Attachment #273141 for bug #155094

View Details Raw Unified Return to Bug 155094

| Differences between

Lines 149-154 inline bool isStringSpeculation(Speculat Source/JavaScriptCore/bytecode/SpeculatedType.h_sec1
- Source/JavaScriptCore/bytecode/SpeculatedType.h +5 lines
149	return !!value && (value & SpecString) == value;	149	return !!value && (value & SpecString) == value;
150	}	150	}
151		151
		152	inline bool isStringOrOtherSpeculation(SpeculatedType value)
		153	{
		154	return !!value && (value & (SpecString \| SpecOther)) == value;
		155	}
		156
152	inline bool isSymbolSpeculation(SpeculatedType value)	157	inline bool isSymbolSpeculation(SpeculatedType value)
153	{	158	{
154	return value == SpecSymbol;	159	return value == SpecSymbol;

Lines 418-423 private: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec1
- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp +4 lines
418	fixEdge<DoubleRepUse>(node->child1());	418	fixEdge<DoubleRepUse>(node->child1());
419	else if (node->child1()->shouldSpeculateString())	419	else if (node->child1()->shouldSpeculateString())
420	fixEdge<StringUse>(node->child1());	420	fixEdge<StringUse>(node->child1());
		421	else if (node->child1()->shouldSpeculateStringOrOther())
		422	fixEdge<StringOrOtherUse>(node->child1());
421	break;	423	break;
422	}	424	}
423		425
Lines 921-926 private: Source/JavaScriptCore/dfg/DFGFixupPhase.cpp_sec2
921	fixEdge<DoubleRepUse>(node->child1());	923	fixEdge<DoubleRepUse>(node->child1());
922	else if (node->child1()->shouldSpeculateString())	924	else if (node->child1()->shouldSpeculateString())
923	fixEdge<StringUse>(node->child1());	925	fixEdge<StringUse>(node->child1());
		926	else if (node->child1()->shouldSpeculateStringOrOther())
		927	fixEdge<StringOrOtherUse>(node->child1());
924	break;	928	break;
925	}	929	}
926		930

Lines 1957-1962 struct Node { Source/JavaScriptCore/dfg/DFGNode.h_sec1
- Source/JavaScriptCore/dfg/DFGNode.h +5 lines
1957	return isStringSpeculation(prediction());	1957	return isStringSpeculation(prediction());
1958	}	1958	}
1959		1959
		1960	bool shouldSpeculateStringOrOther()
		1961	{
		1962	return isStringOrOtherSpeculation(prediction());
		1963	}
		1964
1960	bool shouldSpeculateStringObject()	1965	bool shouldSpeculateStringObject()
1961	{	1966	{
1962	return isStringObjectSpeculation(prediction());	1967	return isStringObjectSpeculation(prediction());

Lines 61-66 public: Source/JavaScriptCore/dfg/DFGSafeToExecute.h_sec1
- Source/JavaScriptCore/dfg/DFGSafeToExecute.h +1 lines
61	case ObjectOrOtherUse:	61	case ObjectOrOtherUse:
62	case StringIdentUse:	62	case StringIdentUse:
63	case StringUse:	63	case StringUse:
		64	case StringOrOtherUse:
64	case SymbolUse:	65	case SymbolUse:
65	case StringObjectUse:	66	case StringObjectUse:
66	case StringOrStringObjectUse:	67	case StringOrStringObjectUse:

Lines 1629-1634 void SpeculativeJIT::compileLogicalNot(N Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp +8 lines
1629	case StringUse:	1629	case StringUse:
1630	return compileStringZeroLength(node);	1630	return compileStringZeroLength(node);
1631		1631
		1632	case StringOrOtherUse:
		1633	return compileLogicalNotStringOrOther(node);
		1634
1632	default:	1635	default:
1633	RELEASE_ASSERT_NOT_REACHED();	1636	RELEASE_ASSERT_NOT_REACHED();
1634	break;	1637	break;
Lines 1719-1724 void SpeculativeJIT::emitBranch(Node* no Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp_sec2
1719	return;	1722	return;
1720	}	1723	}
1721		1724
		1725	case StringOrOtherUse: {
		1726	emitStringOrOtherBranch(node->child1(), taken, notTaken);
		1727	return;
		1728	}
		1729
1722	case DoubleRepUse:	1730	case DoubleRepUse:
1723	case Int32Use: {	1731	case Int32Use: {
1724	if (node->child1().useKind() == Int32Use) {	1732	if (node->child1().useKind() == Int32Use) {

Lines 1774-1779 void SpeculativeJIT::compileLogicalNot(N Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp +8 lines
1774	case StringUse:	1774	case StringUse:
1775	return compileStringZeroLength(node);	1775	return compileStringZeroLength(node);
1776		1776
		1777	case StringOrOtherUse:
		1778	return compileLogicalNotStringOrOther(node);
		1779
1777	default:	1780	default:
1778	DFG_CRASH(m_jit.graph(), node, "Bad use kind");	1781	DFG_CRASH(m_jit.graph(), node, "Bad use kind");
1779	break;	1782	break;
Lines 1875-1880 void SpeculativeJIT::emitBranch(Node* no Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp_sec2
1875	return;	1878	return;
1876	}	1879	}
1877		1880
		1881	case StringOrOtherUse: {
		1882	emitStringOrOtherBranch(node->child1(), taken, notTaken);
		1883	return;
		1884	}
		1885
1878	case UntypedUse:	1886	case UntypedUse:
1879	case BooleanUse:	1887	case BooleanUse:
1880	case KnownBooleanUse: {	1888	case KnownBooleanUse: {



    unblessedBooleanResult(eqGPR, node);
}

void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node)
{
    JSValueOperand value(this, node->child1());
    GPRTemporary temp(this);
    JSValueRegs valueRegs = value.jsValueRegs();
    GPRReg tempGPR = temp.gpr();

    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
    GPRReg cellGPR = valueRegs.payloadGPR();
    DFG_TYPE_CHECK(
        valueRegs, node->chuld1(), (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
    m_jit.test32(
        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
        JITCompiler::TrustedImm32(-1), tempGPR);
    JITCompiler::Jump done = m_jit.jump();
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        valueRegs, node->child1(), SpecCell | SpecOther, m_jit.branchIfNotOther(valueRets, tempGPR));
    m_jit.move(TrustedImm32(1), tempGPR);
    done.link(&m_jit);

    unblessedBooleanResult(tempGPR, node);
}

void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
{
    SpeculateCellOperand str(this, nodeUse);

    noResult(m_currentNode);
}

void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
{
    JSValueOperand value(this, nodeUse);
    GPRTemporary temp(this);
    JSValueRegs valueRegs = value.jsValueRegs();
    GPRReg tempGPR = temp.gpr();
    
    JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
    GPRReg cellGPR = valueRegs.payloadGPR();
    DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCell) | SpecString, m_jit.branchIfNotString(cellGPR));
    branchTest32(
        JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
        JITCompiler::TrustedImm32(-1), notTaken);
    jump(taken, ForceJump);
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        valueRegs, nodeUse, SpecCell | SpecOther, m_jit.branchIfNotOther(valueRets, tempGPR));
    jump(notTaken);
    noResult(m_currentNode);
}

void SpeculativeJIT::compileConstantStoragePointer(Node* node)
{
    GPRTemporary storage(this);

        operand.jsValueRegs(), edge, (~SpecCell) | SpecObject, m_jit.branchIfNotObject(gpr));
    MacroAssembler::Jump done = m_jit.jump();
    notCell.link(&m_jit);
    DFG_TYPE_CHECK(
        operand.jsValueRegs(), edge, SpecCell | SpecOther, m_jit.branchIfNotOther(regs, tempGPR));
            operand.jsValueRegs(), edge, SpecCell | SpecOther,
            m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
    }
    done.link(&m_jit);
}


        JSValueSource::unboxedCell(cell), edge, SpecString | ~SpecCell, m_jit.branchIfNotString(cell));
}

void SpeculativeJIT::speculateStringOrOther(Edge edge, JSValueRegs regs, GPRReg scratch)
{
    JITCompiler::Jump notCell = m_jit.branchIfNotCell(regs);
    GPRReg cell = regs.payloadGPR();
    DFG_TYPE_CHECK(regs, edge, (~SpecCell) | SpecString, m_jit.branchIfNotString(cell));
    JITCompiler::Jump done = m_jit.jump();
    DFG_TYPE_CHECK(regs, edge, SpecCell | SpecOther, m_jit.branchIfNotOther(regs, scratch));
    done.link(&m_jit);
}

void SpeculativeJIT::speculateStringOrOther(Edge edge)
{
    if (!needsTypeCheck(edge, SpecString | SpecOther))
        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);
    GPRTemporary temp(this);
    JSValueRegs regs = operand.jsValueRegs();
    GPRReg tempGPR = temp.gpr();
    speculateStringOrOther(edge, regs, tempGPR);
}

void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
{
    m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);

    case StringUse:
        speculateString(edge);
        break;
    case StringOrOtherUse:
        speculateStringOrOther(edge);
        break;
    case SymbolUse:
        speculateSymbol(edge);
        break;

Lines 2218-2223 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h +4 lines
2218	void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);	2218	void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
2219	void compileObjectOrOtherLogicalNot(Edge value);	2219	void compileObjectOrOtherLogicalNot(Edge value);
2220	void compileLogicalNot(Node*);	2220	void compileLogicalNot(Node*);
		2221	void compileLogicalNotStringOrOther(Node*);
2221	void compileStringEquality(	2222	void compileStringEquality(
2222	Node*, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR,	2223	Node*, GPRReg leftGPR, GPRReg rightGPR, GPRReg lengthGPR,
2223	GPRReg leftTempGPR, GPRReg rightTempGPR, GPRReg leftTemp2GPR,	2224	GPRReg leftTempGPR, GPRReg rightTempGPR, GPRReg leftTemp2GPR,
Lines 2237-2242 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec2
2237		2238
2238	void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);	2239	void emitObjectOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
2239	void emitStringBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);	2240	void emitStringBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
		2241	void emitStringOrOtherBranch(Edge value, BasicBlock* taken, BasicBlock* notTaken);
2240	void emitBranch(Node*);	2242	void emitBranch(Node*);
2241		2243
2242	struct StringSwitchCase {	2244	struct StringSwitchCase {
Lines 2552-2557 public: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h_sec3
2552	void speculateStringIdent(Edge edge, GPRReg string);	2554	void speculateStringIdent(Edge edge, GPRReg string);
2553	void speculateStringIdent(Edge);	2555	void speculateStringIdent(Edge);
2554	void speculateString(Edge);	2556	void speculateString(Edge);
		2557	void speculateStringOrOther(Edge, JSValueRegs, GPRReg scratch);
		2558	void speculateStringOrOther(Edge);
2555	void speculateNotStringVar(Edge);	2559	void speculateNotStringVar(Edge);
2556	template<typename StructureLocationType>	2560	template<typename StructureLocationType>
2557	void speculateStringObjectForStructure(Edge, StructureLocationType);	2561	void speculateStringObjectForStructure(Edge, StructureLocationType);

Lines 103-108 void printInternal(PrintStream& out, Use Source/JavaScriptCore/dfg/DFGUseKind.cpp_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.cpp +3 lines
103	case StringUse:	103	case StringUse:
104	out.print("String");	104	out.print("String");
105	return;	105	return;
		106	case StringOrOtherUse:
		107	out.print("StringOrOther");
		108	return;
106	case KnownStringUse:	109	case KnownStringUse:
107	out.print("KnownString");	110	out.print("KnownString");
108	return;	111	return;

Lines 59-64 enum UseKind { Source/JavaScriptCore/dfg/DFGUseKind.h_sec1
- Source/JavaScriptCore/dfg/DFGUseKind.h +3 lines
59	ObjectOrOtherUse,	59	ObjectOrOtherUse,
60	StringIdentUse,	60	StringIdentUse,
61	StringUse,	61	StringUse,
		62	StringOrOtherUse,
62	KnownStringUse,	63	KnownStringUse,
63	KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).	64	KnownPrimitiveUse, // This bizarre type arises for op_strcat, which has a bytecode guarantee that it will only see primitives (i.e. not objects).
64	SymbolUse,	65	SymbolUse,
Lines 127-132 inline SpeculatedType typeFilterFor(UseK Source/JavaScriptCore/dfg/DFGUseKind.h_sec2
127	case StringUse:	128	case StringUse:
128	case KnownStringUse:	129	case KnownStringUse:
129	return SpecString;	130	return SpecString;
		131	case StringOrOtherUse:
		132	return SpecString \| SpecOther;
130	case KnownPrimitiveUse:	133	case KnownPrimitiveUse:
131	return SpecHeapTop & ~SpecObject;	134	return SpecHeapTop & ~SpecObject;
132	case SymbolUse:	135	case SymbolUse:

Lines 462-467 CapabilityLevel canCompile(Graph& graph) Source/JavaScriptCore/ftl/FTLCapabilities.cpp_sec1
- Source/JavaScriptCore/ftl/FTLCapabilities.cpp +1 lines
462	case FunctionUse:	462	case FunctionUse:
463	case ObjectOrOtherUse:	463	case ObjectOrOtherUse:
464	case StringUse:	464	case StringUse:
		465	case StringOrOtherUse:
465	case KnownStringUse:	466	case KnownStringUse:
466	case KnownPrimitiveUse:	467	case KnownPrimitiveUse:
467	case StringObjectUse:	468	case StringObjectUse:



        // We use prologue frequency for all of the initialization code.
        m_out.setFrequency(1);
        
        m_prologue = m_out.newBlock();
        LBasicBlock stackOverflow = m_out.newBlock();
        m_handleExceptions = m_out.newBlock();
        
        LBasicBlock checkArguments = m_out.newBlock();

        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
            m_highBlock = m_graph.block(blockIndex);
            if (!m_highBlock)
                continue;
            m_out.setFrequency(m_highBlock->executionCount);
            m_blocks.add(m_highBlock, m_out.newBlock());
        }

        // Back to prologue frequency for any bocks that get sneakily created in the initialization code.

            
            LValue doubleValue = unboxDouble(value);
            
            LBasicBlock intCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock fastResult = m_out.anchor(doubleValue);
            m_out.branch(

            
            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);

            LBasicBlock intCase = m_out.newBlock();
            LBasicBlock doubleTesting = m_out.newBlock();
            LBasicBlock doubleCase = m_out.newBlock();
            LBasicBlock nonDoubleCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                isNotInt32(value, provenType(m_node->child1())),

            m_out.jump(continuation);

            if (shouldConvertNonNumber) {
                LBasicBlock undefinedCase = m_out.newBlock();
                LBasicBlock testNullCase = m_out.newBlock();
                LBasicBlock nullCase = m_out.newBlock();
                LBasicBlock testBooleanTrueCase = m_out.newBlock();
                LBasicBlock convertBooleanTrueCase = m_out.newBlock();
                LBasicBlock convertBooleanFalseCase = m_out.newBlock();

                m_out.appendTo(nonDoubleCase, undefinedCase);
                LValue valueIsUndefined = m_out.equal(value, m_out.constInt64(ValueUndefined));

                return;
            }
            
            LBasicBlock booleanCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock notBooleanResult = m_out.anchor(value);
            m_out.branch(

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            isCell(value, provenType(m_node->child1())), usually(isCellCase), rarely(slowCase));

            }
            
            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock slowCase = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                m_out.branch(
                    m_out.notZero32(result), usually(continuation), rarely(slowCase));

            blessSpeculation(result, Overflow, noValue(), nullptr, m_origin);

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock slowCase = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                m_out.branch(
                    m_out.notZero64(result), usually(continuation), rarely(slowCase));

            LValue denominator = lowInt32(m_node->child2());

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock zeroNumerator = m_out.newBlock();
                LBasicBlock numeratorContinuation = m_out.newBlock();

                m_out.branch(
                    m_out.isZero32(numerator),

            }
            
            if (shouldCheckOverflow(m_node->arithMode())) {
                LBasicBlock unsafeDenominator = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
                m_out.branch(


            LValue remainder;
            if (shouldCheckOverflow(m_node->arithMode())) {
                LBasicBlock unsafeDenominator = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
                m_out.branch(

                remainder = m_out.chillMod(numerator, denominator);

            if (shouldCheckNegativeZero(m_node->arithMode())) {
                LBasicBlock negativeNumerator = m_out.newBlock();
                LBasicBlock numeratorContinuation = m_out.newBlock();

                m_out.branch(
                    m_out.lessThan(numerator, m_out.int32Zero),

            LValue left = lowDouble(m_node->child1());
            LValue right = lowDouble(m_node->child2());
            
            LBasicBlock notLessThan = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            Vector<ValueFromBlock, 2> results;
            

            LValue base = lowDouble(m_node->child1());
            LValue exponent = lowDouble(m_node->child2());

            LBasicBlock integerExponentIsSmallBlock = m_out.newBlock();
            LBasicBlock integerExponentPowBlock = m_out.newBlock();
            LBasicBlock doubleExponentPowBlockEntry = m_out.newBlock();
            LBasicBlock nanExceptionExponentIsInfinity = m_out.newBlock();
            LBasicBlock nanExceptionBaseIsOne = m_out.newBlock();
            LBasicBlock powBlock = m_out.newBlock();
            LBasicBlock nanExceptionResultIsNaN = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue integerExponent = m_out.doubleToInt(exponent);
            LValue integerExponentConvertedToDouble = m_out.intToDouble(integerExponent);

            LValue value = lowDouble(m_node->child1());
            result = m_out.doubleFloor(m_out.doubleAdd(value, m_out.constDouble(0.5)));
        } else {
            LBasicBlock realPartIsMoreThanHalf = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue value = lowDouble(m_node->child1());
            LValue integerValue = m_out.doubleCeil(value);

        case CellOrOtherUse: {
            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);

            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(
                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));

        LValue cell = lowCell(m_node->child1());
        LValue property = !!m_node->child2() ? lowInt32(m_node->child2()) : 0;
        
        LBasicBlock unexpectedStructure = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
        

            // https://bugs.webkit.org/show_bug.cgi?id=127830
            LValue value = lowJSValue(m_node->child1());
            
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));

        LValue cell = lowCell(m_node->child1());
        
        if (m_node->arrayMode().type() == Array::String) {
            LBasicBlock slowPath = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            LValue fastResultValue = m_out.loadPtr(cell, m_heaps.JSString_value);
            ValueFromBlock fastResult = m_out.anchor(fastResultValue);

    {
        LValue basePtr = lowCell(m_node->child1());    

        LBasicBlock simpleCase = m_out.newBlock();
        LBasicBlock wastefulCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue mode = m_out.load32(basePtr, m_heaps.JSArrayBufferView_mode);
        m_out.branch(

            
            LValue base = lowCell(m_node->child1());
            
            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

            
            LValue base = lowCell(m_node->child1());
            
            LBasicBlock inBounds = m_out.newBlock();
            LBasicBlock boxPath = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

            LValue table = m_out.loadPtr(base, m_heaps.ScopedArguments_table);
            LValue namedLength = m_out.load32(table, m_heaps.ScopedArgumentsTable_length);
            
            LBasicBlock namedCase = m_out.newBlock();
            LBasicBlock overflowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(index, namedLength), unsure(overflowCase), unsure(namedCase));

        case Array::Int32:
        case Array::Double:
        case Array::Contiguous: {
            LBasicBlock continuation = m_out.newBlock();
            LBasicBlock outerLastNext = m_out.appendTo(m_out.m_block, continuation);
            
            switch (m_node->arrayMode().type()) {

                        if (isClamped(type)) {
                            ASSERT(elementSize(type) == 1);
                            
                            LBasicBlock atLeastZero = m_out.newBlock();
                            LBasicBlock continuation = m_out.newBlock();
                            
                            Vector<ValueFromBlock, 2> intValues;
                            intValues.append(m_out.anchor(m_out.int32Zero));

                        if (isClamped(type)) {
                            ASSERT(elementSize(type) == 1);
                            
                            LBasicBlock atLeastZero = m_out.newBlock();
                            LBasicBlock withinRange = m_out.newBlock();
                            LBasicBlock continuation = m_out.newBlock();
                            
                            Vector<ValueFromBlock, 3> intValues;
                            intValues.append(m_out.anchor(m_out.int32Zero));

                if (m_node->arrayMode().isInBounds() || m_node->op() == PutByValAlias)
                    m_out.store(valueToStore, pointer, storeType);
                else {
                    LBasicBlock isInBounds = m_out.newBlock();
                    LBasicBlock continuation = m_out.newBlock();
                    
                    m_out.branch(
                        m_out.aboveOrEqual(index, lowInt32(child5)),


            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
            
            LBasicBlock fastPath = m_out.newBlock();
            LBasicBlock slowPath = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(

        case Array::Contiguous: {
            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
            
            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
            

            return;
        }
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

            isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() :
            m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        
        unsigned minCapacity = m_graph.baselineCodeBlockFor(m_node->origin.semantic)->numParameters() - 1;
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        } else {
            LValue stackBase = getArgumentsStart();
            
            LBasicBlock loop = m_out.newBlock();
            LBasicBlock end = m_out.newBlock();

            ValueFromBlock originalLength;
            if (minCapacity) {


    void compileCopyRest()
    {            
        LBasicBlock doCopyRest = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue arrayLength = lowInt32(m_node->child2());



    void compileGetRestLength()
    {
        LBasicBlock nonZeroLength = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock zeroLengthResult = m_out.anchor(m_out.constInt32(0));


                || hasDouble(structure->indexingType())
                || hasContiguous(structure->indexingType()));

            LBasicBlock fastCase = m_out.newBlock();
            LBasicBlock largeCase = m_out.newBlock();
            LBasicBlock failCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)),

            m_out.store32(vectorLength, butterfly, m_heaps.Butterfly_vectorLength);
            
            if (hasDouble(m_node->indexingType())) {
                LBasicBlock initLoop = m_out.newBlock();
                LBasicBlock initDone = m_out.newBlock();
                
                ValueFromBlock originalIndex = m_out.anchor(vectorLength);
                ValueFromBlock originalPointer = m_out.anchor(butterfly);


            LValue size = lowInt32(m_node->child1());

            LBasicBlock smallEnoughCase = m_out.newBlock();
            LBasicBlock nonZeroCase = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(
                m_out.above(size, m_out.constInt32(JSArrayBufferView::fastSizeLimit)),

            LValue cell = lowCell(m_node->child1());
            LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
            
            LBasicBlock notString = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock simpleResult = m_out.anchor(cell);
            m_out.branch(

            else
                value = lowJSValue(m_node->child1());
            
            LBasicBlock isCell = m_out.newBlock();
            LBasicBlock notString = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            LValue isCellPredicate;
            if (m_node->child1().useKind() == CellUse)

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock isObjectCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 3> results;
        

            numKids = 2;
        }
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        LValue index = lowInt32(m_node->child2());
        LValue storage = lowStorage(m_node->child3());
            
        LBasicBlock fastPath = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
            
        m_out.branch(
            m_out.aboveOrEqual(

            
        LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
            
        LBasicBlock is8Bit = m_out.newBlock();
        LBasicBlock is16Bit = m_out.newBlock();
        LBasicBlock bitsContinuation = m_out.newBlock();
        LBasicBlock bigCharacter = m_out.newBlock();
            
        m_out.branch(
            m_out.testIsZero32(

                m_graph.watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
                m_graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
                
                LBasicBlock negativeIndex = m_out.newBlock();
                    
                results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
                m_out.branch(

    
    void compileStringCharCodeAt()
    {
        LBasicBlock is8Bit = m_out.newBlock();
        LBasicBlock is16Bit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue base = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());


        LValue value = lowInt32(childEdge);
        
        LBasicBlock smallIntCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            m_out.aboveOrEqual(value, m_out.constInt32(0xff)),

        
        Vector<LBasicBlock, 2> blocks(data.cases.size());
        for (unsigned i = data.cases.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock exit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<SwitchCase, 2> cases;
        StructureSet baseSet;

        
        Vector<LBasicBlock, 2> blocks(data.variants.size());
        for (unsigned i = data.variants.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock exit = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<SwitchCase, 2> cases;
        StructureSet baseSet;

    {
        WatchpointSet* set = m_node->watchpointSet();
        
        LBasicBlock isNotInvalidated = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue state = m_out.load8ZeroExt32(m_out.absolute(set->addressOfState()));
        m_out.branch(

            LValue left = lowCell(m_node->child1());
            LValue right = lowCell(m_node->child2());

            LBasicBlock notTriviallyEqualCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            speculateString(m_node->child1(), left);


            LValue left = lowStringIdent(leftEdge);
            LValue rightValue = lowJSValue(rightEdge, ManualOperandSpeculation);
            
            LBasicBlock isCellCase = m_out.newBlock();
            LBasicBlock isStringCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
            m_out.branch(

        LValue sourceStart = getArgumentsStart(inlineCallFrame);
        LValue targetStart = addressFor(data->machineStart).value();

        LBasicBlock undefinedLoop = m_out.newBlock();
        LBasicBlock mainLoopEntry = m_out.newBlock();
        LBasicBlock mainLoop = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue lengthAsPtr = m_out.zeroExtPtr(length);
        LValue loopBoundValue = m_out.constIntPtr(data->mandatoryMinimum);

        switch (data->kind) {
        case SwitchImm: {
            Vector<ValueFromBlock, 2> intValues;
            LBasicBlock switchOnInts = m_out.newBlock();
            
            LBasicBlock lastNext = m_out.appendTo(m_out.m_block, switchOnInts);
            

            }
                
            case UntypedUse: {
                LBasicBlock isInt = m_out.newBlock();
                LBasicBlock isNotInt = m_out.newBlock();
                LBasicBlock isDouble = m_out.newBlock();
                
                LValue boxedValue = lowJSValue(m_node->child1());
                m_out.branch(isNotInt32(boxedValue), unsure(isNotInt), unsure(isInt));

            case UntypedUse: {
                LValue unboxedValue = lowJSValue(m_node->child1());
                
                LBasicBlock isCellCase = m_out.newBlock();
                LBasicBlock isStringCase = m_out.newBlock();
                
                m_out.branch(
                    isNotCell(unboxedValue, provenType(m_node->child1())),

                break;
            }
            
            LBasicBlock lengthIs1 = m_out.newBlock();
            LBasicBlock needResolution = m_out.newBlock();
            LBasicBlock resolved = m_out.newBlock();
            LBasicBlock is8Bit = m_out.newBlock();
            LBasicBlock is16Bit = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            m_out.branch(
                m_out.notEqual(

            case UntypedUse: {
                LValue value = lowJSValue(m_node->child1());
                
                LBasicBlock isCellBlock = m_out.newBlock();
                LBasicBlock isStringBlock = m_out.newBlock();
                
                m_out.branch(
                    isCell(value, provenType(m_node->child1())),

                
            case UntypedUse: {
                LValue value = lowJSValue(m_node->child1());
                LBasicBlock cellCase = m_out.newBlock();
                m_out.branch(
                    isCell(value, provenType(m_node->child1())),
                    unsure(cellCase), unsure(lowBlock(data->fallThrough.block)));

    {
        LValue value = lowJSValue(m_node->child1());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

    {
        LValue value = lowJSValue(m_node->child1());

        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock objectCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
        

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
        m_out.branch(

        Edge child = m_node->child1();
        LValue value = lowJSValue(child);
        
        LBasicBlock continuation = m_out.newBlock();
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
        
        Vector<ValueFromBlock> results;

        LValue constructor = lowCell(m_node->child1());
        LValue hasInstance = lowJSValue(m_node->child2());

        LBasicBlock defaultHasInstance = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        // Unlike in the DFG, we don't worry about cleaning this code up for the case where we have proven the hasInstanceValue is a constant as B3 should fix it for us.


        
        LValue prototype = lowCell(m_node->child2());
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock loop = m_out.newBlock();
        LBasicBlock notYetInstance = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue condition;
        if (m_node->child1().useKind() == UntypedUse)

            IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
                m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;

            LBasicBlock checkHole = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            if (!m_node->arrayMode().isInBounds()) {
                m_out.branch(

            
            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
            
            LBasicBlock checkHole = m_out.newBlock();
            LBasicBlock slowCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            if (!m_node->arrayMode().isInBounds()) {
                m_out.branch(

        LValue property = lowString(m_node->child2());
        LValue enumerator = lowCell(m_node->child3());

        LBasicBlock correctStructure = m_out.newBlock();
        LBasicBlock wrongStructure = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.notEqual(
            m_out.load32(base, m_heaps.JSCell_structureID),

        LValue index = lowInt32(m_graph.varArgChild(m_node, 2));
        LValue enumerator = lowCell(m_graph.varArgChild(m_node, 3));

        LBasicBlock checkOffset = m_out.newBlock();
        LBasicBlock inlineLoad = m_out.newBlock();
        LBasicBlock outOfLineLoad = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.notEqual(
            m_out.load32(base, m_heaps.JSCell_structureID),

        LValue enumerator = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());

        LBasicBlock inBounds = m_out.newBlock();
        LBasicBlock outOfBounds = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endStructurePropertyIndex)),
            usually(inBounds), rarely(outOfBounds));

        LValue enumerator = lowCell(m_node->child1());
        LValue index = lowInt32(m_node->child2());

        LBasicBlock inBounds = m_out.newBlock();
        LBasicBlock outOfBounds = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endGenericPropertyIndex)),
            usually(inBounds), rarely(outOfBounds));

        
        Vector<LBasicBlock, 1> blocks(set.size());
        for (unsigned i = set.size(); i--;)
            blocks[i] = m_out.newBlock();
        LBasicBlock dummyDefault = m_out.newBlock();
        LBasicBlock outerContinuation = m_out.newBlock();
        
        Vector<SwitchCase, 1> cases(set.size());
        for (unsigned i = set.size(); i--;)

                size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
                MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
                
                LBasicBlock slowPath = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();
                
                LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
                

        ASSERT(table == m_graph.varArgChild(m_node, 0)->castConstant<SymbolTable*>());
        Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure();

        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);



    void compileCheckWatchdogTimer()
    {
        LBasicBlock timerDidFire = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue state = m_out.load8ZeroExt32(m_out.absolute(vm().watchdog()->timerDidFireAddress()));
        m_out.branch(m_out.isZero32(state),

            return;
        }
        
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
        for (unsigned i = 0; i < set.size() - 1; ++i) {
            LBasicBlock nextStructure = m_out.newBlock();
            m_out.branch(
                m_out.equal(structureDiscriminant, weakStructureDiscriminant(set[i])),
                unsure(continuation), unsure(nextStructure));

    
    LValue numberOrNotCellToInt32(Edge edge, LValue value)
    {
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock notIntCase = m_out.newBlock();
        LBasicBlock doubleCase = 0;
        LBasicBlock notNumberCase = 0;
        if (edge.useKind() == NotCellUse) {
            doubleCase = m_out.newBlock();
            notNumberCase = m_out.newBlock();
        }
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock> results;
        

            return;

        case InferredType::ObjectWithStructureOrOther: {
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));


            return;

        case InferredType::ObjectOrOther: {
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));


    
    LValue allocatePropertyStorageWithSizeImpl(size_t sizeInValues)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

        return copyBarrier(
            fastResultValue,
            [&] () -> LValue {
                LBasicBlock slowPath = m_out.newBlock();
                LBasicBlock continuation = m_out.newBlock();

                ValueFromBlock fastResult = m_out.anchor(fastResultValue);
                m_out.branch(isFastTypedArray(object), rarely(slowPath), usually(continuation));

    template<typename Functor>
    LValue copyBarrier(LValue pointer, const Functor& functor)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock fastResult = m_out.anchor(pointer);
        m_out.branch(isInToSpace(pointer), usually(continuation), rarely(slowPath));

    {
        LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);

        LBasicBlock possiblyFromSpace = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        ValueFromBlock fastResult = m_out.anchor(fastResultValue);


        
        speculateTruthyObject(rightChild, rightCell, SpecObject);
        
        LBasicBlock leftCellCase = m_out.newBlock();
        LBasicBlock leftNotCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            isCell(leftValue, provenType(leftChild)),

        LValue left = lowJSValue(m_node->child1());
        LValue right = lowJSValue(m_node->child2());
        
        LBasicBlock leftIsInt = m_out.newBlock();
        LBasicBlock fastPath = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotInt32(left), rarely(slowPath), usually(leftIsInt));
        


    LValue stringsEqual(LValue leftJSString, LValue rightJSString)
    {
        LBasicBlock notTriviallyUnequalCase = m_out.newBlock();
        LBasicBlock notEmptyCase = m_out.newBlock();
        LBasicBlock leftReadyCase = m_out.newBlock();
        LBasicBlock rightReadyCase = m_out.newBlock();
        LBasicBlock left8BitCase = m_out.newBlock();
        LBasicBlock right8BitCase = m_out.newBlock();
        LBasicBlock loop = m_out.newBlock();
        LBasicBlock bytesEqual = m_out.newBlock();
        LBasicBlock trueCase = m_out.newBlock();
        LBasicBlock falseCase = m_out.newBlock();
        LBasicBlock slowCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue length = m_out.load32(leftJSString, m_heaps.JSString_length);



    LValue allocateCell(LValue allocator, LBasicBlock slowPath)
    {
        LBasicBlock success = m_out.newBlock();
    
        LValue result;
        LValue condition;


        LValue subspace = m_out.constIntPtr(&vm().heap.subspaceForObjectOfType<ClassType>());
        
        LBasicBlock smallCaseBlock = m_out.newBlock();
        LBasicBlock largeOrOversizeCaseBlock = m_out.newBlock();
        LBasicBlock largeCaseBlock = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue uproundedSize = m_out.add(size, m_out.constInt32(MarkedSpace::preciseStep - 1));
        LValue isSmall = m_out.below(uproundedSize, m_out.constInt32(MarkedSpace::preciseCutoff));

    {
        CopiedAllocator& allocator = vm().heap.storageAllocator();
        
        LBasicBlock success = m_out.newBlock();
        
        LValue remaining = m_out.loadPtr(m_out.absolute(&allocator.m_currentRemaining));
        LValue newRemaining = m_out.sub(remaining, size);

        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
        MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
        
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

    
    ArrayValues allocateJSArray(Structure* structure, unsigned numElements)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
        

            LValue length = m_out.load32NonNegative(stringValue, m_heaps.JSString_length);
            return m_out.notEqual(length, m_out.int32Zero);
        }
        case StringOrOtherUse: {
            LValue value = lowJSValue(edge, ManualOperandSpeculation);

            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();

            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
            
            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
            
            FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));
            LValue length = m_out.load32NonNegative(value, m_heaps.JSString_length);
            ValueFromBlock cellResult = m_out.anchor(m_out.notEqual(length, m_out.int32Zero));
            m_out.jump(continuation);
            
            m_out.appendTo(notCellCase, continuation);
            
            FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanTrue);
            m_out.jump(continuation);
            m_out.appendTo(continuation, lastNext);

            return m_out.phi(Int32, cellResult, notCellResult);
        }
        case UntypedUse: {
            LValue value = lowJSValue(edge);
            

            //     result = value == jsTrue
            // }
            
            LBasicBlock cellCase = m_out.newBlock();
            LBasicBlock stringCase = m_out.newBlock();
            LBasicBlock notStringCase = m_out.newBlock();
            LBasicBlock notCellCase = m_out.newBlock();
            LBasicBlock int32Case = m_out.newBlock();
            LBasicBlock notInt32Case = m_out.newBlock();
            LBasicBlock doubleCase = m_out.newBlock();
            LBasicBlock notDoubleCase = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            
            Vector<ValueFromBlock> results;
            

            if (masqueradesAsUndefinedWatchpointIsStillValid())
                isTruthyObject = m_out.booleanTrue;
            else {
                LBasicBlock masqueradesCase = m_out.newBlock();
                
                results.append(m_out.anchor(m_out.booleanTrue));
                

        
        LValue value = lowJSValue(edge, operandMode);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock primitiveCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
        

            m_out.jump(continuation);
        } else {
            LBasicBlock masqueradesCase =
                m_out.newBlock();
                
            results.append(m_out.anchor(m_out.booleanFalse));
            

            index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength));
        if (!m_node->arrayMode().isInBounds()) {
            LBasicBlock notInBoundsCase =
                m_out.newBlock();
            LBasicBlock performStore =
                m_out.newBlock();
                
            m_out.branch(isNotInBounds, unsure(notInBoundsCase), unsure(performStore));
                

                speculate(OutOfBounds, noValue(), 0, isOutOfBounds);
            else {
                LBasicBlock outOfBoundsCase =
                    m_out.newBlock();
                LBasicBlock holeCase =
                    m_out.newBlock();
                    
                m_out.branch(isOutOfBounds, rarely(outOfBoundsCase), usually(holeCase));
                    

        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
        LValue length = m_out.load32(string, m_heaps.JSString_length);
        
        LBasicBlock hasImplBlock = m_out.newBlock();
        LBasicBlock is8BitBlock = m_out.newBlock();
        LBasicBlock slowBlock = m_out.newBlock();
        
        m_out.branch(m_out.isNull(stringImpl), unsure(slowBlock), unsure(hasImplBlock));
        

        
        Vector<LBasicBlock> characterBlocks;
        for (CharacterCase& myCase : characterCases)
            characterBlocks.append(m_out.newBlock());
        
        Vector<SwitchCase> switchCases;
        for (unsigned i = 0; i < characterCases.size(); ++i) {

    // contination and set it as the nextBlock (m_out.insertNewBlocksBefore(continuation)) before
    // calling this. For example:
    //
    // LBasicBlock continuation = m_out.newBlock();
    // LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
    // buildTypeOf(
    //     child, value,

        //     return undefined
        // }
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock objectCase = m_out.newBlock();
        LBasicBlock functionCase = m_out.newBlock();
        LBasicBlock notFunctionCase = m_out.newBlock();
        LBasicBlock reallyObjectCase = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock unreachable = m_out.newBlock();
        LBasicBlock notObjectCase = m_out.newBlock();
        LBasicBlock stringCase = m_out.newBlock();
        LBasicBlock symbolCase = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock numberCase = m_out.newBlock();
        LBasicBlock notNumberCase = m_out.newBlock();
        LBasicBlock notNullCase = m_out.newBlock();
        LBasicBlock booleanCase = m_out.newBlock();
        LBasicBlock undefinedCase = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
        

    
    LValue doubleToInt32(LValue doubleValue, double low, double high, bool isSigned = true)
    {
        LBasicBlock greatEnough = m_out.newBlock();
        LBasicBlock withinRange = m_out.newBlock();
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 2> results;
        

    
    LValue sensibleDoubleToInt32(LValue doubleValue)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        LValue fastResultValue = m_out.doubleToInt(doubleValue);
        ValueFromBlock fastResult = m_out.anchor(fastResultValue);

    
    LValue strictInt52ToJSValue(LValue value)
    {
        LBasicBlock isInt32 = m_out.newBlock();
        LBasicBlock isDouble = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        Vector<ValueFromBlock, 2> results;
            

    
    LValue jsValueToStrictInt52(Edge edge, LValue boxedValue)
    {
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock doubleCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
            
        LValue isNotInt32;
        if (!m_interpreter.needsTypeCheck(edge, SpecInt32))

        speculate(Overflow, FormattedValue(DataFormatDouble, value), m_node, valueNotConvertibleToInteger);

        if (shouldCheckNegativeZero) {
            LBasicBlock valueIsZero = m_out.newBlock();
            LBasicBlock continuation = m_out.newBlock();
            m_out.branch(m_out.isZero32(integerValue), unsure(valueIsZero), unsure(continuation));

            LBasicBlock lastNext = m_out.appendTo(valueIsZero, continuation);

        case StringUse:
            speculateString(edge);
            break;
        case StringOrOtherUse:
            speculateStringOrOther(edge);
            break;
        case StringIdentUse:
            speculateStringIdent(edge);
            break;

    {
        LValue value = lowJSValue(edge, ManualOperandSpeculation);

        LBasicBlock isNotCell = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(isCell(value, provenType(edge)), unsure(continuation), unsure(isNotCell));


        
        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock primitiveCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
        

        speculateString(edge, lowCell(edge));
    }
    
    void speculateStringOrOther(Edge edge, LValue value)
    {
        LBasicBlock cellCase = m_out.newBlock();
        LBasicBlock notCellCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));

        LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);

        FTL_TYPE_CHECK(jsValueValue(value), edge, (~SpecCell) | SpecString, isNotString(value));

        m_out.jump(continuation);
        m_out.appendTo(notCellCase, continuation);

        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));

        m_out.jump(continuation);
        m_out.appendTo(continuation, lastNext);
    }
    
    void speculateStringOrOther(Edge edge)
    {
        speculateStringOrOther(edge, lowJSValue(edge, ManualOperandSpeculation));
    }
    
    void speculateStringIdent(Edge edge, LValue string, LValue stringImpl)
    {
        if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString))

        if (!m_interpreter.needsTypeCheck(edge, SpecString | SpecStringObject))
            return;
        
        LBasicBlock notString = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        LValue structureID = m_out.load32(lowCell(edge), m_heaps.JSCell_structureID);
        m_out.branch(

        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        LValue doubleValue = unboxDouble(value);
        
        LBasicBlock intCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(
            m_out.doubleEqual(doubleValue, doubleValue),

        
        LValue value = lowJSValue(edge, ManualOperandSpeculation);
        
        LBasicBlock isCellCase = m_out.newBlock();
        LBasicBlock isStringCase = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();
        
        m_out.branch(isCell(value, provenType(edge)), unsure(isCellCase), unsure(continuation));
        


    void emitStoreBarrier(LValue base)
    {
        LBasicBlock slowPath = m_out.newBlock();
        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            m_out.notZero32(loadCellState(base)), usually(continuation), rarely(slowPath));

            return;
        }

        LBasicBlock continuation = m_out.newBlock();

        m_out.branch(
            hadException, rarely(m_handleExceptions), usually(continuation));

Lines 49-55 void Output::initialize(AbstractHeapRepo Source/JavaScriptCore/ftl/FTLOutput.cpp_sec1
- Source/JavaScriptCore/ftl/FTLOutput.cpp -1 / +1 lines
49	m_heaps = &heaps;	49	m_heaps = &heaps;
50	}	50	}
51		51
52	LBasicBlock Output::newBlock(const char*)	52	LBasicBlock Output::newBlock()
53	{	53	{
54	LBasicBlock result = m_proc.addBlock(m_frequency);	54	LBasicBlock result = m_proc.addBlock(m_frequency);
55		55



        m_frequency = value;
    }

    LBasicBlock newBlock();

    LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
    {

#pragma GCC diagnostic pop
#endif // COMPILER(GCC_OR_CLANG)

#define FTL_NEW_BLOCK(output, nameArguments) \
    (LIKELY(!verboseCompilationEnabled()) \
    ? (output).newBlock() \
    : (output).newBlock((toCString nameArguments).data()))

} } // namespace JSC::FTL

#endif // ENABLE(FTL_JIT)

Return to Bug 155094

Lines 5117-5122 void SpeculativeJIT::compileStringZeroLe Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec1
- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp -5 / +72 lines
5117	unblessedBooleanResult(eqGPR, node);	5117	unblessedBooleanResult(eqGPR, node);
5118	}	5118	}
5119		5119
		5120	void SpeculativeJIT::compileLogicalNotStringOrOther(Node* node)
		5121	{
		5122	JSValueOperand value(this, node->child1());
		5123	GPRTemporary temp(this);
		5124	JSValueRegs valueRegs = value.jsValueRegs();
		5125	GPRReg tempGPR = temp.gpr();
		5126
		5127	JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
		5128	GPRReg cellGPR = valueRegs.payloadGPR();
		5129	DFG_TYPE_CHECK(
		5130	valueRegs, node->chuld1(), (~SpecCell) \| SpecString, m_jit.branchIfNotString(cellGPR));
		5131	m_jit.test32(
		5132	JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
		5133	JITCompiler::TrustedImm32(-1), tempGPR);
		5134	JITCompiler::Jump done = m_jit.jump();
		5135	notCell.link(&m_jit);
		5136	DFG_TYPE_CHECK(
		5137	valueRegs, node->child1(), SpecCell \| SpecOther, m_jit.branchIfNotOther(valueRets, tempGPR));
		5138	m_jit.move(TrustedImm32(1), tempGPR);
		5139	done.link(&m_jit);
		5140
		5141	unblessedBooleanResult(tempGPR, node);
		5142	}
		5143
5120	void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)	5144	void SpeculativeJIT::emitStringBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
5121	{	5145	{
5122	SpeculateCellOperand str(this, nodeUse);	5146	SpeculateCellOperand str(this, nodeUse);
Lines 5126-5131 void SpeculativeJIT::emitStringBranch(Ed Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec2
5126	noResult(m_currentNode);	5150	noResult(m_currentNode);
5127	}	5151	}
5128		5152
		5153	void SpeculativeJIT::emitStringOrOtherBranch(Edge nodeUse, BasicBlock* taken, BasicBlock* notTaken)
		5154	{
		5155	JSValueOperand value(this, nodeUse);
		5156	GPRTemporary temp(this);
		5157	JSValueRegs valueRegs = value.jsValueRegs();
		5158	GPRReg tempGPR = temp.gpr();
		5159
		5160	JITCompiler::Jump notCell = m_jit.branchIfNotCell(valueRegs);
		5161	GPRReg cellGPR = valueRegs.payloadGPR();
		5162	DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCell) \| SpecString, m_jit.branchIfNotString(cellGPR));
		5163	branchTest32(
		5164	JITCompiler::Zero, JITCompiler::Address(cellGPR, JSString::offsetOfLength()),
		5165	JITCompiler::TrustedImm32(-1), notTaken);
		5166	jump(taken, ForceJump);
		5167	notCell.link(&m_jit);
		5168	DFG_TYPE_CHECK(
		5169	valueRegs, nodeUse, SpecCell \| SpecOther, m_jit.branchIfNotOther(valueRets, tempGPR));
		5170	jump(notTaken);
		5171	noResult(m_currentNode);
		5172	}
		5173
5129	void SpeculativeJIT::compileConstantStoragePointer(Node* node)	5174	void SpeculativeJIT::compileConstantStoragePointer(Node* node)
5130	{	5175	{
5131	GPRTemporary storage(this);	5176	GPRTemporary storage(this);
Lines 6651-6661 void SpeculativeJIT::speculateObjectOrOt Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec3
6651	operand.jsValueRegs(), edge, (~SpecCell) \| SpecObject, m_jit.branchIfNotObject(gpr));	6696	operand.jsValueRegs(), edge, (~SpecCell) \| SpecObject, m_jit.branchIfNotObject(gpr));
6652	MacroAssembler::Jump done = m_jit.jump();	6697	MacroAssembler::Jump done = m_jit.jump();
6653	notCell.link(&m_jit);	6698	notCell.link(&m_jit);
6654	if (needsTypeCheck(edge, SpecCell \| SpecOther)) {	6699	DFG_TYPE_CHECK(
6655	typeCheck(	6700	operand.jsValueRegs(), edge, SpecCell \| SpecOther, m_jit.branchIfNotOther(regs, tempGPR));
6656	operand.jsValueRegs(), edge, SpecCell \| SpecOther,
6657	m_jit.branchIfNotOther(operand.jsValueRegs(), tempGPR));
6658	}
6659	done.link(&m_jit);	6701	done.link(&m_jit);
6660	}	6702	}
6661		6703
Lines 6665-6670 void SpeculativeJIT::speculateString(Edg Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec4
6665	JSValueSource::unboxedCell(cell), edge, SpecString \| ~SpecCell, m_jit.branchIfNotString(cell));	6707	JSValueSource::unboxedCell(cell), edge, SpecString \| ~SpecCell, m_jit.branchIfNotString(cell));
6666	}	6708	}
6667		6709
		6710	void SpeculativeJIT::speculateStringOrOther(Edge edge, JSValueRegs regs, GPRReg scratch)
		6711	{
		6712	JITCompiler::Jump notCell = m_jit.branchIfNotCell(regs);
		6713	GPRReg cell = regs.payloadGPR();
		6714	DFG_TYPE_CHECK(regs, edge, (~SpecCell) \| SpecString, m_jit.branchIfNotString(cell));
		6715	JITCompiler::Jump done = m_jit.jump();
		6716	DFG_TYPE_CHECK(regs, edge, SpecCell \| SpecOther, m_jit.branchIfNotOther(regs, scratch));
		6717	done.link(&m_jit);
		6718	}
		6719
		6720	void SpeculativeJIT::speculateStringOrOther(Edge edge)
		6721	{
		6722	if (!needsTypeCheck(edge, SpecString \| SpecOther))
		6723	return;
		6724
		6725	JSValueOperand operand(this, edge, ManualOperandSpeculation);
		6726	GPRTemporary temp(this);
		6727	JSValueRegs regs = operand.jsValueRegs();
		6728	GPRReg tempGPR = temp.gpr();
		6729	speculateStringOrOther(edge, regs, tempGPR);
		6730	}
		6731
6668	void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)	6732	void SpeculativeJIT::speculateStringIdentAndLoadStorage(Edge edge, GPRReg string, GPRReg storage)
6669	{	6733	{
6670	m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);	6734	m_jit.loadPtr(MacroAssembler::Address(string, JSString::offsetOfValue()), storage);
Lines 6912-6917 void SpeculativeJIT::speculate(Node*, Ed Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp_sec5
6912	case StringUse:	6976	case StringUse:
6913	speculateString(edge);	6977	speculateString(edge);
6914	break;	6978	break;
		6979	case StringOrOtherUse:
		6980	speculateStringOrOther(edge);
		6981	break;
6915	case SymbolUse:	6982	case SymbolUse:
6916	speculateSymbol(edge);	6983	speculateSymbol(edge);
6917	break;	6984	break;

Lines 82-88 public: Source/JavaScriptCore/ftl/FTLOutput.h_sec1
- Source/JavaScriptCore/ftl/FTLOutput.h -6 / +1 lines
82	m_frequency = value;	82	m_frequency = value;
83	}	83	}
84		84
85	LBasicBlock newBlock(const char* name = "");	85	LBasicBlock newBlock();
86		86
87	LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)	87	LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
88	{	88	{
Lines 524-534 inline LValue Output::fround(LValue doub Source/JavaScriptCore/ftl/FTLOutput.h_sec2
524	#pragma GCC diagnostic pop	524	#pragma GCC diagnostic pop
525	#endif // COMPILER(GCC_OR_CLANG)	525	#endif // COMPILER(GCC_OR_CLANG)
526		526
527	#define FTL_NEW_BLOCK(output, nameArguments) \
528	(LIKELY(!verboseCompilationEnabled()) \
529	? (output).newBlock() \
530	: (output).newBlock((toCString nameArguments).data()))
531
532	} } // namespace JSC::FTL	527	} } // namespace JSC::FTL
533		528
534	#endif // ENABLE(FTL_JIT)	529	#endif // ENABLE(FTL_JIT)