtr->child1()];

if (flushChild.op == Phi) {

VariableAccessData* variableAccessData = flushChild.variableAccessData();

nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), nodePtr->child1().index());

m_currentBlock->variablesAtTail.local(operand) = nodeIndex;

return nodeIndex;

}

nodePtr = &flushChild;

}

if (nodePtr->op == SetArgument) {

// We're getting an argument in the first basic block; link

// the GetLocal to the SetArgument.

ASSERT(nodePtr->local() == static_cast<VirtualRegister>(operand));

nodeIndex = addToGraph(GetLocal, OpInfo(nodePtr->variableAccessData()), nodeIndex);

m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;

return nodeIndex;

}

if (nodePtr->op == GetLocal)

return nodeIndex;

ASSERT(nodePtr->op == SetLocal);

return nodePtr->child1().index();

}

VariableAccessData* variableAccessData = newVariableAccessData(operand);

NodeIndex phi = addToGraph(Phi, OpInfo(variableAccessData));

m_argumentPhiStack.append(PhiStackEntry(m_currentBlock, phi, argument));

nodeIndex = addToGraph(GetLocal, OpInfo(variableAccessData), phi);

m_currentBlock->variablesAtTail.argument(argument) = nodeIndex;

m_currentBlock->variablesAtHead.setArgumentFirstTime(argument, nodeIndex);

return nodeIndex;

}

void setArgument(int operand, NodeIndex value)

{

unsigned argument = operandToArgument(operand);

ASSERT(argument < m_numArguments);

m_currentBlock->variablesAtTail.argument(argument) = addToGraph(SetLocal, OpInfo(newVariableAccessData(operand)), value);

}

void flush(int operand)

{

// FIXME: This should check if the same operand had already been flushed to

// some other local variable.

operand = m_inlineStackTop->remapOperand(operand);

ASSERT(operand < FirstConstantRegisterIndex);

NodeIndex nodeIndex;

int index;

if (operandIsArgument(operand)) {

index = operandToArgument(operand);

nodeIndex = m_currentBlock->variablesAtTail.argument(index);

} else {

index = operand;

nodeIndex = m_currentBlock->variablesAtTail.local(index);

m_preservedVars.set(operand);

}

if (nodeIndex != NoNode) {

Node& node = m_graph[nodeIndex];

if (node.op == Flush || node.op == SetArgument) {

// If a local has already been flushed, or if it's an argument in the

// first basic block, then there is really no need to flush it. In fact

// emitting a Flush instruction could just confuse things, since the

// getArgument() code assumes that we never see a Flush of a SetArgument.

return;

}

addToGraph(Flush, OpInfo(node.variableAccessData()), nodeIndex);

return;

}

VariableAccessData* variableAccessData = newVariableAccessData(operand);

NodeIndex phi = addToGraph(Phi, OpInfo(variableAccessData));

nodeIndex = addToGraph(Flush, OpInfo(variableAccessData), phi);

if (operandIsArgument(operand)) {

m_argumentPhiStack.append(PhiStackEntry(m_currentBlock, phi, index));

m_currentBlock->variablesAtTail.argument(index) = nodeIndex;

m_currentBlock->variablesAtHead.setArgumentFirstTime(index, nodeIndex);

} else {

m_localPhiStack.append(PhiStackEntry(m_currentBlock, phi, index));

m_currentBlock->variablesAtTail.local(index) = nodeIndex;

m_currentBlock->variablesAtHead.setLocalFirstTime(index, nodeIndex);

}

}

// Get an operand, and perform a ToInt32/ToNumber conversion on it.

NodeIndex getToInt32(int operand)

{

return toInt32(get(operand));

}

// Perform an ES5 ToInt32 operation - returns a node of type NodeResultInt32.

NodeIndex toInt32(NodeIndex index)

{

Node& node = m_graph[index];

if (node.hasInt32Result())

return index;

if (node.op == UInt32ToNumber)

return node.child1().index();

// Check for numeric constants boxed as JSValues.

if (node.op == JSConstant) {

JSValue v = valueOfJSConstant(index);

if (v.isInt32())

return getJSConstant(node.constantNumber());

if (v.isNumber())

return getJSConstantForValue(JSValue(JSC::toInt32(v.asNumber())));

}

return addToGraph(ValueToInt32, index);

}

NodeIndex getJSConstantForValue(JSValue constantValue)

{

unsigned constantIndex = m_codeBlock->addOrFindConstant(constantValue);

if (constantIndex >= m_constants.size())

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

return getJSConstant(constantIndex);

}

NodeIndex getJSConstant(unsigned constant)

{

NodeIndex index = m_constants[constant].asJSValue;

if (index != NoNode)

return index;

NodeIndex resultIndex = addToGraph(JSConstant, OpInfo(constant));

m_constants[constant].asJSValue = resultIndex;

return resultIndex;

}

// Helper functions to get/set the this value.

NodeIndex getThis()

{

return get(m_inlineStackTop->m_codeBlock->thisRegister());

}

void setThis(NodeIndex value)

{

set(m_inlineStackTop->m_codeBlock->thisRegister(), value);

}

// Convenience methods for checking nodes for constants.

bool isJSConstant(NodeIndex index)

{

return m_graph[index].op == JSConstant;

}

bool isInt32Constant(NodeIndex nodeIndex)

{

return isJSConstant(nodeIndex) && valueOfJSConstant(nodeIndex).isInt32();

}

// Convenience methods for getting constant values.

JSValue valueOfJSConstant(NodeIndex index)

{

ASSERT(isJSConstant(index));

return m_codeBlock->getConstant(FirstConstantRegisterIndex + m_graph[index].constantNumber());

}

int32_t valueOfInt32Constant(NodeIndex nodeIndex)

{

ASSERT(isInt32Constant(nodeIndex));

return valueOfJSConstant(nodeIndex).asInt32();

}

// This method returns a JSConstant with the value 'undefined'.

NodeIndex constantUndefined()

{

// Has m_constantUndefined been set up yet?

if (m_constantUndefined == UINT_MAX) {

// Search the constant pool for undefined, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantUndefined = 0; m_constantUndefined < numberOfConstants; ++m_constantUndefined) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined);

if (testMe.isUndefined())

return getJSConstant(m_constantUndefined);

}

// Add undefined to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

m_codeBlock->addConstant(jsUndefined());

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantUndefined must refer to an entry in the CodeBlock's constant pool that has the value 'undefined'.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantUndefined).isUndefined());

return getJSConstant(m_constantUndefined);

}

// This method returns a JSConstant with the value 'null'.

NodeIndex constantNull()

{

// Has m_constantNull been set up yet?

if (m_constantNull == UINT_MAX) {

// Search the constant pool for null, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantNull = 0; m_constantNull < numberOfConstants; ++m_constantNull) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull);

if (testMe.isNull())

return getJSConstant(m_constantNull);

}

// Add null to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

m_codeBlock->addConstant(jsNull());

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantNull must refer to an entry in the CodeBlock's constant pool that has the value 'null'.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNull).isNull());

return getJSConstant(m_constantNull);

}

// This method returns a DoubleConstant with the value 1.

NodeIndex one()

{

// Has m_constant1 been set up yet?

if (m_constant1 == UINT_MAX) {

// Search the constant pool for the value 1, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constant1 = 0; m_constant1 < numberOfConstants; ++m_constant1) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1);

if (testMe.isInt32() && testMe.asInt32() == 1)

return getJSConstant(m_constant1);

}

// Add the value 1 to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

m_codeBlock->addConstant(jsNumber(1));

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constant1 must refer to an entry in the CodeBlock's constant pool that has the integer value 1.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).isInt32());

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constant1).asInt32() == 1);

return getJSConstant(m_constant1);

}

// This method returns a DoubleConstant with the value NaN.

NodeIndex constantNaN()

{

JSValue nan = jsNaN();

// Has m_constantNaN been set up yet?

if (m_constantNaN == UINT_MAX) {

// Search the constant pool for the value NaN, if we find it, we can just reuse this!

unsigned numberOfConstants = m_codeBlock->numberOfConstantRegisters();

for (m_constantNaN = 0; m_constantNaN < numberOfConstants; ++m_constantNaN) {

JSValue testMe = m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN);

if (JSValue::encode(testMe) == JSValue::encode(nan))

return getJSConstant(m_constantNaN);

}

// Add the value nan to the CodeBlock's constants, and add a corresponding slot in m_constants.

ASSERT(m_constants.size() == numberOfConstants);

m_codeBlock->addConstant(nan);

m_constants.append(ConstantRecord());

ASSERT(m_constants.size() == m_codeBlock->numberOfConstantRegisters());

}

// m_constantNaN must refer to an entry in the CodeBlock's constant pool that has the value nan.

ASSERT(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN).isDouble());

ASSERT(isnan(m_codeBlock->getConstant(FirstConstantRegisterIndex + m_constantNaN).asDouble()));

return getJSConstant(m_constantNaN);

}

NodeIndex cellConstant(JSCell* cell)

{

pair<HashMap<JSCell*, NodeIndex>::iterator, bool> iter = m_cellConstantNodes.add(cell, NoNode);

if (iter.second)

iter.first->second = addToGraph(WeakJSConstant, OpInfo(cell));

return iter.first->second;

}

CodeOrigin currentCodeOrigin()

{

return CodeOrigin(m_currentIndex, m_inlineStackTop->m_inlineCallFrame, m_currentProfilingIndex - m_currentIndex);

}

// These methods create a node and add it to the graph. If nodes of this type are

// 'mustGenerate' then the node will implicitly be ref'ed to ensure generation.

NodeIndex addToGraph(NodeType op, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)

{

NodeIndex resultIndex = (NodeIndex)m_graph.size();

m_graph.append(Node(op, currentCodeOrigin(), child1, child2, child3));

if (op & NodeMustGenerate)

m_graph.ref(resultIndex);

return resultIndex;

}

NodeIndex addToGraph(NodeType op, OpInfo info, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)

{

NodeIndex resultIndex = (NodeIndex)m_graph.size();

m_graph.append(Node(op, currentCodeOrigin(), info, child1, child2, child3));

if (op & NodeMustGenerate)

m_graph.ref(resultIndex);

return resultIndex;

}

NodeIndex addToGraph(NodeType op, OpInfo info1, OpInfo info2, NodeIndex child1 = NoNode, NodeIndex child2 = NoNode, NodeIndex child3 = NoNode)

{

NodeIndex resultIndex = (NodeIndex)m_graph.size();

m_graph.append(Node(op, currentCodeOrigin(), info1, info2, child1, child2, child3));

if (op & NodeMustGenerate)

m_graph.ref(resultIndex);

return resultIndex;

}

NodeIndex addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2)

{

NodeIndex resultIndex = (NodeIndex)m_graph.size();

m_graph.append(Node(Node::VarArg, op, currentCodeOrigin(), info1, info2, m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs));

m_numPassedVarArgs = 0;

if (op & NodeMustGenerate)

m_graph.ref(resultIndex);

return resultIndex;

}

void addVarArgChild(NodeIndex child)

{

m_graph.m_varArgChildren.append(NodeUse(child));

m_numPassedVarArgs++;

}

NodeIndex addCall(Interpreter* interpreter, Instruction* currentInstruction, NodeType op)

{

Instruction* putInstruction = currentInstruction + OPCODE_LENGTH(op_call);

PredictedType prediction = PredictNone;

if (interpreter->getOpcodeID(putInstruction->u.opcode) == op_call_put_result) {

m_currentProfilingIndex = m_currentIndex + OPCODE_LENGTH(op_call);

prediction = getPrediction();

}

addVarArgChild(get(currentInstruction[1].u.operand));

int argCount = currentInstruction[2].u.operand;

if (RegisterFile::CallFrameHeaderSize + (unsigned)argCount > m_parameterSlots)

m_parameterSlots = RegisterFile::CallFrameHeaderSize + argCount;

int registerOffset = currentInstruction[3].u.operand;

int dummyThisArgument = op == Call ? 0 : 1;

for (int i = 0 + dummyThisArgument; i < argCount; ++i)

addVarArgChild(get(registerOffset + argumentToOperand(i)));

NodeIndex call = addToGraph(Node::VarArg, op, OpInfo(0), OpInfo(prediction));

if (interpreter->getOpcodeID(putInstruction->u.opcode) == op_call_put_result)

set(putInstruction[1].u.operand, call);

return call;

}

PredictedType getPredictionWithoutOSRExit(NodeIndex nodeIndex, unsigned bytecodeIndex)

{

UNUSED_PARAM(nodeIndex);

ValueProfile* profile = m_inlineStackTop->m_profiledBlock->valueProfileForBytecodeOffset(bytecodeIndex);

ASSERT(profile);

PredictedType prediction = profile->computeUpdatedPrediction();

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Dynamic [@%u, bc#%u] prediction: %s\n", nodeIndex, bytecodeIndex, predictionToString(prediction));

#endif

return prediction;

}

PredictedType getPrediction(NodeIndex nodeIndex, unsigned bytecodeIndex)

{

PredictedType prediction = getPredictionWithoutOSRExit(nodeIndex, bytecodeIndex);

if (prediction == PredictNone) {

// We have no information about what values this node generates. Give up

// on executing this code, since we're likely to do more damage than good.

addToGraph(ForceOSRExit);

}

return prediction;

}

PredictedType getPredictionWithoutOSRExit()

{

return getPredictionWithoutOSRExit(m_graph.size(), m_currentProfilingIndex);

}

PredictedType getPrediction()

{

return getPrediction(m_graph.size(), m_currentProfilingIndex);

}

NodeIndex makeSafe(NodeIndex nodeIndex)

{

if (!m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))

return nodeIndex;

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Making %s @%u safe at bc#%u because slow-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));

#endif

switch (m_graph[nodeIndex].op) {

case UInt32ToNumber:

case ArithAdd:

case ArithSub:

case ValueAdd:

case ArithMod: // for ArithMode "MayOverflow" means we tried to divide by zero, or we saw double.

m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow);

break;

case ArithMul:

if (m_inlineStackTop->m_profiledBlock->likelyToTakeDeepestSlowCase(m_currentIndex)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)) {

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Making ArithMul @%u take deepest slow case.\n", nodeIndex);

#endif

m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow | NodeMayNegZero);

} else if (m_inlineStackTop->m_profiledBlock->likelyToTakeSlowCase(m_currentIndex)

|| m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero)) {

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Making ArithMul @%u take faster slow case.\n", nodeIndex);

#endif

m_graph[nodeIndex].mergeArithNodeFlags(NodeMayNegZero);

}

break;

default:

ASSERT_NOT_REACHED();

break;

}

return nodeIndex;

}

NodeIndex makeDivSafe(NodeIndex nodeIndex)

{

ASSERT(m_graph[nodeIndex].op == ArithDiv);

// The main slow case counter for op_div in the old JIT counts only when

// the operands are not numbers. We don't care about that since we already

// have speculations in place that take care of that separately. We only

// care about when the outcome of the division is not an integer, which

// is what the special fast case counter tells us.

if (!m_inlineStackTop->m_profiledBlock->likelyToTakeSpecialFastCase(m_currentIndex)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))

return nodeIndex;

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Making %s @%u safe at bc#%u because special fast-case counter is at %u and exit profiles say %d, %d\n", Graph::opName(m_graph[nodeIndex].op), nodeIndex, m_currentIndex, m_inlineStackTop->m_profiledBlock->specialFastCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero));

#endif

// FIXME: It might be possible to make this more granular. The DFG certainly can

// distinguish between negative zero and overflow in its exit profiles.

m_graph[nodeIndex].mergeArithNodeFlags(NodeMayOverflow | NodeMayNegZero);

return nodeIndex;

}

bool willNeedFlush(StructureStubInfo& stubInfo)

{

PolymorphicAccessStructureList* list;

int listSize;

switch (stubInfo.accessType) {

case access_get_by_id_self_list:

list = stubInfo.u.getByIdSelfList.structureList;

listSize = stubInfo.u.getByIdSelfList.listSize;

break;

case access_get_by_id_proto_list:

list = stubInfo.u.getByIdProtoList.structureList;

listSize = stubInfo.u.getByIdProtoList.listSize;

break;

default:

return false;

}

for (int i = 0; i < listSize; ++i) {

if (!list->list[i].isDirect)

return true;

}

return false;

}

bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)

{

if (direct)

return true;

if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())

return false;

for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {

if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())

return false;

}

return true;

}

void buildOperandMapsIfNecessary();

JSGlobalData* m_globalData;

CodeBlock* m_codeBlock;

CodeBlock* m_profiledBlock;

Graph& m_graph;

// The current block being generated.

BasicBlock* m_currentBlock;

// The bytecode index of the current instruction being generated.

unsigned m_currentIndex;

// The bytecode index of the value profile of the current instruction being generated.

unsigned m_currentProfilingIndex;

// We use these values during code generation, and to avoid the need for

// special handling we make sure they are available as constants in the

// CodeBlock's constant pool. These variables are initialized to

// UINT_MAX, and lazily updated to hold an index into the CodeBlock's

// constant pool, as necessary.

unsigned m_constantUndefined;

unsigned m_constantNull;

unsigned m_constantNaN;

unsigned m_constant1;

HashMap<JSCell*, unsigned> m_cellConstants;

HashMap<JSCell*, NodeIndex> m_cellConstantNodes;

// A constant in the constant pool may be represented by more than one

// node in the graph, depending on the context in which it is being used.

struct ConstantRecord {

ConstantRecord()

: asInt32(NoNode)

, asNumeric(NoNode)

, asJSValue(NoNode)

{

}

NodeIndex asInt32;

NodeIndex asNumeric;

NodeIndex asJSValue;

};

// Track the index of the node whose result is the current value for every

// register value in the bytecode - argument, local, and temporary.

Vector<ConstantRecord, 16> m_constants;

// The number of arguments passed to the function.

unsigned m_numArguments;

// The number of locals (vars + temporaries) used in the function.

unsigned m_numLocals;

// The set of registers we need to preserve across BasicBlock boundaries;

// typically equal to the set of vars, but we expand this to cover all

// temporaries that persist across blocks (dues to ?:, &&, ||, etc).

BitVector m_preservedVars;

// The number of slots (in units of sizeof(Register)) that we need to

// preallocate for calls emanating from this frame. This includes the

// size of the CallFrame, only if this is not a leaf function. (I.e.

// this is 0 if and only if this function is a leaf.)

unsigned m_parameterSlots;

// The number of var args passed to the next var arg node.

unsigned m_numPassedVarArgs;

// The index in the global resolve info.

unsigned m_globalResolveNumber;

struct PhiStackEntry {

PhiStackEntry(BasicBlock* block, NodeIndex phi, unsigned varNo)

: m_block(block)

, m_phi(phi)

, m_varNo(varNo)

{

}

BasicBlock* m_block;

NodeIndex m_phi;

unsigned m_varNo;

};

Vector<PhiStackEntry, 16> m_argumentPhiStack;

Vector<PhiStackEntry, 16> m_localPhiStack;

struct InlineStackEntry {

ByteCodeParser* m_byteCodeParser;

CodeBlock* m_codeBlock;

CodeBlock* m_profiledBlock;

InlineCallFrame* m_inlineCallFrame;

VirtualRegister m_calleeVR; // absolute virtual register, not relative to call frame

ScriptExecutable* executable() { return m_codeBlock->ownerExecutable(); }

QueryableExitProfile m_exitProfile;

// Remapping of identifier and constant numbers from the code block being

// inlined (inline callee) to the code block that we're inlining into

// (the machine code block, which is the transitive, though not necessarily

// direct, caller).

Vector<unsigned> m_identifierRemap;

Vector<unsigned> m_constantRemap;

// Blocks introduced by this code block, which need successor linking.

// May include up to one basic block that includes the continuation after

// the callsite in the caller. These must be appended in the order that they

// are created, but their bytecodeBegin values need not be in order as they

// are ignored.

Vector<UnlinkedBlock> m_unlinkedBlocks;

// Potential block linking targets. Must be sorted by bytecodeBegin, and

// cannot have two blocks that have the same bytecodeBegin. For this very

// reason, this is not equivalent to

Vector<BlockIndex> m_blockLinkingTargets;

// If the callsite's basic block was split into two, then this will be

// the head of the callsite block. It needs its successors linked to the

// m_unlinkedBlocks, but not the other way around: there's no way for

// any blocks in m_unlinkedBlocks to jump back into this block.

BlockIndex m_callsiteBlockHead;

// Does the callsite block head need linking? This is typically true

// but will be false for the machine code block's inline stack entry

// (since that one is not inlined) and for cases where an inline callee

// did the linking for us.

bool m_callsiteBlockHeadNeedsLinking;

VirtualRegister m_returnValue;

// Did we see any returns? We need to handle the (uncommon but necessary)

// case where a procedure that does not return was inlined.

bool m_didReturn;

// Did we have any early returns?

bool m_didEarlyReturn;

InlineStackEntry* m_caller;

InlineStackEntry(ByteCodeParser*, CodeBlock*, CodeBlock* profiledBlock, BlockIndex callsiteBlockHead, VirtualRegister calleeVR, JSFunction* callee, VirtualRegister returnValueVR, VirtualRegister inlineCallFrameStart, CodeSpecializationKind);

~InlineStackEntry()

{

m_byteCodeParser->m_inlineStackTop = m_caller;

}

int remapOperand(int operand) const

{

if (!m_inlineCallFrame)

return operand;

if (operand >= FirstConstantRegisterIndex) {

int result = m_constantRemap[operand - FirstConstantRegisterIndex];

ASSERT(result >= FirstConstantRegisterIndex);

return result;

}

return operand + m_inlineCallFrame->stackOffset;

}

};

InlineStackEntry* m_inlineStackTop;

// Have we built operand maps? We initialize them lazily, and only when doing

// inlining.

bool m_haveBuiltOperandMaps;

// Mapping between identifier names and numbers.

IdentifierMap m_identifierMap;

// Mapping between values and constant numbers.

JSValueMap m_jsValueMap;

// Cache of code blocks that we've generated bytecode for.

ByteCodeCache<canInlineFunctionFor> m_codeBlockCache;

};

#define NEXT_OPCODE(name) \

m_currentIndex += OPCODE_LENGTH(name); \

continue

#define LAST_OPCODE(name) \

m_currentIndex += OPCODE_LENGTH(name); \

return shouldContinueParsing

void ByteCodeParser::handleCall(Interpreter* interpreter, Instruction* currentInstruction, NodeType op, CodeSpecializationKind kind)

{

ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_construct));

NodeIndex callTarget = get(currentInstruction[1].u.operand);

enum { ConstantFunction, LinkedFunction, UnknownFunction } callType;

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("Slow case count for call at @%zu bc#%u: %u/%u; exit profile: %d.\n", m_graph.size(), m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter, m_inlineStackTop->m_profiledBlock->executionEntryCount(), m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache));

#endif

CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(

m_inlineStackTop->m_profiledBlock, m_currentIndex);

if (m_graph.isFunctionConstant(m_codeBlock, callTarget))

callType = ConstantFunction;

else if (callLinkStatus.isSet() && !callLinkStatus.couldTakeSlowPath()

&& !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache))

callType = LinkedFunction;

else

callType = UnknownFunction;

if (callType != UnknownFunction) {

int argumentCountIncludingThis = currentInstruction[2].u.operand;

int registerOffset = currentInstruction[3].u.operand;

// Do we have a result?

bool usesResult = false;

int resultOperand = 0; // make compiler happy

unsigned nextOffset = m_currentIndex + OPCODE_LENGTH(op_call);

Instruction* putInstruction = currentInstruction + OPCODE_LENGTH(op_call);

PredictedType prediction = PredictNone;

if (interpreter->getOpcodeID(putInstruction->u.opcode) == op_call_put_result) {

resultOperand = putInstruction[1].u.operand;

usesResult = true;

m_currentProfilingIndex = nextOffset;

prediction = getPrediction();

nextOffset += OPCODE_LENGTH(op_call_put_result);

}

JSFunction* expectedFunction;

Intrinsic intrinsic;

bool certainAboutExpectedFunction;

if (callType == ConstantFunction) {

expectedFunction = m_graph.valueOfFunctionConstant(m_codeBlock, callTarget);

intrinsic = expectedFunction->executable()->intrinsicFor(kind);

certainAboutExpectedFunction = true;

} else {

ASSERT(callType == LinkedFunction);

expectedFunction = callLinkStatus.callTarget();

intrinsic = expectedFunction->executable()->intrinsicFor(kind);

certainAboutExpectedFunction = false;

}

if (intrinsic != NoIntrinsic) {

if (!certainAboutExpectedFunction)

emitFunctionCheck(expectedFunction, callTarget, registerOffset, kind);

if (handleIntrinsic(usesResult, resultOperand, intrinsic, registerOffset, argumentCountIncludingThis, prediction)) {

if (!certainAboutExpectedFunction) {

// Need to keep the call target alive for OSR. We could easily optimize this out if we wanted

// to, since at this point we know that the call target is a constant. It's just that OSR isn't

// smart enough to figure that out, since it doesn't understand CheckFunction.

addToGraph(Phantom, callTarget);

}

return;

}

} else if (handleInlining(usesResult, currentInstruction[1].u.operand, callTarget, resultOperand, certainAboutExpectedFunction, expectedFunction, registerOffset, argumentCountIncludingThis, nextOffset, kind))

return;

}

addCall(interpreter, currentInstruction, op);

}

void ByteCodeParser::emitFunctionCheck(JSFunction* expectedFunction, NodeIndex callTarget, int registerOffset, CodeSpecializationKind kind)

{

NodeIndex thisArgument;

if (kind == CodeForCall)

thisArgument = get(registerOffset + argumentToOperand(0));

else

thisArgument = NoNode;

addToGraph(CheckFunction, OpInfo(expectedFunction), callTarget, thisArgument);

}

bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex callTargetNodeIndex, int resultOperand, bool certainAboutExpectedFunction, JSFunction* expectedFunction, int registerOffset, int argumentCountIncludingThis, unsigned nextOffset, CodeSpecializationKind kind)

{

// First, the really simple checks: do we have an actual JS function?

if (!expectedFunction)

return false;

if (expectedFunction->isHostFunction())

return false;

FunctionExecutable* executable = expectedFunction->jsExecutable();

// Does the number of arguments we're passing match the arity of the target? We could