//-------------------------------------------------------------------------------------------------------

// Copyright (C) Microsoft Corporation and contributors. All rights reserved.

// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.

//-------------------------------------------------------------------------------------------------------

#include "Backend.h"

#if ENABLE_DEBUG_CONFIG_OPTIONS

#define TESTTRACE_PHASE_INSTR(phase, instr, ...) \

if(PHASE_TESTTRACE(phase, this->func)) \

{ \

char16 debugStringBuffer[MAX_FUNCTION_BODY_DEBUG_STRING_SIZE]; \

Output::Print( \

_u("Testtrace: %s function %s (%s): "), \

Js::PhaseNames[phase], \

instr->m_func->GetJITFunctionBody()->GetDisplayName(), \

instr->m_func->GetDebugNumberSet(debugStringBuffer)); \

Output::Print(__VA_ARGS__); \

Output::Flush(); \

}

#else

#define TESTTRACE_PHASE_INSTR(phase, instr, ...)

#endif

#if ENABLE_DEBUG_CONFIG_OPTIONS && DBG_DUMP

#define TRACE_TESTTRACE_PHASE_INSTR(phase, instr, ...) \

TRACE_PHASE_INSTR(phase, instr, __VA_ARGS__); \

TESTTRACE_PHASE_INSTR(phase, instr, __VA_ARGS__);

#else

#define TRACE_TESTTRACE_PHASE_INSTR(phase, instr, ...) TESTTRACE_PHASE_INSTR(phase, instr, __VA_ARGS__);

#endif

GlobOpt::ArraySrcOpt::~ArraySrcOpt()

{

if (originalIndexOpnd != nullptr)

{

Assert(instr->m_opcode == Js::OpCode::IsIn);

instr->ReplaceSrc1(originalIndexOpnd);

}

}

bool GlobOpt::ArraySrcOpt::CheckOpCode()

{

switch (instr->m_opcode)

{

// SIMD_JS

case Js::OpCode::Simd128_LdArr_F4:

case Js::OpCode::Simd128_LdArr_I4:

// no type-spec for Asm.js

if (globOpt->GetIsAsmJSFunc())

{

return false;

}

// fall through

case Js::OpCode::LdElemI_A:

case Js::OpCode::LdMethodElem:

if (!instr->GetSrc1()->IsIndirOpnd())

{

return false;

}

baseOwnerIndir = instr->GetSrc1()->AsIndirOpnd();

baseOpnd = baseOwnerIndir->GetBaseOpnd();

// LdMethodElem is currently not profiled

isProfilableLdElem = instr->m_opcode != Js::OpCode::LdMethodElem;

needsBoundChecks = true;

needsHeadSegmentLength = true;

needsHeadSegment = true;

isLoad = true;

break;

// SIMD_JS

case Js::OpCode::Simd128_StArr_F4:

case Js::OpCode::Simd128_StArr_I4:

// no type-spec for Asm.js

if (globOpt->GetIsAsmJSFunc())

{

return false;

}

// fall through

case Js::OpCode::StElemI_A:

case Js::OpCode::StElemI_A_Strict:

case Js::OpCode::StElemC:

if (!instr->GetDst()->IsIndirOpnd())

{

return false;

}

baseOwnerIndir = instr->GetDst()->AsIndirOpnd();

baseOpnd = baseOwnerIndir->GetBaseOpnd();

isProfilableStElem = instr->m_opcode != Js::OpCode::StElemC;

needsBoundChecks = isProfilableStElem;

needsHeadSegmentLength = true;

needsHeadSegment = true;

isStore = true;

break;

case Js::OpCode::InlineArrayPush:

case Js::OpCode::InlineArrayPop:

{

IR::Opnd * thisOpnd = instr->GetSrc1();

// Abort if it not a LikelyArray or Object with Array - No point in doing array check elimination.

if (!thisOpnd->IsRegOpnd() || !thisOpnd->GetValueType().IsLikelyArrayOrObjectWithArray())

{

return false;

}

baseOwnerInstr = instr;

baseOpnd = thisOpnd->AsRegOpnd();

isLoad = instr->m_opcode == Js::OpCode::InlineArrayPop;

isStore = instr->m_opcode == Js::OpCode::InlineArrayPush;

needsLength = true;

needsHeadSegmentLength = true;

needsHeadSegment = true;

break;

}

case Js::OpCode::LdLen_A:

if (!instr->GetSrc1()->IsRegOpnd())

{

return false;

}

baseOpnd = instr->GetSrc1()->AsRegOpnd();

if (baseOpnd->GetValueType().IsLikelyObject() && baseOpnd->GetValueType().GetObjectType() == ObjectType::ObjectWithArray)

{

return false;

}

baseOwnerInstr = instr;

needsLength = true;

break;

case Js::OpCode::IsIn:

if (!globOpt->DoArrayMissingValueCheckHoist())

{

return false;

}

if (instr->GetSrc1()->IsAddrOpnd())

{

const Js::Var val = instr->GetSrc1()->AsAddrOpnd()->m_address;

if (Js::TaggedInt::Is(val))

{

originalIndexOpnd = instr->UnlinkSrc1();

instr->SetSrc1(IR::IntConstOpnd::New(Js::TaggedInt::ToInt32(val), TyInt32, instr->m_func));

}

}

if (!instr->GetSrc1()->IsRegOpnd() && !instr->GetSrc1()->IsIntConstOpnd())

{

return false;

}

if (!instr->GetSrc2()->IsRegOpnd())

{

return false;

}

baseOpnd = instr->GetSrc2()->AsRegOpnd();

if (baseOpnd->GetValueType().IsLikelyObject() && baseOpnd->GetValueType().GetObjectType() == ObjectType::ObjectWithArray)

{

return false;

}

if (!baseOpnd->GetValueType().IsLikelyAnyArray() || (baseOpnd->GetValueType().IsLikelyArrayOrObjectWithArray() && !baseOpnd->GetValueType().HasNoMissingValues()))

{

return false;

}

baseOwnerInstr = instr;

needsBoundChecks = true;

needsHeadSegmentLength = true;

needsHeadSegment = true;

break;

default:

return false;

}

return true;

}

void GlobOpt::ArraySrcOpt::TypeSpecIndex()

{

// Since this happens before type specialization, make sure that any necessary conversions are done, and that the index is int-specialized if possible such that the const flags are correct.

if (!globOpt->IsLoopPrePass())

{

if (baseOwnerIndir)

{

globOpt->ToVarUses(instr, baseOwnerIndir, baseOwnerIndir == instr->GetDst(), nullptr);

}

else if (instr->m_opcode == Js::OpCode::IsIn && instr->GetSrc1()->IsRegOpnd())

{

// If the optimization is unable to eliminate the bounds checks, we need to restore the original var sym.

Assert(originalIndexOpnd == nullptr);

originalIndexOpnd = instr->GetSrc1()->Copy(func);

globOpt->ToTypeSpecIndex(instr, instr->GetSrc1()->AsRegOpnd(), nullptr);

}

}

if (baseOwnerIndir != nullptr)

{

indexOpnd = baseOwnerIndir->GetIndexOpnd();

}

else if (instr->m_opcode == Js::OpCode::IsIn)

{

indexOpnd = instr->GetSrc1();

}

if (indexOpnd != nullptr && indexOpnd->IsRegOpnd())

{

IR::RegOpnd * regOpnd = indexOpnd->AsRegOpnd();

if (regOpnd->m_sym->IsTypeSpec())

{

Assert(regOpnd->m_sym->IsInt32());

indexVarSym = regOpnd->m_sym->GetVarEquivSym(nullptr);

}

else

{

indexVarSym = regOpnd->m_sym;

}

indexValue = globOpt->CurrentBlockData()->FindValue(indexVarSym);

}

}

void GlobOpt::ArraySrcOpt::UpdateValue(StackSym * newHeadSegmentSym, StackSym * newHeadSegmentLengthSym, StackSym * newLengthSym)

{

Assert(baseValueType.GetObjectType() == newBaseValueType.GetObjectType());

Assert(newBaseValueType.IsObject());

Assert(baseValueType.IsLikelyArray() || !newLengthSym);

if (!(newHeadSegmentSym || newHeadSegmentLengthSym || newLengthSym))

{

// We're not adding new information to the value other than changing the value type. Preserve any existing

// information and just change the value type.

globOpt->ChangeValueType(globOpt->currentBlock, baseValue, newBaseValueType, true);

return;

}

// Merge the new syms into the value while preserving any existing information, and change the value type

if (baseArrayValueInfo)

{

if (!newHeadSegmentSym)

{

newHeadSegmentSym = baseArrayValueInfo->HeadSegmentSym();

}

if (!newHeadSegmentLengthSym)

{

newHeadSegmentLengthSym = baseArrayValueInfo->HeadSegmentLengthSym();

}

if (!newLengthSym)

{

newLengthSym = baseArrayValueInfo->LengthSym();

}

Assert(!baseArrayValueInfo->HeadSegmentSym() || newHeadSegmentSym == baseArrayValueInfo->HeadSegmentSym());

Assert(!baseArrayValueInfo->HeadSegmentLengthSym() || newHeadSegmentLengthSym == baseArrayValueInfo->HeadSegmentLengthSym());

Assert(!baseArrayValueInfo->LengthSym() || newLengthSym == baseArrayValueInfo->LengthSym());

}

ArrayValueInfo *const newBaseArrayValueInfo =

ArrayValueInfo::New(

globOpt->alloc,

newBaseValueType,

newHeadSegmentSym,

newHeadSegmentLengthSym,

newLengthSym,

baseValueInfo->GetSymStore());

globOpt->ChangeValueInfo(globOpt->currentBlock, baseValue, newBaseArrayValueInfo);

};

void GlobOpt::ArraySrcOpt::CheckVirtualArrayBounds()

{

#if ENABLE_FAST_ARRAYBUFFER

if (baseValueType.IsLikelyOptimizedVirtualTypedArray() && !Js::IsSimd128LoadStore(instr->m_opcode) /*Always extract bounds for SIMD */)

{

if (isProfilableStElem ||

!instr->IsDstNotAlwaysConvertedToInt32() ||

((baseValueType.GetObjectType() == ObjectType::Float32VirtualArray ||

baseValueType.GetObjectType() == ObjectType::Float64VirtualArray) &&

!instr->IsDstNotAlwaysConvertedToNumber()

)

)

{

// Unless we're in asm.js (where it is guaranteed that virtual typed array accesses cannot read/write beyond 4GB),

// check the range of the index to make sure we won't access beyond the reserved memory beforing eliminating bounds

// checks in jitted code.

if (!globOpt->GetIsAsmJSFunc() && baseOwnerIndir)

{

if (indexOpnd)

{

IntConstantBounds idxConstantBounds;

if (indexValue && indexValue->GetValueInfo()->TryGetIntConstantBounds(&idxConstantBounds))

{

BYTE indirScale = Lowerer::GetArrayIndirScale(baseValueType);

int32 upperBound = idxConstantBounds.UpperBound();

int32 lowerBound = idxConstantBounds.LowerBound();

if (lowerBound >= 0 && ((static_cast<uint64>(upperBound) << indirScale) < MAX_ASMJS_ARRAYBUFFER_LENGTH))

{

eliminatedLowerBoundCheck = true;

eliminatedUpperBoundCheck = true;

canBailOutOnArrayAccessHelperCall = false;

}

}

}

}

else

{

if (baseOwnerIndir == nullptr)

{

Assert(instr->m_opcode == Js::OpCode::InlineArrayPush ||

instr->m_opcode == Js::OpCode::InlineArrayPop ||

instr->m_opcode == Js::OpCode::LdLen_A ||

instr->m_opcode == Js::OpCode::IsIn);

}

eliminatedLowerBoundCheck = true;

eliminatedUpperBoundCheck = true;

canBailOutOnArrayAccessHelperCall = false;

}

}

}

#endif

}

void GlobOpt::ArraySrcOpt::TryEliminiteBoundsCheck()

{

AnalysisAssert(indexOpnd != nullptr || baseOwnerIndir != nullptr);

Assert(needsHeadSegmentLength);

// Bound checks can be separated from the instruction only if it can bail out instead of making a helper call when a

// bound check fails. And only if it would bail out, can we use a bound check to eliminate redundant bound checks later

// on that path.

doExtractBoundChecks = (headSegmentLengthIsAvailable || doHeadSegmentLengthLoad) && canBailOutOnArrayAccessHelperCall;

// Get the index value

if (indexOpnd != nullptr && indexOpnd->IsRegOpnd())

{

if (indexOpnd->AsRegOpnd()->m_sym->IsTypeSpec())

{

Assert(indexVarSym);

Assert(indexValue);

AssertVerify(indexValue->GetValueInfo()->TryGetIntConstantBounds(&indexConstantBounds));

Assert(indexOpnd->GetType() == TyInt32 || indexOpnd->GetType() == TyUint32);

Assert(

(indexOpnd->GetType() == TyUint32) ==

ValueInfo::IsGreaterThanOrEqualTo(

indexValue,

indexConstantBounds.LowerBound(),

indexConstantBounds.UpperBound(),

nullptr,

0,

0));

if (indexOpnd->GetType() == TyUint32)

{

eliminatedLowerBoundCheck = true;

}

}

else

{

doExtractBoundChecks = false; // Bound check instruction operates only on int-specialized operands

if (!indexValue || !indexValue->GetValueInfo()->TryGetIntConstantBounds(&indexConstantBounds))

{

return;

}

if (ValueInfo::IsGreaterThanOrEqualTo(

indexValue,

indexConstantBounds.LowerBound(),

indexConstantBounds.UpperBound(),

nullptr,

0,

0))

{

eliminatedLowerBoundCheck = true;

}

}

if (!eliminatedLowerBoundCheck &&

ValueInfo::IsLessThan(

indexValue,

indexConstantBounds.LowerBound(),

indexConstantBounds.UpperBound(),

nullptr,

0,

0))

{

eliminatedUpperBoundCheck = true;

doExtractBoundChecks = false;

return;

}

}

else

{

const int32 indexConstantValue = indexOpnd ? indexOpnd->AsIntConstOpnd()->AsInt32() : baseOwnerIndir->GetOffset();

if (indexConstantValue < 0)

{

eliminatedUpperBoundCheck = true;

doExtractBoundChecks = false;

return;

}

if (indexConstantValue == INT32_MAX)

{

eliminatedLowerBoundCheck = true;

doExtractBoundChecks = false;

return;

}

indexConstantBounds = IntConstantBounds(indexConstantValue, indexConstantValue);

eliminatedLowerBoundCheck = true;

}

if (!headSegmentLengthIsAvailable)

{

return;

}

headSegmentLengthValue = globOpt->CurrentBlockData()->FindValue(baseArrayValueInfo->HeadSegmentLengthSym());

if (!headSegmentLengthValue)

{

if (doExtractBoundChecks)

{

headSegmentLengthConstantBounds = IntConstantBounds(0, Js::SparseArraySegmentBase::MaxLength);

}

return;

}

AssertVerify(headSegmentLengthValue->GetValueInfo()->TryGetIntConstantBounds(&headSegmentLengthConstantBounds));

if (ValueInfo::IsLessThanOrEqualTo(

indexValue,

indexConstantBounds.LowerBound(),

indexConstantBounds.UpperBound(),

headSegmentLengthValue,

headSegmentLengthConstantBounds.LowerBound(),

headSegmentLengthConstantBounds.UpperBound(),

-1

))

{

eliminatedUpperBoundCheck = true;

if (eliminatedLowerBoundCheck)

{

doExtractBoundChecks = false;

}

}

}

void GlobOpt::ArraySrcOpt::CheckLoops()

{

if (!doArrayChecks && !doHeadSegmentLoad && !doHeadSegmentLengthLoad && !doLengthLoad)

{

return;

}

// Find the loops out of which array checks and head segment loads need to be hoisted

for (Loop *loop = globOpt->currentBlock->loop; loop; loop = loop->parent)

{

const JsArrayKills loopKills(loop->jsArrayKills);

Value *baseValueInLoopLandingPad = nullptr;

if (((isLikelyJsArray || isLikelyVirtualTypedArray) && loopKills.KillsValueType(newBaseValueType)) ||

!globOpt->OptIsInvariant(baseOpnd->m_sym, globOpt->currentBlock, loop, baseValue, true, true, &baseValueInLoopLandingPad) ||

!(doArrayChecks || baseValueInLoopLandingPad->GetValueInfo()->IsObject()))

{

break;

}

// The value types should be the same, except:

// - The value type in the landing pad is a type that can merge to a specific object type. Typically, these

// cases will use BailOnNoProfile, but that can be disabled due to excessive bailouts. Those value types

// merge aggressively to the other side's object type, so the value type may have started off as

// Uninitialized, [Likely]Undefined|Null, [Likely]UninitializedObject, etc., and changed in the loop to an

// array type during a prepass.

// - StElems in the loop can kill the no-missing-values info.

// - The native array type may be made more conservative based on profile data by an instruction in the loop.

#if DBG

if (!baseValueInLoopLandingPad->GetValueInfo()->CanMergeToSpecificObjectType())

{

ValueType landingPadValueType = baseValueInLoopLandingPad->GetValueInfo()->Type();

Assert(landingPadValueType.IsSimilar(baseValueType)

|| (landingPadValueType.IsLikelyNativeArray() && landingPadValueType.Merge(baseValueType).IsSimilar(baseValueType))

|| (baseValueType.IsLikelyNativeArray() && baseValueType.Merge(landingPadValueType).IsSimilar(landingPadValueType))

);

}

#endif

if (doArrayChecks)

{

hoistChecksOutOfLoop = loop;

// If BailOnNotObject isn't hoisted, the value may still be tagged in the landing pad

if (baseValueInLoopLandingPad->GetValueInfo()->Type().CanBeTaggedValue())

{

baseValueType = baseValueType.SetCanBeTaggedValue(true);

baseOpnd->SetValueType(baseValueType);

}

}

if (isLikelyJsArray && loopKills.KillsArrayHeadSegments())

{

Assert(loopKills.KillsArrayHeadSegmentLengths());

if (!(doArrayChecks || doLengthLoad))

{

break;

}

}

else

{

if (doHeadSegmentLoad || headSegmentIsAvailable)

{

// If the head segment is already available, we may need to rehoist the value including other

// information. So, need to track the loop out of which the head segment length can be hoisted even if

// the head segment length is not being loaded here.

hoistHeadSegmentLoadOutOfLoop = loop;

}

if (isLikelyJsArray

? loopKills.KillsArrayHeadSegmentLengths()

: loopKills.KillsTypedArrayHeadSegmentLengths())

{

if (!(doArrayChecks || doHeadSegmentLoad || doLengthLoad))

{

break;

}

}

else if (doHeadSegmentLengthLoad || headSegmentLengthIsAvailable)

{

// If the head segment length is already available, we may need to rehoist the value including other

// information. So, need to track the loop out of which the head segment length can be hoisted even if

// the head segment length is not being loaded here.

hoistHeadSegmentLengthLoadOutOfLoop = loop;

}

}

if (isLikelyJsArray && loopKills.KillsArrayLengths())

{

if (!(doArrayChecks || doHeadSegmentLoad || doHeadSegmentLengthLoad))

{

break;

}

}

else if (doLengthLoad || lengthIsAvailable)

{

// If the length is already available, we may need to rehoist the value including other information. So,

// need to track the loop out of which the head segment length can be hoisted even if the length is not

// being loaded here.

hoistLengthLoadOutOfLoop = loop;

}

}

}

void GlobOpt::ArraySrcOpt::DoArrayChecks()

{

TRACE_TESTTRACE_PHASE_INSTR(Js::ArrayCheckHoistPhase, instr, _u("Separating array checks with bailout\n"));

IR::Instr *bailOnNotArray = IR::Instr::New(Js::OpCode::BailOnNotArray, instr->m_func);

bailOnNotArray->SetSrc1(baseOpnd);

bailOnNotArray->GetSrc1()->SetIsJITOptimizedReg(true);

const IR::BailOutKind bailOutKind = newBaseValueType.IsLikelyNativeArray() ? IR::BailOutOnNotNativeArray : IR::BailOutOnNotArray;

if (hoistChecksOutOfLoop)

{

Assert(!(isLikelyJsArray && hoistChecksOutOfLoop->jsArrayKills.KillsValueType(newBaseValueType)));

TRACE_PHASE_INSTR(

Js::ArrayCheckHoistPhase,

instr,

_u("Hoisting array checks with bailout out of loop %u to landing pad block %u\n"),

hoistChecksOutOfLoop->GetLoopNumber(),

hoistChecksOutOfLoop->landingPad->GetBlockNum());

TESTTRACE_PHASE_INSTR(Js::ArrayCheckHoistPhase, instr, _u("Hoisting array checks with bailout out of loop\n"));

Assert(hoistChecksOutOfLoop->bailOutInfo);

globOpt->EnsureBailTarget(hoistChecksOutOfLoop);

InsertInstrInLandingPad(bailOnNotArray, hoistChecksOutOfLoop);

bailOnNotArray = bailOnNotArray->ConvertToBailOutInstr(hoistChecksOutOfLoop->bailOutInfo, bailOutKind);

}

else

{

bailOnNotArray->SetByteCodeOffset(instr);

insertBeforeInstr->InsertBefore(bailOnNotArray);

globOpt->GenerateBailAtOperation(&bailOnNotArray, bailOutKind);

shareableBailOutInfo = bailOnNotArray->GetBailOutInfo();

shareableBailOutInfoOriginalOwner = bailOnNotArray;

}

baseValueType = newBaseValueType;

baseOpnd->SetValueType(newBaseValueType);

}

void GlobOpt::ArraySrcOpt::DoLengthLoad()

{

Assert(baseValueType.IsArray());

Assert(newLengthSym);

TRACE_TESTTRACE_PHASE_INSTR(Js::Phase::ArrayLengthHoistPhase, instr, _u("Separating array length load\n"));

// Create an initial value for the length

globOpt->CurrentBlockData()->liveVarSyms->Set(newLengthSym->m_id);

Value *const lengthValue = globOpt->NewIntRangeValue(0, INT32_MAX, false);

globOpt->CurrentBlockData()->SetValue(lengthValue, newLengthSym);

// SetValue above would have set the sym store to newLengthSym. This sym won't be used for copy-prop though, so

// remove it as the sym store.

globOpt->SetSymStoreDirect(lengthValue->GetValueInfo(), nullptr);

// length = [array + offsetOf(length)]

IR::Instr *const loadLength =

IR::Instr::New(

Js::OpCode::LdIndir,

IR::RegOpnd::New(newLengthSym, newLengthSym->GetType(), instr->m_func),

IR::IndirOpnd::New(

baseOpnd,

Js::JavascriptArray::GetOffsetOfLength(),

newLengthSym->GetType(),

instr->m_func),

instr->m_func);

loadLength->GetDst()->SetIsJITOptimizedReg(true);

loadLength->GetSrc1()->AsIndirOpnd()->GetBaseOpnd()->SetIsJITOptimizedReg(true);

// BailOnNegative length (BailOutOnIrregularLength)

IR::Instr *bailOnIrregularLength = IR::Instr::New(Js::OpCode::BailOnNegative, instr->m_func);

bailOnIrregularLength->SetSrc1(loadLength->GetDst());

const IR::BailOutKind bailOutKind = IR::BailOutOnIrregularLength;

if (hoistLengthLoadOutOfLoop)

{

Assert(!hoistLengthLoadOutOfLoop->jsArrayKills.KillsArrayLengths());

TRACE_PHASE_INSTR(

Js::Phase::ArrayLengthHoistPhase,

instr,

_u("Hoisting array length load out of loop %u to landing pad block %u\n"),

hoistLengthLoadOutOfLoop->GetLoopNumber(),

hoistLengthLoadOutOfLoop->landingPad->GetBlockNum());

TESTTRACE_PHASE_INSTR(Js::Phase::ArrayLengthHoistPhase, instr, _u("Hoisting array length load out of loop\n"));

Assert(hoistLengthLoadOutOfLoop->bailOutInfo);

globOpt->EnsureBailTarget(hoistLengthLoadOutOfLoop);

InsertInstrInLandingPad(loadLength, hoistLengthLoadOutOfLoop);

InsertInstrInLandingPad(bailOnIrregularLength, hoistLengthLoadOutOfLoop);

bailOnIrregularLength = bailOnIrregularLength->ConvertToBailOutInstr(hoistLengthLoadOutOfLoop->bailOutInfo, bailOutKind);

// Hoist the length value

for (InvariantBlockBackwardIterator it(

globOpt,

globOpt->currentBlock,

hoistLengthLoadOutOfLoop->landingPad,

baseOpnd->m_sym,

baseValue->GetValueNumber());

it.IsValid();

it.MoveNext())

{

BasicBlock *const block = it.Block();

block->globOptData.liveVarSyms->Set(newLengthSym->m_id);

Assert(!block->globOptData.FindValue(newLengthSym));

Value *const lengthValueCopy = globOpt->CopyValue(lengthValue, lengthValue->GetValueNumber());

block->globOptData.SetValue(lengthValueCopy, newLengthSym);

globOpt->SetSymStoreDirect(lengthValueCopy->GetValueInfo(), nullptr);

}

}

else

{

loadLength->SetByteCodeOffset(instr);

insertBeforeInstr->InsertBefore(loadLength);

bailOnIrregularLength->SetByteCodeOffset(instr);

insertBeforeInstr->InsertBefore(bailOnIrregularLength);

if (shareableBailOutInfo)

{

ShareBailOut();

bailOnIrregularLength = bailOnIrregularLength->ConvertToBailOutInstr(shareableBailOutInfo, bailOutKind);

}

else

{

globOpt->GenerateBailAtOperation(&bailOnIrregularLength, bailOutKind);

shareableBailOutInfo = bailOnIrregularLength->GetBailOutInfo();

shareableBailOutInfoOriginalOwner = bailOnIrregularLength;

}

}

}

void GlobOpt::ArraySrcOpt::DoHeadSegmentLengthLoad()

{

Assert(!isLikelyJsArray || newHeadSegmentSym || baseArrayValueInfo && baseArrayValueInfo->HeadSegmentSym());

Assert(newHeadSegmentLengthSym);

Assert(!headSegmentLengthValue);

TRACE_TESTTRACE_PHASE_INSTR(Js::ArraySegmentHoistPhase, instr, _u("Separating array segment length load\n"));

// Create an initial value for the head segment length

globOpt->CurrentBlockData()->liveVarSyms->Set(newHeadSegmentLengthSym->m_id);

headSegmentLengthValue = globOpt->NewIntRangeValue(0, Js::SparseArraySegmentBase::MaxLength, false);

headSegmentLengthConstantBounds = IntConstantBounds(0, Js::SparseArraySegmentBase::MaxLength);

globOpt->CurrentBlockData()->SetValue(headSegmentLengthValue, newHeadSegmentLengthSym);

// SetValue above would have set the sym store to newHeadSegmentLengthSym. This sym won't be used for copy-prop

// though, so remove it as the sym store.

globOpt->SetSymStoreDirect(headSegmentLengthValue->GetValueInfo(), nullptr);

StackSym *const headSegmentSym = isLikelyJsArray ? newHeadSegmentSym ? newHeadSegmentSym : baseArrayValueInfo->HeadSegmentSym() : nullptr;

IR::Instr *const loadHeadSegmentLength =

IR::Instr::New(

Js::OpCode::LdIndir,

IR::RegOpnd::New(newHeadSegmentLengthSym, newHeadSegmentLengthSym->GetType(), instr->m_func),

IR::IndirOpnd::New(

isLikelyJsArray ? IR::RegOpnd::New(headSegmentSym, headSegmentSym->GetType(), instr->m_func) : baseOpnd,

isLikelyJsArray

? Js::SparseArraySegmentBase::GetOffsetOfLength()

: Lowerer::GetArrayOffsetOfLength(baseValueType),

newHeadSegmentLengthSym->GetType(),

instr->m_func),

instr->m_func);

loadHeadSegmentLength->GetDst()->SetIsJITOptimizedReg(true);

loadHeadSegmentLength->GetSrc1()->AsIndirOpnd()->GetBaseOpnd()->SetIsJITOptimizedReg(true);

// We don't check the head segment length for negative (very large uint32) values. For JS arrays, the bound checks

// cover that. For typed arrays, we currently don't allocate array buffers with more than 1 GB elements.

if (hoistHeadSegmentLengthLoadOutOfLoop)

{

Assert(

!(

isLikelyJsArray

? hoistHeadSegmentLengthLoadOutOfLoop->jsArrayKills.KillsArrayHeadSegmentLengths()

: hoistHeadSegmentLengthLoadOutOfLoop->jsArrayKills.KillsTypedArrayHeadSegmentLengths()

));

TRACE_PHASE_INSTR(

Js::ArraySegmentHoistPhase,

instr,

_u("Hoisting array segment length load out of loop %u to landing pad block %u\n"),

hoistHeadSegmentLengthLoadOutOfLoop->GetLoopNumber(),

hoistHeadSegmentLengthLoadOutOfLoop->landingPad->GetBlockNum());

TESTTRACE_PHASE_INSTR(Js::ArraySegmentHoistPhase, instr, _u("Hoisting array segment length load out of loop\n"));

InsertInstrInLandingPad(loadHeadSegmentLength, hoistHeadSegmentLengthLoadOutOfLoop);

// Hoist the head segment length value

for (InvariantBlockBackwardIterator it(

globOpt,

globOpt->currentBlock,

hoistHeadSegmentLengthLoadOutOfLoop->landingPad,

baseOpnd->m_sym,

baseValue->GetValueNumber());

it.IsValid();

it.MoveNext())

{

BasicBlock *const block = it.Block();

block->globOptData.liveVarSyms->Set(newHeadSegmentLengthSym->m_id);

Assert(!block->globOptData.FindValue(newHeadSegmentLengthSym));

Value *const headSegmentLengthValueCopy = globOpt->CopyValue(headSegmentLengthValue, headSegmentLengthValue->GetValueNumber());

block->globOptData.SetValue(headSegmentLengthValueCopy, newHeadSegmentLengthSym);

globOpt->SetSymStoreDirect(headSegmentLengthValueCopy->GetValueInfo(), nullptr);

}

}

else

{

loadHeadSegmentLength->SetByteCodeOffset(instr);

insertBeforeInstr->InsertBefore(loadHeadSegmentLength);

instr->loadedArrayHeadSegmentLength = true;

}

}

void GlobOpt::ArraySrcOpt::DoExtractBoundChecks()

{

Assert(!(eliminatedLowerBoundCheck && eliminatedUpperBoundCheck));

Assert(baseOwnerIndir != nullptr || indexOpnd != nullptr);

Assert(indexOpnd == nullptr || indexOpnd->IsIntConstOpnd() || indexOpnd->AsRegOpnd()->m_sym->IsTypeSpec());

Assert(doHeadSegmentLengthLoad || headSegmentLengthIsAvailable);

Assert(canBailOutOnArrayAccessHelperCall);

Assert(!isStore || instr->m_opcode == Js::OpCode::StElemI_A || instr->m_opcode == Js::OpCode::StElemI_A_Strict || Js::IsSimd128LoadStore(instr->m_opcode));

headSegmentLengthSym = headSegmentLengthIsAvailable ? baseArrayValueInfo->HeadSegmentLengthSym() : newHeadSegmentLengthSym;

Assert(headSegmentLengthSym);

Assert(headSegmentLengthValue);

if (globOpt->DoBoundCheckHoist())

{

if (indexVarSym)

{

TRACE_PHASE_INSTR_VERBOSE(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Determining array bound check hoistability for index s%u\n"),

indexVarSym->m_id);

}

else

{

TRACE_PHASE_INSTR_VERBOSE(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Determining array bound check hoistability for index %d\n"),

indexConstantBounds.LowerBound());

}

globOpt->DetermineArrayBoundCheckHoistability(

!eliminatedLowerBoundCheck,

!eliminatedUpperBoundCheck,

lowerBoundCheckHoistInfo,

upperBoundCheckHoistInfo,

isLikelyJsArray,

indexVarSym,

indexValue,

indexConstantBounds,

headSegmentLengthSym,

headSegmentLengthValue,

headSegmentLengthConstantBounds,

hoistHeadSegmentLengthLoadOutOfLoop,

failedToUpdateCompatibleLowerBoundCheck,

failedToUpdateCompatibleUpperBoundCheck);

}

if (!eliminatedLowerBoundCheck)

{

DoLowerBoundCheck();

}

if (!eliminatedUpperBoundCheck)

{

DoUpperBoundCheck();

}

}

void GlobOpt::ArraySrcOpt::DoLowerBoundCheck()

{

eliminatedLowerBoundCheck = true;

Assert(indexVarSym);

Assert(indexOpnd);

Assert(indexValue);

GlobOpt::ArrayLowerBoundCheckHoistInfo &hoistInfo = lowerBoundCheckHoistInfo;

if (hoistInfo.HasAnyInfo())

{

BasicBlock *hoistBlock;

if (hoistInfo.CompatibleBoundCheckBlock())

{

hoistBlock = hoistInfo.CompatibleBoundCheckBlock();

TRACE_PHASE_INSTR(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Hoisting array lower bound check into existing bound check instruction in block %u\n"),

hoistBlock->GetBlockNum());

TESTTRACE_PHASE_INSTR(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Hoisting array lower bound check into existing bound check instruction\n"));

}

else

{

Assert(hoistInfo.Loop());

BasicBlock *const landingPad = hoistInfo.Loop()->landingPad;

hoistBlock = landingPad;

StackSym *indexIntSym;

if (hoistInfo.IndexSym() && hoistInfo.IndexSym()->IsVar())

{

if (!landingPad->globOptData.IsInt32TypeSpecialized(hoistInfo.IndexSym()))

{

// Int-specialize the index sym, as the BoundCheck instruction requires int operands. Specialize

// it in this block if it is invariant, as the conversion will be hoisted along with value

// updates.

BasicBlock *specializationBlock = hoistInfo.Loop()->landingPad;

IR::Instr *specializeBeforeInstr = nullptr;

if (!globOpt->CurrentBlockData()->IsInt32TypeSpecialized(hoistInfo.IndexSym()) &&

globOpt->OptIsInvariant(

hoistInfo.IndexSym(),

globOpt->currentBlock,

hoistInfo.Loop(),

globOpt->CurrentBlockData()->FindValue(hoistInfo.IndexSym()),

false,

true))

{

specializationBlock = globOpt->currentBlock;

specializeBeforeInstr = insertBeforeInstr;

}

Assert(globOpt->tempBv->IsEmpty());

globOpt->tempBv->Set(hoistInfo.IndexSym()->m_id);

globOpt->ToInt32(globOpt->tempBv, specializationBlock, false, specializeBeforeInstr);

globOpt->tempBv->ClearAll();

Assert(landingPad->globOptData.IsInt32TypeSpecialized(hoistInfo.IndexSym()));

}

indexIntSym = hoistInfo.IndexSym()->GetInt32EquivSym(nullptr);

Assert(indexIntSym);

}

else

{

indexIntSym = hoistInfo.IndexSym();

Assert(!indexIntSym || indexIntSym->GetType() == TyInt32 || indexIntSym->GetType() == TyUint32);

}

if (hoistInfo.IndexSym())

{

Assert(hoistInfo.Loop()->bailOutInfo);

globOpt->EnsureBailTarget(hoistInfo.Loop());

bool needsMagnitudeAdjustment = false;

if (hoistInfo.LoopCount())

{

// Generate the loop count and loop count based bound that will be used for the bound check

if (!hoistInfo.LoopCount()->HasBeenGenerated())

{

globOpt->GenerateLoopCount(hoistInfo.Loop(), hoistInfo.LoopCount());

}

needsMagnitudeAdjustment = (hoistInfo.MaxMagnitudeChange() > 0)

? (hoistInfo.IndexOffset() < hoistInfo.MaxMagnitudeChange())

: (hoistInfo.IndexOffset() > hoistInfo.MaxMagnitudeChange());

globOpt->GenerateSecondaryInductionVariableBound(

hoistInfo.Loop(),

indexVarSym->GetInt32EquivSym(nullptr),

hoistInfo.LoopCount(),

hoistInfo.MaxMagnitudeChange(),

needsMagnitudeAdjustment,

hoistInfo.IndexSym());

}

IR::Opnd* lowerBound = IR::IntConstOpnd::New(0, TyInt32, instr->m_func, true);

IR::Opnd* upperBound = IR::RegOpnd::New(indexIntSym, TyInt32, instr->m_func);

int offset = needsMagnitudeAdjustment ? (hoistInfo.IndexOffset() - hoistInfo.Offset()) : hoistInfo.Offset();

upperBound->SetIsJITOptimizedReg(true);

// 0 <= indexSym + offset (src1 <= src2 + dst)

IR::Instr *const boundCheck = globOpt->CreateBoundsCheckInstr(

lowerBound,

upperBound,

offset,

hoistInfo.IsLoopCountBasedBound()

? IR::BailOutOnFailedHoistedLoopCountBasedBoundCheck

: IR::BailOutOnFailedHoistedBoundCheck,

hoistInfo.Loop()->bailOutInfo,

hoistInfo.Loop()->bailOutInfo->bailOutFunc);

InsertInstrInLandingPad(boundCheck, hoistInfo.Loop());

TRACE_PHASE_INSTR(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Hoisting array lower bound check out of loop %u to landing pad block %u, as (0 <= s%u + %d)\n"),

hoistInfo.Loop()->GetLoopNumber(),

landingPad->GetBlockNum(),

hoistInfo.IndexSym()->m_id,

hoistInfo.Offset());

TESTTRACE_PHASE_INSTR(

Js::Phase::BoundCheckHoistPhase,

instr,

_u("Hoisting array lower bound check out of loop\n"));

// Record the bound check instruction as available

const IntBoundCheck boundCheckInfo(

ZeroValueNumber,

hoistInfo.IndexValueNumber(),

boundCheck,

landingPad);

{

const bool added = globOpt->CurrentBlockData()->availableIntBoundChecks->AddNew(boundCheckInfo) >= 0;

Assert(added || failedToUpdateCompatibleLowerBoundCheck);

}

for (InvariantBlockBackwardIterator it(globOpt, globOpt->currentBlock, landingPad, nullptr);

it.IsValid();

it.MoveNext())

{

const bool added = it.Block()->globOptData.availableIntBoundChecks->AddNew(boundCheckInfo) >= 0;

Assert(added || failedToUpdateCompatibleLowerBoundCheck);

}

}

}

// Update values of the syms involved in the bound check to reflect the bound check

if (hoistBlock != globOpt->currentBlock && hoistInfo.IndexSym() && hoistInfo.Offset() != INT32_MIN)

{

for (InvariantBlockBackwardIterator it(

globOpt,

globOpt->currentBlock->next,