diff options
Diffstat (limited to 'js/src/jit/MIR.h')
| -rw-r--r-- | js/src/jit/MIR.h | 14267 |
1 files changed, 14267 insertions, 0 deletions
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h new file mode 100644 index 000000000..dcb08c317 --- /dev/null +++ b/js/src/jit/MIR.h @@ -0,0 +1,14267 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- + * vim: set ts=8 sts=4 et sw=4 tw=99: + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * Everything needed to build actual MIR instructions: the actual opcodes and + * instructions, the instruction interface, and use chains. + */ + +#ifndef jit_MIR_h +#define jit_MIR_h + +#include "mozilla/Array.h" +#include "mozilla/Attributes.h" +#include "mozilla/MacroForEach.h" + +#include "builtin/SIMD.h" +#include "jit/AtomicOp.h" +#include "jit/BaselineIC.h" +#include "jit/FixedList.h" +#include "jit/InlineList.h" +#include "jit/JitAllocPolicy.h" +#include "jit/MacroAssembler.h" +#include "jit/MOpcodes.h" +#include "jit/TypedObjectPrediction.h" +#include "jit/TypePolicy.h" +#include "vm/ArrayObject.h" +#include "vm/EnvironmentObject.h" +#include "vm/SharedMem.h" +#include "vm/TypedArrayCommon.h" +#include "vm/UnboxedObject.h" + +// Undo windows.h damage on Win64 +#undef MemoryBarrier + +namespace js { + +class StringObject; + +namespace jit { + +class BaselineInspector; +class Range; + +template <typename T> +struct ResultWithOOM { + T value; + bool oom; + + static ResultWithOOM<T> ok(T val) { + return { val, false }; + } + static ResultWithOOM<T> fail() { + return { T(), true }; + } +}; + +static inline +MIRType MIRTypeFromValue(const js::Value& vp) +{ + if (vp.isDouble()) + return MIRType::Double; + if (vp.isMagic()) { + switch (vp.whyMagic()) { + case JS_OPTIMIZED_ARGUMENTS: + return MIRType::MagicOptimizedArguments; + case JS_OPTIMIZED_OUT: + return MIRType::MagicOptimizedOut; + case JS_ELEMENTS_HOLE: + return MIRType::MagicHole; + case JS_IS_CONSTRUCTING: + return MIRType::MagicIsConstructing; + case JS_UNINITIALIZED_LEXICAL: + return MIRType::MagicUninitializedLexical; + default: + MOZ_ASSERT_UNREACHABLE("Unexpected magic constant"); + } + } + return MIRTypeFromValueType(vp.extractNonDoubleType()); +} + +// If simdType is one of the SIMD types suported by Ion, set mirType to the +// corresponding MIRType, and return true. +// +// If simdType is not suported by Ion, return false. +static inline MOZ_MUST_USE +bool MaybeSimdTypeToMIRType(SimdType type, MIRType* mirType) +{ + switch (type) { + case SimdType::Uint32x4: + case SimdType::Int32x4: *mirType = MIRType::Int32x4; return true; + case SimdType::Uint16x8: + case SimdType::Int16x8: *mirType = MIRType::Int16x8; return true; + case SimdType::Uint8x16: + case SimdType::Int8x16: *mirType = MIRType::Int8x16; return true; + case SimdType::Float32x4: *mirType = MIRType::Float32x4; return true; + case SimdType::Bool32x4: *mirType = MIRType::Bool32x4; return true; + case SimdType::Bool16x8: *mirType = MIRType::Bool16x8; return true; + case SimdType::Bool8x16: *mirType = MIRType::Bool8x16; return true; + default: return false; + } +} + +// Convert a SimdType to the corresponding MIRType, or crash. +// +// Note that this is not an injective mapping: SimdType has signed and unsigned +// integer types that map to the same MIRType. +static inline +MIRType SimdTypeToMIRType(SimdType type) +{ + MIRType ret = MIRType::None; + JS_ALWAYS_TRUE(MaybeSimdTypeToMIRType(type, &ret)); + return ret; +} + +static inline +SimdType MIRTypeToSimdType(MIRType type) +{ + switch (type) { + case MIRType::Int32x4: return SimdType::Int32x4; + case MIRType::Int16x8: return SimdType::Int16x8; + case MIRType::Int8x16: return SimdType::Int8x16; + case MIRType::Float32x4: return SimdType::Float32x4; + case MIRType::Bool32x4: return SimdType::Bool32x4; + case MIRType::Bool16x8: return SimdType::Bool16x8; + case MIRType::Bool8x16: return SimdType::Bool8x16; + default: break; + } + MOZ_CRASH("unhandled MIRType"); +} + +// Get the boolean MIRType with the same shape as type. +static inline +MIRType MIRTypeToBooleanSimdType(MIRType type) +{ + return SimdTypeToMIRType(GetBooleanSimdType(MIRTypeToSimdType(type))); +} + +#define MIR_FLAG_LIST(_) \ + _(InWorklist) \ + _(EmittedAtUses) \ + _(Commutative) \ + _(Movable) /* Allow passes like LICM to move this instruction */ \ + _(Lowered) /* (Debug only) has a virtual register */ \ + _(Guard) /* Not removable if uses == 0 */ \ + \ + /* Flag an instruction to be considered as a Guard if the instructions + * bails out on some inputs. + * + * Some optimizations can replace an instruction, and leave its operands + * unused. When the type information of the operand got used as a + * predicate of the transformation, then we have to flag the operands as + * GuardRangeBailouts. + * + * This flag prevents further optimization of instructions, which + * might remove the run-time checks (bailout conditions) used as a + * predicate of the previous transformation. + */ \ + _(GuardRangeBailouts) \ + \ + /* Keep the flagged instruction in resume points and do not substitute this + * instruction by an UndefinedValue. This might be used by call inlining + * when a function argument is not used by the inlined instructions. + */ \ + _(ImplicitlyUsed) \ + \ + /* The instruction has been marked dead for lazy removal from resume + * points. + */ \ + _(Unused) \ + \ + /* When a branch is removed, the uses of multiple instructions are removed. + * The removal of branches is based on hypotheses. These hypotheses might + * fail, in which case we need to bailout from the current code. + * + * When we implement a destructive optimization, we need to consider the + * failing cases, and consider the fact that we might resume the execution + * into a branch which was removed from the compiler. As such, a + * destructive optimization need to take into acount removed branches. + * + * In order to let destructive optimizations know about removed branches, we + * have to annotate instructions with the UseRemoved flag. This flag + * annotates instruction which were used in removed branches. + */ \ + _(UseRemoved) \ + \ + /* Marks if the current instruction should go to the bailout paths instead + * of producing code as part of the control flow. This flag can only be set + * on instructions which are only used by ResumePoint or by other flagged + * instructions. + */ \ + _(RecoveredOnBailout) \ + \ + /* Some instructions might represent an object, but the memory of these + * objects might be incomplete if we have not recovered all the stores which + * were supposed to happen before. This flag is used to annotate + * instructions which might return a pointer to a memory area which is not + * yet fully initialized. This flag is used to ensure that stores are + * executed before returning the value. + */ \ + _(IncompleteObject) \ + \ + /* The current instruction got discarded from the MIR Graph. This is useful + * when we want to iterate over resume points and instructions, while + * handling instructions which are discarded without reporting to the + * iterator. + */ \ + _(Discarded) + +class MDefinition; +class MInstruction; +class MBasicBlock; +class MNode; +class MUse; +class MPhi; +class MIRGraph; +class MResumePoint; +class MControlInstruction; + +// Represents a use of a node. +class MUse : public TempObject, public InlineListNode<MUse> +{ + // Grant access to setProducerUnchecked. + friend class MDefinition; + friend class MPhi; + + MDefinition* producer_; // MDefinition that is being used. + MNode* consumer_; // The node that is using this operand. + + // Low-level unchecked edit method for replaceAllUsesWith and + // MPhi::removeOperand. This doesn't update use lists! + // replaceAllUsesWith and MPhi::removeOperand do that manually. + void setProducerUnchecked(MDefinition* producer) { + MOZ_ASSERT(consumer_); + MOZ_ASSERT(producer_); + MOZ_ASSERT(producer); + producer_ = producer; + } + + public: + // Default constructor for use in vectors. + MUse() + : producer_(nullptr), consumer_(nullptr) + { } + + // Move constructor for use in vectors. When an MUse is moved, it stays + // in its containing use list. + MUse(MUse&& other) + : InlineListNode<MUse>(mozilla::Move(other)), + producer_(other.producer_), consumer_(other.consumer_) + { } + + // Construct an MUse initialized with |producer| and |consumer|. + MUse(MDefinition* producer, MNode* consumer) + { + initUnchecked(producer, consumer); + } + + // Set this use, which was previously clear. + inline void init(MDefinition* producer, MNode* consumer); + // Like init, but works even when the use contains uninitialized data. + inline void initUnchecked(MDefinition* producer, MNode* consumer); + // Like initUnchecked, but set the producer to nullptr. + inline void initUncheckedWithoutProducer(MNode* consumer); + // Set this use, which was not previously clear. + inline void replaceProducer(MDefinition* producer); + // Clear this use. + inline void releaseProducer(); + + MDefinition* producer() const { + MOZ_ASSERT(producer_ != nullptr); + return producer_; + } + bool hasProducer() const { + return producer_ != nullptr; + } + MNode* consumer() const { + MOZ_ASSERT(consumer_ != nullptr); + return consumer_; + } + +#ifdef DEBUG + // Return the operand index of this MUse in its consumer. This is DEBUG-only + // as normal code should instead to call indexOf on the casted consumer + // directly, to allow it to be devirtualized and inlined. + size_t index() const; +#endif +}; + +typedef InlineList<MUse>::iterator MUseIterator; + +// A node is an entry in the MIR graph. It has two kinds: +// MInstruction: an instruction which appears in the IR stream. +// MResumePoint: a list of instructions that correspond to the state of the +// interpreter/Baseline stack. +// +// Nodes can hold references to MDefinitions. Each MDefinition has a list of +// nodes holding such a reference (its use chain). +class MNode : public TempObject +{ + protected: + MBasicBlock* block_; // Containing basic block. + + public: + enum Kind { + Definition, + ResumePoint + }; + + MNode() + : block_(nullptr) + { } + + explicit MNode(MBasicBlock* block) + : block_(block) + { } + + virtual Kind kind() const = 0; + + // Returns the definition at a given operand. + virtual MDefinition* getOperand(size_t index) const = 0; + virtual size_t numOperands() const = 0; + virtual size_t indexOf(const MUse* u) const = 0; + + bool isDefinition() const { + return kind() == Definition; + } + bool isResumePoint() const { + return kind() == ResumePoint; + } + MBasicBlock* block() const { + return block_; + } + MBasicBlock* caller() const; + + // Sets an already set operand, updating use information. If you're looking + // for setOperand, this is probably what you want. + virtual void replaceOperand(size_t index, MDefinition* operand) = 0; + + // Resets the operand to an uninitialized state, breaking the link + // with the previous operand's producer. + void releaseOperand(size_t index) { + getUseFor(index)->releaseProducer(); + } + bool hasOperand(size_t index) const { + return getUseFor(index)->hasProducer(); + } + + inline MDefinition* toDefinition(); + inline MResumePoint* toResumePoint(); + + virtual MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const; + + virtual void dump(GenericPrinter& out) const = 0; + virtual void dump() const = 0; + + protected: + // Need visibility on getUseFor to avoid O(n^2) complexity. + friend void AssertBasicGraphCoherency(MIRGraph& graph); + + // Gets the MUse corresponding to given operand. + virtual MUse* getUseFor(size_t index) = 0; + virtual const MUse* getUseFor(size_t index) const = 0; +}; + +class AliasSet { + private: + uint32_t flags_; + + public: + enum Flag { + None_ = 0, + ObjectFields = 1 << 0, // shape, class, slots, length etc. + Element = 1 << 1, // A Value member of obj->elements or + // a typed object. + UnboxedElement = 1 << 2, // An unboxed scalar or reference member of + // a typed array, typed object, or unboxed + // object. + DynamicSlot = 1 << 3, // A Value member of obj->slots. + FixedSlot = 1 << 4, // A Value member of obj->fixedSlots(). + DOMProperty = 1 << 5, // A DOM property + FrameArgument = 1 << 6, // An argument kept on the stack frame + WasmGlobalVar = 1 << 7, // An asm.js/wasm global var + WasmHeap = 1 << 8, // An asm.js/wasm heap load + TypedArrayLength = 1 << 9,// A typed array's length + Last = TypedArrayLength, + Any = Last | (Last - 1), + + NumCategories = 10, + + // Indicates load or store. + Store_ = 1 << 31 + }; + + static_assert((1 << NumCategories) - 1 == Any, + "NumCategories must include all flags present in Any"); + + explicit AliasSet(uint32_t flags) + : flags_(flags) + { + } + + public: + static const char* Name(size_t flag); + + inline bool isNone() const { + return flags_ == None_; + } + uint32_t flags() const { + return flags_ & Any; + } + inline bool isStore() const { + return !!(flags_ & Store_); + } + inline bool isLoad() const { + return !isStore() && !isNone(); + } + inline AliasSet operator |(const AliasSet& other) const { + return AliasSet(flags_ | other.flags_); + } + inline AliasSet operator&(const AliasSet& other) const { + return AliasSet(flags_ & other.flags_); + } + static AliasSet None() { + return AliasSet(None_); + } + static AliasSet Load(uint32_t flags) { + MOZ_ASSERT(flags && !(flags & Store_)); + return AliasSet(flags); + } + static AliasSet Store(uint32_t flags) { + MOZ_ASSERT(flags && !(flags & Store_)); + return AliasSet(flags | Store_); + } + static uint32_t BoxedOrUnboxedElements(JSValueType type) { + return (type == JSVAL_TYPE_MAGIC) ? Element : UnboxedElement; + } +}; + +typedef Vector<MDefinition*, 6, JitAllocPolicy> MDefinitionVector; +typedef Vector<MInstruction*, 6, JitAllocPolicy> MInstructionVector; +typedef Vector<MDefinition*, 1, JitAllocPolicy> MStoreVector; + +class StoreDependency : public TempObject +{ + MStoreVector all_; + + public: + explicit StoreDependency(TempAllocator& alloc) + : all_(alloc) + { } + + MOZ_MUST_USE bool init(MDefinitionVector& all) { + if (!all_.appendAll(all)) + return false; + return true; + } + + MStoreVector& get() { + return all_; + } +}; + +// An MDefinition is an SSA name. +class MDefinition : public MNode +{ + friend class MBasicBlock; + + public: + enum Opcode { +# define DEFINE_OPCODES(op) Op_##op, + MIR_OPCODE_LIST(DEFINE_OPCODES) +# undef DEFINE_OPCODES + Op_Invalid + }; + + private: + InlineList<MUse> uses_; // Use chain. + uint32_t id_; // Instruction ID, which after block re-ordering + // is sorted within a basic block. + uint32_t flags_; // Bit flags. + Range* range_; // Any computed range for this def. + MIRType resultType_; // Representation of result type. + TemporaryTypeSet* resultTypeSet_; // Optional refinement of the result type. + union { + MDefinition* loadDependency_; // Implicit dependency (store, call, etc.) of this + StoreDependency* storeDependency_; // instruction. Used by alias analysis, GVN and LICM. + uint32_t virtualRegister_; // Used by lowering to map definitions to virtual registers. + }; + + // Track bailouts by storing the current pc in MIR instruction. Also used + // for profiling and keeping track of what the last known pc was. + const BytecodeSite* trackedSite_; + + private: + enum Flag { + None = 0, +# define DEFINE_FLAG(flag) flag, + MIR_FLAG_LIST(DEFINE_FLAG) +# undef DEFINE_FLAG + Total + }; + + bool hasFlags(uint32_t flags) const { + return (flags_ & flags) == flags; + } + void removeFlags(uint32_t flags) { + flags_ &= ~flags; + } + void setFlags(uint32_t flags) { + flags_ |= flags; + } + + protected: + virtual void setBlock(MBasicBlock* block) { + block_ = block; + } + + static HashNumber addU32ToHash(HashNumber hash, uint32_t data); + + public: + MDefinition() + : id_(0), + flags_(0), + range_(nullptr), + resultType_(MIRType::None), + resultTypeSet_(nullptr), + loadDependency_(nullptr), + trackedSite_(nullptr) + { } + + // Copying a definition leaves the list of uses and the block empty. + explicit MDefinition(const MDefinition& other) + : id_(0), + flags_(other.flags_), + range_(other.range_), + resultType_(other.resultType_), + resultTypeSet_(other.resultTypeSet_), + loadDependency_(other.loadDependency_), + trackedSite_(other.trackedSite_) + { } + + virtual Opcode op() const = 0; + virtual const char* opName() const = 0; + virtual void accept(MDefinitionVisitor* visitor) = 0; + + void printName(GenericPrinter& out) const; + static void PrintOpcodeName(GenericPrinter& out, Opcode op); + virtual void printOpcode(GenericPrinter& out) const; + void dump(GenericPrinter& out) const override; + void dump() const override; + void dumpLocation(GenericPrinter& out) const; + void dumpLocation() const; + + // For LICM. + virtual bool neverHoist() const { return false; } + + // Also for LICM. Test whether this definition is likely to be a call, which + // would clobber all or many of the floating-point registers, such that + // hoisting floating-point constants out of containing loops isn't likely to + // be worthwhile. + virtual bool possiblyCalls() const { return false; } + + void setTrackedSite(const BytecodeSite* site) { + MOZ_ASSERT(site); + trackedSite_ = site; + } + const BytecodeSite* trackedSite() const { + return trackedSite_; + } + jsbytecode* trackedPc() const { + return trackedSite_ ? trackedSite_->pc() : nullptr; + } + InlineScriptTree* trackedTree() const { + return trackedSite_ ? trackedSite_->tree() : nullptr; + } + TrackedOptimizations* trackedOptimizations() const { + return trackedSite_ && trackedSite_->hasOptimizations() + ? trackedSite_->optimizations() + : nullptr; + } + + JSScript* profilerLeaveScript() const { + return trackedTree()->outermostCaller()->script(); + } + + jsbytecode* profilerLeavePc() const { + // If this is in a top-level function, use the pc directly. + if (trackedTree()->isOutermostCaller()) + return trackedPc(); + + // Walk up the InlineScriptTree chain to find the top-most callPC + InlineScriptTree* curTree = trackedTree(); + InlineScriptTree* callerTree = curTree->caller(); + while (!callerTree->isOutermostCaller()) { + curTree = callerTree; + callerTree = curTree->caller(); + } + + // Return the callPc of the topmost inlined script. + return curTree->callerPc(); + } + + // Return the range of this value, *before* any bailout checks. Contrast + // this with the type() method, and the Range constructor which takes an + // MDefinition*, which describe the value *after* any bailout checks. + // + // Warning: Range analysis is removing the bit-operations such as '| 0' at + // the end of the transformations. Using this function to analyse any + // operands after the truncate phase of the range analysis will lead to + // errors. Instead, one should define the collectRangeInfoPreTrunc() to set + // the right set of flags which are dependent on the range of the inputs. + Range* range() const { + MOZ_ASSERT(type() != MIRType::None); + return range_; + } + void setRange(Range* range) { + MOZ_ASSERT(type() != MIRType::None); + range_ = range; + } + + virtual HashNumber valueHash() const; + virtual bool congruentTo(const MDefinition* ins) const { + return false; + } + bool congruentIfOperandsEqual(const MDefinition* ins) const; + virtual MDefinition* foldsTo(TempAllocator& alloc); + virtual void analyzeEdgeCasesForward(); + virtual void analyzeEdgeCasesBackward(); + + // When a floating-point value is used by nodes which would prefer to + // recieve integer inputs, we may be able to help by computing our result + // into an integer directly. + // + // A value can be truncated in 4 differents ways: + // 1. Ignore Infinities (x / 0 --> 0). + // 2. Ignore overflow (INT_MIN / -1 == (INT_MAX + 1) --> INT_MIN) + // 3. Ignore negative zeros. (-0 --> 0) + // 4. Ignore remainder. (3 / 4 --> 0) + // + // Indirect truncation is used to represent that we are interested in the + // truncated result, but only if it can safely flow into operations which + // are computed modulo 2^32, such as (2) and (3). Infinities are not safe, + // as they would have absorbed other math operations. Remainders are not + // safe, as fractions can be scaled up by multiplication. + // + // Division is a particularly interesting node here because it covers all 4 + // cases even when its own operands are integers. + // + // Note that these enum values are ordered from least value-modifying to + // most value-modifying, and code relies on this ordering. + enum TruncateKind { + // No correction. + NoTruncate = 0, + // An integer is desired, but we can't skip bailout checks. + TruncateAfterBailouts = 1, + // The value will be truncated after some arithmetic (see above). + IndirectTruncate = 2, + // Direct and infallible truncation to int32. + Truncate = 3 + }; + + static const char * TruncateKindString(TruncateKind kind) { + switch(kind) { + case NoTruncate: + return "NoTruncate"; + case TruncateAfterBailouts: + return "TruncateAfterBailouts"; + case IndirectTruncate: + return "IndirectTruncate"; + case Truncate: + return "Truncate"; + default: + MOZ_CRASH("Unknown truncate kind."); + } + } + + // |needTruncation| records the truncation kind of the results, such that it + // can be used to truncate the operands of this instruction. If + // |needTruncation| function returns true, then the |truncate| function is + // called on the same instruction to mutate the instruction, such as + // updating the return type, the range and the specialization of the + // instruction. + virtual bool needTruncation(TruncateKind kind); + virtual void truncate(); + + // Determine what kind of truncate this node prefers for the operand at the + // given index. + virtual TruncateKind operandTruncateKind(size_t index) const; + + // Compute an absolute or symbolic range for the value of this node. + virtual void computeRange(TempAllocator& alloc) { + } + + // Collect information from the pre-truncated ranges. + virtual void collectRangeInfoPreTrunc() { + } + + MNode::Kind kind() const override { + return MNode::Definition; + } + + uint32_t id() const { + MOZ_ASSERT(block_); + return id_; + } + void setId(uint32_t id) { + id_ = id; + } + +#define FLAG_ACCESSOR(flag) \ + bool is##flag() const {\ + return hasFlags(1 << flag);\ + }\ + void set##flag() {\ + MOZ_ASSERT(!hasFlags(1 << flag));\ + setFlags(1 << flag);\ + }\ + void setNot##flag() {\ + MOZ_ASSERT(hasFlags(1 << flag));\ + removeFlags(1 << flag);\ + }\ + void set##flag##Unchecked() {\ + setFlags(1 << flag);\ + } \ + void setNot##flag##Unchecked() {\ + removeFlags(1 << flag);\ + } + + MIR_FLAG_LIST(FLAG_ACCESSOR) +#undef FLAG_ACCESSOR + + // Return the type of this value. This may be speculative, and enforced + // dynamically with the use of bailout checks. If all the bailout checks + // pass, the value will have this type. + // + // Unless this is an MUrsh that has bailouts disabled, which, as a special + // case, may return a value in (INT32_MAX,UINT32_MAX] even when its type() + // is MIRType::Int32. + MIRType type() const { + return resultType_; + } + + TemporaryTypeSet* resultTypeSet() const { + return resultTypeSet_; + } + bool emptyResultTypeSet() const; + + bool mightBeType(MIRType type) const { + MOZ_ASSERT(type != MIRType::Value); + MOZ_ASSERT(type != MIRType::ObjectOrNull); + + if (type == this->type()) + return true; + + if (this->type() == MIRType::ObjectOrNull) + return type == MIRType::Object || type == MIRType::Null; + + if (this->type() == MIRType::Value) + return !resultTypeSet() || resultTypeSet()->mightBeMIRType(type); + + return false; + } + + bool mightBeMagicType() const; + + bool maybeEmulatesUndefined(CompilerConstraintList* constraints); + + // Float32 specialization operations (see big comment in IonAnalysis before the Float32 + // specialization algorithm). + virtual bool isFloat32Commutative() const { return false; } + virtual bool canProduceFloat32() const { return false; } + virtual bool canConsumeFloat32(MUse* use) const { return false; } + virtual void trySpecializeFloat32(TempAllocator& alloc) {} +#ifdef DEBUG + // Used during the pass that checks that Float32 flow into valid MDefinitions + virtual bool isConsistentFloat32Use(MUse* use) const { + return type() == MIRType::Float32 || canConsumeFloat32(use); + } +#endif + + // Returns the beginning of this definition's use chain. + MUseIterator usesBegin() const { + return uses_.begin(); + } + + // Returns the end of this definition's use chain. + MUseIterator usesEnd() const { + return uses_.end(); + } + + bool canEmitAtUses() const { + return !isEmittedAtUses(); + } + + // Removes a use at the given position + void removeUse(MUse* use) { + uses_.remove(use); + } + +#if defined(DEBUG) || defined(JS_JITSPEW) + // Number of uses of this instruction. This function is only available + // in DEBUG mode since it requires traversing the list. Most users should + // use hasUses() or hasOneUse() instead. + size_t useCount() const; + + // Number of uses of this instruction (only counting MDefinitions, ignoring + // MResumePoints). This function is only available in DEBUG mode since it + // requires traversing the list. Most users should use hasUses() or + // hasOneUse() instead. + size_t defUseCount() const; +#endif + + // Test whether this MDefinition has exactly one use. + bool hasOneUse() const; + + // Test whether this MDefinition has exactly one use. + // (only counting MDefinitions, ignoring MResumePoints) + bool hasOneDefUse() const; + + // Test whether this MDefinition has at least one use. + // (only counting MDefinitions, ignoring MResumePoints) + bool hasDefUses() const; + + // Test whether this MDefinition has at least one non-recovered use. + // (only counting MDefinitions, ignoring MResumePoints) + bool hasLiveDefUses() const; + + bool hasUses() const { + return !uses_.empty(); + } + + void addUse(MUse* use) { + MOZ_ASSERT(use->producer() == this); + uses_.pushFront(use); + } + void addUseUnchecked(MUse* use) { + MOZ_ASSERT(use->producer() == this); + uses_.pushFrontUnchecked(use); + } + void replaceUse(MUse* old, MUse* now) { + MOZ_ASSERT(now->producer() == this); + uses_.replace(old, now); + } + + // Replace the current instruction by a dominating instruction |dom| in all + // uses of the current instruction. + void replaceAllUsesWith(MDefinition* dom); + + // Like replaceAllUsesWith, but doesn't set UseRemoved on |this|'s operands. + void justReplaceAllUsesWith(MDefinition* dom); + + // Like justReplaceAllUsesWith, but doesn't replace its own use to the + // dominating instruction (which would introduce a circular dependency). + void justReplaceAllUsesWithExcept(MDefinition* dom); + + // Replace the current instruction by an optimized-out constant in all uses + // of the current instruction. Note, that optimized-out constant should not + // be observed, and thus they should not flow in any computation. + MOZ_MUST_USE bool optimizeOutAllUses(TempAllocator& alloc); + + // Replace the current instruction by a dominating instruction |dom| in all + // instruction, but keep the current instruction for resume point and + // instruction which are recovered on bailouts. + void replaceAllLiveUsesWith(MDefinition* dom); + + // Mark this instruction as having replaced all uses of ins, as during GVN, + // returning false if the replacement should not be performed. For use when + // GVN eliminates instructions which are not equivalent to one another. + virtual MOZ_MUST_USE bool updateForReplacement(MDefinition* ins) { + return true; + } + + void setVirtualRegister(uint32_t vreg) { + virtualRegister_ = vreg; + setLoweredUnchecked(); + } + uint32_t virtualRegister() const { + MOZ_ASSERT(isLowered()); + return virtualRegister_; + } + + public: + // Opcode testing and casts. + template<typename MIRType> bool is() const { + return op() == MIRType::classOpcode; + } + template<typename MIRType> MIRType* to() { + MOZ_ASSERT(this->is<MIRType>()); + return static_cast<MIRType*>(this); + } + template<typename MIRType> const MIRType* to() const { + MOZ_ASSERT(this->is<MIRType>()); + return static_cast<const MIRType*>(this); + } +# define OPCODE_CASTS(opcode) \ + bool is##opcode() const { \ + return this->is<M##opcode>(); \ + } \ + M##opcode* to##opcode() { \ + return this->to<M##opcode>(); \ + } \ + const M##opcode* to##opcode() const { \ + return this->to<M##opcode>(); \ + } + MIR_OPCODE_LIST(OPCODE_CASTS) +# undef OPCODE_CASTS + + inline MConstant* maybeConstantValue(); + + inline MInstruction* toInstruction(); + inline const MInstruction* toInstruction() const; + bool isInstruction() const { + return !isPhi(); + } + + virtual bool isControlInstruction() const { + return false; + } + inline MControlInstruction* toControlInstruction(); + + void setResultType(MIRType type) { + resultType_ = type; + } + void setResultTypeSet(TemporaryTypeSet* types) { + resultTypeSet_ = types; + } + virtual AliasSet getAliasSet() const { + // Instructions are effectful by default. + return AliasSet::Store(AliasSet::Any); + } + + MDefinition* dependency() const { + if (getAliasSet().isStore()) + return nullptr; + return loadDependency_; + } + void setDependency(MDefinition* dependency) { + MOZ_ASSERT(!getAliasSet().isStore()); + loadDependency_ = dependency; + } + void setStoreDependency(StoreDependency* dependency) { + MOZ_ASSERT(getAliasSet().isStore()); + storeDependency_ = dependency; + } + StoreDependency* storeDependency() { + MOZ_ASSERT_IF(!getAliasSet().isStore(), !storeDependency_); + return storeDependency_; + } + bool isEffectful() const { + return getAliasSet().isStore(); + } + +#ifdef DEBUG + virtual bool needsResumePoint() const { + // Return whether this instruction should have its own resume point. + return isEffectful(); + } +#endif + + enum class AliasType : uint32_t { + NoAlias = 0, + MayAlias = 1, + MustAlias = 2 + }; + virtual AliasType mightAlias(const MDefinition* store) const { + // Return whether this load may depend on the specified store, given + // that the alias sets intersect. This may be refined to exclude + // possible aliasing in cases where alias set flags are too imprecise. + if (!(getAliasSet().flags() & store->getAliasSet().flags())) + return AliasType::NoAlias; + MOZ_ASSERT(!isEffectful() && store->isEffectful()); + return AliasType::MayAlias; + } + + virtual bool canRecoverOnBailout() const { + return false; + } +}; + +// An MUseDefIterator walks over uses in a definition, skipping any use that is +// not a definition. Items from the use list must not be deleted during +// iteration. +class MUseDefIterator +{ + const MDefinition* def_; + MUseIterator current_; + + MUseIterator search(MUseIterator start) { + MUseIterator i(start); + for (; i != def_->usesEnd(); i++) { + if (i->consumer()->isDefinition()) + return i; + } + return def_->usesEnd(); + } + + public: + explicit MUseDefIterator(const MDefinition* def) + : def_(def), + current_(search(def->usesBegin())) + { } + + explicit operator bool() const { + return current_ != def_->usesEnd(); + } + MUseDefIterator operator ++() { + MOZ_ASSERT(current_ != def_->usesEnd()); + ++current_; + current_ = search(current_); + return *this; + } + MUseDefIterator operator ++(int) { + MUseDefIterator old(*this); + operator++(); + return old; + } + MUse* use() const { + return *current_; + } + MDefinition* def() const { + return current_->consumer()->toDefinition(); + } +}; + +#ifdef DEBUG +bool +IonCompilationCanUseNurseryPointers(); +#endif + +// Helper class to check that GC pointers embedded in MIR instructions are in +// in the nursery only when the store buffer has been marked as needing to +// cancel all ion compilations. Otherwise, off-thread Ion compilation and +// nursery GCs can happen in parallel, so it's invalid to store pointers to +// nursery things. There's no need to root these pointers, as GC is suppressed +// during compilation and off-thread compilations are canceled on major GCs. +template <typename T> +class CompilerGCPointer +{ + js::gc::Cell* ptr_; + + public: + explicit CompilerGCPointer(T ptr) + : ptr_(ptr) + { + MOZ_ASSERT_IF(IsInsideNursery(ptr), IonCompilationCanUseNurseryPointers()); +#ifdef DEBUG + PerThreadData* pt = TlsPerThreadData.get(); + MOZ_ASSERT_IF(pt->runtimeIfOnOwnerThread(), pt->suppressGC); +#endif + } + + operator T() const { return static_cast<T>(ptr_); } + T operator->() const { return static_cast<T>(ptr_); } + + private: + CompilerGCPointer() = delete; + CompilerGCPointer(const CompilerGCPointer<T>&) = delete; + CompilerGCPointer<T>& operator=(const CompilerGCPointer<T>&) = delete; +}; + +typedef CompilerGCPointer<JSObject*> CompilerObject; +typedef CompilerGCPointer<NativeObject*> CompilerNativeObject; +typedef CompilerGCPointer<JSFunction*> CompilerFunction; +typedef CompilerGCPointer<JSScript*> CompilerScript; +typedef CompilerGCPointer<PropertyName*> CompilerPropertyName; +typedef CompilerGCPointer<Shape*> CompilerShape; +typedef CompilerGCPointer<ObjectGroup*> CompilerObjectGroup; + +class MRootList : public TempObject +{ + public: + using RootVector = Vector<void*, 0, JitAllocPolicy>; + + private: + mozilla::EnumeratedArray<JS::RootKind, JS::RootKind::Limit, mozilla::Maybe<RootVector>> roots_; + + MRootList(const MRootList&) = delete; + void operator=(const MRootList&) = delete; + + public: + explicit MRootList(TempAllocator& alloc); + + void trace(JSTracer* trc); + + template <typename T> + MOZ_MUST_USE bool append(T ptr) { + if (ptr) + return roots_[JS::MapTypeToRootKind<T>::kind]->append(ptr); + return true; + } + + template <typename T> + MOZ_MUST_USE bool append(const CompilerGCPointer<T>& ptr) { + return append(static_cast<T>(ptr)); + } + MOZ_MUST_USE bool append(const ReceiverGuard& guard) { + return append(guard.group) && append(guard.shape); + } +}; + +// An instruction is an SSA name that is inserted into a basic block's IR +// stream. +class MInstruction + : public MDefinition, + public InlineListNode<MInstruction> +{ + MResumePoint* resumePoint_; + + protected: + // All MInstructions are using the "MFoo::New(alloc)" notation instead of + // the TempObject new operator. This code redefines the new operator as + // protected, and delegates to the TempObject new operator. Thus, the + // following code prevents calls to "new(alloc) MFoo" outside the MFoo + // members. + inline void* operator new(size_t nbytes, TempAllocator::Fallible view) throw() { + return TempObject::operator new(nbytes, view); + } + inline void* operator new(size_t nbytes, TempAllocator& alloc) { + return TempObject::operator new(nbytes, alloc); + } + template <class T> + inline void* operator new(size_t nbytes, T* pos) { + return TempObject::operator new(nbytes, pos); + } + + public: + MInstruction() + : resumePoint_(nullptr) + { } + + // Copying an instruction leaves the block and resume point as empty. + explicit MInstruction(const MInstruction& other) + : MDefinition(other), + resumePoint_(nullptr) + { } + + // Convenient function used for replacing a load by the value of the store + // if the types are match, and boxing the value if they do not match. + MDefinition* foldsToStore(TempAllocator& alloc); + + void setResumePoint(MResumePoint* resumePoint); + + // Used to transfer the resume point to the rewritten instruction. + void stealResumePoint(MInstruction* ins); + void moveResumePointAsEntry(); + void clearResumePoint(); + MResumePoint* resumePoint() const { + return resumePoint_; + } + + // For instructions which can be cloned with new inputs, with all other + // information being the same. clone() implementations do not need to worry + // about cloning generic MInstruction/MDefinition state like flags and + // resume points. + virtual bool canClone() const { + return false; + } + virtual MInstruction* clone(TempAllocator& alloc, const MDefinitionVector& inputs) const { + MOZ_CRASH(); + } + + // MIR instructions containing GC pointers should override this to append + // these pointers to the root list. + virtual bool appendRoots(MRootList& roots) const { + return true; + } + + // Instructions needing to hook into type analysis should return a + // TypePolicy. + virtual TypePolicy* typePolicy() = 0; + virtual MIRType typePolicySpecialization() = 0; +}; + +#define INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(opcode) \ + static const Opcode classOpcode = MDefinition::Op_##opcode; \ + using MThisOpcode = M##opcode; \ + Opcode op() const override { \ + return classOpcode; \ + } \ + const char* opName() const override { \ + return #opcode; \ + } \ + void accept(MDefinitionVisitor* visitor) override { \ + visitor->visit##opcode(this); \ + } + +#define INSTRUCTION_HEADER(opcode) \ + INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(opcode) \ + virtual TypePolicy* typePolicy() override; \ + virtual MIRType typePolicySpecialization() override; + +#define ALLOW_CLONE(typename) \ + bool canClone() const override { \ + return true; \ + } \ + MInstruction* clone(TempAllocator& alloc, \ + const MDefinitionVector& inputs) const override { \ + MInstruction* res = new(alloc) typename(*this); \ + for (size_t i = 0; i < numOperands(); i++) \ + res->replaceOperand(i, inputs[i]); \ + return res; \ + } + +// Adds MFoo::New functions which are mirroring the arguments of the +// constructors. Opcodes which are using this macro can be called with a +// TempAllocator, or the fallible version of the TempAllocator. +#define TRIVIAL_NEW_WRAPPERS \ + template <typename... Args> \ + static MThisOpcode* New(TempAllocator& alloc, Args&&... args) { \ + return new(alloc) MThisOpcode(mozilla::Forward<Args>(args)...); \ + } \ + template <typename... Args> \ + static MThisOpcode* New(TempAllocator::Fallible alloc, Args&&... args) \ + { \ + return new(alloc) MThisOpcode(mozilla::Forward<Args>(args)...); \ + } + + +// These macros are used as a syntactic sugar for writting getOperand +// accessors. They are meant to be used in the body of MIR Instructions as +// follows: +// +// public: +// INSTRUCTION_HEADER(Foo) +// NAMED_OPERANDS((0, lhs), (1, rhs)) +// +// The above example defines 2 accessors, one named "lhs" accessing the first +// operand, and a one named "rhs" accessing the second operand. +#define NAMED_OPERAND_ACCESSOR(Index, Name) \ + MDefinition* Name() const { \ + return getOperand(Index); \ + } +#define NAMED_OPERAND_ACCESSOR_APPLY(Args) \ + NAMED_OPERAND_ACCESSOR Args +#define NAMED_OPERANDS(...) \ + MOZ_FOR_EACH(NAMED_OPERAND_ACCESSOR_APPLY, (), (__VA_ARGS__)) + +template <size_t Arity> +class MAryInstruction : public MInstruction +{ + mozilla::Array<MUse, Arity> operands_; + + protected: + MUse* getUseFor(size_t index) final override { + return &operands_[index]; + } + const MUse* getUseFor(size_t index) const final override { + return &operands_[index]; + } + void initOperand(size_t index, MDefinition* operand) { + operands_[index].init(operand, this); + } + + public: + MDefinition* getOperand(size_t index) const final override { + return operands_[index].producer(); + } + size_t numOperands() const final override { + return Arity; + } +#ifdef DEBUG + static const size_t staticNumOperands = Arity; +#endif + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u >= &operands_[0]); + MOZ_ASSERT(u <= &operands_[numOperands() - 1]); + return u - &operands_[0]; + } + void replaceOperand(size_t index, MDefinition* operand) final override { + operands_[index].replaceProducer(operand); + } + + MAryInstruction() { } + + explicit MAryInstruction(const MAryInstruction<Arity>& other) + : MInstruction(other) + { + for (int i = 0; i < (int) Arity; i++) // N.B. use |int| to avoid warnings when Arity == 0 + operands_[i].init(other.operands_[i].producer(), this); + } +}; + +class MNullaryInstruction + : public MAryInstruction<0>, + public NoTypePolicy::Data +{ }; + +class MUnaryInstruction : public MAryInstruction<1> +{ + protected: + explicit MUnaryInstruction(MDefinition* ins) + { + initOperand(0, ins); + } + + public: + NAMED_OPERANDS((0, input)) +}; + +class MBinaryInstruction : public MAryInstruction<2> +{ + protected: + MBinaryInstruction(MDefinition* left, MDefinition* right) + { + initOperand(0, left); + initOperand(1, right); + } + + public: + NAMED_OPERANDS((0, lhs), (1, rhs)) + void swapOperands() { + MDefinition* temp = getOperand(0); + replaceOperand(0, getOperand(1)); + replaceOperand(1, temp); + } + + protected: + HashNumber valueHash() const + { + MDefinition* lhs = getOperand(0); + MDefinition* rhs = getOperand(1); + + return op() + lhs->id() + rhs->id(); + } + bool binaryCongruentTo(const MDefinition* ins) const + { + if (op() != ins->op()) + return false; + + if (type() != ins->type()) + return false; + + if (isEffectful() || ins->isEffectful()) + return false; + + const MDefinition* left = getOperand(0); + const MDefinition* right = getOperand(1); + const MDefinition* tmp; + + if (isCommutative() && left->id() > right->id()) { + tmp = right; + right = left; + left = tmp; + } + + const MBinaryInstruction* bi = static_cast<const MBinaryInstruction*>(ins); + const MDefinition* insLeft = bi->getOperand(0); + const MDefinition* insRight = bi->getOperand(1); + if (isCommutative() && insLeft->id() > insRight->id()) { + tmp = insRight; + insRight = insLeft; + insLeft = tmp; + } + + return left == insLeft && + right == insRight; + } + + public: + // Return if the operands to this instruction are both unsigned. + static bool unsignedOperands(MDefinition* left, MDefinition* right); + bool unsignedOperands(); + + // Replace any wrapping operands with the underlying int32 operands + // in case of unsigned operands. + void replaceWithUnsignedOperands(); +}; + +class MTernaryInstruction : public MAryInstruction<3> +{ + protected: + MTernaryInstruction(MDefinition* first, MDefinition* second, MDefinition* third) + { + initOperand(0, first); + initOperand(1, second); + initOperand(2, third); + } + + protected: + HashNumber valueHash() const + { + MDefinition* first = getOperand(0); + MDefinition* second = getOperand(1); + MDefinition* third = getOperand(2); + + return op() + first->id() + second->id() + third->id(); + } +}; + +class MQuaternaryInstruction : public MAryInstruction<4> +{ + protected: + MQuaternaryInstruction(MDefinition* first, MDefinition* second, + MDefinition* third, MDefinition* fourth) + { + initOperand(0, first); + initOperand(1, second); + initOperand(2, third); + initOperand(3, fourth); + } + + protected: + HashNumber valueHash() const + { + MDefinition* first = getOperand(0); + MDefinition* second = getOperand(1); + MDefinition* third = getOperand(2); + MDefinition* fourth = getOperand(3); + + return op() + first->id() + second->id() + + third->id() + fourth->id(); + } +}; + +template <class T> +class MVariadicT : public T +{ + FixedList<MUse> operands_; + + protected: + MOZ_MUST_USE bool init(TempAllocator& alloc, size_t length) { + return operands_.init(alloc, length); + } + void initOperand(size_t index, MDefinition* operand) { + // FixedList doesn't initialize its elements, so do an unchecked init. + operands_[index].initUnchecked(operand, this); + } + MUse* getUseFor(size_t index) final override { + return &operands_[index]; + } + const MUse* getUseFor(size_t index) const final override { + return &operands_[index]; + } + + public: + // Will assert if called before initialization. + MDefinition* getOperand(size_t index) const final override { + return operands_[index].producer(); + } + size_t numOperands() const final override { + return operands_.length(); + } + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u >= &operands_[0]); + MOZ_ASSERT(u <= &operands_[numOperands() - 1]); + return u - &operands_[0]; + } + void replaceOperand(size_t index, MDefinition* operand) final override { + operands_[index].replaceProducer(operand); + } +}; + +typedef MVariadicT<MInstruction> MVariadicInstruction; + +// Generates an LSnapshot without further effect. +class MStart : public MNullaryInstruction +{ + public: + INSTRUCTION_HEADER(Start) + TRIVIAL_NEW_WRAPPERS +}; + +// Instruction marking on entrypoint for on-stack replacement. +// OSR may occur at loop headers (at JSOP_TRACE). +// There is at most one MOsrEntry per MIRGraph. +class MOsrEntry : public MNullaryInstruction +{ + protected: + MOsrEntry() { + setResultType(MIRType::Pointer); + } + + public: + INSTRUCTION_HEADER(OsrEntry) + TRIVIAL_NEW_WRAPPERS +}; + +// No-op instruction. This cannot be moved or eliminated, and is intended for +// anchoring resume points at arbitrary points in a block. +class MNop : public MNullaryInstruction +{ + protected: + MNop() { + } + + public: + INSTRUCTION_HEADER(Nop) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MNop) +}; + +// Truncation barrier. This is intended for protecting its input against +// follow-up truncation optimizations. +class MLimitedTruncate + : public MUnaryInstruction, + public ConvertToInt32Policy<0>::Data +{ + public: + TruncateKind truncate_; + TruncateKind truncateLimit_; + + protected: + MLimitedTruncate(MDefinition* input, TruncateKind limit) + : MUnaryInstruction(input), + truncate_(NoTruncate), + truncateLimit_(limit) + { + setResultType(MIRType::Int32); + setResultTypeSet(input->resultTypeSet()); + setMovable(); + } + + public: + INSTRUCTION_HEADER(LimitedTruncate) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + TruncateKind operandTruncateKind(size_t index) const override; + TruncateKind truncateKind() const { + return truncate_; + } + void setTruncateKind(TruncateKind kind) { + truncate_ = kind; + } +}; + +// A constant js::Value. +class MConstant : public MNullaryInstruction +{ + struct Payload { + union { + bool b; + int32_t i32; + int64_t i64; + float f; + double d; + JSString* str; + JS::Symbol* sym; + JSObject* obj; + uint64_t asBits; + }; + Payload() : asBits(0) {} + }; + + Payload payload_; + + static_assert(sizeof(Payload) == sizeof(uint64_t), + "asBits must be big enough for all payload bits"); + +#ifdef DEBUG + void assertInitializedPayload() const; +#else + void assertInitializedPayload() const {} +#endif + + protected: + MConstant(const Value& v, CompilerConstraintList* constraints); + explicit MConstant(JSObject* obj); + explicit MConstant(float f); + explicit MConstant(double d); + explicit MConstant(int64_t i); + + public: + INSTRUCTION_HEADER(Constant) + static MConstant* New(TempAllocator& alloc, const Value& v, + CompilerConstraintList* constraints = nullptr); + static MConstant* New(TempAllocator::Fallible alloc, const Value& v, + CompilerConstraintList* constraints = nullptr); + static MConstant* New(TempAllocator& alloc, const Value& v, MIRType type); + static MConstant* New(TempAllocator& alloc, wasm::RawF32 bits); + static MConstant* New(TempAllocator& alloc, wasm::RawF64 bits); + static MConstant* NewFloat32(TempAllocator& alloc, double d); + static MConstant* NewInt64(TempAllocator& alloc, int64_t i); + static MConstant* NewConstraintlessObject(TempAllocator& alloc, JSObject* v); + static MConstant* Copy(TempAllocator& alloc, MConstant* src) { + return new(alloc) MConstant(*src); + } + + // Try to convert this constant to boolean, similar to js::ToBoolean. + // Returns false if the type is MIRType::Magic*. + bool MOZ_MUST_USE valueToBoolean(bool* res) const; + + // Like valueToBoolean, but returns the result directly instead of using + // an outparam. Should not be used if this constant might be a magic value. + bool valueToBooleanInfallible() const { + bool res; + MOZ_ALWAYS_TRUE(valueToBoolean(&res)); + return res; + } + + void printOpcode(GenericPrinter& out) const override; + + HashNumber valueHash() const override; + bool congruentTo(const MDefinition* ins) const override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool updateForReplacement(MDefinition* def) override { + MConstant* c = def->toConstant(); + // During constant folding, we don't want to replace a float32 + // value by a double value. + if (type() == MIRType::Float32) + return c->type() == MIRType::Float32; + if (type() == MIRType::Double) + return c->type() != MIRType::Float32; + return true; + } + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + + bool canProduceFloat32() const override; + + ALLOW_CLONE(MConstant) + + bool equals(const MConstant* other) const { + assertInitializedPayload(); + return type() == other->type() && payload_.asBits == other->payload_.asBits; + } + + bool toBoolean() const { + MOZ_ASSERT(type() == MIRType::Boolean); + return payload_.b; + } + int32_t toInt32() const { + MOZ_ASSERT(type() == MIRType::Int32); + return payload_.i32; + } + int64_t toInt64() const { + MOZ_ASSERT(type() == MIRType::Int64); + return payload_.i64; + } + bool isInt32(int32_t i) const { + return type() == MIRType::Int32 && payload_.i32 == i; + } + double toDouble() const { + MOZ_ASSERT(type() == MIRType::Double); + return payload_.d; + } + wasm::RawF64 toRawF64() const { + MOZ_ASSERT(type() == MIRType::Double); + return wasm::RawF64::fromBits(payload_.i64); + } + float toFloat32() const { + MOZ_ASSERT(type() == MIRType::Float32); + return payload_.f; + } + wasm::RawF32 toRawF32() const { + MOZ_ASSERT(type() == MIRType::Float32); + return wasm::RawF32::fromBits(payload_.i32); + } + JSString* toString() const { + MOZ_ASSERT(type() == MIRType::String); + return payload_.str; + } + JS::Symbol* toSymbol() const { + MOZ_ASSERT(type() == MIRType::Symbol); + return payload_.sym; + } + JSObject& toObject() const { + MOZ_ASSERT(type() == MIRType::Object); + return *payload_.obj; + } + JSObject* toObjectOrNull() const { + if (type() == MIRType::Object) + return payload_.obj; + MOZ_ASSERT(type() == MIRType::Null); + return nullptr; + } + + bool isTypeRepresentableAsDouble() const { + return IsTypeRepresentableAsDouble(type()); + } + double numberToDouble() const { + MOZ_ASSERT(isTypeRepresentableAsDouble()); + if (type() == MIRType::Int32) + return toInt32(); + if (type() == MIRType::Double) + return toDouble(); + return toFloat32(); + } + + // Convert this constant to a js::Value. Float32 constants will be stored + // as DoubleValue and NaNs are canonicalized. Callers must be careful: not + // all constants can be represented by js::Value (wasm supports int64). + Value toJSValue() const; + + bool appendRoots(MRootList& roots) const override; +}; + +// Generic constructor of SIMD valuesX4. +class MSimdValueX4 + : public MQuaternaryInstruction, + public Mix4Policy<SimdScalarPolicy<0>, SimdScalarPolicy<1>, + SimdScalarPolicy<2>, SimdScalarPolicy<3> >::Data +{ + protected: + MSimdValueX4(MIRType type, MDefinition* x, MDefinition* y, MDefinition* z, MDefinition* w) + : MQuaternaryInstruction(x, y, z, w) + { + MOZ_ASSERT(IsSimdType(type)); + MOZ_ASSERT(SimdTypeToLength(type) == 4); + + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(SimdValueX4) + TRIVIAL_NEW_WRAPPERS + + bool canConsumeFloat32(MUse* use) const override { + return SimdTypeToLaneType(type()) == MIRType::Float32; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MSimdValueX4) +}; + +// Generic constructor of SIMD values with identical lanes. +class MSimdSplat + : public MUnaryInstruction, + public SimdScalarPolicy<0>::Data +{ + protected: + MSimdSplat(MDefinition* v, MIRType type) + : MUnaryInstruction(v) + { + MOZ_ASSERT(IsSimdType(type)); + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(SimdSplat) + TRIVIAL_NEW_WRAPPERS + + bool canConsumeFloat32(MUse* use) const override { + return SimdTypeToLaneType(type()) == MIRType::Float32; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MSimdSplat) +}; + +// A constant SIMD value. +class MSimdConstant + : public MNullaryInstruction +{ + SimdConstant value_; + + protected: + MSimdConstant(const SimdConstant& v, MIRType type) : value_(v) { + MOZ_ASSERT(IsSimdType(type)); + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(SimdConstant) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isSimdConstant()) + return false; + // Bool32x4 and Int32x4 share the same underlying SimdConstant representation. + if (type() != ins->type()) + return false; + return value() == ins->toSimdConstant()->value(); + } + + const SimdConstant& value() const { + return value_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MSimdConstant) +}; + +// Converts all lanes of a given vector into the type of another vector +class MSimdConvert + : public MUnaryInstruction, + public SimdPolicy<0>::Data +{ + // When either fromType or toType is an integer vector, should it be treated + // as signed or unsigned. Note that we don't support int-int conversions - + // use MSimdReinterpretCast for that. + SimdSign sign_; + wasm::TrapOffset trapOffset_; + + MSimdConvert(MDefinition* obj, MIRType toType, SimdSign sign, wasm::TrapOffset trapOffset) + : MUnaryInstruction(obj), sign_(sign), trapOffset_(trapOffset) + { + MIRType fromType = obj->type(); + MOZ_ASSERT(IsSimdType(fromType)); + MOZ_ASSERT(IsSimdType(toType)); + // All conversions are int <-> float, so signedness is required. + MOZ_ASSERT(sign != SimdSign::NotApplicable); + + setResultType(toType); + specialization_ = fromType; // expects fromType as input + + setMovable(); + if (IsFloatingPointSimdType(fromType) && IsIntegerSimdType(toType)) { + // Does the extra range check => do not remove + setGuard(); + } + } + + static MSimdConvert* New(TempAllocator& alloc, MDefinition* obj, MIRType toType, SimdSign sign, + wasm::TrapOffset trapOffset) + { + return new (alloc) MSimdConvert(obj, toType, sign, trapOffset); + } + + public: + INSTRUCTION_HEADER(SimdConvert) + + // Create a MSimdConvert instruction and add it to the basic block. + // Possibly create and add an equivalent sequence of instructions instead if + // the current target doesn't support the requested conversion directly. + // Return the inserted MInstruction that computes the converted value. + static MInstruction* AddLegalized(TempAllocator& alloc, MBasicBlock* addTo, MDefinition* obj, + MIRType toType, SimdSign sign, + wasm::TrapOffset trapOffset = wasm::TrapOffset()); + + SimdSign signedness() const { + return sign_; + } + wasm::TrapOffset trapOffset() const { + return trapOffset_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + const MSimdConvert* other = ins->toSimdConvert(); + return sign_ == other->sign_; + } + ALLOW_CLONE(MSimdConvert) +}; + +// Casts bits of a vector input to another SIMD type (doesn't generate code). +class MSimdReinterpretCast + : public MUnaryInstruction, + public SimdPolicy<0>::Data +{ + MSimdReinterpretCast(MDefinition* obj, MIRType toType) + : MUnaryInstruction(obj) + { + MIRType fromType = obj->type(); + MOZ_ASSERT(IsSimdType(fromType)); + MOZ_ASSERT(IsSimdType(toType)); + setMovable(); + setResultType(toType); + specialization_ = fromType; // expects fromType as input + } + + public: + INSTRUCTION_HEADER(SimdReinterpretCast) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + ALLOW_CLONE(MSimdReinterpretCast) +}; + +// Extracts a lane element from a given vector type, given by its lane symbol. +// +// For integer SIMD types, a SimdSign must be provided so the lane value can be +// converted to a scalar correctly. +class MSimdExtractElement + : public MUnaryInstruction, + public SimdPolicy<0>::Data +{ + protected: + unsigned lane_; + SimdSign sign_; + + MSimdExtractElement(MDefinition* obj, MIRType laneType, unsigned lane, SimdSign sign) + : MUnaryInstruction(obj), lane_(lane), sign_(sign) + { + MIRType vecType = obj->type(); + MOZ_ASSERT(IsSimdType(vecType)); + MOZ_ASSERT(lane < SimdTypeToLength(vecType)); + MOZ_ASSERT(!IsSimdType(laneType)); + MOZ_ASSERT((sign != SimdSign::NotApplicable) == IsIntegerSimdType(vecType), + "Signedness must be specified for integer SIMD extractLanes"); + // The resulting type should match the lane type. + // Allow extracting boolean lanes directly into an Int32 (for wasm). + // Allow extracting Uint32 lanes into a double. + // + // We also allow extracting Uint32 lanes into a MIRType::Int32. This is + // equivalent to extracting the Uint32 lane to a double and then + // applying MTruncateToInt32, but it bypasses the conversion to/from + // double. + MOZ_ASSERT(SimdTypeToLaneType(vecType) == laneType || + (IsBooleanSimdType(vecType) && laneType == MIRType::Int32) || + (vecType == MIRType::Int32x4 && laneType == MIRType::Double && + sign == SimdSign::Unsigned)); + + setMovable(); + specialization_ = vecType; + setResultType(laneType); + } + + public: + INSTRUCTION_HEADER(SimdExtractElement) + TRIVIAL_NEW_WRAPPERS + + unsigned lane() const { + return lane_; + } + + SimdSign signedness() const { + return sign_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isSimdExtractElement()) + return false; + const MSimdExtractElement* other = ins->toSimdExtractElement(); + if (other->lane_ != lane_ || other->sign_ != sign_) + return false; + return congruentIfOperandsEqual(other); + } + ALLOW_CLONE(MSimdExtractElement) +}; + +// Replaces the datum in the given lane by a scalar value of the same type. +class MSimdInsertElement + : public MBinaryInstruction, + public MixPolicy< SimdSameAsReturnedTypePolicy<0>, SimdScalarPolicy<1> >::Data +{ + private: + unsigned lane_; + + MSimdInsertElement(MDefinition* vec, MDefinition* val, unsigned lane) + : MBinaryInstruction(vec, val), lane_(lane) + { + MIRType type = vec->type(); + MOZ_ASSERT(IsSimdType(type)); + MOZ_ASSERT(lane < SimdTypeToLength(type)); + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(SimdInsertElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, vector), (1, value)) + + unsigned lane() const { + return lane_; + } + + bool canConsumeFloat32(MUse* use) const override { + return use == getUseFor(1) && SimdTypeToLaneType(type()) == MIRType::Float32; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return binaryCongruentTo(ins) && lane_ == ins->toSimdInsertElement()->lane(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdInsertElement) +}; + +// Returns true if all lanes are true. +class MSimdAllTrue + : public MUnaryInstruction, + public SimdPolicy<0>::Data +{ + protected: + explicit MSimdAllTrue(MDefinition* obj, MIRType result) + : MUnaryInstruction(obj) + { + MIRType simdType = obj->type(); + MOZ_ASSERT(IsBooleanSimdType(simdType)); + MOZ_ASSERT(result == MIRType::Boolean || result == MIRType::Int32); + setResultType(result); + specialization_ = simdType; + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdAllTrue) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + ALLOW_CLONE(MSimdAllTrue) +}; + +// Returns true if any lane is true. +class MSimdAnyTrue + : public MUnaryInstruction, + public SimdPolicy<0>::Data +{ + protected: + explicit MSimdAnyTrue(MDefinition* obj, MIRType result) + : MUnaryInstruction(obj) + { + MIRType simdType = obj->type(); + MOZ_ASSERT(IsBooleanSimdType(simdType)); + MOZ_ASSERT(result == MIRType::Boolean || result == MIRType::Int32); + setResultType(result); + specialization_ = simdType; + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdAnyTrue) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + ALLOW_CLONE(MSimdAnyTrue) +}; + +// Base for the MSimdSwizzle and MSimdShuffle classes. +class MSimdShuffleBase +{ + protected: + // As of now, there are at most 16 lanes. For each lane, we need to know + // which input we choose and which of the lanes we choose. + mozilla::Array<uint8_t, 16> lane_; + uint32_t arity_; + + MSimdShuffleBase(const uint8_t lanes[], MIRType type) + { + arity_ = SimdTypeToLength(type); + for (unsigned i = 0; i < arity_; i++) + lane_[i] = lanes[i]; + } + + bool sameLanes(const MSimdShuffleBase* other) const { + return arity_ == other->arity_ && + memcmp(&lane_[0], &other->lane_[0], arity_) == 0; + } + + public: + unsigned numLanes() const { + return arity_; + } + + unsigned lane(unsigned i) const { + MOZ_ASSERT(i < arity_); + return lane_[i]; + } + + bool lanesMatch(uint32_t x, uint32_t y, uint32_t z, uint32_t w) const { + return arity_ == 4 && lane(0) == x && lane(1) == y && lane(2) == z && + lane(3) == w; + } +}; + +// Applies a swizzle operation to the input, putting the input lanes as +// indicated in the output register's lanes. This implements the SIMD.js +// "swizzle" function, that takes one vector and an array of lane indexes. +class MSimdSwizzle + : public MUnaryInstruction, + public MSimdShuffleBase, + public NoTypePolicy::Data +{ + protected: + MSimdSwizzle(MDefinition* obj, const uint8_t lanes[]) + : MUnaryInstruction(obj), MSimdShuffleBase(lanes, obj->type()) + { + for (unsigned i = 0; i < arity_; i++) + MOZ_ASSERT(lane(i) < arity_); + setResultType(obj->type()); + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdSwizzle) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isSimdSwizzle()) + return false; + const MSimdSwizzle* other = ins->toSimdSwizzle(); + return sameLanes(other) && congruentIfOperandsEqual(other); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MSimdSwizzle) +}; + +// A "general shuffle" is a swizzle or a shuffle with non-constant lane +// indices. This is the one that Ion inlines and it can be folded into a +// MSimdSwizzle/MSimdShuffle if lane indices are constant. Performance of +// general swizzle/shuffle does not really matter, as we expect to get +// constant indices most of the time. +class MSimdGeneralShuffle : + public MVariadicInstruction, + public SimdShufflePolicy::Data +{ + unsigned numVectors_; + unsigned numLanes_; + + protected: + MSimdGeneralShuffle(unsigned numVectors, unsigned numLanes, MIRType type) + : numVectors_(numVectors), numLanes_(numLanes) + { + MOZ_ASSERT(IsSimdType(type)); + MOZ_ASSERT(SimdTypeToLength(type) == numLanes_); + + setResultType(type); + specialization_ = type; + setGuard(); // throws if lane index is out of bounds + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdGeneralShuffle); + TRIVIAL_NEW_WRAPPERS + + MOZ_MUST_USE bool init(TempAllocator& alloc) { + return MVariadicInstruction::init(alloc, numVectors_ + numLanes_); + } + void setVector(unsigned i, MDefinition* vec) { + MOZ_ASSERT(i < numVectors_); + initOperand(i, vec); + } + void setLane(unsigned i, MDefinition* laneIndex) { + MOZ_ASSERT(i < numLanes_); + initOperand(numVectors_ + i, laneIndex); + } + + unsigned numVectors() const { + return numVectors_; + } + unsigned numLanes() const { + return numLanes_; + } + MDefinition* vector(unsigned i) const { + MOZ_ASSERT(i < numVectors_); + return getOperand(i); + } + MDefinition* lane(unsigned i) const { + MOZ_ASSERT(i < numLanes_); + return getOperand(numVectors_ + i); + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isSimdGeneralShuffle()) + return false; + const MSimdGeneralShuffle* other = ins->toSimdGeneralShuffle(); + return numVectors_ == other->numVectors() && + numLanes_ == other->numLanes() && + congruentIfOperandsEqual(other); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Applies a shuffle operation to the inputs. The lane indexes select a source +// lane from the concatenation of the two input vectors. +class MSimdShuffle + : public MBinaryInstruction, + public MSimdShuffleBase, + public NoTypePolicy::Data +{ + MSimdShuffle(MDefinition* lhs, MDefinition* rhs, const uint8_t lanes[]) + : MBinaryInstruction(lhs, rhs), MSimdShuffleBase(lanes, lhs->type()) + { + MOZ_ASSERT(IsSimdType(lhs->type())); + MOZ_ASSERT(IsSimdType(rhs->type())); + MOZ_ASSERT(lhs->type() == rhs->type()); + for (unsigned i = 0; i < arity_; i++) + MOZ_ASSERT(lane(i) < 2 * arity_); + setResultType(lhs->type()); + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdShuffle) + + static MInstruction* New(TempAllocator& alloc, MDefinition* lhs, MDefinition* rhs, + const uint8_t lanes[]) + { + unsigned arity = SimdTypeToLength(lhs->type()); + + // Swap operands so that new lanes come from LHS in majority. + // In the balanced case, swap operands if needs be, in order to be able + // to do only one vshufps on x86. + unsigned lanesFromLHS = 0; + for (unsigned i = 0; i < arity; i++) { + if (lanes[i] < arity) + lanesFromLHS++; + } + + if (lanesFromLHS < arity / 2 || + (arity == 4 && lanesFromLHS == 2 && lanes[0] >= 4 && lanes[1] >= 4)) { + mozilla::Array<uint8_t, 16> newLanes; + for (unsigned i = 0; i < arity; i++) + newLanes[i] = (lanes[i] + arity) % (2 * arity); + return New(alloc, rhs, lhs, &newLanes[0]); + } + + // If all lanes come from the same vector, just use swizzle instead. + if (lanesFromLHS == arity) + return MSimdSwizzle::New(alloc, lhs, lanes); + + return new(alloc) MSimdShuffle(lhs, rhs, lanes); + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isSimdShuffle()) + return false; + const MSimdShuffle* other = ins->toSimdShuffle(); + return sameLanes(other) && binaryCongruentTo(other); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MSimdShuffle) +}; + +class MSimdUnaryArith + : public MUnaryInstruction, + public SimdSameAsReturnedTypePolicy<0>::Data +{ + public: + enum Operation { +#define OP_LIST_(OP) OP, + FOREACH_FLOAT_SIMD_UNOP(OP_LIST_) + neg, + not_ +#undef OP_LIST_ + }; + + static const char* OperationName(Operation op) { + switch (op) { + case abs: return "abs"; + case neg: return "neg"; + case not_: return "not"; + case reciprocalApproximation: return "reciprocalApproximation"; + case reciprocalSqrtApproximation: return "reciprocalSqrtApproximation"; + case sqrt: return "sqrt"; + } + MOZ_CRASH("unexpected operation"); + } + + private: + Operation operation_; + + MSimdUnaryArith(MDefinition* def, Operation op) + : MUnaryInstruction(def), operation_(op) + { + MIRType type = def->type(); + MOZ_ASSERT(IsSimdType(type)); + MOZ_ASSERT_IF(IsIntegerSimdType(type), op == neg || op == not_); + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdUnaryArith) + TRIVIAL_NEW_WRAPPERS + + Operation operation() const { return operation_; } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && ins->toSimdUnaryArith()->operation() == operation(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdUnaryArith); +}; + +// Compares each value of a SIMD vector to each corresponding lane's value of +// another SIMD vector, and returns a boolean vector containing the results of +// the comparison: all bits are set to 1 if the comparison is true, 0 otherwise. +// When comparing integer vectors, a SimdSign must be provided to request signed +// or unsigned comparison. +class MSimdBinaryComp + : public MBinaryInstruction, + public SimdAllPolicy::Data +{ + public: + enum Operation { +#define NAME_(x) x, + FOREACH_COMP_SIMD_OP(NAME_) +#undef NAME_ + }; + + static const char* OperationName(Operation op) { + switch (op) { +#define NAME_(x) case x: return #x; + FOREACH_COMP_SIMD_OP(NAME_) +#undef NAME_ + } + MOZ_CRASH("unexpected operation"); + } + + private: + Operation operation_; + SimdSign sign_; + + MSimdBinaryComp(MDefinition* left, MDefinition* right, Operation op, SimdSign sign) + : MBinaryInstruction(left, right), operation_(op), sign_(sign) + { + MOZ_ASSERT(left->type() == right->type()); + MIRType opType = left->type(); + MOZ_ASSERT(IsSimdType(opType)); + MOZ_ASSERT((sign != SimdSign::NotApplicable) == IsIntegerSimdType(opType), + "Signedness must be specified for integer SIMD compares"); + setResultType(MIRTypeToBooleanSimdType(opType)); + specialization_ = opType; + setMovable(); + if (op == equal || op == notEqual) + setCommutative(); + } + + static MSimdBinaryComp* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, + Operation op, SimdSign sign) + { + return new (alloc) MSimdBinaryComp(left, right, op, sign); + } + + public: + INSTRUCTION_HEADER(SimdBinaryComp) + + // Create a MSimdBinaryComp or an equivalent sequence of instructions + // supported by the current target. + // Add all instructions to the basic block |addTo|. + static MInstruction* AddLegalized(TempAllocator& alloc, MBasicBlock* addTo, MDefinition* left, + MDefinition* right, Operation op, SimdSign sign); + + AliasSet getAliasSet() const override + { + return AliasSet::None(); + } + + Operation operation() const { return operation_; } + SimdSign signedness() const { return sign_; } + MIRType specialization() const { return specialization_; } + + // Swap the operands and reverse the comparison predicate. + void reverse() { + switch (operation()) { + case greaterThan: operation_ = lessThan; break; + case greaterThanOrEqual: operation_ = lessThanOrEqual; break; + case lessThan: operation_ = greaterThan; break; + case lessThanOrEqual: operation_ = greaterThanOrEqual; break; + case equal: + case notEqual: + break; + default: MOZ_CRASH("Unexpected compare operation"); + } + swapOperands(); + } + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + const MSimdBinaryComp* other = ins->toSimdBinaryComp(); + return specialization_ == other->specialization() && + operation_ == other->operation() && + sign_ == other->signedness(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdBinaryComp) +}; + +class MSimdBinaryArith + : public MBinaryInstruction, + public MixPolicy<SimdSameAsReturnedTypePolicy<0>, SimdSameAsReturnedTypePolicy<1> >::Data +{ + public: + enum Operation { +#define OP_LIST_(OP) Op_##OP, + FOREACH_NUMERIC_SIMD_BINOP(OP_LIST_) + FOREACH_FLOAT_SIMD_BINOP(OP_LIST_) +#undef OP_LIST_ + }; + + static const char* OperationName(Operation op) { + switch (op) { +#define OP_CASE_LIST_(OP) case Op_##OP: return #OP; + FOREACH_NUMERIC_SIMD_BINOP(OP_CASE_LIST_) + FOREACH_FLOAT_SIMD_BINOP(OP_CASE_LIST_) +#undef OP_CASE_LIST_ + } + MOZ_CRASH("unexpected operation"); + } + + private: + Operation operation_; + + MSimdBinaryArith(MDefinition* left, MDefinition* right, Operation op) + : MBinaryInstruction(left, right), operation_(op) + { + MOZ_ASSERT(left->type() == right->type()); + MIRType type = left->type(); + MOZ_ASSERT(IsSimdType(type)); + MOZ_ASSERT_IF(IsIntegerSimdType(type), op == Op_add || op == Op_sub || op == Op_mul); + setResultType(type); + setMovable(); + if (op == Op_add || op == Op_mul || op == Op_min || op == Op_max) + setCommutative(); + } + + static MSimdBinaryArith* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, + Operation op) + { + return new (alloc) MSimdBinaryArith(left, right, op); + } + + public: + INSTRUCTION_HEADER(SimdBinaryArith) + + // Create an MSimdBinaryArith instruction and add it to the basic block. Possibly + // create and add an equivalent sequence of instructions instead if the + // current target doesn't support the requested shift operation directly. + static MInstruction* AddLegalized(TempAllocator& alloc, MBasicBlock* addTo, MDefinition* left, + MDefinition* right, Operation op); + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + Operation operation() const { return operation_; } + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + return operation_ == ins->toSimdBinaryArith()->operation(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdBinaryArith) +}; + +class MSimdBinarySaturating + : public MBinaryInstruction, + public MixPolicy<SimdSameAsReturnedTypePolicy<0>, SimdSameAsReturnedTypePolicy<1>>::Data +{ + public: + enum Operation + { + add, + sub, + }; + + static const char* OperationName(Operation op) + { + switch (op) { + case add: + return "add"; + case sub: + return "sub"; + } + MOZ_CRASH("unexpected operation"); + } + + private: + Operation operation_; + SimdSign sign_; + + MSimdBinarySaturating(MDefinition* left, MDefinition* right, Operation op, SimdSign sign) + : MBinaryInstruction(left, right) + , operation_(op) + , sign_(sign) + { + MOZ_ASSERT(left->type() == right->type()); + MIRType type = left->type(); + MOZ_ASSERT(type == MIRType::Int8x16 || type == MIRType::Int16x8); + setResultType(type); + setMovable(); + if (op == add) + setCommutative(); + } + + public: + INSTRUCTION_HEADER(SimdBinarySaturating) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { return AliasSet::None(); } + + Operation operation() const { return operation_; } + SimdSign signedness() const { return sign_; } + + bool congruentTo(const MDefinition* ins) const override + { + if (!binaryCongruentTo(ins)) + return false; + return operation_ == ins->toSimdBinarySaturating()->operation() && + sign_ == ins->toSimdBinarySaturating()->signedness(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdBinarySaturating) +}; + +class MSimdBinaryBitwise + : public MBinaryInstruction, + public MixPolicy<SimdSameAsReturnedTypePolicy<0>, SimdSameAsReturnedTypePolicy<1> >::Data +{ + public: + enum Operation { + and_, + or_, + xor_ + }; + + static const char* OperationName(Operation op) { + switch (op) { + case and_: return "and"; + case or_: return "or"; + case xor_: return "xor"; + } + MOZ_CRASH("unexpected operation"); + } + + private: + Operation operation_; + + MSimdBinaryBitwise(MDefinition* left, MDefinition* right, Operation op) + : MBinaryInstruction(left, right), operation_(op) + { + MOZ_ASSERT(left->type() == right->type()); + MIRType type = left->type(); + MOZ_ASSERT(IsSimdType(type)); + setResultType(type); + setMovable(); + setCommutative(); + } + + public: + INSTRUCTION_HEADER(SimdBinaryBitwise) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + Operation operation() const { return operation_; } + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + return operation_ == ins->toSimdBinaryBitwise()->operation(); + } + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MSimdBinaryBitwise) +}; + +class MSimdShift + : public MBinaryInstruction, + public MixPolicy<SimdSameAsReturnedTypePolicy<0>, SimdScalarPolicy<1> >::Data +{ + public: + enum Operation { + lsh, + rsh, + ursh + }; + + private: + Operation operation_; + + MSimdShift(MDefinition* left, MDefinition* right, Operation op) + : MBinaryInstruction(left, right), operation_(op) + { + MIRType type = left->type(); + MOZ_ASSERT(IsIntegerSimdType(type)); + setResultType(type); + setMovable(); + } + + static MSimdShift* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, + Operation op) + { + return new (alloc) MSimdShift(left, right, op); + } + + public: + INSTRUCTION_HEADER(SimdShift) + + // Create an MSimdShift instruction and add it to the basic block. Possibly + // create and add an equivalent sequence of instructions instead if the + // current target doesn't support the requested shift operation directly. + // Return the inserted MInstruction that computes the shifted value. + static MInstruction* AddLegalized(TempAllocator& alloc, MBasicBlock* addTo, MDefinition* left, + MDefinition* right, Operation op); + + // Get the relevant right shift operation given the signedness of a type. + static Operation rshForSign(SimdSign sign) { + return sign == SimdSign::Unsigned ? ursh : rsh; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + Operation operation() const { return operation_; } + + static const char* OperationName(Operation op) { + switch (op) { + case lsh: return "lsh"; + case rsh: return "rsh-arithmetic"; + case ursh: return "rsh-logical"; + } + MOZ_CRASH("unexpected operation"); + } + + void printOpcode(GenericPrinter& out) const override; + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + return operation_ == ins->toSimdShift()->operation(); + } + + ALLOW_CLONE(MSimdShift) +}; + +class MSimdSelect + : public MTernaryInstruction, + public SimdSelectPolicy::Data +{ + MSimdSelect(MDefinition* mask, MDefinition* lhs, MDefinition* rhs) + : MTernaryInstruction(mask, lhs, rhs) + { + MOZ_ASSERT(IsBooleanSimdType(mask->type())); + MOZ_ASSERT(lhs->type() == lhs->type()); + MIRType type = lhs->type(); + MOZ_ASSERT(IsSimdType(type)); + setResultType(type); + specialization_ = type; + setMovable(); + } + + public: + INSTRUCTION_HEADER(SimdSelect) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, mask)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + ALLOW_CLONE(MSimdSelect) +}; + +// Deep clone a constant JSObject. +class MCloneLiteral + : public MUnaryInstruction, + public ObjectPolicy<0>::Data +{ + protected: + explicit MCloneLiteral(MDefinition* obj) + : MUnaryInstruction(obj) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(CloneLiteral) + TRIVIAL_NEW_WRAPPERS +}; + +class MParameter : public MNullaryInstruction +{ + int32_t index_; + + MParameter(int32_t index, TemporaryTypeSet* types) + : index_(index) + { + setResultType(MIRType::Value); + setResultTypeSet(types); + } + + public: + INSTRUCTION_HEADER(Parameter) + TRIVIAL_NEW_WRAPPERS + + static const int32_t THIS_SLOT = -1; + int32_t index() const { + return index_; + } + void printOpcode(GenericPrinter& out) const override; + + HashNumber valueHash() const override; + bool congruentTo(const MDefinition* ins) const override; +}; + +class MCallee : public MNullaryInstruction +{ + public: + MCallee() + { + setResultType(MIRType::Object); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Callee) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MIsConstructing : public MNullaryInstruction +{ + public: + MIsConstructing() { + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(IsConstructing) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MControlInstruction : public MInstruction +{ + public: + MControlInstruction() + { } + + virtual size_t numSuccessors() const = 0; + virtual MBasicBlock* getSuccessor(size_t i) const = 0; + virtual void replaceSuccessor(size_t i, MBasicBlock* successor) = 0; + + bool isControlInstruction() const override { + return true; + } + + void printOpcode(GenericPrinter& out) const override; +}; + +class MTableSwitch final + : public MControlInstruction, + public NoFloatPolicy<0>::Data +{ + // The successors of the tableswitch + // - First successor = the default case + // - Successor 2 and higher = the cases sorted on case index. + Vector<MBasicBlock*, 0, JitAllocPolicy> successors_; + Vector<size_t, 0, JitAllocPolicy> cases_; + + // Contains the blocks/cases that still need to get build + Vector<MBasicBlock*, 0, JitAllocPolicy> blocks_; + + MUse operand_; + int32_t low_; + int32_t high_; + + void initOperand(size_t index, MDefinition* operand) { + MOZ_ASSERT(index == 0); + operand_.init(operand, this); + } + + MTableSwitch(TempAllocator& alloc, MDefinition* ins, + int32_t low, int32_t high) + : successors_(alloc), + cases_(alloc), + blocks_(alloc), + low_(low), + high_(high) + { + initOperand(0, ins); + } + + protected: + MUse* getUseFor(size_t index) override { + MOZ_ASSERT(index == 0); + return &operand_; + } + + const MUse* getUseFor(size_t index) const override { + MOZ_ASSERT(index == 0); + return &operand_; + } + + public: + INSTRUCTION_HEADER(TableSwitch) + static MTableSwitch* New(TempAllocator& alloc, MDefinition* ins, int32_t low, int32_t high); + + size_t numSuccessors() const override { + return successors_.length(); + } + + MOZ_MUST_USE bool addSuccessor(MBasicBlock* successor, size_t* index) { + MOZ_ASSERT(successors_.length() < (size_t)(high_ - low_ + 2)); + MOZ_ASSERT(!successors_.empty()); + *index = successors_.length(); + return successors_.append(successor); + } + + MBasicBlock* getSuccessor(size_t i) const override { + MOZ_ASSERT(i < numSuccessors()); + return successors_[i]; + } + + void replaceSuccessor(size_t i, MBasicBlock* successor) override { + MOZ_ASSERT(i < numSuccessors()); + successors_[i] = successor; + } + + MBasicBlock** blocks() { + return &blocks_[0]; + } + + size_t numBlocks() const { + return blocks_.length(); + } + + int32_t low() const { + return low_; + } + + int32_t high() const { + return high_; + } + + MBasicBlock* getDefault() const { + return getSuccessor(0); + } + + MBasicBlock* getCase(size_t i) const { + return getSuccessor(cases_[i]); + } + + size_t numCases() const { + return high() - low() + 1; + } + + MOZ_MUST_USE bool addDefault(MBasicBlock* block, size_t* index = nullptr) { + MOZ_ASSERT(successors_.empty()); + if (index) + *index = 0; + return successors_.append(block); + } + + MOZ_MUST_USE bool addCase(size_t successorIndex) { + return cases_.append(successorIndex); + } + + MBasicBlock* getBlock(size_t i) const { + MOZ_ASSERT(i < numBlocks()); + return blocks_[i]; + } + + MOZ_MUST_USE bool addBlock(MBasicBlock* block) { + return blocks_.append(block); + } + + MDefinition* getOperand(size_t index) const override { + MOZ_ASSERT(index == 0); + return operand_.producer(); + } + + size_t numOperands() const override { + return 1; + } + + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u == getUseFor(0)); + return 0; + } + + void replaceOperand(size_t index, MDefinition* operand) final override { + MOZ_ASSERT(index == 0); + operand_.replaceProducer(operand); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; +}; + +template <size_t Arity, size_t Successors> +class MAryControlInstruction : public MControlInstruction +{ + mozilla::Array<MUse, Arity> operands_; + mozilla::Array<MBasicBlock*, Successors> successors_; + + protected: + void setSuccessor(size_t index, MBasicBlock* successor) { + successors_[index] = successor; + } + + MUse* getUseFor(size_t index) final override { + return &operands_[index]; + } + const MUse* getUseFor(size_t index) const final override { + return &operands_[index]; + } + void initOperand(size_t index, MDefinition* operand) { + operands_[index].init(operand, this); + } + + public: + MDefinition* getOperand(size_t index) const final override { + return operands_[index].producer(); + } + size_t numOperands() const final override { + return Arity; + } + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u >= &operands_[0]); + MOZ_ASSERT(u <= &operands_[numOperands() - 1]); + return u - &operands_[0]; + } + void replaceOperand(size_t index, MDefinition* operand) final override { + operands_[index].replaceProducer(operand); + } + size_t numSuccessors() const final override { + return Successors; + } + MBasicBlock* getSuccessor(size_t i) const final override { + return successors_[i]; + } + void replaceSuccessor(size_t i, MBasicBlock* succ) final override { + successors_[i] = succ; + } +}; + +// Jump to the start of another basic block. +class MGoto + : public MAryControlInstruction<0, 1>, + public NoTypePolicy::Data +{ + explicit MGoto(MBasicBlock* target) { + setSuccessor(0, target); + } + + public: + INSTRUCTION_HEADER(Goto) + static MGoto* New(TempAllocator& alloc, MBasicBlock* target); + static MGoto* New(TempAllocator::Fallible alloc, MBasicBlock* target); + + // Variant that may patch the target later. + static MGoto* New(TempAllocator& alloc); + + static const size_t TargetIndex = 0; + + MBasicBlock* target() { + return getSuccessor(0); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +enum BranchDirection { + FALSE_BRANCH, + TRUE_BRANCH +}; + +static inline BranchDirection +NegateBranchDirection(BranchDirection dir) +{ + return (dir == FALSE_BRANCH) ? TRUE_BRANCH : FALSE_BRANCH; +} + +// Tests if the input instruction evaluates to true or false, and jumps to the +// start of a corresponding basic block. +class MTest + : public MAryControlInstruction<1, 2>, + public TestPolicy::Data +{ + bool operandMightEmulateUndefined_; + + MTest(MDefinition* ins, MBasicBlock* trueBranch, MBasicBlock* falseBranch) + : operandMightEmulateUndefined_(true) + { + initOperand(0, ins); + setSuccessor(0, trueBranch); + setSuccessor(1, falseBranch); + } + + // Variant which may patch the ifTrue branch later. + MTest(MDefinition* ins, MBasicBlock* falseBranch) + : MTest(ins, nullptr, falseBranch) + {} + + public: + INSTRUCTION_HEADER(Test) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, input)) + + static const size_t TrueBranchIndex = 0; + + MBasicBlock* ifTrue() const { + return getSuccessor(0); + } + MBasicBlock* ifFalse() const { + return getSuccessor(1); + } + MBasicBlock* branchSuccessor(BranchDirection dir) const { + return (dir == TRUE_BRANCH) ? ifTrue() : ifFalse(); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + // We cache whether our operand might emulate undefined, but we don't want + // to do that from New() or the constructor, since those can be called on + // background threads. So make callers explicitly call it if they want us + // to check whether the operand might do this. If this method is never + // called, we'll assume our operand can emulate undefined. + void cacheOperandMightEmulateUndefined(CompilerConstraintList* constraints); + MDefinition* foldsDoubleNegation(TempAllocator& alloc); + MDefinition* foldsConstant(TempAllocator& alloc); + MDefinition* foldsTypes(TempAllocator& alloc); + MDefinition* foldsNeedlessControlFlow(TempAllocator& alloc); + MDefinition* foldsTo(TempAllocator& alloc) override; + void filtersUndefinedOrNull(bool trueBranch, MDefinition** subject, bool* filtersUndefined, + bool* filtersNull); + + void markNoOperandEmulatesUndefined() { + operandMightEmulateUndefined_ = false; + } + bool operandMightEmulateUndefined() const { + return operandMightEmulateUndefined_; + } +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif +}; + +// Equivalent to MTest(true, successor, fake), except without the foldsTo +// method. This allows IonBuilder to insert fake CFG edges to magically protect +// control flow for try-catch blocks. +class MGotoWithFake + : public MAryControlInstruction<0, 2>, + public NoTypePolicy::Data +{ + MGotoWithFake(MBasicBlock* successor, MBasicBlock* fake) + { + setSuccessor(0, successor); + setSuccessor(1, fake); + } + + public: + INSTRUCTION_HEADER(GotoWithFake) + TRIVIAL_NEW_WRAPPERS + + MBasicBlock* target() const { + return getSuccessor(0); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Returns from this function to the previous caller. +class MReturn + : public MAryControlInstruction<1, 0>, + public BoxInputsPolicy::Data +{ + explicit MReturn(MDefinition* ins) { + initOperand(0, ins); + } + + public: + INSTRUCTION_HEADER(Return) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, input)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MThrow + : public MAryControlInstruction<1, 0>, + public BoxInputsPolicy::Data +{ + explicit MThrow(MDefinition* ins) { + initOperand(0, ins); + } + + public: + INSTRUCTION_HEADER(Throw) + TRIVIAL_NEW_WRAPPERS + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } +}; + +// Fabricate a type set containing only the type of the specified object. +TemporaryTypeSet* +MakeSingletonTypeSet(CompilerConstraintList* constraints, JSObject* obj); + +TemporaryTypeSet* +MakeSingletonTypeSet(CompilerConstraintList* constraints, ObjectGroup* obj); + +MOZ_MUST_USE bool +MergeTypes(TempAllocator& alloc, MIRType* ptype, TemporaryTypeSet** ptypeSet, + MIRType newType, TemporaryTypeSet* newTypeSet); + +bool +TypeSetIncludes(TypeSet* types, MIRType input, TypeSet* inputTypes); + +bool +EqualTypes(MIRType type1, TemporaryTypeSet* typeset1, + MIRType type2, TemporaryTypeSet* typeset2); + +bool +CanStoreUnboxedType(TempAllocator& alloc, + JSValueType unboxedType, MIRType input, TypeSet* inputTypes); + +class MNewArray + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + // Number of elements to allocate for the array. + uint32_t length_; + + // Heap where the array should be allocated. + gc::InitialHeap initialHeap_; + + // Whether values written to this array should be converted to double first. + bool convertDoubleElements_; + + jsbytecode* pc_; + + bool vmCall_; + + MNewArray(CompilerConstraintList* constraints, uint32_t length, MConstant* templateConst, + gc::InitialHeap initialHeap, jsbytecode* pc, bool vmCall = false); + + public: + INSTRUCTION_HEADER(NewArray) + TRIVIAL_NEW_WRAPPERS + + static MNewArray* NewVM(TempAllocator& alloc, CompilerConstraintList* constraints, + uint32_t length, MConstant* templateConst, + gc::InitialHeap initialHeap, jsbytecode* pc) + { + return new(alloc) MNewArray(constraints, length, templateConst, initialHeap, pc, true); + } + + uint32_t length() const { + return length_; + } + + JSObject* templateObject() const { + return getOperand(0)->toConstant()->toObjectOrNull(); + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + jsbytecode* pc() const { + return pc_; + } + + bool isVMCall() const { + return vmCall_; + } + + bool convertDoubleElements() const { + return convertDoubleElements_; + } + + // NewArray is marked as non-effectful because all our allocations are + // either lazy when we are using "new Array(length)" or bounded by the + // script or the stack size when we are using "new Array(...)" or "[...]" + // notations. So we might have to allocate the array twice if we bail + // during the computation of the first element of the square braket + // notation. + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + // The template object can safely be used in the recover instruction + // because it can never be mutated by any other function execution. + return templateObject() != nullptr; + } +}; + +class MNewArrayCopyOnWrite : public MNullaryInstruction +{ + CompilerGCPointer<ArrayObject*> templateObject_; + gc::InitialHeap initialHeap_; + + MNewArrayCopyOnWrite(CompilerConstraintList* constraints, ArrayObject* templateObject, + gc::InitialHeap initialHeap) + : templateObject_(templateObject), + initialHeap_(initialHeap) + { + MOZ_ASSERT(!templateObject->isSingleton()); + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(NewArrayCopyOnWrite) + TRIVIAL_NEW_WRAPPERS + + ArrayObject* templateObject() const { + return templateObject_; + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject_); + } +}; + +class MNewArrayDynamicLength + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + CompilerObject templateObject_; + gc::InitialHeap initialHeap_; + + MNewArrayDynamicLength(CompilerConstraintList* constraints, JSObject* templateObject, + gc::InitialHeap initialHeap, MDefinition* length) + : MUnaryInstruction(length), + templateObject_(templateObject), + initialHeap_(initialHeap) + { + setGuard(); // Need to throw if length is negative. + setResultType(MIRType::Object); + if (!templateObject->isSingleton()) + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(NewArrayDynamicLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, length)) + + JSObject* templateObject() const { + return templateObject_; + } + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject_); + } +}; + +class MNewTypedArray + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + gc::InitialHeap initialHeap_; + + MNewTypedArray(CompilerConstraintList* constraints, MConstant* templateConst, + gc::InitialHeap initialHeap) + : MUnaryInstruction(templateConst), + initialHeap_(initialHeap) + { + MOZ_ASSERT(!templateObject()->isSingleton()); + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject())); + } + + public: + INSTRUCTION_HEADER(NewTypedArray) + TRIVIAL_NEW_WRAPPERS + + TypedArrayObject* templateObject() const { + return &getOperand(0)->toConstant()->toObject().as<TypedArrayObject>(); + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +class MNewTypedArrayDynamicLength + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + CompilerObject templateObject_; + gc::InitialHeap initialHeap_; + + MNewTypedArrayDynamicLength(CompilerConstraintList* constraints, JSObject* templateObject, + gc::InitialHeap initialHeap, MDefinition* length) + : MUnaryInstruction(length), + templateObject_(templateObject), + initialHeap_(initialHeap) + { + setGuard(); // Need to throw if length is negative. + setResultType(MIRType::Object); + if (!templateObject->isSingleton()) + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(NewTypedArrayDynamicLength) + + static MNewTypedArrayDynamicLength* New(TempAllocator& alloc, CompilerConstraintList* constraints, + JSObject* templateObject, gc::InitialHeap initialHeap, + MDefinition* length) + { + return new(alloc) MNewTypedArrayDynamicLength(constraints, templateObject, initialHeap, length); + } + + MDefinition* length() const { + return getOperand(0); + } + JSObject* templateObject() const { + return templateObject_; + } + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject_); + } +}; + +class MNewObject + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + public: + enum Mode { ObjectLiteral, ObjectCreate }; + + private: + gc::InitialHeap initialHeap_; + Mode mode_; + bool vmCall_; + + MNewObject(CompilerConstraintList* constraints, MConstant* templateConst, + gc::InitialHeap initialHeap, Mode mode, bool vmCall = false) + : MUnaryInstruction(templateConst), + initialHeap_(initialHeap), + mode_(mode), + vmCall_(vmCall) + { + MOZ_ASSERT_IF(mode != ObjectLiteral, templateObject()); + setResultType(MIRType::Object); + + if (JSObject* obj = templateObject()) + setResultTypeSet(MakeSingletonTypeSet(constraints, obj)); + + // The constant is kept separated in a MConstant, this way we can safely + // mark it during GC if we recover the object allocation. Otherwise, by + // making it emittedAtUses, we do not produce register allocations for + // it and inline its content inside the code produced by the + // CodeGenerator. + if (templateConst->toConstant()->type() == MIRType::Object) + templateConst->setEmittedAtUses(); + } + + public: + INSTRUCTION_HEADER(NewObject) + TRIVIAL_NEW_WRAPPERS + + static MNewObject* NewVM(TempAllocator& alloc, CompilerConstraintList* constraints, + MConstant* templateConst, gc::InitialHeap initialHeap, + Mode mode) + { + return new(alloc) MNewObject(constraints, templateConst, initialHeap, mode, true); + } + + Mode mode() const { + return mode_; + } + + JSObject* templateObject() const { + return getOperand(0)->toConstant()->toObjectOrNull(); + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + bool isVMCall() const { + return vmCall_; + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + // The template object can safely be used in the recover instruction + // because it can never be mutated by any other function execution. + return templateObject() != nullptr; + } +}; + +class MNewTypedObject : public MNullaryInstruction +{ + CompilerGCPointer<InlineTypedObject*> templateObject_; + gc::InitialHeap initialHeap_; + + MNewTypedObject(CompilerConstraintList* constraints, + InlineTypedObject* templateObject, + gc::InitialHeap initialHeap) + : templateObject_(templateObject), + initialHeap_(initialHeap) + { + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(NewTypedObject) + TRIVIAL_NEW_WRAPPERS + + InlineTypedObject* templateObject() const { + return templateObject_; + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject_); + } +}; + +class MTypedObjectDescr + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + private: + explicit MTypedObjectDescr(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Object); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypedObjectDescr) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Generic way for constructing a SIMD object in IonMonkey, this instruction +// takes as argument a SIMD instruction and returns a new SIMD object which +// corresponds to the MIRType of its operand. +class MSimdBox + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + protected: + CompilerGCPointer<InlineTypedObject*> templateObject_; + SimdType simdType_; + gc::InitialHeap initialHeap_; + + MSimdBox(CompilerConstraintList* constraints, + MDefinition* op, + InlineTypedObject* templateObject, + SimdType simdType, + gc::InitialHeap initialHeap) + : MUnaryInstruction(op), + templateObject_(templateObject), + simdType_(simdType), + initialHeap_(initialHeap) + { + MOZ_ASSERT(IsSimdType(op->type())); + setMovable(); + setResultType(MIRType::Object); + if (constraints) + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(SimdBox) + TRIVIAL_NEW_WRAPPERS + + InlineTypedObject* templateObject() const { + return templateObject_; + } + + SimdType simdType() const { + return simdType_; + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + const MSimdBox* box = ins->toSimdBox(); + if (box->simdType() != simdType()) + return false; + MOZ_ASSERT(box->templateObject() == templateObject()); + if (box->initialHeap() != initialHeap()) + return false; + return true; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void printOpcode(GenericPrinter& out) const override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject_); + } +}; + +class MSimdUnbox + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + protected: + SimdType simdType_; + + MSimdUnbox(MDefinition* op, SimdType simdType) + : MUnaryInstruction(op), + simdType_(simdType) + { + MIRType type = SimdTypeToMIRType(simdType); + MOZ_ASSERT(IsSimdType(type)); + setGuard(); + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(SimdUnbox) + TRIVIAL_NEW_WRAPPERS + ALLOW_CLONE(MSimdUnbox) + + SimdType simdType() const { return simdType_; } + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + return ins->toSimdUnbox()->simdType() == simdType(); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void printOpcode(GenericPrinter& out) const override; +}; + +// Creates a new derived type object. At runtime, this is just a call +// to `BinaryBlock::createDerived()`. That is, the MIR itself does not +// compile to particularly optimized code. However, using a distinct +// MIR for creating derived type objects allows the compiler to +// optimize ephemeral typed objects as would be created for a +// reference like `a.b.c` -- here, the `a.b` will create an ephemeral +// derived type object that aliases the memory of `a` itself. The +// specific nature of `a.b` is revealed by using +// `MNewDerivedTypedObject` rather than `MGetProperty` or what have +// you. Moreover, the compiler knows that there are no side-effects, +// so `MNewDerivedTypedObject` instructions can be reordered or pruned +// as dead code. +class MNewDerivedTypedObject + : public MTernaryInstruction, + public Mix3Policy<ObjectPolicy<0>, + ObjectPolicy<1>, + IntPolicy<2> >::Data +{ + private: + TypedObjectPrediction prediction_; + + MNewDerivedTypedObject(TypedObjectPrediction prediction, + MDefinition* type, + MDefinition* owner, + MDefinition* offset) + : MTernaryInstruction(type, owner, offset), + prediction_(prediction) + { + setMovable(); + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(NewDerivedTypedObject) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, type), (1, owner), (2, offset)) + + TypedObjectPrediction prediction() const { + return prediction_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +// This vector is used when the recovered object is kept unboxed. We map the +// offset of each property to the index of the corresponding operands in the +// object state. +struct OperandIndexMap : public TempObject +{ + // The number of properties is limited by scalar replacement. Thus we cannot + // have any large number of properties. + FixedList<uint8_t> map; + + MOZ_MUST_USE bool init(TempAllocator& alloc, JSObject* templateObject); +}; + +// Represent the content of all slots of an object. This instruction is not +// lowered and is not used to generate code. +class MObjectState + : public MVariadicInstruction, + public NoFloatPolicyAfter<1>::Data +{ + private: + uint32_t numSlots_; + uint32_t numFixedSlots_; // valid if isUnboxed() == false. + OperandIndexMap* operandIndex_; // valid if isUnboxed() == true. + + bool isUnboxed() const { + return operandIndex_ != nullptr; + } + + MObjectState(JSObject *templateObject, OperandIndexMap* operandIndex); + explicit MObjectState(MObjectState* state); + + MOZ_MUST_USE bool init(TempAllocator& alloc, MDefinition* obj); + + void initSlot(uint32_t slot, MDefinition* def) { + initOperand(slot + 1, def); + } + + public: + INSTRUCTION_HEADER(ObjectState) + NAMED_OPERANDS((0, object)) + + // Return the template object of any object creation which can be recovered + // on bailout. + static JSObject* templateObjectOf(MDefinition* obj); + + static MObjectState* New(TempAllocator& alloc, MDefinition* obj); + static MObjectState* Copy(TempAllocator& alloc, MObjectState* state); + + // As we might do read of uninitialized properties, we have to copy the + // initial values from the template object. + MOZ_MUST_USE bool initFromTemplateObject(TempAllocator& alloc, MDefinition* undefinedVal); + + size_t numFixedSlots() const { + MOZ_ASSERT(!isUnboxed()); + return numFixedSlots_; + } + size_t numSlots() const { + return numSlots_; + } + + MDefinition* getSlot(uint32_t slot) const { + return getOperand(slot + 1); + } + void setSlot(uint32_t slot, MDefinition* def) { + replaceOperand(slot + 1, def); + } + + bool hasFixedSlot(uint32_t slot) const { + return slot < numSlots() && slot < numFixedSlots(); + } + MDefinition* getFixedSlot(uint32_t slot) const { + MOZ_ASSERT(slot < numFixedSlots()); + return getSlot(slot); + } + void setFixedSlot(uint32_t slot, MDefinition* def) { + MOZ_ASSERT(slot < numFixedSlots()); + setSlot(slot, def); + } + + bool hasDynamicSlot(uint32_t slot) const { + return numFixedSlots() < numSlots() && slot < numSlots() - numFixedSlots(); + } + MDefinition* getDynamicSlot(uint32_t slot) const { + return getSlot(slot + numFixedSlots()); + } + void setDynamicSlot(uint32_t slot, MDefinition* def) { + setSlot(slot + numFixedSlots(), def); + } + + // Interface reserved for unboxed objects. + bool hasOffset(uint32_t offset) const { + MOZ_ASSERT(isUnboxed()); + return offset < operandIndex_->map.length() && operandIndex_->map[offset] != 0; + } + MDefinition* getOffset(uint32_t offset) const { + return getOperand(operandIndex_->map[offset]); + } + void setOffset(uint32_t offset, MDefinition* def) { + replaceOperand(operandIndex_->map[offset], def); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +// Represent the contents of all elements of an array. This instruction is not +// lowered and is not used to generate code. +class MArrayState + : public MVariadicInstruction, + public NoFloatPolicyAfter<2>::Data +{ + private: + uint32_t numElements_; + + explicit MArrayState(MDefinition* arr); + + MOZ_MUST_USE bool init(TempAllocator& alloc, MDefinition* obj, MDefinition* len); + + void initElement(uint32_t index, MDefinition* def) { + initOperand(index + 2, def); + } + + public: + INSTRUCTION_HEADER(ArrayState) + NAMED_OPERANDS((0, array), (1, initializedLength)) + + static MArrayState* New(TempAllocator& alloc, MDefinition* arr, MDefinition* undefinedVal, + MDefinition* initLength); + static MArrayState* Copy(TempAllocator& alloc, MArrayState* state); + + void setInitializedLength(MDefinition* def) { + replaceOperand(1, def); + } + + + size_t numElements() const { + return numElements_; + } + + MDefinition* getElement(uint32_t index) const { + return getOperand(index + 2); + } + void setElement(uint32_t index, MDefinition* def) { + replaceOperand(index + 2, def); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +// Setting __proto__ in an object literal. +class MMutateProto + : public MAryInstruction<2>, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >::Data +{ + protected: + MMutateProto(MDefinition* obj, MDefinition* value) + { + initOperand(0, obj); + initOperand(1, value); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(MutateProto) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getObject), (1, getValue)) + + bool possiblyCalls() const override { + return true; + } +}; + +// Slow path for adding a property to an object without a known base. +class MInitProp + : public MAryInstruction<2>, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >::Data +{ + CompilerPropertyName name_; + + protected: + MInitProp(MDefinition* obj, PropertyName* name, MDefinition* value) + : name_(name) + { + initOperand(0, obj); + initOperand(1, value); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(InitProp) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getObject), (1, getValue)) + + PropertyName* propertyName() const { + return name_; + } + + bool possiblyCalls() const override { + return true; + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MInitPropGetterSetter + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data +{ + CompilerPropertyName name_; + + MInitPropGetterSetter(MDefinition* obj, PropertyName* name, MDefinition* value) + : MBinaryInstruction(obj, value), + name_(name) + { } + + public: + INSTRUCTION_HEADER(InitPropGetterSetter) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value)) + + PropertyName* name() const { + return name_; + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MInitElem + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, BoxPolicy<2> >::Data +{ + MInitElem(MDefinition* obj, MDefinition* id, MDefinition* value) + { + initOperand(0, obj); + initOperand(1, id); + initOperand(2, value); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(InitElem) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getObject), (1, getId), (2, getValue)) + + bool possiblyCalls() const override { + return true; + } +}; + +class MInitElemGetterSetter + : public MTernaryInstruction, + public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2> >::Data +{ + MInitElemGetterSetter(MDefinition* obj, MDefinition* id, MDefinition* value) + : MTernaryInstruction(obj, id, value) + { } + + public: + INSTRUCTION_HEADER(InitElemGetterSetter) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, idValue), (2, value)) + +}; + +// WrappedFunction wraps a JSFunction so it can safely be used off-thread. +// In particular, a function's flags can be modified on the main thread as +// functions are relazified and delazified, so we must be careful not to access +// these flags off-thread. +class WrappedFunction : public TempObject +{ + CompilerFunction fun_; + uint16_t nargs_; + bool isNative_ : 1; + bool isConstructor_ : 1; + bool isClassConstructor_ : 1; + bool isSelfHostedBuiltin_ : 1; + + public: + explicit WrappedFunction(JSFunction* fun); + size_t nargs() const { return nargs_; } + bool isNative() const { return isNative_; } + bool isConstructor() const { return isConstructor_; } + bool isClassConstructor() const { return isClassConstructor_; } + bool isSelfHostedBuiltin() const { return isSelfHostedBuiltin_; } + + // fun->native() and fun->jitInfo() can safely be called off-thread: these + // fields never change. + JSNative native() const { return fun_->native(); } + const JSJitInfo* jitInfo() const { return fun_->jitInfo(); } + + JSFunction* rawJSFunction() const { return fun_; } + + bool appendRoots(MRootList& roots) const { + return roots.append(fun_); + } +}; + +class MCall + : public MVariadicInstruction, + public CallPolicy::Data +{ + private: + // An MCall uses the MPrepareCall, MDefinition for the function, and + // MPassArg instructions. They are stored in the same list. + static const size_t FunctionOperandIndex = 0; + static const size_t NumNonArgumentOperands = 1; + + protected: + // Monomorphic cache of single target from TI, or nullptr. + WrappedFunction* target_; + + // Original value of argc from the bytecode. + uint32_t numActualArgs_; + + // True if the call is for JSOP_NEW. + bool construct_; + + bool needsArgCheck_; + + MCall(WrappedFunction* target, uint32_t numActualArgs, bool construct) + : target_(target), + numActualArgs_(numActualArgs), + construct_(construct), + needsArgCheck_(true) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(Call) + static MCall* New(TempAllocator& alloc, JSFunction* target, size_t maxArgc, size_t numActualArgs, + bool construct, bool isDOMCall); + + void initFunction(MDefinition* func) { + initOperand(FunctionOperandIndex, func); + } + + bool needsArgCheck() const { + return needsArgCheck_; + } + + void disableArgCheck() { + needsArgCheck_ = false; + } + MDefinition* getFunction() const { + return getOperand(FunctionOperandIndex); + } + void replaceFunction(MInstruction* newfunc) { + replaceOperand(FunctionOperandIndex, newfunc); + } + + void addArg(size_t argnum, MDefinition* arg); + + MDefinition* getArg(uint32_t index) const { + return getOperand(NumNonArgumentOperands + index); + } + + static size_t IndexOfThis() { + return NumNonArgumentOperands; + } + static size_t IndexOfArgument(size_t index) { + return NumNonArgumentOperands + index + 1; // +1 to skip |this|. + } + static size_t IndexOfStackArg(size_t index) { + return NumNonArgumentOperands + index; + } + + // For TI-informed monomorphic callsites. + WrappedFunction* getSingleTarget() const { + return target_; + } + + bool isConstructing() const { + return construct_; + } + + // The number of stack arguments is the max between the number of formal + // arguments and the number of actual arguments. The number of stack + // argument includes the |undefined| padding added in case of underflow. + // Includes |this|. + uint32_t numStackArgs() const { + return numOperands() - NumNonArgumentOperands; + } + + // Does not include |this|. + uint32_t numActualArgs() const { + return numActualArgs_; + } + + bool possiblyCalls() const override { + return true; + } + + virtual bool isCallDOMNative() const { + return false; + } + + // A method that can be called to tell the MCall to figure out whether it's + // movable or not. This can't be done in the constructor, because it + // depends on the arguments to the call, and those aren't passed to the + // constructor but are set up later via addArg. + virtual void computeMovable() { + } + + bool appendRoots(MRootList& roots) const override { + if (target_) + return target_->appendRoots(roots); + return true; + } +}; + +class MCallDOMNative : public MCall +{ + // A helper class for MCalls for DOM natives. Note that this is NOT + // actually a separate MIR op from MCall, because all sorts of places use + // isCall() to check for calls and all we really want is to overload a few + // virtual things from MCall. + protected: + MCallDOMNative(WrappedFunction* target, uint32_t numActualArgs) + : MCall(target, numActualArgs, false) + { + MOZ_ASSERT(getJitInfo()->type() != JSJitInfo::InlinableNative); + + // If our jitinfo is not marked eliminatable, that means that our C++ + // implementation is fallible or that it never wants to be eliminated or + // that we have no hope of ever doing the sort of argument analysis that + // would allow us to detemine that we're side-effect-free. In the + // latter case we wouldn't get DCEd no matter what, but for the former + // two cases we have to explicitly say that we can't be DCEd. + if (!getJitInfo()->isEliminatable) + setGuard(); + } + + friend MCall* MCall::New(TempAllocator& alloc, JSFunction* target, size_t maxArgc, + size_t numActualArgs, bool construct, bool isDOMCall); + + const JSJitInfo* getJitInfo() const; + public: + virtual AliasSet getAliasSet() const override; + + virtual bool congruentTo(const MDefinition* ins) const override; + + virtual bool isCallDOMNative() const override { + return true; + } + + virtual void computeMovable() override; +}; + +// arr.splice(start, deleteCount) with unused return value. +class MArraySplice + : public MTernaryInstruction, + public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2> >::Data +{ + private: + + MArraySplice(MDefinition* object, MDefinition* start, MDefinition* deleteCount) + : MTernaryInstruction(object, start, deleteCount) + { } + + public: + INSTRUCTION_HEADER(ArraySplice) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, start), (2, deleteCount)) + + bool possiblyCalls() const override { + return true; + } +}; + +// fun.apply(self, arguments) +class MApplyArgs + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, BoxPolicy<2> >::Data +{ + protected: + // Monomorphic cache of single target from TI, or nullptr. + WrappedFunction* target_; + + MApplyArgs(WrappedFunction* target, MDefinition* fun, MDefinition* argc, MDefinition* self) + : target_(target) + { + initOperand(0, fun); + initOperand(1, argc); + initOperand(2, self); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(ApplyArgs) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getFunction), (1, getArgc), (2, getThis)) + + // For TI-informed monomorphic callsites. + WrappedFunction* getSingleTarget() const { + return target_; + } + + bool possiblyCalls() const override { + return true; + } + + bool appendRoots(MRootList& roots) const override { + if (target_) + return target_->appendRoots(roots); + return true; + } +}; + +// fun.apply(fn, array) +class MApplyArray + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, ObjectPolicy<1>, BoxPolicy<2> >::Data +{ + protected: + // Monomorphic cache of single target from TI, or nullptr. + WrappedFunction* target_; + + MApplyArray(WrappedFunction* target, MDefinition* fun, MDefinition* elements, MDefinition* self) + : target_(target) + { + initOperand(0, fun); + initOperand(1, elements); + initOperand(2, self); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(ApplyArray) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getFunction), (1, getElements), (2, getThis)) + + // For TI-informed monomorphic callsites. + WrappedFunction* getSingleTarget() const { + return target_; + } + + bool possiblyCalls() const override { + return true; + } + + bool appendRoots(MRootList& roots) const override { + if (target_) + return target_->appendRoots(roots); + return true; + } +}; + +class MBail : public MNullaryInstruction +{ + protected: + explicit MBail(BailoutKind kind) + : MNullaryInstruction() + { + bailoutKind_ = kind; + setGuard(); + } + + private: + BailoutKind bailoutKind_; + + public: + INSTRUCTION_HEADER(Bail) + + static MBail* + New(TempAllocator& alloc, BailoutKind kind) { + return new(alloc) MBail(kind); + } + static MBail* + New(TempAllocator& alloc) { + return new(alloc) MBail(Bailout_Inevitable); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + BailoutKind bailoutKind() const { + return bailoutKind_; + } +}; + +class MUnreachable + : public MAryControlInstruction<0, 0>, + public NoTypePolicy::Data +{ + public: + INSTRUCTION_HEADER(Unreachable) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// This class serve as a way to force the encoding of a snapshot, even if there +// is no resume point using it. This is useful to run MAssertRecoveredOnBailout +// assertions. +class MEncodeSnapshot : public MNullaryInstruction +{ + protected: + MEncodeSnapshot() + : MNullaryInstruction() + { + setGuard(); + } + + public: + INSTRUCTION_HEADER(EncodeSnapshot) + + static MEncodeSnapshot* + New(TempAllocator& alloc) { + return new(alloc) MEncodeSnapshot(); + } +}; + +class MAssertRecoveredOnBailout + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + protected: + bool mustBeRecovered_; + + MAssertRecoveredOnBailout(MDefinition* ins, bool mustBeRecovered) + : MUnaryInstruction(ins), mustBeRecovered_(mustBeRecovered) + { + setResultType(MIRType::Value); + setRecoveredOnBailout(); + setGuard(); + } + + public: + INSTRUCTION_HEADER(AssertRecoveredOnBailout) + TRIVIAL_NEW_WRAPPERS + + // Needed to assert that float32 instructions are correctly recovered. + bool canConsumeFloat32(MUse* use) const override { return true; } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +class MAssertFloat32 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + protected: + bool mustBeFloat32_; + + MAssertFloat32(MDefinition* value, bool mustBeFloat32) + : MUnaryInstruction(value), mustBeFloat32_(mustBeFloat32) + { + } + + public: + INSTRUCTION_HEADER(AssertFloat32) + TRIVIAL_NEW_WRAPPERS + + bool canConsumeFloat32(MUse* use) const override { return true; } + + bool mustBeFloat32() const { return mustBeFloat32_; } +}; + +class MGetDynamicName + : public MAryInstruction<2>, + public MixPolicy<ObjectPolicy<0>, ConvertToStringPolicy<1> >::Data +{ + protected: + MGetDynamicName(MDefinition* envChain, MDefinition* name) + { + initOperand(0, envChain); + initOperand(1, name); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(GetDynamicName) + NAMED_OPERANDS((0, getEnvironmentChain), (1, getName)) + + static MGetDynamicName* + New(TempAllocator& alloc, MDefinition* envChain, MDefinition* name) { + return new(alloc) MGetDynamicName(envChain, name); + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MCallDirectEval + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, + StringPolicy<1>, + BoxPolicy<2> >::Data +{ + protected: + MCallDirectEval(MDefinition* envChain, MDefinition* string, + MDefinition* newTargetValue, jsbytecode* pc) + : pc_(pc) + { + initOperand(0, envChain); + initOperand(1, string); + initOperand(2, newTargetValue); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(CallDirectEval) + NAMED_OPERANDS((0, getEnvironmentChain), (1, getString), (2, getNewTargetValue)) + + static MCallDirectEval* + New(TempAllocator& alloc, MDefinition* envChain, MDefinition* string, + MDefinition* newTargetValue, jsbytecode* pc) + { + return new(alloc) MCallDirectEval(envChain, string, newTargetValue, pc); + } + + jsbytecode* pc() const { + return pc_; + } + + bool possiblyCalls() const override { + return true; + } + + private: + jsbytecode* pc_; +}; + +class MCompare + : public MBinaryInstruction, + public ComparePolicy::Data +{ + public: + enum CompareType { + + // Anything compared to Undefined + Compare_Undefined, + + // Anything compared to Null + Compare_Null, + + // Undefined compared to Boolean + // Null compared to Boolean + // Double compared to Boolean + // String compared to Boolean + // Symbol compared to Boolean + // Object compared to Boolean + // Value compared to Boolean + Compare_Boolean, + + // Int32 compared to Int32 + // Boolean compared to Boolean + Compare_Int32, + Compare_Int32MaybeCoerceBoth, + Compare_Int32MaybeCoerceLHS, + Compare_Int32MaybeCoerceRHS, + + // Int32 compared as unsigneds + Compare_UInt32, + + // Int64 compared to Int64. + Compare_Int64, + + // Int64 compared as unsigneds. + Compare_UInt64, + + // Double compared to Double + Compare_Double, + + Compare_DoubleMaybeCoerceLHS, + Compare_DoubleMaybeCoerceRHS, + + // Float compared to Float + Compare_Float32, + + // String compared to String + Compare_String, + + // Undefined compared to String + // Null compared to String + // Boolean compared to String + // Int32 compared to String + // Double compared to String + // Object compared to String + // Value compared to String + Compare_StrictString, + + // Object compared to Object + Compare_Object, + + // Compare 2 values bitwise + Compare_Bitwise, + + // All other possible compares + Compare_Unknown + }; + + private: + CompareType compareType_; + JSOp jsop_; + bool operandMightEmulateUndefined_; + bool operandsAreNeverNaN_; + + // When a floating-point comparison is converted to an integer comparison + // (when range analysis proves it safe), we need to convert the operands + // to integer as well. + bool truncateOperands_; + + MCompare(MDefinition* left, MDefinition* right, JSOp jsop) + : MBinaryInstruction(left, right), + compareType_(Compare_Unknown), + jsop_(jsop), + operandMightEmulateUndefined_(true), + operandsAreNeverNaN_(false), + truncateOperands_(false) + { + setResultType(MIRType::Boolean); + setMovable(); + } + + MCompare(MDefinition* left, MDefinition* right, JSOp jsop, CompareType compareType) + : MCompare(left, right, jsop) + { + MOZ_ASSERT(compareType == Compare_Int32 || compareType == Compare_UInt32 || + compareType == Compare_Int64 || compareType == Compare_UInt64 || + compareType == Compare_Double || compareType == Compare_Float32); + compareType_ = compareType; + operandMightEmulateUndefined_ = false; + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(Compare) + TRIVIAL_NEW_WRAPPERS + + MOZ_MUST_USE bool tryFold(bool* result); + MOZ_MUST_USE bool evaluateConstantOperands(TempAllocator& alloc, bool* result); + MDefinition* foldsTo(TempAllocator& alloc) override; + void filtersUndefinedOrNull(bool trueBranch, MDefinition** subject, bool* filtersUndefined, + bool* filtersNull); + + CompareType compareType() const { + return compareType_; + } + bool isInt32Comparison() const { + return compareType() == Compare_Int32 || + compareType() == Compare_Int32MaybeCoerceBoth || + compareType() == Compare_Int32MaybeCoerceLHS || + compareType() == Compare_Int32MaybeCoerceRHS; + } + bool isDoubleComparison() const { + return compareType() == Compare_Double || + compareType() == Compare_DoubleMaybeCoerceLHS || + compareType() == Compare_DoubleMaybeCoerceRHS; + } + bool isFloat32Comparison() const { + return compareType() == Compare_Float32; + } + bool isNumericComparison() const { + return isInt32Comparison() || + isDoubleComparison() || + isFloat32Comparison(); + } + void setCompareType(CompareType type) { + compareType_ = type; + } + MIRType inputType(); + + JSOp jsop() const { + return jsop_; + } + void markNoOperandEmulatesUndefined() { + operandMightEmulateUndefined_ = false; + } + bool operandMightEmulateUndefined() const { + return operandMightEmulateUndefined_; + } + bool operandsAreNeverNaN() const { + return operandsAreNeverNaN_; + } + AliasSet getAliasSet() const override { + // Strict equality is never effectful. + if (jsop_ == JSOP_STRICTEQ || jsop_ == JSOP_STRICTNE) + return AliasSet::None(); + if (compareType_ == Compare_Unknown) + return AliasSet::Store(AliasSet::Any); + MOZ_ASSERT(compareType_ <= Compare_Bitwise); + return AliasSet::None(); + } + + void printOpcode(GenericPrinter& out) const override; + void collectRangeInfoPreTrunc() override; + + void trySpecializeFloat32(TempAllocator& alloc) override; + bool isFloat32Commutative() const override { return true; } + bool needTruncation(TruncateKind kind) override; + void truncate() override; + TruncateKind operandTruncateKind(size_t index) const override; + + static CompareType determineCompareType(JSOp op, MDefinition* left, MDefinition* right); + void cacheOperandMightEmulateUndefined(CompilerConstraintList* constraints); + +# ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + // Both sides of the compare can be Float32 + return compareType_ == Compare_Float32; + } +# endif + + ALLOW_CLONE(MCompare) + + protected: + MOZ_MUST_USE bool tryFoldEqualOperands(bool* result); + MOZ_MUST_USE bool tryFoldTypeOf(bool* result); + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + return compareType() == ins->toCompare()->compareType() && + jsop() == ins->toCompare()->jsop(); + } +}; + +// Takes a typed value and returns an untyped value. +class MBox + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + MBox(TempAllocator& alloc, MDefinition* ins) + : MUnaryInstruction(ins) + { + setResultType(MIRType::Value); + if (ins->resultTypeSet()) { + setResultTypeSet(ins->resultTypeSet()); + } else if (ins->type() != MIRType::Value) { + TypeSet::Type ntype = ins->type() == MIRType::Object + ? TypeSet::AnyObjectType() + : TypeSet::PrimitiveType(ValueTypeFromMIRType(ins->type())); + setResultTypeSet(alloc.lifoAlloc()->new_<TemporaryTypeSet>(alloc.lifoAlloc(), ntype)); + } + setMovable(); + } + + public: + INSTRUCTION_HEADER(Box) + static MBox* New(TempAllocator& alloc, MDefinition* ins) + { + // Cannot box a box. + MOZ_ASSERT(ins->type() != MIRType::Value); + + return new(alloc) MBox(alloc, ins); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MBox) +}; + +// Note: the op may have been inverted during lowering (to put constants in a +// position where they can be immediates), so it is important to use the +// lir->jsop() instead of the mir->jsop() when it is present. +static inline Assembler::Condition +JSOpToCondition(MCompare::CompareType compareType, JSOp op) +{ + bool isSigned = (compareType != MCompare::Compare_UInt32); + return JSOpToCondition(op, isSigned); +} + +// Takes a typed value and checks if it is a certain type. If so, the payload +// is unpacked and returned as that type. Otherwise, it is considered a +// deoptimization. +class MUnbox final : public MUnaryInstruction, public BoxInputsPolicy::Data +{ + public: + enum Mode { + Fallible, // Check the type, and deoptimize if unexpected. + Infallible, // Type guard is not necessary. + TypeBarrier // Guard on the type, and act like a TypeBarrier on failure. + }; + + private: + Mode mode_; + BailoutKind bailoutKind_; + + MUnbox(MDefinition* ins, MIRType type, Mode mode, BailoutKind kind, TempAllocator& alloc) + : MUnaryInstruction(ins), + mode_(mode) + { + // Only allow unboxing a non MIRType::Value when input and output types + // don't match. This is often used to force a bailout. Boxing happens + // during type analysis. + MOZ_ASSERT_IF(ins->type() != MIRType::Value, type != ins->type()); + + MOZ_ASSERT(type == MIRType::Boolean || + type == MIRType::Int32 || + type == MIRType::Double || + type == MIRType::String || + type == MIRType::Symbol || + type == MIRType::Object); + + TemporaryTypeSet* resultSet = ins->resultTypeSet(); + if (resultSet && type == MIRType::Object) + resultSet = resultSet->cloneObjectsOnly(alloc.lifoAlloc()); + + setResultType(type); + setResultTypeSet(resultSet); + setMovable(); + + if (mode_ == TypeBarrier || mode_ == Fallible) + setGuard(); + + bailoutKind_ = kind; + } + public: + INSTRUCTION_HEADER(Unbox) + static MUnbox* New(TempAllocator& alloc, MDefinition* ins, MIRType type, Mode mode) + { + // Unless we were given a specific BailoutKind, pick a default based on + // the type we expect. + BailoutKind kind; + switch (type) { + case MIRType::Boolean: + kind = Bailout_NonBooleanInput; + break; + case MIRType::Int32: + kind = Bailout_NonInt32Input; + break; + case MIRType::Double: + kind = Bailout_NonNumericInput; // Int32s are fine too + break; + case MIRType::String: + kind = Bailout_NonStringInput; + break; + case MIRType::Symbol: + kind = Bailout_NonSymbolInput; + break; + case MIRType::Object: + kind = Bailout_NonObjectInput; + break; + default: + MOZ_CRASH("Given MIRType cannot be unboxed."); + } + + return new(alloc) MUnbox(ins, type, mode, kind, alloc); + } + + static MUnbox* New(TempAllocator& alloc, MDefinition* ins, MIRType type, Mode mode, + BailoutKind kind) + { + return new(alloc) MUnbox(ins, type, mode, kind, alloc); + } + + Mode mode() const { + return mode_; + } + BailoutKind bailoutKind() const { + // If infallible, no bailout should be generated. + MOZ_ASSERT(fallible()); + return bailoutKind_; + } + bool fallible() const { + return mode() != Infallible; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isUnbox() || ins->toUnbox()->mode() != mode()) + return false; + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void printOpcode(GenericPrinter& out) const override; + void makeInfallible() { + // Should only be called if we're already Infallible or TypeBarrier + MOZ_ASSERT(mode() != Fallible); + mode_ = Infallible; + } + + ALLOW_CLONE(MUnbox) +}; + +class MGuardObject + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MGuardObject(MDefinition* ins) + : MUnaryInstruction(ins) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + setResultTypeSet(ins->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(GuardObject) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MGuardString + : public MUnaryInstruction, + public StringPolicy<0>::Data +{ + explicit MGuardString(MDefinition* ins) + : MUnaryInstruction(ins) + { + setGuard(); + setMovable(); + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(GuardString) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MPolyInlineGuard + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MPolyInlineGuard(MDefinition* ins) + : MUnaryInstruction(ins) + { + setGuard(); + setResultType(MIRType::Object); + setResultTypeSet(ins->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(PolyInlineGuard) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MAssertRange + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + // This is the range checked by the assertion. Don't confuse this with the + // range_ member or the range() accessor. Since MAssertRange doesn't return + // a value, it doesn't use those. + const Range* assertedRange_; + + MAssertRange(MDefinition* ins, const Range* assertedRange) + : MUnaryInstruction(ins), assertedRange_(assertedRange) + { + setGuard(); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(AssertRange) + TRIVIAL_NEW_WRAPPERS + + const Range* assertedRange() const { + return assertedRange_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void printOpcode(GenericPrinter& out) const override; +}; + +// Caller-side allocation of |this| for |new|: +// Given a templateobject, construct |this| for JSOP_NEW +class MCreateThisWithTemplate + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + gc::InitialHeap initialHeap_; + + MCreateThisWithTemplate(CompilerConstraintList* constraints, MConstant* templateConst, + gc::InitialHeap initialHeap) + : MUnaryInstruction(templateConst), + initialHeap_(initialHeap) + { + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject())); + } + + public: + INSTRUCTION_HEADER(CreateThisWithTemplate) + TRIVIAL_NEW_WRAPPERS + + // Template for |this|, provided by TI. + JSObject* templateObject() const { + return &getOperand(0)->toConstant()->toObject(); + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + // Although creation of |this| modifies global state, it is safely repeatable. + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override; +}; + +// Caller-side allocation of |this| for |new|: +// Given a prototype operand, construct |this| for JSOP_NEW. +class MCreateThisWithProto + : public MTernaryInstruction, + public Mix3Policy<ObjectPolicy<0>, ObjectPolicy<1>, ObjectPolicy<2> >::Data +{ + MCreateThisWithProto(MDefinition* callee, MDefinition* newTarget, MDefinition* prototype) + : MTernaryInstruction(callee, newTarget, prototype) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(CreateThisWithProto) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getCallee), (1, getNewTarget), (2, getPrototype)) + + // Although creation of |this| modifies global state, it is safely repeatable. + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } +}; + +// Caller-side allocation of |this| for |new|: +// Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING). +class MCreateThis + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data +{ + explicit MCreateThis(MDefinition* callee, MDefinition* newTarget) + : MBinaryInstruction(callee, newTarget) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(CreateThis) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getCallee), (1, getNewTarget)) + + // Although creation of |this| modifies global state, it is safely repeatable. + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } +}; + +// Eager initialization of arguments object. +class MCreateArgumentsObject + : public MUnaryInstruction, + public ObjectPolicy<0>::Data +{ + CompilerGCPointer<ArgumentsObject*> templateObj_; + + MCreateArgumentsObject(MDefinition* callObj, ArgumentsObject* templateObj) + : MUnaryInstruction(callObj), + templateObj_(templateObj) + { + setResultType(MIRType::Object); + setGuard(); + } + + public: + INSTRUCTION_HEADER(CreateArgumentsObject) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getCallObject)) + + ArgumentsObject* templateObject() const { + return templateObj_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool possiblyCalls() const override { + return true; + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObj_); + } +}; + +class MGetArgumentsObjectArg + : public MUnaryInstruction, + public ObjectPolicy<0>::Data +{ + size_t argno_; + + MGetArgumentsObjectArg(MDefinition* argsObject, size_t argno) + : MUnaryInstruction(argsObject), + argno_(argno) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(GetArgumentsObjectArg) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getArgsObject)) + + size_t argno() const { + return argno_; + } + + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::Any); + } +}; + +class MSetArgumentsObjectArg + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >::Data +{ + size_t argno_; + + MSetArgumentsObjectArg(MDefinition* argsObj, size_t argno, MDefinition* value) + : MBinaryInstruction(argsObj, value), + argno_(argno) + { + } + + public: + INSTRUCTION_HEADER(SetArgumentsObjectArg) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getArgsObject), (1, getValue)) + + size_t argno() const { + return argno_; + } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::Any); + } +}; + +class MRunOncePrologue + : public MNullaryInstruction +{ + protected: + MRunOncePrologue() + { + setGuard(); + } + + public: + INSTRUCTION_HEADER(RunOncePrologue) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } +}; + +// Given a MIRType::Value A and a MIRType::Object B: +// If the Value may be safely unboxed to an Object, return Object(A). +// Otherwise, return B. +// Used to implement return behavior for inlined constructors. +class MReturnFromCtor + : public MAryInstruction<2>, + public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >::Data +{ + MReturnFromCtor(MDefinition* value, MDefinition* object) { + initOperand(0, value); + initOperand(1, object); + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(ReturnFromCtor) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, getValue), (1, getObject)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MToFPInstruction + : public MUnaryInstruction, + public ToDoublePolicy::Data +{ + public: + // Types of values which can be converted. + enum ConversionKind { + NonStringPrimitives, + NonNullNonStringPrimitives, + NumbersOnly + }; + + private: + ConversionKind conversion_; + + protected: + explicit MToFPInstruction(MDefinition* def, ConversionKind conversion = NonStringPrimitives) + : MUnaryInstruction(def), conversion_(conversion) + { } + + public: + ConversionKind conversion() const { + return conversion_; + } +}; + +// Converts a primitive (either typed or untyped) to a double. If the input is +// not primitive at runtime, a bailout occurs. +class MToDouble + : public MToFPInstruction +{ + private: + TruncateKind implicitTruncate_; + + explicit MToDouble(MDefinition* def, ConversionKind conversion = NonStringPrimitives) + : MToFPInstruction(def, conversion), implicitTruncate_(NoTruncate) + { + setResultType(MIRType::Double); + setMovable(); + + // An object might have "valueOf", which means it is effectful. + // ToNumber(symbol) throws. + if (def->mightBeType(MIRType::Object) || def->mightBeType(MIRType::Symbol)) + setGuard(); + } + + public: + INSTRUCTION_HEADER(ToDouble) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isToDouble() || ins->toToDouble()->conversion() != conversion()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + TruncateKind operandTruncateKind(size_t index) const override; + +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { return true; } +#endif + + TruncateKind truncateKind() const { + return implicitTruncate_; + } + void setTruncateKind(TruncateKind kind) { + implicitTruncate_ = Max(implicitTruncate_, kind); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + if (input()->type() == MIRType::Value) + return false; + if (input()->type() == MIRType::Symbol) + return false; + + return true; + } + + ALLOW_CLONE(MToDouble) +}; + +// Converts a primitive (either typed or untyped) to a float32. If the input is +// not primitive at runtime, a bailout occurs. +class MToFloat32 + : public MToFPInstruction +{ + protected: + bool mustPreserveNaN_; + + explicit MToFloat32(MDefinition* def, ConversionKind conversion = NonStringPrimitives) + : MToFPInstruction(def, conversion), + mustPreserveNaN_(false) + { + setResultType(MIRType::Float32); + setMovable(); + + // An object might have "valueOf", which means it is effectful. + // ToNumber(symbol) throws. + if (def->mightBeType(MIRType::Object) || def->mightBeType(MIRType::Symbol)) + setGuard(); + } + + explicit MToFloat32(MDefinition* def, bool mustPreserveNaN) + : MToFloat32(def) + { + mustPreserveNaN_ = mustPreserveNaN; + } + + public: + INSTRUCTION_HEADER(ToFloat32) + TRIVIAL_NEW_WRAPPERS + + virtual MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + auto* other = ins->toToFloat32(); + return other->conversion() == conversion() && + other->mustPreserveNaN_ == mustPreserveNaN_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + + bool canConsumeFloat32(MUse* use) const override { return true; } + bool canProduceFloat32() const override { return true; } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MToFloat32) +}; + +// Converts a uint32 to a double (coming from wasm). +class MWasmUnsignedToDouble + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MWasmUnsignedToDouble(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::Double); + setMovable(); + } + + public: + INSTRUCTION_HEADER(WasmUnsignedToDouble) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Converts a uint32 to a float32 (coming from wasm). +class MWasmUnsignedToFloat32 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MWasmUnsignedToFloat32(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::Float32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(WasmUnsignedToFloat32) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool canProduceFloat32() const override { return true; } +}; + +class MWrapInt64ToInt32 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool bottomHalf_; + + explicit MWrapInt64ToInt32(MDefinition* def, bool bottomHalf = true) + : MUnaryInstruction(def), + bottomHalf_(bottomHalf) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(WrapInt64ToInt32) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isWrapInt64ToInt32()) + return false; + if (ins->toWrapInt64ToInt32()->bottomHalf() != bottomHalf()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool bottomHalf() const { + return bottomHalf_; + } +}; + +class MExtendInt32ToInt64 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool isUnsigned_; + + MExtendInt32ToInt64(MDefinition* def, bool isUnsigned) + : MUnaryInstruction(def), + isUnsigned_(isUnsigned) + { + setResultType(MIRType::Int64); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ExtendInt32ToInt64) + TRIVIAL_NEW_WRAPPERS + + bool isUnsigned() const { return isUnsigned_; } + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isExtendInt32ToInt64()) + return false; + if (ins->toExtendInt32ToInt64()->isUnsigned_ != isUnsigned_) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MWasmTruncateToInt64 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool isUnsigned_; + wasm::TrapOffset trapOffset_; + + MWasmTruncateToInt64(MDefinition* def, bool isUnsigned, wasm::TrapOffset trapOffset) + : MUnaryInstruction(def), + isUnsigned_(isUnsigned), + trapOffset_(trapOffset) + { + setResultType(MIRType::Int64); + setGuard(); // neither removable nor movable because of possible side-effects. + } + + public: + INSTRUCTION_HEADER(WasmTruncateToInt64) + TRIVIAL_NEW_WRAPPERS + + bool isUnsigned() const { return isUnsigned_; } + wasm::TrapOffset trapOffset() const { return trapOffset_; } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && + ins->toWasmTruncateToInt64()->isUnsigned() == isUnsigned_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Truncate a value to an int32, with wasm semantics: this will trap when the +// value is out of range. +class MWasmTruncateToInt32 + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool isUnsigned_; + wasm::TrapOffset trapOffset_; + + explicit MWasmTruncateToInt32(MDefinition* def, bool isUnsigned, wasm::TrapOffset trapOffset) + : MUnaryInstruction(def), isUnsigned_(isUnsigned), trapOffset_(trapOffset) + { + setResultType(MIRType::Int32); + setGuard(); // neither removable nor movable because of possible side-effects. + } + + public: + INSTRUCTION_HEADER(WasmTruncateToInt32) + TRIVIAL_NEW_WRAPPERS + + bool isUnsigned() const { + return isUnsigned_; + } + wasm::TrapOffset trapOffset() const { + return trapOffset_; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && + ins->toWasmTruncateToInt32()->isUnsigned() == isUnsigned_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MInt64ToFloatingPoint + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool isUnsigned_; + + MInt64ToFloatingPoint(MDefinition* def, MIRType type, bool isUnsigned) + : MUnaryInstruction(def), + isUnsigned_(isUnsigned) + { + MOZ_ASSERT(IsFloatingPointType(type)); + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Int64ToFloatingPoint) + TRIVIAL_NEW_WRAPPERS + + bool isUnsigned() const { return isUnsigned_; } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isInt64ToFloatingPoint()) + return false; + if (ins->toInt64ToFloatingPoint()->isUnsigned_ != isUnsigned_) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Converts a primitive (either typed or untyped) to an int32. If the input is +// not primitive at runtime, a bailout occurs. If the input cannot be converted +// to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs. +class MToInt32 + : public MUnaryInstruction, + public ToInt32Policy::Data +{ + bool canBeNegativeZero_; + MacroAssembler::IntConversionInputKind conversion_; + + explicit MToInt32(MDefinition* def, MacroAssembler::IntConversionInputKind conversion = + MacroAssembler::IntConversion_Any) + : MUnaryInstruction(def), + canBeNegativeZero_(true), + conversion_(conversion) + { + setResultType(MIRType::Int32); + setMovable(); + + // An object might have "valueOf", which means it is effectful. + // ToNumber(symbol) throws. + if (def->mightBeType(MIRType::Object) || def->mightBeType(MIRType::Symbol)) + setGuard(); + } + + public: + INSTRUCTION_HEADER(ToInt32) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + // this only has backwards information flow. + void analyzeEdgeCasesBackward() override; + + bool canBeNegativeZero() const { + return canBeNegativeZero_; + } + void setCanBeNegativeZero(bool negativeZero) { + canBeNegativeZero_ = negativeZero; + } + + MacroAssembler::IntConversionInputKind conversion() const { + return conversion_; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isToInt32() || ins->toToInt32()->conversion() != conversion()) + return false; + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + void collectRangeInfoPreTrunc() override; + +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { return true; } +#endif + + ALLOW_CLONE(MToInt32) +}; + +// Converts a value or typed input to a truncated int32, for use with bitwise +// operations. This is an infallible ValueToECMAInt32. +class MTruncateToInt32 + : public MUnaryInstruction, + public ToInt32Policy::Data +{ + explicit MTruncateToInt32(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::Int32); + setMovable(); + + // An object might have "valueOf", which means it is effectful. + // ToInt32(symbol) throws. + if (def->mightBeType(MIRType::Object) || def->mightBeType(MIRType::Symbol)) + setGuard(); + } + + public: + INSTRUCTION_HEADER(TruncateToInt32) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + TruncateKind operandTruncateKind(size_t index) const override; +# ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return input()->type() < MIRType::Symbol; + } + + ALLOW_CLONE(MTruncateToInt32) +}; + +// Converts any type to a string +class MToString : + public MUnaryInstruction, + public ToStringPolicy::Data +{ + explicit MToString(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::String); + setMovable(); + + // Objects might override toString and Symbols throw. + if (def->mightBeType(MIRType::Object) || def->mightBeType(MIRType::Symbol)) + setGuard(); + } + + public: + INSTRUCTION_HEADER(ToString) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool fallible() const { + return input()->mightBeType(MIRType::Object); + } + + ALLOW_CLONE(MToString) +}; + +// Converts any type to an object or null value, throwing on undefined. +class MToObjectOrNull : + public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MToObjectOrNull(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::ObjectOrNull); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ToObjectOrNull) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MToObjectOrNull) +}; + +class MBitNot + : public MUnaryInstruction, + public BitwisePolicy::Data +{ + protected: + explicit MBitNot(MDefinition* input) + : MUnaryInstruction(input) + { + specialization_ = MIRType::None; + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(BitNot) + TRIVIAL_NEW_WRAPPERS + + static MBitNot* NewInt32(TempAllocator& alloc, MDefinition* input); + + MDefinition* foldsTo(TempAllocator& alloc) override; + void setSpecialization(MIRType type) { + specialization_ = type; + setResultType(type); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + if (specialization_ == MIRType::None) + return AliasSet::Store(AliasSet::Any); + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ != MIRType::None; + } + + ALLOW_CLONE(MBitNot) +}; + +class MTypeOf + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + MIRType inputType_; + bool inputMaybeCallableOrEmulatesUndefined_; + + MTypeOf(MDefinition* def, MIRType inputType) + : MUnaryInstruction(def), inputType_(inputType), + inputMaybeCallableOrEmulatesUndefined_(true) + { + setResultType(MIRType::String); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypeOf) + TRIVIAL_NEW_WRAPPERS + + MIRType inputType() const { + return inputType_; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void cacheInputMaybeCallableOrEmulatesUndefined(CompilerConstraintList* constraints); + + bool inputMaybeCallableOrEmulatesUndefined() const { + return inputMaybeCallableOrEmulatesUndefined_; + } + void markInputNotCallableOrEmulatesUndefined() { + inputMaybeCallableOrEmulatesUndefined_ = false; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isTypeOf()) + return false; + if (inputType() != ins->toTypeOf()->inputType()) + return false; + if (inputMaybeCallableOrEmulatesUndefined() != + ins->toTypeOf()->inputMaybeCallableOrEmulatesUndefined()) + { + return false; + } + return congruentIfOperandsEqual(ins); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +class MToAsync + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MToAsync(MDefinition* unwrapped) + : MUnaryInstruction(unwrapped) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(ToAsync) + TRIVIAL_NEW_WRAPPERS +}; + +class MToId + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MToId(MDefinition* index) + : MUnaryInstruction(index) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(ToId) + TRIVIAL_NEW_WRAPPERS +}; + +class MBinaryBitwiseInstruction + : public MBinaryInstruction, + public BitwisePolicy::Data +{ + protected: + MBinaryBitwiseInstruction(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryInstruction(left, right), maskMatchesLeftRange(false), + maskMatchesRightRange(false) + { + MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Int64); + setResultType(type); + setMovable(); + } + + void specializeAs(MIRType type); + bool maskMatchesLeftRange; + bool maskMatchesRightRange; + + public: + MDefinition* foldsTo(TempAllocator& alloc) override; + MDefinition* foldUnnecessaryBitop(); + virtual MDefinition* foldIfZero(size_t operand) = 0; + virtual MDefinition* foldIfNegOne(size_t operand) = 0; + virtual MDefinition* foldIfEqual() = 0; + virtual MDefinition* foldIfAllBitsSet(size_t operand) = 0; + virtual void infer(BaselineInspector* inspector, jsbytecode* pc); + void collectRangeInfoPreTrunc() override; + + void setInt32Specialization() { + specialization_ = MIRType::Int32; + setResultType(MIRType::Int32); + } + + bool congruentTo(const MDefinition* ins) const override { + return binaryCongruentTo(ins); + } + AliasSet getAliasSet() const override { + if (specialization_ >= MIRType::Object) + return AliasSet::Store(AliasSet::Any); + return AliasSet::None(); + } + + TruncateKind operandTruncateKind(size_t index) const override; +}; + +class MBitAnd : public MBinaryBitwiseInstruction +{ + MBitAnd(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryBitwiseInstruction(left, right, type) + { } + + public: + INSTRUCTION_HEADER(BitAnd) + static MBitAnd* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MBitAnd* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + return getOperand(operand); // 0 & x => 0; + } + MDefinition* foldIfNegOne(size_t operand) override { + return getOperand(1 - operand); // x & -1 => x + } + MDefinition* foldIfEqual() override { + return getOperand(0); // x & x => x; + } + MDefinition* foldIfAllBitsSet(size_t operand) override { + // e.g. for uint16: x & 0xffff => x; + return getOperand(1 - operand); + } + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ != MIRType::None; + } + + ALLOW_CLONE(MBitAnd) +}; + +class MBitOr : public MBinaryBitwiseInstruction +{ + MBitOr(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryBitwiseInstruction(left, right, type) + { } + + public: + INSTRUCTION_HEADER(BitOr) + static MBitOr* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MBitOr* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + return getOperand(1 - operand); // 0 | x => x, so if ith is 0, return (1-i)th + } + MDefinition* foldIfNegOne(size_t operand) override { + return getOperand(operand); // x | -1 => -1 + } + MDefinition* foldIfEqual() override { + return getOperand(0); // x | x => x + } + MDefinition* foldIfAllBitsSet(size_t operand) override { + return this; + } + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ != MIRType::None; + } + + ALLOW_CLONE(MBitOr) +}; + +class MBitXor : public MBinaryBitwiseInstruction +{ + MBitXor(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryBitwiseInstruction(left, right, type) + { } + + public: + INSTRUCTION_HEADER(BitXor) + static MBitXor* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MBitXor* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + return getOperand(1 - operand); // 0 ^ x => x + } + MDefinition* foldIfNegOne(size_t operand) override { + return this; + } + MDefinition* foldIfEqual() override { + return this; + } + MDefinition* foldIfAllBitsSet(size_t operand) override { + return this; + } + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + ALLOW_CLONE(MBitXor) +}; + +class MShiftInstruction + : public MBinaryBitwiseInstruction +{ + protected: + MShiftInstruction(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryBitwiseInstruction(left, right, type) + { } + + public: + MDefinition* foldIfNegOne(size_t operand) override { + return this; + } + MDefinition* foldIfEqual() override { + return this; + } + MDefinition* foldIfAllBitsSet(size_t operand) override { + return this; + } + virtual void infer(BaselineInspector* inspector, jsbytecode* pc) override; +}; + +class MLsh : public MShiftInstruction +{ + MLsh(MDefinition* left, MDefinition* right, MIRType type) + : MShiftInstruction(left, right, type) + { } + + public: + INSTRUCTION_HEADER(Lsh) + static MLsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MLsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + // 0 << x => 0 + // x << 0 => x + return getOperand(0); + } + + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ != MIRType::None; + } + + ALLOW_CLONE(MLsh) +}; + +class MRsh : public MShiftInstruction +{ + MRsh(MDefinition* left, MDefinition* right, MIRType type) + : MShiftInstruction(left, right, type) + { } + + public: + INSTRUCTION_HEADER(Rsh) + static MRsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MRsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + // 0 >> x => 0 + // x >> 0 => x + return getOperand(0); + } + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MRsh) +}; + +class MUrsh : public MShiftInstruction +{ + bool bailoutsDisabled_; + + MUrsh(MDefinition* left, MDefinition* right, MIRType type) + : MShiftInstruction(left, right, type), + bailoutsDisabled_(false) + { } + + public: + INSTRUCTION_HEADER(Ursh) + static MUrsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right); + static MUrsh* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type); + + MDefinition* foldIfZero(size_t operand) override { + // 0 >>> x => 0 + if (operand == 0) + return getOperand(0); + + return this; + } + + void infer(BaselineInspector* inspector, jsbytecode* pc) override; + + bool bailoutsDisabled() const { + return bailoutsDisabled_; + } + + bool fallible() const; + + void computeRange(TempAllocator& alloc) override; + void collectRangeInfoPreTrunc() override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + ALLOW_CLONE(MUrsh) +}; + +class MSignExtend + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + public: + enum Mode { + Byte, + Half + }; + + private: + Mode mode_; + + MSignExtend(MDefinition* op, Mode mode) + : MUnaryInstruction(op), mode_(mode) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(SignExtend) + TRIVIAL_NEW_WRAPPERS + + Mode mode() { return mode_; } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MSignExtend) +}; + +class MBinaryArithInstruction + : public MBinaryInstruction, + public ArithPolicy::Data +{ + // Implicit truncate flag is set by the truncate backward range analysis + // optimization phase, and by wasm pre-processing. It is used in + // NeedNegativeZeroCheck to check if the result of a multiplication needs to + // produce -0 double value, and for avoiding overflow checks. + + // This optimization happens when the multiplication cannot be truncated + // even if all uses are truncating its result, such as when the range + // analysis detect a precision loss in the multiplication. + TruncateKind implicitTruncate_; + + // Whether we must preserve NaN semantics, and in particular not fold + // (x op id) or (id op x) to x, or replace a division by a multiply of the + // exact reciprocal. + bool mustPreserveNaN_; + + public: + MBinaryArithInstruction(MDefinition* left, MDefinition* right) + : MBinaryInstruction(left, right), + implicitTruncate_(NoTruncate), + mustPreserveNaN_(false) + { + specialization_ = MIRType::None; + setMovable(); + } + + static MBinaryArithInstruction* New(TempAllocator& alloc, Opcode op, + MDefinition* left, MDefinition* right); + + bool constantDoubleResult(TempAllocator& alloc); + + void setMustPreserveNaN(bool b) { mustPreserveNaN_ = b; } + bool mustPreserveNaN() const { return mustPreserveNaN_; } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void printOpcode(GenericPrinter& out) const override; + + virtual double getIdentity() = 0; + + void setSpecialization(MIRType type) { + specialization_ = type; + setResultType(type); + } + void setInt32Specialization() { + specialization_ = MIRType::Int32; + setResultType(MIRType::Int32); + } + void setNumberSpecialization(TempAllocator& alloc, BaselineInspector* inspector, jsbytecode* pc); + + virtual void trySpecializeFloat32(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + if (!binaryCongruentTo(ins)) + return false; + const auto* other = static_cast<const MBinaryArithInstruction*>(ins); + return other->mustPreserveNaN_ == mustPreserveNaN_; + } + AliasSet getAliasSet() const override { + if (specialization_ >= MIRType::Object) + return AliasSet::Store(AliasSet::Any); + return AliasSet::None(); + } + + bool isTruncated() const { + return implicitTruncate_ == Truncate; + } + TruncateKind truncateKind() const { + return implicitTruncate_; + } + void setTruncateKind(TruncateKind kind) { + implicitTruncate_ = Max(implicitTruncate_, kind); + } +}; + +class MMinMax + : public MBinaryInstruction, + public ArithPolicy::Data +{ + bool isMax_; + + MMinMax(MDefinition* left, MDefinition* right, MIRType type, bool isMax) + : MBinaryInstruction(left, right), + isMax_(isMax) + { + MOZ_ASSERT(IsNumberType(type)); + setResultType(type); + setMovable(); + specialization_ = type; + } + + public: + INSTRUCTION_HEADER(MinMax) + TRIVIAL_NEW_WRAPPERS + + static MMinMax* NewWasm(TempAllocator& alloc, MDefinition* left, MDefinition* right, + MIRType type, bool isMax) + { + return New(alloc, left, right, type, isMax); + } + + bool isMax() const { + return isMax_; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + const MMinMax* other = ins->toMinMax(); + return other->isMax() == isMax(); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + MDefinition* foldsTo(TempAllocator& alloc) override; + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + bool isFloat32Commutative() const override { return true; } + void trySpecializeFloat32(TempAllocator& alloc) override; + + ALLOW_CLONE(MMinMax) +}; + +class MAbs + : public MUnaryInstruction, + public ArithPolicy::Data +{ + bool implicitTruncate_; + + MAbs(MDefinition* num, MIRType type) + : MUnaryInstruction(num), + implicitTruncate_(false) + { + MOZ_ASSERT(IsNumberType(type)); + setResultType(type); + setMovable(); + specialization_ = type; + } + + public: + INSTRUCTION_HEADER(Abs) + TRIVIAL_NEW_WRAPPERS + + static MAbs* NewWasm(TempAllocator& alloc, MDefinition* num, MIRType type) { + auto* ins = new(alloc) MAbs(num, type); + if (type == MIRType::Int32) + ins->implicitTruncate_ = true; + return ins; + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + bool fallible() const; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + bool isFloat32Commutative() const override { return true; } + void trySpecializeFloat32(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MAbs) +}; + +class MClz + : public MUnaryInstruction + , public BitwisePolicy::Data +{ + bool operandIsNeverZero_; + + explicit MClz(MDefinition* num, MIRType type) + : MUnaryInstruction(num), + operandIsNeverZero_(false) + { + MOZ_ASSERT(IsIntType(type)); + MOZ_ASSERT(IsNumberType(num->type())); + specialization_ = type; + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Clz) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, num)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool operandIsNeverZero() const { + return operandIsNeverZero_; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void computeRange(TempAllocator& alloc) override; + void collectRangeInfoPreTrunc() override; +}; + +class MCtz + : public MUnaryInstruction + , public BitwisePolicy::Data +{ + bool operandIsNeverZero_; + + explicit MCtz(MDefinition* num, MIRType type) + : MUnaryInstruction(num), + operandIsNeverZero_(false) + { + MOZ_ASSERT(IsIntType(type)); + MOZ_ASSERT(IsNumberType(num->type())); + specialization_ = type; + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Ctz) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, num)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool operandIsNeverZero() const { + return operandIsNeverZero_; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void computeRange(TempAllocator& alloc) override; + void collectRangeInfoPreTrunc() override; +}; + +class MPopcnt + : public MUnaryInstruction + , public BitwisePolicy::Data +{ + explicit MPopcnt(MDefinition* num, MIRType type) + : MUnaryInstruction(num) + { + MOZ_ASSERT(IsNumberType(num->type())); + MOZ_ASSERT(IsIntType(type)); + specialization_ = type; + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Popcnt) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, num)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void computeRange(TempAllocator& alloc) override; +}; + +// Inline implementation of Math.sqrt(). +class MSqrt + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + MSqrt(MDefinition* num, MIRType type) + : MUnaryInstruction(num) + { + setResultType(type); + specialization_ = type; + setMovable(); + } + + public: + INSTRUCTION_HEADER(Sqrt) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + + bool isFloat32Commutative() const override { return true; } + void trySpecializeFloat32(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MSqrt) +}; + +class MCopySign + : public MBinaryInstruction, + public NoTypePolicy::Data +{ + MCopySign(MDefinition* lhs, MDefinition* rhs, MIRType type) + : MBinaryInstruction(lhs, rhs) + { + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(CopySign) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MCopySign) +}; + +// Inline implementation of atan2 (arctangent of y/x). +class MAtan2 + : public MBinaryInstruction, + public MixPolicy<DoublePolicy<0>, DoublePolicy<1> >::Data +{ + MAtan2(MDefinition* y, MDefinition* x) + : MBinaryInstruction(y, x) + { + setResultType(MIRType::Double); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Atan2) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, y), (1, x)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool possiblyCalls() const override { + return true; + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MAtan2) +}; + +// Inline implementation of Math.hypot(). +class MHypot + : public MVariadicInstruction, + public AllDoublePolicy::Data +{ + MHypot() + { + setResultType(MIRType::Double); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Hypot) + static MHypot* New(TempAllocator& alloc, const MDefinitionVector& vector); + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool possiblyCalls() const override { + return true; + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + bool canClone() const override { + return true; + } + + MInstruction* clone(TempAllocator& alloc, + const MDefinitionVector& inputs) const override { + return MHypot::New(alloc, inputs); + } +}; + +// Inline implementation of Math.pow(). +class MPow + : public MBinaryInstruction, + public PowPolicy::Data +{ + MPow(MDefinition* input, MDefinition* power, MIRType powerType) + : MBinaryInstruction(input, power) + { + MOZ_ASSERT(powerType == MIRType::Double || powerType == MIRType::Int32); + specialization_ = powerType; + setResultType(MIRType::Double); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Pow) + TRIVIAL_NEW_WRAPPERS + + MDefinition* input() const { + return lhs(); + } + MDefinition* power() const { + return rhs(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + // Temporarily disable recovery to relieve fuzzer pressure. See bug 1188586. + return false; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MPow) +}; + +// Inline implementation of Math.pow(x, 0.5), which subtly differs from Math.sqrt(x). +class MPowHalf + : public MUnaryInstruction, + public DoublePolicy<0>::Data +{ + bool operandIsNeverNegativeInfinity_; + bool operandIsNeverNegativeZero_; + bool operandIsNeverNaN_; + + explicit MPowHalf(MDefinition* input) + : MUnaryInstruction(input), + operandIsNeverNegativeInfinity_(false), + operandIsNeverNegativeZero_(false), + operandIsNeverNaN_(false) + { + setResultType(MIRType::Double); + setMovable(); + } + + public: + INSTRUCTION_HEADER(PowHalf) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + bool operandIsNeverNegativeInfinity() const { + return operandIsNeverNegativeInfinity_; + } + bool operandIsNeverNegativeZero() const { + return operandIsNeverNegativeZero_; + } + bool operandIsNeverNaN() const { + return operandIsNeverNaN_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void collectRangeInfoPreTrunc() override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MPowHalf) +}; + +// Inline implementation of Math.random(). +class MRandom : public MNullaryInstruction +{ + MRandom() + { + setResultType(MIRType::Double); + } + + public: + INSTRUCTION_HEADER(Random) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool possiblyCalls() const override { + return true; + } + + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + + bool canRecoverOnBailout() const override { +#ifdef JS_MORE_DETERMINISTIC + return false; +#else + return true; +#endif + } + + ALLOW_CLONE(MRandom) +}; + +class MMathFunction + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + public: + enum Function { + Log, + Sin, + Cos, + Exp, + Tan, + ACos, + ASin, + ATan, + Log10, + Log2, + Log1P, + ExpM1, + CosH, + SinH, + TanH, + ACosH, + ASinH, + ATanH, + Sign, + Trunc, + Cbrt, + Floor, + Ceil, + Round + }; + + private: + Function function_; + const MathCache* cache_; + + // A nullptr cache means this function will neither access nor update the cache. + MMathFunction(MDefinition* input, Function function, const MathCache* cache) + : MUnaryInstruction(input), function_(function), cache_(cache) + { + setResultType(MIRType::Double); + specialization_ = MIRType::Double; + setMovable(); + } + + public: + INSTRUCTION_HEADER(MathFunction) + TRIVIAL_NEW_WRAPPERS + + Function function() const { + return function_; + } + const MathCache* cache() const { + return cache_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isMathFunction()) + return false; + if (ins->toMathFunction()->function() != function()) + return false; + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool possiblyCalls() const override { + return true; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + void printOpcode(GenericPrinter& out) const override; + + static const char* FunctionName(Function function); + + bool isFloat32Commutative() const override { + return function_ == Floor || function_ == Ceil || function_ == Round; + } + void trySpecializeFloat32(TempAllocator& alloc) override; + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + if (input()->type() == MIRType::SinCosDouble) + return false; + switch(function_) { + case Sin: + case Log: + case Round: + return true; + default: + return false; + } + } + + ALLOW_CLONE(MMathFunction) +}; + +class MAdd : public MBinaryArithInstruction +{ + MAdd(MDefinition* left, MDefinition* right) + : MBinaryArithInstruction(left, right) + { + setResultType(MIRType::Value); + } + + MAdd(MDefinition* left, MDefinition* right, MIRType type) + : MAdd(left, right) + { + specialization_ = type; + setResultType(type); + if (type == MIRType::Int32) { + setTruncateKind(Truncate); + setCommutative(); + } + } + + public: + INSTRUCTION_HEADER(Add) + TRIVIAL_NEW_WRAPPERS + + bool isFloat32Commutative() const override { return true; } + + double getIdentity() override { + return 0; + } + + bool fallible() const; + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + TruncateKind operandTruncateKind(size_t index) const override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + ALLOW_CLONE(MAdd) +}; + +class MSub : public MBinaryArithInstruction +{ + MSub(MDefinition* left, MDefinition* right) + : MBinaryArithInstruction(left, right) + { + setResultType(MIRType::Value); + } + + MSub(MDefinition* left, MDefinition* right, MIRType type, bool mustPreserveNaN = false) + : MSub(left, right) + { + specialization_ = type; + setResultType(type); + setMustPreserveNaN(mustPreserveNaN); + if (type == MIRType::Int32) + setTruncateKind(Truncate); + } + + public: + INSTRUCTION_HEADER(Sub) + TRIVIAL_NEW_WRAPPERS + + double getIdentity() override { + return 0; + } + + bool isFloat32Commutative() const override { return true; } + + bool fallible() const; + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + TruncateKind operandTruncateKind(size_t index) const override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + ALLOW_CLONE(MSub) +}; + +class MMul : public MBinaryArithInstruction +{ + public: + enum Mode { + Normal, + Integer + }; + + private: + // Annotation the result could be a negative zero + // and we need to guard this during execution. + bool canBeNegativeZero_; + + Mode mode_; + + MMul(MDefinition* left, MDefinition* right, MIRType type, Mode mode) + : MBinaryArithInstruction(left, right), + canBeNegativeZero_(true), + mode_(mode) + { + if (mode == Integer) { + // This implements the required behavior for Math.imul, which + // can never fail and always truncates its output to int32. + canBeNegativeZero_ = false; + setTruncateKind(Truncate); + setCommutative(); + } + MOZ_ASSERT_IF(mode != Integer, mode == Normal); + + if (type != MIRType::Value) + specialization_ = type; + setResultType(type); + } + + public: + INSTRUCTION_HEADER(Mul) + static MMul* New(TempAllocator& alloc, MDefinition* left, MDefinition* right) { + return new(alloc) MMul(left, right, MIRType::Value, MMul::Normal); + } + static MMul* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type, + Mode mode = Normal) + { + return new(alloc) MMul(left, right, type, mode); + } + static MMul* NewWasm(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type, + Mode mode, bool mustPreserveNaN) + { + auto* ret = new(alloc) MMul(left, right, type, mode); + ret->setMustPreserveNaN(mustPreserveNaN); + return ret; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void analyzeEdgeCasesForward() override; + void analyzeEdgeCasesBackward() override; + void collectRangeInfoPreTrunc() override; + + double getIdentity() override { + return 1; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isMul()) + return false; + + const MMul* mul = ins->toMul(); + if (canBeNegativeZero_ != mul->canBeNegativeZero()) + return false; + + if (mode_ != mul->mode()) + return false; + + if (mustPreserveNaN() != mul->mustPreserveNaN()) + return false; + + return binaryCongruentTo(ins); + } + + bool canOverflow() const; + + bool canBeNegativeZero() const { + return canBeNegativeZero_; + } + void setCanBeNegativeZero(bool negativeZero) { + canBeNegativeZero_ = negativeZero; + } + + MOZ_MUST_USE bool updateForReplacement(MDefinition* ins) override; + + bool fallible() const { + return canBeNegativeZero_ || canOverflow(); + } + + void setSpecialization(MIRType type) { + specialization_ = type; + } + + bool isFloat32Commutative() const override { return true; } + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + TruncateKind operandTruncateKind(size_t index) const override; + + Mode mode() const { return mode_; } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + ALLOW_CLONE(MMul) +}; + +class MDiv : public MBinaryArithInstruction +{ + bool canBeNegativeZero_; + bool canBeNegativeOverflow_; + bool canBeDivideByZero_; + bool canBeNegativeDividend_; + bool unsigned_; + bool trapOnError_; + wasm::TrapOffset trapOffset_; + + MDiv(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryArithInstruction(left, right), + canBeNegativeZero_(true), + canBeNegativeOverflow_(true), + canBeDivideByZero_(true), + canBeNegativeDividend_(true), + unsigned_(false), + trapOnError_(false) + { + if (type != MIRType::Value) + specialization_ = type; + setResultType(type); + } + + public: + INSTRUCTION_HEADER(Div) + static MDiv* New(TempAllocator& alloc, MDefinition* left, MDefinition* right) { + return new(alloc) MDiv(left, right, MIRType::Value); + } + static MDiv* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, MIRType type) { + return new(alloc) MDiv(left, right, type); + } + static MDiv* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, + MIRType type, bool unsignd, bool trapOnError = false, + wasm::TrapOffset trapOffset = wasm::TrapOffset(), + bool mustPreserveNaN = false) + { + auto* div = new(alloc) MDiv(left, right, type); + div->unsigned_ = unsignd; + div->trapOnError_ = trapOnError; + div->trapOffset_ = trapOffset; + if (trapOnError) { + div->setGuard(); // not removable because of possible side-effects. + div->setNotMovable(); + } + div->setMustPreserveNaN(mustPreserveNaN); + if (type == MIRType::Int32) + div->setTruncateKind(Truncate); + return div; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + void analyzeEdgeCasesForward() override; + void analyzeEdgeCasesBackward() override; + + double getIdentity() override { + MOZ_CRASH("not used"); + } + + bool canBeNegativeZero() const { + return canBeNegativeZero_; + } + void setCanBeNegativeZero(bool negativeZero) { + canBeNegativeZero_ = negativeZero; + } + + bool canBeNegativeOverflow() const { + return canBeNegativeOverflow_; + } + + bool canBeDivideByZero() const { + return canBeDivideByZero_; + } + + bool canBeNegativeDividend() const { + // "Dividend" is an ambiguous concept for unsigned truncated + // division, because of the truncation procedure: + // ((x>>>0)/2)|0, for example, gets transformed in + // MDiv::truncate into a node with lhs representing x (not + // x>>>0) and rhs representing the constant 2; in other words, + // the MIR node corresponds to "cast operands to unsigned and + // divide" operation. In this case, is the dividend x or is it + // x>>>0? In order to resolve such ambiguities, we disallow + // the usage of this method for unsigned division. + MOZ_ASSERT(!unsigned_); + return canBeNegativeDividend_; + } + + bool isUnsigned() const { + return unsigned_; + } + + bool isTruncatedIndirectly() const { + return truncateKind() >= IndirectTruncate; + } + + bool canTruncateInfinities() const { + return isTruncated(); + } + bool canTruncateRemainder() const { + return isTruncated(); + } + bool canTruncateOverflow() const { + return isTruncated() || isTruncatedIndirectly(); + } + bool canTruncateNegativeZero() const { + return isTruncated() || isTruncatedIndirectly(); + } + + bool trapOnError() const { + return trapOnError_; + } + wasm::TrapOffset trapOffset() const { + MOZ_ASSERT(trapOnError_); + return trapOffset_; + } + + bool isFloat32Commutative() const override { return true; } + + void computeRange(TempAllocator& alloc) override; + bool fallible() const; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + void collectRangeInfoPreTrunc() override; + TruncateKind operandTruncateKind(size_t index) const override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!MBinaryArithInstruction::congruentTo(ins)) + return false; + const MDiv* other = ins->toDiv(); + MOZ_ASSERT(other->trapOnError() == trapOnError_); + return unsigned_ == other->isUnsigned(); + } + + ALLOW_CLONE(MDiv) +}; + +class MMod : public MBinaryArithInstruction +{ + bool unsigned_; + bool canBeNegativeDividend_; + bool canBePowerOfTwoDivisor_; + bool canBeDivideByZero_; + bool trapOnError_; + wasm::TrapOffset trapOffset_; + + MMod(MDefinition* left, MDefinition* right, MIRType type) + : MBinaryArithInstruction(left, right), + unsigned_(false), + canBeNegativeDividend_(true), + canBePowerOfTwoDivisor_(true), + canBeDivideByZero_(true), + trapOnError_(false) + { + if (type != MIRType::Value) + specialization_ = type; + setResultType(type); + } + + public: + INSTRUCTION_HEADER(Mod) + static MMod* New(TempAllocator& alloc, MDefinition* left, MDefinition* right) { + return new(alloc) MMod(left, right, MIRType::Value); + } + static MMod* New(TempAllocator& alloc, MDefinition* left, MDefinition* right, + MIRType type, bool unsignd, bool trapOnError = false, + wasm::TrapOffset trapOffset = wasm::TrapOffset()) + { + auto* mod = new(alloc) MMod(left, right, type); + mod->unsigned_ = unsignd; + mod->trapOnError_ = trapOnError; + mod->trapOffset_ = trapOffset; + if (trapOnError) { + mod->setGuard(); // not removable because of possible side-effects. + mod->setNotMovable(); + } + if (type == MIRType::Int32) + mod->setTruncateKind(Truncate); + return mod; + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + double getIdentity() override { + MOZ_CRASH("not used"); + } + + bool canBeNegativeDividend() const { + MOZ_ASSERT(specialization_ == MIRType::Int32 || specialization_ == MIRType::Int64); + MOZ_ASSERT(!unsigned_); + return canBeNegativeDividend_; + } + + bool canBeDivideByZero() const { + MOZ_ASSERT(specialization_ == MIRType::Int32 || specialization_ == MIRType::Int64); + return canBeDivideByZero_; + } + + bool canBePowerOfTwoDivisor() const { + MOZ_ASSERT(specialization_ == MIRType::Int32); + return canBePowerOfTwoDivisor_; + } + + void analyzeEdgeCasesForward() override; + + bool isUnsigned() const { + return unsigned_; + } + + bool trapOnError() const { + return trapOnError_; + } + wasm::TrapOffset trapOffset() const { + MOZ_ASSERT(trapOnError_); + return trapOffset_; + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return specialization_ < MIRType::Object; + } + + bool fallible() const; + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; + void collectRangeInfoPreTrunc() override; + TruncateKind operandTruncateKind(size_t index) const override; + + bool congruentTo(const MDefinition* ins) const override { + return MBinaryArithInstruction::congruentTo(ins) && + unsigned_ == ins->toMod()->isUnsigned(); + } + + ALLOW_CLONE(MMod) +}; + +class MConcat + : public MBinaryInstruction, + public MixPolicy<ConvertToStringPolicy<0>, ConvertToStringPolicy<1> >::Data +{ + MConcat(MDefinition* left, MDefinition* right) + : MBinaryInstruction(left, right) + { + // At least one input should be definitely string + MOZ_ASSERT(left->type() == MIRType::String || right->type() == MIRType::String); + + setMovable(); + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(Concat) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MConcat) +}; + +class MCharCodeAt + : public MBinaryInstruction, + public MixPolicy<StringPolicy<0>, IntPolicy<1> >::Data +{ + MCharCodeAt(MDefinition* str, MDefinition* index) + : MBinaryInstruction(str, index) + { + setMovable(); + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(CharCodeAt) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + virtual AliasSet getAliasSet() const override { + // Strings are immutable, so there is no implicit dependency. + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MCharCodeAt) +}; + +class MFromCharCode + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + explicit MFromCharCode(MDefinition* code) + : MUnaryInstruction(code) + { + setMovable(); + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(FromCharCode) + TRIVIAL_NEW_WRAPPERS + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MFromCharCode) +}; + +class MFromCodePoint + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + explicit MFromCodePoint(MDefinition* codePoint) + : MUnaryInstruction(codePoint) + { + setGuard(); // throws on invalid code point + setMovable(); + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(FromCodePoint) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + bool possiblyCalls() const override { + return true; + } +}; + +class MSinCos + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + const MathCache* cache_; + + MSinCos(MDefinition *input, const MathCache *cache) : MUnaryInstruction(input), cache_(cache) + { + setResultType(MIRType::SinCosDouble); + specialization_ = MIRType::Double; + setMovable(); + } + + public: + INSTRUCTION_HEADER(SinCos) + + static MSinCos *New(TempAllocator &alloc, MDefinition *input, const MathCache *cache) + { + return new (alloc) MSinCos(input, cache); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition *ins) const override { + return congruentIfOperandsEqual(ins); + } + bool possiblyCalls() const override { + return true; + } + const MathCache* cache() const { + return cache_; + } +}; + +class MStringSplit + : public MTernaryInstruction, + public MixPolicy<StringPolicy<0>, StringPolicy<1> >::Data +{ + MStringSplit(CompilerConstraintList* constraints, MDefinition* string, MDefinition* sep, + MConstant* templateObject) + : MTernaryInstruction(string, sep, templateObject) + { + setResultType(MIRType::Object); + setResultTypeSet(templateObject->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(StringSplit) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, string), (1, separator)) + + JSObject* templateObject() const { + return &getOperand(2)->toConstant()->toObject(); + } + ObjectGroup* group() const { + return templateObject()->group(); + } + bool possiblyCalls() const override { + return true; + } + virtual AliasSet getAliasSet() const override { + // Although this instruction returns a new array, we don't have to mark + // it as store instruction, see also MNewArray. + return AliasSet::None(); + } + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +// Returns the value to use as |this| value. See also ComputeThis and +// BoxNonStrictThis in Interpreter.h. +class MComputeThis + : public MUnaryInstruction, + public BoxPolicy<0>::Data +{ + explicit MComputeThis(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(ComputeThis) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } + + // Note: don't override getAliasSet: the thisValue hook can be effectful. +}; + +// Load an arrow function's |new.target| value. +class MArrowNewTarget + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MArrowNewTarget(MDefinition* callee) + : MUnaryInstruction(callee) + { + setResultType(MIRType::Value); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ArrowNewTarget) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, callee)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + // An arrow function's lexical |this| value is immutable. + return AliasSet::None(); + } +}; + +class MPhi final + : public MDefinition, + public InlineListNode<MPhi>, + public NoTypePolicy::Data +{ + using InputVector = js::Vector<MUse, 2, JitAllocPolicy>; + InputVector inputs_; + + TruncateKind truncateKind_; + bool hasBackedgeType_; + bool triedToSpecialize_; + bool isIterator_; + bool canProduceFloat32_; + bool canConsumeFloat32_; + +#if DEBUG + bool specialized_; +#endif + + protected: + MUse* getUseFor(size_t index) override { + // Note: after the initial IonBuilder pass, it is OK to change phi + // operands such that they do not include the type sets of their + // operands. This can arise during e.g. value numbering, where + // definitions producing the same value may have different type sets. + MOZ_ASSERT(index < numOperands()); + return &inputs_[index]; + } + const MUse* getUseFor(size_t index) const override { + return &inputs_[index]; + } + + public: + INSTRUCTION_HEADER_WITHOUT_TYPEPOLICY(Phi) + virtual TypePolicy* typePolicy(); + virtual MIRType typePolicySpecialization(); + + MPhi(TempAllocator& alloc, MIRType resultType) + : inputs_(alloc), + truncateKind_(NoTruncate), + hasBackedgeType_(false), + triedToSpecialize_(false), + isIterator_(false), + canProduceFloat32_(false), + canConsumeFloat32_(false) +#if DEBUG + , specialized_(false) +#endif + { + setResultType(resultType); + } + + static MPhi* New(TempAllocator& alloc, MIRType resultType = MIRType::Value) { + return new(alloc) MPhi(alloc, resultType); + } + static MPhi* New(TempAllocator::Fallible alloc, MIRType resultType = MIRType::Value) { + return new(alloc) MPhi(alloc.alloc, resultType); + } + + void removeOperand(size_t index); + void removeAllOperands(); + + MDefinition* getOperand(size_t index) const override { + return inputs_[index].producer(); + } + size_t numOperands() const override { + return inputs_.length(); + } + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u >= &inputs_[0]); + MOZ_ASSERT(u <= &inputs_[numOperands() - 1]); + return u - &inputs_[0]; + } + void replaceOperand(size_t index, MDefinition* operand) final override { + inputs_[index].replaceProducer(operand); + } + bool hasBackedgeType() const { + return hasBackedgeType_; + } + bool triedToSpecialize() const { + return triedToSpecialize_; + } + void specialize(MIRType type) { + triedToSpecialize_ = true; + setResultType(type); + } + bool specializeType(TempAllocator& alloc); + +#ifdef DEBUG + // Assert that this is a phi in a loop header with a unique predecessor and + // a unique backedge. + void assertLoopPhi() const; +#else + void assertLoopPhi() const {} +#endif + + // Assuming this phi is in a loop header with a unique loop entry, return + // the phi operand along the loop entry. + MDefinition* getLoopPredecessorOperand() const { + assertLoopPhi(); + return getOperand(0); + } + + // Assuming this phi is in a loop header with a unique loop entry, return + // the phi operand along the loop backedge. + MDefinition* getLoopBackedgeOperand() const { + assertLoopPhi(); + return getOperand(1); + } + + // Whether this phi's type already includes information for def. + bool typeIncludes(MDefinition* def); + + // Add types for this phi which speculate about new inputs that may come in + // via a loop backedge. + MOZ_MUST_USE bool addBackedgeType(TempAllocator& alloc, MIRType type, + TemporaryTypeSet* typeSet); + + // Initializes the operands vector to the given capacity, + // permitting use of addInput() instead of addInputSlow(). + MOZ_MUST_USE bool reserveLength(size_t length) { + return inputs_.reserve(length); + } + + // Use only if capacity has been reserved by reserveLength + void addInput(MDefinition* ins) { + inputs_.infallibleEmplaceBack(ins, this); + } + + // Appends a new input to the input vector. May perform reallocation. + // Prefer reserveLength() and addInput() instead, where possible. + MOZ_MUST_USE bool addInputSlow(MDefinition* ins) { + return inputs_.emplaceBack(ins, this); + } + + // Appends a new input to the input vector. Infallible because + // we know the inputs fits in the vector's inline storage. + void addInlineInput(MDefinition* ins) { + MOZ_ASSERT(inputs_.length() < InputVector::InlineLength); + MOZ_ALWAYS_TRUE(addInputSlow(ins)); + } + + // Update the type of this phi after adding |ins| as an input. Set + // |*ptypeChange| to true if the type changed. + bool checkForTypeChange(TempAllocator& alloc, MDefinition* ins, bool* ptypeChange); + + MDefinition* foldsTo(TempAllocator& alloc) override; + MDefinition* foldsTernary(TempAllocator& alloc); + MDefinition* foldsFilterTypeSet(); + + bool congruentTo(const MDefinition* ins) const override; + + bool isIterator() const { + return isIterator_; + } + void setIterator() { + isIterator_ = true; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + + MDefinition* operandIfRedundant(); + + bool canProduceFloat32() const override { + return canProduceFloat32_; + } + + void setCanProduceFloat32(bool can) { + canProduceFloat32_ = can; + } + + bool canConsumeFloat32(MUse* use) const override { + return canConsumeFloat32_; + } + + void setCanConsumeFloat32(bool can) { + canConsumeFloat32_ = can; + } + + TruncateKind operandTruncateKind(size_t index) const override; + bool needTruncation(TruncateKind kind) override; + void truncate() override; +}; + +// The goal of a Beta node is to split a def at a conditionally taken +// branch, so that uses dominated by it have a different name. +class MBeta + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + // This is the range induced by a comparison and branch in a preceding + // block. Note that this does not reflect any range constraints from + // the input value itself, so this value may differ from the range() + // range after it is computed. + const Range* comparison_; + + MBeta(MDefinition* val, const Range* comp) + : MUnaryInstruction(val), + comparison_(comp) + { + setResultType(val->type()); + setResultTypeSet(val->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(Beta) + TRIVIAL_NEW_WRAPPERS + + void printOpcode(GenericPrinter& out) const override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; +}; + +// If input evaluates to false (i.e. it's NaN, 0 or -0), 0 is returned, else the input is returned +class MNaNToZero + : public MUnaryInstruction, + public DoublePolicy<0>::Data +{ + bool operandIsNeverNaN_; + bool operandIsNeverNegativeZero_; + explicit MNaNToZero(MDefinition* input) + : MUnaryInstruction(input), operandIsNeverNaN_(false), operandIsNeverNegativeZero_(false) + { + setResultType(MIRType::Double); + setMovable(); + } + public: + INSTRUCTION_HEADER(NaNToZero) + TRIVIAL_NEW_WRAPPERS + + bool operandIsNeverNaN() const { + return operandIsNeverNaN_; + } + + bool operandIsNeverNegativeZero() const { + return operandIsNeverNegativeZero_; + } + + void collectRangeInfoPreTrunc() override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + + bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MNaNToZero) +}; + +// MIR representation of a Value on the OSR BaselineFrame. +// The Value is indexed off of OsrFrameReg. +class MOsrValue + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + ptrdiff_t frameOffset_; + + MOsrValue(MOsrEntry* entry, ptrdiff_t frameOffset) + : MUnaryInstruction(entry), + frameOffset_(frameOffset) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(OsrValue) + TRIVIAL_NEW_WRAPPERS + + ptrdiff_t frameOffset() const { + return frameOffset_; + } + + MOsrEntry* entry() { + return getOperand(0)->toOsrEntry(); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// MIR representation of a JSObject scope chain pointer on the OSR BaselineFrame. +// The pointer is indexed off of OsrFrameReg. +class MOsrEnvironmentChain + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + explicit MOsrEnvironmentChain(MOsrEntry* entry) + : MUnaryInstruction(entry) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(OsrEnvironmentChain) + TRIVIAL_NEW_WRAPPERS + + MOsrEntry* entry() { + return getOperand(0)->toOsrEntry(); + } +}; + +// MIR representation of a JSObject ArgumentsObject pointer on the OSR BaselineFrame. +// The pointer is indexed off of OsrFrameReg. +class MOsrArgumentsObject + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + explicit MOsrArgumentsObject(MOsrEntry* entry) + : MUnaryInstruction(entry) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(OsrArgumentsObject) + TRIVIAL_NEW_WRAPPERS + + MOsrEntry* entry() { + return getOperand(0)->toOsrEntry(); + } +}; + +// MIR representation of the return value on the OSR BaselineFrame. +// The Value is indexed off of OsrFrameReg. +class MOsrReturnValue + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + private: + explicit MOsrReturnValue(MOsrEntry* entry) + : MUnaryInstruction(entry) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(OsrReturnValue) + TRIVIAL_NEW_WRAPPERS + + MOsrEntry* entry() { + return getOperand(0)->toOsrEntry(); + } +}; + +class MBinarySharedStub + : public MBinaryInstruction, + public MixPolicy<BoxPolicy<0>, BoxPolicy<1> >::Data +{ + protected: + explicit MBinarySharedStub(MDefinition* left, MDefinition* right) + : MBinaryInstruction(left, right) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(BinarySharedStub) + TRIVIAL_NEW_WRAPPERS +}; + +class MUnarySharedStub + : public MUnaryInstruction, + public BoxPolicy<0>::Data +{ + explicit MUnarySharedStub(MDefinition* input) + : MUnaryInstruction(input) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(UnarySharedStub) + TRIVIAL_NEW_WRAPPERS +}; + +class MNullarySharedStub + : public MNullaryInstruction +{ + explicit MNullarySharedStub() + : MNullaryInstruction() + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(NullarySharedStub) + TRIVIAL_NEW_WRAPPERS +}; + +// Check the current frame for over-recursion past the global stack limit. +class MCheckOverRecursed + : public MNullaryInstruction +{ + public: + INSTRUCTION_HEADER(CheckOverRecursed) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Check whether we need to fire the interrupt handler. +class MInterruptCheck : public MNullaryInstruction +{ + MInterruptCheck() { + setGuard(); + } + + public: + INSTRUCTION_HEADER(InterruptCheck) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Directly jumps to the indicated trap, leaving Wasm code and reporting a +// runtime error. + +class MWasmTrap + : public MAryControlInstruction<0, 0>, + public NoTypePolicy::Data +{ + wasm::Trap trap_; + wasm::TrapOffset trapOffset_; + + explicit MWasmTrap(wasm::Trap trap, wasm::TrapOffset trapOffset) + : trap_(trap), + trapOffset_(trapOffset) + {} + + public: + INSTRUCTION_HEADER(WasmTrap) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + wasm::Trap trap() const { return trap_; } + wasm::TrapOffset trapOffset() const { return trapOffset_; } +}; + +// Checks if a value is JS_UNINITIALIZED_LEXICAL, bailout out if so, leaving +// it to baseline to throw at the correct pc. +class MLexicalCheck + : public MUnaryInstruction, + public BoxPolicy<0>::Data +{ + BailoutKind kind_; + explicit MLexicalCheck(MDefinition* input, BailoutKind kind = Bailout_UninitializedLexical) + : MUnaryInstruction(input), + kind_(kind) + { + setResultType(MIRType::Value); + setResultTypeSet(input->resultTypeSet()); + setMovable(); + setGuard(); + } + + public: + INSTRUCTION_HEADER(LexicalCheck) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + BailoutKind bailoutKind() const { + return kind_; + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } +}; + +// Unconditionally throw an uninitialized let error. +class MThrowRuntimeLexicalError : public MNullaryInstruction +{ + unsigned errorNumber_; + + explicit MThrowRuntimeLexicalError(unsigned errorNumber) + : errorNumber_(errorNumber) + { + setGuard(); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(ThrowRuntimeLexicalError) + TRIVIAL_NEW_WRAPPERS + + unsigned errorNumber() const { + return errorNumber_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// In the prologues of global and eval scripts, check for redeclarations. +class MGlobalNameConflictsCheck : public MNullaryInstruction +{ + MGlobalNameConflictsCheck() { + setGuard(); + } + + public: + INSTRUCTION_HEADER(GlobalNameConflictsCheck) + TRIVIAL_NEW_WRAPPERS +}; + +// If not defined, set a global variable to |undefined|. +class MDefVar + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + CompilerPropertyName name_; // Target name to be defined. + unsigned attrs_; // Attributes to be set. + + private: + MDefVar(PropertyName* name, unsigned attrs, MDefinition* envChain) + : MUnaryInstruction(envChain), + name_(name), + attrs_(attrs) + { + } + + public: + INSTRUCTION_HEADER(DefVar) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, environmentChain)) + + PropertyName* name() const { + return name_; + } + unsigned attrs() const { + return attrs_; + } + + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MDefLexical + : public MNullaryInstruction +{ + CompilerPropertyName name_; // Target name to be defined. + unsigned attrs_; // Attributes to be set. + + private: + MDefLexical(PropertyName* name, unsigned attrs) + : name_(name), + attrs_(attrs) + { } + + public: + INSTRUCTION_HEADER(DefLexical) + TRIVIAL_NEW_WRAPPERS + + PropertyName* name() const { + return name_; + } + unsigned attrs() const { + return attrs_; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MDefFun + : public MBinaryInstruction, + public ObjectPolicy<0>::Data +{ + private: + MDefFun(MDefinition* fun, MDefinition* envChain) + : MBinaryInstruction(fun, envChain) + {} + + public: + INSTRUCTION_HEADER(DefFun) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, fun), (1, environmentChain)) + + bool possiblyCalls() const override { + return true; + } +}; + +class MRegExp : public MNullaryInstruction +{ + CompilerGCPointer<RegExpObject*> source_; + bool mustClone_; + + MRegExp(CompilerConstraintList* constraints, RegExpObject* source) + : source_(source), + mustClone_(true) + { + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, source)); + } + + public: + INSTRUCTION_HEADER(RegExp) + TRIVIAL_NEW_WRAPPERS + + void setDoNotClone() { + mustClone_ = false; + } + bool mustClone() const { + return mustClone_; + } + RegExpObject* source() const { + return source_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(source_); + } +}; + +class MRegExpMatcher + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, + StringPolicy<1>, + IntPolicy<2> >::Data +{ + private: + + MRegExpMatcher(MDefinition* regexp, MDefinition* string, MDefinition* lastIndex) + : MAryInstruction<3>() + { + initOperand(0, regexp); + initOperand(1, string); + initOperand(2, lastIndex); + + setMovable(); + // May be object or null. + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(RegExpMatcher) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, regexp), (1, string), (2, lastIndex)) + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + + bool canRecoverOnBailout() const override { + return true; + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MRegExpSearcher + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, + StringPolicy<1>, + IntPolicy<2> >::Data +{ + private: + + MRegExpSearcher(MDefinition* regexp, MDefinition* string, MDefinition* lastIndex) + : MAryInstruction<3>() + { + initOperand(0, regexp); + initOperand(1, string); + initOperand(2, lastIndex); + + setMovable(); + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(RegExpSearcher) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, regexp), (1, string), (2, lastIndex)) + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + + bool canRecoverOnBailout() const override { + return true; + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MRegExpTester + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, + StringPolicy<1>, + IntPolicy<2> >::Data +{ + private: + + MRegExpTester(MDefinition* regexp, MDefinition* string, MDefinition* lastIndex) + : MAryInstruction<3>() + { + initOperand(0, regexp); + initOperand(1, string); + initOperand(2, lastIndex); + + setMovable(); + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(RegExpTester) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, regexp), (1, string), (2, lastIndex)) + + bool possiblyCalls() const override { + return true; + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +class MRegExpPrototypeOptimizable + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MRegExpPrototypeOptimizable(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(RegExpPrototypeOptimizable) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MRegExpInstanceOptimizable + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data +{ + explicit MRegExpInstanceOptimizable(MDefinition* object, MDefinition* proto) + : MBinaryInstruction(object, proto) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(RegExpInstanceOptimizable) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, proto)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MGetFirstDollarIndex + : public MUnaryInstruction, + public StringPolicy<0>::Data +{ + explicit MGetFirstDollarIndex(MDefinition* str) + : MUnaryInstruction(str) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(GetFirstDollarIndex) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, str)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; +}; + +class MStringReplace + : public MTernaryInstruction, + public Mix3Policy<StringPolicy<0>, StringPolicy<1>, StringPolicy<2> >::Data +{ + private: + + bool isFlatReplacement_; + + MStringReplace(MDefinition* string, MDefinition* pattern, MDefinition* replacement) + : MTernaryInstruction(string, pattern, replacement), isFlatReplacement_(false) + { + setMovable(); + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(StringReplace) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, string), (1, pattern), (2, replacement)) + + void setFlatReplacement() { + MOZ_ASSERT(!isFlatReplacement_); + isFlatReplacement_ = true; + } + + bool isFlatReplacement() const { + return isFlatReplacement_; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isStringReplace()) + return false; + if (isFlatReplacement_ != ins->toStringReplace()->isFlatReplacement()) + return false; + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + if (isFlatReplacement_) { + MOZ_ASSERT(!pattern()->isRegExp()); + return true; + } + return false; + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MSubstr + : public MTernaryInstruction, + public Mix3Policy<StringPolicy<0>, IntPolicy<1>, IntPolicy<2>>::Data +{ + private: + + MSubstr(MDefinition* string, MDefinition* begin, MDefinition* length) + : MTernaryInstruction(string, begin, length) + { + setResultType(MIRType::String); + } + + public: + INSTRUCTION_HEADER(Substr) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, string), (1, begin), (2, length)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +struct LambdaFunctionInfo +{ + // The functions used in lambdas are the canonical original function in + // the script, and are immutable except for delazification. Record this + // information while still on the main thread to avoid races. + CompilerFunction fun; + uint16_t flags; + uint16_t nargs; + gc::Cell* scriptOrLazyScript; + bool singletonType; + bool useSingletonForClone; + + explicit LambdaFunctionInfo(JSFunction* fun) + : fun(fun), flags(fun->flags()), nargs(fun->nargs()), + scriptOrLazyScript(fun->hasScript() + ? (gc::Cell*) fun->nonLazyScript() + : (gc::Cell*) fun->lazyScript()), + singletonType(fun->isSingleton()), + useSingletonForClone(ObjectGroup::useSingletonForClone(fun)) + {} + + bool appendRoots(MRootList& roots) const { + if (!roots.append(fun)) + return false; + if (fun->hasScript()) + return roots.append(fun->nonLazyScript()); + return roots.append(fun->lazyScript()); + } + + private: + LambdaFunctionInfo(const LambdaFunctionInfo&) = delete; + void operator=(const LambdaFunctionInfo&) = delete; +}; + +class MLambda + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + const LambdaFunctionInfo info_; + + MLambda(CompilerConstraintList* constraints, MDefinition* envChain, MConstant* cst) + : MBinaryInstruction(envChain, cst), info_(&cst->toObject().as<JSFunction>()) + { + setResultType(MIRType::Object); + if (!info().fun->isSingleton() && !ObjectGroup::useSingletonForClone(info().fun)) + setResultTypeSet(MakeSingletonTypeSet(constraints, info().fun)); + } + + public: + INSTRUCTION_HEADER(Lambda) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, environmentChain)) + + MConstant* functionOperand() const { + return getOperand(1)->toConstant(); + } + const LambdaFunctionInfo& info() const { + return info_; + } + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return info_.appendRoots(roots); + } +}; + +class MLambdaArrow + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1>>::Data +{ + const LambdaFunctionInfo info_; + + MLambdaArrow(CompilerConstraintList* constraints, MDefinition* envChain, + MDefinition* newTarget_, JSFunction* fun) + : MBinaryInstruction(envChain, newTarget_), info_(fun) + { + setResultType(MIRType::Object); + MOZ_ASSERT(!ObjectGroup::useSingletonForClone(fun)); + if (!fun->isSingleton()) + setResultTypeSet(MakeSingletonTypeSet(constraints, fun)); + } + + public: + INSTRUCTION_HEADER(LambdaArrow) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, environmentChain), (1, newTargetDef)) + + const LambdaFunctionInfo& info() const { + return info_; + } + bool appendRoots(MRootList& roots) const override { + return info_.appendRoots(roots); + } +}; + +// Returns obj->slots. +class MSlots + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MSlots(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Slots); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Slots) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MSlots) +}; + +// Returns obj->elements. +class MElements + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + bool unboxed_; + + explicit MElements(MDefinition* object, bool unboxed = false) + : MUnaryInstruction(object), unboxed_(unboxed) + { + setResultType(MIRType::Elements); + setMovable(); + } + + public: + INSTRUCTION_HEADER(Elements) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool unboxed() const { + return unboxed_; + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && + ins->toElements()->unboxed() == unboxed(); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MElements) +}; + +// A constant value for some object's typed array elements. +class MConstantElements : public MNullaryInstruction +{ + SharedMem<void*> value_; + + protected: + explicit MConstantElements(SharedMem<void*> v) + : value_(v) + { + setResultType(MIRType::Elements); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ConstantElements) + TRIVIAL_NEW_WRAPPERS + + SharedMem<void*> value() const { + return value_; + } + + void printOpcode(GenericPrinter& out) const override; + + HashNumber valueHash() const override { + return (HashNumber)(size_t) value_.asValue(); + } + + bool congruentTo(const MDefinition* ins) const override { + return ins->isConstantElements() && ins->toConstantElements()->value() == value(); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + ALLOW_CLONE(MConstantElements) +}; + +// Passes through an object's elements, after ensuring it is entirely doubles. +class MConvertElementsToDoubles + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MConvertElementsToDoubles(MDefinition* elements) + : MUnaryInstruction(elements) + { + setGuard(); + setMovable(); + setResultType(MIRType::Elements); + } + + public: + INSTRUCTION_HEADER(ConvertElementsToDoubles) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + // This instruction can read and write to the elements' contents. + // However, it is alright to hoist this from loops which explicitly + // read or write to the elements: such reads and writes will use double + // values and can be reordered freely wrt this conversion, except that + // definite double loads must follow the conversion. The latter + // property is ensured by chaining this instruction with the elements + // themselves, in the same manner as MBoundsCheck. + return AliasSet::None(); + } +}; + +// If |elements| has the CONVERT_DOUBLE_ELEMENTS flag, convert value to +// double. Else return the original value. +class MMaybeToDoubleElement + : public MBinaryInstruction, + public IntPolicy<1>::Data +{ + MMaybeToDoubleElement(MDefinition* elements, MDefinition* value) + : MBinaryInstruction(elements, value) + { + MOZ_ASSERT(elements->type() == MIRType::Elements); + setMovable(); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(MaybeToDoubleElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, value)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Passes through an object, after ensuring its elements are not copy on write. +class MMaybeCopyElementsForWrite + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + bool checkNative_; + + explicit MMaybeCopyElementsForWrite(MDefinition* object, bool checkNative) + : MUnaryInstruction(object), checkNative_(checkNative) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + setResultTypeSet(object->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(MaybeCopyElementsForWrite) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool checkNative() const { + return checkNative_; + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && + checkNative() == ins->toMaybeCopyElementsForWrite()->checkNative(); + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields); + } +#ifdef DEBUG + bool needsResumePoint() const override { + // This instruction is idempotent and does not change observable + // behavior, so does not need its own resume point. + return false; + } +#endif + +}; + +// Load the initialized length from an elements header. +class MInitializedLength + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MInitializedLength(MDefinition* elements) + : MUnaryInstruction(elements) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(InitializedLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + void computeRange(TempAllocator& alloc) override; + + ALLOW_CLONE(MInitializedLength) +}; + +// Store to the initialized length in an elements header. Note the input is an +// *index*, one less than the desired length. +class MSetInitializedLength + : public MAryInstruction<2>, + public NoTypePolicy::Data +{ + MSetInitializedLength(MDefinition* elements, MDefinition* index) { + initOperand(0, elements); + initOperand(1, index); + } + + public: + INSTRUCTION_HEADER(SetInitializedLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MSetInitializedLength) +}; + +// Load the length from an unboxed array. +class MUnboxedArrayLength + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MUnboxedArrayLength(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(UnboxedArrayLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MUnboxedArrayLength) +}; + +// Load the initialized length from an unboxed array. +class MUnboxedArrayInitializedLength + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MUnboxedArrayInitializedLength(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(UnboxedArrayInitializedLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MUnboxedArrayInitializedLength) +}; + +// Increment the initialized length of an unboxed array object. +class MIncrementUnboxedArrayInitializedLength + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MIncrementUnboxedArrayInitializedLength(MDefinition* obj) + : MUnaryInstruction(obj) + {} + + public: + INSTRUCTION_HEADER(IncrementUnboxedArrayInitializedLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MIncrementUnboxedArrayInitializedLength) +}; + +// Set the initialized length of an unboxed array object. +class MSetUnboxedArrayInitializedLength + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MSetUnboxedArrayInitializedLength(MDefinition* obj, MDefinition* length) + : MBinaryInstruction(obj, length) + {} + + public: + INSTRUCTION_HEADER(SetUnboxedArrayInitializedLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, length)) + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MSetUnboxedArrayInitializedLength) +}; + +// Load the array length from an elements header. +class MArrayLength + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MArrayLength(MDefinition* elements) + : MUnaryInstruction(elements) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ArrayLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + void computeRange(TempAllocator& alloc) override; + + ALLOW_CLONE(MArrayLength) +}; + +// Store to the length in an elements header. Note the input is an *index*, one +// less than the desired length. +class MSetArrayLength + : public MAryInstruction<2>, + public NoTypePolicy::Data +{ + MSetArrayLength(MDefinition* elements, MDefinition* index) { + initOperand(0, elements); + initOperand(1, index); + } + + public: + INSTRUCTION_HEADER(SetArrayLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields); + } +}; + +class MGetNextEntryForIterator + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >::Data +{ + public: + enum Mode { + Map, + Set + }; + + private: + Mode mode_; + + explicit MGetNextEntryForIterator(MDefinition* iter, MDefinition* result, Mode mode) + : MBinaryInstruction(iter, result), mode_(mode) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(GetNextEntryForIterator) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, iter), (1, result)) + + Mode mode() const { + return mode_; + } +}; + +// Read the length of a typed array. +class MTypedArrayLength + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MTypedArrayLength(MDefinition* obj) + : MUnaryInstruction(obj) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypedArrayLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::TypedArrayLength); + } + + void computeRange(TempAllocator& alloc) override; +}; + +// Load a typed array's elements vector. +class MTypedArrayElements + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MTypedArrayElements(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Elements); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypedArrayElements) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MTypedArrayElements) +}; + +class MSetDisjointTypedElements + : public MTernaryInstruction, + public NoTypePolicy::Data +{ + explicit MSetDisjointTypedElements(MDefinition* target, MDefinition* targetOffset, + MDefinition* source) + : MTernaryInstruction(target, targetOffset, source) + { + MOZ_ASSERT(target->type() == MIRType::Object); + MOZ_ASSERT(targetOffset->type() == MIRType::Int32); + MOZ_ASSERT(source->type() == MIRType::Object); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(SetDisjointTypedElements) + NAMED_OPERANDS((0, target), (1, targetOffset), (2, source)) + + static MSetDisjointTypedElements* + New(TempAllocator& alloc, MDefinition* target, MDefinition* targetOffset, + MDefinition* source) + { + return new(alloc) MSetDisjointTypedElements(target, targetOffset, source); + } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + + ALLOW_CLONE(MSetDisjointTypedElements) +}; + +// Load a binary data object's "elements", which is just its opaque +// binary data space. Eventually this should probably be +// unified with `MTypedArrayElements`. +class MTypedObjectElements + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + bool definitelyOutline_; + + private: + explicit MTypedObjectElements(MDefinition* object, bool definitelyOutline) + : MUnaryInstruction(object), + definitelyOutline_(definitelyOutline) + { + setResultType(MIRType::Elements); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypedObjectElements) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool definitelyOutline() const { + return definitelyOutline_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isTypedObjectElements()) + return false; + const MTypedObjectElements* other = ins->toTypedObjectElements(); + if (other->definitelyOutline() != definitelyOutline()) + return false; + return congruentIfOperandsEqual(other); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Inlined version of the js::SetTypedObjectOffset() intrinsic. +class MSetTypedObjectOffset + : public MBinaryInstruction, + public NoTypePolicy::Data +{ + private: + MSetTypedObjectOffset(MDefinition* object, MDefinition* offset) + : MBinaryInstruction(object, offset) + { + MOZ_ASSERT(object->type() == MIRType::Object); + MOZ_ASSERT(offset->type() == MIRType::Int32); + setResultType(MIRType::None); + } + + public: + INSTRUCTION_HEADER(SetTypedObjectOffset) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, offset)) + + AliasSet getAliasSet() const override { + // This affects the result of MTypedObjectElements, + // which is described as a load of ObjectFields. + return AliasSet::Store(AliasSet::ObjectFields); + } +}; + +class MKeepAliveObject + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MKeepAliveObject(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::None); + setGuard(); + } + + public: + INSTRUCTION_HEADER(KeepAliveObject) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + +}; + +// Perform !-operation +class MNot + : public MUnaryInstruction, + public TestPolicy::Data +{ + bool operandMightEmulateUndefined_; + bool operandIsNeverNaN_; + + explicit MNot(MDefinition* input, CompilerConstraintList* constraints = nullptr) + : MUnaryInstruction(input), + operandMightEmulateUndefined_(true), + operandIsNeverNaN_(false) + { + setResultType(MIRType::Boolean); + setMovable(); + if (constraints) + cacheOperandMightEmulateUndefined(constraints); + } + + void cacheOperandMightEmulateUndefined(CompilerConstraintList* constraints); + + public: + static MNot* NewInt32(TempAllocator& alloc, MDefinition* input) { + MOZ_ASSERT(input->type() == MIRType::Int32 || input->type() == MIRType::Int64); + auto* ins = new(alloc) MNot(input); + ins->setResultType(MIRType::Int32); + return ins; + } + + INSTRUCTION_HEADER(Not) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + void markNoOperandEmulatesUndefined() { + operandMightEmulateUndefined_ = false; + } + bool operandMightEmulateUndefined() const { + return operandMightEmulateUndefined_; + } + bool operandIsNeverNaN() const { + return operandIsNeverNaN_; + } + + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void collectRangeInfoPreTrunc() override; + + void trySpecializeFloat32(TempAllocator& alloc) override; + bool isFloat32Commutative() const override { return true; } +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } +}; + +// Bailout if index + minimum < 0 or index + maximum >= length. The length used +// in a bounds check must not be negative, or the wrong result may be computed +// (unsigned comparisons may be used). +class MBoundsCheck + : public MBinaryInstruction, + public MixPolicy<IntPolicy<0>, IntPolicy<1>>::Data +{ + // Range over which to perform the bounds check, may be modified by GVN. + int32_t minimum_; + int32_t maximum_; + bool fallible_; + + MBoundsCheck(MDefinition* index, MDefinition* length) + : MBinaryInstruction(index, length), minimum_(0), maximum_(0), fallible_(true) + { + setGuard(); + setMovable(); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(length->type() == MIRType::Int32); + + // Returns the checked index. + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(BoundsCheck) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, index), (1, length)) + + int32_t minimum() const { + return minimum_; + } + void setMinimum(int32_t n) { + MOZ_ASSERT(fallible_); + minimum_ = n; + } + int32_t maximum() const { + return maximum_; + } + void setMaximum(int32_t n) { + MOZ_ASSERT(fallible_); + maximum_ = n; + } + MDefinition* foldsTo(TempAllocator& alloc) override; + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isBoundsCheck()) + return false; + const MBoundsCheck* other = ins->toBoundsCheck(); + if (minimum() != other->minimum() || maximum() != other->maximum()) + return false; + if (fallible() != other->fallible()) + return false; + return congruentIfOperandsEqual(other); + } + virtual AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + bool fallible() const { + return fallible_; + } + void collectRangeInfoPreTrunc() override; + + ALLOW_CLONE(MBoundsCheck) +}; + +// Bailout if index < minimum. +class MBoundsCheckLower + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + int32_t minimum_; + bool fallible_; + + explicit MBoundsCheckLower(MDefinition* index) + : MUnaryInstruction(index), minimum_(0), fallible_(true) + { + setGuard(); + setMovable(); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(BoundsCheckLower) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, index)) + + int32_t minimum() const { + return minimum_; + } + void setMinimum(int32_t n) { + minimum_ = n; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool fallible() const { + return fallible_; + } + void collectRangeInfoPreTrunc() override; +}; + +// Instructions which access an object's elements can either do so on a +// definition accessing that elements pointer, or on the object itself, if its +// elements are inline. In the latter case there must be an offset associated +// with the access. +static inline bool +IsValidElementsType(MDefinition* elements, int32_t offsetAdjustment) +{ + return elements->type() == MIRType::Elements || + (elements->type() == MIRType::Object && offsetAdjustment != 0); +} + +// Load a value from a dense array's element vector and does a hole check if the +// array is not known to be packed. +class MLoadElement + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + bool needsHoleCheck_; + bool loadDoubles_; + int32_t offsetAdjustment_; + + MLoadElement(MDefinition* elements, MDefinition* index, + bool needsHoleCheck, bool loadDoubles, int32_t offsetAdjustment = 0) + : MBinaryInstruction(elements, index), + needsHoleCheck_(needsHoleCheck), + loadDoubles_(loadDoubles), + offsetAdjustment_(offsetAdjustment) + { + if (needsHoleCheck) { + // Uses may be optimized away based on this instruction's result + // type. This means it's invalid to DCE this instruction, as we + // have to invalidate when we read a hole. + setGuard(); + } + setResultType(MIRType::Value); + setMovable(); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(LoadElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + bool needsHoleCheck() const { + return needsHoleCheck_; + } + bool loadDoubles() const { + return loadDoubles_; + } + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool fallible() const { + return needsHoleCheck(); + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadElement()) + return false; + const MLoadElement* other = ins->toLoadElement(); + if (needsHoleCheck() != other->needsHoleCheck()) + return false; + if (loadDoubles() != other->loadDoubles()) + return false; + if (offsetAdjustment() != other->offsetAdjustment()) + return false; + return congruentIfOperandsEqual(other); + } + AliasType mightAlias(const MDefinition* store) const override; + MDefinition* foldsTo(TempAllocator& alloc) override; + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::Element); + } + + ALLOW_CLONE(MLoadElement) +}; + +// Load a value from the elements vector for a dense native or unboxed array. +// If the index is out-of-bounds, or the indexed slot has a hole, undefined is +// returned instead. +class MLoadElementHole + : public MTernaryInstruction, + public SingleObjectPolicy::Data +{ + // Unboxed element type, JSVAL_TYPE_MAGIC for dense native elements. + JSValueType unboxedType_; + + bool needsNegativeIntCheck_; + bool needsHoleCheck_; + + MLoadElementHole(MDefinition* elements, MDefinition* index, MDefinition* initLength, + JSValueType unboxedType, bool needsHoleCheck) + : MTernaryInstruction(elements, index, initLength), + unboxedType_(unboxedType), + needsNegativeIntCheck_(true), + needsHoleCheck_(needsHoleCheck) + { + setResultType(MIRType::Value); + setMovable(); + + // Set the guard flag to make sure we bail when we see a negative + // index. We can clear this flag (and needsNegativeIntCheck_) in + // collectRangeInfoPreTrunc. + setGuard(); + + MOZ_ASSERT(elements->type() == MIRType::Elements); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(initLength->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(LoadElementHole) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, initLength)) + + JSValueType unboxedType() const { + return unboxedType_; + } + bool needsNegativeIntCheck() const { + return needsNegativeIntCheck_; + } + bool needsHoleCheck() const { + return needsHoleCheck_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadElementHole()) + return false; + const MLoadElementHole* other = ins->toLoadElementHole(); + if (unboxedType() != other->unboxedType()) + return false; + if (needsHoleCheck() != other->needsHoleCheck()) + return false; + if (needsNegativeIntCheck() != other->needsNegativeIntCheck()) + return false; + return congruentIfOperandsEqual(other); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::BoxedOrUnboxedElements(unboxedType())); + } + void collectRangeInfoPreTrunc() override; + + ALLOW_CLONE(MLoadElementHole) +}; + +class MLoadUnboxedObjectOrNull + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + public: + enum NullBehavior { + HandleNull, + BailOnNull, + NullNotPossible + }; + + private: + NullBehavior nullBehavior_; + int32_t offsetAdjustment_; + + MLoadUnboxedObjectOrNull(MDefinition* elements, MDefinition* index, + NullBehavior nullBehavior, int32_t offsetAdjustment) + : MBinaryInstruction(elements, index), + nullBehavior_(nullBehavior), + offsetAdjustment_(offsetAdjustment) + { + if (nullBehavior == BailOnNull) { + // Don't eliminate loads which bail out on a null pointer, for the + // same reason as MLoadElement. + setGuard(); + } + setResultType(nullBehavior == HandleNull ? MIRType::Value : MIRType::Object); + setMovable(); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(LoadUnboxedObjectOrNull) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + NullBehavior nullBehavior() const { + return nullBehavior_; + } + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool fallible() const { + return nullBehavior() == BailOnNull; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadUnboxedObjectOrNull()) + return false; + const MLoadUnboxedObjectOrNull* other = ins->toLoadUnboxedObjectOrNull(); + if (nullBehavior() != other->nullBehavior()) + return false; + if (offsetAdjustment() != other->offsetAdjustment()) + return false; + return congruentIfOperandsEqual(other); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::UnboxedElement); + } + AliasType mightAlias(const MDefinition* store) const override; + MDefinition* foldsTo(TempAllocator& alloc) override; + + ALLOW_CLONE(MLoadUnboxedObjectOrNull) +}; + +class MLoadUnboxedString + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + int32_t offsetAdjustment_; + + MLoadUnboxedString(MDefinition* elements, MDefinition* index, int32_t offsetAdjustment = 0) + : MBinaryInstruction(elements, index), + offsetAdjustment_(offsetAdjustment) + { + setResultType(MIRType::String); + setMovable(); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(LoadUnboxedString) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadUnboxedString()) + return false; + const MLoadUnboxedString* other = ins->toLoadUnboxedString(); + if (offsetAdjustment() != other->offsetAdjustment()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::UnboxedElement); + } + + ALLOW_CLONE(MLoadUnboxedString) +}; + +class MStoreElementCommon +{ + MIRType elementType_; + bool needsBarrier_; + + protected: + MStoreElementCommon() + : elementType_(MIRType::Value), + needsBarrier_(false) + { } + + public: + MIRType elementType() const { + return elementType_; + } + void setElementType(MIRType elementType) { + MOZ_ASSERT(elementType != MIRType::None); + elementType_ = elementType; + } + bool needsBarrier() const { + return needsBarrier_; + } + void setNeedsBarrier() { + needsBarrier_ = true; + } +}; + +// Store a value to a dense array slots vector. +class MStoreElement + : public MAryInstruction<3>, + public MStoreElementCommon, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<2> >::Data +{ + bool needsHoleCheck_; + int32_t offsetAdjustment_; + + MStoreElement(MDefinition* elements, MDefinition* index, MDefinition* value, + bool needsHoleCheck, int32_t offsetAdjustment = 0) + { + initOperand(0, elements); + initOperand(1, index); + initOperand(2, value); + needsHoleCheck_ = needsHoleCheck; + offsetAdjustment_ = offsetAdjustment; + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(StoreElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value)) + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::Element); + } + bool needsHoleCheck() const { + return needsHoleCheck_; + } + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool fallible() const { + return needsHoleCheck(); + } + + ALLOW_CLONE(MStoreElement) +}; + +// Like MStoreElement, but supports indexes >= initialized length, and can +// handle unboxed arrays. The downside is that we cannot hoist the elements +// vector and bounds check, since this instruction may update the (initialized) +// length and reallocate the elements vector. +class MStoreElementHole + : public MAryInstruction<4>, + public MStoreElementCommon, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<3> >::Data +{ + JSValueType unboxedType_; + + MStoreElementHole(MDefinition* object, MDefinition* elements, + MDefinition* index, MDefinition* value, JSValueType unboxedType) + : unboxedType_(unboxedType) + { + initOperand(0, object); + initOperand(1, elements); + initOperand(2, index); + initOperand(3, value); + MOZ_ASSERT(elements->type() == MIRType::Elements); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(StoreElementHole) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, elements), (2, index), (3, value)) + + JSValueType unboxedType() const { + return unboxedType_; + } + AliasSet getAliasSet() const override { + // StoreElementHole can update the initialized length, the array length + // or reallocate obj->elements. + return AliasSet::Store(AliasSet::ObjectFields | + AliasSet::BoxedOrUnboxedElements(unboxedType())); + } + + ALLOW_CLONE(MStoreElementHole) +}; + +// Try to store a value to a dense array slots vector. May fail due to the object being frozen. +// Cannot be used on an object that has extra indexed properties. +class MFallibleStoreElement + : public MAryInstruction<4>, + public MStoreElementCommon, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<3> >::Data +{ + JSValueType unboxedType_; + bool strict_; + + MFallibleStoreElement(MDefinition* object, MDefinition* elements, + MDefinition* index, MDefinition* value, + JSValueType unboxedType, bool strict) + : unboxedType_(unboxedType) + { + initOperand(0, object); + initOperand(1, elements); + initOperand(2, index); + initOperand(3, value); + strict_ = strict; + MOZ_ASSERT(elements->type() == MIRType::Elements); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(FallibleStoreElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, elements), (2, index), (3, value)) + + JSValueType unboxedType() const { + return unboxedType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields | + AliasSet::BoxedOrUnboxedElements(unboxedType())); + } + bool strict() const { + return strict_; + } + + ALLOW_CLONE(MFallibleStoreElement) +}; + + +// Store an unboxed object or null pointer to a v\ector. +class MStoreUnboxedObjectOrNull + : public MAryInstruction<4>, + public StoreUnboxedObjectOrNullPolicy::Data +{ + int32_t offsetAdjustment_; + bool preBarrier_; + + MStoreUnboxedObjectOrNull(MDefinition* elements, MDefinition* index, + MDefinition* value, MDefinition* typedObj, + int32_t offsetAdjustment = 0, bool preBarrier = true) + : offsetAdjustment_(offsetAdjustment), preBarrier_(preBarrier) + { + initOperand(0, elements); + initOperand(1, index); + initOperand(2, value); + initOperand(3, typedObj); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(typedObj->type() == MIRType::Object); + } + + public: + INSTRUCTION_HEADER(StoreUnboxedObjectOrNull) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value), (3, typedObj)) + + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool preBarrier() const { + return preBarrier_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + + // For StoreUnboxedObjectOrNullPolicy. + void setValue(MDefinition* def) { + replaceOperand(2, def); + } + + ALLOW_CLONE(MStoreUnboxedObjectOrNull) +}; + +// Store an unboxed object or null pointer to a vector. +class MStoreUnboxedString + : public MAryInstruction<3>, + public MixPolicy<SingleObjectPolicy, ConvertToStringPolicy<2> >::Data +{ + int32_t offsetAdjustment_; + bool preBarrier_; + + MStoreUnboxedString(MDefinition* elements, MDefinition* index, MDefinition* value, + int32_t offsetAdjustment = 0, bool preBarrier = true) + : offsetAdjustment_(offsetAdjustment), preBarrier_(preBarrier) + { + initOperand(0, elements); + initOperand(1, index); + initOperand(2, value); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(StoreUnboxedString) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value)) + + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + bool preBarrier() const { + return preBarrier_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + + ALLOW_CLONE(MStoreUnboxedString) +}; + +// Passes through an object, after ensuring it is converted from an unboxed +// object to a native representation. +class MConvertUnboxedObjectToNative + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + CompilerObjectGroup group_; + + explicit MConvertUnboxedObjectToNative(MDefinition* obj, ObjectGroup* group) + : MUnaryInstruction(obj), + group_(group) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(ConvertUnboxedObjectToNative) + NAMED_OPERANDS((0, object)) + + static MConvertUnboxedObjectToNative* New(TempAllocator& alloc, MDefinition* obj, + ObjectGroup* group); + + ObjectGroup* group() const { + return group_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + return ins->toConvertUnboxedObjectToNative()->group() == group(); + } + AliasSet getAliasSet() const override { + // This instruction can read and write to all parts of the object, but + // is marked as non-effectful so it can be consolidated by LICM and GVN + // and avoid inhibiting other optimizations. + // + // This is valid to do because when unboxed objects might have a native + // group they can be converted to, we do not optimize accesses to the + // unboxed objects and do not guard on their group or shape (other than + // in this opcode). + // + // Later accesses can assume the object has a native representation + // and optimize accordingly. Those accesses cannot be reordered before + // this instruction, however. This is prevented by chaining this + // instruction with the object itself, in the same way as MBoundsCheck. + return AliasSet::None(); + } + bool appendRoots(MRootList& roots) const override { + return roots.append(group_); + } +}; + +// Array.prototype.pop or Array.prototype.shift on a dense array. +class MArrayPopShift + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + public: + enum Mode { + Pop, + Shift + }; + + private: + Mode mode_; + JSValueType unboxedType_; + bool needsHoleCheck_; + bool maybeUndefined_; + + MArrayPopShift(MDefinition* object, Mode mode, JSValueType unboxedType, + bool needsHoleCheck, bool maybeUndefined) + : MUnaryInstruction(object), mode_(mode), unboxedType_(unboxedType), + needsHoleCheck_(needsHoleCheck), maybeUndefined_(maybeUndefined) + { } + + public: + INSTRUCTION_HEADER(ArrayPopShift) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool needsHoleCheck() const { + return needsHoleCheck_; + } + bool maybeUndefined() const { + return maybeUndefined_; + } + bool mode() const { + return mode_; + } + JSValueType unboxedType() const { + return unboxedType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields | + AliasSet::BoxedOrUnboxedElements(unboxedType())); + } + + ALLOW_CLONE(MArrayPopShift) +}; + +// Array.prototype.push on a dense array. Returns the new array length. +class MArrayPush + : public MBinaryInstruction, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >::Data +{ + JSValueType unboxedType_; + + MArrayPush(MDefinition* object, MDefinition* value, JSValueType unboxedType) + : MBinaryInstruction(object, value), unboxedType_(unboxedType) + { + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(ArrayPush) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value)) + + JSValueType unboxedType() const { + return unboxedType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::ObjectFields | + AliasSet::BoxedOrUnboxedElements(unboxedType())); + } + void computeRange(TempAllocator& alloc) override; + + ALLOW_CLONE(MArrayPush) +}; + +// Array.prototype.slice on a dense array. +class MArraySlice + : public MTernaryInstruction, + public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2>>::Data +{ + CompilerObject templateObj_; + gc::InitialHeap initialHeap_; + JSValueType unboxedType_; + + MArraySlice(CompilerConstraintList* constraints, MDefinition* obj, + MDefinition* begin, MDefinition* end, + JSObject* templateObj, gc::InitialHeap initialHeap, JSValueType unboxedType) + : MTernaryInstruction(obj, begin, end), + templateObj_(templateObj), + initialHeap_(initialHeap), + unboxedType_(unboxedType) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(ArraySlice) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, begin), (2, end)) + + JSObject* templateObj() const { + return templateObj_; + } + + gc::InitialHeap initialHeap() const { + return initialHeap_; + } + + JSValueType unboxedType() const { + return unboxedType_; + } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::BoxedOrUnboxedElements(unboxedType()) | + AliasSet::ObjectFields); + } + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObj_); + } +}; + +class MArrayJoin + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, StringPolicy<1> >::Data +{ + MArrayJoin(MDefinition* array, MDefinition* sep) + : MBinaryInstruction(array, sep) + { + setResultType(MIRType::String); + } + public: + INSTRUCTION_HEADER(ArrayJoin) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, array), (1, sep)) + + bool possiblyCalls() const override { + return true; + } + virtual AliasSet getAliasSet() const override { + // Array.join might coerce the elements of the Array to strings. This + // coercion might cause the evaluation of the some JavaScript code. + return AliasSet::Store(AliasSet::Any); + } + MDefinition* foldsTo(TempAllocator& alloc) override; +}; + +// All barriered operations - MCompareExchangeTypedArrayElement, +// MExchangeTypedArrayElement, and MAtomicTypedArrayElementBinop, as +// well as MLoadUnboxedScalar and MStoreUnboxedScalar when they are +// marked as requiring a memory barrer - have the following +// attributes: +// +// - Not movable +// - Not removable +// - Not congruent with any other instruction +// - Effectful (they alias every TypedArray store) +// +// The intended effect of those constraints is to prevent all loads +// and stores preceding the barriered operation from being moved to +// after the barriered operation, and vice versa, and to prevent the +// barriered operation from being removed or hoisted. + +enum MemoryBarrierRequirement +{ + DoesNotRequireMemoryBarrier, + DoesRequireMemoryBarrier +}; + +// Also see comments at MMemoryBarrierRequirement, above. + +// Load an unboxed scalar value from a typed array or other object. +class MLoadUnboxedScalar + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + Scalar::Type storageType_; + Scalar::Type readType_; + unsigned numElems_; // used only for SIMD + bool requiresBarrier_; + int32_t offsetAdjustment_; + bool canonicalizeDoubles_; + + MLoadUnboxedScalar(MDefinition* elements, MDefinition* index, Scalar::Type storageType, + MemoryBarrierRequirement requiresBarrier = DoesNotRequireMemoryBarrier, + int32_t offsetAdjustment = 0, bool canonicalizeDoubles = true) + : MBinaryInstruction(elements, index), + storageType_(storageType), + readType_(storageType), + numElems_(1), + requiresBarrier_(requiresBarrier == DoesRequireMemoryBarrier), + offsetAdjustment_(offsetAdjustment), + canonicalizeDoubles_(canonicalizeDoubles) + { + setResultType(MIRType::Value); + if (requiresBarrier_) + setGuard(); // Not removable or movable + else + setMovable(); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType); + } + + public: + INSTRUCTION_HEADER(LoadUnboxedScalar) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index)) + + void setSimdRead(Scalar::Type type, unsigned numElems) { + readType_ = type; + numElems_ = numElems; + } + unsigned numElems() const { + return numElems_; + } + Scalar::Type readType() const { + return readType_; + } + + Scalar::Type storageType() const { + return storageType_; + } + bool fallible() const { + // Bailout if the result does not fit in an int32. + return readType_ == Scalar::Uint32 && type() == MIRType::Int32; + } + bool requiresMemoryBarrier() const { + return requiresBarrier_; + } + bool canonicalizeDoubles() const { + return canonicalizeDoubles_; + } + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + void setOffsetAdjustment(int32_t offsetAdjustment) { + offsetAdjustment_ = offsetAdjustment; + } + AliasSet getAliasSet() const override { + // When a barrier is needed make the instruction effectful by + // giving it a "store" effect. + if (requiresBarrier_) + return AliasSet::Store(AliasSet::UnboxedElement); + return AliasSet::Load(AliasSet::UnboxedElement); + } + + bool congruentTo(const MDefinition* ins) const override { + if (requiresBarrier_) + return false; + if (!ins->isLoadUnboxedScalar()) + return false; + const MLoadUnboxedScalar* other = ins->toLoadUnboxedScalar(); + if (storageType_ != other->storageType_) + return false; + if (readType_ != other->readType_) + return false; + if (numElems_ != other->numElems_) + return false; + if (offsetAdjustment() != other->offsetAdjustment()) + return false; + if (canonicalizeDoubles() != other->canonicalizeDoubles()) + return false; + return congruentIfOperandsEqual(other); + } + + void printOpcode(GenericPrinter& out) const override; + + void computeRange(TempAllocator& alloc) override; + + bool canProduceFloat32() const override { return storageType_ == Scalar::Float32; } + + ALLOW_CLONE(MLoadUnboxedScalar) +}; + +// Load a value from a typed array. Out-of-bounds accesses are handled in-line. +class MLoadTypedArrayElementHole + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + Scalar::Type arrayType_; + bool allowDouble_; + + MLoadTypedArrayElementHole(MDefinition* object, MDefinition* index, Scalar::Type arrayType, bool allowDouble) + : MBinaryInstruction(object, index), arrayType_(arrayType), allowDouble_(allowDouble) + { + setResultType(MIRType::Value); + setMovable(); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(arrayType >= 0 && arrayType < Scalar::MaxTypedArrayViewType); + } + + public: + INSTRUCTION_HEADER(LoadTypedArrayElementHole) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, index)) + + Scalar::Type arrayType() const { + return arrayType_; + } + bool allowDouble() const { + return allowDouble_; + } + bool fallible() const { + return arrayType_ == Scalar::Uint32 && !allowDouble_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadTypedArrayElementHole()) + return false; + const MLoadTypedArrayElementHole* other = ins->toLoadTypedArrayElementHole(); + if (arrayType() != other->arrayType()) + return false; + if (allowDouble() != other->allowDouble()) + return false; + return congruentIfOperandsEqual(other); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::UnboxedElement); + } + bool canProduceFloat32() const override { return arrayType_ == Scalar::Float32; } + + ALLOW_CLONE(MLoadTypedArrayElementHole) +}; + +// Load a value fallibly or infallibly from a statically known typed array. +class MLoadTypedArrayElementStatic + : public MUnaryInstruction, + public ConvertToInt32Policy<0>::Data +{ + MLoadTypedArrayElementStatic(JSObject* someTypedArray, MDefinition* ptr, + int32_t offset = 0, bool needsBoundsCheck = true) + : MUnaryInstruction(ptr), someTypedArray_(someTypedArray), offset_(offset), + needsBoundsCheck_(needsBoundsCheck), fallible_(true) + { + int type = accessType(); + if (type == Scalar::Float32) + setResultType(MIRType::Float32); + else if (type == Scalar::Float64) + setResultType(MIRType::Double); + else + setResultType(MIRType::Int32); + } + + CompilerObject someTypedArray_; + + // An offset to be encoded in the load instruction - taking advantage of the + // addressing modes. This is only non-zero when the access is proven to be + // within bounds. + int32_t offset_; + bool needsBoundsCheck_; + bool fallible_; + + public: + INSTRUCTION_HEADER(LoadTypedArrayElementStatic) + TRIVIAL_NEW_WRAPPERS + + Scalar::Type accessType() const { + return someTypedArray_->as<TypedArrayObject>().type(); + } + SharedMem<void*> base() const; + size_t length() const; + + MDefinition* ptr() const { return getOperand(0); } + int32_t offset() const { return offset_; } + void setOffset(int32_t offset) { offset_ = offset; } + bool congruentTo(const MDefinition* ins) const override; + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::UnboxedElement); + } + + bool needsBoundsCheck() const { return needsBoundsCheck_; } + void setNeedsBoundsCheck(bool v) { needsBoundsCheck_ = v; } + + bool fallible() const { + return fallible_; + } + + void setInfallible() { + fallible_ = false; + } + + void computeRange(TempAllocator& alloc) override; + bool needTruncation(TruncateKind kind) override; + bool canProduceFloat32() const override { return accessType() == Scalar::Float32; } + void collectRangeInfoPreTrunc() override; + + bool appendRoots(MRootList& roots) const override { + return roots.append(someTypedArray_); + } +}; + +// Base class for MIR ops that write unboxed scalar values. +class StoreUnboxedScalarBase +{ + Scalar::Type writeType_; + + protected: + explicit StoreUnboxedScalarBase(Scalar::Type writeType) + : writeType_(writeType) + { + MOZ_ASSERT(isIntegerWrite() || isFloatWrite() || isSimdWrite()); + } + + public: + void setWriteType(Scalar::Type type) { + writeType_ = type; + } + Scalar::Type writeType() const { + return writeType_; + } + bool isByteWrite() const { + return writeType_ == Scalar::Int8 || + writeType_ == Scalar::Uint8 || + writeType_ == Scalar::Uint8Clamped; + } + bool isIntegerWrite() const { + return isByteWrite () || + writeType_ == Scalar::Int16 || + writeType_ == Scalar::Uint16 || + writeType_ == Scalar::Int32 || + writeType_ == Scalar::Uint32; + } + bool isFloatWrite() const { + return writeType_ == Scalar::Float32 || + writeType_ == Scalar::Float64; + } + bool isSimdWrite() const { + return Scalar::isSimdType(writeType()); + } +}; + +// Store an unboxed scalar value to a typed array or other object. +class MStoreUnboxedScalar + : public MTernaryInstruction, + public StoreUnboxedScalarBase, + public StoreUnboxedScalarPolicy::Data +{ + public: + enum TruncateInputKind { + DontTruncateInput, + TruncateInput + }; + + private: + Scalar::Type storageType_; + + // Whether this store truncates out of range inputs, for use by range analysis. + TruncateInputKind truncateInput_; + + bool requiresBarrier_; + int32_t offsetAdjustment_; + unsigned numElems_; // used only for SIMD + + MStoreUnboxedScalar(MDefinition* elements, MDefinition* index, MDefinition* value, + Scalar::Type storageType, TruncateInputKind truncateInput, + MemoryBarrierRequirement requiresBarrier = DoesNotRequireMemoryBarrier, + int32_t offsetAdjustment = 0) + : MTernaryInstruction(elements, index, value), + StoreUnboxedScalarBase(storageType), + storageType_(storageType), + truncateInput_(truncateInput), + requiresBarrier_(requiresBarrier == DoesRequireMemoryBarrier), + offsetAdjustment_(offsetAdjustment), + numElems_(1) + { + if (requiresBarrier_) + setGuard(); // Not removable or movable + else + setMovable(); + MOZ_ASSERT(IsValidElementsType(elements, offsetAdjustment)); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType); + } + + public: + INSTRUCTION_HEADER(StoreUnboxedScalar) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value)) + + void setSimdWrite(Scalar::Type writeType, unsigned numElems) { + MOZ_ASSERT(Scalar::isSimdType(writeType)); + setWriteType(writeType); + numElems_ = numElems; + } + unsigned numElems() const { + return numElems_; + } + Scalar::Type storageType() const { + return storageType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + TruncateInputKind truncateInput() const { + return truncateInput_; + } + bool requiresMemoryBarrier() const { + return requiresBarrier_; + } + int32_t offsetAdjustment() const { + return offsetAdjustment_; + } + TruncateKind operandTruncateKind(size_t index) const override; + + bool canConsumeFloat32(MUse* use) const override { + return use == getUseFor(2) && writeType() == Scalar::Float32; + } + + ALLOW_CLONE(MStoreUnboxedScalar) +}; + +class MStoreTypedArrayElementHole + : public MAryInstruction<4>, + public StoreUnboxedScalarBase, + public StoreTypedArrayHolePolicy::Data +{ + MStoreTypedArrayElementHole(MDefinition* elements, MDefinition* length, MDefinition* index, + MDefinition* value, Scalar::Type arrayType) + : MAryInstruction<4>(), + StoreUnboxedScalarBase(arrayType) + { + initOperand(0, elements); + initOperand(1, length); + initOperand(2, index); + initOperand(3, value); + setMovable(); + MOZ_ASSERT(elements->type() == MIRType::Elements); + MOZ_ASSERT(length->type() == MIRType::Int32); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(arrayType >= 0 && arrayType < Scalar::MaxTypedArrayViewType); + } + + public: + INSTRUCTION_HEADER(StoreTypedArrayElementHole) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, length), (2, index), (3, value)) + + Scalar::Type arrayType() const { + MOZ_ASSERT(!Scalar::isSimdType(writeType()), + "arrayType == writeType iff the write type isn't SIMD"); + return writeType(); + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + TruncateKind operandTruncateKind(size_t index) const override; + + bool canConsumeFloat32(MUse* use) const override { + return use == getUseFor(3) && arrayType() == Scalar::Float32; + } + + ALLOW_CLONE(MStoreTypedArrayElementHole) +}; + +// Store a value infallibly to a statically known typed array. +class MStoreTypedArrayElementStatic : + public MBinaryInstruction, + public StoreUnboxedScalarBase, + public StoreTypedArrayElementStaticPolicy::Data +{ + MStoreTypedArrayElementStatic(JSObject* someTypedArray, MDefinition* ptr, MDefinition* v, + int32_t offset = 0, bool needsBoundsCheck = true) + : MBinaryInstruction(ptr, v), + StoreUnboxedScalarBase(someTypedArray->as<TypedArrayObject>().type()), + someTypedArray_(someTypedArray), + offset_(offset), needsBoundsCheck_(needsBoundsCheck) + {} + + CompilerObject someTypedArray_; + + // An offset to be encoded in the store instruction - taking advantage of the + // addressing modes. This is only non-zero when the access is proven to be + // within bounds. + int32_t offset_; + bool needsBoundsCheck_; + + public: + INSTRUCTION_HEADER(StoreTypedArrayElementStatic) + TRIVIAL_NEW_WRAPPERS + + Scalar::Type accessType() const { + return writeType(); + } + + SharedMem<void*> base() const; + size_t length() const; + + MDefinition* ptr() const { return getOperand(0); } + MDefinition* value() const { return getOperand(1); } + bool needsBoundsCheck() const { return needsBoundsCheck_; } + void setNeedsBoundsCheck(bool v) { needsBoundsCheck_ = v; } + int32_t offset() const { return offset_; } + void setOffset(int32_t offset) { offset_ = offset; } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } + TruncateKind operandTruncateKind(size_t index) const override; + + bool canConsumeFloat32(MUse* use) const override { + return use == getUseFor(1) && accessType() == Scalar::Float32; + } + void collectRangeInfoPreTrunc() override; + + bool appendRoots(MRootList& roots) const override { + return roots.append(someTypedArray_); + } +}; + +// Compute an "effective address", i.e., a compound computation of the form: +// base + index * scale + displacement +class MEffectiveAddress + : public MBinaryInstruction, + public NoTypePolicy::Data +{ + MEffectiveAddress(MDefinition* base, MDefinition* index, Scale scale, int32_t displacement) + : MBinaryInstruction(base, index), scale_(scale), displacement_(displacement) + { + MOZ_ASSERT(base->type() == MIRType::Int32); + MOZ_ASSERT(index->type() == MIRType::Int32); + setMovable(); + setResultType(MIRType::Int32); + } + + Scale scale_; + int32_t displacement_; + + public: + INSTRUCTION_HEADER(EffectiveAddress) + TRIVIAL_NEW_WRAPPERS + + MDefinition* base() const { + return lhs(); + } + MDefinition* index() const { + return rhs(); + } + Scale scale() const { + return scale_; + } + int32_t displacement() const { + return displacement_; + } + + ALLOW_CLONE(MEffectiveAddress) +}; + +// Clamp input to range [0, 255] for Uint8ClampedArray. +class MClampToUint8 + : public MUnaryInstruction, + public ClampPolicy::Data +{ + explicit MClampToUint8(MDefinition* input) + : MUnaryInstruction(input) + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ClampToUint8) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + void computeRange(TempAllocator& alloc) override; + + ALLOW_CLONE(MClampToUint8) +}; + +class MLoadFixedSlot + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + size_t slot_; + + protected: + MLoadFixedSlot(MDefinition* obj, size_t slot) + : MUnaryInstruction(obj), slot_(slot) + { + setResultType(MIRType::Value); + setMovable(); + } + + public: + INSTRUCTION_HEADER(LoadFixedSlot) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + size_t slot() const { + return slot_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadFixedSlot()) + return false; + if (slot() != ins->toLoadFixedSlot()->slot()) + return false; + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::FixedSlot); + } + + AliasType mightAlias(const MDefinition* store) const override; + + ALLOW_CLONE(MLoadFixedSlot) +}; + +class MLoadFixedSlotAndUnbox + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + size_t slot_; + MUnbox::Mode mode_; + BailoutKind bailoutKind_; + protected: + MLoadFixedSlotAndUnbox(MDefinition* obj, size_t slot, MUnbox::Mode mode, MIRType type, + BailoutKind kind) + : MUnaryInstruction(obj), slot_(slot), mode_(mode), bailoutKind_(kind) + { + setResultType(type); + setMovable(); + if (mode_ == MUnbox::TypeBarrier || mode_ == MUnbox::Fallible) + setGuard(); + } + + public: + INSTRUCTION_HEADER(LoadFixedSlotAndUnbox) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + size_t slot() const { + return slot_; + } + MUnbox::Mode mode() const { + return mode_; + } + BailoutKind bailoutKind() const { + return bailoutKind_; + } + bool fallible() const { + return mode_ != MUnbox::Infallible; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadFixedSlotAndUnbox() || + slot() != ins->toLoadFixedSlotAndUnbox()->slot() || + mode() != ins->toLoadFixedSlotAndUnbox()->mode()) + { + return false; + } + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::FixedSlot); + } + + AliasType mightAlias(const MDefinition* store) const override; + + ALLOW_CLONE(MLoadFixedSlotAndUnbox); +}; + +class MStoreFixedSlot + : public MBinaryInstruction, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >::Data +{ + bool needsBarrier_; + size_t slot_; + + MStoreFixedSlot(MDefinition* obj, MDefinition* rval, size_t slot, bool barrier) + : MBinaryInstruction(obj, rval), + needsBarrier_(barrier), + slot_(slot) + { } + + public: + INSTRUCTION_HEADER(StoreFixedSlot) + NAMED_OPERANDS((0, object), (1, value)) + + static MStoreFixedSlot* New(TempAllocator& alloc, MDefinition* obj, size_t slot, + MDefinition* rval) + { + return new(alloc) MStoreFixedSlot(obj, rval, slot, false); + } + static MStoreFixedSlot* NewBarriered(TempAllocator& alloc, MDefinition* obj, size_t slot, + MDefinition* rval) + { + return new(alloc) MStoreFixedSlot(obj, rval, slot, true); + } + + size_t slot() const { + return slot_; + } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::FixedSlot); + } + bool needsBarrier() const { + return needsBarrier_; + } + void setNeedsBarrier(bool needsBarrier = true) { + needsBarrier_ = needsBarrier; + } + + ALLOW_CLONE(MStoreFixedSlot) +}; + +typedef Vector<JSObject*, 4, JitAllocPolicy> ObjectVector; +typedef Vector<bool, 4, JitAllocPolicy> BoolVector; + +class InlinePropertyTable : public TempObject +{ + struct Entry : public TempObject { + CompilerObjectGroup group; + CompilerFunction func; + + Entry(ObjectGroup* group, JSFunction* func) + : group(group), func(func) + { } + bool appendRoots(MRootList& roots) const { + return roots.append(group) && roots.append(func); + } + }; + + jsbytecode* pc_; + MResumePoint* priorResumePoint_; + Vector<Entry*, 4, JitAllocPolicy> entries_; + + public: + InlinePropertyTable(TempAllocator& alloc, jsbytecode* pc) + : pc_(pc), priorResumePoint_(nullptr), entries_(alloc) + { } + + void setPriorResumePoint(MResumePoint* resumePoint) { + MOZ_ASSERT(priorResumePoint_ == nullptr); + priorResumePoint_ = resumePoint; + } + bool hasPriorResumePoint() { return bool(priorResumePoint_); } + MResumePoint* takePriorResumePoint() { + MResumePoint* rp = priorResumePoint_; + priorResumePoint_ = nullptr; + return rp; + } + + jsbytecode* pc() const { + return pc_; + } + + MOZ_MUST_USE bool addEntry(TempAllocator& alloc, ObjectGroup* group, JSFunction* func) { + return entries_.append(new(alloc) Entry(group, func)); + } + + size_t numEntries() const { + return entries_.length(); + } + + ObjectGroup* getObjectGroup(size_t i) const { + MOZ_ASSERT(i < numEntries()); + return entries_[i]->group; + } + + JSFunction* getFunction(size_t i) const { + MOZ_ASSERT(i < numEntries()); + return entries_[i]->func; + } + + bool hasFunction(JSFunction* func) const; + bool hasObjectGroup(ObjectGroup* group) const; + + TemporaryTypeSet* buildTypeSetForFunction(JSFunction* func) const; + + // Remove targets that vetoed inlining from the InlinePropertyTable. + void trimTo(const ObjectVector& targets, const BoolVector& choiceSet); + + // Ensure that the InlinePropertyTable's domain is a subset of |targets|. + void trimToTargets(const ObjectVector& targets); + + bool appendRoots(MRootList& roots) const; +}; + +class CacheLocationList : public InlineConcatList<CacheLocationList> +{ + public: + CacheLocationList() + : pc(nullptr), + script(nullptr) + { } + + jsbytecode* pc; + JSScript* script; +}; + +class MGetPropertyCache + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, CacheIdPolicy<1>>::Data +{ + bool idempotent_ : 1; + bool monitoredResult_ : 1; + + CacheLocationList location_; + + InlinePropertyTable* inlinePropertyTable_; + + MGetPropertyCache(MDefinition* obj, MDefinition* id, bool monitoredResult) + : MBinaryInstruction(obj, id), + idempotent_(false), + monitoredResult_(monitoredResult), + location_(), + inlinePropertyTable_(nullptr) + { + setResultType(MIRType::Value); + + // The cache will invalidate if there are objects with e.g. lookup or + // resolve hooks on the proto chain. setGuard ensures this check is not + // eliminated. + setGuard(); + } + + public: + INSTRUCTION_HEADER(GetPropertyCache) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, idval)) + + InlinePropertyTable* initInlinePropertyTable(TempAllocator& alloc, jsbytecode* pc) { + MOZ_ASSERT(inlinePropertyTable_ == nullptr); + inlinePropertyTable_ = new(alloc) InlinePropertyTable(alloc, pc); + return inlinePropertyTable_; + } + + void clearInlinePropertyTable() { + inlinePropertyTable_ = nullptr; + } + + InlinePropertyTable* propTable() const { + return inlinePropertyTable_; + } + + bool idempotent() const { + return idempotent_; + } + void setIdempotent() { + idempotent_ = true; + setMovable(); + } + bool monitoredResult() const { + return monitoredResult_; + } + CacheLocationList& location() { + return location_; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!idempotent_) + return false; + if (!ins->isGetPropertyCache()) + return false; + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + if (idempotent_) { + return AliasSet::Load(AliasSet::ObjectFields | + AliasSet::FixedSlot | + AliasSet::DynamicSlot); + } + return AliasSet::Store(AliasSet::Any); + } + + void setBlock(MBasicBlock* block) override; + MOZ_MUST_USE bool updateForReplacement(MDefinition* ins) override; + + bool allowDoubleResult() const; + + bool appendRoots(MRootList& roots) const override { + if (inlinePropertyTable_) + return inlinePropertyTable_->appendRoots(roots); + return true; + } +}; + +struct PolymorphicEntry { + // The group and/or shape to guard against. + ReceiverGuard receiver; + + // The property to load, null for loads from unboxed properties. + Shape* shape; + + bool appendRoots(MRootList& roots) const { + return roots.append(receiver) && roots.append(shape); + } +}; + +// Emit code to load a value from an object if it matches one of the receivers +// observed by the baseline IC, else bails out. +class MGetPropertyPolymorphic + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + Vector<PolymorphicEntry, 4, JitAllocPolicy> receivers_; + CompilerPropertyName name_; + + MGetPropertyPolymorphic(TempAllocator& alloc, MDefinition* obj, PropertyName* name) + : MUnaryInstruction(obj), + receivers_(alloc), + name_(name) + { + setGuard(); + setMovable(); + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(GetPropertyPolymorphic) + NAMED_OPERANDS((0, object)) + + static MGetPropertyPolymorphic* New(TempAllocator& alloc, MDefinition* obj, PropertyName* name) { + return new(alloc) MGetPropertyPolymorphic(alloc, obj, name); + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGetPropertyPolymorphic()) + return false; + if (name() != ins->toGetPropertyPolymorphic()->name()) + return false; + return congruentIfOperandsEqual(ins); + } + + MOZ_MUST_USE bool addReceiver(const ReceiverGuard& receiver, Shape* shape) { + PolymorphicEntry entry; + entry.receiver = receiver; + entry.shape = shape; + return receivers_.append(entry); + } + size_t numReceivers() const { + return receivers_.length(); + } + const ReceiverGuard receiver(size_t i) const { + return receivers_[i].receiver; + } + Shape* shape(size_t i) const { + return receivers_[i].shape; + } + PropertyName* name() const { + return name_; + } + AliasSet getAliasSet() const override { + bool hasUnboxedLoad = false; + for (size_t i = 0; i < numReceivers(); i++) { + if (!shape(i)) { + hasUnboxedLoad = true; + break; + } + } + return AliasSet::Load(AliasSet::ObjectFields | + AliasSet::FixedSlot | + AliasSet::DynamicSlot | + (hasUnboxedLoad ? AliasSet::UnboxedElement : 0)); + } + + AliasType mightAlias(const MDefinition* store) const override; + + bool appendRoots(MRootList& roots) const override; +}; + +// Emit code to store a value to an object's slots if its shape/group matches +// one of the shapes/groups observed by the baseline IC, else bails out. +class MSetPropertyPolymorphic + : public MBinaryInstruction, + public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >::Data +{ + Vector<PolymorphicEntry, 4, JitAllocPolicy> receivers_; + CompilerPropertyName name_; + bool needsBarrier_; + + MSetPropertyPolymorphic(TempAllocator& alloc, MDefinition* obj, MDefinition* value, + PropertyName* name) + : MBinaryInstruction(obj, value), + receivers_(alloc), + name_(name), + needsBarrier_(false) + { + } + + public: + INSTRUCTION_HEADER(SetPropertyPolymorphic) + NAMED_OPERANDS((0, object), (1, value)) + + static MSetPropertyPolymorphic* New(TempAllocator& alloc, MDefinition* obj, MDefinition* value, + PropertyName* name) { + return new(alloc) MSetPropertyPolymorphic(alloc, obj, value, name); + } + + MOZ_MUST_USE bool addReceiver(const ReceiverGuard& receiver, Shape* shape) { + PolymorphicEntry entry; + entry.receiver = receiver; + entry.shape = shape; + return receivers_.append(entry); + } + size_t numReceivers() const { + return receivers_.length(); + } + const ReceiverGuard& receiver(size_t i) const { + return receivers_[i].receiver; + } + Shape* shape(size_t i) const { + return receivers_[i].shape; + } + PropertyName* name() const { + return name_; + } + bool needsBarrier() const { + return needsBarrier_; + } + void setNeedsBarrier() { + needsBarrier_ = true; + } + AliasSet getAliasSet() const override { + bool hasUnboxedStore = false; + for (size_t i = 0; i < numReceivers(); i++) { + if (!shape(i)) { + hasUnboxedStore = true; + break; + } + } + return AliasSet::Store(AliasSet::ObjectFields | + AliasSet::FixedSlot | + AliasSet::DynamicSlot | + (hasUnboxedStore ? AliasSet::UnboxedElement : 0)); + } + bool appendRoots(MRootList& roots) const override; +}; + +class MDispatchInstruction + : public MControlInstruction, + public SingleObjectPolicy::Data +{ + // Map from JSFunction* -> MBasicBlock. + struct Entry { + JSFunction* func; + // If |func| has a singleton group, |funcGroup| is null. Otherwise, + // |funcGroup| holds the ObjectGroup for |func|, and dispatch guards + // on the group instead of directly on the function. + ObjectGroup* funcGroup; + MBasicBlock* block; + + Entry(JSFunction* func, ObjectGroup* funcGroup, MBasicBlock* block) + : func(func), funcGroup(funcGroup), block(block) + { } + bool appendRoots(MRootList& roots) const { + return roots.append(func) && roots.append(funcGroup); + } + }; + Vector<Entry, 4, JitAllocPolicy> map_; + + // An optional fallback path that uses MCall. + MBasicBlock* fallback_; + MUse operand_; + + void initOperand(size_t index, MDefinition* operand) { + MOZ_ASSERT(index == 0); + operand_.init(operand, this); + } + + public: + NAMED_OPERANDS((0, input)) + MDispatchInstruction(TempAllocator& alloc, MDefinition* input) + : map_(alloc), fallback_(nullptr) + { + initOperand(0, input); + } + + protected: + MUse* getUseFor(size_t index) final override { + MOZ_ASSERT(index == 0); + return &operand_; + } + const MUse* getUseFor(size_t index) const final override { + MOZ_ASSERT(index == 0); + return &operand_; + } + MDefinition* getOperand(size_t index) const final override { + MOZ_ASSERT(index == 0); + return operand_.producer(); + } + size_t numOperands() const final override { + return 1; + } + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u == getUseFor(0)); + return 0; + } + void replaceOperand(size_t index, MDefinition* operand) final override { + MOZ_ASSERT(index == 0); + operand_.replaceProducer(operand); + } + + public: + void setSuccessor(size_t i, MBasicBlock* successor) { + MOZ_ASSERT(i < numSuccessors()); + if (i == map_.length()) + fallback_ = successor; + else + map_[i].block = successor; + } + size_t numSuccessors() const final override { + return map_.length() + (fallback_ ? 1 : 0); + } + void replaceSuccessor(size_t i, MBasicBlock* successor) final override { + setSuccessor(i, successor); + } + MBasicBlock* getSuccessor(size_t i) const final override { + MOZ_ASSERT(i < numSuccessors()); + if (i == map_.length()) + return fallback_; + return map_[i].block; + } + + public: + MOZ_MUST_USE bool addCase(JSFunction* func, ObjectGroup* funcGroup, MBasicBlock* block) { + return map_.append(Entry(func, funcGroup, block)); + } + uint32_t numCases() const { + return map_.length(); + } + JSFunction* getCase(uint32_t i) const { + return map_[i].func; + } + ObjectGroup* getCaseObjectGroup(uint32_t i) const { + return map_[i].funcGroup; + } + MBasicBlock* getCaseBlock(uint32_t i) const { + return map_[i].block; + } + + bool hasFallback() const { + return bool(fallback_); + } + void addFallback(MBasicBlock* block) { + MOZ_ASSERT(!hasFallback()); + fallback_ = block; + } + MBasicBlock* getFallback() const { + MOZ_ASSERT(hasFallback()); + return fallback_; + } + bool appendRoots(MRootList& roots) const override; +}; + +// Polymorphic dispatch for inlining, keyed off incoming ObjectGroup. +class MObjectGroupDispatch : public MDispatchInstruction +{ + // Map ObjectGroup (of CallProp's Target Object) -> JSFunction (yielded by the CallProp). + InlinePropertyTable* inlinePropertyTable_; + + MObjectGroupDispatch(TempAllocator& alloc, MDefinition* input, InlinePropertyTable* table) + : MDispatchInstruction(alloc, input), + inlinePropertyTable_(table) + { } + + public: + INSTRUCTION_HEADER(ObjectGroupDispatch) + + static MObjectGroupDispatch* New(TempAllocator& alloc, MDefinition* ins, + InlinePropertyTable* table) + { + return new(alloc) MObjectGroupDispatch(alloc, ins, table); + } + + InlinePropertyTable* propTable() const { + return inlinePropertyTable_; + } + bool appendRoots(MRootList& roots) const override; +}; + +// Polymorphic dispatch for inlining, keyed off incoming JSFunction*. +class MFunctionDispatch : public MDispatchInstruction +{ + MFunctionDispatch(TempAllocator& alloc, MDefinition* input) + : MDispatchInstruction(alloc, input) + { } + + public: + INSTRUCTION_HEADER(FunctionDispatch) + + static MFunctionDispatch* New(TempAllocator& alloc, MDefinition* ins) { + return new(alloc) MFunctionDispatch(alloc, ins); + } + bool appendRoots(MRootList& roots) const override; +}; + +class MBindNameCache + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + CompilerPropertyName name_; + CompilerScript script_; + jsbytecode* pc_; + + MBindNameCache(MDefinition* envChain, PropertyName* name, JSScript* script, jsbytecode* pc) + : MUnaryInstruction(envChain), name_(name), script_(script), pc_(pc) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(BindNameCache) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, environmentChain)) + + PropertyName* name() const { + return name_; + } + JSScript* script() const { + return script_; + } + jsbytecode* pc() const { + return pc_; + } + bool appendRoots(MRootList& roots) const override { + // Don't append the script, all scripts are added anyway. + return roots.append(name_); + } +}; + +class MCallBindVar + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MCallBindVar(MDefinition* envChain) + : MUnaryInstruction(envChain) + { + setResultType(MIRType::Object); + setMovable(); + } + + public: + INSTRUCTION_HEADER(CallBindVar) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, environmentChain)) + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isCallBindVar()) + return false; + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Guard on an object's shape. +class MGuardShape + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + CompilerShape shape_; + BailoutKind bailoutKind_; + + MGuardShape(MDefinition* obj, Shape* shape, BailoutKind bailoutKind) + : MUnaryInstruction(obj), + shape_(shape), + bailoutKind_(bailoutKind) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + setResultTypeSet(obj->resultTypeSet()); + + // Disallow guarding on unboxed object shapes. The group is better to + // guard on, and guarding on the shape can interact badly with + // MConvertUnboxedObjectToNative. + MOZ_ASSERT(shape->getObjectClass() != &UnboxedPlainObject::class_); + } + + public: + INSTRUCTION_HEADER(GuardShape) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + const Shape* shape() const { + return shape_; + } + BailoutKind bailoutKind() const { + return bailoutKind_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGuardShape()) + return false; + if (shape() != ins->toGuardShape()->shape()) + return false; + if (bailoutKind() != ins->toGuardShape()->bailoutKind()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + bool appendRoots(MRootList& roots) const override { + return roots.append(shape_); + } +}; + +// Bail if the object's shape or unboxed group is not in the input list. +class MGuardReceiverPolymorphic + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + Vector<ReceiverGuard, 4, JitAllocPolicy> receivers_; + + MGuardReceiverPolymorphic(TempAllocator& alloc, MDefinition* obj) + : MUnaryInstruction(obj), + receivers_(alloc) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + setResultTypeSet(obj->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(GuardReceiverPolymorphic) + NAMED_OPERANDS((0, object)) + + static MGuardReceiverPolymorphic* New(TempAllocator& alloc, MDefinition* obj) { + return new(alloc) MGuardReceiverPolymorphic(alloc, obj); + } + + MOZ_MUST_USE bool addReceiver(const ReceiverGuard& receiver) { + return receivers_.append(receiver); + } + size_t numReceivers() const { + return receivers_.length(); + } + const ReceiverGuard& receiver(size_t i) const { + return receivers_[i]; + } + + bool congruentTo(const MDefinition* ins) const override; + + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + bool appendRoots(MRootList& roots) const override; + +}; + +// Guard on an object's group, inclusively or exclusively. +class MGuardObjectGroup + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + CompilerObjectGroup group_; + bool bailOnEquality_; + BailoutKind bailoutKind_; + + MGuardObjectGroup(MDefinition* obj, ObjectGroup* group, bool bailOnEquality, + BailoutKind bailoutKind) + : MUnaryInstruction(obj), + group_(group), + bailOnEquality_(bailOnEquality), + bailoutKind_(bailoutKind) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + + // Unboxed groups which might be converted to natives can't be guarded + // on, due to MConvertUnboxedObjectToNative. + MOZ_ASSERT_IF(group->maybeUnboxedLayoutDontCheckGeneration(), + !group->unboxedLayoutDontCheckGeneration().nativeGroup()); + } + + public: + INSTRUCTION_HEADER(GuardObjectGroup) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + const ObjectGroup* group() const { + return group_; + } + bool bailOnEquality() const { + return bailOnEquality_; + } + BailoutKind bailoutKind() const { + return bailoutKind_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGuardObjectGroup()) + return false; + if (group() != ins->toGuardObjectGroup()->group()) + return false; + if (bailOnEquality() != ins->toGuardObjectGroup()->bailOnEquality()) + return false; + if (bailoutKind() != ins->toGuardObjectGroup()->bailoutKind()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + bool appendRoots(MRootList& roots) const override { + return roots.append(group_); + } +}; + +// Guard on an object's identity, inclusively or exclusively. +class MGuardObjectIdentity + : public MBinaryInstruction, + public SingleObjectPolicy::Data +{ + bool bailOnEquality_; + + MGuardObjectIdentity(MDefinition* obj, MDefinition* expected, bool bailOnEquality) + : MBinaryInstruction(obj, expected), + bailOnEquality_(bailOnEquality) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(GuardObjectIdentity) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, expected)) + + bool bailOnEquality() const { + return bailOnEquality_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGuardObjectIdentity()) + return false; + if (bailOnEquality() != ins->toGuardObjectIdentity()->bailOnEquality()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Guard on an object's class. +class MGuardClass + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + const Class* class_; + + MGuardClass(MDefinition* obj, const Class* clasp) + : MUnaryInstruction(obj), + class_(clasp) + { + setGuard(); + setMovable(); + } + + public: + INSTRUCTION_HEADER(GuardClass) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + const Class* getClass() const { + return class_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGuardClass()) + return false; + if (getClass() != ins->toGuardClass()->getClass()) + return false; + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } + + ALLOW_CLONE(MGuardClass) +}; + +// Guard on the presence or absence of an unboxed object's expando. +class MGuardUnboxedExpando + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + bool requireExpando_; + BailoutKind bailoutKind_; + + MGuardUnboxedExpando(MDefinition* obj, bool requireExpando, BailoutKind bailoutKind) + : MUnaryInstruction(obj), + requireExpando_(requireExpando), + bailoutKind_(bailoutKind) + { + setGuard(); + setMovable(); + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(GuardUnboxedExpando) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool requireExpando() const { + return requireExpando_; + } + BailoutKind bailoutKind() const { + return bailoutKind_; + } + bool congruentTo(const MDefinition* ins) const override { + if (!congruentIfOperandsEqual(ins)) + return false; + if (requireExpando() != ins->toGuardUnboxedExpando()->requireExpando()) + return false; + return true; + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Load an unboxed plain object's expando. +class MLoadUnboxedExpando + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + private: + explicit MLoadUnboxedExpando(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Object); + setMovable(); + } + + public: + INSTRUCTION_HEADER(LoadUnboxedExpando) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::ObjectFields); + } +}; + +// Load from vp[slot] (slots that are not inline in an object). +class MLoadSlot + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + uint32_t slot_; + + MLoadSlot(MDefinition* slots, uint32_t slot) + : MUnaryInstruction(slots), + slot_(slot) + { + setResultType(MIRType::Value); + setMovable(); + MOZ_ASSERT(slots->type() == MIRType::Slots); + } + + public: + INSTRUCTION_HEADER(LoadSlot) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, slots)) + + uint32_t slot() const { + return slot_; + } + + HashNumber valueHash() const override; + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isLoadSlot()) + return false; + if (slot() != ins->toLoadSlot()->slot()) + return false; + return congruentIfOperandsEqual(ins); + } + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + MOZ_ASSERT(slots()->type() == MIRType::Slots); + return AliasSet::Load(AliasSet::DynamicSlot); + } + AliasType mightAlias(const MDefinition* store) const override; + + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MLoadSlot) +}; + +// Inline call to access a function's environment (scope chain). +class MFunctionEnvironment + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MFunctionEnvironment(MDefinition* function) + : MUnaryInstruction(function) + { + setResultType(MIRType::Object); + setMovable(); + } + + public: + INSTRUCTION_HEADER(FunctionEnvironment) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, function)) + + MDefinition* foldsTo(TempAllocator& alloc) override; + + // A function's environment is fixed. + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Store to vp[slot] (slots that are not inline in an object). +class MStoreSlot + : public MBinaryInstruction, + public MixPolicy<ObjectPolicy<0>, NoFloatPolicy<1> >::Data +{ + uint32_t slot_; + MIRType slotType_; + bool needsBarrier_; + + MStoreSlot(MDefinition* slots, uint32_t slot, MDefinition* value, bool barrier) + : MBinaryInstruction(slots, value), + slot_(slot), + slotType_(MIRType::Value), + needsBarrier_(barrier) + { + MOZ_ASSERT(slots->type() == MIRType::Slots); + } + + public: + INSTRUCTION_HEADER(StoreSlot) + NAMED_OPERANDS((0, slots), (1, value)) + + static MStoreSlot* New(TempAllocator& alloc, MDefinition* slots, uint32_t slot, + MDefinition* value) + { + return new(alloc) MStoreSlot(slots, slot, value, false); + } + static MStoreSlot* NewBarriered(TempAllocator& alloc, MDefinition* slots, uint32_t slot, + MDefinition* value) + { + return new(alloc) MStoreSlot(slots, slot, value, true); + } + + uint32_t slot() const { + return slot_; + } + MIRType slotType() const { + return slotType_; + } + void setSlotType(MIRType slotType) { + MOZ_ASSERT(slotType != MIRType::None); + slotType_ = slotType; + } + bool needsBarrier() const { + return needsBarrier_; + } + void setNeedsBarrier() { + needsBarrier_ = true; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::DynamicSlot); + } + void printOpcode(GenericPrinter& out) const override; + + ALLOW_CLONE(MStoreSlot) +}; + +class MGetNameCache + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + public: + enum AccessKind { + NAMETYPEOF, + NAME + }; + + private: + CompilerPropertyName name_; + AccessKind kind_; + + MGetNameCache(MDefinition* obj, PropertyName* name, AccessKind kind) + : MUnaryInstruction(obj), + name_(name), + kind_(kind) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(GetNameCache) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, envObj)) + + PropertyName* name() const { + return name_; + } + AccessKind accessKind() const { + return kind_; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MCallGetIntrinsicValue : public MNullaryInstruction +{ + CompilerPropertyName name_; + + explicit MCallGetIntrinsicValue(PropertyName* name) + : name_(name) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(CallGetIntrinsicValue) + TRIVIAL_NEW_WRAPPERS + + PropertyName* name() const { + return name_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MSetPropertyInstruction : public MBinaryInstruction +{ + CompilerPropertyName name_; + bool strict_; + + protected: + MSetPropertyInstruction(MDefinition* obj, MDefinition* value, PropertyName* name, + bool strict) + : MBinaryInstruction(obj, value), + name_(name), strict_(strict) + {} + + public: + NAMED_OPERANDS((0, object), (1, value)) + PropertyName* name() const { + return name_; + } + bool strict() const { + return strict_; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MSetElementInstruction + : public MTernaryInstruction +{ + bool strict_; + protected: + MSetElementInstruction(MDefinition* object, MDefinition* index, MDefinition* value, bool strict) + : MTernaryInstruction(object, index, value), + strict_(strict) + { + } + + public: + NAMED_OPERANDS((0, object), (1, index), (2, value)) + bool strict() const { + return strict_; + } +}; + +class MDeleteProperty + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + CompilerPropertyName name_; + bool strict_; + + protected: + MDeleteProperty(MDefinition* val, PropertyName* name, bool strict) + : MUnaryInstruction(val), + name_(name), + strict_(strict) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(DeleteProperty) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, value)) + + PropertyName* name() const { + return name_; + } + bool strict() const { + return strict_; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +class MDeleteElement + : public MBinaryInstruction, + public BoxInputsPolicy::Data +{ + bool strict_; + + MDeleteElement(MDefinition* value, MDefinition* index, bool strict) + : MBinaryInstruction(value, index), + strict_(strict) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(DeleteElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, value), (1, index)) + + bool strict() const { + return strict_; + } +}; + +// Note: This uses CallSetElementPolicy to always box its second input, +// ensuring we don't need two LIR instructions to lower this. +class MCallSetProperty + : public MSetPropertyInstruction, + public CallSetElementPolicy::Data +{ + MCallSetProperty(MDefinition* obj, MDefinition* value, PropertyName* name, bool strict) + : MSetPropertyInstruction(obj, value, name, strict) + { + } + + public: + INSTRUCTION_HEADER(CallSetProperty) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } +}; + +class MSetPropertyCache + : public MTernaryInstruction, + public Mix3Policy<SingleObjectPolicy, CacheIdPolicy<1>, NoFloatPolicy<2>>::Data +{ + bool strict_ : 1; + bool needsTypeBarrier_ : 1; + bool guardHoles_ : 1; + + MSetPropertyCache(MDefinition* obj, MDefinition* id, MDefinition* value, bool strict, + bool typeBarrier, bool guardHoles) + : MTernaryInstruction(obj, id, value), + strict_(strict), + needsTypeBarrier_(typeBarrier), + guardHoles_(guardHoles) + { + } + + public: + INSTRUCTION_HEADER(SetPropertyCache) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, idval), (2, value)) + + bool needsTypeBarrier() const { + return needsTypeBarrier_; + } + + bool guardHoles() const { + return guardHoles_; + } + + bool strict() const { + return strict_; + } +}; + +class MCallGetProperty + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + CompilerPropertyName name_; + bool idempotent_; + + MCallGetProperty(MDefinition* value, PropertyName* name) + : MUnaryInstruction(value), name_(name), + idempotent_(false) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(CallGetProperty) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, value)) + + PropertyName* name() const { + return name_; + } + + // Constructors need to perform a GetProp on the function prototype. + // Since getters cannot be set on the prototype, fetching is non-effectful. + // The operation may be safely repeated in case of bailout. + void setIdempotent() { + idempotent_ = true; + } + AliasSet getAliasSet() const override { + if (!idempotent_) + return AliasSet::Store(AliasSet::Any); + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(name_); + } +}; + +// Inline call to handle lhs[rhs]. The first input is a Value so that this +// instruction can handle both objects and strings. +class MCallGetElement + : public MBinaryInstruction, + public BoxInputsPolicy::Data +{ + MCallGetElement(MDefinition* lhs, MDefinition* rhs) + : MBinaryInstruction(lhs, rhs) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(CallGetElement) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } +}; + +class MCallSetElement + : public MSetElementInstruction, + public CallSetElementPolicy::Data +{ + MCallSetElement(MDefinition* object, MDefinition* index, MDefinition* value, bool strict) + : MSetElementInstruction(object, index, value, strict) + { + } + + public: + INSTRUCTION_HEADER(CallSetElement) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } +}; + +class MCallInitElementArray + : public MAryInstruction<2>, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >::Data +{ + uint32_t index_; + + MCallInitElementArray(MDefinition* obj, uint32_t index, MDefinition* val) + : index_(index) + { + initOperand(0, obj); + initOperand(1, val); + } + + public: + INSTRUCTION_HEADER(CallInitElementArray) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value)) + + uint32_t index() const { + return index_; + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MSetDOMProperty + : public MAryInstruction<2>, + public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >::Data +{ + const JSJitSetterOp func_; + + MSetDOMProperty(const JSJitSetterOp func, MDefinition* obj, MDefinition* val) + : func_(func) + { + initOperand(0, obj); + initOperand(1, val); + } + + public: + INSTRUCTION_HEADER(SetDOMProperty) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value)) + + JSJitSetterOp fun() const { + return func_; + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MGetDOMProperty + : public MVariadicInstruction, + public ObjectPolicy<0>::Data +{ + const JSJitInfo* info_; + + protected: + explicit MGetDOMProperty(const JSJitInfo* jitinfo) + : info_(jitinfo) + { + MOZ_ASSERT(jitinfo); + MOZ_ASSERT(jitinfo->type() == JSJitInfo::Getter); + + // We are movable iff the jitinfo says we can be. + if (isDomMovable()) { + MOZ_ASSERT(jitinfo->aliasSet() != JSJitInfo::AliasEverything); + setMovable(); + } else { + // If we're not movable, that means we shouldn't be DCEd either, + // because we might throw an exception when called, and getting rid + // of that is observable. + setGuard(); + } + + setResultType(MIRType::Value); + } + + const JSJitInfo* info() const { + return info_; + } + + MOZ_MUST_USE bool init(TempAllocator& alloc, MDefinition* obj, MDefinition* guard, + MDefinition* globalGuard) { + MOZ_ASSERT(obj); + // guard can be null. + // globalGuard can be null. + size_t operandCount = 1; + if (guard) + ++operandCount; + if (globalGuard) + ++operandCount; + if (!MVariadicInstruction::init(alloc, operandCount)) + return false; + initOperand(0, obj); + + size_t operandIndex = 1; + // Pin the guard, if we have one as an operand if we want to hoist later. + if (guard) + initOperand(operandIndex++, guard); + + // And the same for the global guard, if we have one. + if (globalGuard) + initOperand(operandIndex, globalGuard); + + return true; + } + + public: + INSTRUCTION_HEADER(GetDOMProperty) + NAMED_OPERANDS((0, object)) + + static MGetDOMProperty* New(TempAllocator& alloc, const JSJitInfo* info, MDefinition* obj, + MDefinition* guard, MDefinition* globalGuard) + { + auto* res = new(alloc) MGetDOMProperty(info); + if (!res || !res->init(alloc, obj, guard, globalGuard)) + return nullptr; + return res; + } + + JSJitGetterOp fun() const { + return info_->getter; + } + bool isInfallible() const { + return info_->isInfallible; + } + bool isDomMovable() const { + return info_->isMovable; + } + JSJitInfo::AliasSet domAliasSet() const { + return info_->aliasSet(); + } + size_t domMemberSlotIndex() const { + MOZ_ASSERT(info_->isAlwaysInSlot || info_->isLazilyCachedInSlot); + return info_->slotIndex; + } + bool valueMayBeInSlot() const { + return info_->isLazilyCachedInSlot; + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGetDOMProperty()) + return false; + + return congruentTo(ins->toGetDOMProperty()); + } + + bool congruentTo(const MGetDOMProperty* ins) const { + if (!isDomMovable()) + return false; + + // Checking the jitinfo is the same as checking the constant function + if (!(info() == ins->info())) + return false; + + return congruentIfOperandsEqual(ins); + } + + AliasSet getAliasSet() const override { + JSJitInfo::AliasSet aliasSet = domAliasSet(); + if (aliasSet == JSJitInfo::AliasNone) + return AliasSet::None(); + if (aliasSet == JSJitInfo::AliasDOMSets) + return AliasSet::Load(AliasSet::DOMProperty); + MOZ_ASSERT(aliasSet == JSJitInfo::AliasEverything); + return AliasSet::Store(AliasSet::Any); + } + + bool possiblyCalls() const override { + return true; + } +}; + +class MGetDOMMember : public MGetDOMProperty +{ + // We inherit everything from MGetDOMProperty except our + // possiblyCalls value and the congruentTo behavior. + explicit MGetDOMMember(const JSJitInfo* jitinfo) + : MGetDOMProperty(jitinfo) + { + setResultType(MIRTypeFromValueType(jitinfo->returnType())); + } + + public: + INSTRUCTION_HEADER(GetDOMMember) + + static MGetDOMMember* New(TempAllocator& alloc, const JSJitInfo* info, MDefinition* obj, + MDefinition* guard, MDefinition* globalGuard) + { + auto* res = new(alloc) MGetDOMMember(info); + if (!res || !res->init(alloc, obj, guard, globalGuard)) + return nullptr; + return res; + } + + bool possiblyCalls() const override { + return false; + } + + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isGetDOMMember()) + return false; + + return MGetDOMProperty::congruentTo(ins->toGetDOMMember()); + } +}; + +class MStringLength + : public MUnaryInstruction, + public StringPolicy<0>::Data +{ + explicit MStringLength(MDefinition* string) + : MUnaryInstruction(string) + { + setResultType(MIRType::Int32); + setMovable(); + } + public: + INSTRUCTION_HEADER(StringLength) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, string)) + + MDefinition* foldsTo(TempAllocator& alloc) override; + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + // The string |length| property is immutable, so there is no + // implicit dependency. + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MStringLength) +}; + +// Inlined version of Math.floor(). +class MFloor + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + explicit MFloor(MDefinition* num) + : MUnaryInstruction(num) + { + setResultType(MIRType::Int32); + specialization_ = MIRType::Double; + setMovable(); + } + + public: + INSTRUCTION_HEADER(Floor) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool isFloat32Commutative() const override { + return true; + } + void trySpecializeFloat32(TempAllocator& alloc) override; +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MFloor) +}; + +// Inlined version of Math.ceil(). +class MCeil + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + explicit MCeil(MDefinition* num) + : MUnaryInstruction(num) + { + setResultType(MIRType::Int32); + specialization_ = MIRType::Double; + setMovable(); + } + + public: + INSTRUCTION_HEADER(Ceil) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool isFloat32Commutative() const override { + return true; + } + void trySpecializeFloat32(TempAllocator& alloc) override; +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + void computeRange(TempAllocator& alloc) override; + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MCeil) +}; + +// Inlined version of Math.round(). +class MRound + : public MUnaryInstruction, + public FloatingPointPolicy<0>::Data +{ + explicit MRound(MDefinition* num) + : MUnaryInstruction(num) + { + setResultType(MIRType::Int32); + specialization_ = MIRType::Double; + setMovable(); + } + + public: + INSTRUCTION_HEADER(Round) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool isFloat32Commutative() const override { + return true; + } + void trySpecializeFloat32(TempAllocator& alloc) override; +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + return true; + } +#endif + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MRound) +}; + +class MIteratorStart + : public MUnaryInstruction, + public BoxExceptPolicy<0, MIRType::Object>::Data +{ + uint8_t flags_; + + MIteratorStart(MDefinition* obj, uint8_t flags) + : MUnaryInstruction(obj), flags_(flags) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(IteratorStart) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + uint8_t flags() const { + return flags_; + } +}; + +class MIteratorMore + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MIteratorMore(MDefinition* iter) + : MUnaryInstruction(iter) + { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(IteratorMore) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, iterator)) + +}; + +class MIsNoIter + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + explicit MIsNoIter(MDefinition* def) + : MUnaryInstruction(def) + { + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(IsNoIter) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MIteratorEnd + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MIteratorEnd(MDefinition* iter) + : MUnaryInstruction(iter) + { } + + public: + INSTRUCTION_HEADER(IteratorEnd) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, iterator)) + +}; + +// Implementation for 'in' operator. +class MIn + : public MBinaryInstruction, + public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >::Data +{ + MIn(MDefinition* key, MDefinition* obj) + : MBinaryInstruction(key, obj) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(In) + TRIVIAL_NEW_WRAPPERS + + bool possiblyCalls() const override { + return true; + } +}; + + +// Test whether the index is in the array bounds or a hole. +class MInArray + : public MQuaternaryInstruction, + public ObjectPolicy<3>::Data +{ + bool needsHoleCheck_; + bool needsNegativeIntCheck_; + JSValueType unboxedType_; + + MInArray(MDefinition* elements, MDefinition* index, + MDefinition* initLength, MDefinition* object, + bool needsHoleCheck, JSValueType unboxedType) + : MQuaternaryInstruction(elements, index, initLength, object), + needsHoleCheck_(needsHoleCheck), + needsNegativeIntCheck_(true), + unboxedType_(unboxedType) + { + setResultType(MIRType::Boolean); + setMovable(); + MOZ_ASSERT(elements->type() == MIRType::Elements); + MOZ_ASSERT(index->type() == MIRType::Int32); + MOZ_ASSERT(initLength->type() == MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(InArray) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, initLength), (3, object)) + + bool needsHoleCheck() const { + return needsHoleCheck_; + } + bool needsNegativeIntCheck() const { + return needsNegativeIntCheck_; + } + JSValueType unboxedType() const { + return unboxedType_; + } + void collectRangeInfoPreTrunc() override; + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::Element); + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isInArray()) + return false; + const MInArray* other = ins->toInArray(); + if (needsHoleCheck() != other->needsHoleCheck()) + return false; + if (needsNegativeIntCheck() != other->needsNegativeIntCheck()) + return false; + if (unboxedType() != other->unboxedType()) + return false; + return congruentIfOperandsEqual(other); + } +}; + +// Implementation for instanceof operator with specific rhs. +class MInstanceOf + : public MUnaryInstruction, + public InstanceOfPolicy::Data +{ + CompilerObject protoObj_; + + MInstanceOf(MDefinition* obj, JSObject* proto) + : MUnaryInstruction(obj), + protoObj_(proto) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(InstanceOf) + TRIVIAL_NEW_WRAPPERS + + JSObject* prototypeObject() { + return protoObj_; + } + + bool appendRoots(MRootList& roots) const override { + return roots.append(protoObj_); + } +}; + +// Implementation for instanceof operator with unknown rhs. +class MCallInstanceOf + : public MBinaryInstruction, + public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >::Data +{ + MCallInstanceOf(MDefinition* obj, MDefinition* proto) + : MBinaryInstruction(obj, proto) + { + setResultType(MIRType::Boolean); + } + + public: + INSTRUCTION_HEADER(CallInstanceOf) + TRIVIAL_NEW_WRAPPERS +}; + +class MArgumentsLength : public MNullaryInstruction +{ + MArgumentsLength() + { + setResultType(MIRType::Int32); + setMovable(); + } + + public: + INSTRUCTION_HEADER(ArgumentsLength) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + // Arguments |length| cannot be mutated by Ion Code. + return AliasSet::None(); + } + + void computeRange(TempAllocator& alloc) override; + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + + bool canRecoverOnBailout() const override { + return true; + } +}; + +// This MIR instruction is used to get an argument from the actual arguments. +class MGetFrameArgument + : public MUnaryInstruction, + public IntPolicy<0>::Data +{ + bool scriptHasSetArg_; + + MGetFrameArgument(MDefinition* idx, bool scriptHasSetArg) + : MUnaryInstruction(idx), + scriptHasSetArg_(scriptHasSetArg) + { + setResultType(MIRType::Value); + setMovable(); + } + + public: + INSTRUCTION_HEADER(GetFrameArgument) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, index)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + // If the script doesn't have any JSOP_SETARG ops, then this instruction is never + // aliased. + if (scriptHasSetArg_) + return AliasSet::Load(AliasSet::FrameArgument); + return AliasSet::None(); + } +}; + +class MNewTarget : public MNullaryInstruction +{ + MNewTarget() : MNullaryInstruction() { + setResultType(MIRType::Value); + setMovable(); + } + + public: + INSTRUCTION_HEADER(NewTarget) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// This MIR instruction is used to set an argument value in the frame. +class MSetFrameArgument + : public MUnaryInstruction, + public NoFloatPolicy<0>::Data +{ + uint32_t argno_; + + MSetFrameArgument(uint32_t argno, MDefinition* value) + : MUnaryInstruction(value), + argno_(argno) + { + setMovable(); + } + + public: + INSTRUCTION_HEADER(SetFrameArgument) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, value)) + + uint32_t argno() const { + return argno_; + } + + bool congruentTo(const MDefinition* ins) const override { + return false; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::FrameArgument); + } +}; + +class MRestCommon +{ + unsigned numFormals_; + CompilerGCPointer<ArrayObject*> templateObject_; + + protected: + MRestCommon(unsigned numFormals, ArrayObject* templateObject) + : numFormals_(numFormals), + templateObject_(templateObject) + { } + + public: + unsigned numFormals() const { + return numFormals_; + } + ArrayObject* templateObject() const { + return templateObject_; + } +}; + +class MRest + : public MUnaryInstruction, + public MRestCommon, + public IntPolicy<0>::Data +{ + MRest(CompilerConstraintList* constraints, MDefinition* numActuals, unsigned numFormals, + ArrayObject* templateObject) + : MUnaryInstruction(numActuals), + MRestCommon(numFormals, templateObject) + { + setResultType(MIRType::Object); + setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject)); + } + + public: + INSTRUCTION_HEADER(Rest) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, numActuals)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool possiblyCalls() const override { + return true; + } + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObject()); + } +}; + +class MFilterTypeSet + : public MUnaryInstruction, + public FilterTypeSetPolicy::Data +{ + MFilterTypeSet(MDefinition* def, TemporaryTypeSet* types) + : MUnaryInstruction(def) + { + MOZ_ASSERT(!types->unknown()); + setResultType(types->getKnownMIRType()); + setResultTypeSet(types); + } + + public: + INSTRUCTION_HEADER(FilterTypeSet) + TRIVIAL_NEW_WRAPPERS + + bool congruentTo(const MDefinition* def) const override { + return false; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + virtual bool neverHoist() const override { + return resultTypeSet()->empty(); + } + void computeRange(TempAllocator& alloc) override; + + bool isFloat32Commutative() const override { + return IsFloatingPointType(type()); + } + + bool canProduceFloat32() const override; + bool canConsumeFloat32(MUse* operand) const override; + void trySpecializeFloat32(TempAllocator& alloc) override; +}; + +// Given a value, guard that the value is in a particular TypeSet, then returns +// that value. +class MTypeBarrier + : public MUnaryInstruction, + public TypeBarrierPolicy::Data +{ + BarrierKind barrierKind_; + + MTypeBarrier(MDefinition* def, TemporaryTypeSet* types, + BarrierKind kind = BarrierKind::TypeSet) + : MUnaryInstruction(def), + barrierKind_(kind) + { + MOZ_ASSERT(kind == BarrierKind::TypeTagOnly || kind == BarrierKind::TypeSet); + + MOZ_ASSERT(!types->unknown()); + setResultType(types->getKnownMIRType()); + setResultTypeSet(types); + + setGuard(); + setMovable(); + } + + public: + INSTRUCTION_HEADER(TypeBarrier) + TRIVIAL_NEW_WRAPPERS + + void printOpcode(GenericPrinter& out) const override; + bool congruentTo(const MDefinition* def) const override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + virtual bool neverHoist() const override { + return resultTypeSet()->empty(); + } + BarrierKind barrierKind() const { + return barrierKind_; + } + + bool alwaysBails() const { + // If mirtype of input doesn't agree with mirtype of barrier, + // we will definitely bail. + MIRType type = resultTypeSet()->getKnownMIRType(); + if (type == MIRType::Value) + return false; + if (input()->type() == MIRType::Value) + return false; + if (input()->type() == MIRType::ObjectOrNull) { + // The ObjectOrNull optimization is only performed when the + // barrier's type is MIRType::Null. + MOZ_ASSERT(type == MIRType::Null); + return false; + } + return input()->type() != type; + } + + ALLOW_CLONE(MTypeBarrier) +}; + +// Like MTypeBarrier, guard that the value is in the given type set. This is +// used before property writes to ensure the value being written is represented +// in the property types for the object. +class MMonitorTypes + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + const TemporaryTypeSet* typeSet_; + BarrierKind barrierKind_; + + MMonitorTypes(MDefinition* def, const TemporaryTypeSet* types, BarrierKind kind) + : MUnaryInstruction(def), + typeSet_(types), + barrierKind_(kind) + { + MOZ_ASSERT(kind == BarrierKind::TypeTagOnly || kind == BarrierKind::TypeSet); + + setGuard(); + MOZ_ASSERT(!types->unknown()); + } + + public: + INSTRUCTION_HEADER(MonitorTypes) + TRIVIAL_NEW_WRAPPERS + + const TemporaryTypeSet* typeSet() const { + return typeSet_; + } + BarrierKind barrierKind() const { + return barrierKind_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +// Given a value being written to another object, update the generational store +// buffer if the value is in the nursery and object is in the tenured heap. +class MPostWriteBarrier : public MBinaryInstruction, public ObjectPolicy<0>::Data +{ + MPostWriteBarrier(MDefinition* obj, MDefinition* value) + : MBinaryInstruction(obj, value) + { + setGuard(); + } + + public: + INSTRUCTION_HEADER(PostWriteBarrier) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + // During lowering, values that neither have object nor value MIR type + // are ignored, thus Float32 can show up at this point without any issue. + return use == getUseFor(1); + } +#endif + + ALLOW_CLONE(MPostWriteBarrier) +}; + +// Given a value being written to another object's elements at the specified +// index, update the generational store buffer if the value is in the nursery +// and object is in the tenured heap. +class MPostWriteElementBarrier : public MTernaryInstruction + , public MixPolicy<ObjectPolicy<0>, IntPolicy<2>>::Data +{ + MPostWriteElementBarrier(MDefinition* obj, MDefinition* value, MDefinition* index) + : MTernaryInstruction(obj, value, index) + { + setGuard(); + } + + public: + INSTRUCTION_HEADER(PostWriteElementBarrier) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object), (1, value), (2, index)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + +#ifdef DEBUG + bool isConsistentFloat32Use(MUse* use) const override { + // During lowering, values that neither have object nor value MIR type + // are ignored, thus Float32 can show up at this point without any issue. + return use == getUseFor(1); + } +#endif + + ALLOW_CLONE(MPostWriteElementBarrier) +}; + +class MNewNamedLambdaObject : public MNullaryInstruction +{ + CompilerGCPointer<LexicalEnvironmentObject*> templateObj_; + + explicit MNewNamedLambdaObject(LexicalEnvironmentObject* templateObj) + : MNullaryInstruction(), + templateObj_(templateObj) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(NewNamedLambdaObject) + TRIVIAL_NEW_WRAPPERS + + LexicalEnvironmentObject* templateObj() { + return templateObj_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObj_); + } +}; + +class MNewCallObjectBase : public MNullaryInstruction +{ + CompilerGCPointer<CallObject*> templateObj_; + + protected: + explicit MNewCallObjectBase(CallObject* templateObj) + : MNullaryInstruction(), + templateObj_(templateObj) + { + setResultType(MIRType::Object); + } + + public: + CallObject* templateObject() { + return templateObj_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObj_); + } +}; + +class MNewCallObject : public MNewCallObjectBase +{ + public: + INSTRUCTION_HEADER(NewCallObject) + + explicit MNewCallObject(CallObject* templateObj) + : MNewCallObjectBase(templateObj) + { + MOZ_ASSERT(!templateObj->isSingleton()); + } + + static MNewCallObject* + New(TempAllocator& alloc, CallObject* templateObj) + { + return new(alloc) MNewCallObject(templateObj); + } +}; + +class MNewSingletonCallObject : public MNewCallObjectBase +{ + public: + INSTRUCTION_HEADER(NewSingletonCallObject) + + explicit MNewSingletonCallObject(CallObject* templateObj) + : MNewCallObjectBase(templateObj) + {} + + static MNewSingletonCallObject* + New(TempAllocator& alloc, CallObject* templateObj) + { + return new(alloc) MNewSingletonCallObject(templateObj); + } +}; + +class MNewStringObject : + public MUnaryInstruction, + public ConvertToStringPolicy<0>::Data +{ + CompilerObject templateObj_; + + MNewStringObject(MDefinition* input, JSObject* templateObj) + : MUnaryInstruction(input), + templateObj_(templateObj) + { + setResultType(MIRType::Object); + } + + public: + INSTRUCTION_HEADER(NewStringObject) + TRIVIAL_NEW_WRAPPERS + + StringObject* templateObj() const; + + bool appendRoots(MRootList& roots) const override { + return roots.append(templateObj_); + } +}; + +// This is an alias for MLoadFixedSlot. +class MEnclosingEnvironment : public MLoadFixedSlot +{ + explicit MEnclosingEnvironment(MDefinition* obj) + : MLoadFixedSlot(obj, EnvironmentObject::enclosingEnvironmentSlot()) + { + setResultType(MIRType::Object); + } + + public: + static MEnclosingEnvironment* New(TempAllocator& alloc, MDefinition* obj) { + return new(alloc) MEnclosingEnvironment(obj); + } + + AliasSet getAliasSet() const override { + // EnvironmentObject reserved slots are immutable. + return AliasSet::None(); + } +}; + +// This is an element of a spaghetti stack which is used to represent the memory +// context which has to be restored in case of a bailout. +struct MStoreToRecover : public TempObject, public InlineSpaghettiStackNode<MStoreToRecover> +{ + MDefinition* operand; + + explicit MStoreToRecover(MDefinition* operand) + : operand(operand) + { } +}; + +typedef InlineSpaghettiStack<MStoreToRecover> MStoresToRecoverList; + +// A resume point contains the information needed to reconstruct the Baseline +// state from a position in the JIT. See the big comment near resumeAfter() in +// IonBuilder.cpp. +class MResumePoint final : + public MNode +#ifdef DEBUG + , public InlineForwardListNode<MResumePoint> +#endif +{ + public: + enum Mode { + ResumeAt, // Resume until before the current instruction + ResumeAfter, // Resume after the current instruction + Outer // State before inlining. + }; + + private: + friend class MBasicBlock; + friend void AssertBasicGraphCoherency(MIRGraph& graph); + + // List of stack slots needed to reconstruct the frame corresponding to the + // function which is compiled by IonBuilder. + FixedList<MUse> operands_; + + // List of stores needed to reconstruct the content of objects which are + // emulated by EmulateStateOf variants. + MStoresToRecoverList stores_; + + jsbytecode* pc_; + MInstruction* instruction_; + Mode mode_; + + MResumePoint(MBasicBlock* block, jsbytecode* pc, Mode mode); + void inherit(MBasicBlock* state); + + protected: + // Initializes operands_ to an empty array of a fixed length. + // The array may then be filled in by inherit(). + MOZ_MUST_USE bool init(TempAllocator& alloc); + + void clearOperand(size_t index) { + // FixedList doesn't initialize its elements, so do an unchecked init. + operands_[index].initUncheckedWithoutProducer(this); + } + + MUse* getUseFor(size_t index) override { + return &operands_[index]; + } + const MUse* getUseFor(size_t index) const override { + return &operands_[index]; + } + + public: + static MResumePoint* New(TempAllocator& alloc, MBasicBlock* block, jsbytecode* pc, + Mode mode); + static MResumePoint* New(TempAllocator& alloc, MBasicBlock* block, MResumePoint* model, + const MDefinitionVector& operands); + static MResumePoint* Copy(TempAllocator& alloc, MResumePoint* src); + + MNode::Kind kind() const override { + return MNode::ResumePoint; + } + size_t numAllocatedOperands() const { + return operands_.length(); + } + uint32_t stackDepth() const { + return numAllocatedOperands(); + } + size_t numOperands() const override { + return numAllocatedOperands(); + } + size_t indexOf(const MUse* u) const final override { + MOZ_ASSERT(u >= &operands_[0]); + MOZ_ASSERT(u <= &operands_[numOperands() - 1]); + return u - &operands_[0]; + } + void initOperand(size_t index, MDefinition* operand) { + // FixedList doesn't initialize its elements, so do an unchecked init. + operands_[index].initUnchecked(operand, this); + } + void replaceOperand(size_t index, MDefinition* operand) final override { + operands_[index].replaceProducer(operand); + } + + bool isObservableOperand(MUse* u) const; + bool isObservableOperand(size_t index) const; + bool isRecoverableOperand(MUse* u) const; + + MDefinition* getOperand(size_t index) const override { + return operands_[index].producer(); + } + jsbytecode* pc() const { + return pc_; + } + MResumePoint* caller() const; + uint32_t frameCount() const { + uint32_t count = 1; + for (MResumePoint* it = caller(); it; it = it->caller()) + count++; + return count; + } + MInstruction* instruction() { + return instruction_; + } + void setInstruction(MInstruction* ins) { + MOZ_ASSERT(!instruction_); + instruction_ = ins; + } + // Only to be used by stealResumePoint. + void replaceInstruction(MInstruction* ins) { + MOZ_ASSERT(instruction_); + instruction_ = ins; + } + void resetInstruction() { + MOZ_ASSERT(instruction_); + instruction_ = nullptr; + } + Mode mode() const { + return mode_; + } + + void releaseUses() { + for (size_t i = 0, e = numOperands(); i < e; i++) { + if (operands_[i].hasProducer()) + operands_[i].releaseProducer(); + } + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + + // Register a store instruction on the current resume point. This + // instruction would be recovered when we are bailing out. The |cache| + // argument can be any resume point, it is used to share memory if we are + // doing the same modification. + void addStore(TempAllocator& alloc, MDefinition* store, const MResumePoint* cache = nullptr); + + MStoresToRecoverList::iterator storesBegin() const { + return stores_.begin(); + } + MStoresToRecoverList::iterator storesEnd() const { + return stores_.end(); + } + + virtual void dump(GenericPrinter& out) const override; + virtual void dump() const override; +}; + +class MIsCallable + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MIsCallable(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(IsCallable) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MIsConstructor + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + public: + explicit MIsConstructor(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(IsConstructor) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MIsObject + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MIsObject(MDefinition* object) + : MUnaryInstruction(object) + { + setResultType(MIRType::Boolean); + setMovable(); + } + public: + INSTRUCTION_HEADER(IsObject) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MHasClass + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + const Class* class_; + + MHasClass(MDefinition* object, const Class* clasp) + : MUnaryInstruction(object) + , class_(clasp) + { + MOZ_ASSERT(object->type() == MIRType::Object); + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(HasClass) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + const Class* getClass() const { + return class_; + } + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + if (!ins->isHasClass()) + return false; + if (getClass() != ins->toHasClass()->getClass()) + return false; + return congruentIfOperandsEqual(ins); + } +}; + +class MCheckReturn + : public MBinaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MCheckReturn(MDefinition* retVal, MDefinition* thisVal) + : MBinaryInstruction(retVal, thisVal) + { + setGuard(); + setResultType(MIRType::Value); + setResultTypeSet(retVal->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(CheckReturn) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, returnValue), (1, thisValue)) + +}; + +// Increase the warm-up counter of the provided script upon execution and test if +// the warm-up counter surpasses the threshold. Upon hit it will recompile the +// outermost script (i.e. not the inlined script). +class MRecompileCheck : public MNullaryInstruction +{ + public: + enum RecompileCheckType { + RecompileCheck_OptimizationLevel, + RecompileCheck_Inlining + }; + + private: + JSScript* script_; + uint32_t recompileThreshold_; + bool forceRecompilation_; + bool increaseWarmUpCounter_; + + MRecompileCheck(JSScript* script, uint32_t recompileThreshold, RecompileCheckType type) + : script_(script), + recompileThreshold_(recompileThreshold) + { + switch (type) { + case RecompileCheck_OptimizationLevel: + forceRecompilation_ = false; + increaseWarmUpCounter_ = true; + break; + case RecompileCheck_Inlining: + forceRecompilation_ = true; + increaseWarmUpCounter_ = false; + break; + default: + MOZ_CRASH("Unexpected recompile check type"); + } + + setGuard(); + } + + public: + INSTRUCTION_HEADER(RecompileCheck) + TRIVIAL_NEW_WRAPPERS + + JSScript* script() const { + return script_; + } + + uint32_t recompileThreshold() const { + return recompileThreshold_; + } + + bool forceRecompilation() const { + return forceRecompilation_; + } + + bool increaseWarmUpCounter() const { + return increaseWarmUpCounter_; + } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MAtomicIsLockFree + : public MUnaryInstruction, + public ConvertToInt32Policy<0>::Data +{ + explicit MAtomicIsLockFree(MDefinition* value) + : MUnaryInstruction(value) + { + setResultType(MIRType::Boolean); + setMovable(); + } + + public: + INSTRUCTION_HEADER(AtomicIsLockFree) + TRIVIAL_NEW_WRAPPERS + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override; + bool canRecoverOnBailout() const override { + return true; + } + + ALLOW_CLONE(MAtomicIsLockFree) +}; + +// This applies to an object that is known to be a TypedArray, it bails out +// if the obj does not map a SharedArrayBuffer. + +class MGuardSharedTypedArray + : public MUnaryInstruction, + public SingleObjectPolicy::Data +{ + explicit MGuardSharedTypedArray(MDefinition* obj) + : MUnaryInstruction(obj) + { + setGuard(); + setMovable(); + } + +public: + INSTRUCTION_HEADER(GuardSharedTypedArray) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, object)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MCompareExchangeTypedArrayElement + : public MAryInstruction<4>, + public Mix4Policy<ObjectPolicy<0>, IntPolicy<1>, TruncateToInt32Policy<2>, TruncateToInt32Policy<3>>::Data +{ + Scalar::Type arrayType_; + + explicit MCompareExchangeTypedArrayElement(MDefinition* elements, MDefinition* index, + Scalar::Type arrayType, MDefinition* oldval, + MDefinition* newval) + : arrayType_(arrayType) + { + initOperand(0, elements); + initOperand(1, index); + initOperand(2, oldval); + initOperand(3, newval); + setGuard(); // Not removable + } + + public: + INSTRUCTION_HEADER(CompareExchangeTypedArrayElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, oldval), (3, newval)) + + bool isByteArray() const { + return (arrayType_ == Scalar::Int8 || + arrayType_ == Scalar::Uint8); + } + int oldvalOperand() { + return 2; + } + Scalar::Type arrayType() const { + return arrayType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } +}; + +class MAtomicExchangeTypedArrayElement + : public MAryInstruction<3>, + public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, TruncateToInt32Policy<2>>::Data +{ + Scalar::Type arrayType_; + + MAtomicExchangeTypedArrayElement(MDefinition* elements, MDefinition* index, MDefinition* value, + Scalar::Type arrayType) + : arrayType_(arrayType) + { + MOZ_ASSERT(arrayType <= Scalar::Uint32); + initOperand(0, elements); + initOperand(1, index); + initOperand(2, value); + setGuard(); // Not removable + } + + public: + INSTRUCTION_HEADER(AtomicExchangeTypedArrayElement) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value)) + + bool isByteArray() const { + return (arrayType_ == Scalar::Int8 || + arrayType_ == Scalar::Uint8); + } + Scalar::Type arrayType() const { + return arrayType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } +}; + +class MAtomicTypedArrayElementBinop + : public MAryInstruction<3>, + public Mix3Policy< ObjectPolicy<0>, IntPolicy<1>, TruncateToInt32Policy<2> >::Data +{ + private: + AtomicOp op_; + Scalar::Type arrayType_; + + protected: + explicit MAtomicTypedArrayElementBinop(AtomicOp op, MDefinition* elements, MDefinition* index, + Scalar::Type arrayType, MDefinition* value) + : op_(op), + arrayType_(arrayType) + { + initOperand(0, elements); + initOperand(1, index); + initOperand(2, value); + setGuard(); // Not removable + } + + public: + INSTRUCTION_HEADER(AtomicTypedArrayElementBinop) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, elements), (1, index), (2, value)) + + bool isByteArray() const { + return (arrayType_ == Scalar::Int8 || + arrayType_ == Scalar::Uint8); + } + AtomicOp operation() const { + return op_; + } + Scalar::Type arrayType() const { + return arrayType_; + } + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::UnboxedElement); + } +}; + +class MDebugger : public MNullaryInstruction +{ + public: + INSTRUCTION_HEADER(Debugger) + TRIVIAL_NEW_WRAPPERS +}; + +class MCheckIsObj + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + uint8_t checkKind_; + + explicit MCheckIsObj(MDefinition* toCheck, uint8_t checkKind) + : MUnaryInstruction(toCheck), checkKind_(checkKind) + { + setResultType(MIRType::Value); + setResultTypeSet(toCheck->resultTypeSet()); + setGuard(); + } + + public: + INSTRUCTION_HEADER(CheckIsObj) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, checkValue)) + + uint8_t checkKind() const { return checkKind_; } + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } +}; + +class MCheckObjCoercible + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MCheckObjCoercible(MDefinition* toCheck) + : MUnaryInstruction(toCheck) + { + setGuard(); + setResultType(MIRType::Value); + setResultTypeSet(toCheck->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(CheckObjCoercible) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, checkValue)) +}; + +class MDebugCheckSelfHosted + : public MUnaryInstruction, + public BoxInputsPolicy::Data +{ + explicit MDebugCheckSelfHosted(MDefinition* toCheck) + : MUnaryInstruction(toCheck) + { + setGuard(); + setResultType(MIRType::Value); + setResultTypeSet(toCheck->resultTypeSet()); + } + + public: + INSTRUCTION_HEADER(DebugCheckSelfHosted) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, checkValue)) + +}; + +class MAsmJSNeg + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + MAsmJSNeg(MDefinition* op, MIRType type) + : MUnaryInstruction(op) + { + setResultType(type); + setMovable(); + } + + public: + INSTRUCTION_HEADER(AsmJSNeg) + TRIVIAL_NEW_WRAPPERS +}; + +class MWasmBoundsCheck + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + bool redundant_; + wasm::TrapOffset trapOffset_; + + explicit MWasmBoundsCheck(MDefinition* index, wasm::TrapOffset trapOffset) + : MUnaryInstruction(index), + redundant_(false), + trapOffset_(trapOffset) + { + setGuard(); // Effectful: throws for OOB. + } + + public: + INSTRUCTION_HEADER(WasmBoundsCheck) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool isRedundant() const { + return redundant_; + } + + void setRedundant(bool val) { + redundant_ = val; + } + + wasm::TrapOffset trapOffset() const { + return trapOffset_; + } +}; + +class MWasmAddOffset + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + uint32_t offset_; + wasm::TrapOffset trapOffset_; + + MWasmAddOffset(MDefinition* base, uint32_t offset, wasm::TrapOffset trapOffset) + : MUnaryInstruction(base), + offset_(offset), + trapOffset_(trapOffset) + { + setGuard(); + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(WasmAddOffset) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, base)) + + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + uint32_t offset() const { + return offset_; + } + wasm::TrapOffset trapOffset() const { + return trapOffset_; + } +}; + +class MWasmLoad + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + wasm::MemoryAccessDesc access_; + + MWasmLoad(MDefinition* base, const wasm::MemoryAccessDesc& access, MIRType resultType) + : MUnaryInstruction(base), + access_(access) + { + setGuard(); + setResultType(resultType); + } + + public: + INSTRUCTION_HEADER(WasmLoad) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, base)) + + const wasm::MemoryAccessDesc& access() const { + return access_; + } + + AliasSet getAliasSet() const override { + // When a barrier is needed, make the instruction effectful by giving + // it a "store" effect. + if (access_.isAtomic()) + return AliasSet::Store(AliasSet::WasmHeap); + return AliasSet::Load(AliasSet::WasmHeap); + } +}; + +class MWasmStore + : public MBinaryInstruction, + public NoTypePolicy::Data +{ + wasm::MemoryAccessDesc access_; + + MWasmStore(MDefinition* base, const wasm::MemoryAccessDesc& access, MDefinition* value) + : MBinaryInstruction(base, value), + access_(access) + { + setGuard(); + } + + public: + INSTRUCTION_HEADER(WasmStore) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, base), (1, value)) + + const wasm::MemoryAccessDesc& access() const { + return access_; + } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmHeap); + } +}; + +class MAsmJSMemoryAccess +{ + uint32_t offset_; + Scalar::Type accessType_; + bool needsBoundsCheck_; + + public: + explicit MAsmJSMemoryAccess(Scalar::Type accessType) + : offset_(0), + accessType_(accessType), + needsBoundsCheck_(true) + { + MOZ_ASSERT(accessType != Scalar::Uint8Clamped); + MOZ_ASSERT(!Scalar::isSimdType(accessType)); + } + + uint32_t offset() const { return offset_; } + uint32_t endOffset() const { return offset() + byteSize(); } + Scalar::Type accessType() const { return accessType_; } + unsigned byteSize() const { return TypedArrayElemSize(accessType()); } + bool needsBoundsCheck() const { return needsBoundsCheck_; } + + wasm::MemoryAccessDesc access() const { + return wasm::MemoryAccessDesc(accessType_, Scalar::byteSize(accessType_), offset_, + mozilla::Nothing()); + } + + void removeBoundsCheck() { needsBoundsCheck_ = false; } + void setOffset(uint32_t o) { offset_ = o; } +}; + +class MAsmJSLoadHeap + : public MUnaryInstruction, + public MAsmJSMemoryAccess, + public NoTypePolicy::Data +{ + MAsmJSLoadHeap(MDefinition* base, Scalar::Type accessType) + : MUnaryInstruction(base), + MAsmJSMemoryAccess(accessType) + { + setResultType(ScalarTypeToMIRType(accessType)); + } + + public: + INSTRUCTION_HEADER(AsmJSLoadHeap) + TRIVIAL_NEW_WRAPPERS + + MDefinition* base() const { return getOperand(0); } + void replaceBase(MDefinition* newBase) { replaceOperand(0, newBase); } + + bool congruentTo(const MDefinition* ins) const override; + AliasSet getAliasSet() const override { + return AliasSet::Load(AliasSet::WasmHeap); + } + AliasType mightAlias(const MDefinition* def) const override; +}; + +class MAsmJSStoreHeap + : public MBinaryInstruction, + public MAsmJSMemoryAccess, + public NoTypePolicy::Data +{ + MAsmJSStoreHeap(MDefinition* base, Scalar::Type accessType, MDefinition* v) + : MBinaryInstruction(base, v), + MAsmJSMemoryAccess(accessType) + {} + + public: + INSTRUCTION_HEADER(AsmJSStoreHeap) + TRIVIAL_NEW_WRAPPERS + + MDefinition* base() const { return getOperand(0); } + void replaceBase(MDefinition* newBase) { replaceOperand(0, newBase); } + MDefinition* value() const { return getOperand(1); } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmHeap); + } +}; + +class MAsmJSCompareExchangeHeap + : public MQuaternaryInstruction, + public NoTypePolicy::Data +{ + wasm::MemoryAccessDesc access_; + + MAsmJSCompareExchangeHeap(MDefinition* base, const wasm::MemoryAccessDesc& access, + MDefinition* oldv, MDefinition* newv, MDefinition* tls) + : MQuaternaryInstruction(base, oldv, newv, tls), + access_(access) + { + setGuard(); // Not removable + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(AsmJSCompareExchangeHeap) + TRIVIAL_NEW_WRAPPERS + + const wasm::MemoryAccessDesc& access() const { return access_; } + + MDefinition* base() const { return getOperand(0); } + MDefinition* oldValue() const { return getOperand(1); } + MDefinition* newValue() const { return getOperand(2); } + MDefinition* tls() const { return getOperand(3); } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmHeap); + } +}; + +class MAsmJSAtomicExchangeHeap + : public MTernaryInstruction, + public NoTypePolicy::Data +{ + wasm::MemoryAccessDesc access_; + + MAsmJSAtomicExchangeHeap(MDefinition* base, const wasm::MemoryAccessDesc& access, + MDefinition* value, MDefinition* tls) + : MTernaryInstruction(base, value, tls), + access_(access) + { + setGuard(); // Not removable + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(AsmJSAtomicExchangeHeap) + TRIVIAL_NEW_WRAPPERS + + const wasm::MemoryAccessDesc& access() const { return access_; } + + MDefinition* base() const { return getOperand(0); } + MDefinition* value() const { return getOperand(1); } + MDefinition* tls() const { return getOperand(2); } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmHeap); + } +}; + +class MAsmJSAtomicBinopHeap + : public MTernaryInstruction, + public NoTypePolicy::Data +{ + AtomicOp op_; + wasm::MemoryAccessDesc access_; + + MAsmJSAtomicBinopHeap(AtomicOp op, MDefinition* base, const wasm::MemoryAccessDesc& access, + MDefinition* v, MDefinition* tls) + : MTernaryInstruction(base, v, tls), + op_(op), + access_(access) + { + setGuard(); // Not removable + setResultType(MIRType::Int32); + } + + public: + INSTRUCTION_HEADER(AsmJSAtomicBinopHeap) + TRIVIAL_NEW_WRAPPERS + + AtomicOp operation() const { return op_; } + const wasm::MemoryAccessDesc& access() const { return access_; } + + MDefinition* base() const { return getOperand(0); } + MDefinition* value() const { return getOperand(1); } + MDefinition* tls() const { return getOperand(2); } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmHeap); + } +}; + +class MWasmLoadGlobalVar : public MNullaryInstruction +{ + MWasmLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant) + : globalDataOffset_(globalDataOffset), isConstant_(isConstant) + { + MOZ_ASSERT(IsNumberType(type) || IsSimdType(type)); + setResultType(type); + setMovable(); + } + + unsigned globalDataOffset_; + bool isConstant_; + + public: + INSTRUCTION_HEADER(WasmLoadGlobalVar) + TRIVIAL_NEW_WRAPPERS + + unsigned globalDataOffset() const { return globalDataOffset_; } + + HashNumber valueHash() const override; + bool congruentTo(const MDefinition* ins) const override; + MDefinition* foldsTo(TempAllocator& alloc) override; + + AliasSet getAliasSet() const override { + return isConstant_ ? AliasSet::None() : AliasSet::Load(AliasSet::WasmGlobalVar); + } + + AliasType mightAlias(const MDefinition* def) const override; +}; + +class MWasmStoreGlobalVar + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + MWasmStoreGlobalVar(unsigned globalDataOffset, MDefinition* v) + : MUnaryInstruction(v), globalDataOffset_(globalDataOffset) + {} + + unsigned globalDataOffset_; + + public: + INSTRUCTION_HEADER(WasmStoreGlobalVar) + TRIVIAL_NEW_WRAPPERS + + unsigned globalDataOffset() const { return globalDataOffset_; } + MDefinition* value() const { return getOperand(0); } + + AliasSet getAliasSet() const override { + return AliasSet::Store(AliasSet::WasmGlobalVar); + } +}; + +class MWasmParameter : public MNullaryInstruction +{ + ABIArg abi_; + + MWasmParameter(ABIArg abi, MIRType mirType) + : abi_(abi) + { + setResultType(mirType); + } + + public: + INSTRUCTION_HEADER(WasmParameter) + TRIVIAL_NEW_WRAPPERS + + ABIArg abi() const { return abi_; } +}; + +class MWasmReturn + : public MAryControlInstruction<2, 0>, + public NoTypePolicy::Data +{ + explicit MWasmReturn(MDefinition* ins, MDefinition* tlsPtr) { + initOperand(0, ins); + initOperand(1, tlsPtr); + } + + public: + INSTRUCTION_HEADER(WasmReturn) + TRIVIAL_NEW_WRAPPERS +}; + +class MWasmReturnVoid + : public MAryControlInstruction<1, 0>, + public NoTypePolicy::Data +{ + explicit MWasmReturnVoid(MDefinition* tlsPtr) { + initOperand(0, tlsPtr); + } + + public: + INSTRUCTION_HEADER(WasmReturnVoid) + TRIVIAL_NEW_WRAPPERS +}; + +class MWasmStackArg + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + MWasmStackArg(uint32_t spOffset, MDefinition* ins) + : MUnaryInstruction(ins), + spOffset_(spOffset) + {} + + uint32_t spOffset_; + + public: + INSTRUCTION_HEADER(WasmStackArg) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, arg)) + + uint32_t spOffset() const { + return spOffset_; + } + void incrementOffset(uint32_t inc) { + spOffset_ += inc; + } +}; + +class MWasmCall final + : public MVariadicInstruction, + public NoTypePolicy::Data +{ + wasm::CallSiteDesc desc_; + wasm::CalleeDesc callee_; + FixedList<AnyRegister> argRegs_; + uint32_t spIncrement_; + uint32_t tlsStackOffset_; + ABIArg instanceArg_; + + MWasmCall(const wasm::CallSiteDesc& desc, const wasm::CalleeDesc& callee, uint32_t spIncrement, + uint32_t tlsStackOffset) + : desc_(desc), + callee_(callee), + spIncrement_(spIncrement), + tlsStackOffset_(tlsStackOffset) + { } + + public: + INSTRUCTION_HEADER(WasmCall) + + struct Arg { + AnyRegister reg; + MDefinition* def; + Arg(AnyRegister reg, MDefinition* def) : reg(reg), def(def) {} + }; + typedef Vector<Arg, 8, SystemAllocPolicy> Args; + + static const uint32_t DontSaveTls = UINT32_MAX; + + static MWasmCall* New(TempAllocator& alloc, + const wasm::CallSiteDesc& desc, + const wasm::CalleeDesc& callee, + const Args& args, + MIRType resultType, + uint32_t spIncrement, + uint32_t tlsStackOffset, + MDefinition* tableIndex = nullptr); + + static MWasmCall* NewBuiltinInstanceMethodCall(TempAllocator& alloc, + const wasm::CallSiteDesc& desc, + const wasm::SymbolicAddress builtin, + const ABIArg& instanceArg, + const Args& args, + MIRType resultType, + uint32_t spIncrement, + uint32_t tlsStackOffset); + + size_t numArgs() const { + return argRegs_.length(); + } + AnyRegister registerForArg(size_t index) const { + MOZ_ASSERT(index < numArgs()); + return argRegs_[index]; + } + const wasm::CallSiteDesc& desc() const { + return desc_; + } + const wasm::CalleeDesc &callee() const { + return callee_; + } + uint32_t spIncrement() const { + return spIncrement_; + } + bool saveTls() const { + return tlsStackOffset_ != DontSaveTls; + } + uint32_t tlsStackOffset() const { + MOZ_ASSERT(saveTls()); + return tlsStackOffset_; + } + + bool possiblyCalls() const override { + return true; + } + + const ABIArg& instanceArg() const { + return instanceArg_; + } +}; + +class MWasmSelect + : public MTernaryInstruction, + public NoTypePolicy::Data +{ + MWasmSelect(MDefinition* trueExpr, MDefinition* falseExpr, MDefinition *condExpr) + : MTernaryInstruction(trueExpr, falseExpr, condExpr) + { + MOZ_ASSERT(condExpr->type() == MIRType::Int32); + MOZ_ASSERT(trueExpr->type() == falseExpr->type()); + setResultType(trueExpr->type()); + setMovable(); + } + + public: + INSTRUCTION_HEADER(WasmSelect) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, trueExpr), (1, falseExpr), (2, condExpr)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + ALLOW_CLONE(MWasmSelect) +}; + +class MWasmReinterpret + : public MUnaryInstruction, + public NoTypePolicy::Data +{ + MWasmReinterpret(MDefinition* val, MIRType toType) + : MUnaryInstruction(val) + { + switch (val->type()) { + case MIRType::Int32: MOZ_ASSERT(toType == MIRType::Float32); break; + case MIRType::Float32: MOZ_ASSERT(toType == MIRType::Int32); break; + case MIRType::Double: MOZ_ASSERT(toType == MIRType::Int64); break; + case MIRType::Int64: MOZ_ASSERT(toType == MIRType::Double); break; + default: MOZ_CRASH("unexpected reinterpret conversion"); + } + setMovable(); + setResultType(toType); + } + + public: + INSTRUCTION_HEADER(WasmReinterpret) + TRIVIAL_NEW_WRAPPERS + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins); + } + + ALLOW_CLONE(MWasmReinterpret) +}; + +class MRotate + : public MBinaryInstruction, + public NoTypePolicy::Data +{ + bool isLeftRotate_; + + MRotate(MDefinition* input, MDefinition* count, MIRType type, bool isLeftRotate) + : MBinaryInstruction(input, count), isLeftRotate_(isLeftRotate) + { + setMovable(); + setResultType(type); + } + + public: + INSTRUCTION_HEADER(Rotate) + TRIVIAL_NEW_WRAPPERS + NAMED_OPERANDS((0, input), (1, count)) + + AliasSet getAliasSet() const override { + return AliasSet::None(); + } + bool congruentTo(const MDefinition* ins) const override { + return congruentIfOperandsEqual(ins) && ins->toRotate()->isLeftRotate() == isLeftRotate_; + } + + bool isLeftRotate() const { + return isLeftRotate_; + } + + ALLOW_CLONE(MRotate) +}; + +class MUnknownValue : public MNullaryInstruction +{ + protected: + MUnknownValue() { + setResultType(MIRType::Value); + } + + public: + INSTRUCTION_HEADER(UnknownValue) + TRIVIAL_NEW_WRAPPERS +}; + +#undef INSTRUCTION_HEADER + +void MUse::init(MDefinition* producer, MNode* consumer) +{ + MOZ_ASSERT(!consumer_, "Initializing MUse that already has a consumer"); + MOZ_ASSERT(!producer_, "Initializing MUse that already has a producer"); + initUnchecked(producer, consumer); +} + +void MUse::initUnchecked(MDefinition* producer, MNode* consumer) +{ + MOZ_ASSERT(consumer, "Initializing to null consumer"); + consumer_ = consumer; + producer_ = producer; + producer_->addUseUnchecked(this); +} + +void MUse::initUncheckedWithoutProducer(MNode* consumer) +{ + MOZ_ASSERT(consumer, "Initializing to null consumer"); + consumer_ = consumer; + producer_ = nullptr; +} + +void MUse::replaceProducer(MDefinition* producer) +{ + MOZ_ASSERT(consumer_, "Resetting MUse without a consumer"); + producer_->removeUse(this); + producer_ = producer; + producer_->addUse(this); +} + +void MUse::releaseProducer() +{ + MOZ_ASSERT(consumer_, "Clearing MUse without a consumer"); + producer_->removeUse(this); + producer_ = nullptr; +} + +// Implement cast functions now that the compiler can see the inheritance. + +MDefinition* +MNode::toDefinition() +{ + MOZ_ASSERT(isDefinition()); + return (MDefinition*)this; +} + +MResumePoint* +MNode::toResumePoint() +{ + MOZ_ASSERT(isResumePoint()); + return (MResumePoint*)this; +} + +MInstruction* +MDefinition::toInstruction() +{ + MOZ_ASSERT(!isPhi()); + return (MInstruction*)this; +} + +const MInstruction* +MDefinition::toInstruction() const +{ + MOZ_ASSERT(!isPhi()); + return (const MInstruction*)this; +} + +MControlInstruction* +MDefinition::toControlInstruction() +{ + MOZ_ASSERT(isControlInstruction()); + return (MControlInstruction*)this; +} + +MConstant* +MDefinition::maybeConstantValue() +{ + MDefinition* op = this; + if (op->isBox()) + op = op->toBox()->input(); + if (op->isConstant()) + return op->toConstant(); + return nullptr; +} + +// Helper functions used to decide how to build MIR. + +bool ElementAccessIsDenseNative(CompilerConstraintList* constraints, + MDefinition* obj, MDefinition* id); +JSValueType UnboxedArrayElementType(CompilerConstraintList* constraints, MDefinition* obj, + MDefinition* id); +bool ElementAccessIsTypedArray(CompilerConstraintList* constraints, + MDefinition* obj, MDefinition* id, + Scalar::Type* arrayType); +bool ElementAccessIsPacked(CompilerConstraintList* constraints, MDefinition* obj); +bool ElementAccessMightBeCopyOnWrite(CompilerConstraintList* constraints, MDefinition* obj); +bool ElementAccessMightBeFrozen(CompilerConstraintList* constraints, MDefinition* obj); +bool ElementAccessHasExtraIndexedProperty(IonBuilder* builder, MDefinition* obj); +MIRType DenseNativeElementType(CompilerConstraintList* constraints, MDefinition* obj); +BarrierKind PropertyReadNeedsTypeBarrier(JSContext* propertycx, + CompilerConstraintList* constraints, + TypeSet::ObjectKey* key, PropertyName* name, + TemporaryTypeSet* observed, bool updateObserved); +BarrierKind PropertyReadNeedsTypeBarrier(JSContext* propertycx, + CompilerConstraintList* constraints, + MDefinition* obj, PropertyName* name, + TemporaryTypeSet* observed); +ResultWithOOM<BarrierKind> +PropertyReadOnPrototypeNeedsTypeBarrier(IonBuilder* builder, + MDefinition* obj, PropertyName* name, + TemporaryTypeSet* observed); +bool PropertyReadIsIdempotent(CompilerConstraintList* constraints, + MDefinition* obj, PropertyName* name); +void AddObjectsForPropertyRead(MDefinition* obj, PropertyName* name, + TemporaryTypeSet* observed); +bool CanWriteProperty(TempAllocator& alloc, CompilerConstraintList* constraints, + HeapTypeSetKey property, MDefinition* value, + MIRType implicitType = MIRType::None); +bool PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, CompilerConstraintList* constraints, + MBasicBlock* current, MDefinition** pobj, + PropertyName* name, MDefinition** pvalue, + bool canModify, MIRType implicitType = MIRType::None); +bool ArrayPrototypeHasIndexedProperty(IonBuilder* builder, JSScript* script); +bool TypeCanHaveExtraIndexedProperties(IonBuilder* builder, TemporaryTypeSet* types); + +inline MIRType +MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble) +{ + switch (arrayType) { + case Scalar::Int8: + case Scalar::Uint8: + case Scalar::Uint8Clamped: + case Scalar::Int16: + case Scalar::Uint16: + case Scalar::Int32: + return MIRType::Int32; + case Scalar::Uint32: + return observedDouble ? MIRType::Double : MIRType::Int32; + case Scalar::Float32: + return MIRType::Float32; + case Scalar::Float64: + return MIRType::Double; + default: + break; + } + MOZ_CRASH("Unknown typed array type"); +} + +} // namespace jit +} // namespace js + +#endif /* jit_MIR_h */ |