/*

* Copyright (C) 2011-2022 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "DFGByteCodeParser.h"

#if ENABLE(DFG_JIT)

#include "ArithProfile.h"

#include "ArrayConstructor.h"

#include "ArrayPrototype.h"

#include "BooleanConstructor.h"

#include "BuiltinNames.h"

#include "BytecodeGenerator.h"

#include "BytecodeOperandsForCheckpoint.h"

#include "CacheableIdentifierInlines.h"

#include "CallLinkStatus.h"

#include "CheckPrivateBrandStatus.h"

#include "CodeBlock.h"

#include "CodeBlockWithJITType.h"

#include "CommonSlowPaths.h"

#include "DFGAbstractHeap.h"

#include "DFGArrayMode.h"

#include "DFGBackwardsPropagationPhase.h"

#include "DFGBlockSet.h"

#include "DFGCapabilities.h"

#include "DFGClobberize.h"

#include "DFGClobbersExitState.h"

#include "DFGGraph.h"

#include "DOMJITGetterSetter.h"

#include "DeleteByStatus.h"

#include "FunctionCodeBlock.h"

#include "GetByStatus.h"

#include "GetterSetter.h"

#include "Heap.h"

#include "InByStatus.h"

#include "InstanceOfStatus.h"

#include "JSArrayIterator.h"

#include "JSCInlines.h"

#include "JSImmutableButterfly.h"

#include "JSInternalPromise.h"

#include "JSInternalPromiseConstructor.h"

#include "JSMapIterator.h"

#include "JSModuleEnvironment.h"

#include "JSModuleNamespaceObject.h"

#include "JSPromiseConstructor.h"

#include "JSSetIterator.h"

#include "NullSetterFunction.h"

#include "NumberConstructor.h"

#include "ObjectConstructor.h"

#include "OpcodeInlines.h"

#include "PreciseJumpTargets.h"

#include "PrivateFieldPutKind.h"

#include "PutByIdFlags.h"

#include "PutByStatus.h"

#include "RegExpPrototype.h"

#include "SetPrivateBrandStatus.h"

#include "StackAlignment.h"

#include "StringConstructor.h"

#include "StructureStubInfo.h"

#include "SymbolConstructor.h"

#include <wtf/CommaPrinter.h>

#include <wtf/HashMap.h>

#include <wtf/SetForScope.h>

#include <wtf/StdLibExtras.h>

namespace JSC { namespace DFG {

namespace DFGByteCodeParserInternal {

#ifdef NDEBUG

static constexpr bool verbose = false;

#else

static constexpr bool verbose = true;

#endif

} // namespace DFGByteCodeParserInternal

#define VERBOSE_LOG(...) do { \

if (DFGByteCodeParserInternal::verbose && Options::verboseDFGBytecodeParsing()) \

dataLog(__VA_ARGS__); \

} while (false)

// === ByteCodeParser ===

//

// This class is used to compile the dataflow graph from a CodeBlock.

class ByteCodeParser {

public:

ByteCodeParser(Graph& graph)

: m_vm(&graph.m_vm)

, m_codeBlock(graph.m_codeBlock)

, m_profiledBlock(graph.m_profiledBlock)

, m_graph(graph)

, m_currentBlock(nullptr)

, m_currentIndex(0)

, m_constantUndefined(graph.freeze(jsUndefined()))

, m_constantNull(graph.freeze(jsNull()))

, m_constantNaN(graph.freeze(jsNumber(PNaN)))

, m_constantOne(graph.freeze(jsNumber(1)))

, m_numArguments(m_codeBlock->numParameters())

, m_numLocals(m_codeBlock->numCalleeLocals())

, m_numTmps(m_codeBlock->numTmps())

, m_parameterSlots(0)

, m_numPassedVarArgs(0)

, m_inlineStackTop(nullptr)

, m_currentInstruction(nullptr)

, m_hasDebuggerEnabled(graph.hasDebuggerEnabled())

{

ASSERT(m_profiledBlock);

}

// Parse a full CodeBlock of bytecode.

void parse();

private:

struct InlineStackEntry;

// Just parse from m_currentIndex to the end of the current CodeBlock.

void parseCodeBlock();

void ensureLocals(unsigned newNumLocals)

{

VERBOSE_LOG(" ensureLocals: trying to raise m_numLocals from ", m_numLocals, " to ", newNumLocals, "\n");

if (newNumLocals <= m_numLocals)

return;

m_numLocals = newNumLocals;

for (size_t i = 0; i < m_graph.numBlocks(); ++i)

m_graph.block(i)->ensureLocals(newNumLocals);

}

void ensureTmps(unsigned newNumTmps)

{

VERBOSE_LOG(" ensureTmps: trying to raise m_numTmps from ", m_numTmps, " to ", newNumTmps, "\n");

if (newNumTmps <= m_numTmps)

return;

m_numTmps = newNumTmps;

for (size_t i = 0; i < m_graph.numBlocks(); ++i)

m_graph.block(i)->ensureTmps(newNumTmps);

}

// Helper for min and max.

template<typename ChecksFunctor>

void handleMinMax(Operand result, NodeType op, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor& insertChecks);

void refineStatically(CallLinkStatus&, Node* callTarget);

// Blocks can either be targetable (i.e. in the m_blockLinkingTargets of one InlineStackEntry) with a well-defined bytecodeBegin,

// or they can be untargetable, with bytecodeBegin==UINT_MAX, to be managed manually and not by the linkBlock machinery.

// This is used most notably when doing polyvariant inlining (it requires a fair bit of control-flow with no bytecode analog).

// It is also used when doing an early return from an inlined callee: it is easier to fix the bytecode index later on if needed

// than to move the right index all the way to the treatment of op_ret.

BasicBlock* allocateTargetableBlock(BytecodeIndex);

BasicBlock* allocateUntargetableBlock();

// An untargetable block can be given a bytecodeIndex to be later managed by linkBlock, but only once, and it can never go in the other direction

void makeBlockTargetable(BasicBlock*, BytecodeIndex);

void addJumpTo(BasicBlock*);

void addJumpTo(unsigned bytecodeIndex);

// Handle calls. This resolves issues surrounding inlining and intrinsics.

enum Terminality { Terminal, NonTerminal };

Terminality handleCall(

Operand result, NodeType op, InlineCallFrame::Kind, BytecodeIndex osrExitIndex,

Node* callTarget, int argumentCountIncludingThis, int registerOffset, CallLinkStatus,

SpeculatedType prediction, ECMAMode = ECMAMode::strict());

template<typename CallOp>

Terminality handleCall(const JSInstruction* pc, NodeType op, CallMode, BytecodeIndex osrExitIndex);

template<typename CallOp>

Terminality handleVarargsCall(const JSInstruction* pc, NodeType op, CallMode);

void emitFunctionChecks(CallVariant, Node* callTarget, VirtualRegister thisArgumnt);

void emitArgumentPhantoms(int registerOffset, int argumentCountIncludingThis);

Node* getArgumentCount();

template<typename ChecksFunctor>

bool handleRecursiveTailCall(Node* callTargetNode, CallVariant, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor& emitFunctionCheckIfNeeded);

unsigned inliningCost(CallVariant, int argumentCountIncludingThis, InlineCallFrame::Kind); // Return UINT_MAX if it's not an inlining candidate. By convention, intrinsics have a cost of 1.

// Handle inlining. Return true if it succeeded, false if we need to plant a call.

bool handleVarargsInlining(Node* callTargetNode, Operand result, const CallLinkStatus&, int registerOffset, VirtualRegister thisArgument, VirtualRegister argumentsArgument, unsigned argumentsOffset, NodeType callOp, InlineCallFrame::Kind);

unsigned getInliningBalance(const CallLinkStatus&, CodeSpecializationKind);

enum class CallOptimizationResult { OptimizedToJump, Inlined, DidNothing };

CallOptimizationResult handleCallVariant(Node* callTargetNode, Operand result, CallVariant, int registerOffset, VirtualRegister thisArgument, int argumentCountIncludingThis, BytecodeIndex osrExitIndex, InlineCallFrame::Kind, SpeculatedType prediction, unsigned& inliningBalance, BasicBlock* continuationBlock, bool needsToCheckCallee);

CallOptimizationResult handleInlining(Node* callTargetNode, Operand result, const CallLinkStatus&, int registerOffset, VirtualRegister thisArgument, int argumentCountIncludingThis, BytecodeIndex osrExitIndex, NodeType callOp, InlineCallFrame::Kind, SpeculatedType prediction, ECMAMode);

template<typename ChecksFunctor>

void inlineCall(Node* callTargetNode, Operand result, CallVariant, int registerOffset, int argumentCountIncludingThis, InlineCallFrame::Kind, BasicBlock* continuationBlock, const ChecksFunctor& insertChecks);

// Handle intrinsic functions. Return true if it succeeded, false if we need to plant a call.

template<typename ChecksFunctor>

bool handleIntrinsicCall(Node* callee, Operand result, CallVariant, Intrinsic, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks);

template<typename ChecksFunctor>

bool handleDOMJITCall(Node* callee, Operand result, const DOMJIT::Signature*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, const ChecksFunctor& insertChecks);

template<typename ChecksFunctor>

bool handleIntrinsicGetter(Operand result, SpeculatedType prediction, const GetByVariant& intrinsicVariant, Node* thisNode, const ChecksFunctor& insertChecks);

template<typename ChecksFunctor>

bool handleTypedArrayConstructor(Operand result, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor& insertChecks);

template<typename ChecksFunctor>

bool handleConstantInternalFunction(Node* callTargetNode, Operand result, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, SpeculatedType, const ChecksFunctor& insertChecks);

Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, Node* value);

Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, NodeType = GetByOffset);

bool handleDOMJITGetter(Operand result, const GetByVariant&, Node* thisNode, unsigned identifierNumber, SpeculatedType prediction);

bool handleModuleNamespaceLoad(VirtualRegister result, SpeculatedType, Node* base, GetByStatus);

template<typename Bytecode>

void handlePutByVal(Bytecode, BytecodeIndex osrExitIndex);

template <typename Bytecode>

void handlePutAccessorById(NodeType, Bytecode);

template <typename Bytecode>

void handlePutAccessorByVal(NodeType, Bytecode);

template <typename Bytecode>

void handleNewFunc(NodeType, Bytecode);

template <typename Bytecode>

void handleNewFuncExp(NodeType, Bytecode);

template <typename Bytecode>

void handleCreateInternalFieldObject(const ClassInfo*, NodeType createOp, NodeType newOp, Bytecode);

// Create a presence ObjectPropertyCondition based on some known offset and structure set. Does not

// check the validity of the condition, but it may return a null one if it encounters a contradiction.

ObjectPropertyCondition presenceConditionIfConsistent(JSObject* knownBase, UniquedStringImpl*, PropertyOffset, const StructureSet&);

// Attempt to watch the presence/replacement of a property. It will watch that the property is present in the same

// way as in all of the structures in the set (or the base if it's a constant). It may emit code instead of just setting a watchpoint.

// Returns the condition if one is found/watched.

void checkReplacement(Node* base, UniquedStringImpl*, PropertyOffset, const StructureSet&);

// Works with both GetByVariant and the setter form of PutByVariant.

template<typename VariantType>

Node* load(SpeculatedType, Node* base, unsigned identifierNumber, const VariantType&);

Node* replace(Node* base, unsigned identifier, const PutByVariant&, Node* value);

template<typename Op>

void parseGetById(const JSInstruction*);

void simplifyGetByStatus(Node* base, GetByStatus&);

void handleGetById(

VirtualRegister destination, SpeculatedType, Node* base, CacheableIdentifier, unsigned identifierNumber, GetByStatus, AccessType, BytecodeIndex osrExitIndex);

void handleGetPrivateNameById(

VirtualRegister destination, SpeculatedType prediction, Node* base, CacheableIdentifier, unsigned identifierNumber, GetByStatus);

void emitPutById(

Node* base, CacheableIdentifier, Node* value, const PutByStatus&, bool isDirect, ECMAMode);

void handlePutById(

Node* base, CacheableIdentifier, unsigned identifierNumber, Node* value, const PutByStatus&,

bool isDirect, BytecodeIndex osrExitIndex, ECMAMode);

void handlePutPrivateNameById(

Node* base, CacheableIdentifier, unsigned identifierNumber, Node* value, const PutByStatus&, PrivateFieldPutKind);

void handleDeleteById(

VirtualRegister destination, Node* base, CacheableIdentifier, unsigned identifierNumber, DeleteByStatus, ECMAMode);

bool handleInByAsMatchStructure(VirtualRegister destination, Node* base, InByStatus);

void handleInById(VirtualRegister destination, Node* base, CacheableIdentifier, InByStatus);

// Either register a watchpoint or emit a check for this condition. Returns false if the

// condition no longer holds, and therefore no reasonable check can be emitted.

bool check(const ObjectPropertyCondition&);

GetByOffsetMethod promoteToConstant(GetByOffsetMethod);

// Either register a watchpoint or emit a check for this condition. It must be a Presence

// condition. It will attempt to promote a Presence condition to an Equivalence condition.

// Emits code for the loaded value that the condition guards, and returns a node containing

// the loaded value. Returns null if the condition no longer holds.

GetByOffsetMethod planLoad(const ObjectPropertyCondition&);

Node* load(SpeculatedType, unsigned identifierNumber, const GetByOffsetMethod&, NodeType = GetByOffset);

Node* load(SpeculatedType, const ObjectPropertyCondition&, NodeType = GetByOffset);

// Calls check() for each condition in the set: that is, it either emits checks or registers

// watchpoints (or a combination of the two) to make the conditions hold. If any of those

// conditions are no longer checkable, returns false.

bool check(const ObjectPropertyConditionSet&);

// Calls check() for those conditions that aren't the slot base, and calls load() for the slot

// base. Does a combination of watchpoint registration and check emission to guard the

// conditions, and emits code to load the value from the slot base. Returns a node containing

// the loaded value. Returns null if any of the conditions were no longer checkable.

GetByOffsetMethod planLoad(const ObjectPropertyConditionSet&);

Node* load(SpeculatedType, const ObjectPropertyConditionSet&, NodeType = GetByOffset);

void prepareToParseBlock();

void clearCaches();

// Parse a single basic block of bytecode instructions.

void parseBlock(unsigned limit);

// Link block successors.

void linkBlock(BasicBlock*, Vector<BasicBlock*>& possibleTargets);

void linkBlocks(Vector<BasicBlock*>& unlinkedBlocks, Vector<BasicBlock*>& possibleTargets);

BytecodeIndex nextOpcodeIndex() const { return BytecodeIndex(m_currentIndex.offset() + m_currentInstruction->size()); }

BytecodeIndex nextCheckpoint() const { return m_currentIndex.withCheckpoint(m_currentIndex.checkpoint() + 1); }

void progressToNextCheckpoint()

{

m_currentIndex = nextCheckpoint();

// At this point, it's again OK to OSR exit.

m_exitOK = true;

processSetLocalQueue();

}

VariableAccessData* newVariableAccessData(Operand operand)

{

ASSERT(!operand.isConstant());

m_graph.m_variableAccessData.append(operand);

return &m_graph.m_variableAccessData.last();

}

// Get/Set the operands/result of a bytecode instruction.

Node* getDirect(Operand operand)

{

ASSERT(!operand.isConstant());

if (operand.isArgument())

return getArgument(operand.virtualRegister());

return getLocalOrTmp(operand);

}

Node* get(Operand operand)

{

if (operand.isConstant()) {

unsigned constantIndex = operand.virtualRegister().toConstantIndex();

unsigned oldSize = m_constants.size();

if (constantIndex >= oldSize || !m_constants[constantIndex]) {

const CodeBlock& codeBlock = *m_inlineStackTop->m_codeBlock;

JSValue value = codeBlock.getConstant(operand.virtualRegister());

SourceCodeRepresentation sourceCodeRepresentation = codeBlock.constantSourceCodeRepresentation(operand.virtualRegister());

if (constantIndex >= oldSize) {

m_constants.grow(constantIndex + 1);

for (unsigned i = oldSize; i < m_constants.size(); ++i)

m_constants[i] = nullptr;

}

Node* constantNode = nullptr;

if (sourceCodeRepresentation == SourceCodeRepresentation::Double)

constantNode = addToGraph(DoubleConstant, OpInfo(m_graph.freezeStrong(jsDoubleNumber(value.asNumber()))));

else

constantNode = addToGraph(JSConstant, OpInfo(m_graph.freezeStrong(value)));

m_constants[constantIndex] = constantNode;

}

ASSERT(m_constants[constantIndex]);

return m_constants[constantIndex];

}

if (inlineCallFrame()) {

if (!inlineCallFrame()->isClosureCall) {

JSFunction* callee = inlineCallFrame()->calleeConstant();

if (operand == VirtualRegister(CallFrameSlot::callee))

return weakJSConstant(callee);

}

} else if (operand == VirtualRegister(CallFrameSlot::callee)) {

// We have to do some constant-folding here because this enables CreateThis folding. Note

// that we don't have such watchpoint-based folding for inlined uses of Callee, since in that

// case if the function is a singleton then we already know it.

if (FunctionExecutable* executable = jsDynamicCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())) {

if (JSFunction* function = executable->singleton().inferredValue()) {

m_graph.watchpoints().addLazily(executable);

return weakJSConstant(function);

}

}

return addToGraph(GetCallee);

}

return getDirect(m_inlineStackTop->remapOperand(operand));

}

enum SetMode {

// A normal set which follows a two-phase commit that spans code origins. During

// the current code origin it issues a MovHint, and at the start of the next

// code origin there will be a SetLocal. If the local needs flushing, the second

// SetLocal will be preceded with a Flush.

NormalSet,

// A set where the SetLocal happens immediately and there is still a Flush. This

// is relevant when assigning to a local in tricky situations for the delayed

// SetLocal logic but where we know that we have not performed any side effects

// within this code origin. This is a safe replacement for NormalSet anytime we

// know that we have not yet performed side effects in this code origin.

ImmediateSetWithFlush,

// A set where the SetLocal happens immediately and we do not Flush it even if

// this is a local that is marked as needing it. This is relevant when

// initializing locals at the top of a function.

ImmediateNakedSet

};

Node* setDirect(Operand operand, Node* value, SetMode setMode = NormalSet)

{

addToGraph(MovHint, OpInfo(operand), value);

// We can't exit anymore because our OSR exit state has changed.

m_exitOK = false;

DelayedSetLocal delayed(currentCodeOrigin(), operand, value, setMode);

if (setMode == NormalSet) {

m_setLocalQueue.append(delayed);

return nullptr;

}

return delayed.execute(this);

}

void processSetLocalQueue()

{

for (unsigned i = 0; i < m_setLocalQueue.size(); ++i)

m_setLocalQueue[i].execute(this);

m_setLocalQueue.shrink(0);

}

Node* set(Operand operand, Node* value, SetMode setMode = NormalSet)

{

return setDirect(m_inlineStackTop->remapOperand(operand), value, setMode);

}

Node* injectLazyOperandSpeculation(Node* node)

{

ASSERT(node->op() == GetLocal);

ASSERT(node->origin.semantic.bytecodeIndex() == m_currentIndex);

ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

LazyOperandValueProfileKey key(m_currentIndex, node->operand());

SpeculatedType prediction = m_inlineStackTop->m_lazyOperands.prediction(locker, key);

node->variableAccessData()->predict(prediction);

return node;

}

// Used in implementing get/set, above, where the operand is a local variable.

Node* getLocalOrTmp(Operand operand)

{

ASSERT(operand.isTmp() || operand.isLocal());

Node*& node = m_currentBlock->variablesAtTail.operand(operand);

// This has two goals: 1) link together variable access datas, and 2)

// try to avoid creating redundant GetLocals. (1) is required for

// correctness - no other phase will ensure that block-local variable

// access data unification is done correctly. (2) is purely opportunistic

// and is meant as an compile-time optimization only.

VariableAccessData* variable;

if (node) {

variable = node->variableAccessData();

switch (node->op()) {

case GetLocal:

return node;

case SetLocal:

return node->child1().node();

default:

break;

}

} else

variable = newVariableAccessData(operand);

node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));

return node;

}

Node* setLocalOrTmp(const CodeOrigin& semanticOrigin, Operand operand, Node* value, SetMode setMode = NormalSet)

{

ASSERT(operand.isTmp() || operand.isLocal());

SetForScope originChange(m_currentSemanticOrigin, semanticOrigin);

if (operand.isTmp() && static_cast<unsigned>(operand.value()) >= m_numTmps) {

if (inlineCallFrame())

dataLogLn(*inlineCallFrame());

dataLogLn("Bad operand: ", operand, " but current number of tmps is: ", m_numTmps, " code block has: ", m_profiledBlock->numTmps(), " tmps.");

CRASH();

}

if (setMode != ImmediateNakedSet && !operand.isTmp()) {

VirtualRegister reg = operand.virtualRegister();

ArgumentPosition* argumentPosition = findArgumentPositionForLocal(reg);

if (argumentPosition)

flushDirect(operand, argumentPosition);

else if (m_graph.needsScopeRegister() && reg == m_codeBlock->scopeRegister())

flush(operand);

}

VariableAccessData* variableAccessData = newVariableAccessData(operand);

variableAccessData->mergeStructureCheckHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex(), BadCache));

variableAccessData->mergeCheckArrayHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex(), BadIndexingType));

Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);

m_currentBlock->variablesAtTail.operand(operand) = node;

return node;

}

// Used in implementing get/set, above, where the operand is an argument.

Node* getArgument(VirtualRegister operand)

{

unsigned argument = operand.toArgument();

ASSERT(argument < m_numArguments);

Node* node = m_currentBlock->variablesAtTail.argument(argument);

VariableAccessData* variable;

if (node) {

variable = node->variableAccessData();

switch (node->op()) {

case GetLocal:

return node;

case SetLocal:

return node->child1().node();

default:

break;

}

} else

variable = newVariableAccessData(operand);

node = injectLazyOperandSpeculation(addToGraph(GetLocal, OpInfo(variable)));

m_currentBlock->variablesAtTail.argument(argument) = node;

return node;

}

Node* setArgument(const CodeOrigin& semanticOrigin, Operand operand, Node* value, SetMode setMode = NormalSet)

{

SetForScope originChange(m_currentSemanticOrigin, semanticOrigin);

VirtualRegister reg = operand.virtualRegister();

unsigned argument = reg.toArgument();

ASSERT(argument < m_numArguments);

VariableAccessData* variableAccessData = newVariableAccessData(reg);

// Always flush arguments, except for 'this'. If 'this' is created by us,

// then make sure that it's never unboxed.

if (argument) {

if (setMode != ImmediateNakedSet)

flushDirect(reg);

} else if (!argument) {

if (setMode != ImmediateNakedSet)

phantomLocalDirect(reg);

}

if (!argument && m_codeBlock->specializationKind() == CodeForConstruct)

variableAccessData->mergeShouldNeverUnbox(true);

variableAccessData->mergeStructureCheckHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex(), BadCache));

variableAccessData->mergeCheckArrayHoistingFailed(

m_inlineStackTop->m_exitProfile.hasExitSite(semanticOrigin.bytecodeIndex(), BadIndexingType));

Node* node = addToGraph(SetLocal, OpInfo(variableAccessData), value);

m_currentBlock->variablesAtTail.argument(argument) = node;

return node;

}

ArgumentPosition* findArgumentPositionForArgument(int argument)

{

InlineStackEntry* stack = m_inlineStackTop;

while (stack->m_inlineCallFrame)

stack = stack->m_caller;

return stack->m_argumentPositions[argument];

}

ArgumentPosition* findArgumentPositionForLocal(VirtualRegister operand)

{

for (InlineStackEntry* stack = m_inlineStackTop; ; stack = stack->m_caller) {

InlineCallFrame* inlineCallFrame = stack->m_inlineCallFrame;

if (!inlineCallFrame)

break;

if (operand.offset() < static_cast<int>(inlineCallFrame->stackOffset + CallFrame::headerSizeInRegisters))

continue;

if (operand.offset() >= static_cast<int>(inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset() + inlineCallFrame->m_argumentsWithFixup.size()))

continue;

int argument = VirtualRegister(operand.offset() - inlineCallFrame->stackOffset).toArgument();

return stack->m_argumentPositions[argument];

}

return nullptr;

}

ArgumentPosition* findArgumentPosition(Operand operand)

{

if (operand.isTmp())

return nullptr;

if (operand.isArgument())

return findArgumentPositionForArgument(operand.toArgument());

return findArgumentPositionForLocal(operand.virtualRegister());

}

template<typename AddFlushDirectFunc>

void flushImpl(InlineCallFrame* inlineCallFrame, const AddFlushDirectFunc& addFlushDirect)

{

int numArguments;

if (inlineCallFrame) {

ASSERT(!m_graph.hasDebuggerEnabled());

numArguments = inlineCallFrame->m_argumentsWithFixup.size();

if (inlineCallFrame->isClosureCall)

addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, CallFrameSlot::callee));

if (inlineCallFrame->isVarargs())

addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, CallFrameSlot::argumentCountIncludingThis));

} else

numArguments = m_graph.baselineCodeBlockFor(inlineCallFrame)->numParameters();

for (unsigned argument = numArguments; argument--;)

addFlushDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForArgumentIncludingThis(argument)));

if (m_graph.needsScopeRegister())

addFlushDirect(nullptr, m_graph.m_codeBlock->scopeRegister());

}

template<typename AddFlushDirectFunc, typename AddPhantomLocalDirectFunc>

void flushForTerminalImpl(CodeOrigin origin, const AddFlushDirectFunc& addFlushDirect, const AddPhantomLocalDirectFunc& addPhantomLocalDirect)

{

bool isCallerOrigin = false;

origin.walkUpInlineStack(

[&] (CodeOrigin origin) {

BytecodeIndex bytecodeIndex = origin.bytecodeIndex();

InlineCallFrame* inlineCallFrame = origin.inlineCallFrame();

flushImpl(inlineCallFrame, addFlushDirect);

CodeBlock* codeBlock = m_graph.baselineCodeBlockFor(inlineCallFrame);

FullBytecodeLiveness& fullLiveness = m_graph.livenessFor(codeBlock);

// Note: We don't need to handle tmps here because tmps are not required to be flushed to the stack.

const auto& livenessAtBytecode = fullLiveness.getLiveness(bytecodeIndex, m_graph.appropriateLivenessCalculationPoint(origin, isCallerOrigin));

for (unsigned local = codeBlock->numCalleeLocals(); local--;) {

if (livenessAtBytecode[local])

addPhantomLocalDirect(inlineCallFrame, remapOperand(inlineCallFrame, virtualRegisterForLocal(local)));

}

if (bytecodeIndex.checkpoint()) {

ASSERT(codeBlock->numTmps());

auto liveTmps = tmpLivenessForCheckpoint(*codeBlock, bytecodeIndex);

liveTmps.forEachSetBit([&](size_t tmp) {

addPhantomLocalDirect(inlineCallFrame, remapOperand(inlineCallFrame, Operand::tmp(tmp)));

});

}

isCallerOrigin = true;

});

}

void flush(Operand operand)

{

flushDirect(m_inlineStackTop->remapOperand(operand));

}

void flushDirect(Operand operand)

{

flushDirect(operand, findArgumentPosition(operand));

}

void flushDirect(Operand operand, ArgumentPosition* argumentPosition)

{

addFlushOrPhantomLocal<Flush>(operand, argumentPosition);

}

template<NodeType nodeType>

void addFlushOrPhantomLocal(Operand operand, ArgumentPosition* argumentPosition)

{

ASSERT(!operand.isConstant());

Node*& node = m_currentBlock->variablesAtTail.operand(operand);

VariableAccessData* variable;

if (node)

variable = node->variableAccessData();

else

variable = newVariableAccessData(operand);

node = addToGraph(nodeType, OpInfo(variable));

if (argumentPosition)

argumentPosition->addVariable(variable);

}

void phantomLocalDirect(Operand operand)

{

addFlushOrPhantomLocal<PhantomLocal>(operand, findArgumentPosition(operand));

}

void flush(InlineStackEntry* inlineStackEntry)

{

auto addFlushDirect = [&] (InlineCallFrame*, Operand operand) { flushDirect(operand); };

flushImpl(inlineStackEntry->m_inlineCallFrame, addFlushDirect);

}

void flushForTerminal()

{

auto addFlushDirect = [&] (InlineCallFrame*, Operand operand) { flushDirect(operand); };

auto addPhantomLocalDirect = [&] (InlineCallFrame*, Operand operand) { phantomLocalDirect(operand); };

flushForTerminalImpl(currentCodeOrigin(), addFlushDirect, addPhantomLocalDirect);

}

void flushForReturn()

{

flush(m_inlineStackTop);

}

void flushIfTerminal(SwitchData& data)

{

if (data.fallThrough.bytecodeIndex() > m_currentIndex.offset())

return;

for (unsigned i = data.cases.size(); i--;) {

if (data.cases[i].target.bytecodeIndex() > m_currentIndex.offset())

return;

}

flushForTerminal();

}

Node* jsConstant(FrozenValue* constantValue)

{

return addToGraph(JSConstant, OpInfo(constantValue));

}

// Assumes that the constant should be strongly marked.

Node* jsConstant(JSValue constantValue)

{

return jsConstant(m_graph.freezeStrong(constantValue));

}

Node* weakJSConstant(JSValue constantValue)

{

return jsConstant(m_graph.freeze(constantValue));

}

// Helper functions to get/set the this value.

Node* getThis()

{

return get(m_inlineStackTop->m_codeBlock->thisRegister());

}

void setThis(Node* value)

{

set(m_inlineStackTop->m_codeBlock->thisRegister(), value);

}

InlineCallFrame* inlineCallFrame()

{

return m_inlineStackTop->m_inlineCallFrame;

}

bool allInlineFramesAreTailCalls()

{

return !inlineCallFrame() || !inlineCallFrame()->getCallerSkippingTailCalls();

}

CodeOrigin currentCodeOrigin()

{

return CodeOrigin(m_currentIndex, inlineCallFrame());

}

NodeOrigin currentNodeOrigin()

{

CodeOrigin semantic = m_currentSemanticOrigin.isSet() ? m_currentSemanticOrigin : currentCodeOrigin();

CodeOrigin forExit = m_currentExitOrigin.isSet() ? m_currentExitOrigin : currentCodeOrigin();

return NodeOrigin(semantic, forExit, m_exitOK);

}

BranchData* branchData(unsigned taken, unsigned notTaken)

{

// We assume that branches originating from bytecode always have a fall-through. We

// use this assumption to avoid checking for the creation of terminal blocks.

ASSERT((taken > m_currentIndex.offset()) || (notTaken > m_currentIndex.offset()));

BranchData* data = m_graph.m_branchData.add();

*data = BranchData::withBytecodeIndices(taken, notTaken);

return data;

}

Node* addToGraph(Node* node)

{

VERBOSE_LOG(" appended ", node, " ", Graph::opName(node->op()), "\n");

m_hasAnyForceOSRExits |= (node->op() == ForceOSRExit);

m_currentBlock->append(node);

if (clobbersExitState(m_graph, node))

m_exitOK = false;

return node;

}

Node* addToGraph(NodeType op, Node* child1 = nullptr, Node* child2 = nullptr, Node* child3 = nullptr)

{

Node* result = m_graph.addNode(

op, currentNodeOrigin(), Edge(child1), Edge(child2),

Edge(child3));

return addToGraph(result);

}

Node* addToGraph(NodeType op, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())

{

Node* result = m_graph.addNode(

op, currentNodeOrigin(), child1, child2, child3);

return addToGraph(result);

}

Node* addToGraph(NodeType op, OpInfo info, Node* child1 = nullptr, Node* child2 = nullptr, Node* child3 = nullptr)

{

Node* result = m_graph.addNode(

op, currentNodeOrigin(), info, Edge(child1), Edge(child2),

Edge(child3));

return addToGraph(result);

}

Node* addToGraph(NodeType op, OpInfo info, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())

{

Node* result = m_graph.addNode(op, currentNodeOrigin(), info, child1, child2, child3);

return addToGraph(result);

}

Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Node* child1 = nullptr, Node* child2 = nullptr, Node* child3 = nullptr)

{

Node* result = m_graph.addNode(

op, currentNodeOrigin(), info1, info2,

Edge(child1), Edge(child2), Edge(child3));

return addToGraph(result);

}

Node* addToGraph(NodeType op, Operand operand, Node* child1)

{

ASSERT(op == MovHint);

return addToGraph(op, OpInfo(operand.kind()), OpInfo(operand.value()), child1);

}

Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())

{

Node* result = m_graph.addNode(

op, currentNodeOrigin(), info1, info2, child1, child2, child3);

return addToGraph(result);

}

Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2 = OpInfo())

{

Node* result = m_graph.addNode(

Node::VarArg, op, currentNodeOrigin(), info1, info2,

m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs);

addToGraph(result);

m_numPassedVarArgs = 0;

return result;

}

void addVarArgChild(Node* child)

{

m_graph.m_varArgChildren.append(Edge(child));

m_numPassedVarArgs++;

}

void addVarArgChild(Edge child)

{

m_graph.m_varArgChildren.append(child);

m_numPassedVarArgs++;

}

Node* addCallWithoutSettingResult(

NodeType op, OpInfo opInfo, Node* callee, int argCount, int registerOffset,

OpInfo prediction, Node* thisValueForEval = nullptr, Node* scopeForEval = nullptr)

{

addVarArgChild(callee);

size_t parameterSlots = Graph::parameterSlotsForArgCount(argCount);

if (parameterSlots > m_parameterSlots)

m_parameterSlots = parameterSlots;

for (int i = 0; i < argCount; ++i)

addVarArgChild(get(virtualRegisterForArgumentIncludingThis(i, registerOffset)));

if (op == CallDirectEval) {

addVarArgChild(Edge(thisValueForEval));

addVarArgChild(Edge(scopeForEval, KnownCellUse));

}

return addToGraph(Node::VarArg, op, opInfo, prediction);

}

Node* addCall(

Operand result, NodeType op, OpInfo opInfo, Node* callee, int argCount, int registerOffset,

SpeculatedType prediction, Node* thisValueForEval = nullptr, Node* scopeForEval = nullptr)

{

if (op == TailCall) {

if (allInlineFramesAreTailCalls())

return addCallWithoutSettingResult(op, opInfo, callee, argCount, registerOffset, OpInfo());

op = TailCallInlinedCaller;

}

Node* call = addCallWithoutSettingResult(op, opInfo, callee, argCount, registerOffset, OpInfo(prediction), thisValueForEval, scopeForEval);

if (result.isValid())

set(result, call);

return call;

}

Node* cellConstantWithStructureCheck(JSCell* object, Structure* structure)

{

// FIXME: This should route to emitPropertyCheck, not the other way around. But currently,

// this gets no profit from using emitPropertyCheck() since we'll non-adaptively watch the

// object's structure as soon as we make it a weakJSCosntant.

Node* objectNode = weakJSConstant(object);

addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structure)), objectNode);

return objectNode;

}

SpeculatedType getPredictionWithoutOSRExit(BytecodeIndex bytecodeIndex)

{

auto getValueProfilePredictionFromForCodeBlockAndBytecodeOffset = [&] (CodeBlock* codeBlock, const CodeOrigin& codeOrigin)

{

SpeculatedType prediction;

{

ConcurrentJSLocker locker(codeBlock->m_lock);

prediction = codeBlock->valueProfilePredictionForBytecodeIndex(locker, codeOrigin.bytecodeIndex());

}

auto* fuzzerAgent = m_vm->fuzzerAgent();

if (UNLIKELY(fuzzerAgent))

return fuzzerAgent->getPrediction(codeBlock, codeOrigin, prediction) & SpecBytecodeTop;

return prediction;

};

SpeculatedType prediction = getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(m_inlineStackTop->m_profiledBlock, CodeOrigin(bytecodeIndex, inlineCallFrame()));

if (prediction != SpecNone)

return prediction;

// If we have no information about the values this

// node generates, we check if by any chance it is

// a tail call opcode. In that case, we walk up the

// inline frames to find a call higher in the call

// chain and use its prediction. If we only have

// inlined tail call frames, we use SpecFullTop

// to avoid a spurious OSR exit.

auto instruction = m_inlineStackTop->m_profiledBlock->instructions().at(bytecodeIndex.offset());

OpcodeID opcodeID = instruction->opcodeID();

switch (opcodeID) {

case op_tail_call:

case op_tail_call_varargs:

case op_tail_call_forward_arguments: {

// Things should be more permissive to us returning BOTTOM instead of TOP here.

// Currently, this will cause us to Force OSR exit. This is bad because returning

// TOP will cause anything that transitively touches this speculated type to

// also become TOP during prediction propagation.

// https://bugs.webkit.org/show_bug.cgi?id=164337

if (!inlineCallFrame())

return SpecFullTop;

CodeOrigin* codeOrigin = inlineCallFrame()->getCallerSkippingTailCalls();

if (!codeOrigin)

return SpecFullTop;

InlineStackEntry* stack = m_inlineStackTop;

while (stack->m_inlineCallFrame != codeOrigin->inlineCallFrame())

stack = stack->m_caller;

return getValueProfilePredictionFromForCodeBlockAndBytecodeOffset(stack->m_profiledBlock, *codeOrigin);

}

default:

return SpecNone;

}

RELEASE_ASSERT_NOT_REACHED();

return SpecNone;

}

SpeculatedType getPrediction(BytecodeIndex bytecodeIndex)

{

SpeculatedType prediction = getPredictionWithoutOSRExit(bytecodeIndex);

if (prediction == SpecNone) {

// We have no information about what values this node generates. Give up

// on executing this code, since we're likely to do more damage than good.

addToGraph(ForceOSRExit);

}

return prediction;

}

SpeculatedType getPredictionWithoutOSRExit()

{

return getPredictionWithoutOSRExit(m_currentIndex);

}

SpeculatedType getPrediction()

{

return getPrediction(m_currentIndex);

}

ArrayMode getArrayMode(Array::Action action)

{

CodeBlock* codeBlock = m_inlineStackTop->m_profiledBlock;

ConcurrentJSLocker locker(codeBlock->m_lock);

ArrayProfile* profile = codeBlock->getArrayProfile(locker, codeBlock->bytecodeIndex(m_currentInstruction));

return getArrayMode(locker, *profile, action);

}

ArrayMode getArrayMode(ArrayProfile& profile, Array::Action action)

{

ConcurrentJSLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);

return getArrayMode(locker, profile, action);

}

ArrayMode getArrayMode(const ConcurrentJSLocker& locker, ArrayProfile& profile, Array::Action action)