/*

* Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGFixupPhase.h"

#if ENABLE(DFG_JIT)

#include "DFGGraph.h"

#include "DFGInsertionSet.h"

#include "DFGPhase.h"

#include "DFGPredictionPropagationPhase.h"

#include "DFGVariableAccessDataDump.h"

#include "JSCInlines.h"

namespace JSC { namespace DFG {

class FixupPhase : public Phase {

public:

FixupPhase(Graph& graph)

: Phase(graph, "fixup")

, m_insertionSet(graph)

{

}

bool run()

{

ASSERT(m_graph.m_fixpointState == BeforeFixpoint);

ASSERT(m_graph.m_form == ThreadedCPS);

m_profitabilityChanged = false;

for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

fixupBlock(m_graph.block(blockIndex));

while (m_profitabilityChanged) {

m_profitabilityChanged = false;

for (unsigned i = m_graph.m_argumentPositions.size(); i--;)

m_graph.m_argumentPositions[i].mergeArgumentUnboxingAwareness();

for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

fixupGetAndSetLocalsInBlock(m_graph.block(blockIndex));

}

for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)

injectTypeConversionsInBlock(m_graph.block(blockIndex));

return true;

}

private:

void fixupBlock(BasicBlock* block)

{

if (!block)

return;

ASSERT(block->isReachable);

m_block = block;

for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {

m_currentNode = block->at(m_indexInBlock);

addPhantomsIfNecessary();

fixupNode(m_currentNode);

}

clearPhantomsAtEnd();

m_insertionSet.execute(block);

}

void fixupNode(Node* node)

{

NodeType op = node->op();

switch (op) {

case SetLocal: {

// This gets handled by fixupSetLocalsInBlock().

return;

}

case BitAnd:

case BitOr:

case BitXor:

case BitRShift:

case BitLShift:

case BitURShift: {

fixIntConvertingEdge(node->child1());

fixIntConvertingEdge(node->child2());

break;

}

case ArithIMul: {

fixIntConvertingEdge(node->child1());

fixIntConvertingEdge(node->child2());

node->setOp(ArithMul);

node->setArithMode(Arith::Unchecked);

node->child1().setUseKind(Int32Use);

node->child2().setUseKind(Int32Use);

break;

}

case UInt32ToNumber: {

fixIntConvertingEdge(node->child1());

if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

node->convertToIdentity();

else if (node->canSpeculateInt32(FixupPass))

node->setArithMode(Arith::CheckOverflow);

else {

node->setArithMode(Arith::DoOverflow);

node->setResult(NodeResultDouble);

}

break;

}

case ValueAdd: {

if (attemptToMakeIntegerAdd(node)) {

node->setOp(ArithAdd);

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (Node::shouldSpeculateNumberOrBooleanExpectingDefined(node->child1().node(), node->child2().node())) {

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->setOp(ArithAdd);

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

node->setResult(NodeResultDouble);

break;

}

// FIXME: Optimize for the case where one of the operands is the

// empty string. Also consider optimizing for the case where we don't

// believe either side is the emtpy string. Both of these things should

// be easy.

if (node->child1()->shouldSpeculateString()

&& attemptToMakeFastStringAdd<StringUse>(node, node->child1(), node->child2()))

break;

if (node->child2()->shouldSpeculateString()

&& attemptToMakeFastStringAdd<StringUse>(node, node->child2(), node->child1()))

break;

if (node->child1()->shouldSpeculateStringObject()

&& attemptToMakeFastStringAdd<StringObjectUse>(node, node->child1(), node->child2()))

break;

if (node->child2()->shouldSpeculateStringObject()

&& attemptToMakeFastStringAdd<StringObjectUse>(node, node->child2(), node->child1()))

break;

if (node->child1()->shouldSpeculateStringOrStringObject()

&& attemptToMakeFastStringAdd<StringOrStringObjectUse>(node, node->child1(), node->child2()))

break;

if (node->child2()->shouldSpeculateStringOrStringObject()

&& attemptToMakeFastStringAdd<StringOrStringObjectUse>(node, node->child2(), node->child1()))

break;

break;

}

case MakeRope: {

fixupMakeRope(node);

break;

}

case ArithAdd:

case ArithSub: {

if (attemptToMakeIntegerAdd(node))

break;

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->setResult(NodeResultDouble);

break;

}

case ArithNegate: {

if (m_graph.negateShouldSpeculateInt32(node, FixupPass)) {

fixIntOrBooleanEdge(node->child1());

if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

node->setArithMode(Arith::Unchecked);

else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

break;

}

if (m_graph.negateShouldSpeculateMachineInt(node, FixupPass)) {

fixEdge<Int52RepUse>(node->child1());

if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

node->setResult(NodeResultInt52);

break;

}

fixDoubleOrBooleanEdge(node->child1());

node->setResult(NodeResultDouble);

break;

}

case ArithMul: {

if (m_graph.mulShouldSpeculateInt32(node, FixupPass)) {

fixIntOrBooleanEdge(node->child1());

fixIntOrBooleanEdge(node->child2());

if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

node->setArithMode(Arith::Unchecked);

else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

break;

}

if (m_graph.mulShouldSpeculateMachineInt(node, FixupPass)) {

fixEdge<Int52RepUse>(node->child1());

fixEdge<Int52RepUse>(node->child2());

if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

node->setResult(NodeResultInt52);

break;

}

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->setResult(NodeResultDouble);

break;

}

case ArithDiv:

case ArithMod: {

if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())

&& node->canSpeculateInt32(FixupPass)) {

if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7s()) {

fixIntOrBooleanEdge(node->child1());

fixIntOrBooleanEdge(node->child2());

if (bytecodeCanTruncateInteger(node->arithNodeFlags()))

node->setArithMode(Arith::Unchecked);

else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

break;

}

// This will cause conversion nodes to be inserted later.

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

// But we have to make sure that everything is phantom'd until after the

// DoubleAsInt32 node, which occurs after the Div/Mod node that the conversions

// will be insered on.

addRequiredPhantom(node->child1().node());

addRequiredPhantom(node->child2().node());

// We don't need to do ref'ing on the children because we're stealing them from

// the original division.

Node* newDivision = m_insertionSet.insertNode(

m_indexInBlock, SpecBytecodeDouble, *node);

newDivision->setResult(NodeResultDouble);

node->setOp(DoubleAsInt32);

node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());

if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))

node->setArithMode(Arith::CheckOverflow);

else

node->setArithMode(Arith::CheckOverflowAndNegativeZero);

break;

}

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->setResult(NodeResultDouble);

break;

}

case ArithMin:

case ArithMax: {

if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())

&& node->canSpeculateInt32(FixupPass)) {

fixIntOrBooleanEdge(node->child1());

fixIntOrBooleanEdge(node->child2());

break;

}

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->setResult(NodeResultDouble);

break;

}

case ArithAbs: {

if (node->child1()->shouldSpeculateInt32OrBooleanForArithmetic()

&& node->canSpeculateInt32(FixupPass)) {

fixIntOrBooleanEdge(node->child1());

break;

}

fixDoubleOrBooleanEdge(node->child1());

node->setResult(NodeResultDouble);

break;

}

case ArithSqrt:

case ArithFRound:

case ArithSin:

case ArithCos: {

fixDoubleOrBooleanEdge(node->child1());

node->setResult(NodeResultDouble);

break;

}

case LogicalNot: {

if (node->child1()->shouldSpeculateBoolean())

fixEdge<BooleanUse>(node->child1());

else if (node->child1()->shouldSpeculateObjectOrOther())

fixEdge<ObjectOrOtherUse>(node->child1());

else if (node->child1()->shouldSpeculateInt32OrBoolean())

fixIntOrBooleanEdge(node->child1());

else if (node->child1()->shouldSpeculateNumber())

fixEdge<DoubleRepUse>(node->child1());

else if (node->child1()->shouldSpeculateString())

fixEdge<StringUse>(node->child1());

break;

}

case TypeOf: {

if (node->child1()->shouldSpeculateString())

fixEdge<StringUse>(node->child1());

else if (node->child1()->shouldSpeculateCell())

fixEdge<CellUse>(node->child1());

break;

}

case CompareEqConstant: {

break;

}

case CompareEq:

case CompareLess:

case CompareLessEq:

case CompareGreater:

case CompareGreaterEq: {

if (node->op() == CompareEq

&& Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {

fixEdge<BooleanUse>(node->child1());

fixEdge<BooleanUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (Node::shouldSpeculateInt32OrBoolean(node->child1().node(), node->child2().node())) {

fixIntOrBooleanEdge(node->child1());

fixIntOrBooleanEdge(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (enableInt52()

&& Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {

fixEdge<Int52RepUse>(node->child1());

fixEdge<Int52RepUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (Node::shouldSpeculateNumberOrBoolean(node->child1().node(), node->child2().node())) {

fixDoubleOrBooleanEdge(node->child1());

fixDoubleOrBooleanEdge(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (node->op() != CompareEq)

break;

if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {

fixEdge<StringIdentUse>(node->child1());

fixEdge<StringIdentUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && GPRInfo::numberOfRegisters >= 7) {

fixEdge<StringUse>(node->child1());

fixEdge<StringUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

fixEdge<ObjectUse>(node->child1());

fixEdge<ObjectUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {

fixEdge<ObjectUse>(node->child1());

fixEdge<ObjectOrOtherUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {

fixEdge<ObjectOrOtherUse>(node->child1());

fixEdge<ObjectUse>(node->child2());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

break;

}

case CompareStrictEq: {

if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {

fixEdge<BooleanUse>(node->child1());

fixEdge<BooleanUse>(node->child2());

break;

}

if (Node::shouldSpeculateInt32(node->child1().node(), node->child2().node())) {

fixEdge<Int32Use>(node->child1());

fixEdge<Int32Use>(node->child2());

break;

}

if (enableInt52()

&& Node::shouldSpeculateMachineInt(node->child1().node(), node->child2().node())) {

fixEdge<Int52RepUse>(node->child1());

fixEdge<Int52RepUse>(node->child2());

break;

}

if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {

fixEdge<DoubleRepUse>(node->child1());

fixEdge<DoubleRepUse>(node->child2());

break;

}

if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {

fixEdge<StringIdentUse>(node->child1());

fixEdge<StringIdentUse>(node->child2());

break;

}

if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && (GPRInfo::numberOfRegisters >= 7 || isFTL(m_graph.m_plan.mode))) {

fixEdge<StringUse>(node->child1());

fixEdge<StringUse>(node->child2());

break;

}

if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

fixEdge<ObjectUse>(node->child1());

fixEdge<ObjectUse>(node->child2());

break;

}

if (node->child1()->shouldSpeculateMisc()) {

fixEdge<MiscUse>(node->child1());

break;

}

if (node->child2()->shouldSpeculateMisc()) {

fixEdge<MiscUse>(node->child2());

break;

}

if (node->child1()->shouldSpeculateStringIdent()

&& node->child2()->shouldSpeculateNotStringVar()) {

fixEdge<StringIdentUse>(node->child1());

fixEdge<NotStringVarUse>(node->child2());

break;

}

if (node->child2()->shouldSpeculateStringIdent()

&& node->child1()->shouldSpeculateNotStringVar()) {

fixEdge<StringIdentUse>(node->child2());

fixEdge<NotStringVarUse>(node->child1());

break;

}

if (node->child1()->shouldSpeculateString() && (GPRInfo::numberOfRegisters >= 8 || isFTL(m_graph.m_plan.mode))) {

fixEdge<StringUse>(node->child1());

break;

}

if (node->child2()->shouldSpeculateString() && (GPRInfo::numberOfRegisters >= 8 || isFTL(m_graph.m_plan.mode))) {

fixEdge<StringUse>(node->child2());

break;

}

break;

}

case StringFromCharCode:

fixEdge<Int32Use>(node->child1());

break;

case StringCharAt:

case StringCharCodeAt: {

// Currently we have no good way of refining these.

ASSERT(node->arrayMode() == ArrayMode(Array::String));

blessArrayOperation(node->child1(), node->child2(), node->child3());

fixEdge<KnownCellUse>(node->child1());

fixEdge<Int32Use>(node->child2());

break;

}

case GetByVal: {

node->setArrayMode(

node->arrayMode().refine(

m_graph, node,

node->child1()->prediction(),

node->child2()->prediction(),

SpecNone, node->flags()));

blessArrayOperation(node->child1(), node->child2(), node->child3());

ArrayMode arrayMode = node->arrayMode();

switch (arrayMode.type()) {

case Array::Double:

if (arrayMode.arrayClass() == Array::OriginalArray

&& arrayMode.speculation() == Array::InBounds

&& m_graph.globalObjectFor(node->origin.semantic)->arrayPrototypeChainIsSane()

&& !(node->flags() & NodeBytecodeUsesAsOther))

node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));

break;

case Array::String:

if ((node->prediction() & ~SpecString)

|| m_graph.hasExitSite(node->origin.semantic, OutOfBounds))

node->setArrayMode(arrayMode.withSpeculation(Array::OutOfBounds));

break;

default:

break;

}

arrayMode = node->arrayMode();

switch (arrayMode.type()) {

case Array::SelectUsingPredictions:

case Array::Unprofiled:

case Array::Undecided:

RELEASE_ASSERT_NOT_REACHED();

break;

case Array::Generic:

#if USE(JSVALUE32_64)

fixEdge<CellUse>(node->child1()); // Speculating cell due to register pressure on 32-bit.

#endif

break;

case Array::ForceExit:

break;

default:

fixEdge<KnownCellUse>(node->child1());

fixEdge<Int32Use>(node->child2());

break;

}

switch (arrayMode.type()) {

case Array::Double:

if (!arrayMode.isOutOfBounds())

node->setResult(NodeResultDouble);

break;

case Array::Float32Array:

case Array::Float64Array:

node->setResult(NodeResultDouble);

break;

case Array::Uint32Array:

if (node->shouldSpeculateInt32())

break;

if (node->shouldSpeculateMachineInt() && enableInt52())

node->setResult(NodeResultInt52);

else

node->setResult(NodeResultDouble);

break;

default:

break;

}

break;

}

case PutByValDirect:

case PutByVal:

case PutByValAlias: {

Edge& child1 = m_graph.varArgChild(node, 0);

Edge& child2 = m_graph.varArgChild(node, 1);

Edge& child3 = m_graph.varArgChild(node, 2);

node->setArrayMode(

node->arrayMode().refine(

m_graph, node,

child1->prediction(),

child2->prediction(),

child3->prediction()));

blessArrayOperation(child1, child2, m_graph.varArgChild(node, 3));

switch (node->arrayMode().modeForPut().type()) {

case Array::SelectUsingPredictions:

case Array::Unprofiled:

case Array::Undecided:

RELEASE_ASSERT_NOT_REACHED();

break;

case Array::ForceExit:

case Array::Generic:

#if USE(JSVALUE32_64)

// Due to register pressure on 32-bit, we speculate cell and

// ignore the base-is-not-cell case entirely by letting the

// baseline JIT handle it.

fixEdge<CellUse>(child1);

#endif

break;

case Array::Int32:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

fixEdge<Int32Use>(child3);

break;

case Array::Double:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

fixEdge<DoubleRepRealUse>(child3);

break;

case Array::Int8Array:

case Array::Int16Array:

case Array::Int32Array:

case Array::Uint8Array:

case Array::Uint8ClampedArray:

case Array::Uint16Array:

case Array::Uint32Array:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

if (child3->shouldSpeculateInt32())

fixIntOrBooleanEdge(child3);

else if (child3->shouldSpeculateMachineInt())

fixEdge<Int52RepUse>(child3);

else

fixDoubleOrBooleanEdge(child3);

break;

case Array::Float32Array:

case Array::Float64Array:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

fixDoubleOrBooleanEdge(child3);

break;

case Array::Contiguous:

case Array::ArrayStorage:

case Array::SlowPutArrayStorage:

case Array::Arguments:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

insertStoreBarrier(m_indexInBlock, child1);

break;

default:

fixEdge<KnownCellUse>(child1);

fixEdge<Int32Use>(child2);

break;

}

break;

}

case ArrayPush: {

// May need to refine the array mode in case the value prediction contravenes

// the array prediction. For example, we may have evidence showing that the

// array is in Int32 mode, but the value we're storing is likely to be a double.

// Then we should turn this into a conversion to Double array followed by the

// push. On the other hand, we absolutely don't want to refine based on the

// base prediction. If it has non-cell garbage in it, then we want that to be

// ignored. That's because ArrayPush can't handle any array modes that aren't

// array-related - so if refine() turned this into a "Generic" ArrayPush then

// that would break things.

node->setArrayMode(

node->arrayMode().refine(

m_graph, node,

node->child1()->prediction() & SpecCell,

SpecInt32,

node->child2()->prediction()));

blessArrayOperation(node->child1(), Edge(), node->child3());

fixEdge<KnownCellUse>(node->child1());

switch (node->arrayMode().type()) {

case Array::Int32:

fixEdge<Int32Use>(node->child2());

break;

case Array::Double:

fixEdge<DoubleRepRealUse>(node->child2());

break;

case Array::Contiguous:

case Array::ArrayStorage:

insertStoreBarrier(m_indexInBlock, node->child1());

break;

default:

break;

}

break;

}

case ArrayPop: {

blessArrayOperation(node->child1(), Edge(), node->child2());

fixEdge<KnownCellUse>(node->child1());

break;

}

case RegExpExec:

case RegExpTest: {

fixEdge<CellUse>(node->child1());

fixEdge<CellUse>(node->child2());

break;

}

case Branch: {

if (node->child1()->shouldSpeculateBoolean())

fixEdge<BooleanUse>(node->child1());

else if (node->child1()->shouldSpeculateObjectOrOther())

fixEdge<ObjectOrOtherUse>(node->child1());

else if (node->child1()->shouldSpeculateInt32OrBoolean())

fixIntOrBooleanEdge(node->child1());

else if (node->child1()->shouldSpeculateNumberOrBoolean())

fixDoubleOrBooleanEdge(node->child1());

Node* logicalNot = node->child1().node();

if (logicalNot->op() == LogicalNot) {

// Make sure that OSR exit can't observe the LogicalNot. If it can,

// then we must compute it and cannot peephole around it.

bool found = false;

bool ok = true;

for (unsigned i = m_indexInBlock; i--;) {

Node* candidate = m_block->at(i);

if (candidate == logicalNot) {

found = true;

break;

}

if (candidate->canExit()) {

ok = false;

found = true;

break;

}

}

ASSERT_UNUSED(found, found);

if (ok) {

Edge newChildEdge = logicalNot->child1();

if (newChildEdge->hasBooleanResult()) {

node->children.setChild1(newChildEdge);

BranchData* data = node->branchData();

std::swap(data->taken, data->notTaken);

}

}

}

break;

}

case Switch: {

SwitchData* data = node->switchData();

switch (data->kind) {

case SwitchImm:

if (node->child1()->shouldSpeculateInt32())

fixEdge<Int32Use>(node->child1());

break;

case SwitchChar:

if (node->child1()->shouldSpeculateString())

fixEdge<StringUse>(node->child1());

break;

case SwitchString:

if (node->child1()->shouldSpeculateStringIdent())

fixEdge<StringIdentUse>(node->child1());

else if (node->child1()->shouldSpeculateString())

fixEdge<StringUse>(node->child1());

break;

}

break;

}

case ToPrimitive: {

fixupToPrimitive(node);

break;

}

case ToString: {

fixupToString(node);

break;

}

case NewStringObject: {

fixEdge<KnownStringUse>(node->child1());

break;

}

case NewArray: {

for (unsigned i = m_graph.varArgNumChildren(node); i--;) {

node->setIndexingType(

leastUpperBoundOfIndexingTypeAndType(

node->indexingType(), m_graph.varArgChild(node, i)->prediction()));

}

switch (node->indexingType()) {

case ALL_BLANK_INDEXING_TYPES:

CRASH();

break;

case ALL_UNDECIDED_INDEXING_TYPES:

if (node->numChildren()) {

// This will only happen if the children have no type predictions. We

// would have already exited by now, but insert a forced exit just to

// be safe.

m_insertionSet.insertNode(

m_indexInBlock, SpecNone, ForceOSRExit, node->origin);

}

break;

case ALL_INT32_INDEXING_TYPES:

for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

fixEdge<Int32Use>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);

break;

case ALL_DOUBLE_INDEXING_TYPES:

for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

fixEdge<DoubleRepRealUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);

break;

case ALL_CONTIGUOUS_INDEXING_TYPES:

case ALL_ARRAY_STORAGE_INDEXING_TYPES:

break;

default:

CRASH();

break;

}

break;

}

case NewTypedArray: {

if (node->child1()->shouldSpeculateInt32()) {

fixEdge<Int32Use>(node->child1());

node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

break;

}

break;

}

case NewArrayWithSize: {

fixEdge<Int32Use>(node->child1());

break;

}

case ToThis: {

ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;

if (node->child1()->shouldSpeculateOther()) {

if (ecmaMode == StrictMode) {

fixEdge<OtherUse>(node->child1());

node->convertToIdentity();

break;

}

m_insertionSet.insertNode(

m_indexInBlock, SpecNone, Phantom, node->origin,

Edge(node->child1().node(), OtherUse));

observeUseKindOnNode<OtherUse>(node->child1().node());

node->convertToWeakConstant(m_graph.globalThisObjectFor(node->origin.semantic));

break;

}

if (isFinalObjectSpeculation(node->child1()->prediction())) {

fixEdge<FinalObjectUse>(node->child1());

node->convertToIdentity();

break;

}

break;

}

case GetMyArgumentByVal:

case GetMyArgumentByValSafe: {

fixEdge<Int32Use>(node->child1());

break;

}

case PutStructure: {

fixEdge<KnownCellUse>(node->child1());

insertStoreBarrier(m_indexInBlock, node->child1());

break;

}

case PutClosureVar: {

fixEdge<KnownCellUse>(node->child1());

insertStoreBarrier(m_indexInBlock, node->child1());

break;

}

case GetClosureRegisters:

case SkipTopScope:

case SkipScope:

case GetScope: {

fixEdge<KnownCellUse>(node->child1());

break;

}

case AllocatePropertyStorage:

case ReallocatePropertyStorage: {

fixEdge<KnownCellUse>(node->child1());

insertStoreBarrier(m_indexInBlock + 1, node->child1());

break;

}

case GetById:

case GetByIdFlush: {

if (!node->child1()->shouldSpeculateCell())

break;

StringImpl* impl = m_graph.identifiers()[node->identifierNumber()];

if (impl == vm().propertyNames->length.impl()) {

attemptToMakeGetArrayLength(node);

break;

}

if (impl == vm().propertyNames->byteLength.impl()) {

attemptToMakeGetTypedArrayByteLength(node);

break;

}

if (impl == vm().propertyNames->byteOffset.impl()) {

attemptToMakeGetTypedArrayByteOffset(node);

break;

}

fixEdge<CellUse>(node->child1());

break;

}

case PutById:

case PutByIdFlush:

case PutByIdDirect: {

fixEdge<CellUse>(node->child1());

insertStoreBarrier(m_indexInBlock, node->child1());

break;

}

case CheckExecutable:

case CheckStructure:

case StructureTransitionWatchpoint:

case CheckFunction:

case CheckHasInstance:

case CreateThis:

case GetButterfly: {

fixEdge<CellUse>(node->child1());

break;

}

case Arrayify:

case ArrayifyToStructure: {

fixEdge<CellUse>(node->child1());

if (node->child2())

fixEdge<Int32Use>(node->child2());

break;

}

case GetByOffset: {

if (!node->child1()->hasStorageResult())

fixEdge<KnownCellUse>(node->child1());

fixEdge<KnownCellUse>(node->child2());

break;

}

case MultiGetByOffset: {

fixEdge<CellUse>(node->child1());

break;

}

case PutByOffset: {

if (!node->child1()->hasStorageResult())

fixEdge<KnownCellUse>(node->child1());

fixEdge<KnownCellUse>(node->child2());

insertStoreBarrier(m_indexInBlock, node->child2());

break;

}

case MultiPutByOffset: {

fixEdge<CellUse>(node->child1());

insertStoreBarrier(m_indexInBlock, node->child1());

break;

}

case InstanceOf: {

if (!(node->child1()->prediction() & ~SpecCell))

fixEdge<CellUse>(node->child1());

fixEdge<CellUse>(node->child2());

break;

}

case In: {

// FIXME: We should at some point have array profiling on op_in, in which

// case we would be able to turn this into a kind of GetByVal.

fixEdge<CellUse>(node->child2());

break;

}

case Phantom:

case Check: {

switch (node->child1().useKind()) {

case NumberUse:

if (node->child1()->shouldSpeculateInt32ForArithmetic())

node->child1().setUseKind(Int32Use);

break;

default:

break;

}

observeUseKindOnEdge(node->child1());

break;

}

case FiatInt52: {

RELEASE_ASSERT(enableInt52());

node->convertToIdentity();

fixEdge<Int52RepUse>(node->child1());

node->setResult(NodeResultInt52);

break;