diff options
Diffstat (limited to 'js/src/jit/IonBuilder.cpp')
| -rw-r--r-- | js/src/jit/IonBuilder.cpp | 14696 |
1 files changed, 14696 insertions, 0 deletions
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp new file mode 100644 index 000000000..1488d7d34 --- /dev/null +++ b/js/src/jit/IonBuilder.cpp @@ -0,0 +1,14696 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "jit/IonBuilder.h" + +#include "mozilla/DebugOnly.h" +#include "mozilla/SizePrintfMacros.h" + +#include "builtin/Eval.h" +#include "builtin/TypedObject.h" +#include "frontend/SourceNotes.h" +#include "jit/BaselineFrame.h" +#include "jit/BaselineInspector.h" +#include "jit/Ion.h" +#include "jit/IonOptimizationLevels.h" +#include "jit/JitSpewer.h" +#include "jit/Lowering.h" +#include "jit/MIRGraph.h" +#include "vm/ArgumentsObject.h" +#include "vm/Opcodes.h" +#include "vm/RegExpStatics.h" +#include "vm/TraceLogging.h" + +#include "jsopcodeinlines.h" +#include "jsscriptinlines.h" + +#include "jit/CompileInfo-inl.h" +#include "jit/shared/Lowering-shared-inl.h" +#include "vm/EnvironmentObject-inl.h" +#include "vm/NativeObject-inl.h" +#include "vm/ObjectGroup-inl.h" +#include "vm/UnboxedObject-inl.h" + +using namespace js; +using namespace js::jit; + +using mozilla::AssertedCast; +using mozilla::DebugOnly; +using mozilla::Maybe; + +using JS::TrackedStrategy; +using JS::TrackedOutcome; +using JS::TrackedTypeSite; + +class jit::BaselineFrameInspector +{ + public: + TypeSet::Type thisType; + JSObject* singletonEnvChain; + + Vector<TypeSet::Type, 4, JitAllocPolicy> argTypes; + Vector<TypeSet::Type, 4, JitAllocPolicy> varTypes; + + explicit BaselineFrameInspector(TempAllocator* temp) + : thisType(TypeSet::UndefinedType()), + singletonEnvChain(nullptr), + argTypes(*temp), + varTypes(*temp) + {} +}; + +BaselineFrameInspector* +jit::NewBaselineFrameInspector(TempAllocator* temp, BaselineFrame* frame, CompileInfo* info) +{ + MOZ_ASSERT(frame); + + BaselineFrameInspector* inspector = temp->lifoAlloc()->new_<BaselineFrameInspector>(temp); + if (!inspector) + return nullptr; + + // Note: copying the actual values into a temporary structure for use + // during compilation could capture nursery pointers, so the values' types + // are recorded instead. + + if (frame->isFunctionFrame()) + inspector->thisType = TypeSet::GetMaybeUntrackedValueType(frame->thisArgument()); + + if (frame->environmentChain()->isSingleton()) + inspector->singletonEnvChain = frame->environmentChain(); + + JSScript* script = frame->script(); + + if (script->functionNonDelazifying()) { + if (!inspector->argTypes.reserve(frame->numFormalArgs())) + return nullptr; + for (size_t i = 0; i < frame->numFormalArgs(); i++) { + if (script->formalIsAliased(i)) { + inspector->argTypes.infallibleAppend(TypeSet::UndefinedType()); + } else if (!script->argsObjAliasesFormals()) { + TypeSet::Type type = + TypeSet::GetMaybeUntrackedValueType(frame->unaliasedFormal(i)); + inspector->argTypes.infallibleAppend(type); + } else if (frame->hasArgsObj()) { + TypeSet::Type type = + TypeSet::GetMaybeUntrackedValueType(frame->argsObj().arg(i)); + inspector->argTypes.infallibleAppend(type); + } else { + inspector->argTypes.infallibleAppend(TypeSet::UndefinedType()); + } + } + } + + if (!inspector->varTypes.reserve(frame->numValueSlots())) + return nullptr; + for (size_t i = 0; i < frame->numValueSlots(); i++) { + TypeSet::Type type = TypeSet::GetMaybeUntrackedValueType(*frame->valueSlot(i)); + inspector->varTypes.infallibleAppend(type); + } + + return inspector; +} + +IonBuilder::IonBuilder(JSContext* analysisContext, CompileCompartment* comp, + const JitCompileOptions& options, TempAllocator* temp, + MIRGraph* graph, CompilerConstraintList* constraints, + BaselineInspector* inspector, CompileInfo* info, + const OptimizationInfo* optimizationInfo, + BaselineFrameInspector* baselineFrame, size_t inliningDepth, + uint32_t loopDepth) + : MIRGenerator(comp, options, temp, graph, info, optimizationInfo), + backgroundCodegen_(nullptr), + actionableAbortScript_(nullptr), + actionableAbortPc_(nullptr), + actionableAbortMessage_(nullptr), + rootList_(nullptr), + analysisContext(analysisContext), + baselineFrame_(baselineFrame), + constraints_(constraints), + analysis_(*temp, info->script()), + thisTypes(nullptr), + argTypes(nullptr), + typeArray(nullptr), + typeArrayHint(0), + bytecodeTypeMap(nullptr), + loopDepth_(loopDepth), + trackedOptimizationSites_(*temp), + lexicalCheck_(nullptr), + callerResumePoint_(nullptr), + callerBuilder_(nullptr), + cfgStack_(*temp), + loops_(*temp), + switches_(*temp), + labels_(*temp), + iterators_(*temp), + loopHeaders_(*temp), + inspector(inspector), + inliningDepth_(inliningDepth), + inlinedBytecodeLength_(0), + numLoopRestarts_(0), + failedBoundsCheck_(info->script()->failedBoundsCheck()), + failedShapeGuard_(info->script()->failedShapeGuard()), + failedLexicalCheck_(info->script()->failedLexicalCheck()), + nonStringIteration_(false), + lazyArguments_(nullptr), + inlineCallInfo_(nullptr), + maybeFallbackFunctionGetter_(nullptr) +{ + script_ = info->script(); + scriptHasIonScript_ = script_->hasIonScript(); + pc = info->startPC(); + abortReason_ = AbortReason_Disable; + + MOZ_ASSERT(script()->hasBaselineScript() == (info->analysisMode() != Analysis_ArgumentsUsage)); + MOZ_ASSERT(!!analysisContext == (info->analysisMode() == Analysis_DefiniteProperties)); + MOZ_ASSERT(script_->nTypeSets() < UINT16_MAX); + + if (!info->isAnalysis()) + script()->baselineScript()->setIonCompiledOrInlined(); +} + +void +IonBuilder::clearForBackEnd() +{ + MOZ_ASSERT(!analysisContext); + baselineFrame_ = nullptr; + + // The caches below allocate data from the malloc heap. Release this before + // later phases of compilation to avoid leaks, as the top level IonBuilder + // is not explicitly destroyed. Note that builders for inner scripts are + // constructed on the stack and will release this memory on destruction. + gsn.purge(); + envCoordinateNameCache.purge(); +} + +bool +IonBuilder::abort(const char* message, ...) +{ + // Don't call PCToLineNumber in release builds. +#ifdef JS_JITSPEW + va_list ap; + va_start(ap, message); + abortFmt(message, ap); + va_end(ap); +# ifdef DEBUG + JitSpew(JitSpew_IonAbort, "aborted @ %s:%d", script()->filename(), PCToLineNumber(script(), pc)); +# else + JitSpew(JitSpew_IonAbort, "aborted @ %s", script()->filename()); +# endif +#endif + trackActionableAbort(message); + return false; +} + +IonBuilder* +IonBuilder::outermostBuilder() +{ + IonBuilder* builder = this; + while (builder->callerBuilder_) + builder = builder->callerBuilder_; + return builder; +} + +void +IonBuilder::trackActionableAbort(const char* message) +{ + if (!isOptimizationTrackingEnabled()) + return; + + IonBuilder* topBuilder = outermostBuilder(); + if (topBuilder->hadActionableAbort()) + return; + + topBuilder->actionableAbortScript_ = script(); + topBuilder->actionableAbortPc_ = pc; + topBuilder->actionableAbortMessage_ = message; +} + +void +IonBuilder::spew(const char* message) +{ + // Don't call PCToLineNumber in release builds. +#ifdef DEBUG + JitSpew(JitSpew_IonMIR, "%s @ %s:%d", message, script()->filename(), PCToLineNumber(script(), pc)); +#endif +} + +static inline int32_t +GetJumpOffset(jsbytecode* pc) +{ + MOZ_ASSERT(CodeSpec[JSOp(*pc)].type() == JOF_JUMP); + return GET_JUMP_OFFSET(pc); +} + +IonBuilder::CFGState +IonBuilder::CFGState::If(jsbytecode* join, MTest* test) +{ + CFGState state; + state.state = IF_TRUE; + state.stopAt = join; + state.branch.ifFalse = test->ifFalse(); + state.branch.test = test; + return state; +} + +IonBuilder::CFGState +IonBuilder::CFGState::IfElse(jsbytecode* trueEnd, jsbytecode* falseEnd, MTest* test) +{ + MBasicBlock* ifFalse = test->ifFalse(); + + CFGState state; + // If the end of the false path is the same as the start of the + // false path, then the "else" block is empty and we can devolve + // this to the IF_TRUE case. We handle this here because there is + // still an extra GOTO on the true path and we want stopAt to point + // there, whereas the IF_TRUE case does not have the GOTO. + state.state = (falseEnd == ifFalse->pc()) + ? IF_TRUE_EMPTY_ELSE + : IF_ELSE_TRUE; + state.stopAt = trueEnd; + state.branch.falseEnd = falseEnd; + state.branch.ifFalse = ifFalse; + state.branch.test = test; + return state; +} + +IonBuilder::CFGState +IonBuilder::CFGState::AndOr(jsbytecode* join, MBasicBlock* lhs) +{ + CFGState state; + state.state = AND_OR; + state.stopAt = join; + state.branch.ifFalse = lhs; + state.branch.test = nullptr; + return state; +} + +IonBuilder::CFGState +IonBuilder::CFGState::TableSwitch(jsbytecode* exitpc, MTableSwitch* ins) +{ + CFGState state; + state.state = TABLE_SWITCH; + state.stopAt = exitpc; + state.tableswitch.exitpc = exitpc; + state.tableswitch.breaks = nullptr; + state.tableswitch.ins = ins; + state.tableswitch.currentBlock = 0; + return state; +} + +JSFunction* +IonBuilder::getSingleCallTarget(TemporaryTypeSet* calleeTypes) +{ + if (!calleeTypes) + return nullptr; + + JSObject* obj = calleeTypes->maybeSingleton(); + if (!obj || !obj->is<JSFunction>()) + return nullptr; + + return &obj->as<JSFunction>(); +} + +bool +IonBuilder::getPolyCallTargets(TemporaryTypeSet* calleeTypes, bool constructing, + ObjectVector& targets, uint32_t maxTargets) +{ + MOZ_ASSERT(targets.empty()); + + if (!calleeTypes) + return true; + + if (calleeTypes->baseFlags() != 0) + return true; + + unsigned objCount = calleeTypes->getObjectCount(); + + if (objCount == 0 || objCount > maxTargets) + return true; + + if (!targets.reserve(objCount)) + return false; + for (unsigned i = 0; i < objCount; i++) { + JSObject* obj = calleeTypes->getSingleton(i); + if (obj) { + MOZ_ASSERT(obj->isSingleton()); + } else { + ObjectGroup* group = calleeTypes->getGroup(i); + if (!group) + continue; + + obj = group->maybeInterpretedFunction(); + if (!obj) { + targets.clear(); + return true; + } + + MOZ_ASSERT(!obj->isSingleton()); + } + + // Don't optimize if the callee is not callable or constructable per + // the manner it is being invoked, so that CallKnown does not have to + // handle these cases (they will always throw). + if (constructing ? !obj->isConstructor() : !obj->isCallable()) { + targets.clear(); + return true; + } + + targets.infallibleAppend(obj); + } + + return true; +} + +IonBuilder::InliningDecision +IonBuilder::DontInline(JSScript* targetScript, const char* reason) +{ + if (targetScript) { + JitSpew(JitSpew_Inlining, "Cannot inline %s:%" PRIuSIZE ": %s", + targetScript->filename(), targetScript->lineno(), reason); + } else { + JitSpew(JitSpew_Inlining, "Cannot inline: %s", reason); + } + + return InliningDecision_DontInline; +} + +/* + * |hasCommonInliningPath| determines whether the current inlining path has been + * seen before based on the sequence of scripts in the chain of |IonBuilder|s. + * + * An inlining path for a function |f| is the sequence of functions whose + * inlinings precede |f| up to any previous occurrences of |f|. + * So, if we have the chain of inlinings + * + * f1 -> f2 -> f -> f3 -> f4 -> f5 -> f + * -------- -------------- + * + * the inlining paths for |f| are [f2, f1] and [f5, f4, f3]. + * When attempting to inline |f|, we find all existing inlining paths for |f| + * and check whether they share a common prefix with the path created were |f| + * inlined. + * + * For example, given mutually recursive functions |f| and |g|, a possible + * inlining is + * + * +---- Inlining stopped here... + * | + * v + * a -> f -> g -> f \ -> g -> f -> g -> ... + * + * where the vertical bar denotes the termination of inlining. + * Inlining is terminated because we have already observed the inlining path + * [f] when inlining function |g|. Note that this will inline recursive + * functions such as |fib| only one level, as |fib| has a zero length inlining + * path which trivially prefixes all inlining paths. + * + */ +bool +IonBuilder::hasCommonInliningPath(const JSScript* scriptToInline) +{ + // Find all previous inlinings of the |scriptToInline| and check for common + // inlining paths with the top of the inlining stack. + for (IonBuilder* it = this->callerBuilder_; it; it = it->callerBuilder_) { + if (it->script() != scriptToInline) + continue; + + // This only needs to check the top of each stack for a match, + // as a match of length one ensures a common prefix. + IonBuilder* path = it->callerBuilder_; + if (!path || this->script() == path->script()) + return true; + } + + return false; +} + +IonBuilder::InliningDecision +IonBuilder::canInlineTarget(JSFunction* target, CallInfo& callInfo) +{ + if (!optimizationInfo().inlineInterpreted()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineGeneric); + return InliningDecision_DontInline; + } + + if (TraceLogTextIdEnabled(TraceLogger_InlinedScripts)) { + return DontInline(nullptr, "Tracelogging of inlined scripts is enabled" + "but Tracelogger cannot do that yet."); + } + + if (!target->isInterpreted()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNotInterpreted); + return DontInline(nullptr, "Non-interpreted target"); + } + + if (info().analysisMode() != Analysis_DefiniteProperties) { + // If |this| or an argument has an empty resultTypeSet, don't bother + // inlining, as the call is currently unreachable due to incomplete type + // information. This does not apply to the definite properties analysis, + // in that case we want to inline anyway. + + if (callInfo.thisArg()->emptyResultTypeSet()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineUnreachable); + return DontInline(nullptr, "Empty TypeSet for |this|"); + } + + for (size_t i = 0; i < callInfo.argc(); i++) { + if (callInfo.getArg(i)->emptyResultTypeSet()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineUnreachable); + return DontInline(nullptr, "Empty TypeSet for argument"); + } + } + } + + // Allow constructing lazy scripts when performing the definite properties + // analysis, as baseline has not been used to warm the caller up yet. + if (target->isInterpreted() && info().analysisMode() == Analysis_DefiniteProperties) { + RootedScript script(analysisContext, target->getOrCreateScript(analysisContext)); + if (!script) + return InliningDecision_Error; + + if (!script->hasBaselineScript() && script->canBaselineCompile()) { + MethodStatus status = BaselineCompile(analysisContext, script); + if (status == Method_Error) + return InliningDecision_Error; + if (status != Method_Compiled) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNoBaseline); + return InliningDecision_DontInline; + } + } + } + + if (!target->hasScript()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineLazy); + return DontInline(nullptr, "Lazy script"); + } + + JSScript* inlineScript = target->nonLazyScript(); + if (callInfo.constructing() && !target->isConstructor()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNotConstructor); + return DontInline(inlineScript, "Callee is not a constructor"); + } + + if (!callInfo.constructing() && target->isClassConstructor()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineClassConstructor); + return DontInline(inlineScript, "Not constructing class constructor"); + } + + AnalysisMode analysisMode = info().analysisMode(); + if (!CanIonCompile(inlineScript, analysisMode)) { + trackOptimizationOutcome(TrackedOutcome::CantInlineDisabledIon); + return DontInline(inlineScript, "Disabled Ion compilation"); + } + + // Don't inline functions which don't have baseline scripts. + if (!inlineScript->hasBaselineScript()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNoBaseline); + return DontInline(inlineScript, "No baseline jitcode"); + } + + if (TooManyFormalArguments(target->nargs())) { + trackOptimizationOutcome(TrackedOutcome::CantInlineTooManyArgs); + return DontInline(inlineScript, "Too many args"); + } + + // We check the number of actual arguments against the maximum number of + // formal arguments as we do not want to encode all actual arguments in the + // callerResumePoint. + if (TooManyFormalArguments(callInfo.argc())) { + trackOptimizationOutcome(TrackedOutcome::CantInlineTooManyArgs); + return DontInline(inlineScript, "Too many actual args"); + } + + if (hasCommonInliningPath(inlineScript)) { + trackOptimizationOutcome(TrackedOutcome::HasCommonInliningPath); + return DontInline(inlineScript, "Common inlining path"); + } + + if (inlineScript->uninlineable()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineGeneric); + return DontInline(inlineScript, "Uninlineable script"); + } + + if (inlineScript->needsArgsObj()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNeedsArgsObj); + return DontInline(inlineScript, "Script that needs an arguments object"); + } + + if (inlineScript->isDebuggee()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineDebuggee); + return DontInline(inlineScript, "Script is debuggee"); + } + + TypeSet::ObjectKey* targetKey = TypeSet::ObjectKey::get(target); + if (targetKey->unknownProperties()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineUnknownProps); + return DontInline(inlineScript, "Target type has unknown properties"); + } + + return InliningDecision_Inline; +} + +void +IonBuilder::popCfgStack() +{ + if (cfgStack_.back().isLoop()) + loops_.popBack(); + if (cfgStack_.back().state == CFGState::LABEL) + labels_.popBack(); + cfgStack_.popBack(); +} + +bool +IonBuilder::analyzeNewLoopTypes(MBasicBlock* entry, jsbytecode* start, jsbytecode* end) +{ + // The phi inputs at the loop head only reflect types for variables that + // were present at the start of the loop. If the variable changes to a new + // type within the loop body, and that type is carried around to the loop + // head, then we need to know about the new type up front. + // + // Since SSA information hasn't been constructed for the loop body yet, we + // need a separate analysis to pick out the types that might flow around + // the loop header. This is a best-effort analysis that may either over- + // or under-approximate the set of such types. + // + // Over-approximating the types may lead to inefficient generated code, and + // under-approximating the types will cause the loop body to be analyzed + // multiple times as the correct types are deduced (see finishLoop). + + // If we restarted processing of an outer loop then get loop header types + // directly from the last time we have previously processed this loop. This + // both avoids repeated work from the bytecode traverse below, and will + // also pick up types discovered while previously building the loop body. + for (size_t i = 0; i < loopHeaders_.length(); i++) { + if (loopHeaders_[i].pc == start) { + MBasicBlock* oldEntry = loopHeaders_[i].header; + + // If this block has been discarded, its resume points will have + // already discarded their operands. + if (!oldEntry->isDead()) { + MResumePoint* oldEntryRp = oldEntry->entryResumePoint(); + size_t stackDepth = oldEntryRp->stackDepth(); + for (size_t slot = 0; slot < stackDepth; slot++) { + MDefinition* oldDef = oldEntryRp->getOperand(slot); + if (!oldDef->isPhi()) { + MOZ_ASSERT(oldDef->block()->id() < oldEntry->id()); + MOZ_ASSERT(oldDef == entry->getSlot(slot)); + continue; + } + MPhi* oldPhi = oldDef->toPhi(); + MPhi* newPhi = entry->getSlot(slot)->toPhi(); + if (!newPhi->addBackedgeType(alloc(), oldPhi->type(), oldPhi->resultTypeSet())) + return false; + } + } + + // Update the most recent header for this loop encountered, in case + // new types flow to the phis and the loop is processed at least + // three times. + loopHeaders_[i].header = entry; + return true; + } + } + if (!loopHeaders_.append(LoopHeader(start, entry))) + return false; + + jsbytecode* last = nullptr; + jsbytecode* earlier = nullptr; + for (jsbytecode* pc = start; pc != end; earlier = last, last = pc, pc += GetBytecodeLength(pc)) { + uint32_t slot; + if (*pc == JSOP_SETLOCAL) + slot = info().localSlot(GET_LOCALNO(pc)); + else if (*pc == JSOP_SETARG) + slot = info().argSlotUnchecked(GET_ARGNO(pc)); + else + continue; + if (slot >= info().firstStackSlot()) + continue; + if (!analysis().maybeInfo(pc)) + continue; + if (!last) + continue; + + MPhi* phi = entry->getSlot(slot)->toPhi(); + + if (*last == JSOP_POS) + last = earlier; + + if (CodeSpec[*last].format & JOF_TYPESET) { + TemporaryTypeSet* typeSet = bytecodeTypes(last); + if (!typeSet->empty()) { + MIRType type = typeSet->getKnownMIRType(); + if (!phi->addBackedgeType(alloc(), type, typeSet)) + return false; + } + } else if (*last == JSOP_GETLOCAL || *last == JSOP_GETARG) { + uint32_t slot = (*last == JSOP_GETLOCAL) + ? info().localSlot(GET_LOCALNO(last)) + : info().argSlotUnchecked(GET_ARGNO(last)); + if (slot < info().firstStackSlot()) { + MPhi* otherPhi = entry->getSlot(slot)->toPhi(); + if (otherPhi->hasBackedgeType()) { + if (!phi->addBackedgeType(alloc(), otherPhi->type(), otherPhi->resultTypeSet())) + return false; + } + } + } else { + MIRType type = MIRType::None; + switch (*last) { + case JSOP_VOID: + case JSOP_UNDEFINED: + type = MIRType::Undefined; + break; + case JSOP_GIMPLICITTHIS: + if (!script()->hasNonSyntacticScope()) + type = MIRType::Undefined; + break; + case JSOP_NULL: + type = MIRType::Null; + break; + case JSOP_ZERO: + case JSOP_ONE: + case JSOP_INT8: + case JSOP_INT32: + case JSOP_UINT16: + case JSOP_UINT24: + case JSOP_BITAND: + case JSOP_BITOR: + case JSOP_BITXOR: + case JSOP_BITNOT: + case JSOP_RSH: + case JSOP_LSH: + case JSOP_URSH: + type = MIRType::Int32; + break; + case JSOP_FALSE: + case JSOP_TRUE: + case JSOP_EQ: + case JSOP_NE: + case JSOP_LT: + case JSOP_LE: + case JSOP_GT: + case JSOP_GE: + case JSOP_NOT: + case JSOP_STRICTEQ: + case JSOP_STRICTNE: + case JSOP_IN: + case JSOP_INSTANCEOF: + type = MIRType::Boolean; + break; + case JSOP_DOUBLE: + type = MIRType::Double; + break; + case JSOP_STRING: + case JSOP_TOSTRING: + case JSOP_TYPEOF: + case JSOP_TYPEOFEXPR: + type = MIRType::String; + break; + case JSOP_SYMBOL: + type = MIRType::Symbol; + break; + case JSOP_ADD: + case JSOP_SUB: + case JSOP_MUL: + case JSOP_DIV: + case JSOP_MOD: + case JSOP_NEG: + type = inspector->expectedResultType(last); + break; + default: + break; + } + if (type != MIRType::None) { + if (!phi->addBackedgeType(alloc(), type, nullptr)) + return false; + } + } + } + return true; +} + +bool +IonBuilder::pushLoop(CFGState::State initial, jsbytecode* stopAt, MBasicBlock* entry, bool osr, + jsbytecode* loopHead, jsbytecode* initialPc, + jsbytecode* bodyStart, jsbytecode* bodyEnd, + jsbytecode* exitpc, jsbytecode* continuepc) +{ + ControlFlowInfo loop(cfgStack_.length(), continuepc); + if (!loops_.append(loop)) + return false; + + CFGState state; + state.state = initial; + state.stopAt = stopAt; + state.loop.bodyStart = bodyStart; + state.loop.bodyEnd = bodyEnd; + state.loop.exitpc = exitpc; + state.loop.continuepc = continuepc; + state.loop.entry = entry; + state.loop.osr = osr; + state.loop.successor = nullptr; + state.loop.breaks = nullptr; + state.loop.continues = nullptr; + state.loop.initialState = initial; + state.loop.initialPc = initialPc; + state.loop.initialStopAt = stopAt; + state.loop.loopHead = loopHead; + return cfgStack_.append(state); +} + +bool +IonBuilder::init() +{ + { + LifoAlloc::AutoFallibleScope fallibleAllocator(alloc().lifoAlloc()); + if (!TypeScript::FreezeTypeSets(constraints(), script(), &thisTypes, &argTypes, &typeArray)) + return false; + } + + if (!alloc().ensureBallast()) + return false; + + if (inlineCallInfo_) { + // If we're inlining, the actual this/argument types are not necessarily + // a subset of the script's observed types. |argTypes| is never accessed + // for inlined scripts, so we just null it. + thisTypes = inlineCallInfo_->thisArg()->resultTypeSet(); + argTypes = nullptr; + } + + if (!analysis().init(alloc(), gsn)) + return false; + + // The baseline script normally has the bytecode type map, but compute + // it ourselves if we do not have a baseline script. + if (script()->hasBaselineScript()) { + bytecodeTypeMap = script()->baselineScript()->bytecodeTypeMap(); + } else { + bytecodeTypeMap = alloc_->lifoAlloc()->newArrayUninitialized<uint32_t>(script()->nTypeSets()); + if (!bytecodeTypeMap) + return false; + FillBytecodeTypeMap(script(), bytecodeTypeMap); + } + + return true; +} + +bool +IonBuilder::build() +{ + if (!init()) + return false; + + if (script()->hasBaselineScript()) + script()->baselineScript()->resetMaxInliningDepth(); + + if (!setCurrentAndSpecializePhis(newBlock(pc))) + return false; + if (!current) + return false; + +#ifdef JS_JITSPEW + if (info().isAnalysis()) { + JitSpew(JitSpew_IonScripts, "Analyzing script %s:%" PRIuSIZE " (%p) %s", + script()->filename(), script()->lineno(), (void*)script(), + AnalysisModeString(info().analysisMode())); + } else { + JitSpew(JitSpew_IonScripts, "%sompiling script %s:%" PRIuSIZE " (%p) (warmup-counter=%" PRIu32 ", level=%s)", + (script()->hasIonScript() ? "Rec" : "C"), + script()->filename(), script()->lineno(), (void*)script(), + script()->getWarmUpCount(), OptimizationLevelString(optimizationInfo().level())); + } +#endif + + if (!initParameters()) + return false; + initLocals(); + + // Initialize something for the env chain. We can bail out before the + // start instruction, but the snapshot is encoded *at* the start + // instruction, which means generating any code that could load into + // registers is illegal. + MInstruction* env = MConstant::New(alloc(), UndefinedValue()); + current->add(env); + current->initSlot(info().environmentChainSlot(), env); + + // Initialize the return value. + MInstruction* returnValue = MConstant::New(alloc(), UndefinedValue()); + current->add(returnValue); + current->initSlot(info().returnValueSlot(), returnValue); + + // Initialize the arguments object slot to undefined if necessary. + if (info().hasArguments()) { + MInstruction* argsObj = MConstant::New(alloc(), UndefinedValue()); + current->add(argsObj); + current->initSlot(info().argsObjSlot(), argsObj); + } + + // Emit the start instruction, so we can begin real instructions. + current->add(MStart::New(alloc())); + + // Guard against over-recursion. Do this before we start unboxing, since + // this will create an OSI point that will read the incoming argument + // values, which is nice to do before their last real use, to minimize + // register/stack pressure. + MCheckOverRecursed* check = MCheckOverRecursed::New(alloc()); + current->add(check); + MResumePoint* entryRpCopy = MResumePoint::Copy(alloc(), current->entryResumePoint()); + if (!entryRpCopy) + return false; + check->setResumePoint(entryRpCopy); + + // Parameters have been checked to correspond to the typeset, now we unbox + // what we can in an infallible manner. + if (!rewriteParameters()) + return false; + + // Check for redeclaration errors for global scripts. + if (!info().funMaybeLazy() && !info().module() && + script()->bodyScope()->is<GlobalScope>() && + script()->bodyScope()->as<GlobalScope>().hasBindings()) + { + MGlobalNameConflictsCheck* redeclCheck = MGlobalNameConflictsCheck::New(alloc()); + current->add(redeclCheck); + MResumePoint* entryRpCopy = MResumePoint::Copy(alloc(), current->entryResumePoint()); + if (!entryRpCopy) + return false; + redeclCheck->setResumePoint(entryRpCopy); + } + + // It's safe to start emitting actual IR, so now build the env chain. + if (!initEnvironmentChain()) + return false; + + if (info().needsArgsObj() && !initArgumentsObject()) + return false; + + // The type analysis phase attempts to insert unbox operations near + // definitions of values. It also attempts to replace uses in resume points + // with the narrower, unboxed variants. However, we must prevent this + // replacement from happening on values in the entry snapshot. Otherwise we + // could get this: + // + // v0 = MParameter(0) + // v1 = MParameter(1) + // -- ResumePoint(v2, v3) + // v2 = Unbox(v0, INT32) + // v3 = Unbox(v1, INT32) + // + // So we attach the initial resume point to each parameter, which the type + // analysis explicitly checks (this is the same mechanism used for + // effectful operations). + for (uint32_t i = 0; i < info().endArgSlot(); i++) { + MInstruction* ins = current->getEntrySlot(i)->toInstruction(); + if (ins->type() != MIRType::Value) + continue; + + MResumePoint* entryRpCopy = MResumePoint::Copy(alloc(), current->entryResumePoint()); + if (!entryRpCopy) + return false; + ins->setResumePoint(entryRpCopy); + } + + // lazyArguments should never be accessed in |argsObjAliasesFormals| scripts. + if (info().hasArguments() && !info().argsObjAliasesFormals()) { + lazyArguments_ = MConstant::New(alloc(), MagicValue(JS_OPTIMIZED_ARGUMENTS)); + current->add(lazyArguments_); + } + + insertRecompileCheck(); + + if (!traverseBytecode()) + return false; + + // Discard unreferenced & pre-allocated resume points. + replaceMaybeFallbackFunctionGetter(nullptr); + + if (script_->hasBaselineScript() && + inlinedBytecodeLength_ > script_->baselineScript()->inlinedBytecodeLength()) + { + script_->baselineScript()->setInlinedBytecodeLength(inlinedBytecodeLength_); + } + + if (!maybeAddOsrTypeBarriers()) + return false; + + if (!processIterators()) + return false; + + if (!info().isAnalysis() && !abortedPreliminaryGroups().empty()) { + abortReason_ = AbortReason_PreliminaryObjects; + return false; + } + + if (shouldForceAbort()) { + abortReason_ = AbortReason_Disable; + return false; + } + + MOZ_ASSERT(loopDepth_ == 0); + abortReason_ = AbortReason_NoAbort; + return true; +} + +bool +IonBuilder::processIterators() +{ + // Find phis that must directly hold an iterator live. + Vector<MPhi*, 0, SystemAllocPolicy> worklist; + for (size_t i = 0; i < iterators_.length(); i++) { + MInstruction* ins = iterators_[i]; + for (MUseDefIterator iter(ins); iter; iter++) { + if (iter.def()->isPhi()) { + if (!worklist.append(iter.def()->toPhi())) + return false; + } + } + } + + // Propagate the iterator and live status of phis to all other connected + // phis. + while (!worklist.empty()) { + MPhi* phi = worklist.popCopy(); + phi->setIterator(); + phi->setImplicitlyUsedUnchecked(); + + for (MUseDefIterator iter(phi); iter; iter++) { + if (iter.def()->isPhi()) { + MPhi* other = iter.def()->toPhi(); + if (!other->isIterator() && !worklist.append(other)) + return false; + } + } + } + + return true; +} + +bool +IonBuilder::buildInline(IonBuilder* callerBuilder, MResumePoint* callerResumePoint, + CallInfo& callInfo) +{ + inlineCallInfo_ = &callInfo; + + if (!init()) + return false; + + JitSpew(JitSpew_IonScripts, "Inlining script %s:%" PRIuSIZE " (%p)", + script()->filename(), script()->lineno(), (void*)script()); + + callerBuilder_ = callerBuilder; + callerResumePoint_ = callerResumePoint; + + if (callerBuilder->failedBoundsCheck_) + failedBoundsCheck_ = true; + + if (callerBuilder->failedShapeGuard_) + failedShapeGuard_ = true; + + if (callerBuilder->failedLexicalCheck_) + failedLexicalCheck_ = true; + + safeForMinorGC_ = callerBuilder->safeForMinorGC_; + + // Generate single entrance block. + if (!setCurrentAndSpecializePhis(newBlock(pc))) + return false; + if (!current) + return false; + + current->setCallerResumePoint(callerResumePoint); + + // Connect the entrance block to the last block in the caller's graph. + MBasicBlock* predecessor = callerBuilder->current; + MOZ_ASSERT(predecessor == callerResumePoint->block()); + + predecessor->end(MGoto::New(alloc(), current)); + if (!current->addPredecessorWithoutPhis(predecessor)) + return false; + + // Initialize env chain slot to Undefined. It's set later by + // |initEnvironmentChain|. + MInstruction* env = MConstant::New(alloc(), UndefinedValue()); + current->add(env); + current->initSlot(info().environmentChainSlot(), env); + + // Initialize |return value| slot. + MInstruction* returnValue = MConstant::New(alloc(), UndefinedValue()); + current->add(returnValue); + current->initSlot(info().returnValueSlot(), returnValue); + + // Initialize |arguments| slot. + if (info().hasArguments()) { + MInstruction* argsObj = MConstant::New(alloc(), UndefinedValue()); + current->add(argsObj); + current->initSlot(info().argsObjSlot(), argsObj); + } + + // Initialize |this| slot. + current->initSlot(info().thisSlot(), callInfo.thisArg()); + + JitSpew(JitSpew_Inlining, "Initializing %u arg slots", info().nargs()); + + // NB: Ion does not inline functions which |needsArgsObj|. So using argSlot() + // instead of argSlotUnchecked() below is OK + MOZ_ASSERT(!info().needsArgsObj()); + + // Initialize actually set arguments. + uint32_t existing_args = Min<uint32_t>(callInfo.argc(), info().nargs()); + for (size_t i = 0; i < existing_args; ++i) { + MDefinition* arg = callInfo.getArg(i); + current->initSlot(info().argSlot(i), arg); + } + + // Pass Undefined for missing arguments + for (size_t i = callInfo.argc(); i < info().nargs(); ++i) { + MConstant* arg = MConstant::New(alloc(), UndefinedValue()); + current->add(arg); + current->initSlot(info().argSlot(i), arg); + } + + JitSpew(JitSpew_Inlining, "Initializing %u locals", info().nlocals()); + + initLocals(); + + JitSpew(JitSpew_Inlining, "Inline entry block MResumePoint %p, %u stack slots", + (void*) current->entryResumePoint(), current->entryResumePoint()->stackDepth()); + + // +2 for the env chain and |this|, maybe another +1 for arguments object slot. + MOZ_ASSERT(current->entryResumePoint()->stackDepth() == info().totalSlots()); + + if (script_->argumentsHasVarBinding()) { + lazyArguments_ = MConstant::New(alloc(), MagicValue(JS_OPTIMIZED_ARGUMENTS)); + current->add(lazyArguments_); + } + + insertRecompileCheck(); + + // Initialize the env chain now that all resume points operands are + // initialized. + if (!initEnvironmentChain(callInfo.fun())) + return false; + + if (!traverseBytecode()) + return false; + + // Discard unreferenced & pre-allocated resume points. + replaceMaybeFallbackFunctionGetter(nullptr); + + MOZ_ASSERT(iterators_.empty(), "Iterators should be added to outer builder"); + + if (!info().isAnalysis() && !abortedPreliminaryGroups().empty()) { + abortReason_ = AbortReason_PreliminaryObjects; + return false; + } + + if (shouldForceAbort()) { + abortReason_ = AbortReason_Disable; + return false; + } + + return true; +} + +void +IonBuilder::rewriteParameter(uint32_t slotIdx, MDefinition* param, int32_t argIndex) +{ + MOZ_ASSERT(param->isParameter() || param->isGetArgumentsObjectArg()); + + TemporaryTypeSet* types = param->resultTypeSet(); + MDefinition* actual = ensureDefiniteType(param, types->getKnownMIRType()); + if (actual == param) + return; + + // Careful! We leave the original MParameter in the entry resume point. The + // arguments still need to be checked unless proven otherwise at the call + // site, and these checks can bailout. We can end up: + // v0 = Parameter(0) + // v1 = Unbox(v0, INT32) + // -- ResumePoint(v0) + // + // As usual, it would be invalid for v1 to be captured in the initial + // resume point, rather than v0. + current->rewriteSlot(slotIdx, actual); +} + +// Apply Type Inference information to parameters early on, unboxing them if +// they have a definitive type. The actual guards will be emitted by the code +// generator, explicitly, as part of the function prologue. +bool +IonBuilder::rewriteParameters() +{ + MOZ_ASSERT(info().environmentChainSlot() == 0); + + if (!info().funMaybeLazy()) + return true; + + for (uint32_t i = info().startArgSlot(); i < info().endArgSlot(); i++) { + if (!alloc().ensureBallast()) + return false; + MDefinition* param = current->getSlot(i); + rewriteParameter(i, param, param->toParameter()->index()); + } + + return true; +} + +bool +IonBuilder::initParameters() +{ + if (!info().funMaybeLazy()) + return true; + + // If we are doing OSR on a frame which initially executed in the + // interpreter and didn't accumulate type information, try to use that OSR + // frame to determine possible initial types for 'this' and parameters. + + if (thisTypes->empty() && baselineFrame_) { + TypeSet::Type type = baselineFrame_->thisType; + if (type.isSingletonUnchecked()) + checkNurseryObject(type.singleton()); + thisTypes->addType(type, alloc_->lifoAlloc()); + } + + MParameter* param = MParameter::New(alloc(), MParameter::THIS_SLOT, thisTypes); + current->add(param); + current->initSlot(info().thisSlot(), param); + + for (uint32_t i = 0; i < info().nargs(); i++) { + TemporaryTypeSet* types = &argTypes[i]; + if (types->empty() && baselineFrame_ && + !script_->baselineScript()->modifiesArguments()) + { + TypeSet::Type type = baselineFrame_->argTypes[i]; + if (type.isSingletonUnchecked()) + checkNurseryObject(type.singleton()); + types->addType(type, alloc_->lifoAlloc()); + } + + param = MParameter::New(alloc().fallible(), i, types); + if (!param) + return false; + current->add(param); + current->initSlot(info().argSlotUnchecked(i), param); + } + + return true; +} + +void +IonBuilder::initLocals() +{ + // Initialize all frame slots to undefined. Lexical bindings are temporal + // dead zoned in bytecode. + + if (info().nlocals() == 0) + return; + + MConstant* undef = MConstant::New(alloc(), UndefinedValue()); + current->add(undef); + + for (uint32_t i = 0; i < info().nlocals(); i++) + current->initSlot(info().localSlot(i), undef); +} + +bool +IonBuilder::initEnvironmentChain(MDefinition* callee) +{ + MInstruction* env = nullptr; + + // If the script doesn't use the envchain, then it's already initialized + // from earlier. However, always make a env chain when |needsArgsObj| is true + // for the script, since arguments object construction requires the env chain + // to be passed in. + if (!info().needsArgsObj() && !analysis().usesEnvironmentChain()) + return true; + + // The env chain is only tracked in scripts that have NAME opcodes which + // will try to access the env. For other scripts, the env instructions + // will be held live by resume points and code will still be generated for + // them, so just use a constant undefined value. + + if (JSFunction* fun = info().funMaybeLazy()) { + if (!callee) { + MCallee* calleeIns = MCallee::New(alloc()); + current->add(calleeIns); + callee = calleeIns; + } + env = MFunctionEnvironment::New(alloc(), callee); + current->add(env); + + // This reproduce what is done in CallObject::createForFunction. Skip + // this for the arguments analysis, as the script might not have a + // baseline script with template objects yet. + if (fun->needsSomeEnvironmentObject() && + info().analysisMode() != Analysis_ArgumentsUsage) + { + if (fun->needsNamedLambdaEnvironment()) { + env = createNamedLambdaObject(callee, env); + if (!env) + return false; + } + + // TODO: Parameter expression-induced extra var environment not + // yet handled. + if (fun->needsExtraBodyVarEnvironment()) + return abort("Extra var environment unsupported"); + + if (fun->needsCallObject()) { + env = createCallObject(callee, env); + if (!env) + return false; + } + } + } else if (ModuleObject* module = info().module()) { + // Modules use a pre-created env object. + env = constant(ObjectValue(module->initialEnvironment())); + } else { + // For global scripts without a non-syntactic global scope, the env + // chain is the global lexical env. + MOZ_ASSERT(!script()->isForEval()); + MOZ_ASSERT(!script()->hasNonSyntacticScope()); + env = constant(ObjectValue(script()->global().lexicalEnvironment())); + } + + current->setEnvironmentChain(env); + return true; +} + +bool +IonBuilder::initArgumentsObject() +{ + JitSpew(JitSpew_IonMIR, "%s:%" PRIuSIZE " - Emitting code to initialize arguments object! block=%p", + script()->filename(), script()->lineno(), current); + MOZ_ASSERT(info().needsArgsObj()); + + bool mapped = script()->hasMappedArgsObj(); + ArgumentsObject* templateObj = script()->compartment()->maybeArgumentsTemplateObject(mapped); + + MCreateArgumentsObject* argsObj = + MCreateArgumentsObject::New(alloc(), current->environmentChain(), templateObj); + current->add(argsObj); + current->setArgumentsObject(argsObj); + return true; +} + +bool +IonBuilder::addOsrValueTypeBarrier(uint32_t slot, MInstruction** def_, + MIRType type, TemporaryTypeSet* typeSet) +{ + MInstruction*& def = *def_; + MBasicBlock* osrBlock = def->block(); + + // Clear bogus type information added in newOsrPreheader(). + def->setResultType(MIRType::Value); + def->setResultTypeSet(nullptr); + + if (typeSet && !typeSet->unknown()) { + MInstruction* barrier = MTypeBarrier::New(alloc(), def, typeSet); + osrBlock->insertBefore(osrBlock->lastIns(), barrier); + osrBlock->rewriteSlot(slot, barrier); + def = barrier; + + // If the TypeSet is more precise than |type|, adjust |type| for the + // code below. + if (type == MIRType::Value) + type = barrier->type(); + } else if (type == MIRType::Null || + type == MIRType::Undefined || + type == MIRType::MagicOptimizedArguments) + { + // No unbox instruction will be added below, so check the type by + // adding a type barrier for a singleton type set. + TypeSet::Type ntype = TypeSet::PrimitiveType(ValueTypeFromMIRType(type)); + LifoAlloc* lifoAlloc = alloc().lifoAlloc(); + typeSet = lifoAlloc->new_<TemporaryTypeSet>(lifoAlloc, ntype); + if (!typeSet) + return false; + MInstruction* barrier = MTypeBarrier::New(alloc(), def, typeSet); + osrBlock->insertBefore(osrBlock->lastIns(), barrier); + osrBlock->rewriteSlot(slot, barrier); + def = barrier; + } + + switch (type) { + case MIRType::Boolean: + case MIRType::Int32: + case MIRType::Double: + case MIRType::String: + case MIRType::Symbol: + case MIRType::Object: + if (type != def->type()) { + MUnbox* unbox = MUnbox::New(alloc(), def, type, MUnbox::Fallible); + osrBlock->insertBefore(osrBlock->lastIns(), unbox); + osrBlock->rewriteSlot(slot, unbox); + def = unbox; + } + break; + + case MIRType::Null: + { + MConstant* c = MConstant::New(alloc(), NullValue()); + osrBlock->insertBefore(osrBlock->lastIns(), c); + osrBlock->rewriteSlot(slot, c); + def = c; + break; + } + + case MIRType::Undefined: + { + MConstant* c = MConstant::New(alloc(), UndefinedValue()); + osrBlock->insertBefore(osrBlock->lastIns(), c); + osrBlock->rewriteSlot(slot, c); + def = c; + break; + } + + case MIRType::MagicOptimizedArguments: + MOZ_ASSERT(lazyArguments_); + osrBlock->rewriteSlot(slot, lazyArguments_); + def = lazyArguments_; + break; + + default: + break; + } + + MOZ_ASSERT(def == osrBlock->getSlot(slot)); + return true; +} + +bool +IonBuilder::maybeAddOsrTypeBarriers() +{ + if (!info().osrPc()) + return true; + + // The loop has successfully been processed, and the loop header phis + // have their final type. Add unboxes and type barriers in the OSR + // block to check that the values have the appropriate type, and update + // the types in the preheader. + + MBasicBlock* osrBlock = graph().osrBlock(); + if (!osrBlock) { + // Because IonBuilder does not compile catch blocks, it's possible to + // end up without an OSR block if the OSR pc is only reachable via a + // break-statement inside the catch block. For instance: + // + // for (;;) { + // try { + // throw 3; + // } catch(e) { + // break; + // } + // } + // while (..) { } // <= OSR here, only reachable via catch block. + // + // For now we just abort in this case. + MOZ_ASSERT(graph().hasTryBlock()); + return abort("OSR block only reachable through catch block"); + } + + MBasicBlock* preheader = osrBlock->getSuccessor(0); + MBasicBlock* header = preheader->getSuccessor(0); + static const size_t OSR_PHI_POSITION = 1; + MOZ_ASSERT(preheader->getPredecessor(OSR_PHI_POSITION) == osrBlock); + + MResumePoint* headerRp = header->entryResumePoint(); + size_t stackDepth = headerRp->stackDepth(); + MOZ_ASSERT(stackDepth == osrBlock->stackDepth()); + for (uint32_t slot = info().startArgSlot(); slot < stackDepth; slot++) { + // Aliased slots are never accessed, since they need to go through + // the callobject. The typebarriers are added there and can be + // discarded here. + if (info().isSlotAliased(slot)) + continue; + + if (!alloc().ensureBallast()) + return false; + + MInstruction* def = osrBlock->getSlot(slot)->toInstruction(); + MPhi* preheaderPhi = preheader->getSlot(slot)->toPhi(); + MPhi* headerPhi = headerRp->getOperand(slot)->toPhi(); + + MIRType type = headerPhi->type(); + TemporaryTypeSet* typeSet = headerPhi->resultTypeSet(); + + if (!addOsrValueTypeBarrier(slot, &def, type, typeSet)) + return false; + + preheaderPhi->replaceOperand(OSR_PHI_POSITION, def); + preheaderPhi->setResultType(type); + preheaderPhi->setResultTypeSet(typeSet); + } + + return true; +} + +// We try to build a control-flow graph in the order that it would be built as +// if traversing the AST. This leads to a nice ordering and lets us build SSA +// in one pass, since the bytecode is structured. +// +// We traverse the bytecode iteratively, maintaining a current basic block. +// Each basic block has a mapping of local slots to instructions, as well as a +// stack depth. As we encounter instructions we mutate this mapping in the +// current block. +// +// Things get interesting when we encounter a control structure. This can be +// either an IFEQ, downward GOTO, or a decompiler hint stashed away in source +// notes. Once we encounter such an opcode, we recover the structure of the +// control flow (its branches and bounds), and push it on a stack. +// +// As we continue traversing the bytecode, we look for points that would +// terminate the topmost control flow path pushed on the stack. These are: +// (1) The bounds of the current structure (end of a loop or join/edge of a +// branch). +// (2) A "return", "break", or "continue" statement. +// +// For (1), we expect that there is a current block in the progress of being +// built, and we complete the necessary edges in the CFG. For (2), we expect +// that there is no active block. +// +// For normal diamond join points, we construct Phi nodes as we add +// predecessors. For loops, care must be taken to propagate Phi nodes back +// through uses in the loop body. +bool +IonBuilder::traverseBytecode() +{ + for (;;) { + MOZ_ASSERT(pc < info().limitPC()); + + for (;;) { + if (!alloc().ensureBallast()) + return false; + + // Check if we've hit an expected join point or edge in the bytecode. + // Leaving one control structure could place us at the edge of another, + // thus |while| instead of |if| so we don't skip any opcodes. + MOZ_ASSERT_IF(!cfgStack_.empty(), cfgStack_.back().stopAt >= pc); + if (!cfgStack_.empty() && cfgStack_.back().stopAt == pc) { + ControlStatus status = processCfgStack(); + if (status == ControlStatus_Error) + return false; + if (status == ControlStatus_Abort) + return abort("Aborted while processing control flow"); + if (!current) + return true; + continue; + } + + // Some opcodes need to be handled early because they affect control + // flow, terminating the current basic block and/or instructing the + // traversal algorithm to continue from a new pc. + // + // (1) If the opcode does not affect control flow, then the opcode + // is inspected and transformed to IR. This is the process_opcode + // label. + // (2) A loop could be detected via a forward GOTO. In this case, + // we don't want to process the GOTO, but the following + // instruction. + // (3) A RETURN, STOP, BREAK, or CONTINUE may require processing the + // CFG stack to terminate open branches. + // + // Similar to above, snooping control flow could land us at another + // control flow point, so we iterate until it's time to inspect a real + // opcode. + ControlStatus status; + if ((status = snoopControlFlow(JSOp(*pc))) == ControlStatus_None) + break; + if (status == ControlStatus_Error) + return false; + if (status == ControlStatus_Abort) + return abort("Aborted while processing control flow"); + if (!current) + return true; + } + +#ifdef DEBUG + // In debug builds, after compiling this op, check that all values + // popped by this opcode either: + // + // (1) Have the ImplicitlyUsed flag set on them. + // (2) Have more uses than before compiling this op (the value is + // used as operand of a new MIR instruction). + // + // This is used to catch problems where IonBuilder pops a value without + // adding any SSA uses and doesn't call setImplicitlyUsedUnchecked on it. + Vector<MDefinition*, 4, JitAllocPolicy> popped(alloc()); + Vector<size_t, 4, JitAllocPolicy> poppedUses(alloc()); + unsigned nuses = GetUseCount(script_, script_->pcToOffset(pc)); + + for (unsigned i = 0; i < nuses; i++) { + MDefinition* def = current->peek(-int32_t(i + 1)); + if (!popped.append(def) || !poppedUses.append(def->defUseCount())) + return false; + } +#endif + + // Nothing in inspectOpcode() is allowed to advance the pc. + JSOp op = JSOp(*pc); + if (!inspectOpcode(op)) + return false; + +#ifdef DEBUG + for (size_t i = 0; i < popped.length(); i++) { + switch (op) { + case JSOP_POP: + case JSOP_POPN: + case JSOP_DUPAT: + case JSOP_DUP: + case JSOP_DUP2: + case JSOP_PICK: + case JSOP_SWAP: + case JSOP_SETARG: + case JSOP_SETLOCAL: + case JSOP_INITLEXICAL: + case JSOP_SETRVAL: + case JSOP_VOID: + // Don't require SSA uses for values popped by these ops. + break; + + case JSOP_POS: + case JSOP_TOID: + case JSOP_TOSTRING: + // These ops may leave their input on the stack without setting + // the ImplicitlyUsed flag. If this value will be popped immediately, + // we may replace it with |undefined|, but the difference is + // not observable. + MOZ_ASSERT(i == 0); + if (current->peek(-1) == popped[0]) + break; + MOZ_FALLTHROUGH; + + default: + MOZ_ASSERT(popped[i]->isImplicitlyUsed() || + + // MNewDerivedTypedObject instances are + // often dead unless they escape from the + // fn. See IonBuilder::loadTypedObjectData() + // for more details. + popped[i]->isNewDerivedTypedObject() || + + popped[i]->defUseCount() > poppedUses[i]); + break; + } + } +#endif + + pc += CodeSpec[op].length; + current->updateTrackedSite(bytecodeSite(pc)); + } + + return true; +} + +IonBuilder::ControlStatus +IonBuilder::snoopControlFlow(JSOp op) +{ + switch (op) { + case JSOP_NOP: + return maybeLoop(op, info().getNote(gsn, pc)); + + case JSOP_POP: + return maybeLoop(op, info().getNote(gsn, pc)); + + case JSOP_RETURN: + case JSOP_RETRVAL: + return processReturn(op); + + case JSOP_THROW: + return processThrow(); + + case JSOP_GOTO: + { + jssrcnote* sn = info().getNote(gsn, pc); + switch (sn ? SN_TYPE(sn) : SRC_NULL) { + case SRC_BREAK: + case SRC_BREAK2LABEL: + return processBreak(op, sn); + + case SRC_CONTINUE: + return processContinue(op); + + case SRC_SWITCHBREAK: + return processSwitchBreak(op); + + case SRC_WHILE: + case SRC_FOR_IN: + case SRC_FOR_OF: + // while (cond) { } + return whileOrForInLoop(sn); + + default: + // Hard assert for now - make an error later. + MOZ_CRASH("unknown goto case"); + } + break; + } + + case JSOP_TABLESWITCH: + return tableSwitch(op, info().getNote(gsn, pc)); + + case JSOP_IFNE: + // We should never reach an IFNE, it's a stopAt point, which will + // trigger closing the loop. + MOZ_CRASH("we should never reach an ifne!"); + + default: + break; + } + return ControlStatus_None; +} + +bool +IonBuilder::inspectOpcode(JSOp op) +{ + MOZ_ASSERT(analysis_.maybeInfo(pc), "Compiling unreachable op"); + + switch (op) { + case JSOP_NOP: + case JSOP_NOP_DESTRUCTURING: + case JSOP_LINENO: + case JSOP_LOOPENTRY: + case JSOP_JUMPTARGET: + return true; + + case JSOP_LABEL: + return jsop_label(); + + case JSOP_UNDEFINED: + // If this ever changes, change what JSOP_GIMPLICITTHIS does too. + pushConstant(UndefinedValue()); + return true; + + case JSOP_IFEQ: + return jsop_ifeq(JSOP_IFEQ); + + case JSOP_TRY: + return jsop_try(); + + case JSOP_CONDSWITCH: + return jsop_condswitch(); + + case JSOP_BITNOT: + return jsop_bitnot(); + + case JSOP_BITAND: + case JSOP_BITOR: + case JSOP_BITXOR: + case JSOP_LSH: + case JSOP_RSH: + case JSOP_URSH: + return jsop_bitop(op); + + case JSOP_ADD: + case JSOP_SUB: + case JSOP_MUL: + case JSOP_DIV: + case JSOP_MOD: + return jsop_binary_arith(op); + + case JSOP_POW: + return jsop_pow(); + + case JSOP_POS: + return jsop_pos(); + + case JSOP_NEG: + return jsop_neg(); + + case JSOP_TOSTRING: + return jsop_tostring(); + + case JSOP_AND: + case JSOP_OR: + return jsop_andor(op); + + case JSOP_DEFVAR: + return jsop_defvar(GET_UINT32_INDEX(pc)); + + case JSOP_DEFLET: + case JSOP_DEFCONST: + return jsop_deflexical(GET_UINT32_INDEX(pc)); + + case JSOP_DEFFUN: + return jsop_deffun(GET_UINT32_INDEX(pc)); + + case JSOP_EQ: + case JSOP_NE: + case JSOP_STRICTEQ: + case JSOP_STRICTNE: + case JSOP_LT: + case JSOP_LE: + case JSOP_GT: + case JSOP_GE: + return jsop_compare(op); + + case JSOP_DOUBLE: + pushConstant(info().getConst(pc)); + return true; + + case JSOP_STRING: + pushConstant(StringValue(info().getAtom(pc))); + return true; + + case JSOP_SYMBOL: { + unsigned which = GET_UINT8(pc); + JS::Symbol* sym = compartment->runtime()->wellKnownSymbols().get(which); + pushConstant(SymbolValue(sym)); + return true; + } + + case JSOP_ZERO: + pushConstant(Int32Value(0)); + return true; + + case JSOP_ONE: + pushConstant(Int32Value(1)); + return true; + + case JSOP_NULL: + pushConstant(NullValue()); + return true; + + case JSOP_VOID: + current->pop(); + pushConstant(UndefinedValue()); + return true; + + case JSOP_HOLE: + pushConstant(MagicValue(JS_ELEMENTS_HOLE)); + return true; + + case JSOP_FALSE: + pushConstant(BooleanValue(false)); + return true; + + case JSOP_TRUE: + pushConstant(BooleanValue(true)); + return true; + + case JSOP_ARGUMENTS: + return jsop_arguments(); + + case JSOP_RUNONCE: + return jsop_runonce(); + + case JSOP_REST: + return jsop_rest(); + + case JSOP_GETARG: + if (info().argsObjAliasesFormals()) { + MGetArgumentsObjectArg* getArg = MGetArgumentsObjectArg::New(alloc(), + current->argumentsObject(), + GET_ARGNO(pc)); + current->add(getArg); + current->push(getArg); + } else { + current->pushArg(GET_ARGNO(pc)); + } + return true; + + case JSOP_SETARG: + return jsop_setarg(GET_ARGNO(pc)); + + case JSOP_GETLOCAL: + current->pushLocal(GET_LOCALNO(pc)); + return true; + + case JSOP_SETLOCAL: + current->setLocal(GET_LOCALNO(pc)); + return true; + + case JSOP_THROWSETCONST: + case JSOP_THROWSETALIASEDCONST: + case JSOP_THROWSETCALLEE: + return jsop_throwsetconst(); + + case JSOP_CHECKLEXICAL: + return jsop_checklexical(); + + case JSOP_INITLEXICAL: + current->setLocal(GET_LOCALNO(pc)); + return true; + + case JSOP_INITGLEXICAL: { + MOZ_ASSERT(!script()->hasNonSyntacticScope()); + MDefinition* value = current->pop(); + current->push(constant(ObjectValue(script()->global().lexicalEnvironment()))); + current->push(value); + return jsop_setprop(info().getAtom(pc)->asPropertyName()); + } + + case JSOP_CHECKALIASEDLEXICAL: + return jsop_checkaliasedlexical(EnvironmentCoordinate(pc)); + + case JSOP_INITALIASEDLEXICAL: + return jsop_setaliasedvar(EnvironmentCoordinate(pc)); + + case JSOP_UNINITIALIZED: + pushConstant(MagicValue(JS_UNINITIALIZED_LEXICAL)); + return true; + + case JSOP_POP: { + MDefinition* def = current->pop(); + + // POP opcodes frequently appear where values are killed, e.g. after + // SET* opcodes. Place a resume point afterwards to avoid capturing + // the dead value in later snapshots, except in places where that + // resume point is obviously unnecessary. + if (pc[JSOP_POP_LENGTH] == JSOP_POP) + return true; + if (def->isConstant()) + return true; + return maybeInsertResume(); + } + + case JSOP_POPN: + for (uint32_t i = 0, n = GET_UINT16(pc); i < n; i++) + current->pop(); + return true; + + case JSOP_DUPAT: + current->pushSlot(current->stackDepth() - 1 - GET_UINT24(pc)); + return true; + + case JSOP_NEWINIT: + if (GET_UINT8(pc) == JSProto_Array) + return jsop_newarray(0); + return jsop_newobject(); + + case JSOP_NEWARRAY: + return jsop_newarray(GET_UINT32(pc)); + + case JSOP_NEWARRAY_COPYONWRITE: + return jsop_newarray_copyonwrite(); + + case JSOP_NEWOBJECT: + return jsop_newobject(); + + case JSOP_INITELEM: + case JSOP_INITHIDDENELEM: + return jsop_initelem(); + + case JSOP_INITELEM_ARRAY: + return jsop_initelem_array(); + + case JSOP_INITPROP: + case JSOP_INITLOCKEDPROP: + case JSOP_INITHIDDENPROP: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_initprop(name); + } + + case JSOP_MUTATEPROTO: + { + return jsop_mutateproto(); + } + + case JSOP_INITPROP_GETTER: + case JSOP_INITHIDDENPROP_GETTER: + case JSOP_INITPROP_SETTER: + case JSOP_INITHIDDENPROP_SETTER: { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_initprop_getter_setter(name); + } + + case JSOP_INITELEM_GETTER: + case JSOP_INITHIDDENELEM_GETTER: + case JSOP_INITELEM_SETTER: + case JSOP_INITHIDDENELEM_SETTER: + return jsop_initelem_getter_setter(); + + case JSOP_FUNCALL: + return jsop_funcall(GET_ARGC(pc)); + + case JSOP_FUNAPPLY: + return jsop_funapply(GET_ARGC(pc)); + + case JSOP_CALL: + case JSOP_CALLITER: + case JSOP_NEW: + case JSOP_SUPERCALL: + return jsop_call(GET_ARGC(pc), (JSOp)*pc == JSOP_NEW || (JSOp)*pc == JSOP_SUPERCALL); + + case JSOP_EVAL: + case JSOP_STRICTEVAL: + return jsop_eval(GET_ARGC(pc)); + + case JSOP_INT8: + pushConstant(Int32Value(GET_INT8(pc))); + return true; + + case JSOP_UINT16: + pushConstant(Int32Value(GET_UINT16(pc))); + return true; + + case JSOP_GETGNAME: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + if (!script()->hasNonSyntacticScope()) + return jsop_getgname(name); + return jsop_getname(name); + } + + case JSOP_SETGNAME: + case JSOP_STRICTSETGNAME: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + JSObject* obj = nullptr; + if (!script()->hasNonSyntacticScope()) + obj = testGlobalLexicalBinding(name); + if (obj) + return setStaticName(obj, name); + return jsop_setprop(name); + } + + case JSOP_GETNAME: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_getname(name); + } + + case JSOP_GETINTRINSIC: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_intrinsic(name); + } + + case JSOP_GETIMPORT: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_getimport(name); + } + + case JSOP_BINDGNAME: + if (!script()->hasNonSyntacticScope()) { + if (JSObject* env = testGlobalLexicalBinding(info().getName(pc))) { + pushConstant(ObjectValue(*env)); + return true; + } + } + // Fall through to JSOP_BINDNAME + MOZ_FALLTHROUGH; + case JSOP_BINDNAME: + return jsop_bindname(info().getName(pc)); + + case JSOP_BINDVAR: + return jsop_bindvar(); + + case JSOP_DUP: + current->pushSlot(current->stackDepth() - 1); + return true; + + case JSOP_DUP2: + return jsop_dup2(); + + case JSOP_SWAP: + current->swapAt(-1); + return true; + + case JSOP_PICK: + current->pick(-GET_INT8(pc)); + return true; + + case JSOP_GETALIASEDVAR: + return jsop_getaliasedvar(EnvironmentCoordinate(pc)); + + case JSOP_SETALIASEDVAR: + return jsop_setaliasedvar(EnvironmentCoordinate(pc)); + + case JSOP_UINT24: + pushConstant(Int32Value(GET_UINT24(pc))); + return true; + + case JSOP_INT32: + pushConstant(Int32Value(GET_INT32(pc))); + return true; + + case JSOP_LOOPHEAD: + // JSOP_LOOPHEAD is handled when processing the loop header. + MOZ_CRASH("JSOP_LOOPHEAD outside loop"); + + case JSOP_GETELEM: + case JSOP_CALLELEM: + if (!jsop_getelem()) + return false; + if (op == JSOP_CALLELEM && !improveThisTypesForCall()) + return false; + return true; + + case JSOP_SETELEM: + case JSOP_STRICTSETELEM: + return jsop_setelem(); + + case JSOP_LENGTH: + return jsop_length(); + + case JSOP_NOT: + return jsop_not(); + + case JSOP_FUNCTIONTHIS: + return jsop_functionthis(); + + case JSOP_GLOBALTHIS: + return jsop_globalthis(); + + case JSOP_CALLEE: { + MDefinition* callee = getCallee(); + current->push(callee); + return true; + } + + case JSOP_GETPROP: + case JSOP_CALLPROP: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + if (!jsop_getprop(name)) + return false; + if (op == JSOP_CALLPROP && !improveThisTypesForCall()) + return false; + return true; + } + + case JSOP_SETPROP: + case JSOP_STRICTSETPROP: + case JSOP_SETNAME: + case JSOP_STRICTSETNAME: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_setprop(name); + } + + case JSOP_DELPROP: + case JSOP_STRICTDELPROP: + { + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_delprop(name); + } + + case JSOP_DELELEM: + case JSOP_STRICTDELELEM: + return jsop_delelem(); + + case JSOP_REGEXP: + return jsop_regexp(info().getRegExp(pc)); + + case JSOP_CALLSITEOBJ: + pushConstant(ObjectValue(*(info().getObject(pc)))); + return true; + + case JSOP_OBJECT: + return jsop_object(info().getObject(pc)); + + case JSOP_TYPEOF: + case JSOP_TYPEOFEXPR: + return jsop_typeof(); + + case JSOP_TOASYNC: + return jsop_toasync(); + + case JSOP_TOID: + return jsop_toid(); + + case JSOP_LAMBDA: + return jsop_lambda(info().getFunction(pc)); + + case JSOP_LAMBDA_ARROW: + return jsop_lambda_arrow(info().getFunction(pc)); + + case JSOP_ITER: + return jsop_iter(GET_INT8(pc)); + + case JSOP_MOREITER: + return jsop_itermore(); + + case JSOP_ISNOITER: + return jsop_isnoiter(); + + case JSOP_ENDITER: + return jsop_iterend(); + + case JSOP_IN: + return jsop_in(); + + case JSOP_SETRVAL: + MOZ_ASSERT(!script()->noScriptRval()); + current->setSlot(info().returnValueSlot(), current->pop()); + return true; + + case JSOP_INSTANCEOF: + return jsop_instanceof(); + + case JSOP_DEBUGLEAVELEXICALENV: + return true; + + case JSOP_DEBUGGER: + return jsop_debugger(); + + case JSOP_GIMPLICITTHIS: + if (!script()->hasNonSyntacticScope()) { + pushConstant(UndefinedValue()); + return true; + } + + // Just fall through to the unsupported bytecode case. + break; + + case JSOP_NEWTARGET: + return jsop_newtarget(); + + case JSOP_CHECKISOBJ: + return jsop_checkisobj(GET_UINT8(pc)); + + case JSOP_CHECKOBJCOERCIBLE: + return jsop_checkobjcoercible(); + + case JSOP_DEBUGCHECKSELFHOSTED: + { +#ifdef DEBUG + MDebugCheckSelfHosted* check = MDebugCheckSelfHosted::New(alloc(), current->pop()); + current->add(check); + current->push(check); + if (!resumeAfter(check)) + return false; +#endif + return true; + } + + case JSOP_IS_CONSTRUCTING: + pushConstant(MagicValue(JS_IS_CONSTRUCTING)); + return true; + +#ifdef DEBUG + case JSOP_PUSHLEXICALENV: + case JSOP_FRESHENLEXICALENV: + case JSOP_RECREATELEXICALENV: + case JSOP_POPLEXICALENV: + // These opcodes are currently unhandled by Ion, but in principle + // there's no reason they couldn't be. Whenever this happens, OSR + // will have to consider that JSOP_{FRESHEN,RECREATE}LEXICALENV + // mutates the env chain -- right now MBasicBlock::environmentChain() + // caches the env chain. JSOP_{FRESHEN,RECREATE}LEXICALENV must + // update that stale value. +#endif + default: + break; + } + + // Track a simpler message, since the actionable abort message is a + // static string, and the internal opcode name isn't an actionable + // thing anyways. + trackActionableAbort("Unsupported bytecode"); +#ifdef DEBUG + return abort("Unsupported opcode: %s", CodeName[op]); +#else + return abort("Unsupported opcode: %d", op); +#endif +} + +// Given that the current control flow structure has ended forcefully, +// via a return, break, or continue (rather than joining), propagate the +// termination up. For example, a return nested 5 loops deep may terminate +// every outer loop at once, if there are no intervening conditionals: +// +// for (...) { +// for (...) { +// return x; +// } +// } +// +// If |current| is nullptr when this function returns, then there is no more +// control flow to be processed. +IonBuilder::ControlStatus +IonBuilder::processControlEnd() +{ + MOZ_ASSERT(!current); + + if (cfgStack_.empty()) { + // If there is no more control flow to process, then this is the + // last return in the function. + return ControlStatus_Ended; + } + + return processCfgStack(); +} + +// Processes the top of the CFG stack. This is used from two places: +// (1) processControlEnd(), whereby a break, continue, or return may interrupt +// an in-progress CFG structure before reaching its actual termination +// point in the bytecode. +// (2) traverseBytecode(), whereby we reach the last instruction in a CFG +// structure. +IonBuilder::ControlStatus +IonBuilder::processCfgStack() +{ + ControlStatus status = processCfgEntry(cfgStack_.back()); + + // If this terminated a CFG structure, act like processControlEnd() and + // keep propagating upward. + while (status == ControlStatus_Ended) { + popCfgStack(); + if (cfgStack_.empty()) + return status; + status = processCfgEntry(cfgStack_.back()); + } + + // If some join took place, the current structure is finished. + if (status == ControlStatus_Joined) + popCfgStack(); + + return status; +} + +IonBuilder::ControlStatus +IonBuilder::processCfgEntry(CFGState& state) +{ + switch (state.state) { + case CFGState::IF_TRUE: + case CFGState::IF_TRUE_EMPTY_ELSE: + return processIfEnd(state); + + case CFGState::IF_ELSE_TRUE: + return processIfElseTrueEnd(state); + + case CFGState::IF_ELSE_FALSE: + return processIfElseFalseEnd(state); + + case CFGState::DO_WHILE_LOOP_BODY: + return processDoWhileBodyEnd(state); + + case CFGState::DO_WHILE_LOOP_COND: + return processDoWhileCondEnd(state); + + case CFGState::WHILE_LOOP_COND: + return processWhileCondEnd(state); + + case CFGState::WHILE_LOOP_BODY: + return processWhileBodyEnd(state); + + case CFGState::FOR_LOOP_COND: + return processForCondEnd(state); + + case CFGState::FOR_LOOP_BODY: + return processForBodyEnd(state); + + case CFGState::FOR_LOOP_UPDATE: + return processForUpdateEnd(state); + + case CFGState::TABLE_SWITCH: + return processNextTableSwitchCase(state); + + case CFGState::COND_SWITCH_CASE: + return processCondSwitchCase(state); + + case CFGState::COND_SWITCH_BODY: + return processCondSwitchBody(state); + + case CFGState::AND_OR: + return processAndOrEnd(state); + + case CFGState::LABEL: + return processLabelEnd(state); + + case CFGState::TRY: + return processTryEnd(state); + + default: + MOZ_CRASH("unknown cfgstate"); + } +} + +IonBuilder::ControlStatus +IonBuilder::processIfEnd(CFGState& state) +{ + bool thenBranchTerminated = !current; + if (!thenBranchTerminated) { + // Here, the false block is the join point. Create an edge from the + // current block to the false block. Note that a RETURN opcode + // could have already ended the block. + current->end(MGoto::New(alloc(), state.branch.ifFalse)); + + if (!state.branch.ifFalse->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + if (!setCurrentAndSpecializePhis(state.branch.ifFalse)) + return ControlStatus_Error; + graph().moveBlockToEnd(current); + pc = current->pc(); + + if (thenBranchTerminated) { + // If we can't reach here via the then-branch, we can filter the types + // after the if-statement based on the if-condition. + MTest* test = state.branch.test; + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return ControlStatus_Error; + } + + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::processIfElseTrueEnd(CFGState& state) +{ + // We've reached the end of the true branch of an if-else. Don't + // create an edge yet, just transition to parsing the false branch. + state.state = CFGState::IF_ELSE_FALSE; + state.branch.ifTrue = current; + state.stopAt = state.branch.falseEnd; + pc = state.branch.ifFalse->pc(); + if (!setCurrentAndSpecializePhis(state.branch.ifFalse)) + return ControlStatus_Error; + graph().moveBlockToEnd(current); + + MTest* test = state.branch.test; + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return ControlStatus_Error; + + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processIfElseFalseEnd(CFGState& state) +{ + // Update the state to have the latest block from the false path. + state.branch.ifFalse = current; + + // To create the join node, we need an incoming edge that has not been + // terminated yet. + MBasicBlock* pred = state.branch.ifTrue + ? state.branch.ifTrue + : state.branch.ifFalse; + MBasicBlock* other = (pred == state.branch.ifTrue) ? state.branch.ifFalse : state.branch.ifTrue; + + if (!pred) + return ControlStatus_Ended; + + // Create a new block to represent the join. + MBasicBlock* join = newBlock(pred, state.branch.falseEnd); + if (!join) + return ControlStatus_Error; + + // Create edges from the true and false blocks as needed. + pred->end(MGoto::New(alloc(), join)); + + if (other) { + other->end(MGoto::New(alloc(), join)); + if (!join->addPredecessor(alloc(), other)) + return ControlStatus_Error; + } + + // Ignore unreachable remainder of false block if existent. + if (!setCurrentAndSpecializePhis(join)) + return ControlStatus_Error; + pc = current->pc(); + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::processBrokenLoop(CFGState& state) +{ + MOZ_ASSERT(!current); + + MOZ_ASSERT(loopDepth_); + loopDepth_--; + + // A broken loop is not a real loop (it has no header or backedge), so + // reset the loop depth. + for (MBasicBlockIterator i(graph().begin(state.loop.entry)); i != graph().end(); i++) { + if (i->loopDepth() > loopDepth_) + i->setLoopDepth(i->loopDepth() - 1); + } + + // If the loop started with a condition (while/for) then even if the + // structure never actually loops, the condition itself can still fail and + // thus we must resume at the successor, if one exists. + if (!setCurrentAndSpecializePhis(state.loop.successor)) + return ControlStatus_Error; + if (current) { + MOZ_ASSERT(current->loopDepth() == loopDepth_); + graph().moveBlockToEnd(current); + } + + // Join the breaks together and continue parsing. + if (state.loop.breaks) { + MBasicBlock* block = createBreakCatchBlock(state.loop.breaks, state.loop.exitpc); + if (!block) + return ControlStatus_Error; + + if (current) { + current->end(MGoto::New(alloc(), block)); + if (!block->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + if (!setCurrentAndSpecializePhis(block)) + return ControlStatus_Error; + } + + // If the loop is not gated on a condition, and has only returns, we'll + // reach this case. For example: + // do { ... return; } while (); + if (!current) + return ControlStatus_Ended; + + // Otherwise, the loop is gated on a condition and/or has breaks so keep + // parsing at the successor. + pc = current->pc(); + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::finishLoop(CFGState& state, MBasicBlock* successor) +{ + MOZ_ASSERT(current); + + MOZ_ASSERT(loopDepth_); + loopDepth_--; + MOZ_ASSERT_IF(successor, successor->loopDepth() == loopDepth_); + + // Compute phis in the loop header and propagate them throughout the loop, + // including the successor. + AbortReason r = state.loop.entry->setBackedge(alloc(), current); + if (r == AbortReason_Alloc) + return ControlStatus_Error; + if (r == AbortReason_Disable) { + // If there are types for variables on the backedge that were not + // present at the original loop header, then uses of the variables' + // phis may have generated incorrect nodes. The new types have been + // incorporated into the header phis, so remove all blocks for the + // loop body and restart with the new types. + return restartLoop(state); + } + + if (successor) { + graph().moveBlockToEnd(successor); + successor->inheritPhis(state.loop.entry); + } + + if (state.loop.breaks) { + // Propagate phis placed in the header to individual break exit points. + DeferredEdge* edge = state.loop.breaks; + while (edge) { + edge->block->inheritPhis(state.loop.entry); + edge = edge->next; + } + + // Create a catch block to join all break exits. + MBasicBlock* block = createBreakCatchBlock(state.loop.breaks, state.loop.exitpc); + if (!block) + return ControlStatus_Error; + + if (successor) { + // Finally, create an unconditional edge from the successor to the + // catch block. + successor->end(MGoto::New(alloc(), block)); + if (!block->addPredecessor(alloc(), successor)) + return ControlStatus_Error; + } + successor = block; + } + + if (!setCurrentAndSpecializePhis(successor)) + return ControlStatus_Error; + + // An infinite loop (for (;;) { }) will not have a successor. + if (!current) + return ControlStatus_Ended; + + pc = current->pc(); + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::restartLoop(const CFGState& state) +{ + AutoTraceLog logCompile(traceLogger(), TraceLogger_IonBuilderRestartLoop); + + spew("New types at loop header, restarting loop body"); + + if (JitOptions.limitScriptSize) { + if (++numLoopRestarts_ >= MAX_LOOP_RESTARTS) + return ControlStatus_Abort; + } + + MBasicBlock* header = state.loop.entry; + + // Discard unreferenced & pre-allocated resume points. + replaceMaybeFallbackFunctionGetter(nullptr); + + // Remove all blocks in the loop body other than the header, which has phis + // of the appropriate type and incoming edges to preserve. + graph().removeBlocksAfter(header); + + // Remove all instructions from the header itself, and all resume points + // except the entry resume point. + header->discardAllInstructions(); + header->discardAllResumePoints(/* discardEntry = */ false); + header->setStackDepth(header->getPredecessor(0)->stackDepth()); + + popCfgStack(); + + loopDepth_++; + + // Keep a local copy for these pointers since state will be overwritten in + // pushLoop since state is a reference to cfgStack_.back() + jsbytecode* condpc = state.loop.condpc; + jsbytecode* updatepc = state.loop.updatepc; + jsbytecode* updateEnd = state.loop.updateEnd; + + if (!pushLoop(state.loop.initialState, state.loop.initialStopAt, header, state.loop.osr, + state.loop.loopHead, state.loop.initialPc, + state.loop.bodyStart, state.loop.bodyEnd, + state.loop.exitpc, state.loop.continuepc)) + { + return ControlStatus_Error; + } + + CFGState& nstate = cfgStack_.back(); + + nstate.loop.condpc = condpc; + nstate.loop.updatepc = updatepc; + nstate.loop.updateEnd = updateEnd; + + // Don't specializePhis(), as the header has been visited before and the + // phis have already had their type set. + setCurrent(header); + + if (!jsop_loophead(nstate.loop.loopHead)) + return ControlStatus_Error; + + pc = nstate.loop.initialPc; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processDoWhileBodyEnd(CFGState& state) +{ + if (!processDeferredContinues(state)) + return ControlStatus_Error; + + // No current means control flow cannot reach the condition, so this will + // never loop. + if (!current) + return processBrokenLoop(state); + + MBasicBlock* header = newBlock(current, state.loop.updatepc); + if (!header) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), header)); + + state.state = CFGState::DO_WHILE_LOOP_COND; + state.stopAt = state.loop.updateEnd; + pc = state.loop.updatepc; + if (!setCurrentAndSpecializePhis(header)) + return ControlStatus_Error; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processDoWhileCondEnd(CFGState& state) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_IFNE); + + // We're guaranteed a |current|, it's impossible to break or return from + // inside the conditional expression. + MOZ_ASSERT(current); + + // Pop the last value, and create the successor block. + MDefinition* vins = current->pop(); + MBasicBlock* successor = newBlock(current, GetNextPc(pc), loopDepth_ - 1); + if (!successor) + return ControlStatus_Error; + + // Test for do {} while(false) and don't create a loop in that case. + if (MConstant* vinsConst = vins->maybeConstantValue()) { + bool b; + if (vinsConst->valueToBoolean(&b) && !b) { + current->end(MGoto::New(alloc(), successor)); + current = nullptr; + + state.loop.successor = successor; + return processBrokenLoop(state); + } + } + + // Create the test instruction and end the current block. + MTest* test = newTest(vins, state.loop.entry, successor); + current->end(test); + return finishLoop(state, successor); +} + +IonBuilder::ControlStatus +IonBuilder::processWhileCondEnd(CFGState& state) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_IFNE || JSOp(*pc) == JSOP_IFEQ); + + // Balance the stack past the IFNE. + MDefinition* ins = current->pop(); + + // Create the body and successor blocks. + MBasicBlock* body = newBlock(current, state.loop.bodyStart); + state.loop.successor = newBlock(current, state.loop.exitpc, loopDepth_ - 1); + if (!body || !state.loop.successor) + return ControlStatus_Error; + + MTest* test; + if (JSOp(*pc) == JSOP_IFNE) + test = newTest(ins, body, state.loop.successor); + else + test = newTest(ins, state.loop.successor, body); + current->end(test); + + state.state = CFGState::WHILE_LOOP_BODY; + state.stopAt = state.loop.bodyEnd; + pc = state.loop.bodyStart; + if (!setCurrentAndSpecializePhis(body)) + return ControlStatus_Error; + + // Filter the types in the loop body. + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return ControlStatus_Error; + + // If this is a for-in loop, unbox the current value as string if possible. + if (ins->isIsNoIter()) { + MIteratorMore* iterMore = ins->toIsNoIter()->input()->toIteratorMore(); + jsbytecode* iterMorePc = iterMore->resumePoint()->pc(); + MOZ_ASSERT(*iterMorePc == JSOP_MOREITER); + + if (!nonStringIteration_ && !inspector->hasSeenNonStringIterMore(iterMorePc)) { + MDefinition* val = current->peek(-1); + MOZ_ASSERT(val == iterMore); + MInstruction* ins = MUnbox::New(alloc(), val, MIRType::String, MUnbox::Fallible, + Bailout_NonStringInputInvalidate); + current->add(ins); + current->rewriteAtDepth(-1, ins); + } + } + + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processWhileBodyEnd(CFGState& state) +{ + if (!processDeferredContinues(state)) + return ControlStatus_Error; + + if (!current) + return processBrokenLoop(state); + + current->end(MGoto::New(alloc(), state.loop.entry)); + return finishLoop(state, state.loop.successor); +} + +IonBuilder::ControlStatus +IonBuilder::processForCondEnd(CFGState& state) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_IFNE); + + // Balance the stack past the IFNE. + MDefinition* ins = current->pop(); + + // Create the body and successor blocks. + MBasicBlock* body = newBlock(current, state.loop.bodyStart); + state.loop.successor = newBlock(current, state.loop.exitpc, loopDepth_ - 1); + if (!body || !state.loop.successor) + return ControlStatus_Error; + + MTest* test = newTest(ins, body, state.loop.successor); + current->end(test); + + state.state = CFGState::FOR_LOOP_BODY; + state.stopAt = state.loop.bodyEnd; + pc = state.loop.bodyStart; + if (!setCurrentAndSpecializePhis(body)) + return ControlStatus_Error; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processForBodyEnd(CFGState& state) +{ + if (!processDeferredContinues(state)) + return ControlStatus_Error; + + // If there is no updatepc, just go right to processing what would be the + // end of the update clause. Otherwise, |current| might be nullptr; if this is + // the case, the udpate is unreachable anyway. + if (!state.loop.updatepc || !current) + return processForUpdateEnd(state); + + pc = state.loop.updatepc; + + state.state = CFGState::FOR_LOOP_UPDATE; + state.stopAt = state.loop.updateEnd; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processForUpdateEnd(CFGState& state) +{ + // If there is no current, we couldn't reach the loop edge and there was no + // update clause. + if (!current) + return processBrokenLoop(state); + + current->end(MGoto::New(alloc(), state.loop.entry)); + return finishLoop(state, state.loop.successor); +} + +IonBuilder::DeferredEdge* +IonBuilder::filterDeadDeferredEdges(DeferredEdge* edge) +{ + DeferredEdge* head = edge; + DeferredEdge* prev = nullptr; + + while (edge) { + if (edge->block->isDead()) { + if (prev) + prev->next = edge->next; + else + head = edge->next; + } else { + prev = edge; + } + edge = edge->next; + } + + // There must be at least one deferred edge from a block that was not + // deleted; blocks are deleted when restarting processing of a loop, and + // the final version of the loop body will have edges from live blocks. + MOZ_ASSERT(head); + + return head; +} + +bool +IonBuilder::processDeferredContinues(CFGState& state) +{ + // If there are any continues for this loop, and there is an update block, + // then we need to create a new basic block to house the update. + if (state.loop.continues) { + DeferredEdge* edge = filterDeadDeferredEdges(state.loop.continues); + + MBasicBlock* update = newBlock(edge->block, loops_.back().continuepc); + if (!update) + return false; + + if (current) { + current->end(MGoto::New(alloc(), update)); + if (!update->addPredecessor(alloc(), current)) + return false; + } + + // No need to use addPredecessor for first edge, + // because it is already predecessor. + edge->block->end(MGoto::New(alloc(), update)); + edge = edge->next; + + // Remaining edges + while (edge) { + edge->block->end(MGoto::New(alloc(), update)); + if (!update->addPredecessor(alloc(), edge->block)) + return false; + edge = edge->next; + } + state.loop.continues = nullptr; + + if (!setCurrentAndSpecializePhis(update)) + return ControlStatus_Error; + } + + return true; +} + +MBasicBlock* +IonBuilder::createBreakCatchBlock(DeferredEdge* edge, jsbytecode* pc) +{ + edge = filterDeadDeferredEdges(edge); + + // Create block, using the first break statement as predecessor + MBasicBlock* successor = newBlock(edge->block, pc); + if (!successor) + return nullptr; + + // No need to use addPredecessor for first edge, + // because it is already predecessor. + edge->block->end(MGoto::New(alloc(), successor)); + edge = edge->next; + + // Finish up remaining breaks. + while (edge) { + MGoto* brk = MGoto::New(alloc().fallible(), successor); + if (!brk) + return nullptr; + edge->block->end(brk); + if (!successor->addPredecessor(alloc(), edge->block)) + return nullptr; + edge = edge->next; + } + + return successor; +} + +IonBuilder::ControlStatus +IonBuilder::processNextTableSwitchCase(CFGState& state) +{ + MOZ_ASSERT(state.state == CFGState::TABLE_SWITCH); + + state.tableswitch.currentBlock++; + + // Test if there are still unprocessed successors (cases/default) + if (state.tableswitch.currentBlock >= state.tableswitch.ins->numBlocks()) + return processSwitchEnd(state.tableswitch.breaks, state.tableswitch.exitpc); + + // Get the next successor + MBasicBlock* successor = state.tableswitch.ins->getBlock(state.tableswitch.currentBlock); + + // Add current block as predecessor if available. + // This means the previous case didn't have a break statement. + // So flow will continue in this block. + if (current) { + current->end(MGoto::New(alloc(), successor)); + if (!successor->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } else { + // If this is an actual case statement, optimize by replacing the + // input to the switch case with the actual number of the case. + // This constant has been emitted when creating the case blocks. + if (state.tableswitch.ins->getDefault() != successor) { + MConstant* constant = successor->begin()->toConstant(); + for (uint32_t j = 0; j < successor->stackDepth(); j++) { + MDefinition* ins = successor->getSlot(j); + if (ins != state.tableswitch.ins->getOperand(0)) + continue; + + constant->setDependency(state.tableswitch.ins); + successor->setSlot(j, constant); + } + } + } + + // Insert successor after the current block, to maintain RPO. + graph().moveBlockToEnd(successor); + + // If this is the last successor the block should stop at the end of the tableswitch + // Else it should stop at the start of the next successor + if (state.tableswitch.currentBlock+1 < state.tableswitch.ins->numBlocks()) + state.stopAt = state.tableswitch.ins->getBlock(state.tableswitch.currentBlock+1)->pc(); + else + state.stopAt = state.tableswitch.exitpc; + + if (!setCurrentAndSpecializePhis(successor)) + return ControlStatus_Error; + pc = current->pc(); + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processAndOrEnd(CFGState& state) +{ + MOZ_ASSERT(current); + MBasicBlock* lhs = state.branch.ifFalse; + + // Create a new block to represent the join. + MBasicBlock* join = newBlock(current, state.stopAt); + if (!join) + return ControlStatus_Error; + + // End the rhs. + current->end(MGoto::New(alloc(), join)); + + // End the lhs. + lhs->end(MGoto::New(alloc(), join)); + if (!join->addPredecessor(alloc(), state.branch.ifFalse)) + return ControlStatus_Error; + + // Set the join path as current path. + if (!setCurrentAndSpecializePhis(join)) + return ControlStatus_Error; + pc = current->pc(); + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::processLabelEnd(CFGState& state) +{ + MOZ_ASSERT(state.state == CFGState::LABEL); + + // If there are no breaks and no current, controlflow is terminated. + if (!state.label.breaks && !current) + return ControlStatus_Ended; + + // If there are no breaks to this label, there's nothing to do. + if (!state.label.breaks) + return ControlStatus_Joined; + + MBasicBlock* successor = createBreakCatchBlock(state.label.breaks, state.stopAt); + if (!successor) + return ControlStatus_Error; + + if (current) { + current->end(MGoto::New(alloc(), successor)); + if (!successor->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + pc = state.stopAt; + if (!setCurrentAndSpecializePhis(successor)) + return ControlStatus_Error; + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::processTryEnd(CFGState& state) +{ + MOZ_ASSERT(state.state == CFGState::TRY); + + if (!state.try_.successor) { + MOZ_ASSERT(!current); + return ControlStatus_Ended; + } + + if (current) { + current->end(MGoto::New(alloc(), state.try_.successor)); + + if (!state.try_.successor->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + // Start parsing the code after this try-catch statement. + if (!setCurrentAndSpecializePhis(state.try_.successor)) + return ControlStatus_Error; + graph().moveBlockToEnd(current); + pc = current->pc(); + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::processBreak(JSOp op, jssrcnote* sn) +{ + MOZ_ASSERT(op == JSOP_GOTO); + + MOZ_ASSERT(SN_TYPE(sn) == SRC_BREAK || + SN_TYPE(sn) == SRC_BREAK2LABEL); + + // Find the break target. + jsbytecode* target = pc + GetJumpOffset(pc); + DebugOnly<bool> found = false; + + if (SN_TYPE(sn) == SRC_BREAK2LABEL) { + for (size_t i = labels_.length() - 1; i < labels_.length(); i--) { + CFGState& cfg = cfgStack_[labels_[i].cfgEntry]; + MOZ_ASSERT(cfg.state == CFGState::LABEL); + if (cfg.stopAt == target) { + cfg.label.breaks = new(alloc()) DeferredEdge(current, cfg.label.breaks); + found = true; + break; + } + } + } else { + for (size_t i = loops_.length() - 1; i < loops_.length(); i--) { + CFGState& cfg = cfgStack_[loops_[i].cfgEntry]; + MOZ_ASSERT(cfg.isLoop()); + if (cfg.loop.exitpc == target) { + cfg.loop.breaks = new(alloc()) DeferredEdge(current, cfg.loop.breaks); + found = true; + break; + } + } + } + + MOZ_ASSERT(found); + + setCurrent(nullptr); + pc += CodeSpec[op].length; + return processControlEnd(); +} + +static inline jsbytecode* +EffectiveContinue(jsbytecode* pc) +{ + if (JSOp(*pc) == JSOP_GOTO) + return pc + GetJumpOffset(pc); + return pc; +} + +IonBuilder::ControlStatus +IonBuilder::processContinue(JSOp op) +{ + MOZ_ASSERT(op == JSOP_GOTO); + + // Find the target loop. + CFGState* found = nullptr; + jsbytecode* target = pc + GetJumpOffset(pc); + for (size_t i = loops_.length() - 1; i < loops_.length(); i--) { + // +1 to skip JSOP_JUMPTARGET. + if (loops_[i].continuepc == target + 1 || + EffectiveContinue(loops_[i].continuepc) == target) + { + found = &cfgStack_[loops_[i].cfgEntry]; + break; + } + } + + // There must always be a valid target loop structure. If not, there's + // probably an off-by-something error in which pc we track. + MOZ_ASSERT(found); + CFGState& state = *found; + + state.loop.continues = new(alloc()) DeferredEdge(current, state.loop.continues); + + setCurrent(nullptr); + pc += CodeSpec[op].length; + return processControlEnd(); +} + +IonBuilder::ControlStatus +IonBuilder::processSwitchBreak(JSOp op) +{ + MOZ_ASSERT(op == JSOP_GOTO); + + // Find the target switch. + CFGState* found = nullptr; + jsbytecode* target = pc + GetJumpOffset(pc); + for (size_t i = switches_.length() - 1; i < switches_.length(); i--) { + if (switches_[i].continuepc == target) { + found = &cfgStack_[switches_[i].cfgEntry]; + break; + } + } + + // There must always be a valid target loop structure. If not, there's + // probably an off-by-something error in which pc we track. + MOZ_ASSERT(found); + CFGState& state = *found; + + DeferredEdge** breaks = nullptr; + switch (state.state) { + case CFGState::TABLE_SWITCH: + breaks = &state.tableswitch.breaks; + break; + case CFGState::COND_SWITCH_BODY: + breaks = &state.condswitch.breaks; + break; + default: + MOZ_CRASH("Unexpected switch state."); + } + + *breaks = new(alloc()) DeferredEdge(current, *breaks); + + setCurrent(nullptr); + pc += CodeSpec[op].length; + return processControlEnd(); +} + +IonBuilder::ControlStatus +IonBuilder::processSwitchEnd(DeferredEdge* breaks, jsbytecode* exitpc) +{ + // No break statements, no current. + // This means that control flow is cut-off from this point + // (e.g. all cases have return statements). + if (!breaks && !current) + return ControlStatus_Ended; + + // Create successor block. + // If there are breaks, create block with breaks as predecessor + // Else create a block with current as predecessor + MBasicBlock* successor = nullptr; + if (breaks) + successor = createBreakCatchBlock(breaks, exitpc); + else + successor = newBlock(current, exitpc); + + if (!successor) + return ControlStatus_Error; + + // If there is current, the current block flows into this one. + // So current is also a predecessor to this block + if (current) { + current->end(MGoto::New(alloc(), successor)); + if (breaks) { + if (!successor->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + } + + pc = exitpc; + if (!setCurrentAndSpecializePhis(successor)) + return ControlStatus_Error; + return ControlStatus_Joined; +} + +IonBuilder::ControlStatus +IonBuilder::maybeLoop(JSOp op, jssrcnote* sn) +{ + // This function looks at the opcode and source note and tries to + // determine the structure of the loop. For some opcodes, like + // POP/NOP which are not explicitly control flow, this source note is + // optional. For opcodes with control flow, like GOTO, an unrecognized + // or not-present source note is a compilation failure. + switch (op) { + case JSOP_POP: + // for (init; ; update?) ... + if (sn && SN_TYPE(sn) == SRC_FOR) { + current->pop(); + return forLoop(op, sn); + } + break; + + case JSOP_NOP: + if (sn) { + // do { } while (cond) + if (SN_TYPE(sn) == SRC_WHILE) + return doWhileLoop(op, sn); + // Build a mapping such that given a basic block, whose successor + // has a phi + + // for (; ; update?) + if (SN_TYPE(sn) == SRC_FOR) + return forLoop(op, sn); + } + break; + + default: + MOZ_CRASH("unexpected opcode"); + } + + return ControlStatus_None; +} + +void +IonBuilder::assertValidLoopHeadOp(jsbytecode* pc) +{ +#ifdef DEBUG + MOZ_ASSERT(JSOp(*pc) == JSOP_LOOPHEAD); + + // Make sure this is the next opcode after the loop header, + // unless the for loop is unconditional. + CFGState& state = cfgStack_.back(); + MOZ_ASSERT_IF((JSOp)*(state.loop.entry->pc()) == JSOP_GOTO, + GetNextPc(state.loop.entry->pc()) == pc); + + // do-while loops have a source note. + jssrcnote* sn = info().getNote(gsn, pc); + if (sn) { + jsbytecode* ifne = pc + GetSrcNoteOffset(sn, 0); + + jsbytecode* expected_ifne; + switch (state.state) { + case CFGState::DO_WHILE_LOOP_BODY: + expected_ifne = state.loop.updateEnd; + break; + + default: + MOZ_CRASH("JSOP_LOOPHEAD unexpected source note"); + } + + // Make sure this loop goes to the same ifne as the loop header's + // source notes or GOTO. + MOZ_ASSERT(ifne == expected_ifne); + } else { + MOZ_ASSERT(state.state != CFGState::DO_WHILE_LOOP_BODY); + } +#endif +} + +IonBuilder::ControlStatus +IonBuilder::doWhileLoop(JSOp op, jssrcnote* sn) +{ + // do { } while() loops have the following structure: + // NOP ; SRC_WHILE (offset to COND) + // LOOPHEAD ; SRC_WHILE (offset to IFNE) + // LOOPENTRY + // ... ; body + // ... + // COND ; start of condition + // ... + // IFNE -> ; goes to LOOPHEAD + int condition_offset = GetSrcNoteOffset(sn, 0); + jsbytecode* conditionpc = pc + condition_offset; + + jssrcnote* sn2 = info().getNote(gsn, pc+1); + int offset = GetSrcNoteOffset(sn2, 0); + jsbytecode* ifne = pc + offset + 1; + MOZ_ASSERT(ifne > pc); + + // Verify that the IFNE goes back to a loophead op. + jsbytecode* loopHead = GetNextPc(pc); + MOZ_ASSERT(JSOp(*loopHead) == JSOP_LOOPHEAD); + MOZ_ASSERT(loopHead == ifne + GetJumpOffset(ifne)); + + jsbytecode* loopEntry = GetNextPc(loopHead); + bool canOsr = LoopEntryCanIonOsr(loopEntry); + bool osr = info().hasOsrAt(loopEntry); + + if (osr) { + MBasicBlock* preheader = newOsrPreheader(current, loopEntry, pc); + if (!preheader) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), preheader)); + if (!setCurrentAndSpecializePhis(preheader)) + return ControlStatus_Error; + } + + unsigned stackPhiCount = 0; + MBasicBlock* header = newPendingLoopHeader(current, loopEntry, osr, canOsr, stackPhiCount); + if (!header) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), header)); + + jsbytecode* loophead = GetNextPc(pc); + jsbytecode* bodyStart = GetNextPc(loophead); + jsbytecode* bodyEnd = conditionpc; + jsbytecode* exitpc = GetNextPc(ifne); + if (!analyzeNewLoopTypes(header, bodyStart, exitpc)) + return ControlStatus_Error; + if (!pushLoop(CFGState::DO_WHILE_LOOP_BODY, conditionpc, header, osr, + loopHead, bodyStart, bodyStart, bodyEnd, exitpc, conditionpc)) + { + return ControlStatus_Error; + } + + CFGState& state = cfgStack_.back(); + state.loop.updatepc = conditionpc; + state.loop.updateEnd = ifne; + + if (!setCurrentAndSpecializePhis(header)) + return ControlStatus_Error; + if (!jsop_loophead(loophead)) + return ControlStatus_Error; + + pc = bodyStart; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::whileOrForInLoop(jssrcnote* sn) +{ + // while (cond) { } loops have the following structure: + // GOTO cond ; SRC_WHILE (offset to IFNE) + // LOOPHEAD + // ... + // cond: + // LOOPENTRY + // ... + // IFNE ; goes to LOOPHEAD + // for (x in y) { } loops are similar; the cond will be a MOREITER. + MOZ_ASSERT(SN_TYPE(sn) == SRC_FOR_OF || SN_TYPE(sn) == SRC_FOR_IN || SN_TYPE(sn) == SRC_WHILE); + int ifneOffset = GetSrcNoteOffset(sn, 0); + jsbytecode* ifne = pc + ifneOffset; + MOZ_ASSERT(ifne > pc); + + // Verify that the IFNE goes back to a loophead op. + MOZ_ASSERT(JSOp(*GetNextPc(pc)) == JSOP_LOOPHEAD); + MOZ_ASSERT(GetNextPc(pc) == ifne + GetJumpOffset(ifne)); + + jsbytecode* loopEntry = pc + GetJumpOffset(pc); + bool canOsr = LoopEntryCanIonOsr(loopEntry); + bool osr = info().hasOsrAt(loopEntry); + + if (osr) { + MBasicBlock* preheader = newOsrPreheader(current, loopEntry, pc); + if (!preheader) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), preheader)); + if (!setCurrentAndSpecializePhis(preheader)) + return ControlStatus_Error; + } + + unsigned stackPhiCount; + if (SN_TYPE(sn) == SRC_FOR_OF) + stackPhiCount = 2; + else if (SN_TYPE(sn) == SRC_FOR_IN) + stackPhiCount = 1; + else + stackPhiCount = 0; + + MBasicBlock* header = newPendingLoopHeader(current, loopEntry, osr, canOsr, stackPhiCount); + if (!header) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), header)); + + // Skip past the JSOP_LOOPHEAD for the body start. + jsbytecode* loopHead = GetNextPc(pc); + jsbytecode* bodyStart = GetNextPc(loopHead); + jsbytecode* bodyEnd = pc + GetJumpOffset(pc); + jsbytecode* exitpc = GetNextPc(ifne); + jsbytecode* continuepc = pc; + if (!analyzeNewLoopTypes(header, bodyStart, exitpc)) + return ControlStatus_Error; + if (!pushLoop(CFGState::WHILE_LOOP_COND, ifne, header, osr, + loopHead, bodyEnd, bodyStart, bodyEnd, exitpc, continuepc)) + { + return ControlStatus_Error; + } + + // Parse the condition first. + if (!setCurrentAndSpecializePhis(header)) + return ControlStatus_Error; + if (!jsop_loophead(loopHead)) + return ControlStatus_Error; + + pc = bodyEnd; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::forLoop(JSOp op, jssrcnote* sn) +{ + // Skip the NOP. + MOZ_ASSERT(op == JSOP_NOP); + pc = GetNextPc(pc); + + jsbytecode* condpc = pc + GetSrcNoteOffset(sn, 0); + jsbytecode* updatepc = pc + GetSrcNoteOffset(sn, 1); + jsbytecode* ifne = pc + GetSrcNoteOffset(sn, 2); + jsbytecode* exitpc = GetNextPc(ifne); + + // for loops have the following structures: + // + // NOP or POP + // [GOTO cond | NOP] + // LOOPHEAD + // body: + // ; [body] + // [increment:] + // [{FRESHEN,RECREATE}LEXICALENV, if needed by a lexical env] + // ; [increment] + // [cond:] + // LOOPENTRY + // GOTO body + // + // If there is a condition (condpc != ifne), this acts similar to a while + // loop otherwise, it acts like a do-while loop. + // + // Note that currently Ion doesn't compile pushlexicalenv/poplexicalenv, + // necessary prerequisites to {freshen,recreate}lexicalenv. So the code + // below doesn't and needn't consider either op's implications. + jsbytecode* bodyStart = pc; + jsbytecode* bodyEnd = updatepc; + jsbytecode* loopEntry = condpc; + if (condpc != ifne) { + MOZ_ASSERT(JSOp(*bodyStart) == JSOP_GOTO); + MOZ_ASSERT(bodyStart + GetJumpOffset(bodyStart) == condpc); + bodyStart = GetNextPc(bodyStart); + } else { + // No loop condition, such as for(j = 0; ; j++) + if (op != JSOP_NOP) { + // If the loop starts with POP, we have to skip a NOP. + MOZ_ASSERT(JSOp(*bodyStart) == JSOP_NOP); + bodyStart = GetNextPc(bodyStart); + } + loopEntry = GetNextPc(bodyStart); + } + jsbytecode* loopHead = bodyStart; + MOZ_ASSERT(JSOp(*bodyStart) == JSOP_LOOPHEAD); + MOZ_ASSERT(ifne + GetJumpOffset(ifne) == bodyStart); + bodyStart = GetNextPc(bodyStart); + + bool osr = info().hasOsrAt(loopEntry); + bool canOsr = LoopEntryCanIonOsr(loopEntry); + + if (osr) { + MBasicBlock* preheader = newOsrPreheader(current, loopEntry, pc); + if (!preheader) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), preheader)); + if (!setCurrentAndSpecializePhis(preheader)) + return ControlStatus_Error; + } + + unsigned stackPhiCount = 0; + MBasicBlock* header = newPendingLoopHeader(current, loopEntry, osr, canOsr, stackPhiCount); + if (!header) + return ControlStatus_Error; + current->end(MGoto::New(alloc(), header)); + + // If there is no condition, we immediately parse the body. Otherwise, we + // parse the condition. + jsbytecode* stopAt; + CFGState::State initial; + if (condpc != ifne) { + pc = condpc; + stopAt = ifne; + initial = CFGState::FOR_LOOP_COND; + } else { + pc = bodyStart; + stopAt = bodyEnd; + initial = CFGState::FOR_LOOP_BODY; + } + + if (!analyzeNewLoopTypes(header, bodyStart, exitpc)) + return ControlStatus_Error; + if (!pushLoop(initial, stopAt, header, osr, + loopHead, pc, bodyStart, bodyEnd, exitpc, updatepc)) + { + return ControlStatus_Error; + } + + CFGState& state = cfgStack_.back(); + state.loop.condpc = (condpc != ifne) ? condpc : nullptr; + state.loop.updatepc = (updatepc != condpc) ? updatepc : nullptr; + if (state.loop.updatepc) + state.loop.updateEnd = condpc; + + if (!setCurrentAndSpecializePhis(header)) + return ControlStatus_Error; + if (!jsop_loophead(loopHead)) + return ControlStatus_Error; + + return ControlStatus_Jumped; +} + +int +IonBuilder::CmpSuccessors(const void* a, const void* b) +{ + const MBasicBlock* a0 = * (MBasicBlock * const*)a; + const MBasicBlock* b0 = * (MBasicBlock * const*)b; + if (a0->pc() == b0->pc()) + return 0; + + return (a0->pc() > b0->pc()) ? 1 : -1; +} + +IonBuilder::ControlStatus +IonBuilder::tableSwitch(JSOp op, jssrcnote* sn) +{ + // TableSwitch op contains the following data + // (length between data is JUMP_OFFSET_LEN) + // + // 0: Offset of default case + // 1: Lowest number in tableswitch + // 2: Highest number in tableswitch + // 3: Offset of case low + // 4: Offset of case low+1 + // .: ... + // .: Offset of case high + + MOZ_ASSERT(op == JSOP_TABLESWITCH); + MOZ_ASSERT(SN_TYPE(sn) == SRC_TABLESWITCH); + + // Pop input. + MDefinition* ins = current->pop(); + + // Get the default and exit pc + jsbytecode* exitpc = pc + GetSrcNoteOffset(sn, 0); + jsbytecode* defaultpc = pc + GET_JUMP_OFFSET(pc); + + MOZ_ASSERT(defaultpc > pc && defaultpc <= exitpc); + + // Get the low and high from the tableswitch + jsbytecode* pc2 = pc; + pc2 += JUMP_OFFSET_LEN; + int low = GET_JUMP_OFFSET(pc2); + pc2 += JUMP_OFFSET_LEN; + int high = GET_JUMP_OFFSET(pc2); + pc2 += JUMP_OFFSET_LEN; + + // Create MIR instruction + MTableSwitch* tableswitch = MTableSwitch::New(alloc(), ins, low, high); + + // Create default case + MBasicBlock* defaultcase = newBlock(current, defaultpc); + if (!defaultcase) + return ControlStatus_Error; + + if (!tableswitch->addDefault(defaultcase)) + return ControlStatus_Error; + + if (!tableswitch->addBlock(defaultcase)) + return ControlStatus_Error; + + // Create cases + jsbytecode* casepc = nullptr; + for (int i = 0; i < high-low+1; i++) { + casepc = pc + GET_JUMP_OFFSET(pc2); + + MOZ_ASSERT(casepc >= pc && casepc <= exitpc); + MBasicBlock* caseblock; + + if (casepc == pc) { + // If the casepc equals the current pc, it is not a written case, + // but a filled gap. That way we can use a tableswitch instead of + // condswitch, even if not all numbers are consecutive. + // In that case this block goes to the default case + caseblock = newBlock(current, defaultpc); + if (!caseblock) + return ControlStatus_Error; + caseblock->end(MGoto::New(alloc(), defaultcase)); + if (!defaultcase->addPredecessor(alloc(), caseblock)) + return ControlStatus_Error; + } else { + // If this is an actual case (not filled gap), + // add this block to the list that still needs to get processed. + caseblock = newBlock(current, casepc); + if (!caseblock) + return ControlStatus_Error; + + if (!tableswitch->addBlock(caseblock)) + return ControlStatus_Error; + + // Add constant to indicate which case this is for use by + // processNextTableSwitchCase. + MConstant* constant = MConstant::New(alloc(), Int32Value(i + low)); + caseblock->add(constant); + } + + size_t caseIndex; + if (!tableswitch->addSuccessor(caseblock, &caseIndex)) + return ControlStatus_Error; + + if (!tableswitch->addCase(caseIndex)) + return ControlStatus_Error; + + pc2 += JUMP_OFFSET_LEN; + } + + // Move defaultcase to the end, to maintain RPO. + graph().moveBlockToEnd(defaultcase); + + MOZ_ASSERT(tableswitch->numCases() == (uint32_t)(high - low + 1)); + MOZ_ASSERT(tableswitch->numSuccessors() > 0); + + // Sort the list of blocks that still needs to get processed by pc + qsort(tableswitch->blocks(), tableswitch->numBlocks(), + sizeof(MBasicBlock*), CmpSuccessors); + + // Create info + ControlFlowInfo switchinfo(cfgStack_.length(), exitpc); + if (!switches_.append(switchinfo)) + return ControlStatus_Error; + + // Use a state to retrieve some information + CFGState state = CFGState::TableSwitch(exitpc, tableswitch); + + // Save the MIR instruction as last instruction of this block. + current->end(tableswitch); + + // If there is only one successor the block should stop at the end of the switch + // Else it should stop at the start of the next successor + if (tableswitch->numBlocks() > 1) + state.stopAt = tableswitch->getBlock(1)->pc(); + if (!setCurrentAndSpecializePhis(tableswitch->getBlock(0))) + return ControlStatus_Error; + + if (!cfgStack_.append(state)) + return ControlStatus_Error; + + pc = current->pc(); + return ControlStatus_Jumped; +} + +bool +IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest* test) +{ + if (type->unknown()) + return true; + + // Don't emit MFilterTypeSet if it doesn't improve the typeset. + if (subject->resultTypeSet()) { + if (subject->resultTypeSet()->equals(type)) + return true; + } else { + TemporaryTypeSet oldTypes(alloc_->lifoAlloc(), subject->type()); + if (oldTypes.equals(type)) + return true; + } + + MInstruction* replace = nullptr; + MDefinition* ins; + + for (uint32_t i = 0; i < current->stackDepth(); i++) { + ins = current->getSlot(i); + + // Instead of creating a new MFilterTypeSet, try to update the old one. + if (ins->isFilterTypeSet() && ins->getOperand(0) == subject && + ins->dependency() == test) + { + TemporaryTypeSet* intersect = + TypeSet::intersectSets(ins->resultTypeSet(), type, alloc_->lifoAlloc()); + if (!intersect) + return false; + + ins->toFilterTypeSet()->setResultType(intersect->getKnownMIRType()); + ins->toFilterTypeSet()->setResultTypeSet(intersect); + + if (ins->type() == MIRType::Undefined) + current->setSlot(i, constant(UndefinedValue())); + else if (ins->type() == MIRType::Null) + current->setSlot(i, constant(NullValue())); + else if (ins->type() == MIRType::MagicOptimizedArguments) + current->setSlot(i, constant(MagicValue(JS_OPTIMIZED_ARGUMENTS))); + else + MOZ_ASSERT(!IsMagicType(ins->type())); + continue; + } + + if (ins == subject) { + if (!replace) { + replace = MFilterTypeSet::New(alloc(), subject, type); + if (!replace) + return false; + + current->add(replace); + + // Make sure we don't hoist it above the MTest, we can use the + // 'dependency' of an MInstruction. This is normally used by + // Alias Analysis, but won't get overwritten, since this + // instruction doesn't have an AliasSet. + replace->setDependency(test); + + if (replace->type() == MIRType::Undefined) + replace = constant(UndefinedValue()); + else if (replace->type() == MIRType::Null) + replace = constant(NullValue()); + else if (replace->type() == MIRType::MagicOptimizedArguments) + replace = constant(MagicValue(JS_OPTIMIZED_ARGUMENTS)); + else + MOZ_ASSERT(!IsMagicType(ins->type())); + } + current->setSlot(i, replace); + } + } + return true; +} + +bool +IonBuilder::detectAndOrStructure(MPhi* ins, bool* branchIsAnd) +{ + // Look for a triangle pattern: + // + // initialBlock + // / | + // branchBlock | + // \ | + // testBlock + // + // Where ins is a phi from testBlock which combines two values + // pushed onto the stack by initialBlock and branchBlock. + + if (ins->numOperands() != 2) + return false; + + MBasicBlock* testBlock = ins->block(); + MOZ_ASSERT(testBlock->numPredecessors() == 2); + + MBasicBlock* initialBlock; + MBasicBlock* branchBlock; + if (testBlock->getPredecessor(0)->lastIns()->isTest()) { + initialBlock = testBlock->getPredecessor(0); + branchBlock = testBlock->getPredecessor(1); + } else if (testBlock->getPredecessor(1)->lastIns()->isTest()) { + initialBlock = testBlock->getPredecessor(1); + branchBlock = testBlock->getPredecessor(0); + } else { + return false; + } + + if (branchBlock->numSuccessors() != 1) + return false; + + if (branchBlock->numPredecessors() != 1 || branchBlock->getPredecessor(0) != initialBlock) + return false; + + if (initialBlock->numSuccessors() != 2) + return false; + + MDefinition* branchResult = ins->getOperand(testBlock->indexForPredecessor(branchBlock)); + MDefinition* initialResult = ins->getOperand(testBlock->indexForPredecessor(initialBlock)); + + if (branchBlock->stackDepth() != initialBlock->stackDepth()) + return false; + if (branchBlock->stackDepth() != testBlock->stackDepth() + 1) + return false; + if (branchResult != branchBlock->peek(-1) || initialResult != initialBlock->peek(-1)) + return false; + + MTest* initialTest = initialBlock->lastIns()->toTest(); + bool branchIsTrue = branchBlock == initialTest->ifTrue(); + if (initialTest->input() == ins->getOperand(0)) + *branchIsAnd = branchIsTrue != (testBlock->getPredecessor(0) == branchBlock); + else if (initialTest->input() == ins->getOperand(1)) + *branchIsAnd = branchIsTrue != (testBlock->getPredecessor(1) == branchBlock); + else + return false; + + return true; +} + +bool +IonBuilder::improveTypesAtCompare(MCompare* ins, bool trueBranch, MTest* test) +{ + if (ins->compareType() == MCompare::Compare_Undefined || + ins->compareType() == MCompare::Compare_Null) + { + return improveTypesAtNullOrUndefinedCompare(ins, trueBranch, test); + } + + if ((ins->lhs()->isTypeOf() || ins->rhs()->isTypeOf()) && + (ins->lhs()->isConstant() || ins->rhs()->isConstant())) + { + return improveTypesAtTypeOfCompare(ins, trueBranch, test); + } + + return true; +} + +bool +IonBuilder::improveTypesAtTypeOfCompare(MCompare* ins, bool trueBranch, MTest* test) +{ + MTypeOf* typeOf = ins->lhs()->isTypeOf() ? ins->lhs()->toTypeOf() : ins->rhs()->toTypeOf(); + MConstant* constant = ins->lhs()->isConstant() ? ins->lhs()->toConstant() : ins->rhs()->toConstant(); + + if (constant->type() != MIRType::String) + return true; + + bool equal = ins->jsop() == JSOP_EQ || ins->jsop() == JSOP_STRICTEQ; + bool notEqual = ins->jsop() == JSOP_NE || ins->jsop() == JSOP_STRICTNE; + + if (notEqual) + trueBranch = !trueBranch; + + // Relational compares not supported. + if (!equal && !notEqual) + return true; + + MDefinition* subject = typeOf->input(); + TemporaryTypeSet* inputTypes = subject->resultTypeSet(); + + // Create temporary typeset equal to the type if there is no resultTypeSet. + TemporaryTypeSet tmp; + if (!inputTypes) { + if (subject->type() == MIRType::Value) + return true; + inputTypes = &tmp; + tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc()); + } + + if (inputTypes->unknown()) + return true; + + // Note: we cannot remove the AnyObject type in the false branch, + // since there are multiple ways to get an object. That is the reason + // for the 'trueBranch' test. + TemporaryTypeSet filter; + const JSAtomState& names = GetJitContext()->runtime->names(); + if (constant->toString() == TypeName(JSTYPE_VOID, names)) { + filter.addType(TypeSet::UndefinedType(), alloc_->lifoAlloc()); + if (typeOf->inputMaybeCallableOrEmulatesUndefined() && trueBranch) + filter.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_BOOLEAN, names)) { + filter.addType(TypeSet::BooleanType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_NUMBER, names)) { + filter.addType(TypeSet::Int32Type(), alloc_->lifoAlloc()); + filter.addType(TypeSet::DoubleType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_STRING, names)) { + filter.addType(TypeSet::StringType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_SYMBOL, names)) { + filter.addType(TypeSet::SymbolType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_OBJECT, names)) { + filter.addType(TypeSet::NullType(), alloc_->lifoAlloc()); + if (trueBranch) + filter.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc()); + } else if (constant->toString() == TypeName(JSTYPE_FUNCTION, names)) { + if (typeOf->inputMaybeCallableOrEmulatesUndefined() && trueBranch) + filter.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc()); + } else { + return true; + } + + TemporaryTypeSet* type; + if (trueBranch) + type = TypeSet::intersectSets(&filter, inputTypes, alloc_->lifoAlloc()); + else + type = TypeSet::removeSet(inputTypes, &filter, alloc_->lifoAlloc()); + + if (!type) + return false; + + return replaceTypeSet(subject, type, test); +} + +bool +IonBuilder::improveTypesAtNullOrUndefinedCompare(MCompare* ins, bool trueBranch, MTest* test) +{ + MOZ_ASSERT(ins->compareType() == MCompare::Compare_Undefined || + ins->compareType() == MCompare::Compare_Null); + + // altersUndefined/Null represents if we can filter/set Undefined/Null. + bool altersUndefined, altersNull; + JSOp op = ins->jsop(); + + switch(op) { + case JSOP_STRICTNE: + case JSOP_STRICTEQ: + altersUndefined = ins->compareType() == MCompare::Compare_Undefined; + altersNull = ins->compareType() == MCompare::Compare_Null; + break; + case JSOP_NE: + case JSOP_EQ: + altersUndefined = altersNull = true; + break; + default: + MOZ_CRASH("Relational compares not supported"); + } + + MDefinition* subject = ins->lhs(); + TemporaryTypeSet* inputTypes = subject->resultTypeSet(); + + MOZ_ASSERT(IsNullOrUndefined(ins->rhs()->type())); + + // Create temporary typeset equal to the type if there is no resultTypeSet. + TemporaryTypeSet tmp; + if (!inputTypes) { + if (subject->type() == MIRType::Value) + return true; + inputTypes = &tmp; + tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc()); + } + + if (inputTypes->unknown()) + return true; + + TemporaryTypeSet* type; + + // Decide if we need to filter the type or set it. + if ((op == JSOP_STRICTEQ || op == JSOP_EQ) ^ trueBranch) { + // Remove undefined/null + TemporaryTypeSet remove; + if (altersUndefined) + remove.addType(TypeSet::UndefinedType(), alloc_->lifoAlloc()); + if (altersNull) + remove.addType(TypeSet::NullType(), alloc_->lifoAlloc()); + + type = TypeSet::removeSet(inputTypes, &remove, alloc_->lifoAlloc()); + } else { + // Set undefined/null. + TemporaryTypeSet base; + if (altersUndefined) { + base.addType(TypeSet::UndefinedType(), alloc_->lifoAlloc()); + // If TypeSet emulates undefined, then we cannot filter the objects. + if (inputTypes->maybeEmulatesUndefined(constraints())) + base.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc()); + } + + if (altersNull) + base.addType(TypeSet::NullType(), alloc_->lifoAlloc()); + + type = TypeSet::intersectSets(&base, inputTypes, alloc_->lifoAlloc()); + } + + if (!type) + return false; + + return replaceTypeSet(subject, type, test); +} + +bool +IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test) +{ + // We explore the test condition to try and deduce as much type information + // as possible. + + // All branches of this switch that don't want to fall through to the + // default behavior must return. The default behavior assumes that a true + // test means the incoming ins is not null or undefined and that a false + // tests means it's one of null, undefined, false, 0, "", and objects + // emulating undefined + switch (ins->op()) { + case MDefinition::Op_Not: + return improveTypesAtTest(ins->toNot()->getOperand(0), !trueBranch, test); + case MDefinition::Op_IsObject: { + MDefinition* subject = ins->getOperand(0); + TemporaryTypeSet* oldType = subject->resultTypeSet(); + + // Create temporary typeset equal to the type if there is no resultTypeSet. + TemporaryTypeSet tmp; + if (!oldType) { + if (subject->type() == MIRType::Value) + return true; + oldType = &tmp; + tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc()); + } + + if (oldType->unknown()) + return true; + + TemporaryTypeSet* type = nullptr; + if (trueBranch) + type = oldType->cloneObjectsOnly(alloc_->lifoAlloc()); + else + type = oldType->cloneWithoutObjects(alloc_->lifoAlloc()); + + if (!type) + return false; + + return replaceTypeSet(subject, type, test); + } + case MDefinition::Op_Phi: { + bool branchIsAnd = true; + if (!detectAndOrStructure(ins->toPhi(), &branchIsAnd)) { + // Just fall through to the default behavior. + break; + } + + // Now we have detected the triangular structure and determined if it + // was an AND or an OR. + if (branchIsAnd) { + if (trueBranch) { + if (!improveTypesAtTest(ins->toPhi()->getOperand(0), true, test)) + return false; + if (!improveTypesAtTest(ins->toPhi()->getOperand(1), true, test)) + return false; + } + } else { + /* + * if (a || b) { + * ... + * } else { + * ... + * } + * + * If we have a statements like the one described above, + * And we are in the else branch of it. It amounts to: + * if (!(a || b)) and being in the true branch. + * + * Simplifying, we have (!a && !b) + * In this case we can use the same logic we use for branchIsAnd + * + */ + if (!trueBranch) { + if (!improveTypesAtTest(ins->toPhi()->getOperand(0), false, test)) + return false; + if (!improveTypesAtTest(ins->toPhi()->getOperand(1), false, test)) + return false; + } + } + return true; + } + + case MDefinition::Op_Compare: + return improveTypesAtCompare(ins->toCompare(), trueBranch, test); + + default: + break; + } + + // By default MTest tests ToBoolean(input). As a result in the true branch we can filter + // undefined and null. In false branch we can only encounter undefined, null, false, 0, "" + // and objects that emulate undefined. + + TemporaryTypeSet* oldType = ins->resultTypeSet(); + TemporaryTypeSet* type; + + // Create temporary typeset equal to the type if there is no resultTypeSet. + TemporaryTypeSet tmp; + if (!oldType) { + if (ins->type() == MIRType::Value) + return true; + oldType = &tmp; + tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(ins->type())), alloc_->lifoAlloc()); + } + + // If ins does not have a typeset we return as we cannot optimize. + if (oldType->unknown()) + return true; + + // Decide either to set or remove. + if (trueBranch) { + TemporaryTypeSet remove; + remove.addType(TypeSet::UndefinedType(), alloc_->lifoAlloc()); + remove.addType(TypeSet::NullType(), alloc_->lifoAlloc()); + type = TypeSet::removeSet(oldType, &remove, alloc_->lifoAlloc()); + } else { + TemporaryTypeSet base; + base.addType(TypeSet::UndefinedType(), alloc_->lifoAlloc()); // ToBoolean(undefined) == false + base.addType(TypeSet::NullType(), alloc_->lifoAlloc()); // ToBoolean(null) == false + base.addType(TypeSet::BooleanType(), alloc_->lifoAlloc()); // ToBoolean(false) == false + base.addType(TypeSet::Int32Type(), alloc_->lifoAlloc()); // ToBoolean(0) == false + base.addType(TypeSet::DoubleType(), alloc_->lifoAlloc()); // ToBoolean(0.0) == false + base.addType(TypeSet::StringType(), alloc_->lifoAlloc()); // ToBoolean("") == false + + // If the typeset does emulate undefined, then we cannot filter out + // objects. + if (oldType->maybeEmulatesUndefined(constraints())) + base.addType(TypeSet::AnyObjectType(), alloc_->lifoAlloc()); + + type = TypeSet::intersectSets(&base, oldType, alloc_->lifoAlloc()); + } + + return type && replaceTypeSet(ins, type, test); +} + +bool +IonBuilder::jsop_label() +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_LABEL); + + jsbytecode* endpc = pc + GET_JUMP_OFFSET(pc); + MOZ_ASSERT(endpc > pc); + + ControlFlowInfo label(cfgStack_.length(), endpc); + if (!labels_.append(label)) + return false; + + return cfgStack_.append(CFGState::Label(endpc)); +} + +bool +IonBuilder::jsop_condswitch() +{ + // CondSwitch op looks as follows: + // condswitch [length +exit_pc; first case offset +next-case ] + // { + // { + // ... any code ... + // case (+jump) [pcdelta offset +next-case] + // }+ + // default (+jump) + // ... jump targets ... + // } + // + // The default case is always emitted even if there is no default case in + // the source. The last case statement pcdelta source note might have a 0 + // offset on the last case (not all the time). + // + // A conditional evaluate the condition of each case and compare it to the + // switch value with a strict equality. Cases conditions are iterated + // linearly until one is matching. If one case succeeds, the flow jumps into + // the corresponding body block. The body block might alias others and + // might continue in the next body block if the body is not terminated with + // a break. + // + // Algorithm: + // 1/ Loop over the case chain to reach the default target + // & Estimate the number of uniq bodies. + // 2/ Generate code for all cases (see processCondSwitchCase). + // 3/ Generate code for all bodies (see processCondSwitchBody). + + MOZ_ASSERT(JSOp(*pc) == JSOP_CONDSWITCH); + jssrcnote* sn = info().getNote(gsn, pc); + MOZ_ASSERT(SN_TYPE(sn) == SRC_CONDSWITCH); + + // Get the exit pc + jsbytecode* exitpc = pc + GetSrcNoteOffset(sn, 0); + jsbytecode* firstCase = pc + GetSrcNoteOffset(sn, 1); + + // Iterate all cases in the conditional switch. + // - Stop at the default case. (always emitted after the last case) + // - Estimate the number of uniq bodies. This estimation might be off by 1 + // if the default body alias a case body. + jsbytecode* curCase = firstCase; + jsbytecode* lastTarget = GetJumpOffset(curCase) + curCase; + size_t nbBodies = 2; // default target and the first body. + + MOZ_ASSERT(pc < curCase && curCase <= exitpc); + while (JSOp(*curCase) == JSOP_CASE) { + // Fetch the next case. + jssrcnote* caseSn = info().getNote(gsn, curCase); + MOZ_ASSERT(caseSn && SN_TYPE(caseSn) == SRC_NEXTCASE); + ptrdiff_t off = GetSrcNoteOffset(caseSn, 0); + MOZ_ASSERT_IF(off == 0, JSOp(*GetNextPc(curCase)) == JSOP_JUMPTARGET); + curCase = off ? curCase + off : GetNextPc(GetNextPc(curCase)); + MOZ_ASSERT(pc < curCase && curCase <= exitpc); + + // Count non-aliased cases. + jsbytecode* curTarget = GetJumpOffset(curCase) + curCase; + if (lastTarget < curTarget) + nbBodies++; + lastTarget = curTarget; + } + + // The current case now be the default case which jump to the body of the + // default case, which might be behind the last target. + MOZ_ASSERT(JSOp(*curCase) == JSOP_DEFAULT); + jsbytecode* defaultTarget = GetJumpOffset(curCase) + curCase; + MOZ_ASSERT(curCase < defaultTarget && defaultTarget <= exitpc); + + // Allocate the current graph state. + CFGState state = CFGState::CondSwitch(this, exitpc, defaultTarget); + if (!state.condswitch.bodies || !state.condswitch.bodies->init(alloc(), nbBodies)) + return ControlStatus_Error; + + // We loop on case conditions with processCondSwitchCase. + MOZ_ASSERT(JSOp(*firstCase) == JSOP_CASE); + state.stopAt = firstCase; + state.state = CFGState::COND_SWITCH_CASE; + + return cfgStack_.append(state); +} + +IonBuilder::CFGState +IonBuilder::CFGState::CondSwitch(IonBuilder* builder, jsbytecode* exitpc, jsbytecode* defaultTarget) +{ + CFGState state; + state.state = COND_SWITCH_CASE; + state.stopAt = nullptr; + state.condswitch.bodies = (FixedList<MBasicBlock*>*)builder->alloc_->allocate( + sizeof(FixedList<MBasicBlock*>)); + state.condswitch.currentIdx = 0; + state.condswitch.defaultTarget = defaultTarget; + state.condswitch.defaultIdx = uint32_t(-1); + state.condswitch.exitpc = exitpc; + state.condswitch.breaks = nullptr; + return state; +} + +IonBuilder::CFGState +IonBuilder::CFGState::Label(jsbytecode* exitpc) +{ + CFGState state; + state.state = LABEL; + state.stopAt = exitpc; + state.label.breaks = nullptr; + return state; +} + +IonBuilder::CFGState +IonBuilder::CFGState::Try(jsbytecode* exitpc, MBasicBlock* successor) +{ + CFGState state; + state.state = TRY; + state.stopAt = exitpc; + state.try_.successor = successor; + return state; +} + +IonBuilder::ControlStatus +IonBuilder::processCondSwitchCase(CFGState& state) +{ + MOZ_ASSERT(state.state == CFGState::COND_SWITCH_CASE); + MOZ_ASSERT(!state.condswitch.breaks); + MOZ_ASSERT(current); + MOZ_ASSERT(JSOp(*pc) == JSOP_CASE); + FixedList<MBasicBlock*>& bodies = *state.condswitch.bodies; + jsbytecode* defaultTarget = state.condswitch.defaultTarget; + uint32_t& currentIdx = state.condswitch.currentIdx; + jsbytecode* lastTarget = currentIdx ? bodies[currentIdx - 1]->pc() : nullptr; + + // Fetch the following case in which we will continue. + jssrcnote* sn = info().getNote(gsn, pc); + ptrdiff_t off = GetSrcNoteOffset(sn, 0); + MOZ_ASSERT_IF(off == 0, JSOp(*GetNextPc(pc)) == JSOP_JUMPTARGET); + jsbytecode* casePc = off ? pc + off : GetNextPc(GetNextPc(pc)); + bool caseIsDefault = JSOp(*casePc) == JSOP_DEFAULT; + MOZ_ASSERT(JSOp(*casePc) == JSOP_CASE || caseIsDefault); + + // Allocate the block of the matching case. + bool bodyIsNew = false; + MBasicBlock* bodyBlock = nullptr; + jsbytecode* bodyTarget = pc + GetJumpOffset(pc); + if (lastTarget < bodyTarget) { + // If the default body is in the middle or aliasing the current target. + if (lastTarget < defaultTarget && defaultTarget <= bodyTarget) { + MOZ_ASSERT(state.condswitch.defaultIdx == uint32_t(-1)); + state.condswitch.defaultIdx = currentIdx; + bodies[currentIdx] = nullptr; + // If the default body does not alias any and it would be allocated + // later and stored in the defaultIdx location. + if (defaultTarget < bodyTarget) + currentIdx++; + } + + bodyIsNew = true; + // Pop switch and case operands. + bodyBlock = newBlockPopN(current, bodyTarget, 2); + bodies[currentIdx++] = bodyBlock; + } else { + // This body alias the previous one. + MOZ_ASSERT(lastTarget == bodyTarget); + MOZ_ASSERT(currentIdx > 0); + bodyBlock = bodies[currentIdx - 1]; + } + + if (!bodyBlock) + return ControlStatus_Error; + + lastTarget = bodyTarget; + + // Allocate the block of the non-matching case. This can either be a normal + // case or the default case. + bool caseIsNew = false; + MBasicBlock* caseBlock = nullptr; + if (!caseIsDefault) { + caseIsNew = true; + // Pop the case operand. + caseBlock = newBlockPopN(current, GetNextPc(pc), 1); + } else { + // The non-matching case is the default case, which jump directly to its + // body. Skip the creation of a default case block and directly create + // the default body if it does not alias any previous body. + + if (state.condswitch.defaultIdx == uint32_t(-1)) { + // The default target is the last target. + MOZ_ASSERT(lastTarget < defaultTarget); + state.condswitch.defaultIdx = currentIdx++; + caseIsNew = true; + } else if (bodies[state.condswitch.defaultIdx] == nullptr) { + // The default target is in the middle and it does not alias any + // case target. + MOZ_ASSERT(defaultTarget < lastTarget); + caseIsNew = true; + } else { + // The default target is in the middle and it alias a case target. + MOZ_ASSERT(defaultTarget <= lastTarget); + caseBlock = bodies[state.condswitch.defaultIdx]; + } + + // Allocate and register the default body. + if (caseIsNew) { + // Pop the case & switch operands. + caseBlock = newBlockPopN(current, defaultTarget, 2); + bodies[state.condswitch.defaultIdx] = caseBlock; + } + } + + if (!caseBlock) + return ControlStatus_Error; + + // Terminate the last case condition block by emitting the code + // corresponding to JSOP_CASE bytecode. + if (bodyBlock != caseBlock) { + MDefinition* caseOperand = current->pop(); + MDefinition* switchOperand = current->peek(-1); + + if (!jsop_compare(JSOP_STRICTEQ, switchOperand, caseOperand)) + return ControlStatus_Error; + MInstruction* cmpResult = current->pop()->toInstruction(); + MOZ_ASSERT(!cmpResult->isEffectful()); + current->end(newTest(cmpResult, bodyBlock, caseBlock)); + + // Add last case as predecessor of the body if the body is aliasing + // the previous case body. + if (!bodyIsNew && !bodyBlock->addPredecessorPopN(alloc(), current, 1)) + return ControlStatus_Error; + + // Add last case as predecessor of the non-matching case if the + // non-matching case is an aliased default case. We need to pop the + // switch operand as we skip the default case block and use the default + // body block directly. + MOZ_ASSERT_IF(!caseIsNew, caseIsDefault); + if (!caseIsNew && !caseBlock->addPredecessorPopN(alloc(), current, 1)) + return ControlStatus_Error; + } else { + // The default case alias the last case body. + MOZ_ASSERT(caseIsDefault); + current->pop(); // Case operand + current->pop(); // Switch operand + current->end(MGoto::New(alloc(), bodyBlock)); + if (!bodyIsNew && !bodyBlock->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + if (caseIsDefault) { + // The last case condition is finished. Loop in processCondSwitchBody, + // with potential stops in processSwitchBreak. Check that the bodies + // fixed list is over-estimate by at most 1, and shrink the size such as + // length can be used as an upper bound while iterating bodies. + MOZ_ASSERT(currentIdx == bodies.length() || currentIdx + 1 == bodies.length()); + bodies.shrink(bodies.length() - currentIdx); + + // Handle break statements in processSwitchBreak while processing + // bodies. + ControlFlowInfo breakInfo(cfgStack_.length() - 1, state.condswitch.exitpc); + if (!switches_.append(breakInfo)) + return ControlStatus_Error; + + // Jump into the first body. + currentIdx = 0; + setCurrent(nullptr); + state.state = CFGState::COND_SWITCH_BODY; + return processCondSwitchBody(state); + } + + // Continue until the case condition. + if (!setCurrentAndSpecializePhis(caseBlock)) + return ControlStatus_Error; + pc = current->pc(); + state.stopAt = casePc; + return ControlStatus_Jumped; +} + +IonBuilder::ControlStatus +IonBuilder::processCondSwitchBody(CFGState& state) +{ + MOZ_ASSERT(state.state == CFGState::COND_SWITCH_BODY); + MOZ_ASSERT(pc <= state.condswitch.exitpc); + FixedList<MBasicBlock*>& bodies = *state.condswitch.bodies; + uint32_t& currentIdx = state.condswitch.currentIdx; + + MOZ_ASSERT(currentIdx <= bodies.length()); + if (currentIdx == bodies.length()) { + MOZ_ASSERT_IF(current, pc == state.condswitch.exitpc); + return processSwitchEnd(state.condswitch.breaks, state.condswitch.exitpc); + } + + // Get the next body + MBasicBlock* nextBody = bodies[currentIdx++]; + MOZ_ASSERT_IF(current, pc == nextBody->pc()); + + // Fix the reverse post-order iteration. + graph().moveBlockToEnd(nextBody); + + // The last body continue into the new one. + if (current) { + current->end(MGoto::New(alloc(), nextBody)); + if (!nextBody->addPredecessor(alloc(), current)) + return ControlStatus_Error; + } + + // Continue in the next body. + if (!setCurrentAndSpecializePhis(nextBody)) + return ControlStatus_Error; + pc = current->pc(); + + if (currentIdx < bodies.length()) + state.stopAt = bodies[currentIdx]->pc(); + else + state.stopAt = state.condswitch.exitpc; + return ControlStatus_Jumped; +} + +bool +IonBuilder::jsop_andor(JSOp op) +{ + MOZ_ASSERT(op == JSOP_AND || op == JSOP_OR); + + jsbytecode* rhsStart = pc + CodeSpec[op].length; + jsbytecode* joinStart = pc + GetJumpOffset(pc); + MOZ_ASSERT(joinStart > pc); + + // We have to leave the LHS on the stack. + MDefinition* lhs = current->peek(-1); + + MBasicBlock* evalLhs = newBlock(current, joinStart); + MBasicBlock* evalRhs = newBlock(current, rhsStart); + if (!evalLhs || !evalRhs) + return false; + + MTest* test = (op == JSOP_AND) + ? newTest(lhs, evalRhs, evalLhs) + : newTest(lhs, evalLhs, evalRhs); + current->end(test); + + // Create the lhs block and specialize. + if (!setCurrentAndSpecializePhis(evalLhs)) + return false; + + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return false; + + // Create the rhs block. + if (!cfgStack_.append(CFGState::AndOr(joinStart, evalLhs))) + return false; + + if (!setCurrentAndSpecializePhis(evalRhs)) + return false; + + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return false; + + return true; +} + +bool +IonBuilder::jsop_dup2() +{ + uint32_t lhsSlot = current->stackDepth() - 2; + uint32_t rhsSlot = current->stackDepth() - 1; + current->pushSlot(lhsSlot); + current->pushSlot(rhsSlot); + return true; +} + +bool +IonBuilder::jsop_loophead(jsbytecode* pc) +{ + assertValidLoopHeadOp(pc); + + current->add(MInterruptCheck::New(alloc())); + insertRecompileCheck(); + + return true; +} + +bool +IonBuilder::jsop_ifeq(JSOp op) +{ + // IFEQ always has a forward offset. + jsbytecode* trueStart = pc + CodeSpec[op].length; + jsbytecode* falseStart = pc + GetJumpOffset(pc); + MOZ_ASSERT(falseStart > pc); + + // We only handle cases that emit source notes. + jssrcnote* sn = info().getNote(gsn, pc); + if (!sn) + return abort("expected sourcenote"); + + MDefinition* ins = current->pop(); + + // Create true and false branches. + MBasicBlock* ifTrue = newBlock(current, trueStart); + MBasicBlock* ifFalse = newBlock(current, falseStart); + if (!ifTrue || !ifFalse) + return false; + + MTest* test = newTest(ins, ifTrue, ifFalse); + current->end(test); + + // The bytecode for if/ternary gets emitted either like this: + // + // IFEQ X ; src note (IF_ELSE, COND) points to the GOTO + // ... + // GOTO Z + // X: ... ; else/else if + // ... + // Z: ; join + // + // Or like this: + // + // IFEQ X ; src note (IF) has no offset + // ... + // Z: ... ; join + // + // We want to parse the bytecode as if we were parsing the AST, so for the + // IF_ELSE/COND cases, we use the source note and follow the GOTO. For the + // IF case, the IFEQ offset is the join point. + switch (SN_TYPE(sn)) { + case SRC_IF: + if (!cfgStack_.append(CFGState::If(falseStart, test))) + return false; + break; + + case SRC_IF_ELSE: + case SRC_COND: + { + // Infer the join point from the JSOP_GOTO[X] sitting here, then + // assert as we much we can that this is the right GOTO. + jsbytecode* trueEnd = pc + GetSrcNoteOffset(sn, 0); + MOZ_ASSERT(trueEnd > pc); + MOZ_ASSERT(trueEnd < falseStart); + MOZ_ASSERT(JSOp(*trueEnd) == JSOP_GOTO); + MOZ_ASSERT(!info().getNote(gsn, trueEnd)); + + jsbytecode* falseEnd = trueEnd + GetJumpOffset(trueEnd); + MOZ_ASSERT(falseEnd > trueEnd); + MOZ_ASSERT(falseEnd >= falseStart); + + if (!cfgStack_.append(CFGState::IfElse(trueEnd, falseEnd, test))) + return false; + break; + } + + default: + MOZ_CRASH("unexpected source note type"); + } + + // Switch to parsing the true branch. Note that no PC update is needed, + // it's the next instruction. + if (!setCurrentAndSpecializePhis(ifTrue)) + return false; + + // Filter the types in the true branch. + if (!improveTypesAtTest(test->getOperand(0), test->ifTrue() == current, test)) + return false; + + return true; +} + +bool +IonBuilder::jsop_try() +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_TRY); + + // Try-finally is not yet supported. + if (analysis().hasTryFinally()) + return abort("Has try-finally"); + + // Try-catch within inline frames is not yet supported. + MOZ_ASSERT(!isInlineBuilder()); + + // Try-catch during the arguments usage analysis is not yet supported. Code + // accessing the arguments within the 'catch' block is not accounted for. + if (info().analysisMode() == Analysis_ArgumentsUsage) + return abort("Try-catch during arguments usage analysis"); + + graph().setHasTryBlock(); + + jssrcnote* sn = info().getNote(gsn, pc); + MOZ_ASSERT(SN_TYPE(sn) == SRC_TRY); + + // Get the pc of the last instruction in the try block. It's a JSOP_GOTO to + // jump over the catch block. + jsbytecode* endpc = pc + GetSrcNoteOffset(sn, 0); + MOZ_ASSERT(JSOp(*endpc) == JSOP_GOTO); + MOZ_ASSERT(GetJumpOffset(endpc) > 0); + + jsbytecode* afterTry = endpc + GetJumpOffset(endpc); + + // If controlflow in the try body is terminated (by a return or throw + // statement), the code after the try-statement may still be reachable + // via the catch block (which we don't compile) and OSR can enter it. + // For example: + // + // try { + // throw 3; + // } catch(e) { } + // + // for (var i=0; i<1000; i++) {} + // + // To handle this, we create two blocks: one for the try block and one + // for the code following the try-catch statement. Both blocks are + // connected to the graph with an MGotoWithFake instruction that always + // jumps to the try block. This ensures the successor block always has a + // predecessor. + // + // If the code after the try block is unreachable (control flow in both the + // try and catch blocks is terminated), only create the try block, to avoid + // parsing unreachable code. + + MBasicBlock* tryBlock = newBlock(current, GetNextPc(pc)); + if (!tryBlock) + return false; + + MBasicBlock* successor; + if (analysis().maybeInfo(afterTry)) { + successor = newBlock(current, afterTry); + if (!successor) + return false; + + current->end(MGotoWithFake::New(alloc(), tryBlock, successor)); + } else { + successor = nullptr; + current->end(MGoto::New(alloc(), tryBlock)); + } + + if (!cfgStack_.append(CFGState::Try(endpc, successor))) + return false; + + // The baseline compiler should not attempt to enter the catch block + // via OSR. + MOZ_ASSERT(info().osrPc() < endpc || info().osrPc() >= afterTry); + + // Start parsing the try block. + return setCurrentAndSpecializePhis(tryBlock); +} + +IonBuilder::ControlStatus +IonBuilder::processReturn(JSOp op) +{ + MDefinition* def; + switch (op) { + case JSOP_RETURN: + // Return the last instruction. + def = current->pop(); + break; + + case JSOP_RETRVAL: + // Return undefined eagerly if script doesn't use return value. + if (script()->noScriptRval()) { + MInstruction* ins = MConstant::New(alloc(), UndefinedValue()); + current->add(ins); + def = ins; + break; + } + + def = current->getSlot(info().returnValueSlot()); + break; + + default: + def = nullptr; + MOZ_CRASH("unknown return op"); + } + + MReturn* ret = MReturn::New(alloc(), def); + current->end(ret); + + if (!graph().addReturn(current)) + return ControlStatus_Error; + + // Make sure no one tries to use this block now. + setCurrent(nullptr); + return processControlEnd(); +} + +IonBuilder::ControlStatus +IonBuilder::processThrow() +{ + MDefinition* def = current->pop(); + + // MThrow is not marked as effectful. This means when it throws and we + // are inside a try block, we could use an earlier resume point and this + // resume point may not be up-to-date, for example: + // + // (function() { + // try { + // var x = 1; + // foo(); // resume point + // x = 2; + // throw foo; + // } catch(e) { + // print(x); + // } + // ])(); + // + // If we use the resume point after the call, this will print 1 instead + // of 2. To fix this, we create a resume point right before the MThrow. + // + // Note that this is not a problem for instructions other than MThrow + // because they are either marked as effectful (have their own resume + // point) or cannot throw a catchable exception. + // + // We always install this resume point (instead of only when the function + // has a try block) in order to handle the Debugger onExceptionUnwind + // hook. When we need to handle the hook, we bail out to baseline right + // after the throw and propagate the exception when debug mode is on. This + // is opposed to the normal behavior of resuming directly in the + // associated catch block. + MNop* nop = MNop::New(alloc()); + current->add(nop); + + if (!resumeAfter(nop)) + return ControlStatus_Error; + + MThrow* ins = MThrow::New(alloc(), def); + current->end(ins); + + // Make sure no one tries to use this block now. + setCurrent(nullptr); + return processControlEnd(); +} + +void +IonBuilder::pushConstant(const Value& v) +{ + current->push(constant(v)); +} + +bool +IonBuilder::bitnotTrySpecialized(bool* emitted, MDefinition* input) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a specialized bitnot instruction based on the input type + // of the operand. + + if (input->mightBeType(MIRType::Object) || input->mightBeType(MIRType::Symbol)) + return true; + + MBitNot* ins = MBitNot::New(alloc(), input); + ins->setSpecialization(MIRType::Int32); + + current->add(ins); + current->push(ins); + + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_bitnot() +{ + bool emitted = false; + + MDefinition* input = current->pop(); + + if (!forceInlineCaches()) { + if (!bitnotTrySpecialized(&emitted, input) || emitted) + return emitted; + } + + if (!arithTrySharedStub(&emitted, JSOP_BITNOT, nullptr, input) || emitted) + return emitted; + + // Not possible to optimize. Do a slow vm call. + MBitNot* ins = MBitNot::New(alloc(), input); + + current->add(ins); + current->push(ins); + MOZ_ASSERT(ins->isEffectful()); + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_bitop(JSOp op) +{ + // Pop inputs. + MDefinition* right = current->pop(); + MDefinition* left = current->pop(); + + MBinaryBitwiseInstruction* ins; + switch (op) { + case JSOP_BITAND: + ins = MBitAnd::New(alloc(), left, right); + break; + + case JSOP_BITOR: + ins = MBitOr::New(alloc(), left, right); + break; + + case JSOP_BITXOR: + ins = MBitXor::New(alloc(), left, right); + break; + + case JSOP_LSH: + ins = MLsh::New(alloc(), left, right); + break; + + case JSOP_RSH: + ins = MRsh::New(alloc(), left, right); + break; + + case JSOP_URSH: + ins = MUrsh::New(alloc(), left, right); + break; + + default: + MOZ_CRASH("unexpected bitop"); + } + + current->add(ins); + ins->infer(inspector, pc); + + current->push(ins); + if (ins->isEffectful() && !resumeAfter(ins)) + return false; + + return true; +} + +MDefinition::Opcode +JSOpToMDefinition(JSOp op) +{ + switch (op) { + case JSOP_ADD: + return MDefinition::Op_Add; + case JSOP_SUB: + return MDefinition::Op_Sub; + case JSOP_MUL: + return MDefinition::Op_Mul; + case JSOP_DIV: + return MDefinition::Op_Div; + case JSOP_MOD: + return MDefinition::Op_Mod; + default: + MOZ_CRASH("unexpected binary opcode"); + } +} + +bool +IonBuilder::binaryArithTryConcat(bool* emitted, JSOp op, MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to convert an addition into a concat operation if the inputs + // indicate this might be a concatenation. + + // Only try to replace this with concat when we have an addition. + if (op != JSOP_ADD) + return true; + + trackOptimizationAttempt(TrackedStrategy::BinaryArith_Concat); + + // Make sure one of the inputs is a string. + if (left->type() != MIRType::String && right->type() != MIRType::String) { + trackOptimizationOutcome(TrackedOutcome::OperandNotString); + return true; + } + + // The none-string input (if present) should be atleast a numerical type. + // Which we can easily coerce to string. + if (right->type() != MIRType::String && !IsNumberType(right->type())) { + trackOptimizationOutcome(TrackedOutcome::OperandNotStringOrNumber); + return true; + } + if (left->type() != MIRType::String && !IsNumberType(left->type())) { + trackOptimizationOutcome(TrackedOutcome::OperandNotStringOrNumber); + return true; + } + + MConcat* ins = MConcat::New(alloc(), left, right); + current->add(ins); + current->push(ins); + + if (!maybeInsertResume()) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::powTrySpecialized(bool* emitted, MDefinition* base, MDefinition* power, + MIRType outputType) +{ + // Typechecking. + MDefinition* output = nullptr; + MIRType baseType = base->type(); + MIRType powerType = power->type(); + + if (outputType != MIRType::Int32 && outputType != MIRType::Double) + return true; + if (!IsNumberType(baseType)) + return true; + if (!IsNumberType(powerType)) + return true; + + if (powerType == MIRType::Float32) + powerType = MIRType::Double; + + MPow* pow = MPow::New(alloc(), base, power, powerType); + current->add(pow); + output = pow; + + // Cast to the right type + if (outputType == MIRType::Int32 && output->type() != MIRType::Int32) { + MToInt32* toInt = MToInt32::New(alloc(), output); + current->add(toInt); + output = toInt; + } + if (outputType == MIRType::Double && output->type() != MIRType::Double) { + MToDouble* toDouble = MToDouble::New(alloc(), output); + current->add(toDouble); + output = toDouble; + } + + current->push(output); + *emitted = true; + return true; +} + +static inline bool +SimpleArithOperand(MDefinition* op) +{ + return !op->mightBeType(MIRType::Object) + && !op->mightBeType(MIRType::String) + && !op->mightBeType(MIRType::Symbol) + && !op->mightBeType(MIRType::MagicOptimizedArguments) + && !op->mightBeType(MIRType::MagicHole) + && !op->mightBeType(MIRType::MagicIsConstructing); +} + +bool +IonBuilder::binaryArithTrySpecialized(bool* emitted, JSOp op, MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a specialized binary instruction based on the input types + // of the operands. + + trackOptimizationAttempt(TrackedStrategy::BinaryArith_SpecializedTypes); + + // Anything complex - strings, symbols, and objects - are not specialized + if (!SimpleArithOperand(left) || !SimpleArithOperand(right)) { + trackOptimizationOutcome(TrackedOutcome::OperandNotSimpleArith); + return true; + } + + // One of the inputs need to be a number. + if (!IsNumberType(left->type()) && !IsNumberType(right->type())) { + trackOptimizationOutcome(TrackedOutcome::OperandNotNumber); + return true; + } + + MDefinition::Opcode defOp = JSOpToMDefinition(op); + MBinaryArithInstruction* ins = MBinaryArithInstruction::New(alloc(), defOp, left, right); + ins->setNumberSpecialization(alloc(), inspector, pc); + + if (op == JSOP_ADD || op == JSOP_MUL) + ins->setCommutative(); + + current->add(ins); + current->push(ins); + + MOZ_ASSERT(!ins->isEffectful()); + if (!maybeInsertResume()) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::binaryArithTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, + MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a specialized binary instruction speculating the + // type using the baseline caches. + + trackOptimizationAttempt(TrackedStrategy::BinaryArith_SpecializedOnBaselineTypes); + + MIRType specialization = inspector->expectedBinaryArithSpecialization(pc); + if (specialization == MIRType::None) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return true; + } + + MDefinition::Opcode def_op = JSOpToMDefinition(op); + MBinaryArithInstruction* ins = MBinaryArithInstruction::New(alloc(), def_op, left, right); + ins->setSpecialization(specialization); + + current->add(ins); + current->push(ins); + + MOZ_ASSERT(!ins->isEffectful()); + if (!maybeInsertResume()) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::arithTrySharedStub(bool* emitted, JSOp op, + MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + JSOp actualOp = JSOp(*pc); + + // Try to emit a shared stub cache. + + if (JitOptions.disableSharedStubs) + return true; + + // The actual jsop 'jsop_pos' is not supported yet. + if (actualOp == JSOP_POS) + return true; + + // FIXME: The JSOP_BITNOT path doesn't track optimizations yet. + if (actualOp != JSOP_BITNOT) { + trackOptimizationAttempt(TrackedStrategy::BinaryArith_SharedCache); + trackOptimizationSuccess(); + } + + MInstruction* stub = nullptr; + switch (actualOp) { + case JSOP_NEG: + case JSOP_BITNOT: + MOZ_ASSERT_IF(op == JSOP_MUL, + left->maybeConstantValue() && left->maybeConstantValue()->toInt32() == -1); + MOZ_ASSERT_IF(op != JSOP_MUL, !left); + + stub = MUnarySharedStub::New(alloc(), right); + break; + case JSOP_ADD: + case JSOP_SUB: + case JSOP_MUL: + case JSOP_DIV: + case JSOP_MOD: + case JSOP_POW: + stub = MBinarySharedStub::New(alloc(), left, right); + break; + default: + MOZ_CRASH("unsupported arith"); + } + + current->add(stub); + current->push(stub); + + // Decrease type from 'any type' to 'empty type' when one of the operands + // is 'empty typed'. + maybeMarkEmpty(stub); + + if (!resumeAfter(stub)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_binary_arith(JSOp op, MDefinition* left, MDefinition* right) +{ + bool emitted = false; + + startTrackingOptimizations(); + + trackTypeInfo(TrackedTypeSite::Operand, left->type(), left->resultTypeSet()); + trackTypeInfo(TrackedTypeSite::Operand, right->type(), right->resultTypeSet()); + + if (!forceInlineCaches()) { + if (!binaryArithTryConcat(&emitted, op, left, right) || emitted) + return emitted; + + if (!binaryArithTrySpecialized(&emitted, op, left, right) || emitted) + return emitted; + + if (!binaryArithTrySpecializedOnBaselineInspector(&emitted, op, left, right) || emitted) + return emitted; + } + + if (!arithTrySharedStub(&emitted, op, left, right) || emitted) + return emitted; + + // Not possible to optimize. Do a slow vm call. + trackOptimizationAttempt(TrackedStrategy::BinaryArith_Call); + trackOptimizationSuccess(); + + MDefinition::Opcode def_op = JSOpToMDefinition(op); + MBinaryArithInstruction* ins = MBinaryArithInstruction::New(alloc(), def_op, left, right); + + // Decrease type from 'any type' to 'empty type' when one of the operands + // is 'empty typed'. + maybeMarkEmpty(ins); + + current->add(ins); + current->push(ins); + MOZ_ASSERT(ins->isEffectful()); + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_binary_arith(JSOp op) +{ + MDefinition* right = current->pop(); + MDefinition* left = current->pop(); + + return jsop_binary_arith(op, left, right); +} + + +bool +IonBuilder::jsop_pow() +{ + MDefinition* exponent = current->pop(); + MDefinition* base = current->pop(); + + bool emitted = false; + + if (!forceInlineCaches()) { + if (!powTrySpecialized(&emitted, base, exponent, MIRType::Double) || emitted) + return emitted; + } + + if (!arithTrySharedStub(&emitted, JSOP_POW, base, exponent) || emitted) + return emitted; + + // For now, use MIRType::Double, as a safe cover-all. See bug 1188079. + MPow* pow = MPow::New(alloc(), base, exponent, MIRType::Double); + current->add(pow); + current->push(pow); + return true; +} + +bool +IonBuilder::jsop_pos() +{ + if (IsNumberType(current->peek(-1)->type())) { + // Already int32 or double. Set the operand as implicitly used so it + // doesn't get optimized out if it has no other uses, as we could bail + // out. + current->peek(-1)->setImplicitlyUsedUnchecked(); + return true; + } + + // Compile +x as x * 1. + MDefinition* value = current->pop(); + MConstant* one = MConstant::New(alloc(), Int32Value(1)); + current->add(one); + + return jsop_binary_arith(JSOP_MUL, value, one); +} + +bool +IonBuilder::jsop_neg() +{ + // Since JSOP_NEG does not use a slot, we cannot push the MConstant. + // The MConstant is therefore passed to JSOP_MUL without slot traffic. + MConstant* negator = MConstant::New(alloc(), Int32Value(-1)); + current->add(negator); + + MDefinition* right = current->pop(); + + return jsop_binary_arith(JSOP_MUL, negator, right); +} + +bool +IonBuilder::jsop_tostring() +{ + if (current->peek(-1)->type() == MIRType::String) + return true; + + MDefinition* value = current->pop(); + MToString* ins = MToString::New(alloc(), value); + current->add(ins); + current->push(ins); + MOZ_ASSERT(!ins->isEffectful()); + return true; +} + +class AutoAccumulateReturns +{ + MIRGraph& graph_; + MIRGraphReturns* prev_; + + public: + AutoAccumulateReturns(MIRGraph& graph, MIRGraphReturns& returns) + : graph_(graph) + { + prev_ = graph_.returnAccumulator(); + graph_.setReturnAccumulator(&returns); + } + ~AutoAccumulateReturns() { + graph_.setReturnAccumulator(prev_); + } +}; + +IonBuilder::InliningStatus +IonBuilder::inlineScriptedCall(CallInfo& callInfo, JSFunction* target) +{ + MOZ_ASSERT(target->hasScript()); + MOZ_ASSERT(IsIonInlinablePC(pc)); + + MBasicBlock::BackupPoint backup(current); + if (!backup.init(alloc())) + return InliningStatus_Error; + + callInfo.setImplicitlyUsedUnchecked(); + + // Ensure sufficient space in the slots: needed for inlining from FUNAPPLY. + uint32_t depth = current->stackDepth() + callInfo.numFormals(); + if (depth > current->nslots()) { + if (!current->increaseSlots(depth - current->nslots())) + return InliningStatus_Error; + } + + // Create new |this| on the caller-side for inlined constructors. + if (callInfo.constructing()) { + MDefinition* thisDefn = createThis(target, callInfo.fun(), callInfo.getNewTarget()); + if (!thisDefn) + return InliningStatus_Error; + callInfo.setThis(thisDefn); + } + + // Capture formals in the outer resume point. + callInfo.pushFormals(current); + + MResumePoint* outerResumePoint = + MResumePoint::New(alloc(), current, pc, MResumePoint::Outer); + if (!outerResumePoint) + return InliningStatus_Error; + current->setOuterResumePoint(outerResumePoint); + + // Pop formals again, except leave |fun| on stack for duration of call. + callInfo.popFormals(current); + current->push(callInfo.fun()); + + JSScript* calleeScript = target->nonLazyScript(); + BaselineInspector inspector(calleeScript); + + // Improve type information of |this| when not set. + if (callInfo.constructing() && + !callInfo.thisArg()->resultTypeSet()) + { + StackTypeSet* types = TypeScript::ThisTypes(calleeScript); + if (types && !types->unknown()) { + TemporaryTypeSet* clonedTypes = types->clone(alloc_->lifoAlloc()); + if (!clonedTypes) + return InliningStatus_Error; + MTypeBarrier* barrier = MTypeBarrier::New(alloc(), callInfo.thisArg(), clonedTypes); + current->add(barrier); + if (barrier->type() == MIRType::Undefined) + callInfo.setThis(constant(UndefinedValue())); + else if (barrier->type() == MIRType::Null) + callInfo.setThis(constant(NullValue())); + else + callInfo.setThis(barrier); + } + } + + // Start inlining. + LifoAlloc* lifoAlloc = alloc_->lifoAlloc(); + InlineScriptTree* inlineScriptTree = + info().inlineScriptTree()->addCallee(alloc_, pc, calleeScript); + if (!inlineScriptTree) + return InliningStatus_Error; + CompileInfo* info = lifoAlloc->new_<CompileInfo>(calleeScript, target, + (jsbytecode*)nullptr, + this->info().analysisMode(), + /* needsArgsObj = */ false, + inlineScriptTree); + if (!info) + return InliningStatus_Error; + + MIRGraphReturns returns(alloc()); + AutoAccumulateReturns aar(graph(), returns); + + // Build the graph. + IonBuilder inlineBuilder(analysisContext, compartment, options, &alloc(), &graph(), constraints(), + &inspector, info, &optimizationInfo(), nullptr, inliningDepth_ + 1, + loopDepth_); + if (!inlineBuilder.buildInline(this, outerResumePoint, callInfo)) { + if (analysisContext && analysisContext->isExceptionPending()) { + JitSpew(JitSpew_IonAbort, "Inline builder raised exception."); + abortReason_ = AbortReason_Error; + return InliningStatus_Error; + } + + // Inlining the callee failed. Mark the callee as uninlineable only if + // the inlining was aborted for a non-exception reason. + if (inlineBuilder.abortReason_ == AbortReason_Disable) { + calleeScript->setUninlineable(); + if (!JitOptions.disableInlineBacktracking) { + current = backup.restore(); + return InliningStatus_NotInlined; + } + abortReason_ = AbortReason_Inlining; + } else if (inlineBuilder.abortReason_ == AbortReason_Inlining) { + abortReason_ = AbortReason_Inlining; + } else if (inlineBuilder.abortReason_ == AbortReason_Alloc) { + abortReason_ = AbortReason_Alloc; + } else if (inlineBuilder.abortReason_ == AbortReason_PreliminaryObjects) { + const ObjectGroupVector& groups = inlineBuilder.abortedPreliminaryGroups(); + MOZ_ASSERT(!groups.empty()); + for (size_t i = 0; i < groups.length(); i++) + addAbortedPreliminaryGroup(groups[i]); + abortReason_ = AbortReason_PreliminaryObjects; + } + + return InliningStatus_Error; + } + + // Create return block. + jsbytecode* postCall = GetNextPc(pc); + MBasicBlock* returnBlock = newBlock(nullptr, postCall); + if (!returnBlock) + return InliningStatus_Error; + returnBlock->setCallerResumePoint(callerResumePoint_); + + // Inherit the slots from current and pop |fun|. + returnBlock->inheritSlots(current); + returnBlock->pop(); + + // Accumulate return values. + if (returns.empty()) { + // Inlining of functions that have no exit is not supported. + calleeScript->setUninlineable(); + if (!JitOptions.disableInlineBacktracking) { + current = backup.restore(); + return InliningStatus_NotInlined; + } + abortReason_ = AbortReason_Inlining; + return InliningStatus_Error; + } + MDefinition* retvalDefn = patchInlinedReturns(callInfo, returns, returnBlock); + if (!retvalDefn) + return InliningStatus_Error; + returnBlock->push(retvalDefn); + + // Initialize entry slots now that the stack has been fixed up. + if (!returnBlock->initEntrySlots(alloc())) + return InliningStatus_Error; + + if (!setCurrentAndSpecializePhis(returnBlock)) + return InliningStatus_Error; + + return InliningStatus_Inlined; +} + +MDefinition* +IonBuilder::patchInlinedReturn(CallInfo& callInfo, MBasicBlock* exit, MBasicBlock* bottom) +{ + // Replaces the MReturn in the exit block with an MGoto. + MDefinition* rdef = exit->lastIns()->toReturn()->input(); + exit->discardLastIns(); + + // Constructors must be patched by the caller to always return an object. + if (callInfo.constructing()) { + if (rdef->type() == MIRType::Value) { + // Unknown return: dynamically detect objects. + MReturnFromCtor* filter = MReturnFromCtor::New(alloc(), rdef, callInfo.thisArg()); + exit->add(filter); + rdef = filter; + } else if (rdef->type() != MIRType::Object) { + // Known non-object return: force |this|. + rdef = callInfo.thisArg(); + } + } else if (callInfo.isSetter()) { + // Setters return their argument, not whatever value is returned. + rdef = callInfo.getArg(0); + } + + if (!callInfo.isSetter()) + rdef = specializeInlinedReturn(rdef, exit); + + MGoto* replacement = MGoto::New(alloc(), bottom); + exit->end(replacement); + if (!bottom->addPredecessorWithoutPhis(exit)) + return nullptr; + + return rdef; +} + +MDefinition* +IonBuilder::specializeInlinedReturn(MDefinition* rdef, MBasicBlock* exit) +{ + // Remove types from the return definition that weren't observed. + TemporaryTypeSet* types = bytecodeTypes(pc); + + // The observed typeset doesn't contain extra information. + if (types->empty() || types->unknown()) + return rdef; + + // Decide if specializing is needed using the result typeset if available, + // else use the result type. + + if (rdef->resultTypeSet()) { + // Don't specialize if return typeset is a subset of the + // observed typeset. The return typeset is already more specific. + if (rdef->resultTypeSet()->isSubset(types)) + return rdef; + } else { + MIRType observedType = types->getKnownMIRType(); + + // Don't specialize if type is MIRType::Float32 and TI reports + // MIRType::Double. Float is more specific than double. + if (observedType == MIRType::Double && rdef->type() == MIRType::Float32) + return rdef; + + // Don't specialize if types are inaccordance, except for MIRType::Value + // and MIRType::Object (when not unknown object), since the typeset + // contains more specific information. + if (observedType == rdef->type() && + observedType != MIRType::Value && + (observedType != MIRType::Object || types->unknownObject())) + { + return rdef; + } + } + + setCurrent(exit); + + MTypeBarrier* barrier = nullptr; + rdef = addTypeBarrier(rdef, types, BarrierKind::TypeSet, &barrier); + if (barrier) + barrier->setNotMovable(); + + return rdef; +} + +MDefinition* +IonBuilder::patchInlinedReturns(CallInfo& callInfo, MIRGraphReturns& returns, MBasicBlock* bottom) +{ + // Replaces MReturns with MGotos, returning the MDefinition + // representing the return value, or nullptr. + MOZ_ASSERT(returns.length() > 0); + + if (returns.length() == 1) + return patchInlinedReturn(callInfo, returns[0], bottom); + + // Accumulate multiple returns with a phi. + MPhi* phi = MPhi::New(alloc()); + if (!phi->reserveLength(returns.length())) + return nullptr; + + for (size_t i = 0; i < returns.length(); i++) { + MDefinition* rdef = patchInlinedReturn(callInfo, returns[i], bottom); + if (!rdef) + return nullptr; + phi->addInput(rdef); + } + + bottom->addPhi(phi); + return phi; +} + +IonBuilder::InliningDecision +IonBuilder::makeInliningDecision(JSObject* targetArg, CallInfo& callInfo) +{ + // When there is no target, inlining is impossible. + if (targetArg == nullptr) { + trackOptimizationOutcome(TrackedOutcome::CantInlineNoTarget); + return InliningDecision_DontInline; + } + + // Inlining non-function targets is handled by inlineNonFunctionCall(). + if (!targetArg->is<JSFunction>()) + return InliningDecision_Inline; + + JSFunction* target = &targetArg->as<JSFunction>(); + + // Never inline during the arguments usage analysis. + if (info().analysisMode() == Analysis_ArgumentsUsage) + return InliningDecision_DontInline; + + // Native functions provide their own detection in inlineNativeCall(). + if (target->isNative()) + return InliningDecision_Inline; + + // Determine whether inlining is possible at callee site + InliningDecision decision = canInlineTarget(target, callInfo); + if (decision != InliningDecision_Inline) + return decision; + + // Heuristics! + JSScript* targetScript = target->nonLazyScript(); + + // Callee must not be excessively large. + // This heuristic also applies to the callsite as a whole. + bool offThread = options.offThreadCompilationAvailable(); + if (targetScript->length() > optimizationInfo().inlineMaxBytecodePerCallSite(offThread)) { + trackOptimizationOutcome(TrackedOutcome::CantInlineBigCallee); + return DontInline(targetScript, "Vetoed: callee excessively large"); + } + + // Callee must have been called a few times to have somewhat stable + // type information, except for definite properties analysis, + // as the caller has not run yet. + if (targetScript->getWarmUpCount() < optimizationInfo().inliningWarmUpThreshold() && + !targetScript->baselineScript()->ionCompiledOrInlined() && + info().analysisMode() != Analysis_DefiniteProperties) + { + trackOptimizationOutcome(TrackedOutcome::CantInlineNotHot); + JitSpew(JitSpew_Inlining, "Cannot inline %s:%" PRIuSIZE ": callee is insufficiently hot.", + targetScript->filename(), targetScript->lineno()); + return InliningDecision_WarmUpCountTooLow; + } + + // Don't inline if the callee is known to inline a lot of code, to avoid + // huge MIR graphs. + uint32_t inlinedBytecodeLength = targetScript->baselineScript()->inlinedBytecodeLength(); + if (inlinedBytecodeLength > optimizationInfo().inlineMaxCalleeInlinedBytecodeLength()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineBigCalleeInlinedBytecodeLength); + return DontInline(targetScript, "Vetoed: callee inlinedBytecodeLength is too big"); + } + + IonBuilder* outerBuilder = outermostBuilder(); + + // Cap the total bytecode length we inline under a single script, to avoid + // excessive inlining in pathological cases. + size_t totalBytecodeLength = outerBuilder->inlinedBytecodeLength_ + targetScript->length(); + if (totalBytecodeLength > optimizationInfo().inlineMaxTotalBytecodeLength()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineExceededTotalBytecodeLength); + return DontInline(targetScript, "Vetoed: exceeding max total bytecode length"); + } + + // Cap the inlining depth. + + uint32_t maxInlineDepth; + if (JitOptions.isSmallFunction(targetScript)) { + maxInlineDepth = optimizationInfo().smallFunctionMaxInlineDepth(); + } else { + maxInlineDepth = optimizationInfo().maxInlineDepth(); + + // Caller must not be excessively large. + if (script()->length() >= optimizationInfo().inliningMaxCallerBytecodeLength()) { + trackOptimizationOutcome(TrackedOutcome::CantInlineBigCaller); + return DontInline(targetScript, "Vetoed: caller excessively large"); + } + } + + BaselineScript* outerBaseline = outermostBuilder()->script()->baselineScript(); + if (inliningDepth_ >= maxInlineDepth) { + // We hit the depth limit and won't inline this function. Give the + // outermost script a max inlining depth of 0, so that it won't be + // inlined in other scripts. This heuristic is currently only used + // when we're inlining scripts with loops, see the comment below. + outerBaseline->setMaxInliningDepth(0); + + trackOptimizationOutcome(TrackedOutcome::CantInlineExceededDepth); + return DontInline(targetScript, "Vetoed: exceeding allowed inline depth"); + } + + // Inlining functions with loops can be complicated. For instance, if we're + // close to the inlining depth limit and we inline the function f below, we + // can no longer inline the call to g: + // + // function f() { + // while (cond) { + // g(); + // } + // } + // + // If the loop has many iterations, it's more efficient to call f and inline + // g in f. + // + // To avoid this problem, we record a separate max inlining depth for each + // script, indicating at which depth we won't be able to inline all functions + // we inlined this time. This solves the issue above, because we will only + // inline f if it means we can also inline g. + if (targetScript->hasLoops() && + inliningDepth_ >= targetScript->baselineScript()->maxInliningDepth()) + { + trackOptimizationOutcome(TrackedOutcome::CantInlineExceededDepth); + return DontInline(targetScript, "Vetoed: exceeding allowed script inline depth"); + } + + // Update the max depth at which we can inline the outer script. + MOZ_ASSERT(maxInlineDepth > inliningDepth_); + uint32_t scriptInlineDepth = maxInlineDepth - inliningDepth_ - 1; + if (scriptInlineDepth < outerBaseline->maxInliningDepth()) + outerBaseline->setMaxInliningDepth(scriptInlineDepth); + + // End of heuristics, we will inline this function. + + // TI calls ObjectStateChange to trigger invalidation of the caller. + TypeSet::ObjectKey* targetKey = TypeSet::ObjectKey::get(target); + targetKey->watchStateChangeForInlinedCall(constraints()); + + outerBuilder->inlinedBytecodeLength_ += targetScript->length(); + + return InliningDecision_Inline; +} + +bool +IonBuilder::selectInliningTargets(const ObjectVector& targets, CallInfo& callInfo, BoolVector& choiceSet, + uint32_t* numInlineable) +{ + *numInlineable = 0; + uint32_t totalSize = 0; + + // For each target, ask whether it may be inlined. + if (!choiceSet.reserve(targets.length())) + return false; + + // Don't inline polymorphic sites during the definite properties analysis. + // AddClearDefiniteFunctionUsesInScript depends on this for correctness. + if (info().analysisMode() == Analysis_DefiniteProperties && targets.length() > 1) + return true; + + for (size_t i = 0; i < targets.length(); i++) { + JSObject* target = targets[i]; + + trackOptimizationAttempt(TrackedStrategy::Call_Inline); + trackTypeInfo(TrackedTypeSite::Call_Target, target); + + bool inlineable; + InliningDecision decision = makeInliningDecision(target, callInfo); + switch (decision) { + case InliningDecision_Error: + return false; + case InliningDecision_DontInline: + case InliningDecision_WarmUpCountTooLow: + inlineable = false; + break; + case InliningDecision_Inline: + inlineable = true; + break; + default: + MOZ_CRASH("Unhandled InliningDecision value!"); + } + + if (target->is<JSFunction>()) { + // Enforce a maximum inlined bytecode limit at the callsite. + if (inlineable && target->as<JSFunction>().isInterpreted()) { + totalSize += target->as<JSFunction>().nonLazyScript()->length(); + bool offThread = options.offThreadCompilationAvailable(); + if (totalSize > optimizationInfo().inlineMaxBytecodePerCallSite(offThread)) + inlineable = false; + } + } else { + // Non-function targets are not supported by polymorphic inlining. + inlineable = false; + } + + choiceSet.infallibleAppend(inlineable); + if (inlineable) + *numInlineable += 1; + } + + // If optimization tracking is turned on and one of the inlineable targets + // is a native, track the type info of the call. Most native inlinings + // depend on the types of the arguments and the return value. + if (isOptimizationTrackingEnabled()) { + for (size_t i = 0; i < targets.length(); i++) { + if (choiceSet[i] && targets[i]->as<JSFunction>().isNative()) { + trackTypeInfo(callInfo); + break; + } + } + } + + MOZ_ASSERT(choiceSet.length() == targets.length()); + return true; +} + +static bool +CanInlineGetPropertyCache(MGetPropertyCache* cache, MDefinition* thisDef) +{ + MOZ_ASSERT(cache->object()->type() == MIRType::Object); + if (cache->object() != thisDef) + return false; + + InlinePropertyTable* table = cache->propTable(); + if (!table) + return false; + if (table->numEntries() == 0) + return false; + return true; +} + +class WrapMGetPropertyCache +{ + MGetPropertyCache* cache_; + + private: + void discardPriorResumePoint() { + if (!cache_) + return; + + InlinePropertyTable* propTable = cache_->propTable(); + if (!propTable) + return; + MResumePoint* rp = propTable->takePriorResumePoint(); + if (!rp) + return; + cache_->block()->discardPreAllocatedResumePoint(rp); + } + + public: + explicit WrapMGetPropertyCache(MGetPropertyCache* cache) + : cache_(cache) + { } + + ~WrapMGetPropertyCache() { + discardPriorResumePoint(); + } + + MGetPropertyCache* get() { + return cache_; + } + MGetPropertyCache* operator->() { + return get(); + } + + // This function returns the cache given to the constructor if the + // GetPropertyCache can be moved into the ObjectGroup fallback path. + MGetPropertyCache* moveableCache(bool hasTypeBarrier, MDefinition* thisDef) { + // If we have unhandled uses of the MGetPropertyCache, then we cannot + // move it to the ObjectGroup fallback path. + if (!hasTypeBarrier) { + if (cache_->hasUses()) + return nullptr; + } else { + // There is the TypeBarrier consumer, so we check that this is the + // only consumer. + MOZ_ASSERT(cache_->hasUses()); + if (!cache_->hasOneUse()) + return nullptr; + } + + // If the this-object is not identical to the object of the + // MGetPropertyCache, then we cannot use the InlinePropertyTable, or if + // we do not yet have enough information from the ObjectGroup. + if (!CanInlineGetPropertyCache(cache_, thisDef)) + return nullptr; + + MGetPropertyCache* ret = cache_; + cache_ = nullptr; + return ret; + } +}; + +MGetPropertyCache* +IonBuilder::getInlineableGetPropertyCache(CallInfo& callInfo) +{ + if (callInfo.constructing()) + return nullptr; + + MDefinition* thisDef = callInfo.thisArg(); + if (thisDef->type() != MIRType::Object) + return nullptr; + + MDefinition* funcDef = callInfo.fun(); + if (funcDef->type() != MIRType::Object) + return nullptr; + + // MGetPropertyCache with no uses may be optimized away. + if (funcDef->isGetPropertyCache()) { + WrapMGetPropertyCache cache(funcDef->toGetPropertyCache()); + return cache.moveableCache(/* hasTypeBarrier = */ false, thisDef); + } + + // Optimize away the following common pattern: + // MTypeBarrier[MIRType::Object] <- MGetPropertyCache + if (funcDef->isTypeBarrier()) { + MTypeBarrier* barrier = funcDef->toTypeBarrier(); + if (barrier->hasUses()) + return nullptr; + if (barrier->type() != MIRType::Object) + return nullptr; + if (!barrier->input()->isGetPropertyCache()) + return nullptr; + + WrapMGetPropertyCache cache(barrier->input()->toGetPropertyCache()); + return cache.moveableCache(/* hasTypeBarrier = */ true, thisDef); + } + + return nullptr; +} + +IonBuilder::InliningStatus +IonBuilder::inlineSingleCall(CallInfo& callInfo, JSObject* targetArg) +{ + if (!targetArg->is<JSFunction>()) { + InliningStatus status = inlineNonFunctionCall(callInfo, targetArg); + trackInlineSuccess(status); + return status; + } + + JSFunction* target = &targetArg->as<JSFunction>(); + if (target->isNative()) { + InliningStatus status = inlineNativeCall(callInfo, target); + trackInlineSuccess(status); + return status; + } + + // Track success now, as inlining a scripted call makes a new return block + // which has a different pc than the current call pc. + trackInlineSuccess(); + return inlineScriptedCall(callInfo, target); +} + +IonBuilder::InliningStatus +IonBuilder::inlineCallsite(const ObjectVector& targets, CallInfo& callInfo) +{ + if (targets.empty()) { + trackOptimizationAttempt(TrackedStrategy::Call_Inline); + trackOptimizationOutcome(TrackedOutcome::CantInlineNoTarget); + return InliningStatus_NotInlined; + } + + // Is the function provided by an MGetPropertyCache? + // If so, the cache may be movable to a fallback path, with a dispatch + // instruction guarding on the incoming ObjectGroup. + WrapMGetPropertyCache propCache(getInlineableGetPropertyCache(callInfo)); + keepFallbackFunctionGetter(propCache.get()); + + // Inline single targets -- unless they derive from a cache, in which case + // avoiding the cache and guarding is still faster. + if (!propCache.get() && targets.length() == 1) { + JSObject* target = targets[0]; + + trackOptimizationAttempt(TrackedStrategy::Call_Inline); + trackTypeInfo(TrackedTypeSite::Call_Target, target); + + InliningDecision decision = makeInliningDecision(target, callInfo); + switch (decision) { + case InliningDecision_Error: + return InliningStatus_Error; + case InliningDecision_DontInline: + return InliningStatus_NotInlined; + case InliningDecision_WarmUpCountTooLow: + return InliningStatus_WarmUpCountTooLow; + case InliningDecision_Inline: + break; + } + + // Inlining will elminate uses of the original callee, but it needs to + // be preserved in phis if we bail out. Mark the old callee definition as + // implicitly used to ensure this happens. + callInfo.fun()->setImplicitlyUsedUnchecked(); + + // If the callee is not going to be a lambda (which may vary across + // different invocations), then the callee definition can be replaced by a + // constant. + if (target->isSingleton()) { + // Replace the function with an MConstant. + MConstant* constFun = constant(ObjectValue(*target)); + if (callInfo.constructing() && callInfo.getNewTarget() == callInfo.fun()) + callInfo.setNewTarget(constFun); + callInfo.setFun(constFun); + } + + return inlineSingleCall(callInfo, target); + } + + // Choose a subset of the targets for polymorphic inlining. + BoolVector choiceSet(alloc()); + uint32_t numInlined; + if (!selectInliningTargets(targets, callInfo, choiceSet, &numInlined)) + return InliningStatus_Error; + if (numInlined == 0) + return InliningStatus_NotInlined; + + // Perform a polymorphic dispatch. + if (!inlineCalls(callInfo, targets, choiceSet, propCache.get())) + return InliningStatus_Error; + + return InliningStatus_Inlined; +} + +bool +IonBuilder::inlineGenericFallback(JSFunction* target, CallInfo& callInfo, MBasicBlock* dispatchBlock) +{ + // Generate a new block with all arguments on-stack. + MBasicBlock* fallbackBlock = newBlock(dispatchBlock, pc); + if (!fallbackBlock) + return false; + + // Create a new CallInfo to track modified state within this block. + CallInfo fallbackInfo(alloc(), callInfo.constructing()); + if (!fallbackInfo.init(callInfo)) + return false; + fallbackInfo.popFormals(fallbackBlock); + + // Generate an MCall, which uses stateful |current|. + if (!setCurrentAndSpecializePhis(fallbackBlock)) + return false; + if (!makeCall(target, fallbackInfo)) + return false; + + // Pass return block to caller as |current|. + return true; +} + +bool +IonBuilder::inlineObjectGroupFallback(CallInfo& callInfo, MBasicBlock* dispatchBlock, + MObjectGroupDispatch* dispatch, MGetPropertyCache* cache, + MBasicBlock** fallbackTarget) +{ + // Getting here implies the following: + // 1. The call function is an MGetPropertyCache, or an MGetPropertyCache + // followed by an MTypeBarrier. + MOZ_ASSERT(callInfo.fun()->isGetPropertyCache() || callInfo.fun()->isTypeBarrier()); + + // 2. The MGetPropertyCache has inlineable cases by guarding on the ObjectGroup. + MOZ_ASSERT(dispatch->numCases() > 0); + + // 3. The MGetPropertyCache (and, if applicable, MTypeBarrier) only + // have at most a single use. + MOZ_ASSERT_IF(callInfo.fun()->isGetPropertyCache(), !cache->hasUses()); + MOZ_ASSERT_IF(callInfo.fun()->isTypeBarrier(), cache->hasOneUse()); + + // This means that no resume points yet capture the MGetPropertyCache, + // so everything from the MGetPropertyCache up until the call is movable. + // We now move the MGetPropertyCache and friends into a fallback path. + MOZ_ASSERT(cache->idempotent()); + + // Create a new CallInfo to track modified state within the fallback path. + CallInfo fallbackInfo(alloc(), callInfo.constructing()); + if (!fallbackInfo.init(callInfo)) + return false; + + // Capture stack prior to the call operation. This captures the function. + MResumePoint* preCallResumePoint = + MResumePoint::New(alloc(), dispatchBlock, pc, MResumePoint::ResumeAt); + if (!preCallResumePoint) + return false; + + DebugOnly<size_t> preCallFuncIndex = preCallResumePoint->stackDepth() - callInfo.numFormals(); + MOZ_ASSERT(preCallResumePoint->getOperand(preCallFuncIndex) == fallbackInfo.fun()); + + // In the dispatch block, replace the function's slot entry with Undefined. + MConstant* undefined = MConstant::New(alloc(), UndefinedValue()); + dispatchBlock->add(undefined); + dispatchBlock->rewriteAtDepth(-int(callInfo.numFormals()), undefined); + + // Construct a block that does nothing but remove formals from the stack. + // This is effectively changing the entry resume point of the later fallback block. + MBasicBlock* prepBlock = newBlock(dispatchBlock, pc); + if (!prepBlock) + return false; + fallbackInfo.popFormals(prepBlock); + + // Construct a block into which the MGetPropertyCache can be moved. + // This is subtle: the pc and resume point are those of the MGetPropertyCache! + InlinePropertyTable* propTable = cache->propTable(); + MResumePoint* priorResumePoint = propTable->takePriorResumePoint(); + MOZ_ASSERT(propTable->pc() != nullptr); + MOZ_ASSERT(priorResumePoint != nullptr); + MBasicBlock* getPropBlock = newBlock(prepBlock, propTable->pc(), priorResumePoint); + if (!getPropBlock) + return false; + + prepBlock->end(MGoto::New(alloc(), getPropBlock)); + + // Since the getPropBlock inherited the stack from right before the MGetPropertyCache, + // the target of the MGetPropertyCache is still on the stack. + DebugOnly<MDefinition*> checkObject = getPropBlock->pop(); + MOZ_ASSERT(checkObject == cache->object()); + + // Move the MGetPropertyCache and friends into the getPropBlock. + if (fallbackInfo.fun()->isGetPropertyCache()) { + MOZ_ASSERT(fallbackInfo.fun()->toGetPropertyCache() == cache); + getPropBlock->addFromElsewhere(cache); + getPropBlock->push(cache); + } else { + MTypeBarrier* barrier = callInfo.fun()->toTypeBarrier(); + MOZ_ASSERT(barrier->type() == MIRType::Object); + MOZ_ASSERT(barrier->input()->isGetPropertyCache()); + MOZ_ASSERT(barrier->input()->toGetPropertyCache() == cache); + + getPropBlock->addFromElsewhere(cache); + getPropBlock->addFromElsewhere(barrier); + getPropBlock->push(barrier); + } + + // Construct an end block with the correct resume point. + MBasicBlock* preCallBlock = newBlock(getPropBlock, pc, preCallResumePoint); + if (!preCallBlock) + return false; + getPropBlock->end(MGoto::New(alloc(), preCallBlock)); + + // Now inline the MCallGeneric, using preCallBlock as the dispatch point. + if (!inlineGenericFallback(nullptr, fallbackInfo, preCallBlock)) + return false; + + // inlineGenericFallback() set the return block as |current|. + preCallBlock->end(MGoto::New(alloc(), current)); + *fallbackTarget = prepBlock; + return true; +} + +bool +IonBuilder::inlineCalls(CallInfo& callInfo, const ObjectVector& targets, BoolVector& choiceSet, + MGetPropertyCache* maybeCache) +{ + // Only handle polymorphic inlining. + MOZ_ASSERT(IsIonInlinablePC(pc)); + MOZ_ASSERT(choiceSet.length() == targets.length()); + MOZ_ASSERT_IF(!maybeCache, targets.length() >= 2); + MOZ_ASSERT_IF(maybeCache, targets.length() >= 1); + + MBasicBlock* dispatchBlock = current; + callInfo.setImplicitlyUsedUnchecked(); + callInfo.pushFormals(dispatchBlock); + + // Patch any InlinePropertyTable to only contain functions that are + // inlineable. The InlinePropertyTable will also be patched at the end to + // exclude native functions that vetoed inlining. + if (maybeCache) { + InlinePropertyTable* propTable = maybeCache->propTable(); + propTable->trimToTargets(targets); + if (propTable->numEntries() == 0) + maybeCache = nullptr; + } + + // Generate a dispatch based on guard kind. + MDispatchInstruction* dispatch; + if (maybeCache) { + dispatch = MObjectGroupDispatch::New(alloc(), maybeCache->object(), maybeCache->propTable()); + callInfo.fun()->setImplicitlyUsedUnchecked(); + } else { + dispatch = MFunctionDispatch::New(alloc(), callInfo.fun()); + } + + // Generate a return block to host the rval-collecting MPhi. + jsbytecode* postCall = GetNextPc(pc); + MBasicBlock* returnBlock = newBlock(nullptr, postCall); + if (!returnBlock) + return false; + returnBlock->setCallerResumePoint(callerResumePoint_); + + // Set up stack, used to manually create a post-call resume point. + returnBlock->inheritSlots(dispatchBlock); + callInfo.popFormals(returnBlock); + + MPhi* retPhi = MPhi::New(alloc()); + returnBlock->addPhi(retPhi); + returnBlock->push(retPhi); + + // Create a resume point from current stack state. + if (!returnBlock->initEntrySlots(alloc())) + return false; + + // Reserve the capacity for the phi. + // Note: this is an upperbound. Unreachable targets and uninlineable natives are also counted. + uint32_t count = 1; // Possible fallback block. + for (uint32_t i = 0; i < targets.length(); i++) { + if (choiceSet[i]) + count++; + } + if (!retPhi->reserveLength(count)) + return false; + + // Inline each of the inlineable targets. + for (uint32_t i = 0; i < targets.length(); i++) { + // Target must be inlineable. + if (!choiceSet[i]) + continue; + + // Even though we made one round of inline decisions already, we may + // be amending them below. + amendOptimizationAttempt(i); + + // Target must be reachable by the MDispatchInstruction. + JSFunction* target = &targets[i]->as<JSFunction>(); + if (maybeCache && !maybeCache->propTable()->hasFunction(target)) { + choiceSet[i] = false; + trackOptimizationOutcome(TrackedOutcome::CantInlineNotInDispatch); + continue; + } + + MBasicBlock* inlineBlock = newBlock(dispatchBlock, pc); + if (!inlineBlock) + return false; + + // Create a function MConstant to use in the entry ResumePoint. If we + // can't use a constant, add a no-op MPolyInlineGuard, to prevent + // hoisting env chain gets above the dispatch instruction. + MInstruction* funcDef; + if (target->isSingleton()) + funcDef = MConstant::New(alloc(), ObjectValue(*target), constraints()); + else + funcDef = MPolyInlineGuard::New(alloc(), callInfo.fun()); + + funcDef->setImplicitlyUsedUnchecked(); + dispatchBlock->add(funcDef); + + // Use the inlined callee in the inline resume point and on stack. + int funIndex = inlineBlock->entryResumePoint()->stackDepth() - callInfo.numFormals(); + inlineBlock->entryResumePoint()->replaceOperand(funIndex, funcDef); + inlineBlock->rewriteSlot(funIndex, funcDef); + + // Create a new CallInfo to track modified state within the inline block. + CallInfo inlineInfo(alloc(), callInfo.constructing()); + if (!inlineInfo.init(callInfo)) + return false; + inlineInfo.popFormals(inlineBlock); + inlineInfo.setFun(funcDef); + + if (maybeCache) { + // Assign the 'this' value a TypeSet specialized to the groups that + // can generate this inlining target. + MOZ_ASSERT(callInfo.thisArg() == maybeCache->object()); + TemporaryTypeSet* thisTypes = maybeCache->propTable()->buildTypeSetForFunction(target); + if (!thisTypes) + return false; + + MFilterTypeSet* filter = MFilterTypeSet::New(alloc(), inlineInfo.thisArg(), thisTypes); + inlineBlock->add(filter); + inlineInfo.setThis(filter); + } + + // Inline the call into the inlineBlock. + if (!setCurrentAndSpecializePhis(inlineBlock)) + return false; + InliningStatus status = inlineSingleCall(inlineInfo, target); + if (status == InliningStatus_Error) + return false; + + // Natives may veto inlining. + if (status == InliningStatus_NotInlined) { + MOZ_ASSERT(current == inlineBlock); + graph().removeBlock(inlineBlock); + choiceSet[i] = false; + continue; + } + + // inlineSingleCall() changed |current| to the inline return block. + MBasicBlock* inlineReturnBlock = current; + setCurrent(dispatchBlock); + + // Connect the inline path to the returnBlock. + ObjectGroup* funcGroup = target->isSingleton() ? nullptr : target->group(); + if (!dispatch->addCase(target, funcGroup, inlineBlock)) + return false; + + MDefinition* retVal = inlineReturnBlock->peek(-1); + retPhi->addInput(retVal); + inlineReturnBlock->end(MGoto::New(alloc(), returnBlock)); + if (!returnBlock->addPredecessorWithoutPhis(inlineReturnBlock)) + return false; + } + + // Patch the InlinePropertyTable to not dispatch to vetoed paths. + bool useFallback; + if (maybeCache) { + InlinePropertyTable* propTable = maybeCache->propTable(); + propTable->trimTo(targets, choiceSet); + + if (propTable->numEntries() == 0 || !propTable->hasPriorResumePoint()) { + // Output a generic fallback path. + MOZ_ASSERT_IF(propTable->numEntries() == 0, dispatch->numCases() == 0); + maybeCache = nullptr; + useFallback = true; + } else { + // We need a fallback path if the ObjectGroup dispatch does not + // handle all incoming objects. + useFallback = false; + TemporaryTypeSet* objectTypes = maybeCache->object()->resultTypeSet(); + for (uint32_t i = 0; i < objectTypes->getObjectCount(); i++) { + TypeSet::ObjectKey* obj = objectTypes->getObject(i); + if (!obj) + continue; + + if (!obj->isGroup()) { + useFallback = true; + break; + } + + if (!propTable->hasObjectGroup(obj->group())) { + useFallback = true; + break; + } + } + + if (!useFallback) { + // The object group dispatch handles all possible incoming + // objects, so the cache and barrier will not be reached and + // can be eliminated. + if (callInfo.fun()->isGetPropertyCache()) { + MOZ_ASSERT(callInfo.fun() == maybeCache); + } else { + MTypeBarrier* barrier = callInfo.fun()->toTypeBarrier(); + MOZ_ASSERT(!barrier->hasUses()); + MOZ_ASSERT(barrier->type() == MIRType::Object); + MOZ_ASSERT(barrier->input()->isGetPropertyCache()); + MOZ_ASSERT(barrier->input()->toGetPropertyCache() == maybeCache); + barrier->block()->discard(barrier); + } + + MOZ_ASSERT(!maybeCache->hasUses()); + maybeCache->block()->discard(maybeCache); + } + } + } else { + useFallback = dispatch->numCases() < targets.length(); + } + + // If necessary, generate a fallback path. + if (useFallback) { + // Generate fallback blocks, and set |current| to the fallback return block. + if (maybeCache) { + MBasicBlock* fallbackTarget; + if (!inlineObjectGroupFallback(callInfo, dispatchBlock, + dispatch->toObjectGroupDispatch(), + maybeCache, &fallbackTarget)) + { + return false; + } + dispatch->addFallback(fallbackTarget); + } else { + JSFunction* remaining = nullptr; + + // If there is only 1 remaining case, we can annotate the fallback call + // with the target information. + if (dispatch->numCases() + 1 == targets.length()) { + for (uint32_t i = 0; i < targets.length(); i++) { + if (choiceSet[i]) + continue; + + MOZ_ASSERT(!remaining); + if (targets[i]->is<JSFunction>() && targets[i]->as<JSFunction>().isSingleton()) + remaining = &targets[i]->as<JSFunction>(); + break; + } + } + + if (!inlineGenericFallback(remaining, callInfo, dispatchBlock)) + return false; + dispatch->addFallback(current); + } + + MBasicBlock* fallbackReturnBlock = current; + + // Connect fallback case to return infrastructure. + MDefinition* retVal = fallbackReturnBlock->peek(-1); + retPhi->addInput(retVal); + fallbackReturnBlock->end(MGoto::New(alloc(), returnBlock)); + if (!returnBlock->addPredecessorWithoutPhis(fallbackReturnBlock)) + return false; + } + + // Finally add the dispatch instruction. + // This must be done at the end so that add() may be called above. + dispatchBlock->end(dispatch); + + // Check the depth change: +1 for retval + MOZ_ASSERT(returnBlock->stackDepth() == dispatchBlock->stackDepth() - callInfo.numFormals() + 1); + + graph().moveBlockToEnd(returnBlock); + return setCurrentAndSpecializePhis(returnBlock); +} + +MInstruction* +IonBuilder::createNamedLambdaObject(MDefinition* callee, MDefinition* env) +{ + // Get a template CallObject that we'll use to generate inline object + // creation. + LexicalEnvironmentObject* templateObj = inspector->templateNamedLambdaObject(); + + // One field is added to the function to handle its name. This cannot be a + // dynamic slot because there is still plenty of room on the NamedLambda object. + MOZ_ASSERT(!templateObj->hasDynamicSlots()); + + // Allocate the actual object. It is important that no intervening + // instructions could potentially bailout, thus leaking the dynamic slots + // pointer. + MInstruction* declEnvObj = MNewNamedLambdaObject::New(alloc(), templateObj); + current->add(declEnvObj); + + // Initialize the object's reserved slots. No post barrier is needed here: + // the object will be allocated in the nursery if possible, and if the + // tenured heap is used instead, a minor collection will have been performed + // that moved env/callee to the tenured heap. + current->add(MStoreFixedSlot::New(alloc(), declEnvObj, + NamedLambdaObject::enclosingEnvironmentSlot(), env)); + current->add(MStoreFixedSlot::New(alloc(), declEnvObj, + NamedLambdaObject::lambdaSlot(), callee)); + + return declEnvObj; +} + +MInstruction* +IonBuilder::createCallObject(MDefinition* callee, MDefinition* env) +{ + // Get a template CallObject that we'll use to generate inline object + // creation. + CallObject* templateObj = inspector->templateCallObject(); + + // Allocate the object. Run-once scripts need a singleton type, so always do + // a VM call in such cases. + MNewCallObjectBase* callObj; + if (script()->treatAsRunOnce() || templateObj->isSingleton()) + callObj = MNewSingletonCallObject::New(alloc(), templateObj); + else + callObj = MNewCallObject::New(alloc(), templateObj); + current->add(callObj); + + // Initialize the object's reserved slots. No post barrier is needed here, + // for the same reason as in createNamedLambdaObject. + current->add(MStoreFixedSlot::New(alloc(), callObj, CallObject::enclosingEnvironmentSlot(), env)); + current->add(MStoreFixedSlot::New(alloc(), callObj, CallObject::calleeSlot(), callee)); + + //if (!script()->functionHasParameterExprs()) { + + // Copy closed-over argument slots if there aren't parameter expressions. + MSlots* slots = nullptr; + for (PositionalFormalParameterIter fi(script()); fi; fi++) { + if (!fi.closedOver()) + continue; + + if (!alloc().ensureBallast()) + return nullptr; + + unsigned slot = fi.location().slot(); + unsigned formal = fi.argumentSlot(); + unsigned numFixedSlots = templateObj->numFixedSlots(); + MDefinition* param; + if (script()->functionHasParameterExprs()) + param = constant(MagicValue(JS_UNINITIALIZED_LEXICAL)); + else + param = current->getSlot(info().argSlotUnchecked(formal)); + if (slot >= numFixedSlots) { + if (!slots) { + slots = MSlots::New(alloc(), callObj); + current->add(slots); + } + current->add(MStoreSlot::New(alloc(), slots, slot - numFixedSlots, param)); + } else { + current->add(MStoreFixedSlot::New(alloc(), callObj, slot, param)); + } + } + + return callObj; +} + +MDefinition* +IonBuilder::createThisScripted(MDefinition* callee, MDefinition* newTarget) +{ + // Get callee.prototype. + // + // This instruction MUST be idempotent: since it does not correspond to an + // explicit operation in the bytecode, we cannot use resumeAfter(). + // Getters may not override |prototype| fetching, so this operation is indeed idempotent. + // - First try an idempotent property cache. + // - Upon failing idempotent property cache, we can't use a non-idempotent cache, + // therefore we fallback to CallGetProperty + // + // Note: both CallGetProperty and GetPropertyCache can trigger a GC, + // and thus invalidation. + MInstruction* getProto; + if (!invalidatedIdempotentCache()) { + MConstant* id = constant(StringValue(names().prototype)); + MGetPropertyCache* getPropCache = MGetPropertyCache::New(alloc(), newTarget, id, + /* monitored = */ false); + getPropCache->setIdempotent(); + getProto = getPropCache; + } else { + MCallGetProperty* callGetProp = MCallGetProperty::New(alloc(), newTarget, names().prototype); + callGetProp->setIdempotent(); + getProto = callGetProp; + } + current->add(getProto); + + // Create this from prototype + MCreateThisWithProto* createThis = MCreateThisWithProto::New(alloc(), callee, newTarget, getProto); + current->add(createThis); + + return createThis; +} + +JSObject* +IonBuilder::getSingletonPrototype(JSFunction* target) +{ + TypeSet::ObjectKey* targetKey = TypeSet::ObjectKey::get(target); + if (targetKey->unknownProperties()) + return nullptr; + + jsid protoid = NameToId(names().prototype); + HeapTypeSetKey protoProperty = targetKey->property(protoid); + + return protoProperty.singleton(constraints()); +} + +MDefinition* +IonBuilder::createThisScriptedSingleton(JSFunction* target, MDefinition* callee) +{ + if (!target->hasScript()) + return nullptr; + + // Get the singleton prototype (if exists) + JSObject* proto = getSingletonPrototype(target); + if (!proto) + return nullptr; + + JSObject* templateObject = inspector->getTemplateObject(pc); + if (!templateObject) + return nullptr; + if (!templateObject->is<PlainObject>() && !templateObject->is<UnboxedPlainObject>()) + return nullptr; + if (templateObject->staticPrototype() != proto) + return nullptr; + + TypeSet::ObjectKey* templateObjectKey = TypeSet::ObjectKey::get(templateObject->group()); + if (templateObjectKey->hasFlags(constraints(), OBJECT_FLAG_NEW_SCRIPT_CLEARED)) + return nullptr; + + StackTypeSet* thisTypes = TypeScript::ThisTypes(target->nonLazyScript()); + if (!thisTypes || !thisTypes->hasType(TypeSet::ObjectType(templateObject))) + return nullptr; + + // Generate an inline path to create a new |this| object with + // the given singleton prototype. + MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + MCreateThisWithTemplate* createThis = + MCreateThisWithTemplate::New(alloc(), constraints(), templateConst, + templateObject->group()->initialHeap(constraints())); + current->add(templateConst); + current->add(createThis); + + return createThis; +} + +MDefinition* +IonBuilder::createThisScriptedBaseline(MDefinition* callee) +{ + // Try to inline |this| creation based on Baseline feedback. + + JSFunction* target = inspector->getSingleCallee(pc); + if (!target || !target->hasScript()) + return nullptr; + + JSObject* templateObject = inspector->getTemplateObject(pc); + if (!templateObject) + return nullptr; + if (!templateObject->is<PlainObject>() && !templateObject->is<UnboxedPlainObject>()) + return nullptr; + + Shape* shape = target->lookupPure(compartment->runtime()->names().prototype); + if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot()) + return nullptr; + + Value protov = target->getSlot(shape->slot()); + if (!protov.isObject()) + return nullptr; + + JSObject* proto = checkNurseryObject(&protov.toObject()); + if (proto != templateObject->staticPrototype()) + return nullptr; + + TypeSet::ObjectKey* templateObjectKey = TypeSet::ObjectKey::get(templateObject->group()); + if (templateObjectKey->hasFlags(constraints(), OBJECT_FLAG_NEW_SCRIPT_CLEARED)) + return nullptr; + + StackTypeSet* thisTypes = TypeScript::ThisTypes(target->nonLazyScript()); + if (!thisTypes || !thisTypes->hasType(TypeSet::ObjectType(templateObject))) + return nullptr; + + // Shape guard. + callee = addShapeGuard(callee, target->lastProperty(), Bailout_ShapeGuard); + + // Guard callee.prototype == proto. + MOZ_ASSERT(shape->numFixedSlots() == 0, "Must be a dynamic slot"); + MSlots* slots = MSlots::New(alloc(), callee); + current->add(slots); + MLoadSlot* prototype = MLoadSlot::New(alloc(), slots, shape->slot()); + current->add(prototype); + MDefinition* protoConst = constant(ObjectValue(*proto)); + MGuardObjectIdentity* guard = MGuardObjectIdentity::New(alloc(), prototype, protoConst, + /* bailOnEquality = */ false); + current->add(guard); + + // Generate an inline path to create a new |this| object with + // the given prototype. + MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + MCreateThisWithTemplate* createThis = + MCreateThisWithTemplate::New(alloc(), constraints(), templateConst, + templateObject->group()->initialHeap(constraints())); + current->add(templateConst); + current->add(createThis); + + return createThis; +} + +MDefinition* +IonBuilder::createThis(JSFunction* target, MDefinition* callee, MDefinition* newTarget) +{ + // Create |this| for unknown target. + if (!target) { + if (MDefinition* createThis = createThisScriptedBaseline(callee)) + return createThis; + + MCreateThis* createThis = MCreateThis::New(alloc(), callee, newTarget); + current->add(createThis); + return createThis; + } + + // Native constructors build the new Object themselves. + if (target->isNative()) { + if (!target->isConstructor()) + return nullptr; + + MConstant* magic = MConstant::New(alloc(), MagicValue(JS_IS_CONSTRUCTING)); + current->add(magic); + return magic; + } + + if (target->isBoundFunction()) + return constant(MagicValue(JS_UNINITIALIZED_LEXICAL)); + + if (target->isDerivedClassConstructor()) { + MOZ_ASSERT(target->isClassConstructor()); + return constant(MagicValue(JS_UNINITIALIZED_LEXICAL)); + } + + // Try baking in the prototype. + if (MDefinition* createThis = createThisScriptedSingleton(target, callee)) + return createThis; + + if (MDefinition* createThis = createThisScriptedBaseline(callee)) + return createThis; + + return createThisScripted(callee, newTarget); +} + +bool +IonBuilder::jsop_funcall(uint32_t argc) +{ + // Stack for JSOP_FUNCALL: + // 1: arg0 + // ... + // argc: argN + // argc+1: JSFunction*, the 'f' in |f.call()|, in |this| position. + // argc+2: The native 'call' function. + + int calleeDepth = -((int)argc + 2); + int funcDepth = -((int)argc + 1); + + // If |Function.prototype.call| may be overridden, don't optimize callsite. + TemporaryTypeSet* calleeTypes = current->peek(calleeDepth)->resultTypeSet(); + JSFunction* native = getSingleCallTarget(calleeTypes); + if (!native || !native->isNative() || native->native() != &fun_call) { + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, argc)) + return false; + return makeCall(native, callInfo); + } + current->peek(calleeDepth)->setImplicitlyUsedUnchecked(); + + // Extract call target. + TemporaryTypeSet* funTypes = current->peek(funcDepth)->resultTypeSet(); + JSFunction* target = getSingleCallTarget(funTypes); + + // Shimmy the slots down to remove the native 'call' function. + current->shimmySlots(funcDepth - 1); + + bool zeroArguments = (argc == 0); + + // If no |this| argument was provided, explicitly pass Undefined. + // Pushing is safe here, since one stack slot has been removed. + if (zeroArguments) { + pushConstant(UndefinedValue()); + } else { + // |this| becomes implicit in the call. + argc -= 1; + } + + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, argc)) + return false; + + // Try to inline the call. + if (!zeroArguments) { + InliningDecision decision = makeInliningDecision(target, callInfo); + switch (decision) { + case InliningDecision_Error: + return false; + case InliningDecision_DontInline: + case InliningDecision_WarmUpCountTooLow: + break; + case InliningDecision_Inline: + if (target->isInterpreted()) { + InliningStatus status = inlineScriptedCall(callInfo, target); + if (status == InliningStatus_Inlined) + return true; + if (status == InliningStatus_Error) + return false; + } + break; + } + } + + // Call without inlining. + return makeCall(target, callInfo); +} + +bool +IonBuilder::jsop_funapply(uint32_t argc) +{ + int calleeDepth = -((int)argc + 2); + + TemporaryTypeSet* calleeTypes = current->peek(calleeDepth)->resultTypeSet(); + JSFunction* native = getSingleCallTarget(calleeTypes); + if (argc != 2 || info().analysisMode() == Analysis_ArgumentsUsage) { + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, argc)) + return false; + return makeCall(native, callInfo); + } + + // Disable compilation if the second argument to |apply| cannot be guaranteed + // to be either definitely |arguments| or definitely not |arguments|. + MDefinition* argument = current->peek(-1); + if (script()->argumentsHasVarBinding() && + argument->mightBeType(MIRType::MagicOptimizedArguments) && + argument->type() != MIRType::MagicOptimizedArguments) + { + return abort("fun.apply with MaybeArguments"); + } + + // Fallback to regular call if arg 2 is not definitely |arguments|. + if (argument->type() != MIRType::MagicOptimizedArguments) { + // Optimize fun.apply(self, array) if the length is sane and there are no holes. + TemporaryTypeSet* objTypes = argument->resultTypeSet(); + if (native && native->isNative() && native->native() == fun_apply && + objTypes && + objTypes->getKnownClass(constraints()) == &ArrayObject::class_ && + !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) && + ElementAccessIsPacked(constraints(), argument)) + { + return jsop_funapplyarray(argc); + } + + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, argc)) + return false; + return makeCall(native, callInfo); + } + + if ((!native || !native->isNative() || + native->native() != fun_apply) && + info().analysisMode() != Analysis_DefiniteProperties) + { + return abort("fun.apply speculation failed"); + } + + // Use funapply that definitely uses |arguments| + return jsop_funapplyarguments(argc); +} + +bool +IonBuilder::jsop_funapplyarray(uint32_t argc) +{ + MOZ_ASSERT(argc == 2); + + int funcDepth = -((int)argc + 1); + + // Extract call target. + TemporaryTypeSet* funTypes = current->peek(funcDepth)->resultTypeSet(); + JSFunction* target = getSingleCallTarget(funTypes); + + // Pop the array agument + MDefinition* argObj = current->pop(); + + MElements* elements = MElements::New(alloc(), argObj); + current->add(elements); + + // Pop the |this| argument. + MDefinition* argThis = current->pop(); + + // Unwrap the (JSFunction *) parameter. + MDefinition* argFunc = current->pop(); + + // Pop apply function. + MDefinition* nativeFunc = current->pop(); + nativeFunc->setImplicitlyUsedUnchecked(); + + WrappedFunction* wrappedTarget = target ? new(alloc()) WrappedFunction(target) : nullptr; + MApplyArray* apply = MApplyArray::New(alloc(), wrappedTarget, argFunc, elements, argThis); + current->add(apply); + current->push(apply); + if (!resumeAfter(apply)) + return false; + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(apply, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::jsop_funapplyarguments(uint32_t argc) +{ + // Stack for JSOP_FUNAPPLY: + // 1: Vp + // 2: This + // argc+1: JSFunction*, the 'f' in |f.call()|, in |this| position. + // argc+2: The native 'apply' function. + + int funcDepth = -((int)argc + 1); + + // Extract call target. + TemporaryTypeSet* funTypes = current->peek(funcDepth)->resultTypeSet(); + JSFunction* target = getSingleCallTarget(funTypes); + + // When this script isn't inlined, use MApplyArgs, + // to copy the arguments from the stack and call the function + if (inliningDepth_ == 0 && info().analysisMode() != Analysis_DefiniteProperties) { + // The array argument corresponds to the arguments object. As the JIT + // is implicitly reading the arguments object in the next instruction, + // we need to prevent the deletion of the arguments object from resume + // points, so that Baseline will behave correctly after a bailout. + MDefinition* vp = current->pop(); + vp->setImplicitlyUsedUnchecked(); + + MDefinition* argThis = current->pop(); + + // Unwrap the (JSFunction*) parameter. + MDefinition* argFunc = current->pop(); + + // Pop apply function. + MDefinition* nativeFunc = current->pop(); + nativeFunc->setImplicitlyUsedUnchecked(); + + MArgumentsLength* numArgs = MArgumentsLength::New(alloc()); + current->add(numArgs); + + WrappedFunction* wrappedTarget = target ? new(alloc()) WrappedFunction(target) : nullptr; + MApplyArgs* apply = MApplyArgs::New(alloc(), wrappedTarget, argFunc, numArgs, argThis); + current->add(apply); + current->push(apply); + if (!resumeAfter(apply)) + return false; + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(apply, types, BarrierKind::TypeSet); + } + + // When inlining we have the arguments the function gets called with + // and can optimize even more, by just calling the functions with the args. + // We also try this path when doing the definite properties analysis, as we + // can inline the apply() target and don't care about the actual arguments + // that were passed in. + + CallInfo callInfo(alloc(), false); + + // Vp + MDefinition* vp = current->pop(); + vp->setImplicitlyUsedUnchecked(); + + // Arguments + if (inliningDepth_) { + if (!callInfo.setArgs(inlineCallInfo_->argv())) + return false; + } + + // This + MDefinition* argThis = current->pop(); + callInfo.setThis(argThis); + + // Pop function parameter. + MDefinition* argFunc = current->pop(); + callInfo.setFun(argFunc); + + // Pop apply function. + MDefinition* nativeFunc = current->pop(); + nativeFunc->setImplicitlyUsedUnchecked(); + + // Try to inline the call. + InliningDecision decision = makeInliningDecision(target, callInfo); + switch (decision) { + case InliningDecision_Error: + return false; + case InliningDecision_DontInline: + case InliningDecision_WarmUpCountTooLow: + break; + case InliningDecision_Inline: + if (target->isInterpreted()) { + InliningStatus status = inlineScriptedCall(callInfo, target); + if (status == InliningStatus_Inlined) + return true; + if (status == InliningStatus_Error) + return false; + } + } + + return makeCall(target, callInfo); +} + +bool +IonBuilder::jsop_call(uint32_t argc, bool constructing) +{ + startTrackingOptimizations(); + + // If this call has never executed, try to seed the observed type set + // based on how the call result is used. + TemporaryTypeSet* observed = bytecodeTypes(pc); + if (observed->empty()) { + if (BytecodeFlowsToBitop(pc)) { + observed->addType(TypeSet::Int32Type(), alloc_->lifoAlloc()); + } else if (*GetNextPc(pc) == JSOP_POS) { + // Note: this is lame, overspecialized on the code patterns used + // by asm.js and should be replaced by a more general mechanism. + // See bug 870847. + observed->addType(TypeSet::DoubleType(), alloc_->lifoAlloc()); + } + } + + int calleeDepth = -((int)argc + 2 + constructing); + + // Acquire known call target if existent. + ObjectVector targets(alloc()); + TemporaryTypeSet* calleeTypes = current->peek(calleeDepth)->resultTypeSet(); + if (calleeTypes && !getPolyCallTargets(calleeTypes, constructing, targets, 4)) + return false; + + CallInfo callInfo(alloc(), constructing); + if (!callInfo.init(current, argc)) + return false; + + // Try inlining + InliningStatus status = inlineCallsite(targets, callInfo); + if (status == InliningStatus_Inlined) + return true; + if (status == InliningStatus_Error) + return false; + + // Discard unreferenced & pre-allocated resume points. + replaceMaybeFallbackFunctionGetter(nullptr); + + // No inline, just make the call. + JSFunction* target = nullptr; + if (targets.length() == 1 && targets[0]->is<JSFunction>()) + target = &targets[0]->as<JSFunction>(); + + if (target && status == InliningStatus_WarmUpCountTooLow) { + MRecompileCheck* check = + MRecompileCheck::New(alloc(), target->nonLazyScript(), + optimizationInfo().inliningRecompileThreshold(), + MRecompileCheck::RecompileCheck_Inlining); + current->add(check); + } + + return makeCall(target, callInfo); +} + +bool +IonBuilder::testShouldDOMCall(TypeSet* inTypes, JSFunction* func, JSJitInfo::OpType opType) +{ + if (!func->isNative() || !func->jitInfo()) + return false; + + // If all the DOM objects flowing through are legal with this + // property, we can bake in a call to the bottom half of the DOM + // accessor + DOMInstanceClassHasProtoAtDepth instanceChecker = + compartment->runtime()->DOMcallbacks()->instanceClassMatchesProto; + + const JSJitInfo* jinfo = func->jitInfo(); + if (jinfo->type() != opType) + return false; + + for (unsigned i = 0; i < inTypes->getObjectCount(); i++) { + TypeSet::ObjectKey* key = inTypes->getObject(i); + if (!key) + continue; + + if (!key->hasStableClassAndProto(constraints())) + return false; + + if (!instanceChecker(key->clasp(), jinfo->protoID, jinfo->depth)) + return false; + } + + return true; +} + +static bool +ArgumentTypesMatch(MDefinition* def, StackTypeSet* calleeTypes) +{ + if (!calleeTypes) + return false; + + if (def->resultTypeSet()) { + MOZ_ASSERT(def->type() == MIRType::Value || def->mightBeType(def->type())); + return def->resultTypeSet()->isSubset(calleeTypes); + } + + if (def->type() == MIRType::Value) + return false; + + if (def->type() == MIRType::Object) + return calleeTypes->unknownObject(); + + return calleeTypes->mightBeMIRType(def->type()); +} + +bool +IonBuilder::testNeedsArgumentCheck(JSFunction* target, CallInfo& callInfo) +{ + // If we have a known target, check if the caller arg types are a subset of callee. + // Since typeset accumulates and can't decrease that means we don't need to check + // the arguments anymore. + if (!target->hasScript()) + return true; + + JSScript* targetScript = target->nonLazyScript(); + + if (!ArgumentTypesMatch(callInfo.thisArg(), TypeScript::ThisTypes(targetScript))) + return true; + uint32_t expected_args = Min<uint32_t>(callInfo.argc(), target->nargs()); + for (size_t i = 0; i < expected_args; i++) { + if (!ArgumentTypesMatch(callInfo.getArg(i), TypeScript::ArgTypes(targetScript, i))) + return true; + } + for (size_t i = callInfo.argc(); i < target->nargs(); i++) { + if (!TypeScript::ArgTypes(targetScript, i)->mightBeMIRType(MIRType::Undefined)) + return true; + } + + return false; +} + +MCall* +IonBuilder::makeCallHelper(JSFunction* target, CallInfo& callInfo) +{ + // This function may be called with mutated stack. + // Querying TI for popped types is invalid. + + uint32_t targetArgs = callInfo.argc(); + + // Collect number of missing arguments provided that the target is + // scripted. Native functions are passed an explicit 'argc' parameter. + if (target && !target->isNative()) + targetArgs = Max<uint32_t>(target->nargs(), callInfo.argc()); + + bool isDOMCall = false; + if (target && !callInfo.constructing()) { + // We know we have a single call target. Check whether the "this" types + // are DOM types and our function a DOM function, and if so flag the + // MCall accordingly. + TemporaryTypeSet* thisTypes = callInfo.thisArg()->resultTypeSet(); + if (thisTypes && + thisTypes->getKnownMIRType() == MIRType::Object && + thisTypes->isDOMClass(constraints()) && + testShouldDOMCall(thisTypes, target, JSJitInfo::Method)) + { + isDOMCall = true; + } + } + + MCall* call = MCall::New(alloc(), target, targetArgs + 1 + callInfo.constructing(), + callInfo.argc(), callInfo.constructing(), isDOMCall); + if (!call) + return nullptr; + + if (callInfo.constructing()) + call->addArg(targetArgs + 1, callInfo.getNewTarget()); + + // Explicitly pad any missing arguments with |undefined|. + // This permits skipping the argumentsRectifier. + for (int i = targetArgs; i > (int)callInfo.argc(); i--) { + MOZ_ASSERT_IF(target, !target->isNative()); + MConstant* undef = constant(UndefinedValue()); + if (!alloc().ensureBallast()) + return nullptr; + call->addArg(i, undef); + } + + // Add explicit arguments. + // Skip addArg(0) because it is reserved for this + for (int32_t i = callInfo.argc() - 1; i >= 0; i--) + call->addArg(i + 1, callInfo.getArg(i)); + + // Now that we've told it about all the args, compute whether it's movable + call->computeMovable(); + + // Inline the constructor on the caller-side. + if (callInfo.constructing()) { + MDefinition* create = createThis(target, callInfo.fun(), callInfo.getNewTarget()); + if (!create) { + abort("Failure inlining constructor for call."); + return nullptr; + } + + callInfo.thisArg()->setImplicitlyUsedUnchecked(); + callInfo.setThis(create); + } + + // Pass |this| and function. + MDefinition* thisArg = callInfo.thisArg(); + call->addArg(0, thisArg); + + if (target && !testNeedsArgumentCheck(target, callInfo)) + call->disableArgCheck(); + + call->initFunction(callInfo.fun()); + + current->add(call); + return call; +} + +static bool +DOMCallNeedsBarrier(const JSJitInfo* jitinfo, TemporaryTypeSet* types) +{ + MOZ_ASSERT(jitinfo->type() != JSJitInfo::InlinableNative); + + // If the return type of our DOM native is in "types" already, we don't + // actually need a barrier. + if (jitinfo->returnType() == JSVAL_TYPE_UNKNOWN) + return true; + + // JSVAL_TYPE_OBJECT doesn't tell us much; we still have to barrier on the + // actual type of the object. + if (jitinfo->returnType() == JSVAL_TYPE_OBJECT) + return true; + + // No need for a barrier if we're already expecting the type we'll produce. + return MIRTypeFromValueType(jitinfo->returnType()) != types->getKnownMIRType(); +} + +bool +IonBuilder::makeCall(JSFunction* target, CallInfo& callInfo) +{ + // Constructor calls to non-constructors should throw. We don't want to use + // CallKnown in this case. + MOZ_ASSERT_IF(callInfo.constructing() && target, target->isConstructor()); + + MCall* call = makeCallHelper(target, callInfo); + if (!call) + return false; + + current->push(call); + if (call->isEffectful() && !resumeAfter(call)) + return false; + + TemporaryTypeSet* types = bytecodeTypes(pc); + + if (call->isCallDOMNative()) + return pushDOMTypeBarrier(call, types, call->getSingleTarget()->rawJSFunction()); + + return pushTypeBarrier(call, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::jsop_eval(uint32_t argc) +{ + int calleeDepth = -((int)argc + 2); + TemporaryTypeSet* calleeTypes = current->peek(calleeDepth)->resultTypeSet(); + + // Emit a normal call if the eval has never executed. This keeps us from + // disabling compilation for the script when testing with --ion-eager. + if (calleeTypes && calleeTypes->empty()) + return jsop_call(argc, /* constructing = */ false); + + JSFunction* singleton = getSingleCallTarget(calleeTypes); + if (!singleton) + return abort("No singleton callee for eval()"); + + if (script()->global().valueIsEval(ObjectValue(*singleton))) { + if (argc != 1) + return abort("Direct eval with more than one argument"); + + if (!info().funMaybeLazy()) + return abort("Direct eval in global code"); + + if (info().funMaybeLazy()->isArrow()) + return abort("Direct eval from arrow function"); + + CallInfo callInfo(alloc(), /* constructing = */ false); + if (!callInfo.init(current, argc)) + return false; + callInfo.setImplicitlyUsedUnchecked(); + + callInfo.fun()->setImplicitlyUsedUnchecked(); + + MDefinition* envChain = current->environmentChain(); + MDefinition* string = callInfo.getArg(0); + + // Direct eval acts as identity on non-string types according to + // ES5 15.1.2.1 step 1. + if (!string->mightBeType(MIRType::String)) { + current->push(string); + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(string, types, BarrierKind::TypeSet); + } + + if (!jsop_newtarget()) + return false; + MDefinition* newTargetValue = current->pop(); + + // Try to pattern match 'eval(v + "()")'. In this case v is likely a + // name on the env chain and the eval is performing a call on that + // value. Use an env chain lookup rather than a full eval. + if (string->isConcat() && + string->getOperand(1)->type() == MIRType::String && + string->getOperand(1)->maybeConstantValue()) + { + JSAtom* atom = &string->getOperand(1)->maybeConstantValue()->toString()->asAtom(); + + if (StringEqualsAscii(atom, "()")) { + MDefinition* name = string->getOperand(0); + MInstruction* dynamicName = MGetDynamicName::New(alloc(), envChain, name); + current->add(dynamicName); + + current->push(dynamicName); + current->push(constant(UndefinedValue())); // thisv + + CallInfo evalCallInfo(alloc(), /* constructing = */ false); + if (!evalCallInfo.init(current, /* argc = */ 0)) + return false; + + return makeCall(nullptr, evalCallInfo); + } + } + + MInstruction* ins = MCallDirectEval::New(alloc(), envChain, string, + newTargetValue, pc); + current->add(ins); + current->push(ins); + + TemporaryTypeSet* types = bytecodeTypes(pc); + return resumeAfter(ins) && pushTypeBarrier(ins, types, BarrierKind::TypeSet); + } + + return jsop_call(argc, /* constructing = */ false); +} + +bool +IonBuilder::jsop_compare(JSOp op) +{ + MDefinition* right = current->pop(); + MDefinition* left = current->pop(); + + return jsop_compare(op, left, right); +} + +bool +IonBuilder::jsop_compare(JSOp op, MDefinition* left, MDefinition* right) +{ + bool emitted = false; + + if (!forceInlineCaches()) { + if (!compareTrySpecialized(&emitted, op, left, right) || emitted) + return emitted; + if (!compareTryBitwise(&emitted, op, left, right) || emitted) + return emitted; + if (!compareTrySpecializedOnBaselineInspector(&emitted, op, left, right) || emitted) + return emitted; + } + + if (!compareTrySharedStub(&emitted, op, left, right) || emitted) + return emitted; + + // Not possible to optimize. Do a slow vm call. + MCompare* ins = MCompare::New(alloc(), left, right, op); + ins->cacheOperandMightEmulateUndefined(constraints()); + + current->add(ins); + current->push(ins); + if (ins->isEffectful() && !resumeAfter(ins)) + return false; + return true; +} + +static bool +ObjectOrSimplePrimitive(MDefinition* op) +{ + // Return true if op is either undefined/null/boolean/int32 or an object. + return !op->mightBeType(MIRType::String) + && !op->mightBeType(MIRType::Symbol) + && !op->mightBeType(MIRType::Double) + && !op->mightBeType(MIRType::Float32) + && !op->mightBeType(MIRType::MagicOptimizedArguments) + && !op->mightBeType(MIRType::MagicHole) + && !op->mightBeType(MIRType::MagicIsConstructing); +} + +bool +IonBuilder::compareTrySpecialized(bool* emitted, JSOp op, MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit an compare based on the input types. + + MCompare::CompareType type = MCompare::determineCompareType(op, left, right); + if (type == MCompare::Compare_Unknown) + return true; + + MCompare* ins = MCompare::New(alloc(), left, right, op); + ins->setCompareType(type); + ins->cacheOperandMightEmulateUndefined(constraints()); + + // Some compare types need to have the specific type in the rhs. + // Swap operands if that is not the case. + if (type == MCompare::Compare_StrictString && right->type() != MIRType::String) + ins->swapOperands(); + else if (type == MCompare::Compare_Null && right->type() != MIRType::Null) + ins->swapOperands(); + else if (type == MCompare::Compare_Undefined && right->type() != MIRType::Undefined) + ins->swapOperands(); + else if (type == MCompare::Compare_Boolean && right->type() != MIRType::Boolean) + ins->swapOperands(); + + // Replace inputs with unsigned variants if needed. + if (type == MCompare::Compare_UInt32) + ins->replaceWithUnsignedOperands(); + + current->add(ins); + current->push(ins); + + MOZ_ASSERT(!ins->isEffectful()); + *emitted = true; + return true; +} + +bool +IonBuilder::compareTryBitwise(bool* emitted, JSOp op, MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a bitwise compare. Check if a bitwise compare equals the wanted + // result for all observed operand types. + + // Onlye allow loose and strict equality. + if (op != JSOP_EQ && op != JSOP_NE && op != JSOP_STRICTEQ && op != JSOP_STRICTNE) + return true; + + // Only primitive (not double/string) or objects are supported. + // I.e. Undefined/Null/Boolean/Int32 and Object + if (!ObjectOrSimplePrimitive(left) || !ObjectOrSimplePrimitive(right)) + return true; + + // Objects that emulate undefined are not supported. + if (left->maybeEmulatesUndefined(constraints()) || right->maybeEmulatesUndefined(constraints())) + return true; + + // In the loose comparison more values could be the same, + // but value comparison reporting otherwise. + if (op == JSOP_EQ || op == JSOP_NE) { + + // Undefined compared loosy to Null is not supported, + // because tag is different, but value can be the same (undefined == null). + if ((left->mightBeType(MIRType::Undefined) && right->mightBeType(MIRType::Null)) || + (left->mightBeType(MIRType::Null) && right->mightBeType(MIRType::Undefined))) + { + return true; + } + + // Int32 compared loosy to Boolean is not supported, + // because tag is different, but value can be the same (1 == true). + if ((left->mightBeType(MIRType::Int32) && right->mightBeType(MIRType::Boolean)) || + (left->mightBeType(MIRType::Boolean) && right->mightBeType(MIRType::Int32))) + { + return true; + } + + // For loosy comparison of an object with a Boolean/Number/String + // the valueOf the object is taken. Therefore not supported. + bool simpleLHS = left->mightBeType(MIRType::Boolean) || left->mightBeType(MIRType::Int32); + bool simpleRHS = right->mightBeType(MIRType::Boolean) || right->mightBeType(MIRType::Int32); + if ((left->mightBeType(MIRType::Object) && simpleRHS) || + (right->mightBeType(MIRType::Object) && simpleLHS)) + { + return true; + } + } + + MCompare* ins = MCompare::New(alloc(), left, right, op); + ins->setCompareType(MCompare::Compare_Bitwise); + ins->cacheOperandMightEmulateUndefined(constraints()); + + current->add(ins); + current->push(ins); + + MOZ_ASSERT(!ins->isEffectful()); + *emitted = true; + return true; +} + +bool +IonBuilder::compareTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to specialize based on any baseline caches that have been generated + // for the opcode. These will cause the instruction's type policy to insert + // fallible unboxes to the appropriate input types. + + // Strict equality isn't supported. + if (op == JSOP_STRICTEQ || op == JSOP_STRICTNE) + return true; + + MCompare::CompareType type = inspector->expectedCompareType(pc); + if (type == MCompare::Compare_Unknown) + return true; + + MCompare* ins = MCompare::New(alloc(), left, right, op); + ins->setCompareType(type); + ins->cacheOperandMightEmulateUndefined(constraints()); + + current->add(ins); + current->push(ins); + + MOZ_ASSERT(!ins->isEffectful()); + *emitted = true; + return true; +} + +bool +IonBuilder::compareTrySharedStub(bool* emitted, JSOp op, MDefinition* left, MDefinition* right) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a shared stub cache. + + if (JitOptions.disableSharedStubs) + return true; + + if (JSOp(*pc) == JSOP_CASE) + return true; + + MBinarySharedStub* stub = MBinarySharedStub::New(alloc(), left, right); + current->add(stub); + current->push(stub); + if (!resumeAfter(stub)) + return false; + + MUnbox* unbox = MUnbox::New(alloc(), current->pop(), MIRType::Boolean, MUnbox::Infallible); + current->add(unbox); + current->push(unbox); + + *emitted = true; + return true; +} + +bool +IonBuilder::newArrayTryTemplateObject(bool* emitted, JSObject* templateObject, uint32_t length) +{ + MOZ_ASSERT(*emitted == false); + + if (!templateObject) + return true; + + if (templateObject->is<UnboxedArrayObject>()) { + MOZ_ASSERT(templateObject->as<UnboxedArrayObject>().capacity() >= length); + if (!templateObject->as<UnboxedArrayObject>().hasInlineElements()) + return true; + } + + MOZ_ASSERT(length <= NativeObject::MAX_DENSE_ELEMENTS_COUNT); + + size_t arraySlots = + gc::GetGCKindSlots(templateObject->asTenured().getAllocKind()) - ObjectElements::VALUES_PER_HEADER; + + if (length > arraySlots) + return true; + + // Emit fastpath. + + gc::InitialHeap heap = templateObject->group()->initialHeap(constraints()); + MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + current->add(templateConst); + + MNewArray* ins = MNewArray::New(alloc(), constraints(), length, templateConst, heap, pc); + current->add(ins); + current->push(ins); + + *emitted = true; + return true; +} + +bool +IonBuilder::newArrayTrySharedStub(bool* emitted) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a shared stub cache. + + if (JitOptions.disableSharedStubs) + return true; + + if (*pc != JSOP_NEWINIT && *pc != JSOP_NEWARRAY) + return true; + + MInstruction* stub = MNullarySharedStub::New(alloc()); + current->add(stub); + current->push(stub); + + if (!resumeAfter(stub)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::newArrayTryVM(bool* emitted, JSObject* templateObject, uint32_t length) +{ + MOZ_ASSERT(*emitted == false); + + // Emit a VM call. + + gc::InitialHeap heap = gc::DefaultHeap; + MConstant* templateConst = MConstant::New(alloc(), NullValue()); + + if (templateObject) { + heap = templateObject->group()->initialHeap(constraints()); + templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + } + + current->add(templateConst); + + MNewArray* ins = MNewArray::NewVM(alloc(), constraints(), length, templateConst, heap, pc); + current->add(ins); + current->push(ins); + + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_newarray(uint32_t length) +{ + JSObject* templateObject = inspector->getTemplateObject(pc); + if (!jsop_newarray(templateObject, length)) + return false; + + // Improve resulting typeset. + ObjectGroup* templateGroup = inspector->getTemplateObjectGroup(pc); + if (templateGroup) { + TemporaryTypeSet* types = MakeSingletonTypeSet(constraints(), templateGroup); + current->peek(-1)->setResultTypeSet(types); + } + + return true; +} + +bool +IonBuilder::jsop_newarray(JSObject* templateObject, uint32_t length) +{ + bool emitted = false; + + if (!forceInlineCaches()) { + if (!newArrayTryTemplateObject(&emitted, templateObject, length) || emitted) + return emitted; + } + + if (!newArrayTrySharedStub(&emitted) || emitted) + return emitted; + + if (!newArrayTryVM(&emitted, templateObject, length) || emitted) + return emitted; + + MOZ_CRASH("newarray should have been emited"); +} + +bool +IonBuilder::jsop_newarray_copyonwrite() +{ + ArrayObject* templateObject = ObjectGroup::getCopyOnWriteObject(script(), pc); + + // The baseline compiler should have ensured the template object has a type + // with the copy on write flag set already. During the arguments usage + // analysis the baseline compiler hasn't run yet, however, though in this + // case the template object's type doesn't matter. + MOZ_ASSERT_IF(info().analysisMode() != Analysis_ArgumentsUsage, + templateObject->group()->hasAnyFlags(OBJECT_FLAG_COPY_ON_WRITE)); + + MNewArrayCopyOnWrite* ins = + MNewArrayCopyOnWrite::New(alloc(), constraints(), templateObject, + templateObject->group()->initialHeap(constraints())); + + current->add(ins); + current->push(ins); + + return true; +} + +bool +IonBuilder::newObjectTryTemplateObject(bool* emitted, JSObject* templateObject) +{ + MOZ_ASSERT(*emitted == false); + + if (!templateObject) + return true; + + if (templateObject->is<PlainObject>() && templateObject->as<PlainObject>().hasDynamicSlots()) + return true; + + // Emit fastpath. + + MNewObject::Mode mode; + if (JSOp(*pc) == JSOP_NEWOBJECT || JSOp(*pc) == JSOP_NEWINIT) + mode = MNewObject::ObjectLiteral; + else + mode = MNewObject::ObjectCreate; + + gc::InitialHeap heap = templateObject->group()->initialHeap(constraints()); + MConstant* templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + current->add(templateConst); + + MNewObject* ins = MNewObject::New(alloc(), constraints(), templateConst, heap, mode); + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::newObjectTrySharedStub(bool* emitted) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a shared stub cache. + + if (JitOptions.disableSharedStubs) + return true; + + MInstruction* stub = MNullarySharedStub::New(alloc()); + current->add(stub); + current->push(stub); + + if (!resumeAfter(stub)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::newObjectTryVM(bool* emitted, JSObject* templateObject) +{ + // Emit a VM call. + MOZ_ASSERT(JSOp(*pc) == JSOP_NEWOBJECT || JSOp(*pc) == JSOP_NEWINIT); + + gc::InitialHeap heap = gc::DefaultHeap; + MConstant* templateConst = MConstant::New(alloc(), NullValue()); + + if (templateObject) { + heap = templateObject->group()->initialHeap(constraints()); + templateConst = MConstant::NewConstraintlessObject(alloc(), templateObject); + } + + current->add(templateConst); + + MNewObject* ins = MNewObject::NewVM(alloc(), constraints(), templateConst, heap, + MNewObject::ObjectLiteral); + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_newobject() +{ + bool emitted = false; + + JSObject* templateObject = inspector->getTemplateObject(pc); + + if (!forceInlineCaches()) { + if (!newObjectTryTemplateObject(&emitted, templateObject) || emitted) + return emitted; + } + if (!newObjectTrySharedStub(&emitted) || emitted) + return emitted; + + if (!newObjectTryVM(&emitted, templateObject) || emitted) + return emitted; + + MOZ_CRASH("newobject should have been emited"); +} + +bool +IonBuilder::jsop_initelem() +{ + MDefinition* value = current->pop(); + MDefinition* id = current->pop(); + MDefinition* obj = current->peek(-1); + + MInitElem* initElem = MInitElem::New(alloc(), obj, id, value); + current->add(initElem); + + return resumeAfter(initElem); +} + +bool +IonBuilder::jsop_initelem_array() +{ + MDefinition* value = current->pop(); + MDefinition* obj = current->peek(-1); + + // Make sure that arrays have the type being written to them by the + // intializer, and that arrays are marked as non-packed when writing holes + // to them during initialization. + bool needStub = false; + JSValueType unboxedType = JSVAL_TYPE_MAGIC; + if (shouldAbortOnPreliminaryGroups(obj)) { + needStub = true; + } else if (!obj->resultTypeSet() || + obj->resultTypeSet()->unknownObject() || + obj->resultTypeSet()->getObjectCount() != 1) + { + needStub = true; + } else { + MOZ_ASSERT(obj->resultTypeSet()->getObjectCount() == 1); + TypeSet::ObjectKey* initializer = obj->resultTypeSet()->getObject(0); + if (initializer->clasp() == &UnboxedArrayObject::class_) { + if (initializer->group()->unboxedLayout().nativeGroup()) + needStub = true; + else + unboxedType = initializer->group()->unboxedLayout().elementType(); + } + if (value->type() == MIRType::MagicHole) { + if (!initializer->hasFlags(constraints(), OBJECT_FLAG_NON_PACKED)) + needStub = true; + } else if (!initializer->unknownProperties()) { + HeapTypeSetKey elemTypes = initializer->property(JSID_VOID); + if (!TypeSetIncludes(elemTypes.maybeTypes(), value->type(), value->resultTypeSet())) { + elemTypes.freeze(constraints()); + needStub = true; + } + } + } + + uint32_t index = GET_UINT32(pc); + if (needStub) { + MCallInitElementArray* store = MCallInitElementArray::New(alloc(), obj, index, value); + current->add(store); + return resumeAfter(store); + } + + return initializeArrayElement(obj, index, value, unboxedType, /* addResumePoint = */ true); +} + +bool +IonBuilder::initializeArrayElement(MDefinition* obj, size_t index, MDefinition* value, + JSValueType unboxedType, + bool addResumePointAndIncrementInitializedLength) +{ + MConstant* id = MConstant::New(alloc(), Int32Value(index)); + current->add(id); + + // Get the elements vector. + MElements* elements = MElements::New(alloc(), obj, unboxedType != JSVAL_TYPE_MAGIC); + current->add(elements); + + if (unboxedType != JSVAL_TYPE_MAGIC) { + // Note: storeUnboxedValue takes care of any post barriers on the value. + storeUnboxedValue(obj, elements, 0, id, unboxedType, value, /* preBarrier = */ false); + + if (addResumePointAndIncrementInitializedLength) { + MInstruction* increment = MIncrementUnboxedArrayInitializedLength::New(alloc(), obj); + current->add(increment); + + if (!resumeAfter(increment)) + return false; + } + } else { + if (NeedsPostBarrier(value)) + current->add(MPostWriteBarrier::New(alloc(), obj, value)); + + if ((obj->isNewArray() && obj->toNewArray()->convertDoubleElements()) || + (obj->isNullarySharedStub() && + obj->resultTypeSet()->convertDoubleElements(constraints()) == TemporaryTypeSet::AlwaysConvertToDoubles)) + { + MInstruction* valueDouble = MToDouble::New(alloc(), value); + current->add(valueDouble); + value = valueDouble; + } + + // Store the value. + MStoreElement* store = MStoreElement::New(alloc(), elements, id, value, + /* needsHoleCheck = */ false); + current->add(store); + + if (addResumePointAndIncrementInitializedLength) { + // Update the initialized length. (The template object for this + // array has the array's ultimate length, so the length field is + // already correct: no updating needed.) + MSetInitializedLength* initLength = MSetInitializedLength::New(alloc(), elements, id); + current->add(initLength); + + if (!resumeAfter(initLength)) + return false; + } + } + + return true; +} + +bool +IonBuilder::jsop_mutateproto() +{ + MDefinition* value = current->pop(); + MDefinition* obj = current->peek(-1); + + MMutateProto* mutate = MMutateProto::New(alloc(), obj, value); + current->add(mutate); + return resumeAfter(mutate); +} + +bool +IonBuilder::jsop_initprop(PropertyName* name) +{ + bool useSlowPath = false; + + MDefinition* value = current->peek(-1); + MDefinition* obj = current->peek(-2); + if (obj->isLambda()) { + useSlowPath = true; + } else if (obj->isNewObject()) { + if (JSObject* templateObject = obj->toNewObject()->templateObject()) { + if (templateObject->is<PlainObject>()) { + if (!templateObject->as<PlainObject>().containsPure(name)) + useSlowPath = true; + } else { + MOZ_ASSERT(templateObject->as<UnboxedPlainObject>().layout().lookup(name)); + } + } else { + useSlowPath = true; + } + } else { + MOZ_ASSERT(obj->isNullarySharedStub()); + useSlowPath = true; + } + + if (useSlowPath) { + current->pop(); + MInitProp* init = MInitProp::New(alloc(), obj, name, value); + current->add(init); + return resumeAfter(init); + } + + MInstruction* last = *current->rbegin(); + + // This is definitely initializing an 'own' property of the object, treat + // it as an assignment. + if (!jsop_setprop(name)) + return false; + + // SETPROP pushed the value, instead of the object. Fix this on the stack, + // and check the most recent resume point to see if it needs updating too. + current->pop(); + current->push(obj); + for (MInstructionReverseIterator riter = current->rbegin(); *riter != last; riter++) { + if (MResumePoint* resumePoint = riter->resumePoint()) { + MOZ_ASSERT(resumePoint->pc() == pc); + if (resumePoint->mode() == MResumePoint::ResumeAfter) { + size_t index = resumePoint->numOperands() - 1; + resumePoint->replaceOperand(index, obj); + } + break; + } + } + + return true; +} + +bool +IonBuilder::jsop_initprop_getter_setter(PropertyName* name) +{ + MDefinition* value = current->pop(); + MDefinition* obj = current->peek(-1); + + MInitPropGetterSetter* init = MInitPropGetterSetter::New(alloc(), obj, name, value); + current->add(init); + return resumeAfter(init); +} + +bool +IonBuilder::jsop_initelem_getter_setter() +{ + MDefinition* value = current->pop(); + MDefinition* id = current->pop(); + MDefinition* obj = current->peek(-1); + + MInitElemGetterSetter* init = MInitElemGetterSetter::New(alloc(), obj, id, value); + current->add(init); + return resumeAfter(init); +} + +MBasicBlock* +IonBuilder::addBlock(MBasicBlock* block, uint32_t loopDepth) +{ + if (!block) + return nullptr; + if (block->pc() && script()->hasScriptCounts()) + block->setHitCount(script()->getHitCount(block->pc())); + graph().addBlock(block); + block->setLoopDepth(loopDepth); + return block; +} + +MBasicBlock* +IonBuilder::newBlock(MBasicBlock* predecessor, jsbytecode* pc) +{ + MBasicBlock* block = MBasicBlock::New(graph(), &analysis(), info(), predecessor, + bytecodeSite(pc), MBasicBlock::NORMAL); + return addBlock(block, loopDepth_); +} + +MBasicBlock* +IonBuilder::newBlock(MBasicBlock* predecessor, jsbytecode* pc, MResumePoint* priorResumePoint) +{ + MBasicBlock* block = MBasicBlock::NewWithResumePoint(graph(), info(), predecessor, + bytecodeSite(pc), priorResumePoint); + return addBlock(block, loopDepth_); +} + +MBasicBlock* +IonBuilder::newBlockPopN(MBasicBlock* predecessor, jsbytecode* pc, uint32_t popped) +{ + MBasicBlock* block = MBasicBlock::NewPopN(graph(), info(), predecessor, bytecodeSite(pc), + MBasicBlock::NORMAL, popped); + return addBlock(block, loopDepth_); +} + +MBasicBlock* +IonBuilder::newBlockAfter(MBasicBlock* at, MBasicBlock* predecessor, jsbytecode* pc) +{ + MBasicBlock* block = MBasicBlock::New(graph(), &analysis(), info(), predecessor, + bytecodeSite(pc), MBasicBlock::NORMAL); + if (!block) + return nullptr; + block->setHitCount(0); // osr block + graph().insertBlockAfter(at, block); + return block; +} + +MBasicBlock* +IonBuilder::newBlock(MBasicBlock* predecessor, jsbytecode* pc, uint32_t loopDepth) +{ + MBasicBlock* block = MBasicBlock::New(graph(), &analysis(), info(), predecessor, + bytecodeSite(pc), MBasicBlock::NORMAL); + return addBlock(block, loopDepth); +} + +MBasicBlock* +IonBuilder::newOsrPreheader(MBasicBlock* predecessor, jsbytecode* loopEntry, jsbytecode* beforeLoopEntry) +{ + MOZ_ASSERT(LoopEntryCanIonOsr(loopEntry)); + MOZ_ASSERT(loopEntry == info().osrPc()); + + // Create two blocks: one for the OSR entry with no predecessors, one for + // the preheader, which has the OSR entry block as a predecessor. The + // OSR block is always the second block (with id 1). + MBasicBlock* osrBlock = newBlockAfter(*graph().begin(), loopEntry); + MBasicBlock* preheader = newBlock(predecessor, loopEntry); + if (!osrBlock || !preheader) + return nullptr; + + // Give the pre-header the same hit count as the code before the loop. + if (script()->hasScriptCounts()) + preheader->setHitCount(script()->getHitCount(beforeLoopEntry)); + + MOsrEntry* entry = MOsrEntry::New(alloc()); + osrBlock->add(entry); + + // Initialize |envChain|. + { + uint32_t slot = info().environmentChainSlot(); + + MInstruction* envv; + if (analysis().usesEnvironmentChain()) { + envv = MOsrEnvironmentChain::New(alloc(), entry); + } else { + // Use an undefined value if the script does not need its env + // chain, to match the type that is already being tracked for the + // slot. + envv = MConstant::New(alloc(), UndefinedValue()); + } + + osrBlock->add(envv); + osrBlock->initSlot(slot, envv); + } + // Initialize |return value| + { + MInstruction* returnValue; + if (!script()->noScriptRval()) + returnValue = MOsrReturnValue::New(alloc(), entry); + else + returnValue = MConstant::New(alloc(), UndefinedValue()); + osrBlock->add(returnValue); + osrBlock->initSlot(info().returnValueSlot(), returnValue); + } + + // Initialize arguments object. + bool needsArgsObj = info().needsArgsObj(); + MInstruction* argsObj = nullptr; + if (info().hasArguments()) { + if (needsArgsObj) + argsObj = MOsrArgumentsObject::New(alloc(), entry); + else + argsObj = MConstant::New(alloc(), UndefinedValue()); + osrBlock->add(argsObj); + osrBlock->initSlot(info().argsObjSlot(), argsObj); + } + + if (info().funMaybeLazy()) { + // Initialize |this| parameter. + MParameter* thisv = MParameter::New(alloc(), MParameter::THIS_SLOT, nullptr); + osrBlock->add(thisv); + osrBlock->initSlot(info().thisSlot(), thisv); + + // Initialize arguments. + for (uint32_t i = 0; i < info().nargs(); i++) { + uint32_t slot = needsArgsObj ? info().argSlotUnchecked(i) : info().argSlot(i); + + // Only grab arguments from the arguments object if the arguments object + // aliases formals. If the argsobj does not alias formals, then the + // formals may have been assigned to during interpretation, and that change + // will not be reflected in the argsobj. + if (needsArgsObj && info().argsObjAliasesFormals()) { + MOZ_ASSERT(argsObj && argsObj->isOsrArgumentsObject()); + // If this is an aliased formal, then the arguments object + // contains a hole at this index. Any references to this + // variable in the jitcode will come from JSOP_*ALIASEDVAR + // opcodes, so the slot itself can be set to undefined. If + // it's not aliased, it must be retrieved from the arguments + // object. + MInstruction* osrv; + if (script()->formalIsAliased(i)) + osrv = MConstant::New(alloc(), UndefinedValue()); + else + osrv = MGetArgumentsObjectArg::New(alloc(), argsObj, i); + + osrBlock->add(osrv); + osrBlock->initSlot(slot, osrv); + } else { + MParameter* arg = MParameter::New(alloc(), i, nullptr); + osrBlock->add(arg); + osrBlock->initSlot(slot, arg); + } + } + } + + // Initialize locals. + for (uint32_t i = 0; i < info().nlocals(); i++) { + uint32_t slot = info().localSlot(i); + ptrdiff_t offset = BaselineFrame::reverseOffsetOfLocal(i); + + MOsrValue* osrv = MOsrValue::New(alloc().fallible(), entry, offset); + if (!osrv) + return nullptr; + osrBlock->add(osrv); + osrBlock->initSlot(slot, osrv); + } + + // Initialize stack. + uint32_t numStackSlots = preheader->stackDepth() - info().firstStackSlot(); + for (uint32_t i = 0; i < numStackSlots; i++) { + uint32_t slot = info().stackSlot(i); + ptrdiff_t offset = BaselineFrame::reverseOffsetOfLocal(info().nlocals() + i); + + MOsrValue* osrv = MOsrValue::New(alloc().fallible(), entry, offset); + if (!osrv) + return nullptr; + osrBlock->add(osrv); + osrBlock->initSlot(slot, osrv); + } + + // Create an MStart to hold the first valid MResumePoint. + MStart* start = MStart::New(alloc()); + osrBlock->add(start); + + // MOsrValue instructions are infallible, so the first MResumePoint must + // occur after they execute, at the point of the MStart. + if (!resumeAt(start, loopEntry)) + return nullptr; + + // Link the same MResumePoint from the MStart to each MOsrValue. + // This causes logic in ShouldSpecializeInput() to not replace Uses with + // Unboxes in the MResumePiont, so that the MStart always sees Values. + if (!osrBlock->linkOsrValues(start)) + return nullptr; + + // Clone types of the other predecessor of the pre-header to the osr block, + // such as pre-header phi's won't discard specialized type of the + // predecessor. + MOZ_ASSERT(predecessor->stackDepth() == osrBlock->stackDepth()); + MOZ_ASSERT(info().environmentChainSlot() == 0); + + // Treat the OSR values as having the same type as the existing values + // coming in to the loop. These will be fixed up with appropriate + // unboxing and type barriers in finishLoop, once the possible types + // at the loop header are known. + for (uint32_t i = info().startArgSlot(); i < osrBlock->stackDepth(); i++) { + MDefinition* existing = current->getSlot(i); + MDefinition* def = osrBlock->getSlot(i); + MOZ_ASSERT_IF(!needsArgsObj || !info().isSlotAliased(i), def->type() == MIRType::Value); + + // Aliased slots are never accessed, since they need to go through + // the callobject. No need to type them here. + if (info().isSlotAliased(i)) + continue; + + def->setResultType(existing->type()); + def->setResultTypeSet(existing->resultTypeSet()); + } + + // Finish the osrBlock. + osrBlock->end(MGoto::New(alloc(), preheader)); + if (!preheader->addPredecessor(alloc(), osrBlock)) + return nullptr; + graph().setOsrBlock(osrBlock); + + return preheader; +} + +MBasicBlock* +IonBuilder::newPendingLoopHeader(MBasicBlock* predecessor, jsbytecode* pc, bool osr, bool canOsr, + unsigned stackPhiCount) +{ + loopDepth_++; + // If this site can OSR, all values on the expression stack are part of the loop. + if (canOsr) + stackPhiCount = predecessor->stackDepth() - info().firstStackSlot(); + MBasicBlock* block = MBasicBlock::NewPendingLoopHeader(graph(), info(), predecessor, + bytecodeSite(pc), stackPhiCount); + if (!addBlock(block, loopDepth_)) + return nullptr; + + if (osr) { + // Incorporate type information from the OSR frame into the loop + // header. The OSR frame may have unexpected types due to type changes + // within the loop body or due to incomplete profiling information, + // in which case this may avoid restarts of loop analysis or bailouts + // during the OSR itself. + + MOZ_ASSERT(info().firstLocalSlot() - info().firstArgSlot() == + baselineFrame_->argTypes.length()); + MOZ_ASSERT(block->stackDepth() - info().firstLocalSlot() == + baselineFrame_->varTypes.length()); + + // Unbox the MOsrValue if it is known to be unboxable. + for (uint32_t i = info().startArgSlot(); i < block->stackDepth(); i++) { + + // The value of aliased args and slots are in the callobject. So we can't + // the value from the baseline frame. + if (info().isSlotAliased(i)) + continue; + + MPhi* phi = block->getSlot(i)->toPhi(); + + // Get the type from the baseline frame. + TypeSet::Type existingType = TypeSet::UndefinedType(); + uint32_t arg = i - info().firstArgSlot(); + uint32_t var = i - info().firstLocalSlot(); + if (info().funMaybeLazy() && i == info().thisSlot()) + existingType = baselineFrame_->thisType; + else if (arg < info().nargs()) + existingType = baselineFrame_->argTypes[arg]; + else + existingType = baselineFrame_->varTypes[var]; + + if (existingType.isSingletonUnchecked()) + checkNurseryObject(existingType.singleton()); + + // Extract typeset from value. + LifoAlloc* lifoAlloc = alloc().lifoAlloc(); + TemporaryTypeSet* typeSet = + lifoAlloc->new_<TemporaryTypeSet>(lifoAlloc, existingType); + if (!typeSet) + return nullptr; + MIRType type = typeSet->getKnownMIRType(); + if (!phi->addBackedgeType(alloc(), type, typeSet)) + return nullptr; + } + } + + return block; +} + +MTest* +IonBuilder::newTest(MDefinition* ins, MBasicBlock* ifTrue, MBasicBlock* ifFalse) +{ + MTest* test = MTest::New(alloc(), ins, ifTrue, ifFalse); + test->cacheOperandMightEmulateUndefined(constraints()); + return test; +} + +// A resume point is a mapping of stack slots to MDefinitions. It is used to +// capture the environment such that if a guard fails, and IonMonkey needs +// to exit back to the interpreter, the interpreter state can be +// reconstructed. +// +// We capture stack state at critical points: +// * (1) At the beginning of every basic block. +// * (2) After every effectful operation. +// +// As long as these two properties are maintained, instructions can +// be moved, hoisted, or, eliminated without problems, and ops without side +// effects do not need to worry about capturing state at precisely the +// right point in time. +// +// Effectful instructions, of course, need to capture state after completion, +// where the interpreter will not attempt to repeat the operation. For this, +// ResumeAfter must be used. The state is attached directly to the effectful +// instruction to ensure that no intermediate instructions could be injected +// in between by a future analysis pass. +// +// During LIR construction, if an instruction can bail back to the interpreter, +// we create an LSnapshot, which uses the last known resume point to request +// register/stack assignments for every live value. +bool +IonBuilder::resume(MInstruction* ins, jsbytecode* pc, MResumePoint::Mode mode) +{ + MOZ_ASSERT(ins->isEffectful() || !ins->isMovable()); + + MResumePoint* resumePoint = MResumePoint::New(alloc(), ins->block(), pc, + mode); + if (!resumePoint) { + abortReason_ = AbortReason_Alloc; + return false; + } + ins->setResumePoint(resumePoint); + return true; +} + +bool +IonBuilder::resumeAt(MInstruction* ins, jsbytecode* pc) +{ + return resume(ins, pc, MResumePoint::ResumeAt); +} + +bool +IonBuilder::resumeAfter(MInstruction* ins) +{ + return resume(ins, pc, MResumePoint::ResumeAfter); +} + +bool +IonBuilder::maybeInsertResume() +{ + // Create a resume point at the current position, without an existing + // effectful instruction. This resume point is not necessary for correct + // behavior (see above), but is added to avoid holding any values from the + // previous resume point which are now dead. This shortens the live ranges + // of such values and improves register allocation. + // + // This optimization is not performed outside of loop bodies, where good + // register allocation is not as critical, in order to avoid creating + // excessive resume points. + + if (loopDepth_ == 0) + return true; + + MNop* ins = MNop::New(alloc()); + current->add(ins); + + return resumeAfter(ins); +} + +void +IonBuilder::maybeMarkEmpty(MDefinition* ins) +{ + MOZ_ASSERT(ins->type() == MIRType::Value); + + // When one of the operands has no type information, mark the output + // as having no possible types too. This is to avoid degrading + // subsequent analysis. + for (size_t i = 0; i < ins->numOperands(); i++) { + if (!ins->emptyResultTypeSet()) + continue; + + TemporaryTypeSet* types = alloc().lifoAlloc()->new_<TemporaryTypeSet>(); + if (types) + ins->setResultTypeSet(types); + } +} + +// Return whether property lookups can be performed effectlessly on clasp. +static bool +ClassHasEffectlessLookup(const Class* clasp) +{ + return (clasp == &UnboxedPlainObject::class_) || + (clasp == &UnboxedArrayObject::class_) || + IsTypedObjectClass(clasp) || + (clasp->isNative() && !clasp->getOpsLookupProperty()); +} + +// Return whether an object might have a property for name which is not +// accounted for by type information. +static bool +ObjectHasExtraOwnProperty(CompileCompartment* comp, TypeSet::ObjectKey* object, jsid id) +{ + // Some typed object properties are not reflected in type information. + if (object->isGroup() && object->group()->maybeTypeDescr()) + return object->group()->typeDescr().hasProperty(comp->runtime()->names(), id); + + const Class* clasp = object->clasp(); + + // Array |length| properties are not reflected in type information. + if (clasp == &ArrayObject::class_) + return JSID_IS_ATOM(id, comp->runtime()->names().length); + + // Resolve hooks can install new properties on objects on demand. + JSObject* singleton = object->isSingleton() ? object->singleton() : nullptr; + return ClassMayResolveId(comp->runtime()->names(), clasp, id, singleton); +} + +void +IonBuilder::insertRecompileCheck() +{ + // No need for recompile checks if this is the highest optimization level. + OptimizationLevel curLevel = optimizationInfo().level(); + if (IonOptimizations.isLastLevel(curLevel)) + return; + + // Add recompile check. + + // Get the topmost builder. The topmost script will get recompiled when + // warm-up counter is high enough to justify a higher optimization level. + IonBuilder* topBuilder = outermostBuilder(); + + // Add recompile check to recompile when the warm-up count reaches the + // threshold of the next optimization level. + OptimizationLevel nextLevel = IonOptimizations.nextLevel(curLevel); + const OptimizationInfo* info = IonOptimizations.get(nextLevel); + uint32_t warmUpThreshold = info->compilerWarmUpThreshold(topBuilder->script()); + MRecompileCheck* check = MRecompileCheck::New(alloc(), topBuilder->script(), warmUpThreshold, + MRecompileCheck::RecompileCheck_OptimizationLevel); + current->add(check); +} + +JSObject* +IonBuilder::testSingletonProperty(JSObject* obj, jsid id) +{ + // We would like to completely no-op property/global accesses which can + // produce only a particular JSObject. When indicating the access result is + // definitely an object, type inference does not account for the + // possibility that the property is entirely missing from the input object + // and its prototypes (if this happens, a semantic trigger would be hit and + // the pushed types updated, even if there is no type barrier). + // + // If the access definitely goes through obj, either directly or on the + // prototype chain, and the object has singleton type, then the type + // information for that property reflects the value that will definitely be + // read on accesses to the object. If the property is later deleted or + // reconfigured as a getter/setter then the type information for the + // property will change and trigger invalidation. + + while (obj) { + if (!ClassHasEffectlessLookup(obj->getClass())) + return nullptr; + + TypeSet::ObjectKey* objKey = TypeSet::ObjectKey::get(obj); + if (analysisContext) + objKey->ensureTrackedProperty(analysisContext, id); + + if (objKey->unknownProperties()) + return nullptr; + + HeapTypeSetKey property = objKey->property(id); + if (property.isOwnProperty(constraints())) { + if (obj->isSingleton()) + return property.singleton(constraints()); + return nullptr; + } + + if (ObjectHasExtraOwnProperty(compartment, objKey, id)) + return nullptr; + + obj = checkNurseryObject(obj->staticPrototype()); + } + + return nullptr; +} + +JSObject* +IonBuilder::testSingletonPropertyTypes(MDefinition* obj, jsid id) +{ + // As for TestSingletonProperty, but the input is any value in a type set + // rather than a specific object. + + TemporaryTypeSet* types = obj->resultTypeSet(); + if (types && types->unknownObject()) + return nullptr; + + JSObject* objectSingleton = types ? types->maybeSingleton() : nullptr; + if (objectSingleton) + return testSingletonProperty(objectSingleton, id); + + MIRType objType = obj->type(); + if (objType == MIRType::Value && types) + objType = types->getKnownMIRType(); + + JSProtoKey key; + switch (objType) { + case MIRType::String: + key = JSProto_String; + break; + + case MIRType::Symbol: + key = JSProto_Symbol; + break; + + case MIRType::Int32: + case MIRType::Double: + key = JSProto_Number; + break; + + case MIRType::Boolean: + key = JSProto_Boolean; + break; + + case MIRType::Object: { + if (!types) + return nullptr; + + // For property accesses which may be on many objects, we just need to + // find a prototype common to all the objects; if that prototype + // has the singleton property, the access will not be on a missing property. + JSObject* singleton = nullptr; + for (unsigned i = 0; i < types->getObjectCount(); i++) { + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + if (analysisContext) + key->ensureTrackedProperty(analysisContext, id); + + const Class* clasp = key->clasp(); + if (!ClassHasEffectlessLookup(clasp) || ObjectHasExtraOwnProperty(compartment, key, id)) + return nullptr; + if (key->unknownProperties()) + return nullptr; + HeapTypeSetKey property = key->property(id); + if (property.isOwnProperty(constraints())) + return nullptr; + + if (JSObject* proto = checkNurseryObject(key->proto().toObjectOrNull())) { + // Test this type. + JSObject* thisSingleton = testSingletonProperty(proto, id); + if (!thisSingleton) + return nullptr; + if (singleton) { + if (thisSingleton != singleton) + return nullptr; + } else { + singleton = thisSingleton; + } + } else { + // Can't be on the prototype chain with no prototypes... + return nullptr; + } + } + return singleton; + } + default: + return nullptr; + } + + JSObject* proto = GetBuiltinPrototypePure(&script()->global(), key); + if (proto) + return testSingletonProperty(proto, id); + + return nullptr; +} + +ResultWithOOM<bool> +IonBuilder::testNotDefinedProperty(MDefinition* obj, jsid id) +{ + TemporaryTypeSet* types = obj->resultTypeSet(); + if (!types || types->unknownObject() || types->getKnownMIRType() != MIRType::Object) + return ResultWithOOM<bool>::ok(false); + + for (unsigned i = 0, count = types->getObjectCount(); i < count; i++) { + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + while (true) { + if (!alloc().ensureBallast()) + return ResultWithOOM<bool>::fail(); + + if (!key->hasStableClassAndProto(constraints()) || key->unknownProperties()) + return ResultWithOOM<bool>::ok(false); + + const Class* clasp = key->clasp(); + if (!ClassHasEffectlessLookup(clasp) || ObjectHasExtraOwnProperty(compartment, key, id)) + return ResultWithOOM<bool>::ok(false); + + // If the object is a singleton, we can do a lookup now to avoid + // unnecessary invalidations later on, in case the property types + // have not yet been instantiated. + if (key->isSingleton() && + key->singleton()->is<NativeObject>() && + key->singleton()->as<NativeObject>().lookupPure(id)) + { + return ResultWithOOM<bool>::ok(false); + } + + HeapTypeSetKey property = key->property(id); + if (property.isOwnProperty(constraints())) + return ResultWithOOM<bool>::ok(false); + + JSObject* proto = checkNurseryObject(key->proto().toObjectOrNull()); + if (!proto) + break; + key = TypeSet::ObjectKey::get(proto); + } + } + + return ResultWithOOM<bool>::ok(true); +} + +bool +IonBuilder::pushTypeBarrier(MDefinition* def, TemporaryTypeSet* observed, BarrierKind kind) +{ + MOZ_ASSERT(def == current->peek(-1)); + + MDefinition* replace = addTypeBarrier(current->pop(), observed, kind); + if (!replace) + return false; + + current->push(replace); + return true; +} + +// Given an observed type set, annotates the IR as much as possible: +// (1) If no type information is provided, the given value is returned. +// (2) If a single type definitely exists, and no type barrier is needed, +// then an infallible unbox instruction is returned. +// (3) If a type barrier is needed, but has an unknown type set, the given +// value is returned. +// (4) Lastly, a type barrier instruction is added and returned. +MDefinition* +IonBuilder::addTypeBarrier(MDefinition* def, TemporaryTypeSet* observed, BarrierKind kind, + MTypeBarrier** pbarrier) +{ + // Barriers are never needed for instructions whose result will not be used. + if (BytecodeIsPopped(pc)) + return def; + + // If the instruction has no side effects, we'll resume the entire operation. + // The actual type barrier will occur in the interpreter. If the + // instruction is effectful, even if it has a singleton type, there + // must be a resume point capturing the original def, and resuming + // to that point will explicitly monitor the new type. + if (kind == BarrierKind::NoBarrier) { + MDefinition* replace = ensureDefiniteType(def, observed->getKnownMIRType()); + replace->setResultTypeSet(observed); + return replace; + } + + if (observed->unknown()) + return def; + + MTypeBarrier* barrier = MTypeBarrier::New(alloc(), def, observed, kind); + current->add(barrier); + + if (pbarrier) + *pbarrier = barrier; + + if (barrier->type() == MIRType::Undefined) + return constant(UndefinedValue()); + if (barrier->type() == MIRType::Null) + return constant(NullValue()); + + return barrier; +} + +bool +IonBuilder::pushDOMTypeBarrier(MInstruction* ins, TemporaryTypeSet* observed, JSFunction* func) +{ + MOZ_ASSERT(func && func->isNative() && func->jitInfo()); + + const JSJitInfo* jitinfo = func->jitInfo(); + bool barrier = DOMCallNeedsBarrier(jitinfo, observed); + // Need to be a bit careful: if jitinfo->returnType is JSVAL_TYPE_DOUBLE but + // types->getKnownMIRType() is MIRType::Int32, then don't unconditionally + // unbox as a double. Instead, go ahead and barrier on having an int type, + // since we know we need a barrier anyway due to the type mismatch. This is + // the only situation in which TI actually has more information about the + // JSValueType than codegen can, short of jitinfo->returnType just being + // JSVAL_TYPE_UNKNOWN. + MDefinition* replace = ins; + if (jitinfo->returnType() != JSVAL_TYPE_DOUBLE || + observed->getKnownMIRType() != MIRType::Int32) { + replace = ensureDefiniteType(ins, MIRTypeFromValueType(jitinfo->returnType())); + if (replace != ins) { + current->pop(); + current->push(replace); + } + } else { + MOZ_ASSERT(barrier); + } + + return pushTypeBarrier(replace, observed, + barrier ? BarrierKind::TypeSet : BarrierKind::NoBarrier); +} + +MDefinition* +IonBuilder::ensureDefiniteType(MDefinition* def, MIRType definiteType) +{ + MInstruction* replace; + switch (definiteType) { + case MIRType::Undefined: + def->setImplicitlyUsedUnchecked(); + replace = MConstant::New(alloc(), UndefinedValue()); + break; + + case MIRType::Null: + def->setImplicitlyUsedUnchecked(); + replace = MConstant::New(alloc(), NullValue()); + break; + + case MIRType::Value: + return def; + + default: { + if (def->type() != MIRType::Value) { + if (def->type() == MIRType::Int32 && definiteType == MIRType::Double) { + replace = MToDouble::New(alloc(), def); + break; + } + MOZ_ASSERT(def->type() == definiteType); + return def; + } + replace = MUnbox::New(alloc(), def, definiteType, MUnbox::Infallible); + break; + } + } + + current->add(replace); + return replace; +} + +MDefinition* +IonBuilder::ensureDefiniteTypeSet(MDefinition* def, TemporaryTypeSet* types) +{ + // We cannot arbitrarily add a typeset to a definition. It can be shared + // in another path. So we always need to create a new MIR. + + // Use ensureDefiniteType to do unboxing. If that happened the type can + // be added on the newly created unbox operation. + MDefinition* replace = ensureDefiniteType(def, types->getKnownMIRType()); + if (replace != def) { + replace->setResultTypeSet(types); + return replace; + } + + // Don't replace if input type is more accurate than given typeset. + if (def->type() != types->getKnownMIRType()) { + MOZ_ASSERT(types->getKnownMIRType() == MIRType::Value); + return def; + } + + // Create a NOP mir instruction to filter the typeset. + MFilterTypeSet* filter = MFilterTypeSet::New(alloc(), def, types); + current->add(filter); + return filter; +} + +static size_t +NumFixedSlots(JSObject* object) +{ + // Note: we can't use object->numFixedSlots() here, as this will read the + // shape and can race with the main thread if we are building off thread. + // The allocation kind and object class (which goes through the type) can + // be read freely, however. + gc::AllocKind kind = object->asTenured().getAllocKind(); + return gc::GetGCKindSlots(kind, object->getClass()); +} + +static bool +IsUninitializedGlobalLexicalSlot(JSObject* obj, PropertyName* name) +{ + LexicalEnvironmentObject &globalLexical = obj->as<LexicalEnvironmentObject>(); + MOZ_ASSERT(globalLexical.isGlobal()); + Shape* shape = globalLexical.lookupPure(name); + if (!shape) + return false; + return globalLexical.getSlot(shape->slot()).isMagic(JS_UNINITIALIZED_LEXICAL); +} + +bool +IonBuilder::getStaticName(JSObject* staticObject, PropertyName* name, bool* psucceeded, + MDefinition* lexicalCheck) +{ + MOZ_ASSERT(*psucceeded == false); + + jsid id = NameToId(name); + + bool isGlobalLexical = staticObject->is<LexicalEnvironmentObject>() && + staticObject->as<LexicalEnvironmentObject>().isGlobal(); + MOZ_ASSERT(isGlobalLexical || + staticObject->is<GlobalObject>() || + staticObject->is<CallObject>() || + staticObject->is<ModuleEnvironmentObject>()); + MOZ_ASSERT(staticObject->isSingleton()); + + *psucceeded = true; + + // Always emit the lexical check. This could be optimized, but is + // currently not for simplicity's sake. + if (lexicalCheck) { + *psucceeded = false; + return true; + } + + TypeSet::ObjectKey* staticKey = TypeSet::ObjectKey::get(staticObject); + if (analysisContext) + staticKey->ensureTrackedProperty(analysisContext, NameToId(name)); + + if (staticKey->unknownProperties()) { + *psucceeded = false; + return true; + } + + HeapTypeSetKey property = staticKey->property(id); + if (!property.maybeTypes() || + !property.maybeTypes()->definiteProperty() || + property.nonData(constraints())) + { + // The property has been reconfigured as non-configurable, non-enumerable + // or non-writable. + *psucceeded = false; + return true; + } + + // Don't optimize global lexical bindings if they aren't initialized at + // compile time. + if (isGlobalLexical && IsUninitializedGlobalLexicalSlot(staticObject, name)) { + *psucceeded = false; + return true; + } + + TemporaryTypeSet* types = bytecodeTypes(pc); + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), staticKey, + name, types, /* updateObserved = */ true); + + if (barrier == BarrierKind::NoBarrier) { + // Try to inline properties holding a known constant object. + JSObject* singleton = types->maybeSingleton(); + if (singleton) { + if (testSingletonProperty(staticObject, id) == singleton) { + pushConstant(ObjectValue(*singleton)); + return true; + } + } + + // Try to inline properties that have never been overwritten. + Value constantValue; + if (property.constant(constraints(), &constantValue)) { + pushConstant(constantValue); + return true; + } + } + + if (!loadStaticSlot(staticObject, barrier, types, property.maybeTypes()->definiteSlot())) { + *psucceeded = false; + return false; + } + + return true; +} + +bool +IonBuilder::loadStaticSlot(JSObject* staticObject, BarrierKind barrier, TemporaryTypeSet* types, + uint32_t slot) +{ + if (barrier == BarrierKind::NoBarrier) { + // Try to inline properties that can only have one value. + MIRType knownType = types->getKnownMIRType(); + if (knownType == MIRType::Undefined) { + pushConstant(UndefinedValue()); + return true; + } + if (knownType == MIRType::Null) { + pushConstant(NullValue()); + return true; + } + } + + MInstruction* obj = constant(ObjectValue(*staticObject)); + + MIRType rvalType = types->getKnownMIRType(); + if (barrier != BarrierKind::NoBarrier) + rvalType = MIRType::Value; + + return loadSlot(obj, slot, NumFixedSlots(staticObject), rvalType, barrier, types); +} + +// Whether a write of the given value may need a post-write barrier for GC purposes. +bool +jit::NeedsPostBarrier(MDefinition* value) +{ + if (!GetJitContext()->runtime->gcNursery().exists()) + return false; + return value->mightBeType(MIRType::Object); +} + +bool +IonBuilder::setStaticName(JSObject* staticObject, PropertyName* name) +{ + jsid id = NameToId(name); + + bool isGlobalLexical = staticObject->is<LexicalEnvironmentObject>() && + staticObject->as<LexicalEnvironmentObject>().isGlobal(); + MOZ_ASSERT(isGlobalLexical || + staticObject->is<GlobalObject>() || + staticObject->is<CallObject>()); + + MDefinition* value = current->peek(-1); + + TypeSet::ObjectKey* staticKey = TypeSet::ObjectKey::get(staticObject); + if (staticKey->unknownProperties()) + return jsop_setprop(name); + + HeapTypeSetKey property = staticKey->property(id); + if (!property.maybeTypes() || + !property.maybeTypes()->definiteProperty() || + property.nonData(constraints()) || + property.nonWritable(constraints())) + { + // The property has been reconfigured as non-configurable, non-enumerable + // or non-writable. + return jsop_setprop(name); + } + + if (!CanWriteProperty(alloc(), constraints(), property, value)) + return jsop_setprop(name); + + // Don't optimize global lexical bindings if they aren't initialized at + // compile time. + if (isGlobalLexical && IsUninitializedGlobalLexicalSlot(staticObject, name)) + return jsop_setprop(name); + + current->pop(); + + // Pop the bound object on the stack. + MDefinition* obj = current->pop(); + MOZ_ASSERT(&obj->toConstant()->toObject() == staticObject); + + if (NeedsPostBarrier(value)) + current->add(MPostWriteBarrier::New(alloc(), obj, value)); + + // If the property has a known type, we may be able to optimize typed stores by not + // storing the type tag. + MIRType slotType = MIRType::None; + MIRType knownType = property.knownMIRType(constraints()); + if (knownType != MIRType::Value) + slotType = knownType; + + bool needsBarrier = property.needsBarrier(constraints()); + return storeSlot(obj, property.maybeTypes()->definiteSlot(), NumFixedSlots(staticObject), + value, needsBarrier, slotType); +} + +JSObject* +IonBuilder::testGlobalLexicalBinding(PropertyName* name) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_BINDGNAME || + JSOp(*pc) == JSOP_GETGNAME || + JSOp(*pc) == JSOP_SETGNAME || + JSOp(*pc) == JSOP_STRICTSETGNAME); + + // The global isn't the global lexical env's prototype, but its enclosing + // env. Test for the existence of |name| manually on the global lexical + // env. If it is not found, look for it on the global itself. + + NativeObject* obj = &script()->global().lexicalEnvironment(); + TypeSet::ObjectKey* lexicalKey = TypeSet::ObjectKey::get(obj); + jsid id = NameToId(name); + if (analysisContext) + lexicalKey->ensureTrackedProperty(analysisContext, id); + + // If the property is not found on the global lexical env but it is found + // on the global and is configurable, try to freeze the typeset for its + // non-existence. If we don't have type information then fail. + // + // In the case that it is found on the global but is non-configurable, + // the binding cannot be shadowed by a global lexical binding. + Maybe<HeapTypeSetKey> lexicalProperty; + if (!lexicalKey->unknownProperties()) + lexicalProperty.emplace(lexicalKey->property(id)); + Shape* shape = obj->lookupPure(name); + if (shape) { + if ((JSOp(*pc) != JSOP_GETGNAME && !shape->writable()) || + obj->getSlot(shape->slot()).isMagic(JS_UNINITIALIZED_LEXICAL)) + { + return nullptr; + } + } else { + shape = script()->global().lookupPure(name); + if (!shape || shape->configurable()) { + if (lexicalProperty.isSome()) + MOZ_ALWAYS_FALSE(lexicalProperty->isOwnProperty(constraints())); + else + return nullptr; + } + obj = &script()->global(); + } + + return obj; +} + +bool +IonBuilder::jsop_getgname(PropertyName* name) +{ + // Optimize undefined/NaN/Infinity first. We must ensure we handle these + // cases *exactly* like Baseline, because it's invalid to add an Ion IC or + // VM call (that might trigger invalidation) if there's no Baseline IC for + // this op. + if (name == names().undefined) { + pushConstant(UndefinedValue()); + return true; + } + if (name == names().NaN) { + pushConstant(compartment->runtime()->NaNValue()); + return true; + } + if (name == names().Infinity) { + pushConstant(compartment->runtime()->positiveInfinityValue()); + return true; + } + + if (JSObject* obj = testGlobalLexicalBinding(name)) { + bool emitted = false; + if (!getStaticName(obj, name, &emitted) || emitted) + return emitted; + + if (!forceInlineCaches() && obj->is<GlobalObject>()) { + TemporaryTypeSet* types = bytecodeTypes(pc); + MDefinition* globalObj = constant(ObjectValue(*obj)); + if (!getPropTryCommonGetter(&emitted, globalObj, name, types) || emitted) + return emitted; + } + } + + return jsop_getname(name); +} + +bool +IonBuilder::jsop_getname(PropertyName* name) +{ + MDefinition* object; + if (IsGlobalOp(JSOp(*pc)) && !script()->hasNonSyntacticScope()) { + MInstruction* global = constant(ObjectValue(script()->global().lexicalEnvironment())); + object = global; + } else { + current->push(current->environmentChain()); + object = current->pop(); + } + + MGetNameCache* ins; + if (JSOp(*GetNextPc(pc)) == JSOP_TYPEOF) + ins = MGetNameCache::New(alloc(), object, name, MGetNameCache::NAMETYPEOF); + else + ins = MGetNameCache::New(alloc(), object, name, MGetNameCache::NAME); + + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(ins, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::jsop_intrinsic(PropertyName* name) +{ + TemporaryTypeSet* types = bytecodeTypes(pc); + + Value vp = UndefinedValue(); + // If the intrinsic value doesn't yet exist, we haven't executed this + // opcode yet, so we need to get it and monitor the result. + if (!script()->global().maybeExistingIntrinsicValue(name, &vp)) { + MCallGetIntrinsicValue* ins = MCallGetIntrinsicValue::New(alloc(), name); + + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + return pushTypeBarrier(ins, types, BarrierKind::TypeSet); + } + + if (types->empty()) + types->addType(TypeSet::GetValueType(vp), alloc().lifoAlloc()); + + // Bake in the intrinsic, guaranteed to exist because a non-empty typeset + // means the intrinsic was successfully gotten in the VM call above. + // Assert that TI agrees with us on the type. + MOZ_ASSERT(types->hasType(TypeSet::GetValueType(vp))); + + pushConstant(vp); + return true; +} + +bool +IonBuilder::jsop_getimport(PropertyName* name) +{ + ModuleEnvironmentObject* env = GetModuleEnvironmentForScript(script()); + MOZ_ASSERT(env); + + Shape* shape; + ModuleEnvironmentObject* targetEnv; + MOZ_ALWAYS_TRUE(env->lookupImport(NameToId(name), &targetEnv, &shape)); + + PropertyName* localName = JSID_TO_STRING(shape->propid())->asAtom().asPropertyName(); + bool emitted = false; + if (!getStaticName(targetEnv, localName, &emitted)) + return false; + + if (!emitted) { + // This can happen if we don't have type information. + TypeSet::ObjectKey* staticKey = TypeSet::ObjectKey::get(targetEnv); + TemporaryTypeSet* types = bytecodeTypes(pc); + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), staticKey, + name, types, /* updateObserved = */ true); + + if (!loadStaticSlot(targetEnv, barrier, types, shape->slot())) + return false; + } + + // In the rare case where this import hasn't been initialized already (we + // have an import cycle where modules reference each other's imports), emit + // a check. + if (targetEnv->getSlot(shape->slot()).isMagic(JS_UNINITIALIZED_LEXICAL)) { + MDefinition* checked = addLexicalCheck(current->pop()); + current->push(checked); + } + + return true; +} + +bool +IonBuilder::jsop_bindname(PropertyName* name) +{ + MDefinition* envChain; + if (analysis().usesEnvironmentChain()) { + envChain = current->environmentChain(); + } else { + // We take the slow path when trying to BINDGNAME a name that resolves + // to a 'const' or an uninitialized binding. + MOZ_ASSERT(JSOp(*pc) == JSOP_BINDGNAME); + envChain = constant(ObjectValue(script()->global().lexicalEnvironment())); + } + MBindNameCache* ins = MBindNameCache::New(alloc(), envChain, name, script(), pc); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_bindvar() +{ + MOZ_ASSERT(analysis().usesEnvironmentChain()); + MCallBindVar* ins = MCallBindVar::New(alloc(), current->environmentChain()); + current->add(ins); + current->push(ins); + return true; +} + +static MIRType +GetElemKnownType(bool needsHoleCheck, TemporaryTypeSet* types) +{ + MIRType knownType = types->getKnownMIRType(); + + // Null and undefined have no payload so they can't be specialized. + // Since folding null/undefined while building SSA is not safe (see the + // comment in IsPhiObservable), we just add an untyped load instruction + // and rely on pushTypeBarrier and DCE to replace it with a null/undefined + // constant. + if (knownType == MIRType::Undefined || knownType == MIRType::Null) + knownType = MIRType::Value; + + // Different architectures may want typed element reads which require + // hole checks to be done as either value or typed reads. + if (needsHoleCheck && !LIRGenerator::allowTypedElementHoleCheck()) + knownType = MIRType::Value; + + return knownType; +} + +bool +IonBuilder::jsop_getelem() +{ + startTrackingOptimizations(); + + MDefinition* index = current->pop(); + MDefinition* obj = current->pop(); + + trackTypeInfo(TrackedTypeSite::Receiver, obj->type(), obj->resultTypeSet()); + trackTypeInfo(TrackedTypeSite::Index, index->type(), index->resultTypeSet()); + + // Always use a call if we are performing analysis and not actually + // emitting code, to simplify later analysis. + if (info().isAnalysis() || shouldAbortOnPreliminaryGroups(obj)) { + MInstruction* ins = MCallGetElement::New(alloc(), obj, index); + + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(ins, types, BarrierKind::TypeSet); + } + + obj = maybeUnboxForPropertyAccess(obj); + if (obj->type() == MIRType::Object) + obj = convertUnboxedObjects(obj); + + bool emitted = false; + + if (!forceInlineCaches()) { + trackOptimizationAttempt(TrackedStrategy::GetElem_TypedObject); + if (!getElemTryTypedObject(&emitted, obj, index) || emitted) + return emitted; + + // Note: no trackOptimizationAttempt call is needed, getElemTryGetProp + // will call it. + if (!getElemTryGetProp(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_Dense); + if (!getElemTryDense(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_TypedStatic); + if (!getElemTryTypedStatic(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_TypedArray); + if (!getElemTryTypedArray(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_String); + if (!getElemTryString(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_Arguments); + if (!getElemTryArguments(&emitted, obj, index) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::GetElem_ArgumentsInlined); + if (!getElemTryArgumentsInlined(&emitted, obj, index) || emitted) + return emitted; + } + + if (script()->argumentsHasVarBinding() && obj->mightBeType(MIRType::MagicOptimizedArguments)) + return abort("Type is not definitely lazy arguments."); + + trackOptimizationAttempt(TrackedStrategy::GetElem_InlineCache); + if (!getElemTryCache(&emitted, obj, index) || emitted) + return emitted; + + // Emit call. + MInstruction* ins = MCallGetElement::New(alloc(), obj, index); + + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + if (*pc == JSOP_CALLELEM && IsNullOrUndefined(obj->type())) { + // Due to inlining, it's possible the observed TypeSet is non-empty, + // even though we know |obj| is null/undefined and the MCallGetElement + // will throw. Don't push a TypeBarrier in this case, to avoid + // inlining the following (unreachable) JSOP_CALL. + return true; + } + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(ins, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::getElemTryTypedObject(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + // The next several failures are all due to types not predicting that we + // are definitely doing a getelem access on a typed object. + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedObject); + + TypedObjectPrediction objPrediction = typedObjectPrediction(obj); + if (objPrediction.isUseless()) + return true; + + if (!objPrediction.ofArrayKind()) + return true; + + TypedObjectPrediction elemPrediction = objPrediction.arrayElementType(); + if (elemPrediction.isUseless()) + return true; + + uint32_t elemSize; + if (!elemPrediction.hasKnownSize(&elemSize)) + return true; + + switch (elemPrediction.kind()) { + case type::Simd: + // FIXME (bug 894105): load into a MIRType::float32x4 etc + trackOptimizationOutcome(TrackedOutcome::GenericFailure); + return true; + + case type::Struct: + case type::Array: + return getElemTryComplexElemOfTypedObject(emitted, + obj, + index, + objPrediction, + elemPrediction, + elemSize); + case type::Scalar: + return getElemTryScalarElemOfTypedObject(emitted, + obj, + index, + objPrediction, + elemPrediction, + elemSize); + + case type::Reference: + return getElemTryReferenceElemOfTypedObject(emitted, + obj, + index, + objPrediction, + elemPrediction); + } + + MOZ_CRASH("Bad kind"); +} + +bool +IonBuilder::checkTypedObjectIndexInBounds(uint32_t elemSize, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + LinearSum* indexAsByteOffset) +{ + // Ensure index is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), index); + current->add(idInt32); + + // If we know the length statically from the type, just embed it. + // Otherwise, load it from the appropriate reserved slot on the + // typed object. We know it's an int32, so we can convert from + // Value to int32 using truncation. + int32_t lenOfAll; + MDefinition* length; + if (objPrediction.hasKnownArrayLength(&lenOfAll)) { + length = constantInt(lenOfAll); + + // If we are not loading the length from the object itself, only + // optimize if the array buffer can never be a detached array buffer. + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) { + trackOptimizationOutcome(TrackedOutcome::TypedObjectHasDetachedBuffer); + return false; + } + } else { + trackOptimizationOutcome(TrackedOutcome::TypedObjectArrayRange); + return false; + } + + index = addBoundsCheck(idInt32, length); + + return indexAsByteOffset->add(index, AssertedCast<int32_t>(elemSize)); +} + +bool +IonBuilder::getElemTryScalarElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + TypedObjectPrediction elemPrediction, + uint32_t elemSize) +{ + MOZ_ASSERT(objPrediction.ofArrayKind()); + + // Must always be loading the same scalar type + ScalarTypeDescr::Type elemType = elemPrediction.scalarType(); + MOZ_ASSERT(elemSize == ScalarTypeDescr::alignment(elemType)); + + LinearSum indexAsByteOffset(alloc()); + if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset)) + return true; + + trackOptimizationSuccess(); + *emitted = true; + + return pushScalarLoadFromTypedObject(obj, indexAsByteOffset, elemType); +} + +bool +IonBuilder::getElemTryReferenceElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + TypedObjectPrediction elemPrediction) +{ + MOZ_ASSERT(objPrediction.ofArrayKind()); + + ReferenceTypeDescr::Type elemType = elemPrediction.referenceType(); + uint32_t elemSize = ReferenceTypeDescr::size(elemType); + + LinearSum indexAsByteOffset(alloc()); + if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset)) + return true; + + trackOptimizationSuccess(); + *emitted = true; + + return pushReferenceLoadFromTypedObject(obj, indexAsByteOffset, elemType, nullptr); +} + +bool +IonBuilder::pushScalarLoadFromTypedObject(MDefinition* obj, + const LinearSum& byteOffset, + ScalarTypeDescr::Type elemType) +{ + uint32_t size = ScalarTypeDescr::size(elemType); + MOZ_ASSERT(size == ScalarTypeDescr::alignment(elemType)); + + // Find location within the owner object. + MDefinition* elements; + MDefinition* scaledOffset; + int32_t adjustment; + loadTypedObjectElements(obj, byteOffset, size, &elements, &scaledOffset, &adjustment); + + // Load the element. + MLoadUnboxedScalar* load = MLoadUnboxedScalar::New(alloc(), elements, scaledOffset, + elemType, + DoesNotRequireMemoryBarrier, + adjustment); + current->add(load); + current->push(load); + + // If we are reading in-bounds elements, we can use knowledge about + // the array type to determine the result type, even if the opcode has + // never executed. The known pushed type is only used to distinguish + // uint32 reads that may produce either doubles or integers. + TemporaryTypeSet* resultTypes = bytecodeTypes(pc); + bool allowDouble = resultTypes->hasType(TypeSet::DoubleType()); + + // Note: knownType is not necessarily in resultTypes; e.g. if we + // have only observed integers coming out of float array. + MIRType knownType = MIRTypeForTypedArrayRead(elemType, allowDouble); + + // Note: we can ignore the type barrier here, we know the type must + // be valid and unbarriered. Also, need not set resultTypeSet, + // because knownType is scalar and a resultTypeSet would provide + // no useful additional info. + load->setResultType(knownType); + + return true; +} + +bool +IonBuilder::pushReferenceLoadFromTypedObject(MDefinition* typedObj, + const LinearSum& byteOffset, + ReferenceTypeDescr::Type type, + PropertyName* name) +{ + // Find location within the owner object. + MDefinition* elements; + MDefinition* scaledOffset; + int32_t adjustment; + uint32_t alignment = ReferenceTypeDescr::alignment(type); + loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment); + + TemporaryTypeSet* observedTypes = bytecodeTypes(pc); + + MInstruction* load = nullptr; // initialize to silence GCC warning + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), + typedObj, name, observedTypes); + + switch (type) { + case ReferenceTypeDescr::TYPE_ANY: { + // Make sure the barrier reflects the possibility of reading undefined. + bool bailOnUndefined = barrier == BarrierKind::NoBarrier && + !observedTypes->hasType(TypeSet::UndefinedType()); + if (bailOnUndefined) + barrier = BarrierKind::TypeTagOnly; + load = MLoadElement::New(alloc(), elements, scaledOffset, false, false, adjustment); + break; + } + case ReferenceTypeDescr::TYPE_OBJECT: { + // Make sure the barrier reflects the possibility of reading null. When + // there is no other barrier needed we include the null bailout with + // MLoadUnboxedObjectOrNull, which avoids the need to box the result + // for a type barrier instruction. + MLoadUnboxedObjectOrNull::NullBehavior nullBehavior; + if (barrier == BarrierKind::NoBarrier && !observedTypes->hasType(TypeSet::NullType())) + nullBehavior = MLoadUnboxedObjectOrNull::BailOnNull; + else + nullBehavior = MLoadUnboxedObjectOrNull::HandleNull; + load = MLoadUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, nullBehavior, + adjustment); + break; + } + case ReferenceTypeDescr::TYPE_STRING: { + load = MLoadUnboxedString::New(alloc(), elements, scaledOffset, adjustment); + observedTypes->addType(TypeSet::StringType(), alloc().lifoAlloc()); + break; + } + } + + current->add(load); + current->push(load); + + return pushTypeBarrier(load, observedTypes, barrier); +} + +bool +IonBuilder::getElemTryComplexElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + TypedObjectPrediction elemPrediction, + uint32_t elemSize) +{ + MOZ_ASSERT(objPrediction.ofArrayKind()); + + MDefinition* type = loadTypedObjectType(obj); + MDefinition* elemTypeObj = typeObjectForElementFromArrayStructType(type); + + LinearSum indexAsByteOffset(alloc()); + if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset)) + return true; + + return pushDerivedTypedObject(emitted, obj, indexAsByteOffset, + elemPrediction, elemTypeObj); +} + +bool +IonBuilder::pushDerivedTypedObject(bool* emitted, + MDefinition* obj, + const LinearSum& baseByteOffset, + TypedObjectPrediction derivedPrediction, + MDefinition* derivedTypeObj) +{ + // Find location within the owner object. + MDefinition* owner; + LinearSum ownerByteOffset(alloc()); + loadTypedObjectData(obj, &owner, &ownerByteOffset); + + if (!ownerByteOffset.add(baseByteOffset, 1)) + setForceAbort(); + + MDefinition* offset = ConvertLinearSum(alloc(), current, ownerByteOffset, + /* convertConstant = */ true); + + // Create the derived typed object. + MInstruction* derivedTypedObj = MNewDerivedTypedObject::New(alloc(), + derivedPrediction, + derivedTypeObj, + owner, + offset); + current->add(derivedTypedObj); + current->push(derivedTypedObj); + + // Determine (if possible) the class/proto that `derivedTypedObj` will + // have. For derived typed objects, the opacity will be the same as the + // incoming object from which the derived typed object is, well, derived. + // The prototype will be determined based on the type descriptor (and is + // immutable). + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + const Class* expectedClass = nullptr; + if (const Class* objClass = objTypes ? objTypes->getKnownClass(constraints()) : nullptr) { + MOZ_ASSERT(IsTypedObjectClass(objClass)); + expectedClass = GetOutlineTypedObjectClass(IsOpaqueTypedObjectClass(objClass)); + } + const TypedProto* expectedProto = derivedPrediction.getKnownPrototype(); + MOZ_ASSERT_IF(expectedClass, IsTypedObjectClass(expectedClass)); + + // Determine (if possible) the class/proto that the observed type set + // describes. + TemporaryTypeSet* observedTypes = bytecodeTypes(pc); + const Class* observedClass = observedTypes->getKnownClass(constraints()); + + // If expectedClass/expectedProto are both non-null (and hence known), we + // can predict precisely what object group derivedTypedObj will have. + // Therefore, if we observe that this group is already contained in the set + // of observedTypes, we can skip the barrier. + // + // Barriers still wind up being needed in some relatively + // rare cases: + // + // - if multiple kinds of typed objects flow into this point, + // in which case we will not be able to predict expectedClass + // nor expectedProto. + // + // - if the code has never executed, in which case the set of + // observed types will be incomplete. + // + // Barriers are particularly expensive here because they prevent + // us from optimizing the MNewDerivedTypedObject away. + JSObject* observedProto; + if (observedTypes->getCommonPrototype(constraints(), &observedProto) && + observedClass && observedProto && observedClass == expectedClass && + observedProto == expectedProto) + { + derivedTypedObj->setResultTypeSet(observedTypes); + } else { + if (!pushTypeBarrier(derivedTypedObj, observedTypes, BarrierKind::TypeSet)) + return false; + } + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getElemTryGetProp(bool* emitted, MDefinition* obj, MDefinition* index) +{ + // If index is a constant string or symbol, try to optimize this GETELEM + // as a GETPROP. + + MOZ_ASSERT(*emitted == false); + + MConstant* indexConst = index->maybeConstantValue(); + jsid id; + if (!indexConst || !ValueToIdPure(indexConst->toJSValue(), &id)) + return true; + + if (id != IdToTypeId(id)) + return true; + + TemporaryTypeSet* types = bytecodeTypes(pc); + + trackOptimizationAttempt(TrackedStrategy::GetProp_Constant); + if (!getPropTryConstant(emitted, obj, id, types) || *emitted) { + if (*emitted) + index->setImplicitlyUsedUnchecked(); + return *emitted; + } + + trackOptimizationAttempt(TrackedStrategy::GetProp_NotDefined); + if (!getPropTryNotDefined(emitted, obj, id, types) || *emitted) { + if (*emitted) + index->setImplicitlyUsedUnchecked(); + return *emitted; + } + + return true; +} + +bool +IonBuilder::getElemTryDense(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + JSValueType unboxedType = UnboxedArrayElementType(constraints(), obj, index); + if (unboxedType == JSVAL_TYPE_MAGIC) { + if (!ElementAccessIsDenseNative(constraints(), obj, index)) { + trackOptimizationOutcome(TrackedOutcome::AccessNotDense); + return true; + } + } + + // Don't generate a fast path if there have been bounds check failures + // and this access might be on a sparse property. + if (ElementAccessHasExtraIndexedProperty(this, obj) && failedBoundsCheck_) { + trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); + return true; + } + + // Don't generate a fast path if this pc has seen negative indexes accessed, + // which will not appear to be extra indexed properties. + if (inspector->hasSeenNegativeIndexGetElement(pc)) { + trackOptimizationOutcome(TrackedOutcome::ArraySeenNegativeIndex); + return true; + } + + if (!jsop_getelem_dense(obj, index, unboxedType)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +JSObject* +IonBuilder::getStaticTypedArrayObject(MDefinition* obj, MDefinition* index) +{ + Scalar::Type arrayType; + if (!ElementAccessIsTypedArray(constraints(), obj, index, &arrayType)) { + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedArray); + return nullptr; + } + + if (!LIRGenerator::allowStaticTypedArrayAccesses()) { + trackOptimizationOutcome(TrackedOutcome::Disabled); + return nullptr; + } + + if (ElementAccessHasExtraIndexedProperty(this, obj)) { + trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); + return nullptr; + } + + if (!obj->resultTypeSet()) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return nullptr; + } + + JSObject* tarrObj = obj->resultTypeSet()->maybeSingleton(); + if (!tarrObj) { + trackOptimizationOutcome(TrackedOutcome::NotSingleton); + return nullptr; + } + + TypeSet::ObjectKey* tarrKey = TypeSet::ObjectKey::get(tarrObj); + if (tarrKey->unknownProperties()) { + trackOptimizationOutcome(TrackedOutcome::UnknownProperties); + return nullptr; + } + + return tarrObj; +} + +bool +IonBuilder::getElemTryTypedStatic(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + JSObject* tarrObj = getStaticTypedArrayObject(obj, index); + if (!tarrObj) + return true; + + // LoadTypedArrayElementStatic currently treats uint32 arrays as int32. + Scalar::Type viewType = tarrObj->as<TypedArrayObject>().type(); + if (viewType == Scalar::Uint32) { + trackOptimizationOutcome(TrackedOutcome::StaticTypedArrayUint32); + return true; + } + + MDefinition* ptr = convertShiftToMaskForStaticTypedArray(index, viewType); + if (!ptr) + return true; + + // Emit LoadTypedArrayElementStatic. + + if (tarrObj->is<TypedArrayObject>()) { + TypeSet::ObjectKey* tarrKey = TypeSet::ObjectKey::get(tarrObj); + tarrKey->watchStateChangeForTypedArrayData(constraints()); + } + + obj->setImplicitlyUsedUnchecked(); + index->setImplicitlyUsedUnchecked(); + + MLoadTypedArrayElementStatic* load = MLoadTypedArrayElementStatic::New(alloc(), tarrObj, ptr); + current->add(load); + current->push(load); + + // The load is infallible if an undefined result will be coerced to the + // appropriate numeric type if the read is out of bounds. The truncation + // analysis picks up some of these cases, but is incomplete with respect + // to others. For now, sniff the bytecode for simple patterns following + // the load which guarantee a truncation or numeric conversion. + if (viewType == Scalar::Float32 || viewType == Scalar::Float64) { + jsbytecode* next = pc + JSOP_GETELEM_LENGTH; + if (*next == JSOP_POS) + load->setInfallible(); + } else { + jsbytecode* next = pc + JSOP_GETELEM_LENGTH; + if (*next == JSOP_ZERO && *(next + JSOP_ZERO_LENGTH) == JSOP_BITOR) + load->setInfallible(); + } + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getElemTryTypedArray(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + Scalar::Type arrayType; + if (!ElementAccessIsTypedArray(constraints(), obj, index, &arrayType)) { + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedArray); + return true; + } + + // Emit typed getelem variant. + if (!jsop_getelem_typed(obj, index, arrayType)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getElemTryString(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + if (obj->type() != MIRType::String || !IsNumberType(index->type())) { + trackOptimizationOutcome(TrackedOutcome::AccessNotString); + return true; + } + + // If the index is expected to be out-of-bounds, don't optimize to avoid + // frequent bailouts. + if (bytecodeTypes(pc)->hasType(TypeSet::UndefinedType())) { + trackOptimizationOutcome(TrackedOutcome::OutOfBounds); + return true; + } + + // Emit fast path for string[index]. + MInstruction* idInt32 = MToInt32::New(alloc(), index); + current->add(idInt32); + index = idInt32; + + MStringLength* length = MStringLength::New(alloc(), obj); + current->add(length); + + index = addBoundsCheck(index, length); + + MCharCodeAt* charCode = MCharCodeAt::New(alloc(), obj, index); + current->add(charCode); + + MFromCharCode* result = MFromCharCode::New(alloc(), charCode); + current->add(result); + current->push(result); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getElemTryArguments(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + if (inliningDepth_ > 0) + return true; + + if (obj->type() != MIRType::MagicOptimizedArguments) + return true; + + // Emit GetFrameArgument. + + MOZ_ASSERT(!info().argsObjAliasesFormals()); + + // Type Inference has guaranteed this is an optimized arguments object. + obj->setImplicitlyUsedUnchecked(); + + // To ensure that we are not looking above the number of actual arguments. + MArgumentsLength* length = MArgumentsLength::New(alloc()); + current->add(length); + + // Ensure index is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), index); + current->add(idInt32); + index = idInt32; + + // Bailouts if we read more than the number of actual arguments. + index = addBoundsCheck(index, length); + + // Load the argument from the actual arguments. + MGetFrameArgument* load = MGetFrameArgument::New(alloc(), index, analysis_.hasSetArg()); + current->add(load); + current->push(load); + + TemporaryTypeSet* types = bytecodeTypes(pc); + if (!pushTypeBarrier(load, types, BarrierKind::TypeSet)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getElemTryArgumentsInlined(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + if (inliningDepth_ == 0) + return true; + + if (obj->type() != MIRType::MagicOptimizedArguments) + return true; + + // Emit inlined arguments. + obj->setImplicitlyUsedUnchecked(); + + MOZ_ASSERT(!info().argsObjAliasesFormals()); + + // When the id is constant, we can just return the corresponding inlined argument + MConstant* indexConst = index->maybeConstantValue(); + if (indexConst && indexConst->type() == MIRType::Int32) { + MOZ_ASSERT(inliningDepth_ > 0); + + int32_t id = indexConst->toInt32(); + index->setImplicitlyUsedUnchecked(); + + if (id < (int32_t)inlineCallInfo_->argc() && id >= 0) + current->push(inlineCallInfo_->getArg(id)); + else + pushConstant(UndefinedValue()); + + trackOptimizationSuccess(); + *emitted = true; + return true; + } + + // inlined not constant not supported, yet. + return abort("NYI inlined not constant get argument element"); +} + +bool +IonBuilder::getElemTryCache(bool* emitted, MDefinition* obj, MDefinition* index) +{ + MOZ_ASSERT(*emitted == false); + + // Make sure we have at least an object. + if (!obj->mightBeType(MIRType::Object)) { + trackOptimizationOutcome(TrackedOutcome::NotObject); + return true; + } + + // Don't cache for strings. + if (obj->mightBeType(MIRType::String)) { + trackOptimizationOutcome(TrackedOutcome::GetElemStringNotCached); + return true; + } + + // Index should be integer, string, or symbol + if (!index->mightBeType(MIRType::Int32) && + !index->mightBeType(MIRType::String) && + !index->mightBeType(MIRType::Symbol)) + { + trackOptimizationOutcome(TrackedOutcome::IndexType); + return true; + } + + // Turn off cacheing if the element is int32 and we've seen non-native objects as the target + // of this getelem. + bool nonNativeGetElement = inspector->hasSeenNonNativeGetElement(pc); + if (index->mightBeType(MIRType::Int32) && nonNativeGetElement) { + trackOptimizationOutcome(TrackedOutcome::NonNativeReceiver); + return true; + } + + // Emit GetElementCache. + + TemporaryTypeSet* types = bytecodeTypes(pc); + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), obj, + nullptr, types); + + // Always add a barrier if the index might be a string or symbol, so that + // the cache can attach stubs for particular properties. + if (index->mightBeType(MIRType::String) || index->mightBeType(MIRType::Symbol)) + barrier = BarrierKind::TypeSet; + + MGetPropertyCache* ins = MGetPropertyCache::New(alloc(), obj, index, + barrier == BarrierKind::TypeSet); + current->add(ins); + current->push(ins); + + if (!resumeAfter(ins)) + return false; + + // Spice up type information. + if (index->type() == MIRType::Int32 && barrier == BarrierKind::NoBarrier) { + bool needHoleCheck = !ElementAccessIsPacked(constraints(), obj); + MIRType knownType = GetElemKnownType(needHoleCheck, types); + + if (knownType != MIRType::Value && knownType != MIRType::Double) + ins->setResultType(knownType); + } + + if (!pushTypeBarrier(ins, types, barrier)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +TemporaryTypeSet* +IonBuilder::computeHeapType(const TemporaryTypeSet* objTypes, const jsid id) +{ + if (objTypes->unknownObject() || objTypes->getObjectCount() == 0) + return nullptr; + + TemporaryTypeSet empty; + TemporaryTypeSet* acc = ∅ + LifoAlloc* lifoAlloc = alloc().lifoAlloc(); + + Vector<HeapTypeSetKey, 4, SystemAllocPolicy> properties; + if (!properties.reserve(objTypes->getObjectCount())) + return nullptr; + + for (unsigned i = 0; i < objTypes->getObjectCount(); i++) { + TypeSet::ObjectKey* key = objTypes->getObject(i); + + if (key->unknownProperties()) + return nullptr; + + HeapTypeSetKey property = key->property(id); + HeapTypeSet* currentSet = property.maybeTypes(); + + if (!currentSet || currentSet->unknown()) + return nullptr; + + properties.infallibleAppend(property); + acc = TypeSet::unionSets(acc, currentSet, lifoAlloc); + if (!acc) + return nullptr; + } + + // Freeze all the properties associated with the refined type set. + for (HeapTypeSetKey* i = properties.begin(); i != properties.end(); i++) + i->freeze(constraints()); + + return acc; +} + +bool +IonBuilder::jsop_getelem_dense(MDefinition* obj, MDefinition* index, JSValueType unboxedType) +{ + TemporaryTypeSet* types = bytecodeTypes(pc); + + MOZ_ASSERT(index->type() == MIRType::Int32 || index->type() == MIRType::Double); + if (JSOp(*pc) == JSOP_CALLELEM) { + // Indexed call on an element of an array. Populate the observed types + // with any objects that could be in the array, to avoid extraneous + // type barriers. + AddObjectsForPropertyRead(obj, nullptr, types); + } + + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), obj, + nullptr, types); + bool needsHoleCheck = !ElementAccessIsPacked(constraints(), obj); + + // Reads which are on holes in the object do not have to bail out if + // undefined values have been observed at this access site and the access + // cannot hit another indexed property on the object or its prototypes. + bool readOutOfBounds = + types->hasType(TypeSet::UndefinedType()) && + !ElementAccessHasExtraIndexedProperty(this, obj); + + MIRType knownType = MIRType::Value; + if (unboxedType == JSVAL_TYPE_MAGIC && barrier == BarrierKind::NoBarrier) + knownType = GetElemKnownType(needsHoleCheck, types); + + // Ensure index is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), index); + current->add(idInt32); + index = idInt32; + + // Get the elements vector. + MInstruction* elements = MElements::New(alloc(), obj, unboxedType != JSVAL_TYPE_MAGIC); + current->add(elements); + + // Note: to help GVN, use the original MElements instruction and not + // MConvertElementsToDoubles as operand. This is fine because converting + // elements to double does not change the initialized length. + MInstruction* initLength = initializedLength(obj, elements, unboxedType); + + // If we can load the element as a definite double, make sure to check that + // the array has been converted to homogenous doubles first. + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + bool inBounds = !readOutOfBounds && !needsHoleCheck; + + if (inBounds) { + TemporaryTypeSet* heapTypes = computeHeapType(objTypes, JSID_VOID); + if (heapTypes && heapTypes->isSubset(types)) { + knownType = heapTypes->getKnownMIRType(); + types = heapTypes; + } + } + + bool loadDouble = + unboxedType == JSVAL_TYPE_MAGIC && + barrier == BarrierKind::NoBarrier && + loopDepth_ && + inBounds && + knownType == MIRType::Double && + objTypes && + objTypes->convertDoubleElements(constraints()) == TemporaryTypeSet::AlwaysConvertToDoubles; + if (loadDouble) + elements = addConvertElementsToDoubles(elements); + + MInstruction* load; + + if (!readOutOfBounds) { + // This load should not return undefined, so likely we're reading + // in-bounds elements, and the array is packed or its holes are not + // read. This is the best case: we can separate the bounds check for + // hoisting. + index = addBoundsCheck(index, initLength); + + if (unboxedType != JSVAL_TYPE_MAGIC) { + load = loadUnboxedValue(elements, 0, index, unboxedType, barrier, types); + } else { + load = MLoadElement::New(alloc(), elements, index, needsHoleCheck, loadDouble); + current->add(load); + } + } else { + // This load may return undefined, so assume that we *can* read holes, + // or that we can read out-of-bounds accesses. In this case, the bounds + // check is part of the opcode. + load = MLoadElementHole::New(alloc(), elements, index, initLength, + unboxedType, needsHoleCheck); + current->add(load); + + // If maybeUndefined was true, the typeset must have undefined, and + // then either additional types or a barrier. This means we should + // never have a typed version of LoadElementHole. + MOZ_ASSERT(knownType == MIRType::Value); + } + + if (knownType != MIRType::Value) { + if (unboxedType == JSVAL_TYPE_MAGIC) + load->setResultType(knownType); + load->setResultTypeSet(types); + } + + current->push(load); + return pushTypeBarrier(load, types, barrier); +} + +MInstruction* +IonBuilder::addArrayBufferByteLength(MDefinition* obj) +{ + MLoadFixedSlot* ins = MLoadFixedSlot::New(alloc(), obj, size_t(ArrayBufferObject::BYTE_LENGTH_SLOT)); + current->add(ins); + ins->setResultType(MIRType::Int32); + return ins; +} + +void +IonBuilder::addTypedArrayLengthAndData(MDefinition* obj, + BoundsChecking checking, + MDefinition** index, + MInstruction** length, MInstruction** elements) +{ + MOZ_ASSERT((index != nullptr) == (elements != nullptr)); + + JSObject* tarr = nullptr; + + if (MConstant* objConst = obj->maybeConstantValue()) { + if (objConst->type() == MIRType::Object) + tarr = &objConst->toObject(); + } else if (TemporaryTypeSet* types = obj->resultTypeSet()) { + tarr = types->maybeSingleton(); + } + + if (tarr) { + SharedMem<void*> data = tarr->as<TypedArrayObject>().viewDataEither(); + // Bug 979449 - Optimistically embed the elements and use TI to + // invalidate if we move them. + bool isTenured = !tarr->runtimeFromMainThread()->gc.nursery.isInside(data); + if (isTenured && tarr->isSingleton()) { + // The 'data' pointer of TypedArrayObject can change in rare circumstances + // (ArrayBufferObject::changeContents). + TypeSet::ObjectKey* tarrKey = TypeSet::ObjectKey::get(tarr); + if (!tarrKey->unknownProperties()) { + if (tarr->is<TypedArrayObject>()) + tarrKey->watchStateChangeForTypedArrayData(constraints()); + + obj->setImplicitlyUsedUnchecked(); + + int32_t len = AssertedCast<int32_t>(tarr->as<TypedArrayObject>().length()); + *length = MConstant::New(alloc(), Int32Value(len)); + current->add(*length); + + if (index) { + if (checking == DoBoundsCheck) + *index = addBoundsCheck(*index, *length); + + *elements = MConstantElements::New(alloc(), data); + current->add(*elements); + } + return; + } + } + } + + *length = MTypedArrayLength::New(alloc(), obj); + current->add(*length); + + if (index) { + if (checking == DoBoundsCheck) + *index = addBoundsCheck(*index, *length); + + *elements = MTypedArrayElements::New(alloc(), obj); + current->add(*elements); + } +} + +MDefinition* +IonBuilder::convertShiftToMaskForStaticTypedArray(MDefinition* id, + Scalar::Type viewType) +{ + trackOptimizationOutcome(TrackedOutcome::StaticTypedArrayCantComputeMask); + + // No shifting is necessary if the typed array has single byte elements. + if (TypedArrayShift(viewType) == 0) + return id; + + // If the index is an already shifted constant, undo the shift to get the + // absolute offset being accessed. + if (MConstant* idConst = id->maybeConstantValue()) { + if (idConst->type() == MIRType::Int32) { + int32_t index = idConst->toInt32(); + MConstant* offset = MConstant::New(alloc(), Int32Value(index << TypedArrayShift(viewType))); + current->add(offset); + return offset; + } + } + + if (!id->isRsh() || id->isEffectful()) + return nullptr; + + MConstant* shiftAmount = id->toRsh()->rhs()->maybeConstantValue(); + if (!shiftAmount || shiftAmount->type() != MIRType::Int32) + return nullptr; + if (uint32_t(shiftAmount->toInt32()) != TypedArrayShift(viewType)) + return nullptr; + + // Instead of shifting, mask off the low bits of the index so that + // a non-scaled access on the typed array can be performed. + MConstant* mask = MConstant::New(alloc(), Int32Value(~((1 << shiftAmount->toInt32()) - 1))); + MBitAnd* ptr = MBitAnd::New(alloc(), id->getOperand(0), mask); + + ptr->infer(nullptr, nullptr); + MOZ_ASSERT(!ptr->isEffectful()); + + current->add(mask); + current->add(ptr); + + return ptr; +} + +bool +IonBuilder::jsop_getelem_typed(MDefinition* obj, MDefinition* index, + Scalar::Type arrayType) +{ + TemporaryTypeSet* types = bytecodeTypes(pc); + + bool maybeUndefined = types->hasType(TypeSet::UndefinedType()); + + // Reading from an Uint32Array will result in a double for values + // that don't fit in an int32. We have to bailout if this happens + // and the instruction is not known to return a double. + bool allowDouble = types->hasType(TypeSet::DoubleType()); + + // Ensure id is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), index); + current->add(idInt32); + index = idInt32; + + if (!maybeUndefined) { + // Assume the index is in range, so that we can hoist the length, + // elements vector and bounds check. + + // If we are reading in-bounds elements, we can use knowledge about + // the array type to determine the result type, even if the opcode has + // never executed. The known pushed type is only used to distinguish + // uint32 reads that may produce either doubles or integers. + MIRType knownType = MIRTypeForTypedArrayRead(arrayType, allowDouble); + + // Get length, bounds-check, then get elements, and add all instructions. + MInstruction* length; + MInstruction* elements; + addTypedArrayLengthAndData(obj, DoBoundsCheck, &index, &length, &elements); + + // Load the element. + MLoadUnboxedScalar* load = MLoadUnboxedScalar::New(alloc(), elements, index, arrayType); + current->add(load); + current->push(load); + + // Note: we can ignore the type barrier here, we know the type must + // be valid and unbarriered. + load->setResultType(knownType); + return true; + } else { + // We need a type barrier if the array's element type has never been + // observed (we've only read out-of-bounds values). Note that for + // Uint32Array, we only check for int32: if allowDouble is false we + // will bailout when we read a double. + BarrierKind barrier = BarrierKind::TypeSet; + switch (arrayType) { + case Scalar::Int8: + case Scalar::Uint8: + case Scalar::Uint8Clamped: + case Scalar::Int16: + case Scalar::Uint16: + case Scalar::Int32: + case Scalar::Uint32: + if (types->hasType(TypeSet::Int32Type())) + barrier = BarrierKind::NoBarrier; + break; + case Scalar::Float32: + case Scalar::Float64: + if (allowDouble) + barrier = BarrierKind::NoBarrier; + break; + default: + MOZ_CRASH("Unknown typed array type"); + } + + // Assume we will read out-of-bound values. In this case the + // bounds check will be part of the instruction, and the instruction + // will always return a Value. + MLoadTypedArrayElementHole* load = + MLoadTypedArrayElementHole::New(alloc(), obj, index, arrayType, allowDouble); + current->add(load); + current->push(load); + + return pushTypeBarrier(load, types, barrier); + } +} + +bool +IonBuilder::jsop_setelem() +{ + bool emitted = false; + startTrackingOptimizations(); + + MDefinition* value = current->pop(); + MDefinition* index = current->pop(); + MDefinition* object = convertUnboxedObjects(current->pop()); + + trackTypeInfo(TrackedTypeSite::Receiver, object->type(), object->resultTypeSet()); + trackTypeInfo(TrackedTypeSite::Index, index->type(), index->resultTypeSet()); + trackTypeInfo(TrackedTypeSite::Value, value->type(), value->resultTypeSet()); + + if (shouldAbortOnPreliminaryGroups(object)) { + MInstruction* ins = MCallSetElement::New(alloc(), object, index, value, IsStrictSetPC(pc)); + current->add(ins); + current->push(value); + return resumeAfter(ins); + } + + if (!forceInlineCaches()) { + trackOptimizationAttempt(TrackedStrategy::SetElem_TypedObject); + if (!setElemTryTypedObject(&emitted, object, index, value) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::SetElem_TypedStatic); + if (!setElemTryTypedStatic(&emitted, object, index, value) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::SetElem_TypedArray); + if (!setElemTryTypedArray(&emitted, object, index, value) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::SetElem_Dense); + SetElemICInspector icInspect(inspector->setElemICInspector(pc)); + bool writeHole = icInspect.sawOOBDenseWrite(); + if (!setElemTryDense(&emitted, object, index, value, writeHole) || emitted) + return emitted; + + trackOptimizationAttempt(TrackedStrategy::SetElem_Arguments); + if (!setElemTryArguments(&emitted, object, index, value) || emitted) + return emitted; + } + + if (script()->argumentsHasVarBinding() && + object->mightBeType(MIRType::MagicOptimizedArguments) && + info().analysisMode() != Analysis_ArgumentsUsage) + { + return abort("Type is not definitely lazy arguments."); + } + + trackOptimizationAttempt(TrackedStrategy::SetElem_InlineCache); + if (!setElemTryCache(&emitted, object, index, value) || emitted) + return emitted; + + // Emit call. + MInstruction* ins = MCallSetElement::New(alloc(), object, index, value, IsStrictSetPC(pc)); + current->add(ins); + current->push(value); + + return resumeAfter(ins); +} + +bool +IonBuilder::setElemTryTypedObject(bool* emitted, MDefinition* obj, + MDefinition* index, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + // The next several failures are all due to types not predicting that we + // are definitely doing a getelem access on a typed object. + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedObject); + + TypedObjectPrediction objPrediction = typedObjectPrediction(obj); + if (objPrediction.isUseless()) + return true; + + if (!objPrediction.ofArrayKind()) + return true; + + TypedObjectPrediction elemPrediction = objPrediction.arrayElementType(); + if (elemPrediction.isUseless()) + return true; + + uint32_t elemSize; + if (!elemPrediction.hasKnownSize(&elemSize)) + return true; + + switch (elemPrediction.kind()) { + case type::Simd: + // FIXME (bug 894105): store a MIRType::float32x4 etc + trackOptimizationOutcome(TrackedOutcome::GenericFailure); + return true; + + case type::Reference: + return setElemTryReferenceElemOfTypedObject(emitted, obj, index, + objPrediction, value, elemPrediction); + + case type::Scalar: + return setElemTryScalarElemOfTypedObject(emitted, + obj, + index, + objPrediction, + value, + elemPrediction, + elemSize); + + case type::Struct: + case type::Array: + // Not yet optimized. + trackOptimizationOutcome(TrackedOutcome::GenericFailure); + return true; + } + + MOZ_CRASH("Bad kind"); +} + +bool +IonBuilder::setElemTryReferenceElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + MDefinition* value, + TypedObjectPrediction elemPrediction) +{ + ReferenceTypeDescr::Type elemType = elemPrediction.referenceType(); + uint32_t elemSize = ReferenceTypeDescr::size(elemType); + + LinearSum indexAsByteOffset(alloc()); + if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset)) + return true; + + if (!storeReferenceTypedObjectValue(obj, indexAsByteOffset, elemType, value, nullptr)) + return true; + + current->push(value); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setElemTryScalarElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + MDefinition* value, + TypedObjectPrediction elemPrediction, + uint32_t elemSize) +{ + // Must always be loading the same scalar type + ScalarTypeDescr::Type elemType = elemPrediction.scalarType(); + MOZ_ASSERT(elemSize == ScalarTypeDescr::alignment(elemType)); + + LinearSum indexAsByteOffset(alloc()); + if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset)) + return true; + + // Store the element + if (!storeScalarTypedObjectValue(obj, indexAsByteOffset, elemType, value)) + return false; + + current->push(value); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setElemTryTypedStatic(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + JSObject* tarrObj = getStaticTypedArrayObject(object, index); + if (!tarrObj) + return true; + + SharedMem<void*> viewData = tarrObj->as<TypedArrayObject>().viewDataEither(); + if (tarrObj->runtimeFromMainThread()->gc.nursery.isInside(viewData)) + return true; + + Scalar::Type viewType = tarrObj->as<TypedArrayObject>().type(); + MDefinition* ptr = convertShiftToMaskForStaticTypedArray(index, viewType); + if (!ptr) + return true; + + // Emit StoreTypedArrayElementStatic. + + if (tarrObj->is<TypedArrayObject>()) { + TypeSet::ObjectKey* tarrKey = TypeSet::ObjectKey::get(tarrObj); + tarrKey->watchStateChangeForTypedArrayData(constraints()); + } + + object->setImplicitlyUsedUnchecked(); + index->setImplicitlyUsedUnchecked(); + + // Clamp value to [0, 255] for Uint8ClampedArray. + MDefinition* toWrite = value; + if (viewType == Scalar::Uint8Clamped) { + toWrite = MClampToUint8::New(alloc(), value); + current->add(toWrite->toInstruction()); + } + + MInstruction* store = MStoreTypedArrayElementStatic::New(alloc(), tarrObj, ptr, toWrite); + current->add(store); + current->push(value); + + if (!resumeAfter(store)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setElemTryTypedArray(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + Scalar::Type arrayType; + if (!ElementAccessIsTypedArray(constraints(), object, index, &arrayType)) { + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedArray); + return true; + } + + // Emit typed setelem variant. + if (!jsop_setelem_typed(arrayType, object, index, value)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setElemTryDense(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value, bool writeHole) +{ + MOZ_ASSERT(*emitted == false); + + JSValueType unboxedType = UnboxedArrayElementType(constraints(), object, index); + if (unboxedType == JSVAL_TYPE_MAGIC) { + if (!ElementAccessIsDenseNative(constraints(), object, index)) { + trackOptimizationOutcome(TrackedOutcome::AccessNotDense); + return true; + } + } + + if (PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current, + &object, nullptr, &value, /* canModify = */ true)) + { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + return true; + } + + if (!object->resultTypeSet()) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return true; + } + + TemporaryTypeSet::DoubleConversion conversion = + object->resultTypeSet()->convertDoubleElements(constraints()); + + // If AmbiguousDoubleConversion, only handle int32 values for now. + if (conversion == TemporaryTypeSet::AmbiguousDoubleConversion && + value->type() != MIRType::Int32) + { + trackOptimizationOutcome(TrackedOutcome::ArrayDoubleConversion); + return true; + } + + // Don't generate a fast path if there have been bounds check failures + // and this access might be on a sparse property. + if (ElementAccessHasExtraIndexedProperty(this, object) && failedBoundsCheck_) { + trackOptimizationOutcome(TrackedOutcome::ProtoIndexedProps); + return true; + } + + // Emit dense setelem variant. + if (!jsop_setelem_dense(conversion, object, index, value, unboxedType, writeHole, emitted)) + return false; + + if (!*emitted) { + trackOptimizationOutcome(TrackedOutcome::NonWritableProperty); + return true; + } + + trackOptimizationSuccess(); + return true; +} + +bool +IonBuilder::setElemTryArguments(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + if (object->type() != MIRType::MagicOptimizedArguments) + return true; + + // Arguments are not supported yet. + return abort("NYI arguments[]="); +} + +bool +IonBuilder::setElemTryCache(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + if (!object->mightBeType(MIRType::Object)) { + trackOptimizationOutcome(TrackedOutcome::NotObject); + return true; + } + + if (!index->mightBeType(MIRType::Int32) && + !index->mightBeType(MIRType::String) && + !index->mightBeType(MIRType::Symbol)) + { + trackOptimizationOutcome(TrackedOutcome::IndexType); + return true; + } + + bool barrier = true; + bool indexIsInt32 = index->type() == MIRType::Int32; + + if (indexIsInt32 && + !PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current, + &object, nullptr, &value, /* canModify = */ true)) + { + barrier = false; + } + + // We can avoid worrying about holes in the IC if we know a priori we are safe + // from them. If TI can guard that there are no indexed properties on the prototype + // chain, we know that we anen't missing any setters by overwriting the hole with + // another value. + bool guardHoles = ElementAccessHasExtraIndexedProperty(this, object); + + // Make sure the object being written to doesn't have copy on write elements. + const Class* clasp = object->resultTypeSet() ? object->resultTypeSet()->getKnownClass(constraints()) : nullptr; + bool checkNative = !clasp || !clasp->isNative(); + object = addMaybeCopyElementsForWrite(object, checkNative); + + if (NeedsPostBarrier(value)) { + if (indexIsInt32) + current->add(MPostWriteElementBarrier::New(alloc(), object, value, index)); + else + current->add(MPostWriteBarrier::New(alloc(), object, value)); + } + + // Emit SetPropertyCache. + bool strict = JSOp(*pc) == JSOP_STRICTSETELEM; + MSetPropertyCache* ins = + MSetPropertyCache::New(alloc(), object, index, value, strict, barrier, guardHoles); + current->add(ins); + current->push(value); + + if (!resumeAfter(ins)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion, + MDefinition* obj, MDefinition* id, MDefinition* value, + JSValueType unboxedType, bool writeHole, bool* emitted) +{ + MOZ_ASSERT(*emitted == false); + + MIRType elementType = MIRType::None; + if (unboxedType == JSVAL_TYPE_MAGIC) + elementType = DenseNativeElementType(constraints(), obj); + bool packed = ElementAccessIsPacked(constraints(), obj); + + // Writes which are on holes in the object do not have to bail out if they + // cannot hit another indexed property on the object or its prototypes. + bool hasNoExtraIndexedProperty = !ElementAccessHasExtraIndexedProperty(this, obj); + + bool mayBeFrozen = ElementAccessMightBeFrozen(constraints(), obj); + + if (mayBeFrozen && !hasNoExtraIndexedProperty) { + // FallibleStoreElement does not know how to deal with extra indexed + // properties on the prototype. This case should be rare so we fall back + // to an IC. + return true; + } + + *emitted = true; + + // Ensure id is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), id); + current->add(idInt32); + id = idInt32; + + if (NeedsPostBarrier(value)) + current->add(MPostWriteElementBarrier::New(alloc(), obj, value, id)); + + // Copy the elements vector if necessary. + obj = addMaybeCopyElementsForWrite(obj, /* checkNative = */ false); + + // Get the elements vector. + MElements* elements = MElements::New(alloc(), obj, unboxedType != JSVAL_TYPE_MAGIC); + current->add(elements); + + // Ensure the value is a double, if double conversion might be needed. + MDefinition* newValue = value; + switch (conversion) { + case TemporaryTypeSet::AlwaysConvertToDoubles: + case TemporaryTypeSet::MaybeConvertToDoubles: { + MInstruction* valueDouble = MToDouble::New(alloc(), value); + current->add(valueDouble); + newValue = valueDouble; + break; + } + + case TemporaryTypeSet::AmbiguousDoubleConversion: { + MOZ_ASSERT(value->type() == MIRType::Int32); + MInstruction* maybeDouble = MMaybeToDoubleElement::New(alloc(), elements, value); + current->add(maybeDouble); + newValue = maybeDouble; + break; + } + + case TemporaryTypeSet::DontConvertToDoubles: + break; + + default: + MOZ_CRASH("Unknown double conversion"); + } + + // Use MStoreElementHole if this SETELEM has written to out-of-bounds + // indexes in the past. Otherwise, use MStoreElement so that we can hoist + // the initialized length and bounds check. + // If an object may have been frozen, no previous expectation hold and we + // fallback to MFallibleStoreElement. + MInstruction* store; + MStoreElementCommon* common = nullptr; + if (writeHole && hasNoExtraIndexedProperty && !mayBeFrozen) { + MStoreElementHole* ins = MStoreElementHole::New(alloc(), obj, elements, id, newValue, unboxedType); + store = ins; + common = ins; + + current->add(ins); + current->push(value); + } else if (mayBeFrozen) { + MOZ_ASSERT(hasNoExtraIndexedProperty, + "FallibleStoreElement codegen assumes no extra indexed properties"); + + bool strict = IsStrictSetPC(pc); + MFallibleStoreElement* ins = MFallibleStoreElement::New(alloc(), obj, elements, id, + newValue, unboxedType, strict); + store = ins; + common = ins; + + current->add(ins); + current->push(value); + } else { + MInstruction* initLength = initializedLength(obj, elements, unboxedType); + + id = addBoundsCheck(id, initLength); + bool needsHoleCheck = !packed && !hasNoExtraIndexedProperty; + + if (unboxedType != JSVAL_TYPE_MAGIC) { + store = storeUnboxedValue(obj, elements, 0, id, unboxedType, newValue); + } else { + MStoreElement* ins = MStoreElement::New(alloc(), elements, id, newValue, needsHoleCheck); + store = ins; + common = ins; + + current->add(store); + } + + current->push(value); + } + + if (!resumeAfter(store)) + return false; + + if (common) { + // Determine whether a write barrier is required. + if (obj->resultTypeSet()->propertyNeedsBarrier(constraints(), JSID_VOID)) + common->setNeedsBarrier(); + + if (elementType != MIRType::None && packed) + common->setElementType(elementType); + } + + return true; +} + + +bool +IonBuilder::jsop_setelem_typed(Scalar::Type arrayType, + MDefinition* obj, MDefinition* id, MDefinition* value) +{ + SetElemICInspector icInspect(inspector->setElemICInspector(pc)); + bool expectOOB = icInspect.sawOOBTypedArrayWrite(); + + if (expectOOB) + spew("Emitting OOB TypedArray SetElem"); + + // Ensure id is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), id); + current->add(idInt32); + id = idInt32; + + // Get length, bounds-check, then get elements, and add all instructions. + MInstruction* length; + MInstruction* elements; + BoundsChecking checking = expectOOB ? SkipBoundsCheck : DoBoundsCheck; + addTypedArrayLengthAndData(obj, checking, &id, &length, &elements); + + // Clamp value to [0, 255] for Uint8ClampedArray. + MDefinition* toWrite = value; + if (arrayType == Scalar::Uint8Clamped) { + toWrite = MClampToUint8::New(alloc(), value); + current->add(toWrite->toInstruction()); + } + + // Store the value. + MInstruction* ins; + if (expectOOB) { + ins = MStoreTypedArrayElementHole::New(alloc(), elements, length, id, toWrite, arrayType); + } else { + MStoreUnboxedScalar* store = + MStoreUnboxedScalar::New(alloc(), elements, id, toWrite, arrayType, + MStoreUnboxedScalar::TruncateInput); + ins = store; + } + + current->add(ins); + current->push(value); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_length() +{ + if (jsop_length_fastPath()) + return true; + + PropertyName* name = info().getAtom(pc)->asPropertyName(); + return jsop_getprop(name); +} + +bool +IonBuilder::jsop_length_fastPath() +{ + TemporaryTypeSet* types = bytecodeTypes(pc); + + if (types->getKnownMIRType() != MIRType::Int32) + return false; + + MDefinition* obj = current->peek(-1); + + if (shouldAbortOnPreliminaryGroups(obj)) + return false; + + if (obj->mightBeType(MIRType::String)) { + if (obj->mightBeType(MIRType::Object)) + return false; + current->pop(); + MStringLength* ins = MStringLength::New(alloc(), obj); + current->add(ins); + current->push(ins); + return true; + } + + if (obj->mightBeType(MIRType::Object)) { + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + + // Compute the length for array objects. + if (objTypes && + objTypes->getKnownClass(constraints()) == &ArrayObject::class_ && + !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW)) + { + current->pop(); + MElements* elements = MElements::New(alloc(), obj); + current->add(elements); + + // Read length. + MArrayLength* length = MArrayLength::New(alloc(), elements); + current->add(length); + current->push(length); + return true; + } + + // Compute the length for unboxed array objects. + if (UnboxedArrayElementType(constraints(), obj, nullptr) != JSVAL_TYPE_MAGIC && + !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW)) + { + current->pop(); + + MUnboxedArrayLength* length = MUnboxedArrayLength::New(alloc(), obj); + current->add(length); + current->push(length); + return true; + } + + // Compute the length for array typed objects. + TypedObjectPrediction prediction = typedObjectPrediction(obj); + if (!prediction.isUseless()) { + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return false; + + MInstruction* length; + int32_t sizedLength; + if (prediction.hasKnownArrayLength(&sizedLength)) { + obj->setImplicitlyUsedUnchecked(); + length = MConstant::New(alloc(), Int32Value(sizedLength)); + } else { + return false; + } + + current->pop(); + current->add(length); + current->push(length); + return true; + } + } + + return false; +} + +bool +IonBuilder::jsop_arguments() +{ + if (info().needsArgsObj()) { + current->push(current->argumentsObject()); + return true; + } + MOZ_ASSERT(lazyArguments_); + current->push(lazyArguments_); + return true; +} + +bool +IonBuilder::jsop_newtarget() +{ + if (!info().funMaybeLazy()) { + MOZ_ASSERT(!info().script()->isForEval()); + pushConstant(NullValue()); + return true; + } + + MOZ_ASSERT(info().funMaybeLazy()); + + if (info().funMaybeLazy()->isArrow()) { + MArrowNewTarget* arrowNewTarget = MArrowNewTarget::New(alloc(), getCallee()); + current->add(arrowNewTarget); + current->push(arrowNewTarget); + return true; + } + + if (inliningDepth_ == 0) { + MNewTarget* newTarget = MNewTarget::New(alloc()); + current->add(newTarget); + current->push(newTarget); + return true; + } + + if (!inlineCallInfo_->constructing()) { + pushConstant(UndefinedValue()); + return true; + } + + current->push(inlineCallInfo_->getNewTarget()); + return true; +} + +bool +IonBuilder::jsop_rest() +{ + if (info().analysisMode() == Analysis_ArgumentsUsage) { + // There's no BaselineScript with the template object. Just push a + // dummy value, it does not affect the arguments analysis. + MUnknownValue* unknown = MUnknownValue::New(alloc()); + current->add(unknown); + current->push(unknown); + return true; + } + + ArrayObject* templateObject = &inspector->getTemplateObject(pc)->as<ArrayObject>(); + + if (inliningDepth_ == 0) { + // We don't know anything about the callee. + MArgumentsLength* numActuals = MArgumentsLength::New(alloc()); + current->add(numActuals); + + // Pass in the number of actual arguments, the number of formals (not + // including the rest parameter slot itself), and the template object. + MRest* rest = MRest::New(alloc(), constraints(), numActuals, info().nargs() - 1, + templateObject); + current->add(rest); + current->push(rest); + return true; + } + + // We know the exact number of arguments the callee pushed. + unsigned numActuals = inlineCallInfo_->argc(); + unsigned numFormals = info().nargs() - 1; + unsigned numRest = numActuals > numFormals ? numActuals - numFormals : 0; + + if (!jsop_newarray(numRest)) + return false; + + if (numRest == 0) { + // No more updating to do. (Note that in this one case the length from + // the template object is already correct.) + return true; + } + + MDefinition *array = current->peek(-1); + MElements* elements = MElements::New(alloc(), array); + current->add(elements); + + // Unroll the argument copy loop. We don't need to do any bounds or hole + // checking here. + MConstant* index = nullptr; + for (unsigned i = numFormals; i < numActuals; i++) { + index = MConstant::New(alloc(), Int32Value(i - numFormals)); + current->add(index); + + MDefinition* arg = inlineCallInfo_->argv()[i]; + MStoreElement* store = MStoreElement::New(alloc(), elements, index, arg, + /* needsHoleCheck = */ false); + current->add(store); + + if (NeedsPostBarrier(arg)) + current->add(MPostWriteBarrier::New(alloc(), array, arg)); + } + + // The array's length is incorrectly 0 now, from the template object + // created by BaselineCompiler::emit_JSOP_REST() before the actual argument + // count was known. Set the correct length now that we know that count. + MSetArrayLength* length = MSetArrayLength::New(alloc(), elements, index); + current->add(length); + + // Update the initialized length for all the (necessarily non-hole) + // elements added. + MSetInitializedLength* initLength = MSetInitializedLength::New(alloc(), elements, index); + current->add(initLength); + + return true; +} + +bool +IonBuilder::jsop_checkisobj(uint8_t kind) +{ + MDefinition* toCheck = current->peek(-1); + + if (toCheck->type() == MIRType::Object) { + toCheck->setImplicitlyUsedUnchecked(); + return true; + } + + MCheckIsObj* check = MCheckIsObj::New(alloc(), current->pop(), kind); + current->add(check); + current->push(check); + return true; +} + +bool +IonBuilder::jsop_checkobjcoercible() +{ + MDefinition* toCheck = current->peek(-1); + + if (!toCheck->mightBeType(MIRType::Undefined) && + !toCheck->mightBeType(MIRType::Null)) + { + toCheck->setImplicitlyUsedUnchecked(); + return true; + } + + MOZ_ASSERT(toCheck->type() == MIRType::Value || + toCheck->type() == MIRType::Null || + toCheck->type() == MIRType::Undefined); + + // If we want to squeeze more perf here, we can throw without checking, + // if IsNullOrUndefined(toCheck->type()). Since this is a failure case, + // it should be OK. + MCheckObjCoercible* check = MCheckObjCoercible::New(alloc(), current->pop()); + current->add(check); + current->push(check); + return resumeAfter(check); +} + +uint32_t +IonBuilder::getDefiniteSlot(TemporaryTypeSet* types, PropertyName* name, uint32_t* pnfixed) +{ + if (!types || types->unknownObject() || !types->objectOrSentinel()) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return UINT32_MAX; + } + + uint32_t slot = UINT32_MAX; + + for (size_t i = 0; i < types->getObjectCount(); i++) { + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + if (key->unknownProperties()) { + trackOptimizationOutcome(TrackedOutcome::UnknownProperties); + return UINT32_MAX; + } + + if (key->isSingleton()) { + trackOptimizationOutcome(TrackedOutcome::Singleton); + return UINT32_MAX; + } + + HeapTypeSetKey property = key->property(NameToId(name)); + if (!property.maybeTypes() || + !property.maybeTypes()->definiteProperty() || + property.nonData(constraints())) + { + trackOptimizationOutcome(TrackedOutcome::NotFixedSlot); + return UINT32_MAX; + } + + // Definite slots will always be fixed slots when they are in the + // allowable range for fixed slots, except for objects which were + // converted from unboxed objects and have a smaller allocation size. + size_t nfixed = NativeObject::MAX_FIXED_SLOTS; + if (ObjectGroup* group = key->group()->maybeOriginalUnboxedGroup()) + nfixed = gc::GetGCKindSlots(group->unboxedLayout().getAllocKind()); + + uint32_t propertySlot = property.maybeTypes()->definiteSlot(); + if (slot == UINT32_MAX) { + slot = propertySlot; + *pnfixed = nfixed; + } else if (slot != propertySlot || nfixed != *pnfixed) { + trackOptimizationOutcome(TrackedOutcome::InconsistentFixedSlot); + return UINT32_MAX; + } + } + + return slot; +} + +uint32_t +IonBuilder::getUnboxedOffset(TemporaryTypeSet* types, PropertyName* name, JSValueType* punboxedType) +{ + if (!types || types->unknownObject() || !types->objectOrSentinel()) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return UINT32_MAX; + } + + uint32_t offset = UINT32_MAX; + + for (size_t i = 0; i < types->getObjectCount(); i++) { + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + if (key->unknownProperties()) { + trackOptimizationOutcome(TrackedOutcome::UnknownProperties); + return UINT32_MAX; + } + + if (key->isSingleton()) { + trackOptimizationOutcome(TrackedOutcome::Singleton); + return UINT32_MAX; + } + + UnboxedLayout* layout = key->group()->maybeUnboxedLayout(); + if (!layout) { + trackOptimizationOutcome(TrackedOutcome::NotUnboxed); + return UINT32_MAX; + } + + const UnboxedLayout::Property* property = layout->lookup(name); + if (!property) { + trackOptimizationOutcome(TrackedOutcome::StructNoField); + return UINT32_MAX; + } + + if (layout->nativeGroup()) { + trackOptimizationOutcome(TrackedOutcome::UnboxedConvertedToNative); + return UINT32_MAX; + } + + key->watchStateChangeForUnboxedConvertedToNative(constraints()); + + if (offset == UINT32_MAX) { + offset = property->offset; + *punboxedType = property->type; + } else if (offset != property->offset) { + trackOptimizationOutcome(TrackedOutcome::InconsistentFieldOffset); + return UINT32_MAX; + } else if (*punboxedType != property->type) { + trackOptimizationOutcome(TrackedOutcome::InconsistentFieldType); + return UINT32_MAX; + } + } + + return offset; +} + +bool +IonBuilder::jsop_runonce() +{ + MRunOncePrologue* ins = MRunOncePrologue::New(alloc()); + current->add(ins); + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_not() +{ + MDefinition* value = current->pop(); + + MNot* ins = MNot::New(alloc(), value, constraints()); + current->add(ins); + current->push(ins); + return true; +} + +bool +IonBuilder::objectsHaveCommonPrototype(TemporaryTypeSet* types, PropertyName* name, + bool isGetter, JSObject* foundProto, bool* guardGlobal) +{ + // With foundProto a prototype with a getter or setter for name, return + // whether looking up name on any object in |types| will go through + // foundProto, i.e. all the objects have foundProto on their prototype + // chain and do not have a property for name before reaching foundProto. + + // No sense looking if we don't know what's going on. + if (!types || types->unknownObject()) + return false; + *guardGlobal = false; + + for (unsigned i = 0; i < types->getObjectCount(); i++) { + if (types->getSingleton(i) == foundProto) + continue; + + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + while (key) { + if (key->unknownProperties()) + return false; + + const Class* clasp = key->clasp(); + if (!ClassHasEffectlessLookup(clasp)) + return false; + JSObject* singleton = key->isSingleton() ? key->singleton() : nullptr; + if (ObjectHasExtraOwnProperty(compartment, key, NameToId(name))) { + if (!singleton || !singleton->is<GlobalObject>()) + return false; + *guardGlobal = true; + } + + // Look for a getter/setter on the class itself which may need + // to be called. + if (isGetter && clasp->getOpsGetProperty()) + return false; + if (!isGetter && clasp->getOpsSetProperty()) + return false; + + // Test for isOwnProperty() without freezing. If we end up + // optimizing, freezePropertiesForCommonPropFunc will freeze the + // property type sets later on. + HeapTypeSetKey property = key->property(NameToId(name)); + if (TypeSet* types = property.maybeTypes()) { + if (!types->empty() || types->nonDataProperty()) + return false; + } + if (singleton) { + if (CanHaveEmptyPropertyTypesForOwnProperty(singleton)) { + MOZ_ASSERT(singleton->is<GlobalObject>()); + *guardGlobal = true; + } + } + + JSObject* proto = checkNurseryObject(key->proto().toObjectOrNull()); + + if (proto == foundProto) + break; + if (!proto) { + // The foundProto being searched for did not show up on the + // object's prototype chain. + return false; + } + key = TypeSet::ObjectKey::get(proto); + } + } + + return true; +} + +void +IonBuilder::freezePropertiesForCommonPrototype(TemporaryTypeSet* types, PropertyName* name, + JSObject* foundProto, + bool allowEmptyTypesforGlobal/* = false*/) +{ + for (unsigned i = 0; i < types->getObjectCount(); i++) { + // If we found a Singleton object's own-property, there's nothing to + // freeze. + if (types->getSingleton(i) == foundProto) + continue; + + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + while (true) { + HeapTypeSetKey property = key->property(NameToId(name)); + JS_ALWAYS_TRUE(!property.isOwnProperty(constraints(), allowEmptyTypesforGlobal)); + + // Don't mark the proto. It will be held down by the shape + // guard. This allows us to use properties found on prototypes + // with properties unknown to TI. + if (key->proto() == TaggedProto(foundProto)) + break; + key = TypeSet::ObjectKey::get(key->proto().toObjectOrNull()); + } + } +} + +bool +IonBuilder::testCommonGetterSetter(TemporaryTypeSet* types, PropertyName* name, + bool isGetter, JSObject* foundProto, Shape* lastProperty, + JSFunction* getterOrSetter, + MDefinition** guard, + Shape* globalShape/* = nullptr*/, + MDefinition** globalGuard/* = nullptr */) +{ + MOZ_ASSERT_IF(globalShape, globalGuard); + bool guardGlobal; + + // Check if all objects being accessed will lookup the name through foundProto. + if (!objectsHaveCommonPrototype(types, name, isGetter, foundProto, &guardGlobal) || + (guardGlobal && !globalShape)) + { + trackOptimizationOutcome(TrackedOutcome::MultiProtoPaths); + return false; + } + + // We can optimize the getter/setter, so freeze all involved properties to + // ensure there isn't a lower shadowing getter or setter installed in the + // future. + freezePropertiesForCommonPrototype(types, name, foundProto, guardGlobal); + + // Add a shape guard on the prototype we found the property on. The rest of + // the prototype chain is guarded by TI freezes, except when name is a global + // name. In this case, we also have to guard on the globals shape to be able + // to optimize, because the way global property sets are handled means + // freezing doesn't work for what we want here. Note that a shape guard is + // good enough here, even in the proxy case, because we have ensured there + // are no lookup hooks for this property. + if (guardGlobal) { + JSObject* obj = &script()->global(); + MDefinition* globalObj = constant(ObjectValue(*obj)); + *globalGuard = addShapeGuard(globalObj, globalShape, Bailout_ShapeGuard); + } + + if (foundProto->isNative()) { + NativeObject& nativeProto = foundProto->as<NativeObject>(); + if (nativeProto.lastProperty() == lastProperty) { + // The proto shape is the same as it was at the point when we + // created the baseline IC, so looking up the prop on the object as + // it is now should be safe. + Shape* propShape = nativeProto.lookupPure(name); + MOZ_ASSERT_IF(isGetter, propShape->getterObject() == getterOrSetter); + MOZ_ASSERT_IF(!isGetter, propShape->setterObject() == getterOrSetter); + if (propShape && !propShape->configurable()) + return true; + } + } + + MInstruction* wrapper = constant(ObjectValue(*foundProto)); + *guard = addShapeGuard(wrapper, lastProperty, Bailout_ShapeGuard); + return true; +} + +void +IonBuilder::replaceMaybeFallbackFunctionGetter(MGetPropertyCache* cache) +{ + // Discard the last prior resume point of the previous MGetPropertyCache. + WrapMGetPropertyCache rai(maybeFallbackFunctionGetter_); + maybeFallbackFunctionGetter_ = cache; +} + +bool +IonBuilder::annotateGetPropertyCache(MDefinition* obj, PropertyName* name, + MGetPropertyCache* getPropCache, TemporaryTypeSet* objTypes, + TemporaryTypeSet* pushedTypes) +{ + // Ensure every pushed value is a singleton. + if (pushedTypes->unknownObject() || pushedTypes->baseFlags() != 0) + return true; + + for (unsigned i = 0; i < pushedTypes->getObjectCount(); i++) { + if (pushedTypes->getGroup(i) != nullptr) + return true; + } + + // Object's typeset should be a proper object + if (!objTypes || objTypes->baseFlags() || objTypes->unknownObject()) + return true; + + unsigned int objCount = objTypes->getObjectCount(); + if (objCount == 0) + return true; + + InlinePropertyTable* inlinePropTable = getPropCache->initInlinePropertyTable(alloc(), pc); + if (!inlinePropTable) + return false; + + // Ensure that the relevant property typeset for each group is + // is a single-object typeset containing a JSFunction + for (unsigned int i = 0; i < objCount; i++) { + ObjectGroup* group = objTypes->getGroup(i); + if (!group) + continue; + TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(group); + if (key->unknownProperties() || !key->proto().isObject()) + continue; + JSObject* proto = checkNurseryObject(key->proto().toObject()); + + const Class* clasp = key->clasp(); + if (!ClassHasEffectlessLookup(clasp) || ObjectHasExtraOwnProperty(compartment, key, NameToId(name))) + continue; + + HeapTypeSetKey ownTypes = key->property(NameToId(name)); + if (ownTypes.isOwnProperty(constraints())) + continue; + + JSObject* singleton = testSingletonProperty(proto, NameToId(name)); + if (!singleton || !singleton->is<JSFunction>()) + continue; + + // Don't add cases corresponding to non-observed pushes + if (!pushedTypes->hasType(TypeSet::ObjectType(singleton))) + continue; + + if (!inlinePropTable->addEntry(alloc(), group, &singleton->as<JSFunction>())) + return false; + } + + if (inlinePropTable->numEntries() == 0) { + getPropCache->clearInlinePropertyTable(); + return true; + } + +#ifdef JS_JITSPEW + if (inlinePropTable->numEntries() > 0) + JitSpew(JitSpew_Inlining, "Annotated GetPropertyCache with %d/%d inline cases", + (int) inlinePropTable->numEntries(), (int) objCount); +#endif + + // If we successfully annotated the GetPropertyCache and there are inline cases, + // then keep a resume point of the state right before this instruction for use + // later when we have to bail out to this point in the fallback case of a + // PolyInlineDispatch. + if (inlinePropTable->numEntries() > 0) { + // Push the object back onto the stack temporarily to capture the resume point. + current->push(obj); + MResumePoint* resumePoint = MResumePoint::New(alloc(), current, pc, + MResumePoint::ResumeAt); + if (!resumePoint) + return false; + inlinePropTable->setPriorResumePoint(resumePoint); + replaceMaybeFallbackFunctionGetter(getPropCache); + current->pop(); + } + return true; +} + +// Returns true if an idempotent cache has ever invalidated this script +// or an outer script. +bool +IonBuilder::invalidatedIdempotentCache() +{ + IonBuilder* builder = this; + do { + if (builder->script()->invalidatedIdempotentCache()) + return true; + builder = builder->callerBuilder_; + } while (builder); + + return false; +} + +bool +IonBuilder::loadSlot(MDefinition* obj, size_t slot, size_t nfixed, MIRType rvalType, + BarrierKind barrier, TemporaryTypeSet* types) +{ + if (slot < nfixed) { + MLoadFixedSlot* load = MLoadFixedSlot::New(alloc(), obj, slot); + current->add(load); + current->push(load); + + load->setResultType(rvalType); + return pushTypeBarrier(load, types, barrier); + } + + MSlots* slots = MSlots::New(alloc(), obj); + current->add(slots); + + MLoadSlot* load = MLoadSlot::New(alloc(), slots, slot - nfixed); + current->add(load); + current->push(load); + + load->setResultType(rvalType); + return pushTypeBarrier(load, types, barrier); +} + +bool +IonBuilder::loadSlot(MDefinition* obj, Shape* shape, MIRType rvalType, + BarrierKind barrier, TemporaryTypeSet* types) +{ + return loadSlot(obj, shape->slot(), shape->numFixedSlots(), rvalType, barrier, types); +} + +bool +IonBuilder::storeSlot(MDefinition* obj, size_t slot, size_t nfixed, + MDefinition* value, bool needsBarrier, + MIRType slotType /* = MIRType::None */) +{ + if (slot < nfixed) { + MStoreFixedSlot* store = MStoreFixedSlot::New(alloc(), obj, slot, value); + current->add(store); + current->push(value); + if (needsBarrier) + store->setNeedsBarrier(); + return resumeAfter(store); + } + + MSlots* slots = MSlots::New(alloc(), obj); + current->add(slots); + + MStoreSlot* store = MStoreSlot::New(alloc(), slots, slot - nfixed, value); + current->add(store); + current->push(value); + if (needsBarrier) + store->setNeedsBarrier(); + if (slotType != MIRType::None) + store->setSlotType(slotType); + return resumeAfter(store); +} + +bool +IonBuilder::storeSlot(MDefinition* obj, Shape* shape, MDefinition* value, bool needsBarrier, + MIRType slotType /* = MIRType::None */) +{ + MOZ_ASSERT(shape->writable()); + return storeSlot(obj, shape->slot(), shape->numFixedSlots(), value, needsBarrier, slotType); +} + +bool +IonBuilder::shouldAbortOnPreliminaryGroups(MDefinition *obj) +{ + // Watch for groups which still have preliminary object information and + // have not had the new script properties or unboxed layout analyses + // performed. Normally this is done after a small number of the objects + // have been created, but if only a few have been created we can still + // perform the analysis with a smaller object population. The analysis can + // have side effects so we will end up aborting compilation after building + // finishes and retrying later. + TemporaryTypeSet *types = obj->resultTypeSet(); + if (!types || types->unknownObject()) + return false; + + bool preliminary = false; + for (size_t i = 0; i < types->getObjectCount(); i++) { + TypeSet::ObjectKey* key = types->getObject(i); + if (!key) + continue; + + if (ObjectGroup* group = key->maybeGroup()) { + if (group->hasUnanalyzedPreliminaryObjects()) { + addAbortedPreliminaryGroup(group); + preliminary = true; + } + } + } + + return preliminary; +} + +MDefinition* +IonBuilder::maybeUnboxForPropertyAccess(MDefinition* def) +{ + if (def->type() != MIRType::Value) + return def; + + MIRType type = inspector->expectedPropertyAccessInputType(pc); + if (type == MIRType::Value || !def->mightBeType(type)) + return def; + + MUnbox* unbox = MUnbox::New(alloc(), def, type, MUnbox::Fallible); + current->add(unbox); + + // Fixup type information for a common case where a property call + // is converted to the following bytecodes + // + // a.foo() + // ================= Compiles to ================ + // LOAD "a" + // DUP + // CALLPROP "foo" + // SWAP + // CALL 0 + // + // If we have better type information to unbox the first copy going into + // the CALLPROP operation, we can replace the duplicated copy on the + // stack as well. + if (*pc == JSOP_CALLPROP || *pc == JSOP_CALLELEM) { + uint32_t idx = current->stackDepth() - 1; + MOZ_ASSERT(current->getSlot(idx) == def); + current->setSlot(idx, unbox); + } + + return unbox; +} + +bool +IonBuilder::jsop_getprop(PropertyName* name) +{ + bool emitted = false; + startTrackingOptimizations(); + + MDefinition* obj = current->pop(); + TemporaryTypeSet* types = bytecodeTypes(pc); + + trackTypeInfo(TrackedTypeSite::Receiver, obj->type(), obj->resultTypeSet()); + + if (!info().isAnalysis()) { + // The calls below can abort compilation, so we only try this if we're + // not analyzing. + // Try to optimize arguments.length. + trackOptimizationAttempt(TrackedStrategy::GetProp_ArgumentsLength); + if (!getPropTryArgumentsLength(&emitted, obj) || emitted) + return emitted; + + // Try to optimize arguments.callee. + trackOptimizationAttempt(TrackedStrategy::GetProp_ArgumentsCallee); + if (!getPropTryArgumentsCallee(&emitted, obj, name) || emitted) + return emitted; + } + + obj = maybeUnboxForPropertyAccess(obj); + if (obj->type() == MIRType::Object) + obj = convertUnboxedObjects(obj); + + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), + obj, name, types); + + // Try to optimize to a specific constant. + trackOptimizationAttempt(TrackedStrategy::GetProp_InferredConstant); + if (barrier == BarrierKind::NoBarrier) { + if (!getPropTryInferredConstant(&emitted, obj, name, types) || emitted) + return emitted; + } else { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + } + + // Always use a call if we are performing analysis and + // not actually emitting code, to simplify later analysis. Also skip deeper + // analysis if there are no known types for this operation, as it will + // always invalidate when executing. + if (info().isAnalysis() || types->empty() || shouldAbortOnPreliminaryGroups(obj)) { + if (types->empty()) { + // Since no further optimizations will be tried, use the IC + // strategy, which would have been the last one to be tried, as a + // sentinel value for why everything failed. + trackOptimizationAttempt(TrackedStrategy::GetProp_InlineCache); + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + } + + MCallGetProperty* call = MCallGetProperty::New(alloc(), obj, name); + current->add(call); + + // During the definite properties analysis we can still try to bake in + // constants read off the prototype chain, to allow inlining later on. + // In this case we still need the getprop call so that the later + // analysis knows when the |this| value has been read from. + if (info().isAnalysis()) { + if (!getPropTryConstant(&emitted, obj, NameToId(name), types) || emitted) + return emitted; + } + + current->push(call); + return resumeAfter(call) && pushTypeBarrier(call, types, BarrierKind::TypeSet); + } + + // Try to optimize accesses on outer window proxies, for example window.foo. + // This needs to come before the various strategies getPropTryInnerize tries + // internally, since some of those strategies will "succeed" in silly ways + // even for an outer object. + trackOptimizationAttempt(TrackedStrategy::GetProp_Innerize); + if (!getPropTryInnerize(&emitted, obj, name, types) || emitted) + return emitted; + + if (!forceInlineCaches()) { + // Try to hardcode known constants. + trackOptimizationAttempt(TrackedStrategy::GetProp_Constant); + if (!getPropTryConstant(&emitted, obj, NameToId(name), types) || emitted) + return emitted; + + // Try to hardcode known not-defined + trackOptimizationAttempt(TrackedStrategy::GetProp_NotDefined); + if (!getPropTryNotDefined(&emitted, obj, NameToId(name), types) || emitted) + return emitted; + + // Try to emit loads from known binary data blocks + trackOptimizationAttempt(TrackedStrategy::GetProp_TypedObject); + if (!getPropTryTypedObject(&emitted, obj, name) || emitted) + return emitted; + + // Try to emit loads from definite slots. + trackOptimizationAttempt(TrackedStrategy::GetProp_DefiniteSlot); + if (!getPropTryDefiniteSlot(&emitted, obj, name, barrier, types) || emitted) + return emitted; + + // Try to emit loads from unboxed objects. + trackOptimizationAttempt(TrackedStrategy::GetProp_Unboxed); + if (!getPropTryUnboxed(&emitted, obj, name, barrier, types) || emitted) + return emitted; + + // Try to inline a common property getter, or make a call. + trackOptimizationAttempt(TrackedStrategy::GetProp_CommonGetter); + if (!getPropTryCommonGetter(&emitted, obj, name, types) || emitted) + return emitted; + + // Try to emit a monomorphic/polymorphic access based on baseline caches. + trackOptimizationAttempt(TrackedStrategy::GetProp_InlineAccess); + if (!getPropTryInlineAccess(&emitted, obj, name, barrier, types) || emitted) + return emitted; + + // Try to emit loads from a module namespace. + trackOptimizationAttempt(TrackedStrategy::GetProp_ModuleNamespace); + if (!getPropTryModuleNamespace(&emitted, obj, name, barrier, types) || emitted) + return emitted; + } + + // Try to emit a polymorphic cache. + trackOptimizationAttempt(TrackedStrategy::GetProp_InlineCache); + if (!getPropTryCache(&emitted, obj, name, barrier, types) || emitted) + return emitted; + + // Try to emit a shared stub. + trackOptimizationAttempt(TrackedStrategy::GetProp_SharedCache); + if (!getPropTrySharedStub(&emitted, obj, types) || emitted) + return emitted; + + // Emit a call. + MCallGetProperty* call = MCallGetProperty::New(alloc(), obj, name); + current->add(call); + current->push(call); + if (!resumeAfter(call)) + return false; + + if (*pc == JSOP_CALLPROP && IsNullOrUndefined(obj->type())) { + // Due to inlining, it's possible the observed TypeSet is non-empty, + // even though we know |obj| is null/undefined and the MCallGetProperty + // will throw. Don't push a TypeBarrier in this case, to avoid + // inlining the following (unreachable) JSOP_CALL. + return true; + } + + return pushTypeBarrier(call, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::improveThisTypesForCall() +{ + // After a CALLPROP (or CALLELEM) for obj.prop(), the this-value and callee + // for the call are on top of the stack: + // + // ... [this: obj], [callee: obj.prop] + // + // If obj is null or undefined, obj.prop would have thrown an exception so + // at this point we can remove null and undefined from obj's TypeSet, to + // improve type information for the call that will follow. + + MOZ_ASSERT(*pc == JSOP_CALLPROP || *pc == JSOP_CALLELEM); + + // Ensure |this| has types {object, null/undefined}. + MDefinition* thisDef = current->peek(-2); + if (thisDef->type() != MIRType::Value || + !thisDef->mightBeType(MIRType::Object) || + !thisDef->resultTypeSet() || + !thisDef->resultTypeSet()->objectOrSentinel()) + { + return true; + } + + // Remove null/undefined from the TypeSet. + TemporaryTypeSet* types = thisDef->resultTypeSet()->cloneObjectsOnly(alloc_->lifoAlloc()); + if (!types) + return false; + + MFilterTypeSet* filter = MFilterTypeSet::New(alloc(), thisDef, types); + current->add(filter); + current->rewriteAtDepth(-2, filter); + + // FilterTypeSetPolicy::adjustInputs will insert an infallible Unbox(Object) + // for the input. Don't hoist this unbox above the getprop or getelem + // operation. + filter->setDependency(current->peek(-1)->toInstruction()); + return true; +} + +bool +IonBuilder::checkIsDefinitelyOptimizedArguments(MDefinition* obj, bool* isOptimizedArgs) +{ + if (obj->type() != MIRType::MagicOptimizedArguments) { + if (script()->argumentsHasVarBinding() && + obj->mightBeType(MIRType::MagicOptimizedArguments)) + { + return abort("Type is not definitely lazy arguments."); + } + + *isOptimizedArgs = false; + return true; + } + + *isOptimizedArgs = true; + return true; +} + +bool +IonBuilder::getPropTryInferredConstant(bool* emitted, MDefinition* obj, PropertyName* name, + TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + // Need a result typeset to optimize. + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + if (!objTypes) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return true; + } + + JSObject* singleton = objTypes->maybeSingleton(); + if (!singleton) { + trackOptimizationOutcome(TrackedOutcome::NotSingleton); + return true; + } + + TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(singleton); + if (key->unknownProperties()) { + trackOptimizationOutcome(TrackedOutcome::UnknownProperties); + return true; + } + + HeapTypeSetKey property = key->property(NameToId(name)); + + Value constantValue = UndefinedValue(); + if (property.constant(constraints(), &constantValue)) { + spew("Optimized constant property"); + obj->setImplicitlyUsedUnchecked(); + pushConstant(constantValue); + types->addType(TypeSet::GetValueType(constantValue), alloc_->lifoAlloc()); + trackOptimizationSuccess(); + *emitted = true; + } + + return true; +} + +bool +IonBuilder::getPropTryArgumentsLength(bool* emitted, MDefinition* obj) +{ + MOZ_ASSERT(*emitted == false); + + if (JSOp(*pc) != JSOP_LENGTH) + return true; + + bool isOptimizedArgs = false; + if (!checkIsDefinitelyOptimizedArguments(obj, &isOptimizedArgs)) + return false; + if (!isOptimizedArgs) + return true; + + trackOptimizationSuccess(); + *emitted = true; + + obj->setImplicitlyUsedUnchecked(); + + // We don't know anything from the callee + if (inliningDepth_ == 0) { + MInstruction* ins = MArgumentsLength::New(alloc()); + current->add(ins); + current->push(ins); + return true; + } + + // We are inlining and know the number of arguments the callee pushed + pushConstant(Int32Value(inlineCallInfo_->argv().length())); + return true; +} + +bool +IonBuilder::getPropTryArgumentsCallee(bool* emitted, MDefinition* obj, PropertyName* name) +{ + MOZ_ASSERT(*emitted == false); + + if (name != names().callee) + return true; + + bool isOptimizedArgs = false; + if (!checkIsDefinitelyOptimizedArguments(obj, &isOptimizedArgs)) + return false; + if (!isOptimizedArgs) + return true; + + MOZ_ASSERT(script()->hasMappedArgsObj()); + + obj->setImplicitlyUsedUnchecked(); + current->push(getCallee()); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTryConstant(bool* emitted, MDefinition* obj, jsid id, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + if (!types->mightBeMIRType(MIRType::Object)) { + // If we have not observed an object result here, don't look for a + // singleton constant. + trackOptimizationOutcome(TrackedOutcome::NotObject); + return true; + } + + JSObject* singleton = testSingletonPropertyTypes(obj, id); + if (!singleton) { + trackOptimizationOutcome(TrackedOutcome::NotSingleton); + return true; + } + + // Property access is a known constant -- safe to emit. + obj->setImplicitlyUsedUnchecked(); + + pushConstant(ObjectValue(*singleton)); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTryNotDefined(bool* emitted, MDefinition* obj, jsid id, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + if (!types->mightBeMIRType(MIRType::Undefined)) { + // Only optimize if we expect this property access to return undefined. + trackOptimizationOutcome(TrackedOutcome::NotUndefined); + return true; + } + + ResultWithOOM<bool> res = testNotDefinedProperty(obj, id); + if (res.oom) + return false; + if (!res.value) { + trackOptimizationOutcome(TrackedOutcome::GenericFailure); + return true; + } + + obj->setImplicitlyUsedUnchecked(); + pushConstant(UndefinedValue()); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTryTypedObject(bool* emitted, + MDefinition* obj, + PropertyName* name) +{ + TypedObjectPrediction fieldPrediction; + size_t fieldOffset; + size_t fieldIndex; + if (!typedObjectHasField(obj, name, &fieldOffset, &fieldPrediction, &fieldIndex)) + return true; + + switch (fieldPrediction.kind()) { + case type::Simd: + // FIXME (bug 894104): load into a MIRType::float32x4 etc + return true; + + case type::Struct: + case type::Array: + return getPropTryComplexPropOfTypedObject(emitted, + obj, + fieldOffset, + fieldPrediction, + fieldIndex); + + case type::Reference: + return getPropTryReferencePropOfTypedObject(emitted, + obj, + fieldOffset, + fieldPrediction, + name); + + case type::Scalar: + return getPropTryScalarPropOfTypedObject(emitted, + obj, + fieldOffset, + fieldPrediction); + } + + MOZ_CRASH("Bad kind"); +} + +bool +IonBuilder::getPropTryScalarPropOfTypedObject(bool* emitted, MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldPrediction) +{ + // Must always be loading the same scalar type + Scalar::Type fieldType = fieldPrediction.scalarType(); + + // Don't optimize if the typed object's underlying buffer may be detached. + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return true; + + trackOptimizationSuccess(); + *emitted = true; + + LinearSum byteOffset(alloc()); + if (!byteOffset.add(fieldOffset)) + setForceAbort(); + + return pushScalarLoadFromTypedObject(typedObj, byteOffset, fieldType); +} + +bool +IonBuilder::getPropTryReferencePropOfTypedObject(bool* emitted, MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldPrediction, + PropertyName* name) +{ + ReferenceTypeDescr::Type fieldType = fieldPrediction.referenceType(); + + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return true; + + trackOptimizationSuccess(); + *emitted = true; + + LinearSum byteOffset(alloc()); + if (!byteOffset.add(fieldOffset)) + setForceAbort(); + + return pushReferenceLoadFromTypedObject(typedObj, byteOffset, fieldType, name); +} + +bool +IonBuilder::getPropTryComplexPropOfTypedObject(bool* emitted, + MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldPrediction, + size_t fieldIndex) +{ + // Don't optimize if the typed object's underlying buffer may be detached. + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return true; + + // OK, perform the optimization + + // Identify the type object for the field. + MDefinition* type = loadTypedObjectType(typedObj); + MDefinition* fieldTypeObj = typeObjectForFieldFromStructType(type, fieldIndex); + + LinearSum byteOffset(alloc()); + if (!byteOffset.add(fieldOffset)) + setForceAbort(); + + return pushDerivedTypedObject(emitted, typedObj, byteOffset, + fieldPrediction, fieldTypeObj); +} + +MDefinition* +IonBuilder::convertUnboxedObjects(MDefinition* obj) +{ + // If obj might be in any particular unboxed group which should be + // converted to a native representation, perform that conversion. This does + // not guarantee the object will not have such a group afterwards, if the + // object's possible groups are not precisely known. + TemporaryTypeSet* types = obj->resultTypeSet(); + if (!types || types->unknownObject() || !types->objectOrSentinel()) + return obj; + + BaselineInspector::ObjectGroupVector list(alloc()); + for (size_t i = 0; i < types->getObjectCount(); i++) { + TypeSet::ObjectKey* key = obj->resultTypeSet()->getObject(i); + if (!key || !key->isGroup()) + continue; + + if (UnboxedLayout* layout = key->group()->maybeUnboxedLayout()) { + AutoEnterOOMUnsafeRegion oomUnsafe; + if (layout->nativeGroup() && !list.append(key->group())) + oomUnsafe.crash("IonBuilder::convertUnboxedObjects"); + } + } + + return convertUnboxedObjects(obj, list); +} + +MDefinition* +IonBuilder::convertUnboxedObjects(MDefinition* obj, + const BaselineInspector::ObjectGroupVector& list) +{ + for (size_t i = 0; i < list.length(); i++) { + ObjectGroup* group = list[i]; + if (TemporaryTypeSet* types = obj->resultTypeSet()) { + if (!types->hasType(TypeSet::ObjectType(group))) + continue; + } + obj = MConvertUnboxedObjectToNative::New(alloc(), obj, group); + current->add(obj->toInstruction()); + } + return obj; +} + +bool +IonBuilder::getPropTryDefiniteSlot(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + uint32_t nfixed; + uint32_t slot = getDefiniteSlot(obj->resultTypeSet(), name, &nfixed); + if (slot == UINT32_MAX) + return true; + + if (obj->type() != MIRType::Object) { + MGuardObject* guard = MGuardObject::New(alloc(), obj); + current->add(guard); + obj = guard; + } + + MInstruction* load; + if (slot < nfixed) { + load = MLoadFixedSlot::New(alloc(), obj, slot); + } else { + MInstruction* slots = MSlots::New(alloc(), obj); + current->add(slots); + + load = MLoadSlot::New(alloc(), slots, slot - nfixed); + } + + if (barrier == BarrierKind::NoBarrier) + load->setResultType(types->getKnownMIRType()); + + current->add(load); + current->push(load); + + if (!pushTypeBarrier(load, types, barrier)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTryModuleNamespace(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + if (!objTypes) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return true; + } + + JSObject* singleton = objTypes->maybeSingleton(); + if (!singleton) { + trackOptimizationOutcome(TrackedOutcome::NotSingleton); + return true; + } + + if (!singleton->is<ModuleNamespaceObject>()) { + trackOptimizationOutcome(TrackedOutcome::NotModuleNamespace); + return true; + } + + ModuleNamespaceObject* ns = &singleton->as<ModuleNamespaceObject>(); + ModuleEnvironmentObject* env; + Shape* shape; + if (!ns->bindings().lookup(NameToId(name), &env, &shape)) { + trackOptimizationOutcome(TrackedOutcome::UnknownProperty); + return true; + } + + obj->setImplicitlyUsedUnchecked(); + MConstant* envConst = constant(ObjectValue(*env)); + uint32_t slot = shape->slot(); + uint32_t nfixed = env->numFixedSlots(); + if (!loadSlot(envConst, slot, nfixed, types->getKnownMIRType(), barrier, types)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +MInstruction* +IonBuilder::loadUnboxedProperty(MDefinition* obj, size_t offset, JSValueType unboxedType, + BarrierKind barrier, TemporaryTypeSet* types) +{ + // loadUnboxedValue is designed to load any value as if it were contained in + // an array. Thus a property offset is converted to an index, when the + // object is reinterpreted as an array of properties of the same size. + size_t index = offset / UnboxedTypeSize(unboxedType); + MInstruction* indexConstant = MConstant::New(alloc(), Int32Value(index)); + current->add(indexConstant); + + return loadUnboxedValue(obj, UnboxedPlainObject::offsetOfData(), + indexConstant, unboxedType, barrier, types); +} + +MInstruction* +IonBuilder::loadUnboxedValue(MDefinition* elements, size_t elementsOffset, + MDefinition* index, JSValueType unboxedType, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MInstruction* load; + switch (unboxedType) { + case JSVAL_TYPE_BOOLEAN: + load = MLoadUnboxedScalar::New(alloc(), elements, index, Scalar::Uint8, + DoesNotRequireMemoryBarrier, elementsOffset); + load->setResultType(MIRType::Boolean); + break; + + case JSVAL_TYPE_INT32: + load = MLoadUnboxedScalar::New(alloc(), elements, index, Scalar::Int32, + DoesNotRequireMemoryBarrier, elementsOffset); + load->setResultType(MIRType::Int32); + break; + + case JSVAL_TYPE_DOUBLE: + load = MLoadUnboxedScalar::New(alloc(), elements, index, Scalar::Float64, + DoesNotRequireMemoryBarrier, elementsOffset, + /* canonicalizeDoubles = */ false); + load->setResultType(MIRType::Double); + break; + + case JSVAL_TYPE_STRING: + load = MLoadUnboxedString::New(alloc(), elements, index, elementsOffset); + break; + + case JSVAL_TYPE_OBJECT: { + MLoadUnboxedObjectOrNull::NullBehavior nullBehavior; + if (types->hasType(TypeSet::NullType())) + nullBehavior = MLoadUnboxedObjectOrNull::HandleNull; + else if (barrier != BarrierKind::NoBarrier) + nullBehavior = MLoadUnboxedObjectOrNull::BailOnNull; + else + nullBehavior = MLoadUnboxedObjectOrNull::NullNotPossible; + load = MLoadUnboxedObjectOrNull::New(alloc(), elements, index, nullBehavior, + elementsOffset); + break; + } + + default: + MOZ_CRASH(); + } + + current->add(load); + return load; +} + +bool +IonBuilder::getPropTryUnboxed(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + JSValueType unboxedType; + uint32_t offset = getUnboxedOffset(obj->resultTypeSet(), name, &unboxedType); + if (offset == UINT32_MAX) + return true; + + if (obj->type() != MIRType::Object) { + MGuardObject* guard = MGuardObject::New(alloc(), obj); + current->add(guard); + obj = guard; + } + + MInstruction* load = loadUnboxedProperty(obj, offset, unboxedType, barrier, types); + current->push(load); + + if (!pushTypeBarrier(load, types, barrier)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +MDefinition* +IonBuilder::addShapeGuardsForGetterSetter(MDefinition* obj, JSObject* holder, Shape* holderShape, + const BaselineInspector::ReceiverVector& receivers, + const BaselineInspector::ObjectGroupVector& convertUnboxedGroups, + bool isOwnProperty) +{ + MOZ_ASSERT(holder); + MOZ_ASSERT(holderShape); + + obj = convertUnboxedObjects(obj, convertUnboxedGroups); + + if (isOwnProperty) { + MOZ_ASSERT(receivers.empty()); + return addShapeGuard(obj, holderShape, Bailout_ShapeGuard); + } + + MDefinition* holderDef = constant(ObjectValue(*holder)); + addShapeGuard(holderDef, holderShape, Bailout_ShapeGuard); + + return addGuardReceiverPolymorphic(obj, receivers); +} + +bool +IonBuilder::getPropTryCommonGetter(bool* emitted, MDefinition* obj, PropertyName* name, + TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + Shape* lastProperty = nullptr; + JSFunction* commonGetter = nullptr; + Shape* globalShape = nullptr; + JSObject* foundProto = nullptr; + bool isOwnProperty = false; + BaselineInspector::ReceiverVector receivers(alloc()); + BaselineInspector::ObjectGroupVector convertUnboxedGroups(alloc()); + if (!inspector->commonGetPropFunction(pc, &foundProto, &lastProperty, &commonGetter, + &globalShape, &isOwnProperty, + receivers, convertUnboxedGroups)) + { + return true; + } + + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + MDefinition* guard = nullptr; + MDefinition* globalGuard = nullptr; + bool canUseTIForGetter = + testCommonGetterSetter(objTypes, name, /* isGetter = */ true, + foundProto, lastProperty, commonGetter, &guard, + globalShape, &globalGuard); + if (!canUseTIForGetter) { + // If type information is bad, we can still optimize the getter if we + // shape guard. + obj = addShapeGuardsForGetterSetter(obj, foundProto, lastProperty, + receivers, convertUnboxedGroups, + isOwnProperty); + if (!obj) + return false; + } + + bool isDOM = objTypes && objTypes->isDOMClass(constraints()); + + if (isDOM && testShouldDOMCall(objTypes, commonGetter, JSJitInfo::Getter)) { + const JSJitInfo* jitinfo = commonGetter->jitInfo(); + MInstruction* get; + if (jitinfo->isAlwaysInSlot) { + // If our object is a singleton and we know the property is + // constant (which is true if and only if the get doesn't alias + // anything), we can just read the slot here and use that constant. + JSObject* singleton = objTypes->maybeSingleton(); + if (singleton && jitinfo->aliasSet() == JSJitInfo::AliasNone) { + size_t slot = jitinfo->slotIndex; + *emitted = true; + pushConstant(GetReservedSlot(singleton, slot)); + return true; + } + + // We can't use MLoadFixedSlot here because it might not have the + // right aliasing behavior; we want to alias DOM setters as needed. + get = MGetDOMMember::New(alloc(), jitinfo, obj, guard, globalGuard); + } else { + get = MGetDOMProperty::New(alloc(), jitinfo, obj, guard, globalGuard); + } + if (!get) { + return false; + } + current->add(get); + current->push(get); + + if (get->isEffectful() && !resumeAfter(get)) + return false; + + if (!pushDOMTypeBarrier(get, types, commonGetter)) + return false; + + trackOptimizationOutcome(TrackedOutcome::DOM); + *emitted = true; + return true; + } + + // Don't call the getter with a primitive value. + if (obj->type() != MIRType::Object) { + MGuardObject* guardObj = MGuardObject::New(alloc(), obj); + current->add(guardObj); + obj = guardObj; + } + + // Spoof stack to expected state for call. + + // Make sure there's enough room + if (!current->ensureHasSlots(2)) + return false; + current->push(constant(ObjectValue(*commonGetter))); + + current->push(obj); + + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, 0)) + return false; + + if (commonGetter->isNative()) { + InliningStatus status = inlineNativeGetter(callInfo, commonGetter); + switch (status) { + case InliningStatus_Error: + return false; + case InliningStatus_WarmUpCountTooLow: + case InliningStatus_NotInlined: + break; + case InliningStatus_Inlined: + trackOptimizationOutcome(TrackedOutcome::Inlined); + *emitted = true; + return true; + } + } + + // Inline if we can, otherwise, forget it and just generate a call. + if (commonGetter->isInterpreted()) { + InliningDecision decision = makeInliningDecision(commonGetter, callInfo); + switch (decision) { + case InliningDecision_Error: + return false; + case InliningDecision_DontInline: + case InliningDecision_WarmUpCountTooLow: + break; + case InliningDecision_Inline: { + InliningStatus status = inlineScriptedCall(callInfo, commonGetter); + if (status == InliningStatus_Inlined) { + *emitted = true; + return true; + } + if (status == InliningStatus_Error) + return false; + break; + } + } + } + + if (!makeCall(commonGetter, callInfo)) + return false; + + // If the getter could have been inlined, don't track success. The call to + // makeInliningDecision above would have tracked a specific reason why we + // couldn't inline. + if (!commonGetter->isInterpreted()) + trackOptimizationSuccess(); + + *emitted = true; + return true; +} + +bool +IonBuilder::canInlinePropertyOpShapes(const BaselineInspector::ReceiverVector& receivers) +{ + if (receivers.empty()) { + trackOptimizationOutcome(TrackedOutcome::NoShapeInfo); + return false; + } + + for (size_t i = 0; i < receivers.length(); i++) { + // We inline the property access as long as the shape is not in + // dictionary mode. We cannot be sure that the shape is still a + // lastProperty, and calling Shape::search() on dictionary mode + // shapes that aren't lastProperty is invalid. + if (receivers[i].shape && receivers[i].shape->inDictionary()) { + trackOptimizationOutcome(TrackedOutcome::InDictionaryMode); + return false; + } + } + + return true; +} + +static Shape* +PropertyShapesHaveSameSlot(const BaselineInspector::ReceiverVector& receivers, jsid id) +{ + Shape* firstShape = nullptr; + for (size_t i = 0; i < receivers.length(); i++) { + if (receivers[i].group) + return nullptr; + + Shape* shape = receivers[i].shape->searchLinear(id); + MOZ_ASSERT(shape); + + if (i == 0) { + firstShape = shape; + } else if (shape->slot() != firstShape->slot() || + shape->numFixedSlots() != firstShape->numFixedSlots()) + { + return nullptr; + } + } + + return firstShape; +} + +bool +IonBuilder::getPropTryInlineAccess(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + BaselineInspector::ReceiverVector receivers(alloc()); + BaselineInspector::ObjectGroupVector convertUnboxedGroups(alloc()); + if (!inspector->maybeInfoForPropertyOp(pc, receivers, convertUnboxedGroups)) + return false; + + if (!canInlinePropertyOpShapes(receivers)) + return true; + + obj = convertUnboxedObjects(obj, convertUnboxedGroups); + + MIRType rvalType = types->getKnownMIRType(); + if (barrier != BarrierKind::NoBarrier || IsNullOrUndefined(rvalType)) + rvalType = MIRType::Value; + + if (receivers.length() == 1) { + if (!receivers[0].group) { + // Monomorphic load from a native object. + spew("Inlining monomorphic native GETPROP"); + + obj = addShapeGuard(obj, receivers[0].shape, Bailout_ShapeGuard); + + Shape* shape = receivers[0].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(shape); + + if (!loadSlot(obj, shape, rvalType, barrier, types)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + if (receivers[0].shape) { + // Monomorphic load from an unboxed object expando. + spew("Inlining monomorphic unboxed expando GETPROP"); + + obj = addGroupGuard(obj, receivers[0].group, Bailout_ShapeGuard); + obj = addUnboxedExpandoGuard(obj, /* hasExpando = */ true, Bailout_ShapeGuard); + + MInstruction* expando = MLoadUnboxedExpando::New(alloc(), obj); + current->add(expando); + + expando = addShapeGuard(expando, receivers[0].shape, Bailout_ShapeGuard); + + Shape* shape = receivers[0].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(shape); + + if (!loadSlot(expando, shape, rvalType, barrier, types)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + // Monomorphic load from an unboxed object. + ObjectGroup* group = receivers[0].group; + if (obj->resultTypeSet() && !obj->resultTypeSet()->hasType(TypeSet::ObjectType(group))) + return true; + + obj = addGroupGuard(obj, group, Bailout_ShapeGuard); + + const UnboxedLayout::Property* property = group->unboxedLayout().lookup(name); + MInstruction* load = loadUnboxedProperty(obj, property->offset, property->type, barrier, types); + current->push(load); + + if (!pushTypeBarrier(load, types, barrier)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + MOZ_ASSERT(receivers.length() > 1); + spew("Inlining polymorphic GETPROP"); + + if (Shape* propShape = PropertyShapesHaveSameSlot(receivers, NameToId(name))) { + obj = addGuardReceiverPolymorphic(obj, receivers); + if (!obj) + return false; + + if (!loadSlot(obj, propShape, rvalType, barrier, types)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Polymorphic); + *emitted = true; + return true; + } + + MGetPropertyPolymorphic* load = MGetPropertyPolymorphic::New(alloc(), obj, name); + current->add(load); + current->push(load); + + for (size_t i = 0; i < receivers.length(); i++) { + Shape* propShape = nullptr; + if (receivers[i].shape) { + propShape = receivers[i].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(propShape); + } + if (!load->addReceiver(receivers[i], propShape)) + return false; + } + + if (failedShapeGuard_) + load->setNotMovable(); + + load->setResultType(rvalType); + if (!pushTypeBarrier(load, types, barrier)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Polymorphic); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTryCache(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + // The input value must either be an object, or we should have strong suspicions + // that it can be safely unboxed to an object. + if (obj->type() != MIRType::Object) { + TemporaryTypeSet* types = obj->resultTypeSet(); + if (!types || !types->objectOrSentinel()) { + trackOptimizationOutcome(TrackedOutcome::NoTypeInfo); + return true; + } + } + + // Since getters have no guaranteed return values, we must barrier in order to be + // able to attach stubs for them. + if (inspector->hasSeenAccessedGetter(pc)) + barrier = BarrierKind::TypeSet; + + // Caches can read values from prototypes, so update the barrier to + // reflect such possible values. + if (barrier != BarrierKind::TypeSet) { + ResultWithOOM<BarrierKind> protoBarrier = + PropertyReadOnPrototypeNeedsTypeBarrier(this, obj, name, types); + if (protoBarrier.oom) + return false; + if (protoBarrier.value != BarrierKind::NoBarrier) { + MOZ_ASSERT(barrier <= protoBarrier.value); + barrier = protoBarrier.value; + } + } + + MConstant* id = constant(StringValue(name)); + MGetPropertyCache* load = MGetPropertyCache::New(alloc(), obj, id, + barrier == BarrierKind::TypeSet); + + // Try to mark the cache as idempotent. + if (obj->type() == MIRType::Object && !invalidatedIdempotentCache()) { + if (PropertyReadIsIdempotent(constraints(), obj, name)) + load->setIdempotent(); + } + + // When we are in the context of making a call from the value returned from + // a property, we query the typeObject for the given property name to fill + // the InlinePropertyTable of the GetPropertyCache. This information is + // then used in inlineCallsite and inlineCalls, if the "this" definition is + // matching the "object" definition of the GetPropertyCache (see + // CanInlineGetPropertyCache). + // + // If this GetPropertyCache is idempotent, then we can dispatch to the right + // function only by checking the typed object, instead of querying the value + // of the property. Thus this GetPropertyCache can be moved into the + // fallback path (see inlineObjectGroupFallback). Otherwise, we always have + // to do the GetPropertyCache, and we can dispatch based on the JSFunction + // value. + if (JSOp(*pc) == JSOP_CALLPROP && load->idempotent()) { + if (!annotateGetPropertyCache(obj, name, load, obj->resultTypeSet(), types)) + return false; + } + + current->add(load); + current->push(load); + + if (load->isEffectful() && !resumeAfter(load)) + return false; + + MIRType rvalType = types->getKnownMIRType(); + if (barrier != BarrierKind::NoBarrier || IsNullOrUndefined(rvalType)) + rvalType = MIRType::Value; + load->setResultType(rvalType); + + if (!pushTypeBarrier(load, types, barrier)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::getPropTrySharedStub(bool* emitted, MDefinition* obj, TemporaryTypeSet* types) +{ + MOZ_ASSERT(*emitted == false); + + // Try to emit a shared stub cache. + + if (JitOptions.disableSharedStubs) + return true; + + MInstruction* stub = MUnarySharedStub::New(alloc(), obj); + current->add(stub); + current->push(stub); + + if (!resumeAfter(stub)) + return false; + + // Due to inlining, it's possible the observed TypeSet is non-empty, + // even though we know |obj| is null/undefined and the MCallGetProperty + // will throw. Don't push a TypeBarrier in this case, to avoid + // inlining the following (unreachable) JSOP_CALL. + if (*pc != JSOP_CALLPROP || !IsNullOrUndefined(obj->type())) { + if (!pushTypeBarrier(stub, types, BarrierKind::TypeSet)) + return false; + } + + *emitted = true; + return true; +} + +MDefinition* +IonBuilder::tryInnerizeWindow(MDefinition* obj) +{ + // Try to optimize accesses on outer window proxies (window.foo, for + // example) to go directly to the inner window, the global. + // + // Callers should be careful not to pass the inner object to getters or + // setters that require outerization. + + if (obj->type() != MIRType::Object) + return obj; + + TemporaryTypeSet* types = obj->resultTypeSet(); + if (!types) + return obj; + + JSObject* singleton = types->maybeSingleton(); + if (!singleton) + return obj; + + if (!IsWindowProxy(singleton)) + return obj; + + // This must be a WindowProxy for the current Window/global. Else it'd be + // a cross-compartment wrapper and IsWindowProxy returns false for those. + MOZ_ASSERT(ToWindowIfWindowProxy(singleton) == &script()->global()); + + // When we navigate, the WindowProxy is brain transplanted and we'll mark + // its ObjectGroup as having unknown properties. The type constraint we add + // here will invalidate JIT code when this happens. + TypeSet::ObjectKey* key = TypeSet::ObjectKey::get(singleton); + if (key->hasFlags(constraints(), OBJECT_FLAG_UNKNOWN_PROPERTIES)) + return obj; + + obj->setImplicitlyUsedUnchecked(); + return constant(ObjectValue(script()->global())); +} + +bool +IonBuilder::getPropTryInnerize(bool* emitted, MDefinition* obj, PropertyName* name, + TemporaryTypeSet* types) +{ + // See the comment in tryInnerizeWindow for how this works. + + // Note that it's important that we do this _before_ we'd try to + // do the optimizations below on obj normally, since some of those + // optimizations have fallback paths that are slower than the path + // we'd produce here. + + MOZ_ASSERT(*emitted == false); + + MDefinition* inner = tryInnerizeWindow(obj); + if (inner == obj) + return true; + + if (!forceInlineCaches()) { + trackOptimizationAttempt(TrackedStrategy::GetProp_Constant); + if (!getPropTryConstant(emitted, inner, NameToId(name), types) || *emitted) + return *emitted; + + trackOptimizationAttempt(TrackedStrategy::GetProp_StaticName); + if (!getStaticName(&script()->global(), name, emitted) || *emitted) + return *emitted; + + trackOptimizationAttempt(TrackedStrategy::GetProp_CommonGetter); + if (!getPropTryCommonGetter(emitted, inner, name, types) || *emitted) + return *emitted; + } + + // Passing the inner object to GetProperty IC is safe, see the + // needsOuterizedThisObject check in IsCacheableGetPropCallNative. + BarrierKind barrier = PropertyReadNeedsTypeBarrier(analysisContext, constraints(), + inner, name, types); + trackOptimizationAttempt(TrackedStrategy::GetProp_InlineCache); + if (!getPropTryCache(emitted, inner, name, barrier, types) || *emitted) + return *emitted; + + MOZ_ASSERT(*emitted == false); + return true; +} + +bool +IonBuilder::jsop_setprop(PropertyName* name) +{ + MDefinition* value = current->pop(); + MDefinition* obj = convertUnboxedObjects(current->pop()); + + bool emitted = false; + startTrackingOptimizations(); + trackTypeInfo(TrackedTypeSite::Receiver, obj->type(), obj->resultTypeSet()); + trackTypeInfo(TrackedTypeSite::Value, value->type(), value->resultTypeSet()); + + // Always use a call if we are doing the definite properties analysis and + // not actually emitting code, to simplify later analysis. + if (info().isAnalysis() || shouldAbortOnPreliminaryGroups(obj)) { + bool strict = IsStrictSetPC(pc); + MInstruction* ins = MCallSetProperty::New(alloc(), obj, value, name, strict); + current->add(ins); + current->push(value); + return resumeAfter(ins); + } + + if (!forceInlineCaches()) { + // Try to inline a common property setter, or make a call. + trackOptimizationAttempt(TrackedStrategy::SetProp_CommonSetter); + if (!setPropTryCommonSetter(&emitted, obj, name, value) || emitted) + return emitted; + + // Try to emit stores to known binary data blocks + trackOptimizationAttempt(TrackedStrategy::SetProp_TypedObject); + if (!setPropTryTypedObject(&emitted, obj, name, value) || emitted) + return emitted; + } + + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + bool barrier = PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current, &obj, name, &value, + /* canModify = */ true); + + if (!forceInlineCaches()) { + // Try to emit stores to unboxed objects. + trackOptimizationAttempt(TrackedStrategy::SetProp_Unboxed); + if (!setPropTryUnboxed(&emitted, obj, name, value, barrier, objTypes) || emitted) + return emitted; + } + + // Add post barrier if needed. The instructions above manage any post + // barriers they need directly. + if (NeedsPostBarrier(value)) + current->add(MPostWriteBarrier::New(alloc(), obj, value)); + + if (!forceInlineCaches()) { + // Try to emit store from definite slots. + trackOptimizationAttempt(TrackedStrategy::SetProp_DefiniteSlot); + if (!setPropTryDefiniteSlot(&emitted, obj, name, value, barrier, objTypes) || emitted) + return emitted; + + // Try to emit a monomorphic/polymorphic store based on baseline caches. + trackOptimizationAttempt(TrackedStrategy::SetProp_InlineAccess); + if (!setPropTryInlineAccess(&emitted, obj, name, value, barrier, objTypes) || emitted) + return emitted; + } + + // Emit a polymorphic cache. + trackOptimizationAttempt(TrackedStrategy::SetProp_InlineCache); + return setPropTryCache(&emitted, obj, name, value, barrier, objTypes); +} + +bool +IonBuilder::setPropTryCommonSetter(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value) +{ + MOZ_ASSERT(*emitted == false); + + Shape* lastProperty = nullptr; + JSFunction* commonSetter = nullptr; + JSObject* foundProto = nullptr; + bool isOwnProperty; + BaselineInspector::ReceiverVector receivers(alloc()); + BaselineInspector::ObjectGroupVector convertUnboxedGroups(alloc()); + if (!inspector->commonSetPropFunction(pc, &foundProto, &lastProperty, &commonSetter, + &isOwnProperty, + receivers, convertUnboxedGroups)) + { + trackOptimizationOutcome(TrackedOutcome::NoProtoFound); + return true; + } + + TemporaryTypeSet* objTypes = obj->resultTypeSet(); + MDefinition* guard = nullptr; + bool canUseTIForSetter = + testCommonGetterSetter(objTypes, name, /* isGetter = */ false, + foundProto, lastProperty, commonSetter, &guard); + if (!canUseTIForSetter) { + // If type information is bad, we can still optimize the setter if we + // shape guard. + obj = addShapeGuardsForGetterSetter(obj, foundProto, lastProperty, + receivers, convertUnboxedGroups, + isOwnProperty); + if (!obj) + return false; + } + + // Emit common setter. + + // Setters can be called even if the property write needs a type + // barrier, as calling the setter does not actually write any data + // properties. + + // Try emitting dom call. + if (!setPropTryCommonDOMSetter(emitted, obj, value, commonSetter, objTypes)) + return false; + + if (*emitted) { + trackOptimizationOutcome(TrackedOutcome::DOM); + return true; + } + + // Don't call the setter with a primitive value. + if (obj->type() != MIRType::Object) { + MGuardObject* guardObj = MGuardObject::New(alloc(), obj); + current->add(guardObj); + obj = guardObj; + } + + // Dummy up the stack, as in getprop. We are pushing an extra value, so + // ensure there is enough space. + if (!current->ensureHasSlots(3)) + return false; + + current->push(constant(ObjectValue(*commonSetter))); + current->push(obj); + current->push(value); + + // Call the setter. Note that we have to push the original value, not + // the setter's return value. + CallInfo callInfo(alloc(), false); + if (!callInfo.init(current, 1)) + return false; + + // Ensure that we know we are calling a setter in case we inline it. + callInfo.markAsSetter(); + + // Inline the setter if we can. + if (commonSetter->isInterpreted()) { + InliningDecision decision = makeInliningDecision(commonSetter, callInfo); + switch (decision) { + case InliningDecision_Error: + return false; + case InliningDecision_DontInline: + case InliningDecision_WarmUpCountTooLow: + break; + case InliningDecision_Inline: { + InliningStatus status = inlineScriptedCall(callInfo, commonSetter); + if (status == InliningStatus_Inlined) { + *emitted = true; + return true; + } + if (status == InliningStatus_Error) + return false; + } + } + } + + MCall* call = makeCallHelper(commonSetter, callInfo); + if (!call) + return false; + + current->push(value); + if (!resumeAfter(call)) + return false; + + // If the setter could have been inlined, don't track success. The call to + // makeInliningDecision above would have tracked a specific reason why we + // couldn't inline. + if (!commonSetter->isInterpreted()) + trackOptimizationSuccess(); + + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryCommonDOMSetter(bool* emitted, MDefinition* obj, + MDefinition* value, JSFunction* setter, + TemporaryTypeSet* objTypes) +{ + MOZ_ASSERT(*emitted == false); + + if (!objTypes || !objTypes->isDOMClass(constraints())) + return true; + + if (!testShouldDOMCall(objTypes, setter, JSJitInfo::Setter)) + return true; + + // Emit SetDOMProperty. + MOZ_ASSERT(setter->jitInfo()->type() == JSJitInfo::Setter); + MSetDOMProperty* set = MSetDOMProperty::New(alloc(), setter->jitInfo()->setter, obj, value); + + current->add(set); + current->push(value); + + if (!resumeAfter(set)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryTypedObject(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value) +{ + TypedObjectPrediction fieldPrediction; + size_t fieldOffset; + size_t fieldIndex; + if (!typedObjectHasField(obj, name, &fieldOffset, &fieldPrediction, &fieldIndex)) + return true; + + switch (fieldPrediction.kind()) { + case type::Simd: + // FIXME (bug 894104): store into a MIRType::float32x4 etc + return true; + + case type::Reference: + return setPropTryReferencePropOfTypedObject(emitted, obj, fieldOffset, + value, fieldPrediction, name); + + case type::Scalar: + return setPropTryScalarPropOfTypedObject(emitted, obj, fieldOffset, + value, fieldPrediction); + + case type::Struct: + case type::Array: + return true; + } + + MOZ_CRASH("Unknown kind"); +} + +bool +IonBuilder::setPropTryReferencePropOfTypedObject(bool* emitted, + MDefinition* obj, + int32_t fieldOffset, + MDefinition* value, + TypedObjectPrediction fieldPrediction, + PropertyName* name) +{ + ReferenceTypeDescr::Type fieldType = fieldPrediction.referenceType(); + + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return true; + + LinearSum byteOffset(alloc()); + if (!byteOffset.add(fieldOffset)) + setForceAbort(); + + if (!storeReferenceTypedObjectValue(obj, byteOffset, fieldType, value, name)) + return true; + + current->push(value); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryScalarPropOfTypedObject(bool* emitted, + MDefinition* obj, + int32_t fieldOffset, + MDefinition* value, + TypedObjectPrediction fieldPrediction) +{ + // Must always be loading the same scalar type + Scalar::Type fieldType = fieldPrediction.scalarType(); + + // Don't optimize if the typed object's underlying buffer may be detached. + TypeSet::ObjectKey* globalKey = TypeSet::ObjectKey::get(&script()->global()); + if (globalKey->hasFlags(constraints(), OBJECT_FLAG_TYPED_OBJECT_HAS_DETACHED_BUFFER)) + return true; + + LinearSum byteOffset(alloc()); + if (!byteOffset.add(fieldOffset)) + setForceAbort(); + + if (!storeScalarTypedObjectValue(obj, byteOffset, fieldType, value)) + return false; + + current->push(value); + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryDefiniteSlot(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes) +{ + MOZ_ASSERT(*emitted == false); + + if (barrier) { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + return true; + } + + uint32_t nfixed; + uint32_t slot = getDefiniteSlot(obj->resultTypeSet(), name, &nfixed); + if (slot == UINT32_MAX) + return true; + + bool writeBarrier = false; + for (size_t i = 0; i < obj->resultTypeSet()->getObjectCount(); i++) { + TypeSet::ObjectKey* key = obj->resultTypeSet()->getObject(i); + if (!key) + continue; + + HeapTypeSetKey property = key->property(NameToId(name)); + if (property.nonWritable(constraints())) { + trackOptimizationOutcome(TrackedOutcome::NonWritableProperty); + return true; + } + writeBarrier |= property.needsBarrier(constraints()); + } + + MInstruction* store; + if (slot < nfixed) { + store = MStoreFixedSlot::New(alloc(), obj, slot, value); + if (writeBarrier) + store->toStoreFixedSlot()->setNeedsBarrier(); + } else { + MInstruction* slots = MSlots::New(alloc(), obj); + current->add(slots); + + store = MStoreSlot::New(alloc(), slots, slot - nfixed, value); + if (writeBarrier) + store->toStoreSlot()->setNeedsBarrier(); + } + + current->add(store); + current->push(value); + + if (!resumeAfter(store)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +MInstruction* +IonBuilder::storeUnboxedProperty(MDefinition* obj, size_t offset, JSValueType unboxedType, + MDefinition* value) +{ + size_t scaledOffsetConstant = offset / UnboxedTypeSize(unboxedType); + MInstruction* scaledOffset = MConstant::New(alloc(), Int32Value(scaledOffsetConstant)); + current->add(scaledOffset); + + return storeUnboxedValue(obj, obj, UnboxedPlainObject::offsetOfData(), + scaledOffset, unboxedType, value); +} + +MInstruction* +IonBuilder::storeUnboxedValue(MDefinition* obj, MDefinition* elements, int32_t elementsOffset, + MDefinition* scaledOffset, JSValueType unboxedType, + MDefinition* value, bool preBarrier /* = true */) +{ + MInstruction* store; + switch (unboxedType) { + case JSVAL_TYPE_BOOLEAN: + store = MStoreUnboxedScalar::New(alloc(), elements, scaledOffset, value, Scalar::Uint8, + MStoreUnboxedScalar::DontTruncateInput, + DoesNotRequireMemoryBarrier, elementsOffset); + break; + + case JSVAL_TYPE_INT32: + store = MStoreUnboxedScalar::New(alloc(), elements, scaledOffset, value, Scalar::Int32, + MStoreUnboxedScalar::DontTruncateInput, + DoesNotRequireMemoryBarrier, elementsOffset); + break; + + case JSVAL_TYPE_DOUBLE: + store = MStoreUnboxedScalar::New(alloc(), elements, scaledOffset, value, Scalar::Float64, + MStoreUnboxedScalar::DontTruncateInput, + DoesNotRequireMemoryBarrier, elementsOffset); + break; + + case JSVAL_TYPE_STRING: + store = MStoreUnboxedString::New(alloc(), elements, scaledOffset, value, + elementsOffset, preBarrier); + break; + + case JSVAL_TYPE_OBJECT: + MOZ_ASSERT(value->type() == MIRType::Object || + value->type() == MIRType::Null || + value->type() == MIRType::Value); + MOZ_ASSERT(!value->mightBeType(MIRType::Undefined), + "MToObjectOrNull slow path is invalid for unboxed objects"); + store = MStoreUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, value, obj, + elementsOffset, preBarrier); + break; + + default: + MOZ_CRASH(); + } + + current->add(store); + return store; +} + +bool +IonBuilder::setPropTryUnboxed(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes) +{ + MOZ_ASSERT(*emitted == false); + + if (barrier) { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + return true; + } + + JSValueType unboxedType; + uint32_t offset = getUnboxedOffset(obj->resultTypeSet(), name, &unboxedType); + if (offset == UINT32_MAX) + return true; + + if (obj->type() != MIRType::Object) { + MGuardObject* guard = MGuardObject::New(alloc(), obj); + current->add(guard); + obj = guard; + } + + MInstruction* store = storeUnboxedProperty(obj, offset, unboxedType, value); + + current->push(value); + + if (!resumeAfter(store)) + return false; + + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryInlineAccess(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes) +{ + MOZ_ASSERT(*emitted == false); + + if (barrier) { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + return true; + } + + BaselineInspector::ReceiverVector receivers(alloc()); + BaselineInspector::ObjectGroupVector convertUnboxedGroups(alloc()); + if (!inspector->maybeInfoForPropertyOp(pc, receivers, convertUnboxedGroups)) + return false; + + if (!canInlinePropertyOpShapes(receivers)) + return true; + + obj = convertUnboxedObjects(obj, convertUnboxedGroups); + + if (receivers.length() == 1) { + if (!receivers[0].group) { + // Monomorphic store to a native object. + spew("Inlining monomorphic native SETPROP"); + + obj = addShapeGuard(obj, receivers[0].shape, Bailout_ShapeGuard); + + Shape* shape = receivers[0].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(shape); + + bool needsBarrier = objTypes->propertyNeedsBarrier(constraints(), NameToId(name)); + if (!storeSlot(obj, shape, value, needsBarrier)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + if (receivers[0].shape) { + // Monomorphic store to an unboxed object expando. + spew("Inlining monomorphic unboxed expando SETPROP"); + + obj = addGroupGuard(obj, receivers[0].group, Bailout_ShapeGuard); + obj = addUnboxedExpandoGuard(obj, /* hasExpando = */ true, Bailout_ShapeGuard); + + MInstruction* expando = MLoadUnboxedExpando::New(alloc(), obj); + current->add(expando); + + expando = addShapeGuard(expando, receivers[0].shape, Bailout_ShapeGuard); + + Shape* shape = receivers[0].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(shape); + + bool needsBarrier = objTypes->propertyNeedsBarrier(constraints(), NameToId(name)); + if (!storeSlot(expando, shape, value, needsBarrier)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + // Monomorphic store to an unboxed object. + spew("Inlining monomorphic unboxed SETPROP"); + + ObjectGroup* group = receivers[0].group; + if (!objTypes->hasType(TypeSet::ObjectType(group))) + return true; + + obj = addGroupGuard(obj, group, Bailout_ShapeGuard); + + const UnboxedLayout::Property* property = group->unboxedLayout().lookup(name); + storeUnboxedProperty(obj, property->offset, property->type, value); + + current->push(value); + + trackOptimizationOutcome(TrackedOutcome::Monomorphic); + *emitted = true; + return true; + } + + MOZ_ASSERT(receivers.length() > 1); + spew("Inlining polymorphic SETPROP"); + + if (Shape* propShape = PropertyShapesHaveSameSlot(receivers, NameToId(name))) { + obj = addGuardReceiverPolymorphic(obj, receivers); + if (!obj) + return false; + + bool needsBarrier = objTypes->propertyNeedsBarrier(constraints(), NameToId(name)); + if (!storeSlot(obj, propShape, value, needsBarrier)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Polymorphic); + *emitted = true; + return true; + } + + MSetPropertyPolymorphic* ins = MSetPropertyPolymorphic::New(alloc(), obj, value, name); + current->add(ins); + current->push(value); + + for (size_t i = 0; i < receivers.length(); i++) { + Shape* propShape = nullptr; + if (receivers[i].shape) { + propShape = receivers[i].shape->searchLinear(NameToId(name)); + MOZ_ASSERT(propShape); + } + if (!ins->addReceiver(receivers[i], propShape)) + return false; + } + + if (objTypes->propertyNeedsBarrier(constraints(), NameToId(name))) + ins->setNeedsBarrier(); + + if (!resumeAfter(ins)) + return false; + + trackOptimizationOutcome(TrackedOutcome::Polymorphic); + *emitted = true; + return true; +} + +bool +IonBuilder::setPropTryCache(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes) +{ + MOZ_ASSERT(*emitted == false); + + bool strict = IsStrictSetPC(pc); + + MConstant* id = constant(StringValue(name)); + MSetPropertyCache* ins = MSetPropertyCache::New(alloc(), obj, id, value, strict, barrier, + /* guardHoles = */ false); + current->add(ins); + current->push(value); + + if (!resumeAfter(ins)) + return false; + + trackOptimizationSuccess(); + *emitted = true; + return true; +} + +bool +IonBuilder::jsop_delprop(PropertyName* name) +{ + MDefinition* obj = current->pop(); + + bool strict = JSOp(*pc) == JSOP_STRICTDELPROP; + MInstruction* ins = MDeleteProperty::New(alloc(), obj, name, strict); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_delelem() +{ + MDefinition* index = current->pop(); + MDefinition* obj = current->pop(); + + bool strict = JSOp(*pc) == JSOP_STRICTDELELEM; + MDeleteElement* ins = MDeleteElement::New(alloc(), obj, index, strict); + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_regexp(RegExpObject* reobj) +{ + MRegExp* regexp = MRegExp::New(alloc(), constraints(), reobj); + current->add(regexp); + current->push(regexp); + + return true; +} + +bool +IonBuilder::jsop_object(JSObject* obj) +{ + if (options.cloneSingletons()) { + MCloneLiteral* clone = MCloneLiteral::New(alloc(), constant(ObjectValue(*obj))); + current->add(clone); + current->push(clone); + return resumeAfter(clone); + } + + compartment->setSingletonsAsValues(); + pushConstant(ObjectValue(*obj)); + return true; +} + +bool +IonBuilder::jsop_lambda(JSFunction* fun) +{ + MOZ_ASSERT(analysis().usesEnvironmentChain()); + MOZ_ASSERT(!fun->isArrow()); + + if (IsAsmJSModule(fun)) + return abort("asm.js module function"); + + MConstant* cst = MConstant::NewConstraintlessObject(alloc(), fun); + current->add(cst); + MLambda* ins = MLambda::New(alloc(), constraints(), current->environmentChain(), cst); + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_lambda_arrow(JSFunction* fun) +{ + MOZ_ASSERT(analysis().usesEnvironmentChain()); + MOZ_ASSERT(fun->isArrow()); + MOZ_ASSERT(!fun->isNative()); + + MDefinition* newTargetDef = current->pop(); + MLambdaArrow* ins = MLambdaArrow::New(alloc(), constraints(), current->environmentChain(), + newTargetDef, fun); + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_setarg(uint32_t arg) +{ + // To handle this case, we should spill the arguments to the space where + // actual arguments are stored. The tricky part is that if we add a MIR + // to wrap the spilling action, we don't want the spilling to be + // captured by the GETARG and by the resume point, only by + // MGetFrameArgument. + MOZ_ASSERT(analysis_.hasSetArg()); + MDefinition* val = current->peek(-1); + + // If an arguments object is in use, and it aliases formals, then all SETARGs + // must go through the arguments object. + if (info().argsObjAliasesFormals()) { + if (NeedsPostBarrier(val)) + current->add(MPostWriteBarrier::New(alloc(), current->argumentsObject(), val)); + current->add(MSetArgumentsObjectArg::New(alloc(), current->argumentsObject(), + GET_ARGNO(pc), val)); + return true; + } + + // :TODO: if hasArguments() is true, and the script has a JSOP_SETARG, then + // convert all arg accesses to go through the arguments object. (see Bug 957475) + if (info().hasArguments()) + return abort("NYI: arguments & setarg."); + + // Otherwise, if a magic arguments is in use, and it aliases formals, and there exist + // arguments[...] GETELEM expressions in the script, then SetFrameArgument must be used. + // If no arguments[...] GETELEM expressions are in the script, and an argsobj is not + // required, then it means that any aliased argument set can never be observed, and + // the frame does not actually need to be updated with the new arg value. + if (info().argumentsAliasesFormals()) { + // JSOP_SETARG with magic arguments within inline frames is not yet supported. + MOZ_ASSERT(script()->uninlineable() && !isInlineBuilder()); + + MSetFrameArgument* store = MSetFrameArgument::New(alloc(), arg, val); + modifiesFrameArguments_ = true; + current->add(store); + current->setArg(arg); + return true; + } + + // If this assignment is at the start of the function and is coercing + // the original value for the argument which was passed in, loosen + // the type information for that original argument if it is currently + // empty due to originally executing in the interpreter. + if (graph().numBlocks() == 1 && + (val->isBitOr() || val->isBitAnd() || val->isMul() /* for JSOP_POS */)) + { + for (size_t i = 0; i < val->numOperands(); i++) { + MDefinition* op = val->getOperand(i); + if (op->isParameter() && + op->toParameter()->index() == (int32_t)arg && + op->resultTypeSet() && + op->resultTypeSet()->empty()) + { + bool otherUses = false; + for (MUseDefIterator iter(op); iter; iter++) { + MDefinition* def = iter.def(); + if (def == val) + continue; + otherUses = true; + } + if (!otherUses) { + MOZ_ASSERT(op->resultTypeSet() == &argTypes[arg]); + argTypes[arg].addType(TypeSet::UnknownType(), alloc_->lifoAlloc()); + if (val->isMul()) { + val->setResultType(MIRType::Double); + val->toMul()->setSpecialization(MIRType::Double); + } else { + MOZ_ASSERT(val->type() == MIRType::Int32); + } + val->setResultTypeSet(nullptr); + } + } + } + } + + current->setArg(arg); + return true; +} + +bool +IonBuilder::jsop_defvar(uint32_t index) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_DEFVAR); + + PropertyName* name = script()->getName(index); + + // Bake in attrs. + unsigned attrs = JSPROP_ENUMERATE | JSPROP_PERMANENT; + MOZ_ASSERT(!script()->isForEval()); + + // Pass the EnvironmentChain. + MOZ_ASSERT(analysis().usesEnvironmentChain()); + + // Bake the name pointer into the MDefVar. + MDefVar* defvar = MDefVar::New(alloc(), name, attrs, current->environmentChain()); + current->add(defvar); + + return resumeAfter(defvar); +} + +bool +IonBuilder::jsop_deflexical(uint32_t index) +{ + MOZ_ASSERT(!script()->hasNonSyntacticScope()); + MOZ_ASSERT(JSOp(*pc) == JSOP_DEFLET || JSOp(*pc) == JSOP_DEFCONST); + + PropertyName* name = script()->getName(index); + unsigned attrs = JSPROP_ENUMERATE | JSPROP_PERMANENT; + if (JSOp(*pc) == JSOP_DEFCONST) + attrs |= JSPROP_READONLY; + + MDefLexical* deflex = MDefLexical::New(alloc(), name, attrs); + current->add(deflex); + + return resumeAfter(deflex); +} + +bool +IonBuilder::jsop_deffun(uint32_t index) +{ + MOZ_ASSERT(analysis().usesEnvironmentChain()); + + MDefFun* deffun = MDefFun::New(alloc(), current->pop(), current->environmentChain()); + current->add(deffun); + + return resumeAfter(deffun); +} + +bool +IonBuilder::jsop_throwsetconst() +{ + current->peek(-1)->setImplicitlyUsedUnchecked(); + MInstruction* lexicalError = MThrowRuntimeLexicalError::New(alloc(), JSMSG_BAD_CONST_ASSIGN); + current->add(lexicalError); + return resumeAfter(lexicalError); +} + +bool +IonBuilder::jsop_checklexical() +{ + uint32_t slot = info().localSlot(GET_LOCALNO(pc)); + MDefinition* lexical = addLexicalCheck(current->getSlot(slot)); + if (!lexical) + return false; + current->setSlot(slot, lexical); + return true; +} + +bool +IonBuilder::jsop_checkaliasedlexical(EnvironmentCoordinate ec) +{ + MDefinition* let = addLexicalCheck(getAliasedVar(ec)); + if (!let) + return false; + + jsbytecode* nextPc = pc + JSOP_CHECKALIASEDLEXICAL_LENGTH; + MOZ_ASSERT(JSOp(*nextPc) == JSOP_GETALIASEDVAR || + JSOp(*nextPc) == JSOP_SETALIASEDVAR || + JSOp(*nextPc) == JSOP_THROWSETALIASEDCONST); + MOZ_ASSERT(ec == EnvironmentCoordinate(nextPc)); + + // If we are checking for a load, push the checked let so that the load + // can use it. + if (JSOp(*nextPc) == JSOP_GETALIASEDVAR) + setLexicalCheck(let); + + return true; +} + +bool +IonBuilder::jsop_functionthis() +{ + MOZ_ASSERT(info().funMaybeLazy()); + MOZ_ASSERT(!info().funMaybeLazy()->isArrow()); + + if (script()->strict() || info().funMaybeLazy()->isSelfHostedBuiltin()) { + // No need to wrap primitive |this| in strict mode or self-hosted code. + current->pushSlot(info().thisSlot()); + return true; + } + + if (thisTypes && (thisTypes->getKnownMIRType() == MIRType::Object || + (thisTypes->empty() && baselineFrame_ && baselineFrame_->thisType.isSomeObject()))) + { + // This is safe, because if the entry type of |this| is an object, it + // will necessarily be an object throughout the entire function. OSR + // can introduce a phi, but this phi will be specialized. + current->pushSlot(info().thisSlot()); + return true; + } + + // If we are doing an analysis, we might not yet know the type of |this|. + // Instead of bailing out just push the |this| slot, as this code won't + // actually execute and it does not matter whether |this| is primitive. + if (info().isAnalysis()) { + current->pushSlot(info().thisSlot()); + return true; + } + + // Hard case: |this| may be a primitive we have to wrap. + MDefinition* def = current->getSlot(info().thisSlot()); + + if (def->type() == MIRType::Object) { + current->push(def); + return true; + } + + if (IsNullOrUndefined(def->type())) { + pushConstant(GetThisValue(&script()->global())); + return true; + } + + MComputeThis* thisObj = MComputeThis::New(alloc(), def); + current->add(thisObj); + current->push(thisObj); + + return resumeAfter(thisObj); +} + +bool +IonBuilder::jsop_globalthis() +{ + if (script()->hasNonSyntacticScope()) { + // Ion does not compile global scripts with a non-syntactic scope, but + // we can end up here when we're compiling an arrow function. + return abort("JSOP_GLOBALTHIS in script with non-syntactic scope"); + } + + LexicalEnvironmentObject* globalLexical = &script()->global().lexicalEnvironment(); + pushConstant(globalLexical->thisValue()); + return true; +} + +bool +IonBuilder::jsop_typeof() +{ + MDefinition* input = current->pop(); + MTypeOf* ins = MTypeOf::New(alloc(), input, input->type()); + + ins->cacheInputMaybeCallableOrEmulatesUndefined(constraints()); + + current->add(ins); + current->push(ins); + + return true; +} + +bool +IonBuilder::jsop_toasync() +{ + MDefinition* unwrapped = current->pop(); + MOZ_ASSERT(unwrapped->type() == MIRType::Object); + + MToAsync* ins = MToAsync::New(alloc(), unwrapped); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_toid() +{ + // No-op if the index is an integer. + if (current->peek(-1)->type() == MIRType::Int32) + return true; + + MDefinition* index = current->pop(); + MToId* ins = MToId::New(alloc(), index); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_iter(uint8_t flags) +{ + if (flags != JSITER_ENUMERATE) + nonStringIteration_ = true; + + MDefinition* obj = current->pop(); + MInstruction* ins = MIteratorStart::New(alloc(), obj, flags); + + if (!outermostBuilder()->iterators_.append(ins)) + return false; + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_itermore() +{ + MDefinition* iter = current->peek(-1); + MInstruction* ins = MIteratorMore::New(alloc(), iter); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_isnoiter() +{ + MDefinition* def = current->peek(-1); + MOZ_ASSERT(def->isIteratorMore()); + + MInstruction* ins = MIsNoIter::New(alloc(), def); + current->add(ins); + current->push(ins); + + return true; +} + +bool +IonBuilder::jsop_iterend() +{ + MDefinition* iter = current->pop(); + MInstruction* ins = MIteratorEnd::New(alloc(), iter); + + current->add(ins); + + return resumeAfter(ins); +} + +MDefinition* +IonBuilder::walkEnvironmentChain(unsigned hops) +{ + MDefinition* env = current->getSlot(info().environmentChainSlot()); + + for (unsigned i = 0; i < hops; i++) { + MInstruction* ins = MEnclosingEnvironment::New(alloc(), env); + current->add(ins); + env = ins; + } + + return env; +} + +bool +IonBuilder::hasStaticEnvironmentObject(EnvironmentCoordinate ec, JSObject** pcall) +{ + JSScript* outerScript = EnvironmentCoordinateFunctionScript(script(), pc); + if (!outerScript || !outerScript->treatAsRunOnce()) + return false; + + TypeSet::ObjectKey* funKey = + TypeSet::ObjectKey::get(outerScript->functionNonDelazifying()); + if (funKey->hasFlags(constraints(), OBJECT_FLAG_RUNONCE_INVALIDATED)) + return false; + + // The script this aliased var operation is accessing will run only once, + // so there will be only one call object and the aliased var access can be + // compiled in the same manner as a global access. We still need to find + // the call object though. + + // Look for the call object on the current script's function's env chain. + // If the current script is inner to the outer script and the function has + // singleton type then it should show up here. + + MDefinition* envDef = current->getSlot(info().environmentChainSlot()); + envDef->setImplicitlyUsedUnchecked(); + + JSObject* environment = script()->functionNonDelazifying()->environment(); + while (environment && !environment->is<GlobalObject>()) { + if (environment->is<CallObject>() && + environment->as<CallObject>().callee().nonLazyScript() == outerScript) + { + MOZ_ASSERT(environment->isSingleton()); + *pcall = environment; + return true; + } + environment = environment->enclosingEnvironment(); + } + + // Look for the call object on the current frame, if we are compiling the + // outer script itself. Don't do this if we are at entry to the outer + // script, as the call object we see will not be the real one --- after + // entering the Ion code a different call object will be created. + + if (script() == outerScript && baselineFrame_ && info().osrPc()) { + JSObject* singletonScope = baselineFrame_->singletonEnvChain; + if (singletonScope && + singletonScope->is<CallObject>() && + singletonScope->as<CallObject>().callee().nonLazyScript() == outerScript) + { + MOZ_ASSERT(singletonScope->isSingleton()); + *pcall = singletonScope; + return true; + } + } + + return true; +} + +MDefinition* +IonBuilder::getAliasedVar(EnvironmentCoordinate ec) +{ + MDefinition* obj = walkEnvironmentChain(ec.hops()); + + Shape* shape = EnvironmentCoordinateToEnvironmentShape(script(), pc); + + MInstruction* load; + if (shape->numFixedSlots() <= ec.slot()) { + MInstruction* slots = MSlots::New(alloc(), obj); + current->add(slots); + + load = MLoadSlot::New(alloc(), slots, ec.slot() - shape->numFixedSlots()); + } else { + load = MLoadFixedSlot::New(alloc(), obj, ec.slot()); + } + + current->add(load); + return load; +} + +bool +IonBuilder::jsop_getaliasedvar(EnvironmentCoordinate ec) +{ + JSObject* call = nullptr; + if (hasStaticEnvironmentObject(ec, &call) && call) { + PropertyName* name = EnvironmentCoordinateName(envCoordinateNameCache, script(), pc); + bool emitted = false; + if (!getStaticName(call, name, &emitted, takeLexicalCheck()) || emitted) + return emitted; + } + + // See jsop_checkaliasedlexical. + MDefinition* load = takeLexicalCheck(); + if (!load) + load = getAliasedVar(ec); + current->push(load); + + TemporaryTypeSet* types = bytecodeTypes(pc); + return pushTypeBarrier(load, types, BarrierKind::TypeSet); +} + +bool +IonBuilder::jsop_setaliasedvar(EnvironmentCoordinate ec) +{ + JSObject* call = nullptr; + if (hasStaticEnvironmentObject(ec, &call)) { + uint32_t depth = current->stackDepth() + 1; + if (depth > current->nslots()) { + if (!current->increaseSlots(depth - current->nslots())) + return false; + } + MDefinition* value = current->pop(); + PropertyName* name = EnvironmentCoordinateName(envCoordinateNameCache, script(), pc); + + if (call) { + // Push the object on the stack to match the bound object expected in + // the global and property set cases. + pushConstant(ObjectValue(*call)); + current->push(value); + return setStaticName(call, name); + } + + // The call object has type information we need to respect but we + // couldn't find it. Just do a normal property assign. + MDefinition* obj = walkEnvironmentChain(ec.hops()); + current->push(obj); + current->push(value); + return jsop_setprop(name); + } + + MDefinition* rval = current->peek(-1); + MDefinition* obj = walkEnvironmentChain(ec.hops()); + + Shape* shape = EnvironmentCoordinateToEnvironmentShape(script(), pc); + + if (NeedsPostBarrier(rval)) + current->add(MPostWriteBarrier::New(alloc(), obj, rval)); + + MInstruction* store; + if (shape->numFixedSlots() <= ec.slot()) { + MInstruction* slots = MSlots::New(alloc(), obj); + current->add(slots); + + store = MStoreSlot::NewBarriered(alloc(), slots, ec.slot() - shape->numFixedSlots(), rval); + } else { + store = MStoreFixedSlot::NewBarriered(alloc(), obj, ec.slot(), rval); + } + + current->add(store); + return resumeAfter(store); +} + +bool +IonBuilder::jsop_in() +{ + MDefinition* obj = convertUnboxedObjects(current->pop()); + MDefinition* id = current->pop(); + + bool emitted = false; + + if (!inTryDense(&emitted, obj, id) || emitted) + return emitted; + + if (!inTryFold(&emitted, obj, id) || emitted) + return emitted; + + MIn* ins = MIn::New(alloc(), id, obj); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::inTryDense(bool* emitted, MDefinition* obj, MDefinition* id) +{ + MOZ_ASSERT(!*emitted); + + if (shouldAbortOnPreliminaryGroups(obj)) + return true; + + JSValueType unboxedType = UnboxedArrayElementType(constraints(), obj, id); + if (unboxedType == JSVAL_TYPE_MAGIC) { + if (!ElementAccessIsDenseNative(constraints(), obj, id)) + return true; + } + + if (ElementAccessHasExtraIndexedProperty(this, obj)) + return true; + + *emitted = true; + + bool needsHoleCheck = !ElementAccessIsPacked(constraints(), obj); + + // Ensure id is an integer. + MInstruction* idInt32 = MToInt32::New(alloc(), id); + current->add(idInt32); + id = idInt32; + + // Get the elements vector. + MElements* elements = MElements::New(alloc(), obj, unboxedType != JSVAL_TYPE_MAGIC); + current->add(elements); + + MInstruction* initLength = initializedLength(obj, elements, unboxedType); + + // If there are no holes, speculate the InArray check will not fail. + if (!needsHoleCheck && !failedBoundsCheck_) { + addBoundsCheck(idInt32, initLength); + pushConstant(BooleanValue(true)); + return true; + } + + // Check if id < initLength and elem[id] not a hole. + MInArray* ins = MInArray::New(alloc(), elements, id, initLength, obj, needsHoleCheck, + unboxedType); + + current->add(ins); + current->push(ins); + + return true; +} + +bool +IonBuilder::inTryFold(bool* emitted, MDefinition* obj, MDefinition* id) +{ + // Fold |id in obj| to |false|, if we know the object (or an object on its + // prototype chain) does not have this property. + + MOZ_ASSERT(!*emitted); + + MConstant* idConst = id->maybeConstantValue(); + jsid propId; + if (!idConst || !ValueToIdPure(idConst->toJSValue(), &propId)) + return true; + + if (propId != IdToTypeId(propId)) + return true; + + ResultWithOOM<bool> res = testNotDefinedProperty(obj, propId); + if (res.oom) + return false; + if (!res.value) + return true; + + *emitted = true; + + pushConstant(BooleanValue(false)); + obj->setImplicitlyUsedUnchecked(); + id->setImplicitlyUsedUnchecked(); + return true; +} + +bool +IonBuilder::hasOnProtoChain(TypeSet::ObjectKey* key, JSObject* protoObject, bool* hasOnProto) +{ + MOZ_ASSERT(protoObject); + + while (true) { + if (!key->hasStableClassAndProto(constraints()) || !key->clasp()->isNative()) + return false; + + JSObject* proto = checkNurseryObject(key->proto().toObjectOrNull()); + if (!proto) { + *hasOnProto = false; + return true; + } + + if (proto == protoObject) { + *hasOnProto = true; + return true; + } + + key = TypeSet::ObjectKey::get(proto); + } + + MOZ_CRASH("Unreachable"); +} + +bool +IonBuilder::tryFoldInstanceOf(MDefinition* lhs, JSObject* protoObject) +{ + // Try to fold the js::IsDelegate part of the instanceof operation. + + if (!lhs->mightBeType(MIRType::Object)) { + // If the lhs is a primitive, the result is false. + lhs->setImplicitlyUsedUnchecked(); + pushConstant(BooleanValue(false)); + return true; + } + + TemporaryTypeSet* lhsTypes = lhs->resultTypeSet(); + if (!lhsTypes || lhsTypes->unknownObject()) + return false; + + // We can fold if either all objects have protoObject on their proto chain + // or none have. + bool isFirst = true; + bool knownIsInstance = false; + + for (unsigned i = 0; i < lhsTypes->getObjectCount(); i++) { + TypeSet::ObjectKey* key = lhsTypes->getObject(i); + if (!key) + continue; + + bool isInstance; + if (!hasOnProtoChain(key, protoObject, &isInstance)) + return false; + + if (isFirst) { + knownIsInstance = isInstance; + isFirst = false; + } else if (knownIsInstance != isInstance) { + // Some of the objects have protoObject on their proto chain and + // others don't, so we can't optimize this. + return false; + } + } + + if (knownIsInstance && lhsTypes->getKnownMIRType() != MIRType::Object) { + // The result is true for all objects, but the lhs might be a primitive. + // We can't fold this completely but we can use a much faster IsObject + // test. + MIsObject* isObject = MIsObject::New(alloc(), lhs); + current->add(isObject); + current->push(isObject); + return true; + } + + lhs->setImplicitlyUsedUnchecked(); + pushConstant(BooleanValue(knownIsInstance)); + return true; +} + +bool +IonBuilder::jsop_instanceof() +{ + MDefinition* rhs = current->pop(); + MDefinition* obj = current->pop(); + + // If this is an 'x instanceof function' operation and we can determine the + // exact function and prototype object being tested for, use a typed path. + do { + TemporaryTypeSet* rhsTypes = rhs->resultTypeSet(); + JSObject* rhsObject = rhsTypes ? rhsTypes->maybeSingleton() : nullptr; + if (!rhsObject || !rhsObject->is<JSFunction>() || rhsObject->isBoundFunction()) + break; + + // Refuse to optimize anything whose [[Prototype]] isn't Function.prototype + // since we can't guarantee that it uses the default @@hasInstance method. + if (rhsObject->hasUncacheableProto() || !rhsObject->hasStaticPrototype()) + break; + + Value funProto = script()->global().getPrototype(JSProto_Function); + if (!funProto.isObject() || rhsObject->staticPrototype() != &funProto.toObject()) + break; + + // If the user has supplied their own @@hasInstance method we shouldn't + // clobber it. + JSFunction* fun = &rhsObject->as<JSFunction>(); + const WellKnownSymbols* symbols = &compartment->runtime()->wellKnownSymbols(); + if (!js::FunctionHasDefaultHasInstance(fun, *symbols)) + break; + + // Ensure that we will bail if the @@hasInstance property or [[Prototype]] + // change. + TypeSet::ObjectKey* rhsKey = TypeSet::ObjectKey::get(rhsObject); + if (!rhsKey->hasStableClassAndProto(constraints())) + break; + + if (rhsKey->unknownProperties()) + break; + + HeapTypeSetKey hasInstanceObject = + rhsKey->property(SYMBOL_TO_JSID(symbols->hasInstance)); + if (hasInstanceObject.isOwnProperty(constraints())) + break; + + HeapTypeSetKey protoProperty = + rhsKey->property(NameToId(names().prototype)); + JSObject* protoObject = protoProperty.singleton(constraints()); + if (!protoObject) + break; + + rhs->setImplicitlyUsedUnchecked(); + + if (tryFoldInstanceOf(obj, protoObject)) + return true; + + MInstanceOf* ins = MInstanceOf::New(alloc(), obj, protoObject); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); + } while (false); + + // Try to inline a fast path based on Baseline ICs. + do { + Shape* shape; + uint32_t slot; + JSObject* protoObject; + if (!inspector->instanceOfData(pc, &shape, &slot, &protoObject)) + break; + + // Shape guard. + rhs = addShapeGuard(rhs, shape, Bailout_ShapeGuard); + + // Guard .prototype == protoObject. + MOZ_ASSERT(shape->numFixedSlots() == 0, "Must be a dynamic slot"); + MSlots* slots = MSlots::New(alloc(), rhs); + current->add(slots); + MLoadSlot* prototype = MLoadSlot::New(alloc(), slots, slot); + current->add(prototype); + MConstant* protoConst = MConstant::NewConstraintlessObject(alloc(), protoObject); + current->add(protoConst); + MGuardObjectIdentity* guard = MGuardObjectIdentity::New(alloc(), prototype, protoConst, + /* bailOnEquality = */ false); + current->add(guard); + + if (tryFoldInstanceOf(obj, protoObject)) + return true; + + MInstanceOf* ins = MInstanceOf::New(alloc(), obj, protoObject); + current->add(ins); + current->push(ins); + return resumeAfter(ins); + } while (false); + + MCallInstanceOf* ins = MCallInstanceOf::New(alloc(), obj, rhs); + + current->add(ins); + current->push(ins); + + return resumeAfter(ins); +} + +bool +IonBuilder::jsop_debugger() +{ + MDebugger* debugger = MDebugger::New(alloc()); + current->add(debugger); + + // The |debugger;| statement will always bail out to baseline if + // cx->compartment()->isDebuggee(). Resume in-place and have baseline + // handle the details. + return resumeAt(debugger, pc); +} + +MInstruction* +IonBuilder::addConvertElementsToDoubles(MDefinition* elements) +{ + MInstruction* convert = MConvertElementsToDoubles::New(alloc(), elements); + current->add(convert); + return convert; +} + +MDefinition* +IonBuilder::addMaybeCopyElementsForWrite(MDefinition* object, bool checkNative) +{ + if (!ElementAccessMightBeCopyOnWrite(constraints(), object)) + return object; + MInstruction* copy = MMaybeCopyElementsForWrite::New(alloc(), object, checkNative); + current->add(copy); + return copy; +} + +MInstruction* +IonBuilder::addBoundsCheck(MDefinition* index, MDefinition* length) +{ + MInstruction* check = MBoundsCheck::New(alloc(), index, length); + current->add(check); + + // If a bounds check failed in the past, don't optimize bounds checks. + if (failedBoundsCheck_) + check->setNotMovable(); + + return check; +} + +MInstruction* +IonBuilder::addShapeGuard(MDefinition* obj, Shape* const shape, BailoutKind bailoutKind) +{ + MGuardShape* guard = MGuardShape::New(alloc(), obj, shape, bailoutKind); + current->add(guard); + + // If a shape guard failed in the past, don't optimize shape guard. + if (failedShapeGuard_) + guard->setNotMovable(); + + return guard; +} + +MInstruction* +IonBuilder::addGroupGuard(MDefinition* obj, ObjectGroup* group, BailoutKind bailoutKind) +{ + MGuardObjectGroup* guard = MGuardObjectGroup::New(alloc(), obj, group, + /* bailOnEquality = */ false, bailoutKind); + current->add(guard); + + // If a shape guard failed in the past, don't optimize group guards. + if (failedShapeGuard_) + guard->setNotMovable(); + + LifoAlloc* lifoAlloc = alloc().lifoAlloc(); + guard->setResultTypeSet(lifoAlloc->new_<TemporaryTypeSet>(lifoAlloc, + TypeSet::ObjectType(group))); + + return guard; +} + +MInstruction* +IonBuilder::addUnboxedExpandoGuard(MDefinition* obj, bool hasExpando, BailoutKind bailoutKind) +{ + MGuardUnboxedExpando* guard = MGuardUnboxedExpando::New(alloc(), obj, hasExpando, bailoutKind); + current->add(guard); + + // If a shape guard failed in the past, don't optimize group guards. + if (failedShapeGuard_) + guard->setNotMovable(); + + return guard; +} + +MInstruction* +IonBuilder::addGuardReceiverPolymorphic(MDefinition* obj, + const BaselineInspector::ReceiverVector& receivers) +{ + if (receivers.length() == 1) { + if (!receivers[0].group) { + // Monomorphic guard on a native object. + return addShapeGuard(obj, receivers[0].shape, Bailout_ShapeGuard); + } + + if (!receivers[0].shape) { + // Guard on an unboxed object that does not have an expando. + obj = addGroupGuard(obj, receivers[0].group, Bailout_ShapeGuard); + return addUnboxedExpandoGuard(obj, /* hasExpando = */ false, Bailout_ShapeGuard); + } + + // Monomorphic receiver guards are not yet supported when the receiver + // is an unboxed object with an expando. + } + + MGuardReceiverPolymorphic* guard = MGuardReceiverPolymorphic::New(alloc(), obj); + current->add(guard); + + if (failedShapeGuard_) + guard->setNotMovable(); + + for (size_t i = 0; i < receivers.length(); i++) { + if (!guard->addReceiver(receivers[i])) + return nullptr; + } + + return guard; +} + +MInstruction* +IonBuilder::addSharedTypedArrayGuard(MDefinition* obj) +{ + MGuardSharedTypedArray* guard = MGuardSharedTypedArray::New(alloc(), obj); + current->add(guard); + return guard; +} + +TemporaryTypeSet* +IonBuilder::bytecodeTypes(jsbytecode* pc) +{ + return TypeScript::BytecodeTypes(script(), pc, bytecodeTypeMap, &typeArrayHint, typeArray); +} + +TypedObjectPrediction +IonBuilder::typedObjectPrediction(MDefinition* typedObj) +{ + // Extract TypedObjectPrediction directly if we can + if (typedObj->isNewDerivedTypedObject()) { + return typedObj->toNewDerivedTypedObject()->prediction(); + } + + TemporaryTypeSet* types = typedObj->resultTypeSet(); + return typedObjectPrediction(types); +} + +TypedObjectPrediction +IonBuilder::typedObjectPrediction(TemporaryTypeSet* types) +{ + // Type set must be known to be an object. + if (!types || types->getKnownMIRType() != MIRType::Object) + return TypedObjectPrediction(); + + // And only known objects. + if (types->unknownObject()) + return TypedObjectPrediction(); + + TypedObjectPrediction out; + for (uint32_t i = 0; i < types->getObjectCount(); i++) { + ObjectGroup* group = types->getGroup(i); + if (!group || !TypeSet::ObjectKey::get(group)->hasStableClassAndProto(constraints())) + return TypedObjectPrediction(); + + if (!IsTypedObjectClass(group->clasp())) + return TypedObjectPrediction(); + + out.addDescr(group->typeDescr()); + } + + return out; +} + +MDefinition* +IonBuilder::loadTypedObjectType(MDefinition* typedObj) +{ + // Shortcircuit derived type objects, meaning the intermediate + // objects created to represent `a.b` in an expression like + // `a.b.c`. In that case, the type object can be simply pulled + // from the operands of that instruction. + if (typedObj->isNewDerivedTypedObject()) + return typedObj->toNewDerivedTypedObject()->type(); + + MInstruction* descr = MTypedObjectDescr::New(alloc(), typedObj); + current->add(descr); + + return descr; +} + +// Given a typed object `typedObj` and an offset `offset` into that +// object's data, returns another typed object and adusted offset +// where the data can be found. Often, these returned values are the +// same as the inputs, but in cases where intermediate derived type +// objects have been created, the return values will remove +// intermediate layers (often rendering those derived type objects +// into dead code). +void +IonBuilder::loadTypedObjectData(MDefinition* typedObj, + MDefinition** owner, + LinearSum* ownerOffset) +{ + MOZ_ASSERT(typedObj->type() == MIRType::Object); + + // Shortcircuit derived type objects, meaning the intermediate + // objects created to represent `a.b` in an expression like + // `a.b.c`. In that case, the owned and a base offset can be + // pulled from the operands of the instruction and combined with + // `offset`. + if (typedObj->isNewDerivedTypedObject()) { + MNewDerivedTypedObject* ins = typedObj->toNewDerivedTypedObject(); + + SimpleLinearSum base = ExtractLinearSum(ins->offset()); + if (!ownerOffset->add(base)) + setForceAbort(); + + *owner = ins->owner(); + return; + } + + *owner = typedObj; +} + +// Takes as input a typed object, an offset into that typed object's +// memory, and the type repr of the data found at that offset. Returns +// the elements pointer and a scaled offset. The scaled offset is +// expressed in units of `unit`; when working with typed array MIR, +// this is typically the alignment. +void +IonBuilder::loadTypedObjectElements(MDefinition* typedObj, + const LinearSum& baseByteOffset, + uint32_t scale, + MDefinition** ownerElements, + MDefinition** ownerScaledOffset, + int32_t* ownerByteAdjustment) +{ + MDefinition* owner; + LinearSum ownerByteOffset(alloc()); + loadTypedObjectData(typedObj, &owner, &ownerByteOffset); + + if (!ownerByteOffset.add(baseByteOffset)) + setForceAbort(); + + TemporaryTypeSet* ownerTypes = owner->resultTypeSet(); + const Class* clasp = ownerTypes ? ownerTypes->getKnownClass(constraints()) : nullptr; + if (clasp && IsInlineTypedObjectClass(clasp)) { + // Perform the load directly from the owner pointer. + if (!ownerByteOffset.add(InlineTypedObject::offsetOfDataStart())) + setForceAbort(); + *ownerElements = owner; + } else { + bool definitelyOutline = clasp && IsOutlineTypedObjectClass(clasp); + *ownerElements = MTypedObjectElements::New(alloc(), owner, definitelyOutline); + current->add((*ownerElements)->toInstruction()); + } + + // Extract the constant adjustment from the byte offset. + *ownerByteAdjustment = ownerByteOffset.constant(); + int32_t negativeAdjustment; + if (!SafeSub(0, *ownerByteAdjustment, &negativeAdjustment)) + setForceAbort(); + if (!ownerByteOffset.add(negativeAdjustment)) + setForceAbort(); + + // Scale the byte offset if required by the MIR node which will access the + // typed object. In principle we should always be able to cleanly divide + // the terms in this lienar sum due to alignment restrictions, but due to + // limitations of ExtractLinearSum when applied to the terms in derived + // typed objects this isn't always be possible. In these cases, fall back + // on an explicit division operation. + if (ownerByteOffset.divide(scale)) { + *ownerScaledOffset = ConvertLinearSum(alloc(), current, ownerByteOffset); + } else { + MDefinition* unscaledOffset = ConvertLinearSum(alloc(), current, ownerByteOffset); + *ownerScaledOffset = MDiv::New(alloc(), unscaledOffset, constantInt(scale), + MIRType::Int32, /* unsigned = */ false); + current->add((*ownerScaledOffset)->toInstruction()); + } +} + +// Looks up the offset/type-repr-set of the field `id`, given the type +// set `objTypes` of the field owner. If a field is found, returns true +// and sets *fieldOffset, *fieldPrediction, and *fieldIndex. Returns false +// otherwise. Infallible. +bool +IonBuilder::typedObjectHasField(MDefinition* typedObj, + PropertyName* name, + size_t* fieldOffset, + TypedObjectPrediction* fieldPrediction, + size_t* fieldIndex) +{ + TypedObjectPrediction objPrediction = typedObjectPrediction(typedObj); + if (objPrediction.isUseless()) { + trackOptimizationOutcome(TrackedOutcome::AccessNotTypedObject); + return false; + } + + // Must be accessing a struct. + if (objPrediction.kind() != type::Struct) { + trackOptimizationOutcome(TrackedOutcome::NotStruct); + return false; + } + + // Determine the type/offset of the field `name`, if any. + if (!objPrediction.hasFieldNamed(NameToId(name), fieldOffset, + fieldPrediction, fieldIndex)) + { + trackOptimizationOutcome(TrackedOutcome::StructNoField); + return false; + } + + return true; +} + +MDefinition* +IonBuilder::typeObjectForElementFromArrayStructType(MDefinition* typeObj) +{ + MInstruction* elemType = MLoadFixedSlot::New(alloc(), typeObj, JS_DESCR_SLOT_ARRAY_ELEM_TYPE); + current->add(elemType); + + MInstruction* unboxElemType = MUnbox::New(alloc(), elemType, MIRType::Object, MUnbox::Infallible); + current->add(unboxElemType); + + return unboxElemType; +} + +MDefinition* +IonBuilder::typeObjectForFieldFromStructType(MDefinition* typeObj, + size_t fieldIndex) +{ + // Load list of field type objects. + + MInstruction* fieldTypes = MLoadFixedSlot::New(alloc(), typeObj, JS_DESCR_SLOT_STRUCT_FIELD_TYPES); + current->add(fieldTypes); + + MInstruction* unboxFieldTypes = MUnbox::New(alloc(), fieldTypes, MIRType::Object, MUnbox::Infallible); + current->add(unboxFieldTypes); + + // Index into list with index of field. + + MInstruction* fieldTypesElements = MElements::New(alloc(), unboxFieldTypes); + current->add(fieldTypesElements); + + MConstant* fieldIndexDef = constantInt(fieldIndex); + + MInstruction* fieldType = MLoadElement::New(alloc(), fieldTypesElements, fieldIndexDef, false, false); + current->add(fieldType); + + MInstruction* unboxFieldType = MUnbox::New(alloc(), fieldType, MIRType::Object, MUnbox::Infallible); + current->add(unboxFieldType); + + return unboxFieldType; +} + +bool +IonBuilder::storeScalarTypedObjectValue(MDefinition* typedObj, + const LinearSum& byteOffset, + ScalarTypeDescr::Type type, + MDefinition* value) +{ + // Find location within the owner object. + MDefinition* elements; + MDefinition* scaledOffset; + int32_t adjustment; + uint32_t alignment = ScalarTypeDescr::alignment(type); + loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment); + + // Clamp value to [0, 255] when type is Uint8Clamped + MDefinition* toWrite = value; + if (type == Scalar::Uint8Clamped) { + toWrite = MClampToUint8::New(alloc(), value); + current->add(toWrite->toInstruction()); + } + + MStoreUnboxedScalar* store = + MStoreUnboxedScalar::New(alloc(), elements, scaledOffset, toWrite, + type, MStoreUnboxedScalar::TruncateInput, + DoesNotRequireMemoryBarrier, adjustment); + current->add(store); + + return true; +} + +bool +IonBuilder::storeReferenceTypedObjectValue(MDefinition* typedObj, + const LinearSum& byteOffset, + ReferenceTypeDescr::Type type, + MDefinition* value, + PropertyName* name) +{ + // Make sure we aren't adding new type information for writes of object and value + // references. + if (type != ReferenceTypeDescr::TYPE_STRING) { + MOZ_ASSERT(type == ReferenceTypeDescr::TYPE_ANY || + type == ReferenceTypeDescr::TYPE_OBJECT); + MIRType implicitType = + (type == ReferenceTypeDescr::TYPE_ANY) ? MIRType::Undefined : MIRType::Null; + + if (PropertyWriteNeedsTypeBarrier(alloc(), constraints(), current, &typedObj, name, &value, + /* canModify = */ true, implicitType)) + { + trackOptimizationOutcome(TrackedOutcome::NeedsTypeBarrier); + return false; + } + } + + // Find location within the owner object. + MDefinition* elements; + MDefinition* scaledOffset; + int32_t adjustment; + uint32_t alignment = ReferenceTypeDescr::alignment(type); + loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment); + + MInstruction* store = nullptr; // initialize to silence GCC warning + switch (type) { + case ReferenceTypeDescr::TYPE_ANY: + if (NeedsPostBarrier(value)) + current->add(MPostWriteBarrier::New(alloc(), typedObj, value)); + store = MStoreElement::New(alloc(), elements, scaledOffset, value, false, adjustment); + store->toStoreElement()->setNeedsBarrier(); + break; + case ReferenceTypeDescr::TYPE_OBJECT: + // Note: We cannot necessarily tell at this point whether a post + // barrier is needed, because the type policy may insert ToObjectOrNull + // instructions later, and those may require a post barrier. Therefore, + // defer the insertion of post barriers to the type policy. + store = MStoreUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, value, typedObj, adjustment); + break; + case ReferenceTypeDescr::TYPE_STRING: + // Strings are not nursery allocated, so these writes do not need post + // barriers. + store = MStoreUnboxedString::New(alloc(), elements, scaledOffset, value, adjustment); + break; + } + + current->add(store); + return true; +} + +JSObject* +IonBuilder::checkNurseryObject(JSObject* obj) +{ + // If we try to use any nursery pointers during compilation, make sure that + // the main thread will cancel this compilation before performing a minor + // GC. All constants used during compilation should either go through this + // function or should come from a type set (which has a similar barrier). + if (obj && IsInsideNursery(obj)) { + compartment->runtime()->setMinorGCShouldCancelIonCompilations(); + IonBuilder* builder = this; + while (builder) { + builder->setNotSafeForMinorGC(); + builder = builder->callerBuilder_; + } + } + + return obj; +} + +MConstant* +IonBuilder::constant(const Value& v) +{ + MOZ_ASSERT(!v.isString() || v.toString()->isAtom(), + "Handle non-atomized strings outside IonBuilder."); + + if (v.isObject()) + checkNurseryObject(&v.toObject()); + + MConstant* c = MConstant::New(alloc(), v, constraints()); + current->add(c); + return c; +} + +MConstant* +IonBuilder::constantInt(int32_t i) +{ + return constant(Int32Value(i)); +} + +MInstruction* +IonBuilder::initializedLength(MDefinition* obj, MDefinition* elements, JSValueType unboxedType) +{ + MInstruction* res; + if (unboxedType != JSVAL_TYPE_MAGIC) + res = MUnboxedArrayInitializedLength::New(alloc(), obj); + else + res = MInitializedLength::New(alloc(), elements); + current->add(res); + return res; +} + +MInstruction* +IonBuilder::setInitializedLength(MDefinition* obj, JSValueType unboxedType, size_t count) +{ + MOZ_ASSERT(count); + + MInstruction* res; + if (unboxedType != JSVAL_TYPE_MAGIC) { + res = MSetUnboxedArrayInitializedLength::New(alloc(), obj, constant(Int32Value(count))); + } else { + // MSetInitializedLength takes the index of the last element, rather + // than the count itself. + MInstruction* elements = MElements::New(alloc(), obj, /* unboxed = */ false); + current->add(elements); + res = MSetInitializedLength::New(alloc(), elements, constant(Int32Value(count - 1))); + } + current->add(res); + return res; +} + +MDefinition* +IonBuilder::getCallee() +{ + if (inliningDepth_ == 0) { + MInstruction* callee = MCallee::New(alloc()); + current->add(callee); + return callee; + } + + return inlineCallInfo_->fun(); +} + +MDefinition* +IonBuilder::addLexicalCheck(MDefinition* input) +{ + MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKLEXICAL || + JSOp(*pc) == JSOP_CHECKALIASEDLEXICAL || + JSOp(*pc) == JSOP_GETIMPORT); + + MInstruction* lexicalCheck; + + // If we're guaranteed to not be JS_UNINITIALIZED_LEXICAL, no need to check. + if (input->type() == MIRType::MagicUninitializedLexical) { + // Mark the input as implicitly used so the JS_UNINITIALIZED_LEXICAL + // magic value will be preserved on bailout. + input->setImplicitlyUsedUnchecked(); + lexicalCheck = MThrowRuntimeLexicalError::New(alloc(), JSMSG_UNINITIALIZED_LEXICAL); + current->add(lexicalCheck); + if (!resumeAfter(lexicalCheck)) + return nullptr; + return constant(UndefinedValue()); + } + + if (input->type() == MIRType::Value) { + lexicalCheck = MLexicalCheck::New(alloc(), input); + current->add(lexicalCheck); + if (failedLexicalCheck_) + lexicalCheck->setNotMovableUnchecked(); + return lexicalCheck; + } + + return input; +} + +MDefinition* +IonBuilder::convertToBoolean(MDefinition* input) +{ + // Convert to bool with the '!!' idiom + MNot* resultInverted = MNot::New(alloc(), input, constraints()); + current->add(resultInverted); + MNot* result = MNot::New(alloc(), resultInverted, constraints()); + current->add(result); + + return result; +} + +void +IonBuilder::trace(JSTracer* trc) +{ + if (!compartment->runtime()->runtimeMatches(trc->runtime())) + return; + + MOZ_ASSERT(rootList_); + rootList_->trace(trc); +} |