diff options
Diffstat (limited to 'js/src/jit/IonBuilder.h')
| -rw-r--r-- | js/src/jit/IonBuilder.h | 1533 |
1 files changed, 1533 insertions, 0 deletions
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h new file mode 100644 index 000000000..38647a88f --- /dev/null +++ b/js/src/jit/IonBuilder.h @@ -0,0 +1,1533 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef jit_IonBuilder_h +#define jit_IonBuilder_h + +// This file declares the data structures for building a MIRGraph from a +// JSScript. + +#include "mozilla/LinkedList.h" + +#include "jit/BaselineInspector.h" +#include "jit/BytecodeAnalysis.h" +#include "jit/IonAnalysis.h" +#include "jit/IonOptimizationLevels.h" +#include "jit/MIR.h" +#include "jit/MIRGenerator.h" +#include "jit/MIRGraph.h" +#include "jit/OptimizationTracking.h" + +namespace js { +namespace jit { + +class CodeGenerator; +class CallInfo; +class BaselineFrameInspector; + +enum class InlinableNative : uint16_t; + +// Records information about a baseline frame for compilation that is stable +// when later used off thread. +BaselineFrameInspector* +NewBaselineFrameInspector(TempAllocator* temp, BaselineFrame* frame, CompileInfo* info); + +class IonBuilder + : public MIRGenerator, + public mozilla::LinkedListElement<IonBuilder> +{ + enum ControlStatus { + ControlStatus_Error, + ControlStatus_Abort, + ControlStatus_Ended, // There is no continuation/join point. + ControlStatus_Joined, // Created a join node. + ControlStatus_Jumped, // Parsing another branch at the same level. + ControlStatus_None // No control flow. + }; + + struct DeferredEdge : public TempObject + { + MBasicBlock* block; + DeferredEdge* next; + + DeferredEdge(MBasicBlock* block, DeferredEdge* next) + : block(block), next(next) + { } + }; + + struct ControlFlowInfo { + // Entry in the cfgStack. + uint32_t cfgEntry; + + // Label that continues go to. + jsbytecode* continuepc; + + ControlFlowInfo(uint32_t cfgEntry, jsbytecode* continuepc) + : cfgEntry(cfgEntry), + continuepc(continuepc) + { } + }; + + // To avoid recursion, the bytecode analyzer uses a stack where each entry + // is a small state machine. As we encounter branches or jumps in the + // bytecode, we push information about the edges on the stack so that the + // CFG can be built in a tree-like fashion. + struct CFGState { + enum State { + IF_TRUE, // if() { }, no else. + IF_TRUE_EMPTY_ELSE, // if() { }, empty else + IF_ELSE_TRUE, // if() { X } else { } + IF_ELSE_FALSE, // if() { } else { X } + DO_WHILE_LOOP_BODY, // do { x } while () + DO_WHILE_LOOP_COND, // do { } while (x) + WHILE_LOOP_COND, // while (x) { } + WHILE_LOOP_BODY, // while () { x } + FOR_LOOP_COND, // for (; x;) { } + FOR_LOOP_BODY, // for (; ;) { x } + FOR_LOOP_UPDATE, // for (; ; x) { } + TABLE_SWITCH, // switch() { x } + COND_SWITCH_CASE, // switch() { case X: ... } + COND_SWITCH_BODY, // switch() { case ...: X } + AND_OR, // && x, || x + LABEL, // label: x + TRY // try { x } catch(e) { } + }; + + State state; // Current state of this control structure. + jsbytecode* stopAt; // Bytecode at which to stop the processing loop. + + // For if structures, this contains branch information. + union { + struct { + MBasicBlock* ifFalse; + jsbytecode* falseEnd; + MBasicBlock* ifTrue; // Set when the end of the true path is reached. + MTest* test; + } branch; + struct { + // Common entry point. + MBasicBlock* entry; + + // Whether OSR is being performed for this loop. + bool osr; + + // Position of where the loop body starts and ends. + jsbytecode* bodyStart; + jsbytecode* bodyEnd; + + // pc immediately after the loop exits. + jsbytecode* exitpc; + + // pc for 'continue' jumps. + jsbytecode* continuepc; + + // Common exit point. Created lazily, so it may be nullptr. + MBasicBlock* successor; + + // Deferred break and continue targets. + DeferredEdge* breaks; + DeferredEdge* continues; + + // Initial state, in case loop processing is restarted. + State initialState; + jsbytecode* initialPc; + jsbytecode* initialStopAt; + jsbytecode* loopHead; + + // For-loops only. + jsbytecode* condpc; + jsbytecode* updatepc; + jsbytecode* updateEnd; + } loop; + struct { + // pc immediately after the switch. + jsbytecode* exitpc; + + // Deferred break and continue targets. + DeferredEdge* breaks; + + // MIR instruction + MTableSwitch* ins; + + // The number of current successor that get mapped into a block. + uint32_t currentBlock; + + } tableswitch; + struct { + // Vector of body blocks to process after the cases. + FixedList<MBasicBlock*>* bodies; + + // When processing case statements, this counter points at the + // last uninitialized body. When processing bodies, this + // counter targets the next body to process. + uint32_t currentIdx; + + // Remember the block index of the default case. + jsbytecode* defaultTarget; + uint32_t defaultIdx; + + // Block immediately after the switch. + jsbytecode* exitpc; + DeferredEdge* breaks; + } condswitch; + struct { + DeferredEdge* breaks; + } label; + struct { + MBasicBlock* successor; + } try_; + }; + + inline bool isLoop() const { + switch (state) { + case DO_WHILE_LOOP_COND: + case DO_WHILE_LOOP_BODY: + case WHILE_LOOP_COND: + case WHILE_LOOP_BODY: + case FOR_LOOP_COND: + case FOR_LOOP_BODY: + case FOR_LOOP_UPDATE: + return true; + default: + return false; + } + } + + static CFGState If(jsbytecode* join, MTest* test); + static CFGState IfElse(jsbytecode* trueEnd, jsbytecode* falseEnd, MTest* test); + static CFGState AndOr(jsbytecode* join, MBasicBlock* lhs); + static CFGState TableSwitch(jsbytecode* exitpc, MTableSwitch* ins); + static CFGState CondSwitch(IonBuilder* builder, jsbytecode* exitpc, jsbytecode* defaultTarget); + static CFGState Label(jsbytecode* exitpc); + static CFGState Try(jsbytecode* exitpc, MBasicBlock* successor); + }; + + static int CmpSuccessors(const void* a, const void* b); + + public: + IonBuilder(JSContext* analysisContext, CompileCompartment* comp, + const JitCompileOptions& options, TempAllocator* temp, + MIRGraph* graph, CompilerConstraintList* constraints, + BaselineInspector* inspector, CompileInfo* info, + const OptimizationInfo* optimizationInfo, BaselineFrameInspector* baselineFrame, + size_t inliningDepth = 0, uint32_t loopDepth = 0); + + // Callers of build() and buildInline() should always check whether the + // call overrecursed, if false is returned. Overrecursion is not + // signaled as OOM and will not in general be caught by OOM paths. + MOZ_MUST_USE bool build(); + MOZ_MUST_USE bool buildInline(IonBuilder* callerBuilder, MResumePoint* callerResumePoint, + CallInfo& callInfo); + + private: + MOZ_MUST_USE bool traverseBytecode(); + ControlStatus snoopControlFlow(JSOp op); + MOZ_MUST_USE bool processIterators(); + MOZ_MUST_USE bool inspectOpcode(JSOp op); + uint32_t readIndex(jsbytecode* pc); + JSAtom* readAtom(jsbytecode* pc); + bool abort(const char* message, ...) MOZ_FORMAT_PRINTF(2, 3); + void trackActionableAbort(const char* message); + void spew(const char* message); + + JSFunction* getSingleCallTarget(TemporaryTypeSet* calleeTypes); + MOZ_MUST_USE bool getPolyCallTargets(TemporaryTypeSet* calleeTypes, bool constructing, + ObjectVector& targets, uint32_t maxTargets); + + void popCfgStack(); + DeferredEdge* filterDeadDeferredEdges(DeferredEdge* edge); + MOZ_MUST_USE bool processDeferredContinues(CFGState& state); + ControlStatus processControlEnd(); + ControlStatus processCfgStack(); + ControlStatus processCfgEntry(CFGState& state); + ControlStatus processIfEnd(CFGState& state); + ControlStatus processIfElseTrueEnd(CFGState& state); + ControlStatus processIfElseFalseEnd(CFGState& state); + ControlStatus processDoWhileBodyEnd(CFGState& state); + ControlStatus processDoWhileCondEnd(CFGState& state); + ControlStatus processWhileCondEnd(CFGState& state); + ControlStatus processWhileBodyEnd(CFGState& state); + ControlStatus processForCondEnd(CFGState& state); + ControlStatus processForBodyEnd(CFGState& state); + ControlStatus processForUpdateEnd(CFGState& state); + ControlStatus processNextTableSwitchCase(CFGState& state); + ControlStatus processCondSwitchCase(CFGState& state); + ControlStatus processCondSwitchBody(CFGState& state); + ControlStatus processSwitchBreak(JSOp op); + ControlStatus processSwitchEnd(DeferredEdge* breaks, jsbytecode* exitpc); + ControlStatus processAndOrEnd(CFGState& state); + ControlStatus processLabelEnd(CFGState& state); + ControlStatus processTryEnd(CFGState& state); + ControlStatus processReturn(JSOp op); + ControlStatus processThrow(); + ControlStatus processContinue(JSOp op); + ControlStatus processBreak(JSOp op, jssrcnote* sn); + ControlStatus maybeLoop(JSOp op, jssrcnote* sn); + MOZ_MUST_USE bool pushLoop(CFGState::State state, jsbytecode* stopAt, MBasicBlock* entry, + bool osr, jsbytecode* loopHead, jsbytecode* initialPc, + jsbytecode* bodyStart, jsbytecode* bodyEnd, + jsbytecode* exitpc, jsbytecode* continuepc); + MOZ_MUST_USE bool analyzeNewLoopTypes(MBasicBlock* entry, jsbytecode* start, jsbytecode* end); + + MBasicBlock* addBlock(MBasicBlock* block, uint32_t loopDepth); + MBasicBlock* newBlock(MBasicBlock* predecessor, jsbytecode* pc); + MBasicBlock* newBlock(MBasicBlock* predecessor, jsbytecode* pc, uint32_t loopDepth); + MBasicBlock* newBlock(MBasicBlock* predecessor, jsbytecode* pc, MResumePoint* priorResumePoint); + MBasicBlock* newBlockPopN(MBasicBlock* predecessor, jsbytecode* pc, uint32_t popped); + MBasicBlock* newBlockAfter(MBasicBlock* at, MBasicBlock* predecessor, jsbytecode* pc); + MBasicBlock* newOsrPreheader(MBasicBlock* header, jsbytecode* loopEntry, + jsbytecode* beforeLoopEntry); + MBasicBlock* newPendingLoopHeader(MBasicBlock* predecessor, jsbytecode* pc, bool osr, bool canOsr, + unsigned stackPhiCount); + MBasicBlock* newBlock(jsbytecode* pc) { + return newBlock(nullptr, pc); + } + MBasicBlock* newBlockAfter(MBasicBlock* at, jsbytecode* pc) { + return newBlockAfter(at, nullptr, pc); + } + + // We want to make sure that our MTest instructions all check whether the + // thing being tested might emulate undefined. So we funnel their creation + // through this method, to make sure that happens. We don't want to just do + // the check in MTest::New, because that can run on background compilation + // threads, and we're not sure it's safe to touch that part of the typeset + // from a background thread. + MTest* newTest(MDefinition* ins, MBasicBlock* ifTrue, MBasicBlock* ifFalse); + + // Given a list of pending breaks, creates a new block and inserts a Goto + // linking each break to the new block. + MBasicBlock* createBreakCatchBlock(DeferredEdge* edge, jsbytecode* pc); + + // Finishes loops that do not actually loop, containing only breaks and + // returns or a do while loop with a condition that is constant false. + ControlStatus processBrokenLoop(CFGState& state); + + // Computes loop phis, places them in all successors of a loop, then + // handles any pending breaks. + ControlStatus finishLoop(CFGState& state, MBasicBlock* successor); + + // Incorporates a type/typeSet into an OSR value for a loop, after the loop + // body has been processed. + MOZ_MUST_USE bool addOsrValueTypeBarrier(uint32_t slot, MInstruction** def, + MIRType type, TemporaryTypeSet* typeSet); + MOZ_MUST_USE bool maybeAddOsrTypeBarriers(); + + // Restarts processing of a loop if the type information at its header was + // incomplete. + ControlStatus restartLoop(const CFGState& state); + + void assertValidLoopHeadOp(jsbytecode* pc); + + ControlStatus forLoop(JSOp op, jssrcnote* sn); + ControlStatus whileOrForInLoop(jssrcnote* sn); + ControlStatus doWhileLoop(JSOp op, jssrcnote* sn); + ControlStatus tableSwitch(JSOp op, jssrcnote* sn); + ControlStatus condSwitch(JSOp op, jssrcnote* sn); + + // Please see the Big Honkin' Comment about how resume points work in + // IonBuilder.cpp, near the definition for this function. + MOZ_MUST_USE bool resume(MInstruction* ins, jsbytecode* pc, MResumePoint::Mode mode); + MOZ_MUST_USE bool resumeAt(MInstruction* ins, jsbytecode* pc); + MOZ_MUST_USE bool resumeAfter(MInstruction* ins); + MOZ_MUST_USE bool maybeInsertResume(); + + void insertRecompileCheck(); + + MOZ_MUST_USE bool initParameters(); + void initLocals(); + void rewriteParameter(uint32_t slotIdx, MDefinition* param, int32_t argIndex); + MOZ_MUST_USE bool rewriteParameters(); + MOZ_MUST_USE bool initEnvironmentChain(MDefinition* callee = nullptr); + MOZ_MUST_USE bool initArgumentsObject(); + void pushConstant(const Value& v); + + MConstant* constant(const Value& v); + MConstant* constantInt(int32_t i); + MInstruction* initializedLength(MDefinition* obj, MDefinition* elements, + JSValueType unboxedType); + MInstruction* setInitializedLength(MDefinition* obj, JSValueType unboxedType, size_t count); + + // Improve the type information at tests + MOZ_MUST_USE bool improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test); + MOZ_MUST_USE bool improveTypesAtCompare(MCompare* ins, bool trueBranch, MTest* test); + MOZ_MUST_USE bool improveTypesAtNullOrUndefinedCompare(MCompare* ins, bool trueBranch, + MTest* test); + MOZ_MUST_USE bool improveTypesAtTypeOfCompare(MCompare* ins, bool trueBranch, MTest* test); + + // Used to detect triangular structure at test. + MOZ_MUST_USE bool detectAndOrStructure(MPhi* ins, bool* branchIsTrue); + MOZ_MUST_USE bool replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest* test); + + // Add a guard which ensure that the set of type which goes through this + // generated code correspond to the observed types for the bytecode. + MDefinition* addTypeBarrier(MDefinition* def, TemporaryTypeSet* observed, + BarrierKind kind, MTypeBarrier** pbarrier = nullptr); + MOZ_MUST_USE bool pushTypeBarrier(MDefinition* def, TemporaryTypeSet* observed, + BarrierKind kind); + + // As pushTypeBarrier, but will compute the needBarrier boolean itself based + // on observed and the JSFunction that we're planning to call. The + // JSFunction must be a DOM method or getter. + MOZ_MUST_USE bool pushDOMTypeBarrier(MInstruction* ins, TemporaryTypeSet* observed, + JSFunction* func); + + // If definiteType is not known or def already has the right type, just + // returns def. Otherwise, returns an MInstruction that has that definite + // type, infallibly unboxing ins as needed. The new instruction will be + // added to |current| in this case. + MDefinition* ensureDefiniteType(MDefinition* def, MIRType definiteType); + + // Creates a MDefinition based on the given def improved with type as TypeSet. + MDefinition* ensureDefiniteTypeSet(MDefinition* def, TemporaryTypeSet* types); + + void maybeMarkEmpty(MDefinition* ins); + + JSObject* getSingletonPrototype(JSFunction* target); + + MDefinition* createThisScripted(MDefinition* callee, MDefinition* newTarget); + MDefinition* createThisScriptedSingleton(JSFunction* target, MDefinition* callee); + MDefinition* createThisScriptedBaseline(MDefinition* callee); + MDefinition* createThis(JSFunction* target, MDefinition* callee, MDefinition* newTarget); + MInstruction* createNamedLambdaObject(MDefinition* callee, MDefinition* envObj); + MInstruction* createCallObject(MDefinition* callee, MDefinition* envObj); + + MDefinition* walkEnvironmentChain(unsigned hops); + + MInstruction* addConvertElementsToDoubles(MDefinition* elements); + MDefinition* addMaybeCopyElementsForWrite(MDefinition* object, bool checkNative); + MInstruction* addBoundsCheck(MDefinition* index, MDefinition* length); + MInstruction* addShapeGuard(MDefinition* obj, Shape* const shape, BailoutKind bailoutKind); + MInstruction* addGroupGuard(MDefinition* obj, ObjectGroup* group, BailoutKind bailoutKind); + MInstruction* addUnboxedExpandoGuard(MDefinition* obj, bool hasExpando, BailoutKind bailoutKind); + MInstruction* addSharedTypedArrayGuard(MDefinition* obj); + + MInstruction* + addGuardReceiverPolymorphic(MDefinition* obj, const BaselineInspector::ReceiverVector& receivers); + + MDefinition* convertShiftToMaskForStaticTypedArray(MDefinition* id, + Scalar::Type viewType); + + bool invalidatedIdempotentCache(); + + bool hasStaticEnvironmentObject(EnvironmentCoordinate ec, JSObject** pcall); + MOZ_MUST_USE bool loadSlot(MDefinition* obj, size_t slot, size_t nfixed, MIRType rvalType, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool loadSlot(MDefinition* obj, Shape* shape, MIRType rvalType, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool storeSlot(MDefinition* obj, size_t slot, size_t nfixed, MDefinition* value, + bool needsBarrier, MIRType slotType = MIRType::None); + MOZ_MUST_USE bool storeSlot(MDefinition* obj, Shape* shape, MDefinition* value, + bool needsBarrier, MIRType slotType = MIRType::None); + bool shouldAbortOnPreliminaryGroups(MDefinition *obj); + + MDefinition* tryInnerizeWindow(MDefinition* obj); + MDefinition* maybeUnboxForPropertyAccess(MDefinition* def); + + // jsop_getprop() helpers. + MOZ_MUST_USE bool checkIsDefinitelyOptimizedArguments(MDefinition* obj, bool* isOptimizedArgs); + MOZ_MUST_USE bool getPropTryInferredConstant(bool* emitted, MDefinition* obj, + PropertyName* name, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryArgumentsLength(bool* emitted, MDefinition* obj); + MOZ_MUST_USE bool getPropTryArgumentsCallee(bool* emitted, MDefinition* obj, + PropertyName* name); + MOZ_MUST_USE bool getPropTryConstant(bool* emitted, MDefinition* obj, jsid id, + TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryNotDefined(bool* emitted, MDefinition* obj, jsid id, + TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryDefiniteSlot(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryModuleNamespace(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryUnboxed(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryCommonGetter(bool* emitted, MDefinition* obj, PropertyName* name, + TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryInlineAccess(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryTypedObject(bool* emitted, MDefinition* obj, PropertyName* name); + MOZ_MUST_USE bool getPropTryScalarPropOfTypedObject(bool* emitted, MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldTypeReprs); + MOZ_MUST_USE bool getPropTryReferencePropOfTypedObject(bool* emitted, MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldPrediction, + PropertyName* name); + MOZ_MUST_USE bool getPropTryComplexPropOfTypedObject(bool* emitted, MDefinition* typedObj, + int32_t fieldOffset, + TypedObjectPrediction fieldTypeReprs, + size_t fieldIndex); + MOZ_MUST_USE bool getPropTryInnerize(bool* emitted, MDefinition* obj, PropertyName* name, + TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTryCache(bool* emitted, MDefinition* obj, PropertyName* name, + BarrierKind barrier, TemporaryTypeSet* types); + MOZ_MUST_USE bool getPropTrySharedStub(bool* emitted, MDefinition* obj, + TemporaryTypeSet* types); + + // jsop_setprop() helpers. + MOZ_MUST_USE bool setPropTryCommonSetter(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value); + MOZ_MUST_USE bool setPropTryCommonDOMSetter(bool* emitted, MDefinition* obj, + MDefinition* value, JSFunction* setter, + TemporaryTypeSet* objTypes); + MOZ_MUST_USE bool setPropTryDefiniteSlot(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes); + MOZ_MUST_USE bool setPropTryUnboxed(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes); + MOZ_MUST_USE bool setPropTryInlineAccess(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes); + MOZ_MUST_USE bool setPropTryTypedObject(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value); + MOZ_MUST_USE bool setPropTryReferencePropOfTypedObject(bool* emitted, MDefinition* obj, + int32_t fieldOffset, MDefinition* value, + TypedObjectPrediction fieldPrediction, + PropertyName* name); + MOZ_MUST_USE bool setPropTryScalarPropOfTypedObject(bool* emitted, + MDefinition* obj, + int32_t fieldOffset, + MDefinition* value, + TypedObjectPrediction fieldTypeReprs); + MOZ_MUST_USE bool setPropTryCache(bool* emitted, MDefinition* obj, + PropertyName* name, MDefinition* value, + bool barrier, TemporaryTypeSet* objTypes); + + // jsop_binary_arith helpers. + MBinaryArithInstruction* binaryArithInstruction(JSOp op, MDefinition* left, MDefinition* right); + MOZ_MUST_USE bool binaryArithTryConcat(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool binaryArithTrySpecialized(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool binaryArithTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, + MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool arithTrySharedStub(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + + // jsop_bitnot helpers. + MOZ_MUST_USE bool bitnotTrySpecialized(bool* emitted, MDefinition* input); + + // jsop_pow helpers. + MOZ_MUST_USE bool powTrySpecialized(bool* emitted, MDefinition* base, MDefinition* power, + MIRType outputType); + + // jsop_compare helpers. + MOZ_MUST_USE bool compareTrySpecialized(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool compareTryBitwise(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool compareTrySpecializedOnBaselineInspector(bool* emitted, JSOp op, + MDefinition* left, + MDefinition* right); + MOZ_MUST_USE bool compareTrySharedStub(bool* emitted, JSOp op, MDefinition* left, + MDefinition* right); + + // jsop_newarray helpers. + MOZ_MUST_USE bool newArrayTrySharedStub(bool* emitted); + MOZ_MUST_USE bool newArrayTryTemplateObject(bool* emitted, JSObject* templateObject, + uint32_t length); + MOZ_MUST_USE bool newArrayTryVM(bool* emitted, JSObject* templateObject, uint32_t length); + + // jsop_newobject helpers. + MOZ_MUST_USE bool newObjectTrySharedStub(bool* emitted); + MOZ_MUST_USE bool newObjectTryTemplateObject(bool* emitted, JSObject* templateObject); + MOZ_MUST_USE bool newObjectTryVM(bool* emitted, JSObject* templateObject); + + // jsop_in helpers. + MOZ_MUST_USE bool inTryDense(bool* emitted, MDefinition* obj, MDefinition* id); + MOZ_MUST_USE bool inTryFold(bool* emitted, MDefinition* obj, MDefinition* id); + + // binary data lookup helpers. + TypedObjectPrediction typedObjectPrediction(MDefinition* typedObj); + TypedObjectPrediction typedObjectPrediction(TemporaryTypeSet* types); + MOZ_MUST_USE bool typedObjectHasField(MDefinition* typedObj, + PropertyName* name, + size_t* fieldOffset, + TypedObjectPrediction* fieldTypeReprs, + size_t* fieldIndex); + MDefinition* loadTypedObjectType(MDefinition* value); + void loadTypedObjectData(MDefinition* typedObj, + MDefinition** owner, + LinearSum* ownerOffset); + void loadTypedObjectElements(MDefinition* typedObj, + const LinearSum& byteOffset, + uint32_t scale, + MDefinition** ownerElements, + MDefinition** ownerScaledOffset, + int32_t* ownerByteAdjustment); + MDefinition* typeObjectForElementFromArrayStructType(MDefinition* typedObj); + MDefinition* typeObjectForFieldFromStructType(MDefinition* type, + size_t fieldIndex); + MOZ_MUST_USE bool storeReferenceTypedObjectValue(MDefinition* typedObj, + const LinearSum& byteOffset, + ReferenceTypeDescr::Type type, + MDefinition* value, + PropertyName* name); + MOZ_MUST_USE bool storeScalarTypedObjectValue(MDefinition* typedObj, + const LinearSum& byteOffset, + ScalarTypeDescr::Type type, + MDefinition* value); + MOZ_MUST_USE bool checkTypedObjectIndexInBounds(uint32_t elemSize, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objTypeDescrs, + LinearSum* indexAsByteOffset); + MOZ_MUST_USE bool pushDerivedTypedObject(bool* emitted, + MDefinition* obj, + const LinearSum& byteOffset, + TypedObjectPrediction derivedTypeDescrs, + MDefinition* derivedTypeObj); + MOZ_MUST_USE bool pushScalarLoadFromTypedObject(MDefinition* obj, + const LinearSum& byteoffset, + ScalarTypeDescr::Type type); + MOZ_MUST_USE bool pushReferenceLoadFromTypedObject(MDefinition* typedObj, + const LinearSum& byteOffset, + ReferenceTypeDescr::Type type, + PropertyName* name); + JSObject* getStaticTypedArrayObject(MDefinition* obj, MDefinition* index); + + // jsop_setelem() helpers. + MOZ_MUST_USE bool setElemTryTypedArray(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value); + MOZ_MUST_USE bool setElemTryTypedObject(bool* emitted, MDefinition* obj, + MDefinition* index, MDefinition* value); + MOZ_MUST_USE bool setElemTryTypedStatic(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value); + MOZ_MUST_USE bool setElemTryDense(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value, bool writeHole); + MOZ_MUST_USE bool setElemTryArguments(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value); + MOZ_MUST_USE bool setElemTryCache(bool* emitted, MDefinition* object, + MDefinition* index, MDefinition* value); + MOZ_MUST_USE bool setElemTryReferenceElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + MDefinition* value, + TypedObjectPrediction elemPrediction); + MOZ_MUST_USE bool setElemTryScalarElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objTypeReprs, + MDefinition* value, + TypedObjectPrediction elemTypeReprs, + uint32_t elemSize); + MOZ_MUST_USE bool initializeArrayElement(MDefinition* obj, size_t index, MDefinition* value, + JSValueType unboxedType, + bool addResumePointAndIncrementInitializedLength); + + // jsop_getelem() helpers. + MOZ_MUST_USE bool getElemTryDense(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryGetProp(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryTypedStatic(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryTypedArray(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryTypedObject(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryString(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryArguments(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryArgumentsInlined(bool* emitted, MDefinition* obj, + MDefinition* index); + MOZ_MUST_USE bool getElemTryCache(bool* emitted, MDefinition* obj, MDefinition* index); + MOZ_MUST_USE bool getElemTryScalarElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objTypeReprs, + TypedObjectPrediction elemTypeReprs, + uint32_t elemSize); + MOZ_MUST_USE bool getElemTryReferenceElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objPrediction, + TypedObjectPrediction elemPrediction); + MOZ_MUST_USE bool getElemTryComplexElemOfTypedObject(bool* emitted, + MDefinition* obj, + MDefinition* index, + TypedObjectPrediction objTypeReprs, + TypedObjectPrediction elemTypeReprs, + uint32_t elemSize); + TemporaryTypeSet* computeHeapType(const TemporaryTypeSet* objTypes, const jsid id); + + enum BoundsChecking { DoBoundsCheck, SkipBoundsCheck }; + + MInstruction* addArrayBufferByteLength(MDefinition* obj); + + // Add instructions to compute a typed array's length and data. Also + // optionally convert |*index| into a bounds-checked definition, if + // requested. + // + // If you only need the array's length, use addTypedArrayLength below. + void addTypedArrayLengthAndData(MDefinition* obj, + BoundsChecking checking, + MDefinition** index, + MInstruction** length, MInstruction** elements); + + // Add an instruction to compute a typed array's length to the current + // block. If you also need the typed array's data, use the above method + // instead. + MInstruction* addTypedArrayLength(MDefinition* obj) { + MInstruction* length; + addTypedArrayLengthAndData(obj, SkipBoundsCheck, nullptr, &length, nullptr); + return length; + } + + MOZ_MUST_USE bool improveThisTypesForCall(); + + MDefinition* getCallee(); + MDefinition* getAliasedVar(EnvironmentCoordinate ec); + MDefinition* addLexicalCheck(MDefinition* input); + + MDefinition* convertToBoolean(MDefinition* input); + + MOZ_MUST_USE bool tryFoldInstanceOf(MDefinition* lhs, JSObject* protoObject); + MOZ_MUST_USE bool hasOnProtoChain(TypeSet::ObjectKey* key, JSObject* protoObject, + bool* hasOnProto); + + MOZ_MUST_USE bool jsop_add(MDefinition* left, MDefinition* right); + MOZ_MUST_USE bool jsop_bitnot(); + MOZ_MUST_USE bool jsop_bitop(JSOp op); + MOZ_MUST_USE bool jsop_binary_arith(JSOp op); + MOZ_MUST_USE bool jsop_binary_arith(JSOp op, MDefinition* left, MDefinition* right); + MOZ_MUST_USE bool jsop_pow(); + MOZ_MUST_USE bool jsop_pos(); + MOZ_MUST_USE bool jsop_neg(); + MOZ_MUST_USE bool jsop_tostring(); + MOZ_MUST_USE bool jsop_setarg(uint32_t arg); + MOZ_MUST_USE bool jsop_defvar(uint32_t index); + MOZ_MUST_USE bool jsop_deflexical(uint32_t index); + MOZ_MUST_USE bool jsop_deffun(uint32_t index); + MOZ_MUST_USE bool jsop_notearg(); + MOZ_MUST_USE bool jsop_throwsetconst(); + MOZ_MUST_USE bool jsop_checklexical(); + MOZ_MUST_USE bool jsop_checkaliasedlexical(EnvironmentCoordinate ec); + MOZ_MUST_USE bool jsop_funcall(uint32_t argc); + MOZ_MUST_USE bool jsop_funapply(uint32_t argc); + MOZ_MUST_USE bool jsop_funapplyarguments(uint32_t argc); + MOZ_MUST_USE bool jsop_funapplyarray(uint32_t argc); + MOZ_MUST_USE bool jsop_call(uint32_t argc, bool constructing); + MOZ_MUST_USE bool jsop_eval(uint32_t argc); + MOZ_MUST_USE bool jsop_ifeq(JSOp op); + MOZ_MUST_USE bool jsop_try(); + MOZ_MUST_USE bool jsop_label(); + MOZ_MUST_USE bool jsop_condswitch(); + MOZ_MUST_USE bool jsop_andor(JSOp op); + MOZ_MUST_USE bool jsop_dup2(); + MOZ_MUST_USE bool jsop_loophead(jsbytecode* pc); + MOZ_MUST_USE bool jsop_compare(JSOp op); + MOZ_MUST_USE bool jsop_compare(JSOp op, MDefinition* left, MDefinition* right); + MOZ_MUST_USE bool getStaticName(JSObject* staticObject, PropertyName* name, bool* psucceeded, + MDefinition* lexicalCheck = nullptr); + MOZ_MUST_USE bool loadStaticSlot(JSObject* staticObject, BarrierKind barrier, + TemporaryTypeSet* types, uint32_t slot); + MOZ_MUST_USE bool setStaticName(JSObject* staticObject, PropertyName* name); + MOZ_MUST_USE bool jsop_getgname(PropertyName* name); + MOZ_MUST_USE bool jsop_getname(PropertyName* name); + MOZ_MUST_USE bool jsop_intrinsic(PropertyName* name); + MOZ_MUST_USE bool jsop_getimport(PropertyName* name); + MOZ_MUST_USE bool jsop_bindname(PropertyName* name); + MOZ_MUST_USE bool jsop_bindvar(); + MOZ_MUST_USE bool jsop_getelem(); + MOZ_MUST_USE bool jsop_getelem_dense(MDefinition* obj, MDefinition* index, + JSValueType unboxedType); + MOZ_MUST_USE bool jsop_getelem_typed(MDefinition* obj, MDefinition* index, + ScalarTypeDescr::Type arrayType); + MOZ_MUST_USE bool jsop_setelem(); + MOZ_MUST_USE bool jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion, + MDefinition* object, MDefinition* index, + MDefinition* value, JSValueType unboxedType, + bool writeHole, bool* emitted); + MOZ_MUST_USE bool jsop_setelem_typed(ScalarTypeDescr::Type arrayType, + MDefinition* object, MDefinition* index, + MDefinition* value); + MOZ_MUST_USE bool jsop_length(); + MOZ_MUST_USE bool jsop_length_fastPath(); + MOZ_MUST_USE bool jsop_arguments(); + MOZ_MUST_USE bool jsop_arguments_getelem(); + MOZ_MUST_USE bool jsop_runonce(); + MOZ_MUST_USE bool jsop_rest(); + MOZ_MUST_USE bool jsop_not(); + MOZ_MUST_USE bool jsop_getprop(PropertyName* name); + MOZ_MUST_USE bool jsop_setprop(PropertyName* name); + MOZ_MUST_USE bool jsop_delprop(PropertyName* name); + MOZ_MUST_USE bool jsop_delelem(); + MOZ_MUST_USE bool jsop_newarray(uint32_t length); + MOZ_MUST_USE bool jsop_newarray(JSObject* templateObject, uint32_t length); + MOZ_MUST_USE bool jsop_newarray_copyonwrite(); + MOZ_MUST_USE bool jsop_newobject(); + MOZ_MUST_USE bool jsop_initelem(); + MOZ_MUST_USE bool jsop_initelem_array(); + MOZ_MUST_USE bool jsop_initelem_getter_setter(); + MOZ_MUST_USE bool jsop_mutateproto(); + MOZ_MUST_USE bool jsop_initprop(PropertyName* name); + MOZ_MUST_USE bool jsop_initprop_getter_setter(PropertyName* name); + MOZ_MUST_USE bool jsop_regexp(RegExpObject* reobj); + MOZ_MUST_USE bool jsop_object(JSObject* obj); + MOZ_MUST_USE bool jsop_lambda(JSFunction* fun); + MOZ_MUST_USE bool jsop_lambda_arrow(JSFunction* fun); + MOZ_MUST_USE bool jsop_functionthis(); + MOZ_MUST_USE bool jsop_globalthis(); + MOZ_MUST_USE bool jsop_typeof(); + MOZ_MUST_USE bool jsop_toasync(); + MOZ_MUST_USE bool jsop_toid(); + MOZ_MUST_USE bool jsop_iter(uint8_t flags); + MOZ_MUST_USE bool jsop_itermore(); + MOZ_MUST_USE bool jsop_isnoiter(); + MOZ_MUST_USE bool jsop_iterend(); + MOZ_MUST_USE bool jsop_in(); + MOZ_MUST_USE bool jsop_instanceof(); + MOZ_MUST_USE bool jsop_getaliasedvar(EnvironmentCoordinate ec); + MOZ_MUST_USE bool jsop_setaliasedvar(EnvironmentCoordinate ec); + MOZ_MUST_USE bool jsop_debugger(); + MOZ_MUST_USE bool jsop_newtarget(); + MOZ_MUST_USE bool jsop_checkisobj(uint8_t kind); + MOZ_MUST_USE bool jsop_checkobjcoercible(); + MOZ_MUST_USE bool jsop_pushcallobj(); + + /* Inlining. */ + + enum InliningStatus + { + InliningStatus_Error, + InliningStatus_NotInlined, + InliningStatus_WarmUpCountTooLow, + InliningStatus_Inlined + }; + + enum InliningDecision + { + InliningDecision_Error, + InliningDecision_Inline, + InliningDecision_DontInline, + InliningDecision_WarmUpCountTooLow + }; + + static InliningDecision DontInline(JSScript* targetScript, const char* reason); + + // Helper function for canInlineTarget + bool hasCommonInliningPath(const JSScript* scriptToInline); + + // Oracles. + InliningDecision canInlineTarget(JSFunction* target, CallInfo& callInfo); + InliningDecision makeInliningDecision(JSObject* target, CallInfo& callInfo); + MOZ_MUST_USE bool selectInliningTargets(const ObjectVector& targets, CallInfo& callInfo, + BoolVector& choiceSet, uint32_t* numInlineable); + + // Native inlining helpers. + // The typeset for the return value of our function. These are + // the types it's been observed returning in the past. + TemporaryTypeSet* getInlineReturnTypeSet(); + // The known MIR type of getInlineReturnTypeSet. + MIRType getInlineReturnType(); + + // Array natives. + InliningStatus inlineArray(CallInfo& callInfo); + InliningStatus inlineArrayIsArray(CallInfo& callInfo); + InliningStatus inlineArrayPopShift(CallInfo& callInfo, MArrayPopShift::Mode mode); + InliningStatus inlineArrayPush(CallInfo& callInfo); + InliningStatus inlineArraySlice(CallInfo& callInfo); + InliningStatus inlineArrayJoin(CallInfo& callInfo); + InliningStatus inlineArraySplice(CallInfo& callInfo); + + // Math natives. + InliningStatus inlineMathAbs(CallInfo& callInfo); + InliningStatus inlineMathFloor(CallInfo& callInfo); + InliningStatus inlineMathCeil(CallInfo& callInfo); + InliningStatus inlineMathClz32(CallInfo& callInfo); + InliningStatus inlineMathRound(CallInfo& callInfo); + InliningStatus inlineMathSqrt(CallInfo& callInfo); + InliningStatus inlineMathAtan2(CallInfo& callInfo); + InliningStatus inlineMathHypot(CallInfo& callInfo); + InliningStatus inlineMathMinMax(CallInfo& callInfo, bool max); + InliningStatus inlineMathPow(CallInfo& callInfo); + InliningStatus inlineMathRandom(CallInfo& callInfo); + InliningStatus inlineMathImul(CallInfo& callInfo); + InliningStatus inlineMathFRound(CallInfo& callInfo); + InliningStatus inlineMathFunction(CallInfo& callInfo, MMathFunction::Function function); + + // String natives. + InliningStatus inlineStringObject(CallInfo& callInfo); + InliningStatus inlineStrCharCodeAt(CallInfo& callInfo); + InliningStatus inlineConstantCharCodeAt(CallInfo& callInfo); + InliningStatus inlineStrFromCharCode(CallInfo& callInfo); + InliningStatus inlineStrFromCodePoint(CallInfo& callInfo); + InliningStatus inlineStrCharAt(CallInfo& callInfo); + + // String intrinsics. + InliningStatus inlineStringReplaceString(CallInfo& callInfo); + InliningStatus inlineConstantStringSplitString(CallInfo& callInfo); + InliningStatus inlineStringSplitString(CallInfo& callInfo); + + // RegExp intrinsics. + InliningStatus inlineRegExpMatcher(CallInfo& callInfo); + InliningStatus inlineRegExpSearcher(CallInfo& callInfo); + InliningStatus inlineRegExpTester(CallInfo& callInfo); + InliningStatus inlineIsRegExpObject(CallInfo& callInfo); + InliningStatus inlineRegExpPrototypeOptimizable(CallInfo& callInfo); + InliningStatus inlineRegExpInstanceOptimizable(CallInfo& callInfo); + InliningStatus inlineGetFirstDollarIndex(CallInfo& callInfo); + + // Object natives and intrinsics. + InliningStatus inlineObjectCreate(CallInfo& callInfo); + InliningStatus inlineDefineDataProperty(CallInfo& callInfo); + + // Atomics natives. + InliningStatus inlineAtomicsCompareExchange(CallInfo& callInfo); + InliningStatus inlineAtomicsExchange(CallInfo& callInfo); + InliningStatus inlineAtomicsLoad(CallInfo& callInfo); + InliningStatus inlineAtomicsStore(CallInfo& callInfo); + InliningStatus inlineAtomicsBinop(CallInfo& callInfo, InlinableNative target); + InliningStatus inlineAtomicsIsLockFree(CallInfo& callInfo); + + // Slot intrinsics. + InliningStatus inlineUnsafeSetReservedSlot(CallInfo& callInfo); + InliningStatus inlineUnsafeGetReservedSlot(CallInfo& callInfo, + MIRType knownValueType); + + // Map and Set intrinsics. + InliningStatus inlineGetNextEntryForIterator(CallInfo& callInfo, + MGetNextEntryForIterator::Mode mode); + + // ArrayBuffer intrinsics. + InliningStatus inlineArrayBufferByteLength(CallInfo& callInfo); + InliningStatus inlinePossiblyWrappedArrayBufferByteLength(CallInfo& callInfo); + + // TypedArray intrinsics. + enum WrappingBehavior { AllowWrappedTypedArrays, RejectWrappedTypedArrays }; + InliningStatus inlineTypedArray(CallInfo& callInfo, Native native); + InliningStatus inlineIsTypedArrayHelper(CallInfo& callInfo, WrappingBehavior wrappingBehavior); + InliningStatus inlineIsTypedArray(CallInfo& callInfo); + InliningStatus inlineIsPossiblyWrappedTypedArray(CallInfo& callInfo); + InliningStatus inlineTypedArrayLength(CallInfo& callInfo); + InliningStatus inlinePossiblyWrappedTypedArrayLength(CallInfo& callInfo); + InliningStatus inlineSetDisjointTypedElements(CallInfo& callInfo); + + // TypedObject intrinsics and natives. + InliningStatus inlineObjectIsTypeDescr(CallInfo& callInfo); + InliningStatus inlineSetTypedObjectOffset(CallInfo& callInfo); + InliningStatus inlineConstructTypedObject(CallInfo& callInfo, TypeDescr* target); + + // SIMD intrinsics and natives. + InliningStatus inlineConstructSimdObject(CallInfo& callInfo, SimdTypeDescr* target); + + // SIMD helpers. + bool canInlineSimd(CallInfo& callInfo, JSNative native, unsigned numArgs, + InlineTypedObject** templateObj); + MDefinition* unboxSimd(MDefinition* ins, SimdType type); + IonBuilder::InliningStatus boxSimd(CallInfo& callInfo, MDefinition* ins, + InlineTypedObject* templateObj); + MDefinition* convertToBooleanSimdLane(MDefinition* scalar); + + InliningStatus inlineSimd(CallInfo& callInfo, JSFunction* target, SimdType type); + + InliningStatus inlineSimdBinaryArith(CallInfo& callInfo, JSNative native, + MSimdBinaryArith::Operation op, SimdType type); + InliningStatus inlineSimdBinaryBitwise(CallInfo& callInfo, JSNative native, + MSimdBinaryBitwise::Operation op, SimdType type); + InliningStatus inlineSimdBinarySaturating(CallInfo& callInfo, JSNative native, + MSimdBinarySaturating::Operation op, SimdType type); + InliningStatus inlineSimdShift(CallInfo& callInfo, JSNative native, MSimdShift::Operation op, + SimdType type); + InliningStatus inlineSimdComp(CallInfo& callInfo, JSNative native, + MSimdBinaryComp::Operation op, SimdType type); + InliningStatus inlineSimdUnary(CallInfo& callInfo, JSNative native, + MSimdUnaryArith::Operation op, SimdType type); + InliningStatus inlineSimdExtractLane(CallInfo& callInfo, JSNative native, SimdType type); + InliningStatus inlineSimdReplaceLane(CallInfo& callInfo, JSNative native, SimdType type); + InliningStatus inlineSimdSplat(CallInfo& callInfo, JSNative native, SimdType type); + InliningStatus inlineSimdShuffle(CallInfo& callInfo, JSNative native, SimdType type, + unsigned numVectors); + InliningStatus inlineSimdCheck(CallInfo& callInfo, JSNative native, SimdType type); + InliningStatus inlineSimdConvert(CallInfo& callInfo, JSNative native, bool isCast, + SimdType from, SimdType to); + InliningStatus inlineSimdSelect(CallInfo& callInfo, JSNative native, SimdType type); + + MOZ_MUST_USE bool prepareForSimdLoadStore(CallInfo& callInfo, Scalar::Type simdType, + MInstruction** elements, MDefinition** index, + Scalar::Type* arrayType); + InliningStatus inlineSimdLoad(CallInfo& callInfo, JSNative native, SimdType type, + unsigned numElems); + InliningStatus inlineSimdStore(CallInfo& callInfo, JSNative native, SimdType type, + unsigned numElems); + + InliningStatus inlineSimdAnyAllTrue(CallInfo& callInfo, bool IsAllTrue, JSNative native, + SimdType type); + + // Utility intrinsics. + InliningStatus inlineIsCallable(CallInfo& callInfo); + InliningStatus inlineIsConstructor(CallInfo& callInfo); + InliningStatus inlineIsObject(CallInfo& callInfo); + InliningStatus inlineToObject(CallInfo& callInfo); + InliningStatus inlineIsWrappedArrayConstructor(CallInfo& callInfo); + InliningStatus inlineToInteger(CallInfo& callInfo); + InliningStatus inlineToString(CallInfo& callInfo); + InliningStatus inlineDump(CallInfo& callInfo); + InliningStatus inlineHasClass(CallInfo& callInfo, const Class* clasp, + const Class* clasp2 = nullptr, + const Class* clasp3 = nullptr, + const Class* clasp4 = nullptr); + InliningStatus inlineIsConstructing(CallInfo& callInfo); + InliningStatus inlineSubstringKernel(CallInfo& callInfo); + InliningStatus inlineObjectHasPrototype(CallInfo& callInfo); + + // Testing functions. + InliningStatus inlineBailout(CallInfo& callInfo); + InliningStatus inlineAssertFloat32(CallInfo& callInfo); + InliningStatus inlineAssertRecoveredOnBailout(CallInfo& callInfo); + + // Bind function. + InliningStatus inlineBoundFunction(CallInfo& callInfo, JSFunction* target); + + // Main inlining functions + InliningStatus inlineNativeCall(CallInfo& callInfo, JSFunction* target); + InliningStatus inlineNativeGetter(CallInfo& callInfo, JSFunction* target); + InliningStatus inlineNonFunctionCall(CallInfo& callInfo, JSObject* target); + InliningStatus inlineScriptedCall(CallInfo& callInfo, JSFunction* target); + InliningStatus inlineSingleCall(CallInfo& callInfo, JSObject* target); + + // Call functions + InliningStatus inlineCallsite(const ObjectVector& targets, CallInfo& callInfo); + MOZ_MUST_USE bool inlineCalls(CallInfo& callInfo, const ObjectVector& targets, + BoolVector& choiceSet, MGetPropertyCache* maybeCache); + + // Inlining helpers. + MOZ_MUST_USE bool inlineGenericFallback(JSFunction* target, CallInfo& callInfo, + MBasicBlock* dispatchBlock); + MOZ_MUST_USE bool inlineObjectGroupFallback(CallInfo& callInfo, MBasicBlock* dispatchBlock, + MObjectGroupDispatch* dispatch, + MGetPropertyCache* cache, + MBasicBlock** fallbackTarget); + + enum AtomicCheckResult { + DontCheckAtomicResult, + DoCheckAtomicResult + }; + + MOZ_MUST_USE bool atomicsMeetsPreconditions(CallInfo& callInfo, Scalar::Type* arrayElementType, + bool* requiresDynamicCheck, + AtomicCheckResult checkResult=DoCheckAtomicResult); + void atomicsCheckBounds(CallInfo& callInfo, MInstruction** elements, MDefinition** index); + + MOZ_MUST_USE bool testNeedsArgumentCheck(JSFunction* target, CallInfo& callInfo); + + MCall* makeCallHelper(JSFunction* target, CallInfo& callInfo); + MOZ_MUST_USE bool makeCall(JSFunction* target, CallInfo& callInfo); + + MDefinition* patchInlinedReturn(CallInfo& callInfo, MBasicBlock* exit, MBasicBlock* bottom); + MDefinition* patchInlinedReturns(CallInfo& callInfo, MIRGraphReturns& returns, + MBasicBlock* bottom); + MDefinition* specializeInlinedReturn(MDefinition* rdef, MBasicBlock* exit); + + MOZ_MUST_USE bool objectsHaveCommonPrototype(TemporaryTypeSet* types, PropertyName* name, + bool isGetter, JSObject* foundProto, + bool* guardGlobal); + void freezePropertiesForCommonPrototype(TemporaryTypeSet* types, PropertyName* name, + JSObject* foundProto, bool allowEmptyTypesForGlobal = false); + /* + * Callers must pass a non-null globalGuard if they pass a non-null globalShape. + */ + MOZ_MUST_USE bool testCommonGetterSetter(TemporaryTypeSet* types, PropertyName* name, + bool isGetter, JSObject* foundProto, + Shape* lastProperty, JSFunction* getterOrSetter, + MDefinition** guard, Shape* globalShape = nullptr, + MDefinition** globalGuard = nullptr); + MOZ_MUST_USE bool testShouldDOMCall(TypeSet* inTypes, + JSFunction* func, JSJitInfo::OpType opType); + + MDefinition* + addShapeGuardsForGetterSetter(MDefinition* obj, JSObject* holder, Shape* holderShape, + const BaselineInspector::ReceiverVector& receivers, + const BaselineInspector::ObjectGroupVector& convertUnboxedGroups, + bool isOwnProperty); + + MOZ_MUST_USE bool annotateGetPropertyCache(MDefinition* obj, PropertyName* name, + MGetPropertyCache* getPropCache, + TemporaryTypeSet* objTypes, + TemporaryTypeSet* pushedTypes); + + MGetPropertyCache* getInlineableGetPropertyCache(CallInfo& callInfo); + + JSObject* testGlobalLexicalBinding(PropertyName* name); + + JSObject* testSingletonProperty(JSObject* obj, jsid id); + JSObject* testSingletonPropertyTypes(MDefinition* obj, jsid id); + + ResultWithOOM<bool> testNotDefinedProperty(MDefinition* obj, jsid id); + + uint32_t getDefiniteSlot(TemporaryTypeSet* types, PropertyName* name, uint32_t* pnfixed); + MDefinition* convertUnboxedObjects(MDefinition* obj); + MDefinition* convertUnboxedObjects(MDefinition* obj, + const BaselineInspector::ObjectGroupVector& list); + uint32_t getUnboxedOffset(TemporaryTypeSet* types, PropertyName* name, + JSValueType* punboxedType); + MInstruction* loadUnboxedProperty(MDefinition* obj, size_t offset, JSValueType unboxedType, + BarrierKind barrier, TemporaryTypeSet* types); + MInstruction* loadUnboxedValue(MDefinition* elements, size_t elementsOffset, + MDefinition* scaledOffset, JSValueType unboxedType, + BarrierKind barrier, TemporaryTypeSet* types); + MInstruction* storeUnboxedProperty(MDefinition* obj, size_t offset, JSValueType unboxedType, + MDefinition* value); + MInstruction* storeUnboxedValue(MDefinition* obj, + MDefinition* elements, int32_t elementsOffset, + MDefinition* scaledOffset, JSValueType unboxedType, + MDefinition* value, bool preBarrier = true); + MOZ_MUST_USE bool checkPreliminaryGroups(MDefinition *obj); + MOZ_MUST_USE bool freezePropTypeSets(TemporaryTypeSet* types, + JSObject* foundProto, PropertyName* name); + bool canInlinePropertyOpShapes(const BaselineInspector::ReceiverVector& receivers); + + TemporaryTypeSet* bytecodeTypes(jsbytecode* pc); + + // Use one of the below methods for updating the current block, rather than + // updating |current| directly. setCurrent() should only be used in cases + // where the block cannot have phis whose type needs to be computed. + + MOZ_MUST_USE bool setCurrentAndSpecializePhis(MBasicBlock* block) { + if (block) { + if (!block->specializePhis(alloc())) + return false; + } + setCurrent(block); + return true; + } + + void setCurrent(MBasicBlock* block) { + current = block; + } + + // A builder is inextricably tied to a particular script. + JSScript* script_; + + // script->hasIonScript() at the start of the compilation. Used to avoid + // calling hasIonScript() from background compilation threads. + bool scriptHasIonScript_; + + // If off thread compilation is successful, the final code generator is + // attached here. Code has been generated, but not linked (there is not yet + // an IonScript). This is heap allocated, and must be explicitly destroyed, + // performed by FinishOffThreadBuilder(). + CodeGenerator* backgroundCodegen_; + + // Some aborts are actionable (e.g., using an unsupported bytecode). When + // optimization tracking is enabled, the location and message of the abort + // are recorded here so they may be propagated to the script's + // corresponding JitcodeGlobalEntry::BaselineEntry. + JSScript* actionableAbortScript_; + jsbytecode* actionableAbortPc_; + const char* actionableAbortMessage_; + + MRootList* rootList_; + + public: + void setRootList(MRootList& rootList) { + MOZ_ASSERT(!rootList_); + rootList_ = &rootList; + } + void clearForBackEnd(); + JSObject* checkNurseryObject(JSObject* obj); + + JSScript* script() const { return script_; } + bool scriptHasIonScript() const { return scriptHasIonScript_; } + + CodeGenerator* backgroundCodegen() const { return backgroundCodegen_; } + void setBackgroundCodegen(CodeGenerator* codegen) { backgroundCodegen_ = codegen; } + + CompilerConstraintList* constraints() { + return constraints_; + } + + bool isInlineBuilder() const { + return callerBuilder_ != nullptr; + } + + const JSAtomState& names() { return compartment->runtime()->names(); } + + bool hadActionableAbort() const { + MOZ_ASSERT(!actionableAbortScript_ || + (actionableAbortPc_ && actionableAbortMessage_)); + return actionableAbortScript_ != nullptr; + } + + TraceLoggerThread *traceLogger() { + // Currently ionbuilder only runs on the main thread. + return TraceLoggerForMainThread(compartment->runtime()->mainThread()->runtimeFromMainThread()); + } + + void actionableAbortLocationAndMessage(JSScript** abortScript, jsbytecode** abortPc, + const char** abortMessage) + { + MOZ_ASSERT(hadActionableAbort()); + *abortScript = actionableAbortScript_; + *abortPc = actionableAbortPc_; + *abortMessage = actionableAbortMessage_; + } + + void trace(JSTracer* trc); + + private: + MOZ_MUST_USE bool init(); + + JSContext* analysisContext; + BaselineFrameInspector* baselineFrame_; + + // Constraints for recording dependencies on type information. + CompilerConstraintList* constraints_; + + // Basic analysis information about the script. + BytecodeAnalysis analysis_; + BytecodeAnalysis& analysis() { + return analysis_; + } + + TemporaryTypeSet* thisTypes; + TemporaryTypeSet* argTypes; + TemporaryTypeSet* typeArray; + uint32_t typeArrayHint; + uint32_t* bytecodeTypeMap; + + GSNCache gsn; + EnvironmentCoordinateNameCache envCoordinateNameCache; + + jsbytecode* pc; + MBasicBlock* current; + uint32_t loopDepth_; + + Vector<BytecodeSite*, 0, JitAllocPolicy> trackedOptimizationSites_; + + BytecodeSite* bytecodeSite(jsbytecode* pc) { + MOZ_ASSERT(info().inlineScriptTree()->script()->containsPC(pc)); + // See comment in maybeTrackedOptimizationSite. + if (isOptimizationTrackingEnabled()) { + if (BytecodeSite* site = maybeTrackedOptimizationSite(pc)) + return site; + } + return new(alloc()) BytecodeSite(info().inlineScriptTree(), pc); + } + + BytecodeSite* maybeTrackedOptimizationSite(jsbytecode* pc); + + MDefinition* lexicalCheck_; + + void setLexicalCheck(MDefinition* lexical) { + MOZ_ASSERT(!lexicalCheck_); + lexicalCheck_ = lexical; + } + MDefinition* takeLexicalCheck() { + MDefinition* lexical = lexicalCheck_; + lexicalCheck_ = nullptr; + return lexical; + } + + /* Information used for inline-call builders. */ + MResumePoint* callerResumePoint_; + jsbytecode* callerPC() { + return callerResumePoint_ ? callerResumePoint_->pc() : nullptr; + } + IonBuilder* callerBuilder_; + + IonBuilder* outermostBuilder(); + + struct LoopHeader { + jsbytecode* pc; + MBasicBlock* header; + + LoopHeader(jsbytecode* pc, MBasicBlock* header) + : pc(pc), header(header) + {} + }; + + Vector<CFGState, 8, JitAllocPolicy> cfgStack_; + Vector<ControlFlowInfo, 4, JitAllocPolicy> loops_; + Vector<ControlFlowInfo, 0, JitAllocPolicy> switches_; + Vector<ControlFlowInfo, 2, JitAllocPolicy> labels_; + Vector<MInstruction*, 2, JitAllocPolicy> iterators_; + Vector<LoopHeader, 0, JitAllocPolicy> loopHeaders_; + BaselineInspector* inspector; + + size_t inliningDepth_; + + // Total bytecode length of all inlined scripts. Only tracked for the + // outermost builder. + size_t inlinedBytecodeLength_; + + // Cutoff to disable compilation if excessive time is spent reanalyzing + // loop bodies to compute a fixpoint of the types for loop variables. + static const size_t MAX_LOOP_RESTARTS = 40; + size_t numLoopRestarts_; + + // True if script->failedBoundsCheck is set for the current script or + // an outer script. + bool failedBoundsCheck_; + + // True if script->failedShapeGuard is set for the current script or + // an outer script. + bool failedShapeGuard_; + + // True if script->failedLexicalCheck_ is set for the current script or + // an outer script. + bool failedLexicalCheck_; + + // Has an iterator other than 'for in'. + bool nonStringIteration_; + + // If this script can use a lazy arguments object, it will be pre-created + // here. + MInstruction* lazyArguments_; + + // If this is an inline builder, the call info for the builder. + const CallInfo* inlineCallInfo_; + + // When compiling a call with multiple targets, we are first creating a + // MGetPropertyCache. This MGetPropertyCache is following the bytecode, and + // is used to recover the JSFunction. In some cases, the Type of the object + // which own the property is enough for dispatching to the right function. + // In such cases we do not have read the property, except when the type + // object is unknown. + // + // As an optimization, we can dispatch a call based on the object group, + // without doing the MGetPropertyCache. This is what is achieved by + // |IonBuilder::inlineCalls|. As we might not know all the functions, we + // are adding a fallback path, where this MGetPropertyCache would be moved + // into. + // + // In order to build the fallback path, we have to capture a resume point + // ahead, for the potential fallback path. This resume point is captured + // while building MGetPropertyCache. It is capturing the state of Baseline + // before the execution of the MGetPropertyCache, such as we can safely do + // it in the fallback path. + // + // This field is used to discard the resume point if it is not used for + // building a fallback path. + + // Discard the prior resume point while setting a new MGetPropertyCache. + void replaceMaybeFallbackFunctionGetter(MGetPropertyCache* cache); + + // Discard the MGetPropertyCache if it is handled by WrapMGetPropertyCache. + void keepFallbackFunctionGetter(MGetPropertyCache* cache) { + if (cache == maybeFallbackFunctionGetter_) + maybeFallbackFunctionGetter_ = nullptr; + } + + MGetPropertyCache* maybeFallbackFunctionGetter_; + + // Used in tracking outcomes of optimization strategies for devtools. + void startTrackingOptimizations(); + + // The track* methods below are called often. Do not combine them with the + // unchecked variants, despite the unchecked variants having no other + // callers. + void trackTypeInfo(JS::TrackedTypeSite site, MIRType mirType, + TemporaryTypeSet* typeSet) + { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackTypeInfoUnchecked(site, mirType, typeSet); + } + void trackTypeInfo(JS::TrackedTypeSite site, JSObject* obj) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackTypeInfoUnchecked(site, obj); + } + void trackTypeInfo(CallInfo& callInfo) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackTypeInfoUnchecked(callInfo); + } + void trackOptimizationAttempt(JS::TrackedStrategy strategy) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackOptimizationAttemptUnchecked(strategy); + } + void amendOptimizationAttempt(uint32_t index) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + amendOptimizationAttemptUnchecked(index); + } + void trackOptimizationOutcome(JS::TrackedOutcome outcome) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackOptimizationOutcomeUnchecked(outcome); + } + void trackOptimizationSuccess() { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackOptimizationSuccessUnchecked(); + } + void trackInlineSuccess(InliningStatus status = InliningStatus_Inlined) { + if (MOZ_UNLIKELY(current->trackedSite()->hasOptimizations())) + trackInlineSuccessUnchecked(status); + } + + bool forceInlineCaches() { + return MOZ_UNLIKELY(JitOptions.forceInlineCaches); + } + + // Out-of-line variants that don't check if optimization tracking is + // enabled. + void trackTypeInfoUnchecked(JS::TrackedTypeSite site, MIRType mirType, + TemporaryTypeSet* typeSet); + void trackTypeInfoUnchecked(JS::TrackedTypeSite site, JSObject* obj); + void trackTypeInfoUnchecked(CallInfo& callInfo); + void trackOptimizationAttemptUnchecked(JS::TrackedStrategy strategy); + void amendOptimizationAttemptUnchecked(uint32_t index); + void trackOptimizationOutcomeUnchecked(JS::TrackedOutcome outcome); + void trackOptimizationSuccessUnchecked(); + void trackInlineSuccessUnchecked(InliningStatus status); +}; + +class CallInfo +{ + MDefinition* fun_; + MDefinition* thisArg_; + MDefinition* newTargetArg_; + MDefinitionVector args_; + + bool constructing_; + bool setter_; + + public: + CallInfo(TempAllocator& alloc, bool constructing) + : fun_(nullptr), + thisArg_(nullptr), + newTargetArg_(nullptr), + args_(alloc), + constructing_(constructing), + setter_(false) + { } + + MOZ_MUST_USE bool init(CallInfo& callInfo) { + MOZ_ASSERT(constructing_ == callInfo.constructing()); + + fun_ = callInfo.fun(); + thisArg_ = callInfo.thisArg(); + + if (constructing()) + newTargetArg_ = callInfo.getNewTarget(); + + if (!args_.appendAll(callInfo.argv())) + return false; + + return true; + } + + MOZ_MUST_USE bool init(MBasicBlock* current, uint32_t argc) { + MOZ_ASSERT(args_.empty()); + + // Get the arguments in the right order + if (!args_.reserve(argc)) + return false; + + if (constructing()) + setNewTarget(current->pop()); + + for (int32_t i = argc; i > 0; i--) + args_.infallibleAppend(current->peek(-i)); + current->popn(argc); + + // Get |this| and |fun| + setThis(current->pop()); + setFun(current->pop()); + + return true; + } + + void popFormals(MBasicBlock* current) { + current->popn(numFormals()); + } + + void pushFormals(MBasicBlock* current) { + current->push(fun()); + current->push(thisArg()); + + for (uint32_t i = 0; i < argc(); i++) + current->push(getArg(i)); + + if (constructing()) + current->push(getNewTarget()); + } + + uint32_t argc() const { + return args_.length(); + } + uint32_t numFormals() const { + return argc() + 2 + constructing(); + } + + MOZ_MUST_USE bool setArgs(const MDefinitionVector& args) { + MOZ_ASSERT(args_.empty()); + return args_.appendAll(args); + } + + MDefinitionVector& argv() { + return args_; + } + + const MDefinitionVector& argv() const { + return args_; + } + + MDefinition* getArg(uint32_t i) const { + MOZ_ASSERT(i < argc()); + return args_[i]; + } + + MDefinition* getArgWithDefault(uint32_t i, MDefinition* defaultValue) const { + if (i < argc()) + return args_[i]; + + return defaultValue; + } + + void setArg(uint32_t i, MDefinition* def) { + MOZ_ASSERT(i < argc()); + args_[i] = def; + } + + MDefinition* thisArg() const { + MOZ_ASSERT(thisArg_); + return thisArg_; + } + + void setThis(MDefinition* thisArg) { + thisArg_ = thisArg; + } + + bool constructing() const { + return constructing_; + } + + void setNewTarget(MDefinition* newTarget) { + MOZ_ASSERT(constructing()); + newTargetArg_ = newTarget; + } + MDefinition* getNewTarget() const { + MOZ_ASSERT(newTargetArg_); + return newTargetArg_; + } + + bool isSetter() const { + return setter_; + } + void markAsSetter() { + setter_ = true; + } + + MDefinition* fun() const { + MOZ_ASSERT(fun_); + return fun_; + } + + void setFun(MDefinition* fun) { + fun_ = fun; + } + + void setImplicitlyUsedUnchecked() { + fun_->setImplicitlyUsedUnchecked(); + thisArg_->setImplicitlyUsedUnchecked(); + if (newTargetArg_) + newTargetArg_->setImplicitlyUsedUnchecked(); + for (uint32_t i = 0; i < argc(); i++) + getArg(i)->setImplicitlyUsedUnchecked(); + } +}; + +bool NeedsPostBarrier(MDefinition* value); + +} // namespace jit +} // namespace js + +#endif /* jit_IonBuilder_h */ |