/*

* Copyright (C) 2011 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGSpeculativeJIT.h"

#include "JSByteArray.h"

#if ENABLE(DFG_JIT)

namespace JSC { namespace DFG {

#if USE(JSVALUE64)

GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat)

{

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (info.registerFormat() == DataFormatNone) {

GPRReg gpr = allocate();

if (node.hasConstant()) {

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

if (isInt32Constant(nodeIndex)) {

m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);

info.fillInteger(gpr);

returnFormat = DataFormatInteger;

return gpr;

}

if (isNumberConstant(nodeIndex)) {

JSValue jsValue = jsNumber(valueOfNumberConstant(nodeIndex));

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

} else {

ASSERT(isJSConstant(nodeIndex));

JSValue jsValue = valueOfJSConstant(nodeIndex);

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

}

} else if (info.spillFormat() == DataFormatInteger) {

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);

// Tag it, since fillInteger() is used when we want a boxed integer.

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr);

} else {

ASSERT(info.spillFormat() == DataFormatJS || info.spillFormat() == DataFormatJSInteger);

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);

}

// Since we statically know that we're filling an integer, and values

// in the RegisterFile are boxed, this must be DataFormatJSInteger.

// We will check this with a jitAssert below.

info.fillJSValue(gpr, DataFormatJSInteger);

unlock(gpr);

}

switch (info.registerFormat()) {

case DataFormatNone:

// Should have filled, above.

case DataFormatJSDouble:

case DataFormatDouble:

case DataFormatJS:

case DataFormatCell:

case DataFormatJSCell:

case DataFormatBoolean:

case DataFormatJSBoolean:

case DataFormatStorage:

// Should only be calling this function if we know this operand to be integer.

ASSERT_NOT_REACHED();

case DataFormatJSInteger: {

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

m_jit.jitAssertIsJSInt32(gpr);

returnFormat = DataFormatJSInteger;

return gpr;

}

case DataFormatInteger: {

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

m_jit.jitAssertIsInt32(gpr);

returnFormat = DataFormatInteger;

return gpr;

}

}

ASSERT_NOT_REACHED();

return InvalidGPRReg;

}

FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)

{

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

if (info.registerFormat() == DataFormatNone) {

if (node.hasConstant()) {

GPRReg gpr = allocate();

if (isInt32Constant(nodeIndex)) {

// FIXME: should not be reachable?

m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

info.fillInteger(gpr);

unlock(gpr);

} else if (isNumberConstant(nodeIndex)) {

FPRReg fpr = fprAllocate();

m_jit.move(MacroAssembler::ImmPtr(reinterpret_cast<void*>(reinterpretDoubleToIntptr(valueOfNumberConstant(nodeIndex)))), gpr);

m_jit.movePtrToDouble(gpr, fpr);

unlock(gpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

return fpr;

} else {

// FIXME: should not be reachable?

ASSERT(isJSConstant(nodeIndex));

JSValue jsValue = valueOfJSConstant(nodeIndex);

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

info.fillJSValue(gpr, DataFormatJS);

unlock(gpr);

}

} else {

DataFormat spillFormat = info.spillFormat();

switch (spillFormat) {

case DataFormatDouble: {

FPRReg fpr = fprAllocate();

m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

return fpr;

}

case DataFormatInteger: {

GPRReg gpr = allocate();

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);

info.fillInteger(gpr);

unlock(gpr);

break;

}

default:

GPRReg gpr = allocate();

ASSERT(spillFormat & DataFormatJS);

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);

info.fillJSValue(gpr, spillFormat);

unlock(gpr);

break;

}

}

}

switch (info.registerFormat()) {

case DataFormatNone:

// Should have filled, above.

case DataFormatCell:

case DataFormatJSCell:

case DataFormatBoolean:

case DataFormatJSBoolean:

case DataFormatStorage:

// Should only be calling this function if we know this operand to be numeric.

ASSERT_NOT_REACHED();

case DataFormatJS: {

GPRReg jsValueGpr = info.gpr();

m_gprs.lock(jsValueGpr);

FPRReg fpr = fprAllocate();

GPRReg tempGpr = allocate(); // FIXME: can we skip this allocation on the last use of the virtual register?

JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueGpr, GPRInfo::tagTypeNumberRegister);

m_jit.jitAssertIsJSDouble(jsValueGpr);

// First, if we get here we have a double encoded as a JSValue

m_jit.move(jsValueGpr, tempGpr);

unboxDouble(tempGpr, fpr);

JITCompiler::Jump hasUnboxedDouble = m_jit.jump();

// Finally, handle integers.

isInteger.link(&m_jit);

m_jit.convertInt32ToDouble(jsValueGpr, fpr);

hasUnboxedDouble.link(&m_jit);

m_gprs.release(jsValueGpr);

m_gprs.unlock(jsValueGpr);

m_gprs.unlock(tempGpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

info.killSpilled();

return fpr;

}

case DataFormatJSInteger:

case DataFormatInteger: {

FPRReg fpr = fprAllocate();

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

m_jit.convertInt32ToDouble(gpr, fpr);

m_gprs.unlock(gpr);

return fpr;

}

// Unbox the double

case DataFormatJSDouble: {

GPRReg gpr = info.gpr();

FPRReg fpr = fprAllocate();

if (m_gprs.isLocked(gpr)) {

// Make sure we don't trample gpr if it is in use.

GPRReg temp = allocate();

m_jit.move(gpr, temp);

unboxDouble(temp, fpr);

unlock(temp);

} else

unboxDouble(gpr, fpr);

m_gprs.release(gpr);

m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);

info.fillDouble(fpr);

return fpr;

}

case DataFormatDouble: {

FPRReg fpr = info.fpr();

m_fprs.lock(fpr);

return fpr;

}

}

ASSERT_NOT_REACHED();

return InvalidFPRReg;

}

GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)

{

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

switch (info.registerFormat()) {

case DataFormatNone: {

GPRReg gpr = allocate();

if (node.hasConstant()) {

if (isInt32Constant(nodeIndex)) {

info.fillJSValue(gpr, DataFormatJSInteger);

JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

} else if (isNumberConstant(nodeIndex)) {

info.fillJSValue(gpr, DataFormatJSDouble);

JSValue jsValue(JSValue::EncodeAsDouble, valueOfNumberConstant(nodeIndex));

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

} else {

ASSERT(isJSConstant(nodeIndex));

JSValue jsValue = valueOfJSConstant(nodeIndex);

m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);

info.fillJSValue(gpr, DataFormatJS);

}

m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

} else {

DataFormat spillFormat = info.spillFormat();

m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

if (spillFormat == DataFormatInteger) {

m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr);

spillFormat = DataFormatJSInteger;

} else {

m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);

if (spillFormat == DataFormatDouble) {

// Need to box the double, since we want a JSValue.

m_jit.subPtr(GPRInfo::tagTypeNumberRegister, gpr);

spillFormat = DataFormatJSDouble;

} else

ASSERT(spillFormat & DataFormatJS);

}

info.fillJSValue(gpr, spillFormat);

}

return gpr;

}

case DataFormatInteger: {

GPRReg gpr = info.gpr();

// If the register has already been locked we need to take a copy.

// If not, we'll zero extend in place, so mark on the info that this is now type DataFormatInteger, not DataFormatJSInteger.

if (m_gprs.isLocked(gpr)) {

GPRReg result = allocate();

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr, result);

return result;

}

m_gprs.lock(gpr);

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr);

info.fillJSValue(gpr, DataFormatJSInteger);

return gpr;

}

case DataFormatDouble: {

FPRReg fpr = info.fpr();

GPRReg gpr = boxDouble(fpr);

// Update all info

info.fillJSValue(gpr, DataFormatJSDouble);

m_fprs.release(fpr);

m_gprs.retain(gpr, virtualRegister, SpillOrderJS);

return gpr;

}

case DataFormatCell:

// No retag required on JSVALUE64!

case DataFormatJS:

case DataFormatJSInteger:

case DataFormatJSDouble:

case DataFormatJSCell:

case DataFormatJSBoolean: {

GPRReg gpr = info.gpr();

m_gprs.lock(gpr);

return gpr;

}

case DataFormatBoolean:

case DataFormatStorage:

// this type currently never occurs

ASSERT_NOT_REACHED();

}

ASSERT_NOT_REACHED();

return InvalidGPRReg;

}

void SpeculativeJIT::nonSpeculativeValueToNumber(Node& node)

{

if (isKnownNumeric(node.child1().index())) {

JSValueOperand op1(this, node.child1());

GPRTemporary result(this, op1);

m_jit.move(op1.gpr(), result.gpr());

jsValueResult(result.gpr(), m_compileIndex);

return;

}

JSValueOperand op1(this, node.child1());

GPRTemporary result(this);

ASSERT(!isInt32Constant(node.child1().index()));

ASSERT(!isNumberConstant(node.child1().index()));

GPRReg jsValueGpr = op1.gpr();

GPRReg gpr = result.gpr();

op1.use();

JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueGpr, GPRInfo::tagTypeNumberRegister);

JITCompiler::Jump nonNumeric = m_jit.branchTestPtr(MacroAssembler::Zero, jsValueGpr, GPRInfo::tagTypeNumberRegister);

// First, if we get here we have a double encoded as a JSValue

m_jit.move(jsValueGpr, gpr);

JITCompiler::Jump hasUnboxedDouble = m_jit.jump();

// Next handle cells (& other JS immediates)

nonNumeric.link(&m_jit);

silentSpillAllRegisters(gpr);

callOperation(dfgConvertJSValueToNumber, FPRInfo::returnValueFPR, jsValueGpr);

boxDouble(FPRInfo::returnValueFPR, gpr);

silentFillAllRegisters(gpr);

JITCompiler::Jump hasCalledToNumber = m_jit.jump();

// Finally, handle integers.

isInteger.link(&m_jit);

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, jsValueGpr, gpr);

hasUnboxedDouble.link(&m_jit);

hasCalledToNumber.link(&m_jit);

jsValueResult(result.gpr(), m_compileIndex, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::nonSpeculativeValueToInt32(Node& node)

{

ASSERT(!isInt32Constant(node.child1().index()));

if (isKnownInteger(node.child1().index())) {

IntegerOperand op1(this, node.child1());

GPRTemporary result(this, op1);

m_jit.move(op1.gpr(), result.gpr());

integerResult(result.gpr(), m_compileIndex);

return;

}

GenerationInfo& childInfo = m_generationInfo[at(node.child1()).virtualRegister()];

if (childInfo.isJSDouble()) {

DoubleOperand op1(this, node.child1());

GPRTemporary result(this);

FPRReg fpr = op1.fpr();

GPRReg gpr = result.gpr();

op1.use();

JITCompiler::Jump truncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateSuccessful);

silentSpillAllRegisters(gpr);

callOperation(toInt32, gpr, fpr);

silentFillAllRegisters(gpr);

truncatedToInteger.link(&m_jit);

integerResult(gpr, m_compileIndex, UseChildrenCalledExplicitly);

return;

}

JSValueOperand op1(this, node.child1());

GPRTemporary result(this, op1);

GPRReg jsValueGpr = op1.gpr();

GPRReg resultGPR = result.gpr();

op1.use();

JITCompiler::Jump isInteger = m_jit.branchPtr(MacroAssembler::AboveOrEqual, jsValueGpr, GPRInfo::tagTypeNumberRegister);

// First handle non-integers

silentSpillAllRegisters(resultGPR);

callOperation(dfgConvertJSValueToInt32, resultGPR, jsValueGpr);

silentFillAllRegisters(resultGPR);

JITCompiler::Jump hasCalledToInt32 = m_jit.jump();

// Then handle integers.

isInteger.link(&m_jit);

m_jit.zeroExtend32ToPtr(jsValueGpr, resultGPR);

hasCalledToInt32.link(&m_jit);

integerResult(resultGPR, m_compileIndex, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::nonSpeculativeUInt32ToNumber(Node& node)

{

IntegerOperand op1(this, node.child1());

FPRTemporary boxer(this);

GPRTemporary result(this, op1);

JITCompiler::Jump positive = m_jit.branch32(MacroAssembler::GreaterThanOrEqual, op1.gpr(), TrustedImm32(0));

m_jit.convertInt32ToDouble(op1.gpr(), boxer.fpr());

m_jit.addDouble(JITCompiler::AbsoluteAddress(&AssemblyHelpers::twoToThe32), boxer.fpr());

boxDouble(boxer.fpr(), result.gpr());

JITCompiler::Jump done = m_jit.jump();

positive.link(&m_jit);

m_jit.orPtr(GPRInfo::tagTypeNumberRegister, op1.gpr(), result.gpr());

done.link(&m_jit);

jsValueResult(result.gpr(), m_compileIndex);

}

JITCompiler::Call SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg resultGPR, GPRReg scratchGPR, unsigned identifierNumber, JITCompiler::Jump slowPathTarget, SpillRegistersMode spillMode)

{

JITCompiler::DataLabelPtr structureToCompare;

JITCompiler::Jump structureCheck = m_jit.branchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(baseGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));

m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), resultGPR);

JITCompiler::DataLabelCompact loadWithPatch = m_jit.loadPtrWithCompactAddressOffsetPatch(JITCompiler::Address(resultGPR, 0), resultGPR);

JITCompiler::Jump done = m_jit.jump();

structureCheck.link(&m_jit);

if (slowPathTarget.isSet())

slowPathTarget.link(&m_jit);

JITCompiler::Label slowCase = m_jit.label();

if (spillMode == NeedToSpill)

silentSpillAllRegisters(resultGPR);

JITCompiler::Call functionCall = callOperation(operationGetByIdOptimize, resultGPR, baseGPR, identifier(identifierNumber));

if (spillMode == NeedToSpill)

silentFillAllRegisters(resultGPR);

done.link(&m_jit);

JITCompiler::Label doneLabel = m_jit.label();

m_jit.addPropertyAccess(PropertyAccessRecord(codeOrigin, structureToCompare, functionCall, structureCheck, loadWithPatch, slowCase, doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(resultGPR), safeCast<int8_t>(scratchGPR), spillMode == NeedToSpill ? PropertyAccessRecord::RegistersInUse : PropertyAccessRecord::RegistersFlushed));

if (scratchGPR != resultGPR && scratchGPR != InvalidGPRReg && spillMode == NeedToSpill)

unlock(scratchGPR);

return functionCall;

}

void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg valueGPR, NodeUse valueUse, GPRReg scratchGPR, unsigned identifierNumber, PutKind putKind, JITCompiler::Jump slowPathTarget)

{

JITCompiler::DataLabelPtr structureToCompare;

JITCompiler::Jump structureCheck = m_jit.branchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(baseGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));

writeBarrier(baseGPR, valueGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);

m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);

JITCompiler::DataLabel32 storeWithPatch = m_jit.storePtrWithAddressOffsetPatch(valueGPR, JITCompiler::Address(scratchGPR, 0));

JITCompiler::Jump done = m_jit.jump();

structureCheck.link(&m_jit);

if (slowPathTarget.isSet())

slowPathTarget.link(&m_jit);

JITCompiler::Label slowCase = m_jit.label();

silentSpillAllRegisters(InvalidGPRReg);

V_DFGOperation_EJCI optimizedCall;

if (m_jit.strictModeFor(at(m_compileIndex).codeOrigin)) {

if (putKind == Direct)

optimizedCall = operationPutByIdDirectStrictOptimize;

else

optimizedCall = operationPutByIdStrictOptimize;

} else {

if (putKind == Direct)

optimizedCall = operationPutByIdDirectNonStrictOptimize;

else

optimizedCall = operationPutByIdNonStrictOptimize;

}

JITCompiler::Call functionCall = callOperation(optimizedCall, valueGPR, baseGPR, identifier(identifierNumber));

silentFillAllRegisters(InvalidGPRReg);

done.link(&m_jit);

JITCompiler::Label doneLabel = m_jit.label();

m_jit.addPropertyAccess(PropertyAccessRecord(codeOrigin, structureToCompare, functionCall, structureCheck, JITCompiler::DataLabelCompact(storeWithPatch.label()), slowCase, doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(valueGPR), safeCast<int8_t>(scratchGPR)));

}

void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull(NodeUse operand, bool invert)

{

JSValueOperand arg(this, operand);

GPRReg argGPR = arg.gpr();

GPRTemporary result(this, arg);

GPRReg resultGPR = result.gpr();

JITCompiler::Jump notCell;

if (!isKnownCell(operand.index()))

notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, argGPR, GPRInfo::tagMaskRegister);

m_jit.loadPtr(JITCompiler::Address(argGPR, JSCell::structureOffset()), resultGPR);

m_jit.test8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), resultGPR);

if (!isKnownCell(operand.index())) {

JITCompiler::Jump done = m_jit.jump();

notCell.link(&m_jit);

m_jit.move(argGPR, resultGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(~TagBitUndefined), resultGPR);

m_jit.comparePtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImm32(ValueNull), resultGPR);

done.link(&m_jit);

}

m_jit.or32(TrustedImm32(ValueFalse), resultGPR);

jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);

}

void SpeculativeJIT::nonSpeculativePeepholeBranchNull(NodeUse operand, NodeIndex branchNodeIndex, bool invert)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

if (taken == (m_block + 1)) {

invert = !invert;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg(this, operand);

GPRReg argGPR = arg.gpr();

GPRTemporary result(this, arg);

GPRReg resultGPR = result.gpr();

JITCompiler::Jump notCell;

if (!isKnownCell(operand.index()))

notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, argGPR, GPRInfo::tagMaskRegister);

m_jit.loadPtr(JITCompiler::Address(argGPR, JSCell::structureOffset()), resultGPR);

branchTest8(invert ? JITCompiler::Zero : JITCompiler::NonZero, JITCompiler::Address(resultGPR, Structure::typeInfoFlagsOffset()), JITCompiler::TrustedImm32(MasqueradesAsUndefined), taken);

if (!isKnownCell(operand.index())) {

jump(notTaken, ForceJump);

notCell.link(&m_jit);

m_jit.move(argGPR, resultGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(~TagBitUndefined), resultGPR);

branchPtr(invert ? JITCompiler::NotEqual : JITCompiler::Equal, resultGPR, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull)), taken);

}

jump(notTaken);

}

bool SpeculativeJIT::nonSpeculativeCompareNull(Node& node, NodeUse operand, bool invert)

{

NodeIndex branchNodeIndex = detectPeepHoleBranch();

if (branchNodeIndex != NoNode) {

ASSERT(node.adjustedRefCount() == 1);

nonSpeculativePeepholeBranchNull(operand, branchNodeIndex, invert);

use(node.child1());

use(node.child2());

m_compileIndex = branchNodeIndex;

return true;

}

nonSpeculativeNonPeepholeCompareNull(operand, invert);

return false;

}

void SpeculativeJIT::nonSpeculativePeepholeBranch(Node& node, NodeIndex branchNodeIndex, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

JITCompiler::ResultCondition callResultCondition = JITCompiler::NonZero;

// The branch instruction will branch to the taken block.

// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.

if (taken == (m_block + 1)) {

cond = JITCompiler::invert(cond);

callResultCondition = JITCompiler::Zero;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1GPR = arg1.gpr();

GPRReg arg2GPR = arg2.gpr();

JITCompiler::JumpList slowPath;

if (isKnownNotInteger(node.child1().index()) || isKnownNotInteger(node.child2().index())) {

GPRResult result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

flushRegisters();

callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);

branchTest32(callResultCondition, resultGPR, taken);

} else {

GPRTemporary result(this, arg2);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

if (!isKnownInteger(node.child1().index()))

slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));

if (!isKnownInteger(node.child2().index()))

slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));

branch32(cond, arg1GPR, arg2GPR, taken);

if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {

jump(notTaken, ForceJump);

slowPath.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

branchTest32(callResultCondition, resultGPR, taken);

}

}

jump(notTaken);

}

void SpeculativeJIT::nonSpeculativeNonPeepholeCompare(Node& node, MacroAssembler::RelationalCondition cond, S_DFGOperation_EJJ helperFunction)

{

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1GPR = arg1.gpr();

GPRReg arg2GPR = arg2.gpr();

JITCompiler::JumpList slowPath;

if (isKnownNotInteger(node.child1().index()) || isKnownNotInteger(node.child2().index())) {

GPRResult result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

flushRegisters();

callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);

m_jit.or32(TrustedImm32(ValueFalse), resultGPR);

jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean, UseChildrenCalledExplicitly);

} else {

GPRTemporary result(this, arg2);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

if (!isKnownInteger(node.child1().index()))

slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg1GPR, GPRInfo::tagTypeNumberRegister));

if (!isKnownInteger(node.child2().index()))

slowPath.append(m_jit.branchPtr(MacroAssembler::Below, arg2GPR, GPRInfo::tagTypeNumberRegister));

m_jit.compare32(cond, arg1GPR, arg2GPR, resultGPR);

if (!isKnownInteger(node.child1().index()) || !isKnownInteger(node.child2().index())) {

JITCompiler::Jump haveResult = m_jit.jump();

slowPath.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(helperFunction, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

m_jit.andPtr(TrustedImm32(1), resultGPR);

haveResult.link(&m_jit);

}

m_jit.or32(TrustedImm32(ValueFalse), resultGPR);

jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean, UseChildrenCalledExplicitly);

}

}

void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node& node, NodeIndex branchNodeIndex, bool invert)

{

Node& branchNode = at(branchNodeIndex);

BlockIndex taken = branchNode.takenBlockIndex();

BlockIndex notTaken = branchNode.notTakenBlockIndex();

// The branch instruction will branch to the taken block.

// If taken is next, switch taken with notTaken & invert the branch condition so we can fall through.

if (taken == (m_block + 1)) {

invert = !invert;

BlockIndex tmp = taken;

taken = notTaken;

notTaken = tmp;

}

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1GPR = arg1.gpr();

GPRReg arg2GPR = arg2.gpr();

GPRTemporary result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {

// see if we get lucky: if the arguments are cells and they reference the same

// cell, then they must be strictly equal.

branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);

silentSpillAllRegisters(resultGPR);

callOperation(operationCompareStrictEqCell, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);

} else {

m_jit.orPtr(arg1GPR, arg2GPR, resultGPR);

JITCompiler::Jump twoCellsCase = m_jit.branchTestPtr(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);

JITCompiler::Jump numberCase = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR, GPRInfo::tagTypeNumberRegister);

branch32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, taken);

jump(notTaken, ForceJump);

twoCellsCase.link(&m_jit);

branchPtr(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);

numberCase.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(operationCompareStrictEq, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);

}

jump(notTaken);

}

void SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq(Node& node, bool invert)

{

JSValueOperand arg1(this, node.child1());

JSValueOperand arg2(this, node.child2());

GPRReg arg1GPR = arg1.gpr();

GPRReg arg2GPR = arg2.gpr();

GPRTemporary result(this);

GPRReg resultGPR = result.gpr();

arg1.use();

arg2.use();

if (isKnownCell(node.child1().index()) && isKnownCell(node.child2().index())) {

// see if we get lucky: if the arguments are cells and they reference the same

// cell, then they must be strictly equal.

JITCompiler::Jump notEqualCase = m_jit.branchPtr(JITCompiler::NotEqual, arg1GPR, arg2GPR);

m_jit.move(JITCompiler::TrustedImmPtr(JSValue::encode(jsBoolean(!invert))), resultGPR);

JITCompiler::Jump done = m_jit.jump();

notEqualCase.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(operationCompareStrictEqCell, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(1), resultGPR);

m_jit.or32(JITCompiler::TrustedImm32(ValueFalse), resultGPR);

done.link(&m_jit);

} else {

m_jit.orPtr(arg1GPR, arg2GPR, resultGPR);

JITCompiler::Jump twoCellsCase = m_jit.branchTestPtr(JITCompiler::Zero, resultGPR, GPRInfo::tagMaskRegister);

JITCompiler::Jump numberCase = m_jit.branchTestPtr(JITCompiler::NonZero, resultGPR, GPRInfo::tagTypeNumberRegister);

m_jit.compare32(invert ? JITCompiler::NotEqual : JITCompiler::Equal, arg1GPR, arg2GPR, resultGPR);

JITCompiler::Jump done1 = m_jit.jump();

twoCellsCase.link(&m_jit);

JITCompiler::Jump notEqualCase = m_jit.branchPtr(JITCompiler::NotEqual, arg1GPR, arg2GPR);

m_jit.move(JITCompiler::TrustedImmPtr(JSValue::encode(jsBoolean(!invert))), resultGPR);

JITCompiler::Jump done2 = m_jit.jump();

numberCase.link(&m_jit);

notEqualCase.link(&m_jit);

silentSpillAllRegisters(resultGPR);

callOperation(operationCompareStrictEq, resultGPR, arg1GPR, arg2GPR);

silentFillAllRegisters(resultGPR);

m_jit.andPtr(JITCompiler::TrustedImm32(1), resultGPR);

done1.link(&m_jit);

m_jit.or32(JITCompiler::TrustedImm32(ValueFalse), resultGPR);

done2.link(&m_jit);

}

jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean, UseChildrenCalledExplicitly);

}

void SpeculativeJIT::emitCall(Node& node)

{

P_DFGOperation_E slowCallFunction;

if (node.op == Call)

slowCallFunction = operationLinkCall;

else {

ASSERT(node.op == Construct);

slowCallFunction = operationLinkConstruct;

}

// For constructors, the this argument is not passed but we have to make space

// for it.

int dummyThisArgument = node.op == Call ? 0 : 1;

CallLinkInfo::CallType callType = node.op == Call ? CallLinkInfo::Call : CallLinkInfo::Construct;

NodeUse calleeNodeUse = m_jit.graph().m_varArgChildren[node.firstChild()];

JSValueOperand callee(this, calleeNodeUse);

GPRReg calleeGPR = callee.gpr();

use(calleeNodeUse);

// The call instruction's first child is either the function (normal call) or the

// receiver (method call). subsequent children are the arguments.

int numPassedArgs = node.numChildren() - 1;

m_jit.store32(MacroAssembler::TrustedImm32(numPassedArgs + dummyThisArgument), callFramePayloadSlot(RegisterFile::ArgumentCount));

m_jit.storePtr(GPRInfo::callFrameRegister, callFrameSlot(RegisterFile::CallerFrame));

m_jit.storePtr(calleeGPR, callFrameSlot(RegisterFile::Callee));

for (int i = 0; i < numPassedArgs; i++) {

NodeUse argNodeUse = m_jit.graph().m_varArgChildren[node.firstChild() + 1 + i];

JSValueOperand arg(this, argNodeUse);

GPRReg argGPR = arg.gpr();

use(argNodeUse);

m_jit.storePtr(argGPR, argumentSlot(i + dummyThisArgument));

}

flushRegisters();

GPRResult result(this);

GPRReg resultGPR = result.gpr();

JITCompiler::DataLabelPtr targetToCheck;

JITCompiler::Jump slowPath;

slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleeGPR, targetToCheck, MacroAssembler::TrustedImmPtr(JSValue::encode(JSValue())));

m_jit.loadPtr(MacroAssembler::Address(calleeGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);

m_jit.storePtr(resultGPR, callFrameSlot(RegisterFile::ScopeChain));

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);

CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;

CallBeginToken token = m_jit.beginJSCall();

JITCompiler::Call fastCall = m_jit.nearCall();

m_jit.notifyCall(fastCall, codeOrigin, token);

JITCompiler::Jump done = m_jit.jump();

slowPath.link(&m_jit);

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);

token = m_jit.beginCall();

JITCompiler::Call slowCall = m_jit.appendCall(slowCallFunction);

m_jit.addFastExceptionCheck(slowCall, codeOrigin, token);

m_jit.addPtr(Imm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);

token = m_jit.beginJSCall();

JITCompiler::Call theCall = m_jit.call(GPRInfo::returnValueGPR);

m_jit.notifyCall(theCall, codeOrigin, token);

done.link(&m_jit);

m_jit.move(GPRInfo::returnValueGPR, resultGPR);

jsValueResult(resultGPR, m_compileIndex, DataFormatJS, UseChildrenCalledExplicitly);

m_jit.addJSCall(fastCall, slowCall, targetToCheck, callType, at(m_compileIndex).codeOrigin);

}

template<bool strict>

GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat& returnFormat)

{

#if DFG_ENABLE(DEBUG_VERBOSE)

dataLog("SpecInt@%d ", nodeIndex);

#endif

Node& node = at(nodeIndex);

VirtualRegister virtualRegister = node.virtualRegister();

GenerationInfo& info = m_generationInfo[virtualRegister];

switch (info.registerFormat()) {

case DataFormatNone: {

if ((node.hasConstant() && !isInt32Constant(nodeIndex)) || info.spillFormat() == DataFormatDouble) {

terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);

returnFormat = DataFormatInteger;

return allocate();

}

GPRReg gpr = allocate();

if (node.hasConstant()) {