DFGAbstractState.cpp

@@AbstractState::BooleanResult AbstractSta

    return UnknownBooleanResult;

}

237 bool AbstractState::execut~~e(unsigned~~ in~~dexInBlock~~)

237bool AbstractState::startExecuting(Node* node)

{

    ASSERT(m_block);

    ASSERT(m_isValid);

    m_didClobber = false;

244 Node* node ~~= m_block~~->a~~t(indexInBlock~~);

245

244 node->setCanExit(false);

245

246246 if (!node->shouldGenerate())

247 return true;

248

        return false;

    return true;

}

bool AbstractState::startExecuting(unsigned indexInBlock)

{

    return startExecuting(m_block->at(indexInBlock));

}

void AbstractState::executeEdges(Node* node)

{

    DFG_NODE_DO_TO_CHILDREN(m_graph, node, filterEdgeByUse);

}

void AbstractState::executeEdges(unsigned indexInBlock)

{

    executeEdges(m_block->at(indexInBlock));

}

void AbstractState::verifyEdge(Node*, Edge edge)

{

    RELEASE_ASSERT(!(forNode(edge).m_type & ~typeFilterFor(edge.useKind())));

}

void AbstractState::verifyEdges(Node* node)

{

    DFG_NODE_DO_TO_CHILDREN(m_graph, node, verifyEdge);

}

bool AbstractState::executeEffects(unsigned indexInBlock, Node* node)

{

    if (!ASSERT_DISABLED)

        verifyEdges(node);

    switch (node->op()) {

    case JSConstant:

    case WeakJSConstant:

    case PhantomArguments: {

        forNode(node).set(m_graph.valueOfJSConstant(node));

254 node->setCanExit(false);

        break;

    }

    case Identity: {

        forNode(node) = forNode(node->child1());

260 node->setCanExit(false);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        VariableAccessData* variableAccessData = node->variableAccessData();

        if (variableAccessData->prediction() == SpecNone) {

            m_isValid = false;

268 node->setCanExit(true);

269299 break;

270300 }

271 bool canExit = false;

        AbstractValue value = m_variables.operand(variableAccessData->local());

        if (!variableAccessData->isCaptured()) {

            if (value.isClear())

275 canExit |= true;

304 node->setCanExit(true);

        }

        if (value.value())

            m_foundConstants = true;

        forNode(node) = value;

280 node->setCanExit(canExit);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (value.value())

            m_foundConstants = true;

        forNode(node) = value;

289 node->setCanExit(false);

        break;

    }

    case SetLocal: {

        if (node->variableAccessData()->isCaptured()

            || m_graph.isCreatedThisArgument(node->local())) {

            m_variables.operand(node->local()) = forNode(node->child1());

            node->setCanExit(false);

            break;

        }

        if (node->variableAccessData()->shouldUseDoubleFormat()) {

            speculateNumberUnary(node);

            m_variables.operand(node->local()).set(SpecDouble);

            break;

        }

        SpeculatedType predictedType = node->variableAccessData()->argumentAwarePrediction();

        if (isInt32Speculation(predictedType))

            speculateInt32Unary(node);

        else if (isCellSpeculation(predictedType)) {

            node->setCanExit(!isCellSpeculation(forNode(node->child1()).m_type));

            forNode(node->child1()).filter(SpecCell);

        } else if (isBooleanSpeculation(predictedType))

            speculateBooleanUnary(node);

        else

            node->setCanExit(false);

        m_variables.operand(node->local()) = forNode(node->child1());

        break;

    }

@@bool AbstractState::execute(unsigned ind

    case SetArgument:

        // Assert that the state of arguments has been set.

        ASSERT(!m_block->valuesAtHead.operand(node->local()).isClear());

325 node->setCanExit(false);

        break;

    case BitAnd:

@@bool AbstractState::execute(unsigned ind

            }

            if (constantWasSet) {

                m_foundConstants = true;

365 node->setCanExit(false);

369 speculateInt32Binary(node);

        forNode(node).set(SpecInt32);

        break;

    }

@@bool AbstractState::execute(unsigned ind

            ASSERT(child.isInt32());

            if (trySetConstant(node, JSValue(child.asUInt32()))) {

                m_foundConstants = true;

380 node->setCanExit(false);

384 if (!node->canSpeculateInteger()) {

383 if (!node->canSpeculateInteger())

385384 forNode(node).set(SpecDouble);

386 node->setCanExit(false);

387 } else {

385 else {

            forNode(node).set(SpecInt32);

            node->setCanExit(true);

        }

        break;

    }

393

            
    case DoubleAsInt32: {

        JSValue child = forNode(node->child1()).value();

@@bool AbstractState::execute(unsigned ind

            }

        }

        node->setCanExit(true);

407 forNode(node->child1()).filter(SpecNumber);

        forNode(node).set(SpecInt32);

        break;

    }

@@bool AbstractState::execute(unsigned ind

                constantWasSet = trySetConstant(node, JSValue(JSC::toInt32(child.asDouble())));

            if (constantWasSet) {

                m_foundConstants = true;

422 node->setCanExit(false);

        if (node->child1()->shouldSpeculateInteger())

            speculateInt32Unary(node);

        else if (node->child1()->shouldSpeculateBoolean())

            speculateBooleanUnary(node);

        else if (node->child1()->shouldSpeculateNumber())

            speculateNumberUnary(node);

        else {

            node->setCanExit(forNode(node->child1()).m_type & SpecCell);

            forNode(node->child1()).filter(~SpecCell);

        }

        
        forNode(node).set(SpecInt32);

        break;

@@bool AbstractState::execute(unsigned ind

        if (child && child.isNumber()

            && trySetConstant(node, JSValue(JSValue::EncodeAsDouble, child.asNumber()))) {

            m_foundConstants = true;

447 node->setCanExit(false);

448432 break;

449433 }

450 speculateNumberUnary(node);

        if (isInt32Speculation(forNode(node->child1()).m_type))

            forNode(node).set(SpecDoubleReal);

        else

@@bool AbstractState::execute(unsigned ind

        break;

    }

    case CheckNumber:

        forNode(node->child1()).filter(SpecNumber);

        break;

    case ValueAdd:

    case ArithAdd: {

        JSValue left = forNode(node->child1()).value();

@@bool AbstractState::execute(unsigned ind

        if (left && right && left.isNumber() && right.isNumber()

            && trySetConstant(node, JSValue(left.asNumber() + right.asNumber()))) {

            m_foundConstants = true;

469 node->setCanExit(false);

470448 break;

471449 }

        if (m_graph.addShouldSpeculateInteger(node)) {

            speculateInt32Binary(

                node, !nodeCanTruncateInteger(node->arithNodeFlags()));

450 switch (node->binaryUseKind()) {

451 case Int32Use:

475452 forNode(node).set(SpecInt32);

453 if (!nodeCanTruncateInteger(node->arithNodeFlags()))

454 node->setCanExit(true);

476455 break;

        }

        if (Node::shouldSpeculateNumberExpectingDefined(node->child1().node(), node->child2().node())) {

            speculateNumberBinary(node);

456 case NumberUse:

            if (isRealNumberSpeculation(forNode(node->child1()).m_type)

                && isRealNumberSpeculation(forNode(node->child2()).m_type))

                forNode(node).set(SpecDoubleReal);

            else

                forNode(node).set(SpecDouble);

            break;

486 }

487 if (node->op() == ValueAdd) {

463 default:

464 RELEASE_ASSERT(node->op() == ValueAdd);

488465 clobberWorld(node->codeOrigin, indexInBlock);

489466 forNode(node).set(SpecString | SpecInt32 | SpecNumber);

490 node->setCanExit(false);

491467 break;

492468 }

        // We don't handle this yet. :-(

        m_isValid = false;

        node->setCanExit(true);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (left && right && left.isNumber() && right.isNumber()

            && trySetConstant(node, JSValue(left.asNumber() - right.asNumber()))) {

            m_foundConstants = true;

505 node->setCanExit(false);

506478 break;

507479 }

        if (m_graph.addShouldSpeculateInteger(node)) {

            speculateInt32Binary(

                node, !nodeCanTruncateInteger(node->arithNodeFlags()));

480 switch (node->binaryUseKind()) {

481 case Int32Use:

511482 forNode(node).set(SpecInt32);

            if (!nodeCanTruncateInteger(node->arithNodeFlags()))

                node->setCanExit(true);

            break;

        case NumberUse:

            forNode(node).set(SpecDouble);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

512491 break;

513492 }

514 speculateNumberBinary(node);

515 forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (child && child.isNumber()

            && trySetConstant(node, JSValue(-child.asNumber()))) {

            m_foundConstants = true;

524 node->setCanExit(false);

525501 break;

526502 }

        if (m_graph.negateShouldSpeculateInteger(node)) {

            speculateInt32Unary(

                node, !nodeCanTruncateInteger(node->arithNodeFlags()));

503 switch (node->child1().useKind()) {

504 case Int32Use:

530505 forNode(node).set(SpecInt32);

            if (!nodeCanTruncateInteger(node->arithNodeFlags()))

                node->setCanExit(true);

            break;

        case NumberUse:

            forNode(node).set(SpecDouble);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

531514 break;

532515 }

533 speculateNumberUnary(node);

534 forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (left && right && left.isNumber() && right.isNumber()

            && trySetConstant(node, JSValue(left.asNumber() * right.asNumber()))) {

            m_foundConstants = true;

544 node->setCanExit(false);

545525 break;

546526 }

        if (m_graph.mulShouldSpeculateInteger(node)) {

            speculateInt32Binary(

                node,

                !nodeCanTruncateInteger(node->arithNodeFlags())

                || !nodeCanIgnoreNegativeZero(node->arithNodeFlags()));

527 switch (node->binaryUseKind()) {

528 case Int32Use:

552529 forNode(node).set(SpecInt32);

            if (!nodeCanTruncateInteger(node->arithNodeFlags())

                || !nodeCanIgnoreNegativeZero(node->arithNodeFlags()))

                node->setCanExit(true);

            break;

        case NumberUse:

            if (isRealNumberSpeculation(forNode(node->child1()).m_type)

                || isRealNumberSpeculation(forNode(node->child2()).m_type))

                forNode(node).set(SpecDoubleReal);

            else

                forNode(node).set(SpecDouble);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

553543 break;

554544 }

        speculateNumberBinary(node);

        if (isRealNumberSpeculation(forNode(node->child1()).m_type)

            || isRealNumberSpeculation(forNode(node->child2()).m_type))

            forNode(node).set(SpecDoubleReal);

        else

            forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

            }

            if (constantWasSet) {

                m_foundConstants = true;

594 node->setCanExit(false);

        if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())

            && node->canSpeculateInteger()) {

            speculateInt32Binary(node, true); // forcing can-exit, which is a bit on the conservative side.

581 switch (node->binaryUseKind()) {

582 case Int32Use:

601583 forNode(node).set(SpecInt32);

            node->setCanExit(true);

            break;

        case NumberUse:

            forNode(node).set(SpecDouble);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

602591 break;

603592 }

604 speculateNumberBinary(node);

605 forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (child && child.isNumber()

            && trySetConstant(node, JSValue(fabs(child.asNumber())))) {

            m_foundConstants = true;

614 node->setCanExit(false);

615601 break;

616602 }

        if (node->child1()->shouldSpeculateIntegerForArithmetic()

            && node->canSpeculateInteger()) {

            speculateInt32Unary(node, true);

603 switch (node->child1().useKind()) {

604 case Int32Use:

620605 forNode(node).set(SpecInt32);

            node->setCanExit(true);

            break;

        case NumberUse:

            forNode(node).set(SpecDouble);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

621613 break;

622614 }

623 speculateNumberUnary(node);

624 forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (child && child.isNumber()

            && trySetConstant(node, JSValue(sqrt(child.asNumber())))) {

            m_foundConstants = true;

633 node->setCanExit(false);

634623 break;

635624 }

636 speculateNumberUnary(node);

        forNode(node).set(SpecDouble);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        }

        if (didSetConstant) {

            m_foundConstants = true;

655 node->setCanExit(false);

656643 break;

657644 }

        Node* child = node->child1().node();

        if (isBooleanSpeculation(child->prediction()))

            speculateBooleanUnary(node);

        else if (child->shouldSpeculateObjectOrOther()) {

        switch (node->child1().useKind()) {

        case BooleanUse:

        case Int32Use:

        case NumberUse:

        case UntypedUse:

            break;

        case ObjectOrOtherUse:

662652 node->setCanExit(true);

            forNode(child).filter((SpecCell & ~SpecString) | SpecOther);

        } else if (child->shouldSpeculateInteger())

            speculateInt32Unary(node);

        else if (child->shouldSpeculateNumber())

            speculateNumberUnary(node);

        else

            node->setCanExit(false);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        forNode(node).set(SpecBoolean);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        
        Node* childNode = node->child1().node();

        if (isCellSpeculation(childNode->prediction())) {

            if (isStringSpeculation(childNode->prediction()))

                forNode(childNode).filter(SpecString);

            else

                forNode(childNode).filter(SpecCell);

        switch (node->child1().useKind()) {

        case StringUse:

        case CellUse:

774759 node->setCanExit(true);

            break;

        case UntypedUse:

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        forNode(node).set(SpecString);

        break;

@@bool AbstractState::execute(unsigned ind

        
        if (constantWasSet) {

            m_foundConstants = true;

826 node->setCanExit(false);

            break;

        }

        forNode(node).set(SpecBoolean);

        if (node->op() == CompareEqConstant) {

            // We can exit if we haven't fired the MasqueradesAsUndefind watchpoint yet.

            node->setCanExit(m_codeBlock->globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid());

            break;

        }

        Node* left = node->child1().node();

        Node* right = node->child2().node();

        SpeculatedType filter;

        SpeculatedTypeChecker checker;

        if (Node::shouldSpeculateInteger(left, right)) {

            filter = SpecInt32;

            checker = isInt32Speculation;

        } else if (Node::shouldSpeculateNumber(left, right)) {

            filter = SpecNumber;

            checker = isNumberSpeculation;

        } else if (node->op() == CompareEq) {

            if (left->shouldSpeculateString() || right->shouldSpeculateString()) {

                node->setCanExit(false);

                break;

            } 

            if (left->shouldSpeculateObject() && right->shouldSpeculateObject()) {

                node->setCanExit(true);

                forNode(left).filter(SpecObject);

                forNode(right).filter(SpecObject);

                break;

            }

            if (left->shouldSpeculateObject() && right->shouldSpeculateObjectOrOther()) {

                node->setCanExit(true);

                forNode(left).filter(SpecObject);

                forNode(right).filter(SpecObject | SpecOther);

                break;

            }

            if (left->shouldSpeculateObjectOrOther() && right->shouldSpeculateObject()) {

                node->setCanExit(true);

                forNode(left).filter(SpecObject | SpecOther);

                forNode(right).filter(SpecObject);

                break;

            }

            filter = SpecTop;

            checker = isAnySpeculation;

            clobberWorld(node->codeOrigin, indexInBlock);

        } else {

            filter = SpecTop;

            checker = isAnySpeculation;

            clobberWorld(node->codeOrigin, indexInBlock);

        }

        node->setCanExit(

            !checker(forNode(left).m_type)

            || !checker(forNode(right).m_type));

        forNode(left).filter(filter);

        forNode(right).filter(filter);

        // This is overly conservative. But the only thing this prevents is store elimination,

        // and how likely is it, really, that you'll have redundant stores across a comparison

        // operation? Comparison operations are typically at the end of basic blocks, so

        // unless we have global store elimination (super unlikely given how unprofitable that

        // optimization is to begin with), you aren't going to be wanting to store eliminate

        // across an equality op.

        node->setCanExit(true);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (left && right && left.isNumber() && right.isNumber()

            && trySetConstant(node, jsBoolean(left.asNumber() == right.asNumber()))) {

            m_foundConstants = true;

897 node->setCanExit(false);

            break;

        }

        forNode(node).set(SpecBoolean);

        if (node->op() == CompareStrictEqConstant) {

            node->setCanExit(false);

            break;

        }

        if (Node::shouldSpeculateInteger(leftNode, rightNode)) {

            speculateInt32Binary(node);

            break;

        }

        if (Node::shouldSpeculateNumber(leftNode, rightNode)) {

            speculateNumberBinary(node);

            break;

        }

        if (leftNode->shouldSpeculateString() || rightNode->shouldSpeculateString()) {

            node->setCanExit(false);

            break;

        }

        if (leftNode->shouldSpeculateObject() && rightNode->shouldSpeculateObject()) {

            node->setCanExit(true);

            forNode(leftNode).filter(SpecObject);

            forNode(rightNode).filter(SpecObject);

            break;

        }

        node->setCanExit(false);

844 node->setCanExit(true); // This is overly conservative.

        break;

    }

    case StringCharCodeAt:

        node->setCanExit(true);

929 forNode(node->child1()).filter(SpecString);

930 forNode(node->child2()).filter(SpecInt32);

        forNode(node).set(SpecInt32);

        break;

    case StringCharAt:

        node->setCanExit(true);

936 forNode(node->child1()).filter(SpecString);

937 forNode(node->child2()).filter(SpecInt32);

        forNode(node).set(SpecString);

        break;

@@bool AbstractState::execute(unsigned ind

            forNode(node).makeTop();

            break;

        case Array::String:

957 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecString);

            break;

        case Array::Arguments:

961 forNode(node->child2()).filter(SpecInt32);

            forNode(node).makeTop();

            break;

        case Array::Int32:

965 forNode(node->child2()).filter(SpecInt32);

            if (node->arrayMode().isOutOfBounds()) {

                clobberWorld(node->codeOrigin, indexInBlock);

                forNode(node).makeTop();

@@bool AbstractState::execute(unsigned ind

                forNode(node).set(SpecInt32);

            break;

        case Array::Double:

973 forNode(node->child2()).filter(SpecInt32);

            if (node->arrayMode().isOutOfBounds()) {

                clobberWorld(node->codeOrigin, indexInBlock);

                forNode(node).makeTop();

@@bool AbstractState::execute(unsigned ind

        case Array::Contiguous:

        case Array::ArrayStorage:

        case Array::SlowPutArrayStorage:

985 forNode(node->child2()).filter(SpecInt32);

            if (node->arrayMode().isOutOfBounds())

                clobberWorld(node->codeOrigin, indexInBlock);

            forNode(node).makeTop();

            break;

        case Array::Int8Array:

991 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Int16Array:

995 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Int32Array:

999 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Uint8Array:

1003 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Uint8ClampedArray:

1007 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Uint16Array:

1011 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecInt32);

            break;

        case Array::Uint32Array:

1015 forNode(node->child2()).filter(SpecInt32);

            if (node->shouldSpeculateInteger())

                forNode(node).set(SpecInt32);

            else

                forNode(node).set(SpecDouble);

            break;

        case Array::Float32Array:

1022 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecDouble);

            break;

        case Array::Float64Array:

1026 forNode(node->child2()).filter(SpecInt32);

            forNode(node).set(SpecDouble);

            break;

        default:

@@bool AbstractState::execute(unsigned ind

    case PutByVal:

    case PutByValAlias: {

        node->setCanExit(true);

        Edge child1 = m_graph.varArgChild(node, 0);

        Edge child2 = m_graph.varArgChild(node, 1);

        Edge child3 = m_graph.varArgChild(node, 2);

        switch (node->arrayMode().modeForPut().type()) {

        case Array::ForceExit:

            m_isValid = false;

@@bool AbstractState::execute(unsigned ind

            clobberWorld(node->codeOrigin, indexInBlock);

            break;

        case Array::Int32:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            forNode(child3).filter(SpecInt32);

            if (node->arrayMode().isOutOfBounds())

                clobberWorld(node->codeOrigin, indexInBlock);

            break;

        case Array::Double:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            forNode(child3).filter(SpecRealNumber);

            if (node->arrayMode().isOutOfBounds())

                clobberWorld(node->codeOrigin, indexInBlock);

            break;

        case Array::Contiguous:

        case Array::ArrayStorage:

1065 forNode(child1).filter(SpecCell);

1066 forNode(child2).filter(SpecInt32);

            if (node->arrayMode().isOutOfBounds())

                clobberWorld(node->codeOrigin, indexInBlock);

            break;

        case Array::SlowPutArrayStorage:

1071 forNode(child1).filter(SpecCell);

1072 forNode(child2).filter(SpecInt32);

            if (node->arrayMode().mayStoreToHole())

                clobberWorld(node->codeOrigin, indexInBlock);

            break;

        case Array::Arguments:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            break;

        case Array::Int8Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Int16Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Int32Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Uint8Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Uint8ClampedArray:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Uint16Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Uint32Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            if (child3->shouldSpeculateInteger())

                forNode(child3).filter(SpecInt32);

            else

                forNode(child3).filter(SpecNumber);

            break;

        case Array::Float32Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            forNode(child3).filter(SpecNumber);

            break;

        case Array::Float64Array:

            forNode(child1).filter(SpecCell);

            forNode(child2).filter(SpecInt32);

            forNode(child3).filter(SpecNumber);

            break;

1146966 default:

1147 CRASH();

            break;

        }

        break;

@@bool AbstractState::execute(unsigned ind

            
    case ArrayPush:

        node->setCanExit(true);

        switch (node->arrayMode().type()) {

        case Array::Int32:

            forNode(node->child2()).filter(SpecInt32);

            break;

        case Array::Double:

            forNode(node->child2()).filter(SpecRealNumber);

            break;

        default:

            break;

        }

        clobberWorld(node->codeOrigin, indexInBlock);

        forNode(node).set(SpecNumber);

        break;

@@bool AbstractState::execute(unsigned ind

            
    case RegExpExec:

    case RegExpTest:

        node->setCanExit(

            !isCellSpeculation(forNode(node->child1()).m_type)

            || !isCellSpeculation(forNode(node->child2()).m_type));

        forNode(node->child1()).filter(SpecCell);

        forNode(node->child2()).filter(SpecCell);

        forNode(node).makeTop();

        break;

    case Jump:

1186 node->setCanExit(false);

        break;

    case Branch: {

@@bool AbstractState::execute(unsigned ind

        BooleanResult result = booleanResult(node, forNode(child));

        if (result == DefinitelyTrue) {

            m_branchDirection = TakeTrue;

1194 node->setCanExit(false);

            break;

        }

        if (result == DefinitelyFalse) {

            m_branchDirection = TakeFalse;

1199 node->setCanExit(false);

            break;

        }

        // FIXME: The above handles the trivial cases of sparse conditional

        // constant propagation, but we can do better:

        // We can specialize the source variable's value on each direction of

        // the branch.

        if (child->shouldSpeculateBoolean())

            speculateBooleanUnary(node);

        else if (child->shouldSpeculateObjectOrOther()) {

            node->setCanExit(true);

            forNode(child).filter(SpecObject | SpecOther);

        } else if (child->shouldSpeculateInteger())

            speculateInt32Unary(node);

        else if (child->shouldSpeculateNumber())

            speculateNumberUnary(node);

        else

            node->setCanExit(false);

1007 node->setCanExit(true); // This is overly conservative.

        m_branchDirection = TakeBoth;

        break;

    }

    case Return:

        m_isValid = false;

1223 node->setCanExit(false);

        break;

    case Throw:

@@bool AbstractState::execute(unsigned ind

        break;

    case ToPrimitive: {

        Node* child = node->child1().node();

        JSValue childConst = forNode(child).value();

1023 JSValue childConst = forNode(node->child1()).value();

12361024 if (childConst && childConst.isNumber() && trySetConstant(node, childConst)) {

12371025 m_foundConstants = true;

1238 node->setCanExit(false);

            break;

        }

1242 if (child->shouldSpeculateInteger()) {

1243 speculateInt32Unary(node);

1029 if (node->child1().useKind() == Int32Use) {

            forNode(node).set(SpecInt32);

            break;

        }

1248 AbstractValue& source = forNode(child);

1034 AbstractValue& source = forNode(node->child1());

        AbstractValue& destination = forNode(node);

        // NB. The more canonical way of writing this would have been:

@@bool AbstractState::execute(unsigned ind

            type |= SpecString;

        }

        destination.set(type);

1278 node->setCanExit(false);

        break;

    }

    case StrCat:

1283 node->setCanExit(false);

        forNode(node).set(SpecString);

        break;

    case NewArray:

        node->setCanExit(true);

        switch (node->indexingType()) {

        case ALL_BLANK_INDEXING_TYPES:

            CRASH();

            break;

        case ALL_UNDECIDED_INDEXING_TYPES:

            ASSERT(!node->numChildren());

            break;

        case ALL_INT32_INDEXING_TYPES:

            for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                forNode(m_graph.m_varArgChildren[node->firstChild() + operandIndex]).filter(SpecInt32);

            break;

        case ALL_DOUBLE_INDEXING_TYPES:

            for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                forNode(m_graph.m_varArgChildren[node->firstChild() + operandIndex]).filter(SpecRealNumber);

            break;

        case ALL_CONTIGUOUS_INDEXING_TYPES:

        case ALL_ARRAY_STORAGE_INDEXING_TYPES:

            break;

        default:

            CRASH();

            break;

        }

        forNode(node).set(m_graph.globalObjectFor(node->codeOrigin)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));

        m_haveStructures = true;

        break;

@@bool AbstractState::execute(unsigned ind

    case NewArrayWithSize:

        node->setCanExit(true);

1323 forNode(node->child1()).filter(SpecInt32);

        forNode(node).set(SpecArray);

        m_haveStructures = true;

        break;

    case NewRegexp:

1329 node->setCanExit(false);

        forNode(node).set(m_graph.globalObjectFor(node->codeOrigin)->regExpStructure());

        m_haveStructures = true;

        break;

    case ConvertThis: {

1335 Node* child = node->child1().node();

        AbstractValue& source = forNode(node->child1());

        AbstractValue& destination = forNode(node);

@@bool AbstractState::execute(unsigned ind

            // object, so there's nothing to do. I don't think this case will

            // be hit, but then again, you never know.

            destination = source;

1344 node->setCanExit(false);

            m_foundConstants = true; // Tell the constant folder to turn this into Identity.

            break;

        }

        node->setCanExit(true);

        
        if (isOtherSpeculation(child->prediction())) {

            source.filter(SpecOther);

1108 switch (node->child1().useKind()) {

1109 case OtherUse:

13531110 destination.set(SpecObjectOther);

13541111 break;

        }

        if (isObjectSpeculation(child->prediction())) {

            source.filter(SpecObject);

        case ObjectUse:

            destination = source;

            break;

        case UntypedUse:

13591116 destination = source;

            destination.merge(SpecObjectOther);

            break;

        default:

            RELEASE_ASSERT_NOT_REACHED();

13601121 break;

13611122 }

            
        destination = source;

        destination.merge(SpecObjectOther);

        break;

    }

    case CreateThis: {

        AbstractValue& source = forNode(node->child1());

        AbstractValue& destination = forNode(node);

        node->setCanExit(!isCellSpeculation(source.m_type));

        source.filter(SpecFunction);

        destination.set(SpecFinalObject);

1127 forNode(node).set(SpecFinalObject);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        break;

    case NewObject:

1384 node->setCanExit(false);

        forNode(node).set(node->structure());

        m_haveStructures = true;

        break;

    case CreateActivation:

1390 node->setCanExit(false);

        forNode(node).set(m_codeBlock->globalObjectFor(node->codeOrigin)->activationStructure());

        m_haveStructures = true;

        break;

    case CreateArguments:

1396 node->setCanExit(false);

        forNode(node).set(m_codeBlock->globalObjectFor(node->codeOrigin)->argumentsStructure());

        m_haveStructures = true;

        break;

    case TearOffActivation:

    case TearOffArguments:

1403 node->setCanExit(false);

        // Does nothing that is user-visible.

        break;

    case CheckArgumentsNotCreated:

        if (isEmptySpeculation(

                m_variables.operand(

1410 m_graph.argumentsRegisterFor(node->codeOrigin)).m_type)) {

1411 node->setCanExit(false);

1158 m_graph.argumentsRegisterFor(node->codeOrigin)).m_type))

14121159 m_foundConstants = true;

1413 } else

1160 else

            node->setCanExit(true);

        break;

@@bool AbstractState::execute(unsigned ind

        break;

    case GetMyArgumentsLengthSafe:

1433 node->setCanExit(false);

        // This potentially clobbers all structures if the arguments object had a getter

        // installed on the length property.

        clobberWorld(node->codeOrigin, indexInBlock);

@@bool AbstractState::execute(unsigned ind

        // We know that this executable does not escape its arguments, so we can optimize

        // the arguments a bit. Note that this ends up being further optimized by the

        // ArgumentsSimplificationPhase.

1447 forNode(node->child1()).filter(SpecInt32);

        forNode(node).makeTop();

        break;

@@bool AbstractState::execute(unsigned ind

        // This potentially clobbers all structures if the property we're accessing has

        // a getter. We don't speculate against this.

        clobberWorld(node->codeOrigin, indexInBlock);

1456 // But we do speculate that the index is an integer.

1457 forNode(node->child1()).filter(SpecInt32);

        // And the result is unknown.

        forNode(node).makeTop();

        break;

@@bool AbstractState::execute(unsigned ind

    case NewFunction:

    case NewFunctionExpression:

    case NewFunctionNoCheck:

1465 node->setCanExit(false);

        forNode(node).set(m_codeBlock->globalObjectFor(node->codeOrigin)->functionStructure());

        break;

    case GetCallee:

1470 node->setCanExit(false);

        forNode(node).set(SpecFunction);

        break;

    case SetCallee:

    case SetMyScope:

1476 node->setCanExit(false);

        break;

    case GetScope: // FIXME: We could get rid of these if we know that the JSFunction is a constant. https://bugs.webkit.org/show_bug.cgi?id=106202

    case GetMyScope:

    case SkipTopScope:

1482 node->setCanExit(false);

        forNode(node).set(SpecCellOther);

        break;

    case SkipScope: {

1487 node->setCanExit(false);

        JSValue child = forNode(node->child1()).value();

        if (child && trySetConstant(node, JSValue(jsCast<JSScope*>(child.asCell())->next()))) {

            m_foundConstants = true;

@@bool AbstractState::execute(unsigned ind

    }

    case GetScopeRegisters:

1498 node->setCanExit(false);

1499 forNode(node->child1()).filter(SpecCell);

        forNode(node).clear(); // The result is not a JS value.

        break;

    case GetScopedVar:

1504 node->setCanExit(false);

        forNode(node).makeTop();

        break;

    case PutScopedVar:

1509 node->setCanExit(false);

        clobberCapturedVars(node->codeOrigin);

        break;

@@bool AbstractState::execute(unsigned ind

            break;

        }

        if (isCellSpeculation(node->child1()->prediction())) {

1521 forNode(node->child1()).filter(SpecCell);

1522

            if (Structure* structure = forNode(node->child1()).bestProvenStructure()) {

                GetByIdStatus status = GetByIdStatus::computeFor(

                    m_graph.m_globalData, structure,

@@bool AbstractState::execute(unsigned ind

        // more thoroughly. https://bugs.webkit.org/show_bug.cgi?id=106200

        // FIXME: We could eliminate these entirely if we know the exact value that flows into this.

        // https://bugs.webkit.org/show_bug.cgi?id=106201

1558 forNode(node->child1()).filter(SpecCell);

        node->setCanExit(true);

        break;

    }

@@bool AbstractState::execute(unsigned ind

    case ForwardCheckStructure: {

        // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).

        AbstractValue& value = forNode(node->child1());

1298 ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.

        // If this structure check is attempting to prove knowledge already held in

        // the futurePossibleStructure set then the constant folding phase should

        // turn this into a watchpoint instead.

@@bool AbstractState::execute(unsigned ind

        if (value.m_futurePossibleStructure.isSubsetOf(set)

            || value.m_currentKnownStructure.isSubsetOf(set))

            m_foundConstants = true;

        node->setCanExit(

            !value.m_currentKnownStructure.isSubsetOf(set)

            || !isCellSpeculation(value.m_type));

1306 if (!value.m_currentKnownStructure.isSubsetOf(set))

1307 node->setCanExit(true);

        value.filter(set);

        m_haveStructures = true;

        break;

@@bool AbstractState::execute(unsigned ind

        // infinity of structures.

        ASSERT(value.m_futurePossibleStructure.isSubsetOf(StructureSet(node->structure())));

1594 ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad.

        value.filter(node->structure());

        m_haveStructures = true;

        node->setCanExit(true);

@@bool AbstractState::execute(unsigned ind

            
    case PutStructure:

    case PhantomPutStructure:

1603 node->setCanExit(false);

        if (!forNode(node->child1()).m_currentKnownStructure.isClear()) {

            clobberStructures(indexInBlock);

            forNode(node->child1()).set(node->structureTransitionData().newStructure);

@@bool AbstractState::execute(unsigned ind

    case GetButterfly:

    case AllocatePropertyStorage:

    case ReallocatePropertyStorage:

1613 node->setCanExit(!isCellSpeculation(forNode(node->child1()).m_type));

1614 forNode(node->child1()).filter(SpecCell);

        forNode(node).clear(); // The result is not a JS value.

        break;

    case CheckArray: {

        if (node->arrayMode().alreadyChecked(m_graph, node, forNode(node->child1()))) {

            m_foundConstants = true;

1620 node->setCanExit(false);

            break;

        }

        node->setCanExit(true); // Lies, but this is followed by operations (like GetByVal) that always exit, so there is no point in us trying to be clever here.

@@bool AbstractState::execute(unsigned ind

        case Array::Contiguous:

        case Array::ArrayStorage:

        case Array::SlowPutArrayStorage:

1633 forNode(node->child1()).filter(SpecCell);

            break;

        case Array::Arguments:

            forNode(node->child1()).filter(SpecArguments);

@@bool AbstractState::execute(unsigned ind

    case Arrayify: {

        if (node->arrayMode().alreadyChecked(m_graph, node, forNode(node->child1()))) {

            m_foundConstants = true;

1676 node->setCanExit(false);

            break;

        }

        ASSERT(node->arrayMode().conversion() == Array::Convert

            || node->arrayMode().conversion() == Array::RageConvert);

        node->setCanExit(true);

        forNode(node->child1()).filter(SpecCell);

        if (node->child2())

            forNode(node->child2()).filter(SpecInt32);

        clobberStructures(indexInBlock);

        forNode(node->child1()).filterArrayModes(node->arrayMode().arrayModesThatPassFiltering());

        m_haveStructures = true;

@@bool AbstractState::execute(unsigned ind

            || value.m_currentKnownStructure.isSubsetOf(set))

            m_foundConstants = true;

        node->setCanExit(true);

1697 if (node->child2())

1698 forNode(node->child2()).filter(SpecInt32);

        clobberStructures(indexInBlock);

        value.filter(set);

        m_haveStructures = true;

        break;

    }

    case GetIndexedPropertyStorage: {

1705 node->setCanExit(false);

        forNode(node).clear();

        break; 

    }

    case GetByOffset:

        if (!node->child1()->hasStorageResult()) {

            node->setCanExit(!isCellSpeculation(forNode(node->child1()).m_type));

            forNode(node->child1()).filter(SpecCell);

        }

1427 case GetByOffset: {

17141428 forNode(node).makeTop();

17151429 break;

1430 }

17161431

17171432 case PutByOffset: {

        bool canExit = false;

        if (!node->child1()->hasStorageResult()) {

            canExit |= !isCellSpeculation(forNode(node->child1()).m_type);

            forNode(node->child1()).filter(SpecCell);

        }

        canExit |= !isCellSpeculation(forNode(node->child2()).m_type);

        forNode(node->child2()).filter(SpecCell);

        node->setCanExit(canExit);

        break;

    }

@@bool AbstractState::execute(unsigned ind

        if (value == node->function()) {

            m_foundConstants = true;

            ASSERT(value);

1734 node->setCanExit(false);

            break;

        }

@@bool AbstractState::execute(unsigned ind

1769 forNode(node->child1()).filter(SpecCell);

        clobberWorld(node->codeOrigin, indexInBlock);

        break;

    case GetGlobalVar:

1774 node->setCanExit(false);

        forNode(node).makeTop();

        break;

@@bool AbstractState::execute(unsigned ind

            
    case PutGlobalVar:

    case PutGlobalVarCheck:

1784 node->setCanExit(false);

        break;

    case CheckHasInstance:

        node->setCanExit(true);

1789 forNode(node->child1()).filter(SpecCell);

        // Sadly, we don't propagate the fact that we've done CheckHasInstance

        break;

    case InstanceOf:

        node->setCanExit(true);

        // Again, sadly, we don't propagate the fact that we've done InstanceOf

        // FIXME: This appears broken: CheckHasInstance already does an unconditional cell

        // check. https://bugs.webkit.org/show_bug.cgi?id=107479

        if (!(node->child1()->prediction() & ~SpecCell) && !(forNode(node->child1()).m_type & ~SpecCell))

            forNode(node->child1()).filter(SpecCell);

        forNode(node->child2()).filter(SpecCell);

        forNode(node).set(SpecBoolean);

        break;

    case Phi:

    case Flush:

    case PhantomLocal:

        node->setCanExit(false);

        break;

18101504 case Breakpoint:

1811 node->setCanExit(false);

        break;

    case Call:

@@bool AbstractState::execute(unsigned ind

    case InlineStart:

    case Nop:

    case CountExecution:

1839 node->setCanExit(false);

        break;

    case LastNodeType:

@@bool AbstractState::execute(unsigned ind

    return m_isValid;

}

bool AbstractState::executeEffects(unsigned indexInBlock)

{

    return executeEffects(indexInBlock, m_block->at(indexInBlock));

}

bool AbstractState::execute(unsigned indexInBlock)

{

    Node* node = m_block->at(indexInBlock);

    if (!startExecuting(node))

        return true;

    executeEdges(node);

    return executeEffects(indexInBlock, node);

}

inline void AbstractState::clobberWorld(const CodeOrigin& codeOrigin, unsigned indexInBlock)

{

    clobberCapturedVars(codeOrigin);

143562

Source/JavaScriptCore/dfg/DFGAbstractState.h

@@public:

    // if execution should continue past this node. Notably, it will return true

    // for block terminals, so long as those terminals are not Return or variants

    // of Throw.

161 bool execute(unsigned);

    //

    // This is guaranteed to be equivalent to doing:

    //

    // if (state.startExecuting(index)) {

    //     state.executeEdges(index);

    //     result = state.executeEffects(index);

    // } else

    //     result = true;

    bool execute(unsigned indexInBlock);

    // Indicate the start of execution of the node. It resets any state in the node,

    // that is progressively built up by executeEdges() and executeEffects(). In

    // particular, this resets canExit(), so if you want to "know" between calls of

    // startExecuting() and executeEdges()/Effects() whether the last run of the

    // analysis concluded that the node can exit, you should probably set that

    // information aside prior to calling startExecuting().

    bool startExecuting(Node*);

    bool startExecuting(unsigned indexInBlock);

    // Abstractly execute the edges of the given node. This runs filterEdgeByUse()

    // on all edges of the node. You can skip this step, if you have already used

    // filterEdgeByUse() (or some equivalent) on each edge.

    void executeEdges(Node*);

    void executeEdges(unsigned indexInBlock);

    ALWAYS_INLINE void filterEdgeByUse(Node* node, Edge edge)

    {

#if !ASSERT_DISABLED

        switch (edge.useKind()) {

        case KnownInt32Use:

        case KnownNumberUse:

        case KnownCellUse:

            ASSERT(!(forNode(edge).m_type & ~typeFilterFor(edge.useKind())));

            break;

        default:

            break;

        }

#endif // !ASSERT_DISABLED

        filterByType(node, edge.node(), typeFilterFor(edge.useKind()));

    }

    // Abstractly execute the effects of the given node. This changes the abstract

    // state assuming that edges have already been filtered.

    bool executeEffects(unsigned indexInBlock);

    bool executeEffects(unsigned indexInBlock, Node*);

    
    // Did the last executed node clobber the world?

    bool didClobber() const { return m_didClobber; }

@@private:

    
    static bool mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode);

    void speculateInt32Unary(Node* node, bool forceCanExit = false)

    {

        AbstractValue& childValue = forNode(node->child1());

        node->setCanExit(forceCanExit || !isInt32Speculation(childValue.m_type));

        childValue.filter(SpecInt32);

    }

    void speculateNumberUnary(Node* node)

    {

        AbstractValue& childValue = forNode(node->child1());

        node->setCanExit(!isNumberSpeculation(childValue.m_type));

        childValue.filter(SpecNumber);

    }

    void speculateBooleanUnary(Node* node)

    {

        AbstractValue& childValue = forNode(node->child1());

        node->setCanExit(!isBooleanSpeculation(childValue.m_type));

        childValue.filter(SpecBoolean);

    }

    void speculateInt32Binary(Node* node, bool forceCanExit = false)

    {

        AbstractValue& childValue1 = forNode(node->child1());

        AbstractValue& childValue2 = forNode(node->child2());

        node->setCanExit(

            forceCanExit

            || !isInt32Speculation(childValue1.m_type)

            || !isInt32Speculation(childValue2.m_type));

        childValue1.filter(SpecInt32);

        childValue2.filter(SpecInt32);

    }

    void speculateNumberBinary(Node* node)

    {

        AbstractValue& childValue1 = forNode(node->child1());

        AbstractValue& childValue2 = forNode(node->child2());

        node->setCanExit(

            !isNumberSpeculation(childValue1.m_type)

            || !isNumberSpeculation(childValue2.m_type));

        childValue1.filter(SpecNumber);

        childValue2.filter(SpecNumber);

    }

    enum BooleanResult {

        UnknownBooleanResult,

        DefinitelyFalse,

@@private:

        return true;

    }

    ALWAYS_INLINE void filterByType(Node* node, Node* child, SpeculatedType type)

    {

        AbstractValue& value = forNode(child);

        if (value.m_type & ~type)

            node->setCanExit(true);

        value.filter(type);

    }

    void verifyEdge(Node*, Edge);

    void verifyEdges(Node*);

    CodeBlock* m_codeBlock;

    Graph& m_graph;

143562

Source/JavaScriptCore/dfg/DFGAbstractValue.h

@@struct AbstractValue {

    
    void filter(const StructureSet& other)

    {

        // FIXME: This could be optimized for the common case of m_type not

        // having structures, array modes, or a specific value.

        // https://bugs.webkit.org/show_bug.cgi?id=109663

        m_type &= other.speculationFromStructures();

        m_arrayModes &= other.arrayModesFromStructures();

        m_currentKnownStructure.filter(other);

143562

Source/JavaScriptCore/dfg/DFGAdjacencyList.h

@@public:

    AdjacencyList() { }

    AdjacencyList(Kind kind)

#if !ASSERT_DISABLED

        : m_kind(kind)

#endif

    {

        if (kind == Variable) {

            m_words[0].m_encodedWord = UINT_MAX;

@@public:

        }

    }

    AdjacencyList(Kind kind, Node* child1, Node* child2, Node* child3)

#if !ASSERT_DISABLED

        : m_kind(Fixed)

#endif

57 AdjacencyList(Kind kind, Edge child1, Edge child2, Edge child3)

    {

        ASSERT_UNUSED(kind, kind == Fixed);

        initialize(child1, child2, child3);

    }

    AdjacencyList(Kind kind, unsigned firstChild, unsigned numChildren)

#if !ASSERT_DISABLED

        : m_kind(Variable)

#endif

    {

        ASSERT_UNUSED(kind, kind == Variable);

        setFirstChild(firstChild);

@@public:

    const Edge& child(unsigned i) const

    {

        ASSERT(i < Size);

82 ASSERT(m_kind == Fixed);

        return m_words[i];

    }    

    Edge& child(unsigned i)

    {

        ASSERT(i < Size);

89 ASSERT(m_kind == Fixed);

        return m_words[i];

    }

    void setChild(unsigned i, Edge nodeUse)

    {

        ASSERT(i < Size);

96 ASSERT(m_kind == Fixed);

        m_words[i] = nodeUse;

    }

@@public:

    
    void reset()

    {

#if !ASSERT_DISABLED

        m_kind = Fixed;

#endif

        initialize();

    }

@@public:

    unsigned firstChild() const

    {

145 ASSERT(m_kind == Variable);

        return m_words[0].m_encodedWord;

    }

    void setFirstChild(unsigned firstChild)

    {

150 ASSERT(m_kind == Variable);

        m_words[0].m_encodedWord = firstChild;

    }

    unsigned numChildren() const

    {

156 ASSERT(m_kind == Variable);

        return m_words[1].m_encodedWord;

    }

    void setNumChildren(unsigned numChildren)

    {

161 ASSERT(m_kind == Variable);

        m_words[1].m_encodedWord = numChildren;

    }

#if !ASSERT_DISABLED

    Kind kind() const { return m_kind; }

#endif

168146private:

169147 Edge m_words[Size];

#if !ASSERT_DISABLED

    Kind m_kind;

#endif

};

} } // namespace JSC::DFG

143562

Source/JavaScriptCore/dfg/DFGAllocator.h

@@namespace JSC { namespace DFG {

//   anything. You can just call freeAll() instead.

// - You call free() on all T's that you allocated, and never use freeAll().

46 template<typename T>

// forcedCellSize: set this to 0 if you're happy with the default alignment, or set it

// to a non-zero value if you want to forcibly align the allocations to a certain

// value. When you do this, Allocator will ASSERT that forcedCellAlignment >= sizeof(T).

template<typename T, unsigned forcedCellAlignment>

class Allocator {

public:

    Allocator();

@@private:

    void* bumpAllocate();

    void* freeListAllocate();

    void* allocateSlow();

    
    static size_t cellSize()

    {

        if (!forcedCellAlignment)

            return sizeof(T);

        ASSERT(forcedCellAlignment >= sizeof(T));

        return forcedCellAlignment;

    }

6780 struct Region {

6881 static size_t size() { return 64 * KB; }

        static size_t headerSize() { return std::max(sizeof(Region), sizeof(T)); }

        static unsigned numberOfThingsPerRegion() { return (size() - headerSize()) / sizeof(T); }

        T* data() { return bitwise_cast<T*>(bitwise_cast<char*>(this) + headerSize()); }

        bool isInThisRegion(const T* pointer) { return static_cast<unsigned>(pointer - data()) < numberOfThingsPerRegion(); }

        static size_t headerSize() { return std::max(sizeof(Region), cellSize()); }

        static unsigned numberOfThingsPerRegion() { return (size() - headerSize()) / cellSize(); }

        static size_t payloadSize() { return numberOfThingsPerRegion() * cellSize(); }

        char* payloadBegin() { return bitwise_cast<char*>(this) + headerSize(); }

        char* payloadEnd() { return payloadBegin() + payloadSize(); }

        bool isInThisRegion(const T* pointer) { return static_cast<size_t>(bitwise_cast<char*>(pointer) - payloadBegin()) < payloadSize(); }

        static Region* regionFor(const T* pointer) { return bitwise_cast<Region*>(bitwise_cast<uintptr_t>(pointer) & ~(size() - 1)); }

        PageAllocationAligned m_allocation;

@@private:

    
    Region* m_regionHead;

    void** m_freeListHead;

85 T* m_bumpEnd;

86 un~~sign~~ed m_bumpRemaining;

100 char* m_bumpEnd;

101 size_t m_bumpRemaining;

87102};

88103

89 template<typename T>

90 inline Allocator<T>::Allocator()

104template<typename T, unsigned forcedCellAlignment>

105inline Allocator<T, forcedCellAlignment>::Allocator()

    : m_regionHead(0)

    , m_freeListHead(0)

    , m_bumpRemaining(0)

{

}

97 template<typename T>

98 inline Allocator<T>::~Allocator()

112template<typename T, unsigned forcedCellAlignment>

113inline Allocator<T, forcedCellAlignment>::~Allocator()

{

    reset();

}

103 template<typename T>

104 ALWAYS_INLINE void* Allocator<T>::allocate()

118template<typename T, unsigned forcedCellAlignment>

119ALWAYS_INLINE void* Allocator<T, forcedCellAlignment>::allocate()

{

    void* result = bumpAllocate();

    if (LIKELY(!!result))

@@ALWAYS_INLINE void* Allocator<T>::alloca

    return freeListAllocate();

}

112 template<typename T>

113 void Allocator<T>::free(T* object)

127template<typename T, unsigned forcedCellAlignment>

128void Allocator<T, forcedCellAlignment>::free(T* object)

{

    object->~T();

@@void Allocator<T>::free(T* object)

    m_freeListHead = cell;

}

122 template<typename T>

123 void Allocator<T>::freeAll()

137template<typename T, unsigned forcedCellAlignment>

138void Allocator<T, forcedCellAlignment>::freeAll()

{

    if (!m_regionHead) {

        ASSERT(!m_bumpRemaining);

@@void Allocator<T>::freeAll()

    startBumpingIn(m_regionHead);

}

145 template<typename T>

146 void Allocator<T>::reset()

160template<typename T, unsigned forcedCellAlignment>

161void Allocator<T, forcedCellAlignment>::reset()

{

    freeRegionsStartingAt(m_regionHead);

@@void Allocator<T>::reset()

    m_bumpRemaining = 0;

}

155 template<typename T>

156 unsigned Allocator<T>::indexOf(const T* object)

170template<typename T, unsigned forcedCellAlignment>

171unsigned Allocator<T, forcedCellAlignment>::indexOf(const T* object)

{

    unsigned baseIndex = 0;

    for (Region* region = m_regionHead; region; region = region->m_next) {

        if (region->isInThisRegion(object))

161 return baseIndex + (object - region->~~data~~());

176 return baseIndex + (bitwise_cast<char*>(object) - region->payloadBegin()) / cellSize();

        baseIndex += Region::numberOfThingsPerRegion();

    }

    CRASH();

    return 0;

}

168 template<typename T>

169 Allocator<T>* Allocator<T>::allocatorOf(const T* object)

183template<typename T, unsigned forcedCellAlignment>

184Allocator<T, forcedCellAlignment>* Allocator<T, forcedCellAlignment>::allocatorOf(const T* object)

{

    return Region::regionFor(object)->m_allocator;

}

174 template<typename T>

175 ALWAYS_INLINE void* Allocator<T>::bumpAllocate()

189template<typename T, unsigned forcedCellAlignment>

190ALWAYS_INLINE void* Allocator<T, forcedCellAlignment>::bumpAllocate()

176191{

177 if (un~~sign~~ed remaining = m_bumpRemaining) {

178 remaining--;

192 if (size_t remaining = m_bumpRemaining) {

193 remaining -= cellSize();

179194 m_bumpRemaining = remaining;

180 return m_bumpEnd - (remaining + 1);

195 return m_bumpEnd - (remaining + cellSize());

    }

    return 0;

}

185 template<typename T>

186 void* Allocator<T>::freeListAllocate()

200template<typename T, unsigned forcedCellAlignment>

201void* Allocator<T, forcedCellAlignment>::freeListAllocate()

{

    void** result = m_freeListHead;

    if (UNLIKELY(!result))

@@void* Allocator<T>::freeListAllocate()

    return result;

}

195 template<typename T>

196 void* Allocator<T>::allocateSlow()

210template<typename T, unsigned forcedCellAlignment>

211void* Allocator<T, forcedCellAlignment>::allocateSlow()

{

    ASSERT(!m_freeListHead);

    ASSERT(!m_bumpRemaining);

@@void* Allocator<T>::allocateSlow()

    return result;

}

219 template<typename T>

220 void Allocator<T>::freeRegionsStartingAt(typename Allocator<T>::Region* region)

234template<typename T, unsigned forcedCellAlignment>

235void Allocator<T, forcedCellAlignment>::freeRegionsStartingAt(typename Allocator<T, forcedCellAlignment>::Region* region)

{

    while (region) {

        Region* nextRegion = region->m_next;

@@void Allocator<T>::freeRegionsStartingAt

    }

}

229 template<typename T>

230 void Allocator<T>::startBumpingIn(typename Allocator<T>::Region* region)

244template<typename T, unsigned forcedCellAlignment>

245void Allocator<T, forcedCellAlignment>::startBumpingIn(typename Allocator<T, forcedCellAlignment>::Region* region)

231246{

232 m_bumpEnd = region->~~data() + Region::numberOfThingsPerRegion~~();

233 m_bumpRemaining = Region::~~numberOfThingsPerRegion~~();

247 m_bumpEnd = region->payloadEnd();

248 m_bumpRemaining = Region::payloadSize();

}

} } // namespace JSC::DFG

143562

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@private:

    {

        Node* result = m_graph.addNode(

            DontRefChildren, DontRefNode, SpecNone,

            op, currentCodeOrigin(), Edge(child1), Edge(child2), Edge(child3));

        ASSERT(op != Phi);

        m_currentBlock->append(result);

        if (defaultFlags(op) & NodeMustGenerate)

            m_graph.refChildren(result);

        return result;

    }

    Node* addToGraph(NodeType op, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())

    {

        Node* result = m_graph.addNode(

            DontRefChildren, DontRefNode, SpecNone,

            op, currentCodeOrigin(), child1, child2, child3);

        ASSERT(op != Phi);

        m_currentBlock->append(result);

@@private:

    {

        Node* result = m_graph.addNode(

            DontRefChildren, DontRefNode, SpecNone,

713 op, currentCodeOrigin(), info, child1, child2, child3);

725 op, currentCodeOrigin(), info, Edge(child1), Edge(child2), Edge(child3));

        if (op == Phi)

            m_currentBlock->phis.append(result);

        else

@@private:

    {

        Node* result = m_graph.addNode(

            DontRefChildren, DontRefNode, SpecNone,

727 op, currentCodeOrigin(), info1, info2, child1, child2, child3);

739 op, currentCodeOrigin(), info1, info2, Edge(child1), Edge(child2), Edge(child3));

        ASSERT(op != Phi);

        m_currentBlock->append(result);

@@bool ByteCodeParser::handleMinMax(bool u

     
    if (argumentCountIncludingThis == 2) { // Math.min(x)

        Node* result = get(registerOffset + argumentToOperand(1));

1468 addToGraph(Ch~~eck~~Number~~, result~~);

1480 addToGraph(Phantom, Edge(result, NumberUse));

        setIntrinsicResult(usesResult, resultOperand, result);

        return true;

    }

143562

Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

@@private:

                
            case GetByVal:

                // If this is accessing arguments then it's potentially accessing locals.

972 if (node->~~chil~~d1~~()->shouldSpeculate~~Arguments())

972 if (node->arrayMode().type() == Array::Arguments)

                    result.mayBeAccessed = true;

                break;

@@private:

            Edge edge = node->children.child(i);

            if (!edge)

                continue;

1005 if (edge.useKind() != UntypedUse)

1006 continue; // Keep the type check.

            if (edge->flags() & NodeRelevantToOSR)

                continue;

@@private:

        }

    }

1017 enum PredictionHandlingMode { RequireSamePrediction, AllowPredictionMismatch };

1018 bool setReplacement(Node* replacement, PredictionHandlingMode predictionHandlingMode = RequireSamePrediction)

1019 bool setReplacement(Node* replacement)

    {

        if (!replacement)

            return false;

        // Be safe. Don't try to perform replacements if the predictions don't

        // agree.

        if (predictionHandlingMode == RequireSamePrediction

            && m_currentNode->prediction() != replacement->prediction())

            return false;

#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)

        dataLogF("   Replacing @%u -> @%u", m_currentNode->index(), replacement->index());

#endif

@@private:

        case JSConstant:

            // This is strange, but necessary. Some phases will convert nodes to constants,

            // which may result in duplicated constants. We use CSE to clean this up.

1233 setReplacement(constantCSE(node)~~, AllowPredictionMismatch~~);

1228 setReplacement(constantCSE(node));

            break;

        case WeakJSConstant:

143562

Source/JavaScriptCore/dfg/DFGCommon.h

@@struct NodePointerTraits {

    static void dump(Node* value, PrintStream& out);

};

enum UseKind {

    UntypedUse,

    DoubleUse,

    LastUseKind // Must always be the last entry in the enum, as it is used to denote the number of enum elements.

};

// Use RefChildren if the child ref counts haven't already been adjusted using

// other means and either of the following is true:

// - The node you're creating is MustGenerate.

@@enum RefNodeMode {

    DontRefNode

};

inline const char* useKindToString(UseKind useKind)

{

    switch (useKind) {

    case UntypedUse:

        return "";

    case DoubleUse:

        return "d";

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return 0;

    }

}

inline bool isARMv7s()

{

#if CPU(APPLE_ARMV7S)

@@enum UnificationState {

    GloballyUnified

};

220enum OperandSpeculationMode { AutomaticOperandSpeculation, ManualOperandSpeculation };

221

enum SpeculationDirection { ForwardSpeculation, BackwardSpeculation };

} } // namespace JSC::DFG

143562

Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

@@private:

                    set = node->structure();

                else

                    set = node->structureSet();

106 if (!isCellSpeculation(value.m_type))

107 break;

108106 if (value.m_currentKnownStructure.isSubsetOf(set)) {

109107 ASSERT(node->refCount() == 1);

108 m_state.execute(indexInBlock); // Catch the fact that we may filter on cell.

                    node->setOpAndDefaultFlags(Phantom);

                    eliminated = true;

                    break;

@@private:

                StructureAbstractValue& structureValue = value.m_futurePossibleStructure;

                if (structureValue.isSubsetOf(set)

                    && structureValue.hasSingleton()) {

117 node->convertToStructureTransitionWatchpoint(structureValue.singleton());

118 changed = true;

                    Structure* structure = structureValue.singleton();

                    m_state.execute(indexInBlock); // Catch the fact that we may filter on cell.

                    node->convertToStructureTransitionWatchpoint(structure);

                    eliminated = true;

                    break;

@@private:

            case GetById:

            case GetByIdFlush: {

                CodeOrigin codeOrigin = node->codeOrigin;

152 Node* child = node->child1().node();

154 Edge childEdge = node->child1();

155 Node* child = childEdge.node();

153156 unsigned identifierNumber = node->identifierNumber();

154157

155 if (~~!isCellSpeculation(~~child~~->pr~~e~~diction~~()))

158 if (childEdge.useKind() != CellUse)

                    break;

                Structure* structure = m_state.forNode(child).bestProvenStructure();

@@private:

                GetByIdStatus status = GetByIdStatus::computeFor(

                    globalData(), structure, codeBlock()->identifier(identifierNumber));

167 if (!status.isSimple())

                if (!status.isSimple()) {

                    // FIXME: We could handle prototype cases.

                    // https://bugs.webkit.org/show_bug.cgi?id=110386

168173 break;

174 }

                
                ASSERT(status.structureSet().size() == 1);

                ASSERT(status.chain().isEmpty());

@@private:

                    ASSERT(m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)));

                    m_insertionSet.insertNode(

                        indexInBlock, RefChildren, DontRefNode, SpecNone,

184 StructureTransitionWatchpoint, codeOrigin, OpInfo(structure), child);

                        StructureTransitionWatchpoint, codeOrigin, OpInfo(structure), childEdge);

                } else if (m_state.forNode(child).m_type & ~SpecCell) {

                    m_insertionSet.insertNode(

                        indexInBlock, RefChildren, DontRefNode, SpecNone,

                        Phantom, codeOrigin, childEdge);

185195 }

186196

187 Node* propertyStorage;

                childEdge.setUseKind(KnownCellUse);

                Edge propertyStorage;

                
                child->ref();

                if (isInlineOffset(status.offset()))

191 propertyStorage = child;

203 propertyStorage = childEdge;

192204 else {

193 propertyStorage = m_insertionSet.insertNode(

205 propertyStorage = Edge(m_insertionSet.insertNode(

194206 indexInBlock, DontRefChildren, RefNode, SpecNone, GetButterfly, codeOrigin,

195 child);

207 childEdge));

                }

                node->convertToGetByOffset(m_graph.m_storageAccessData.size(), propertyStorage);

@@private:

            case PutById:

            case PutByIdDirect: {

                CodeOrigin codeOrigin = node->codeOrigin;

210 Node* child = node->child1().node();

222 Edge childEdge = node->child1();

223 Node* child = childEdge.node();

211224 unsigned identifierNumber = node->identifierNumber();

212225

226 ASSERT(childEdge.useKind() == CellUse);

227

                Structure* structure = m_state.forNode(child).bestProvenStructure();

                if (!structure)

                    break;

@@private:

                    ASSERT(m_state.forNode(child).m_futurePossibleStructure.isSubsetOf(StructureSet(structure)));

                    m_insertionSet.insertNode(

                        indexInBlock, RefChildren, DontRefNode, SpecNone,

241 StructureTransitionWatchpoint, codeOrigin, OpInfo(structure), child);

                        StructureTransitionWatchpoint, codeOrigin, OpInfo(structure), childEdge);

                } else if (m_state.forNode(child).m_type & ~SpecCell) {

                    m_insertionSet.insertNode(

                        indexInBlock, RefChildren, DontRefNode, SpecNone,

                        Phantom, codeOrigin, childEdge);

242261 }

243262

263 childEdge.setUseKind(KnownCellUse);

264

                StructureTransitionData* transitionData = 0;

                if (status.isSimpleTransition()) {

                    transitionData = m_graph.addStructureTransitionData(

@@private:

                    }

                }

267 Node* propertyStorage;

288 Edge propertyStorage;

                
                if (isInlineOffset(status.offset())) {

                    child->ref(); // The child will be used as the property index, so ref it to reflect the double use.

271 propertyStorage = child;

292 propertyStorage = childEdge;

272293 } else if (status.isSimpleReplace() || structure->outOfLineCapacity() == status.newStructure()->outOfLineCapacity()) {

273 propertyStorage = m_insertionSet.insertNode(

274 indexInBlock, RefChildren, RefNode, SpecNone, GetButterfly, codeOrigin, child);

294 propertyStorage = Edge(m_insertionSet.insertNode(

295 indexInBlock, RefChildren, RefNode, SpecNone, GetButterfly, codeOrigin, childEdge));

                } else if (!structure->outOfLineCapacity()) {

                    ASSERT(status.newStructure()->outOfLineCapacity());

                    ASSERT(!isInlineOffset(status.offset()));

278 propertyStorage = m_insertionSet.insertNode(

299 propertyStorage = Edge(m_insertionSet.insertNode(

279300 indexInBlock, RefChildren, RefNode, SpecNone, AllocatePropertyStorage,

280 codeOrigin, OpInfo(transitionData), child);

301 codeOrigin, OpInfo(transitionData), childEdge));

                } else {

                    ASSERT(structure->outOfLineCapacity());

                    ASSERT(status.newStructure()->outOfLineCapacity() > structure->outOfLineCapacity());

                    ASSERT(!isInlineOffset(status.offset()));

286 propertyStorage = m_insertionSet.insertNode(

307 propertyStorage = Edge(m_insertionSet.insertNode(

287308 indexInBlock, RefChildren, RefNode, SpecNone, ReallocatePropertyStorage,

288309 codeOrigin, OpInfo(transitionData),

289 child,

290 m_insertionSet.insertNode(

310 childEdge,

311 Edge(m_insertionSet.insertNode(

291312 indexInBlock, DontRefChildren, DontRefNode, SpecNone, GetButterfly,

292 codeOrigin, child));

313 codeOrigin, childEdge))));

                }

                if (status.isSimpleTransition()) {

                    m_insertionSet.insertNode(

                        indexInBlock, RefChildren, DontRefNode, SpecNone, PutStructure, codeOrigin,

298 OpInfo(transitionData), child);

319 OpInfo(transitionData), childEdge);

                }

                node->convertToPutByOffset(m_graph.m_storageAccessData.size(), propertyStorage);

@@private:

                        m_graph.convertToConstant(node, value);

                        Node* phantom = m_insertionSet.insertNode(

                            indexInBlock, DontRefChildren, DontRefNode, SpecNone, PhantomLocal, 

343 codeOrigin, OpInfo(variable), phi);

364 codeOrigin, OpInfo(variable), Edge(phi));

                        block->variablesAtHead.operand(variable->local()) = phantom;

                        block->variablesAtTail.operand(variable->local()) = phantom;

@@private:

        if (cell->structure()->transitionWatchpointSetIsStillValid()) {

            m_insertionSet.insertNode(

                indexInBlock, RefChildren, DontRefNode, SpecNone, StructureTransitionWatchpoint,

394 codeOrigin, OpInfo(cell->structure()), weakConstant);

415 codeOrigin, OpInfo(cell->structure()), Edge(weakConstant, CellUse));

            return;

        }

        m_insertionSet.insertNode(

            indexInBlock, RefChildren, DontRefNode, SpecNone, CheckStructure, codeOrigin,

400 OpInfo(m_graph.addStructureSet(cell->structure())), weakConstant);

421 OpInfo(m_graph.addStructureSet(cell->structure())), Edge(weakConstant, CellUse));

    }

    // This is necessary because the CFA may reach conclusions about constants based on its

143562

Source/JavaScriptCore/dfg/DFGDriver.cpp

@@inline bool compile(CompileMode compileM

        if (!changed)

            break;

147 dfg.resetExitStates();

148 performFixup(dfg);

        performCPSRethreading(dfg);

    }

143562

Source/JavaScriptCore/dfg/DFGEdge.cpp

@@namespace JSC { namespace DFG {

void Edge::dump(PrintStream& out) const

{

37 out.print(useKindToString(useKind()), node());

    if (useKind() != UntypedUse)

        out.print(useKind(), ":");

    out.print(node());

}

} } // namespace JSC::DFG

143562

Source/JavaScriptCore/dfg/DFGEdge.h

#if ENABLE(DFG_JIT)

#include "DFGCommon.h"

34#include "DFGUseKind.h"

namespace JSC { namespace DFG {

@@public:

        m_encodedWord = makeWord(node, useKind());

    }

65 UseKind useKind() const

66 UseKind useKindUnchecked() const

6667 {

67 ASSERT(node());

6868 unsigned masked = m_encodedWord & (((1 << shift()) - 1));

6969 ASSERT(masked < LastUseKind);

70 return static_cast<UseKind>(masked);

        UseKind result = static_cast<UseKind>(masked);

        ASSERT(node() || result == UntypedUse);

        return result;

    }

    UseKind useKind() const

    {

        ASSERT(node());

        return useKindUnchecked();

    }

    void setUseKind(UseKind useKind)

    {

@@public:

private:

    friend class AdjacencyList;

99 static uint32_t shift() { return 2; }

106 static uint32_t shift() { return 4; }

    
    static uintptr_t makeWord(Node* node, UseKind useKind)

    {

143562

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@public:

    
    bool run()

    {

        ASSERT(m_graph.m_fixpointState == BeforeFixpoint);

        ASSERT(m_graph.m_form == ThreadedCPS);

        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex)

            fixupBlock(m_graph.m_blocks[blockIndex].get());

        return true;

@@private:

#endif

        switch (op) {

79 case GetById: {

80 if (m_graph.m_fixpointState > BeforeFixpoint)

        case SetLocal: {

            VariableAccessData* variable = node->variableAccessData();

            if (variable->isCaptured()

                || m_graph.isCreatedThisArgument(variable->local()))

8187 break;

8288

83 if (!isInt32Speculation(node->prediction()))

89 if (variable->shouldUseDoubleFormat()) {

90 fixDoubleEdge(node->child1(), NumberUse, ForwardSpeculation);

8491 break;

85 if (codeBlock()->identifier(node->identifierNumber()) != globalData().propertyNames->length)

            }

            SpeculatedType predictedType = variable->argumentAwarePrediction();

            if (isInt32Speculation(predictedType))

                node->child1().setUseKind(Int32Use);

            else if (isCellSpeculation(predictedType))

                node->child1().setUseKind(CellUse);

            else if (isBooleanSpeculation(predictedType))

                node->child1().setUseKind(BooleanUse);

            break;

        }

        case BitAnd:

        case BitOr:

        case BitXor:

        case BitRShift:

        case BitLShift:

        case BitURShift: {

            fixIntEdge(node->child1());

            fixIntEdge(node->child2());

            break;

        }

        case UInt32ToNumber: {

            node->child1().setUseKind(KnownInt32Use);

            break;

        }

        case DoubleAsInt32: {

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        case ValueToInt32: {

            if (node->child1()->shouldSpeculateInteger()) {

                node->child1().setUseKind(Int32Use);

86128 break;

            ArrayProfile* arrayProfile = 

                m_graph.baselineCodeBlockFor(node->codeOrigin)->getArrayProfile(

                    node->codeOrigin.bytecodeIndex);

            ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);

            if (arrayProfile) {

                arrayProfile->computeUpdatedPrediction(m_graph.baselineCodeBlockFor(node->codeOrigin));

                arrayMode = ArrayMode::fromObserved(arrayProfile, Array::Read, false);

                arrayMode = arrayMode.refine(

                    node->child1()->prediction(), node->prediction());

                if (arrayMode.supportsLength() && arrayProfile->hasDefiniteStructure()) {

                    m_insertionSet.insertNode(

                        m_indexInBlock, RefChildren, DontRefNode, SpecNone, CheckStructure,

                        node->codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())),

                        node->child1().node());

            }

            if (node->child1()->shouldSpeculateNumber()) {

                node->child1().setUseKind(NumberUse);

                break;

            }

            if (node->child1()->shouldSpeculateBoolean()) {

                node->child1().setUseKind(BooleanUse);

                break;

            }

            node->child1().setUseKind(NotCellUse);

            break;

        }

        case Int32ToDouble: {

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        case ValueAdd: {

            if (attemptToMakeIntegerAdd(node))

                break;

            if (Node::shouldSpeculateNumberExpectingDefined(node->child1().node(), node->child2().node())) {

                fixDoubleEdge(node->child1());

                fixDoubleEdge(node->child2());

                break;

            }

            break;

        }

        case ArithAdd:

        case ArithSub: {

            if (attemptToMakeIntegerAdd(node))

                break;

            fixDoubleEdge(node->child1());

            fixDoubleEdge(node->child2());

            break;

        }

        case ArithNegate: {

            if (m_graph.negateShouldSpeculateInteger(node)) {

                node->child1().setUseKind(Int32Use);

                break;

            }

            fixDoubleEdge(node->child1());

            break;

        }

        case ArithMul: {

            if (m_graph.mulShouldSpeculateInteger(node)) {

                node->child1().setUseKind(Int32Use);

                node->child2().setUseKind(Int32Use);

                break;

            }

            fixDoubleEdge(node->child1());

            fixDoubleEdge(node->child2());

            break;

        }

        case ArithDiv: {

            if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())

                && node->canSpeculateInteger()) {

                if (isX86() || isARMv7s()) {

                    node->child1().setUseKind(Int32Use);

                    node->child2().setUseKind(Int32Use);

                    break;

101197 }

            } else

                arrayMode = arrayMode.refine(node->child1()->prediction(), node->prediction());

            if (!arrayMode.supportsLength())

                injectInt32ToDoubleNode(node->child1());

                injectInt32ToDoubleNode(node->child2());

                // We don't need to do ref'ing on the children because we're stealing them from

                // the original division.

                Node* newDivision = m_insertionSet.insertNode(

                    m_indexInBlock, DontRefChildren, RefNode, SpecDouble, *node);

                node->setOp(DoubleAsInt32);

                node->children.initialize(Edge(newDivision, KnownNumberUse), Edge(), Edge());

105208 break;

            node->setOp(GetArrayLength);

            ASSERT(node->flags() & NodeMustGenerate);

            node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

            m_graph.deref(node);

            node->setArrayMode(arrayMode);

            }

            fixDoubleEdge(node->child1());

            fixDoubleEdge(node->child2());

            break;

        }

111214

112 Node* storage = checkArray(arrayMode, node->codeOrigin, node->child1().node(), 0, lengthNeedsStorage, node->shouldGenerate());

113 if (!storage)

        case ArithMin:

        case ArithMax:

        case ArithMod: {

            if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())

                && node->canSpeculateInteger()) {

                node->child1().setUseKind(Int32Use);

                node->child2().setUseKind(Int32Use);

                break;

            }

            fixDoubleEdge(node->child1());

            fixDoubleEdge(node->child2());

            break;

        }

        case ArithAbs: {

            if (node->child1()->shouldSpeculateIntegerForArithmetic()

                && node->canSpeculateInteger()) {

                node->child1().setUseKind(Int32Use);

114233 break;

            }

            fixDoubleEdge(node->child1());

            break;

        }

115238

116 node->children.child2() = Edge(storage);

        case ArithSqrt: {

            fixDoubleEdge(node->child1());

            break;

        }

        case LogicalNot: {

            if (node->child1()->shouldSpeculateBoolean())

                node->child1().setUseKind(BooleanUse);

            else if (node->child1()->shouldSpeculateObjectOrOther())

                node->child1().setUseKind(ObjectOrOtherUse);

            else if (node->child1()->shouldSpeculateInteger())

                node->child1().setUseKind(Int32Use);

            else if (node->child1()->shouldSpeculateNumber())

                fixDoubleEdge(node->child1());

117253 break;

118254 }

119 case GetIndexedPropertyStorage: {

120 ASSERT(node->arrayMode().canCSEStorage());

            
        case TypeOf: {

            if (node->child1()->shouldSpeculateString())

                node->child1().setUseKind(StringUse);

            else if (node->child1()->shouldSpeculateCell())

                node->child1().setUseKind(CellUse);

121261 break;

122262 }

            
        case CompareEq:

        case CompareEqConstant:

        case CompareLess:

        case CompareLessEq:

        case CompareGreater:

        case CompareGreaterEq: {

            if (node->op() == CompareEqConstant)

                break;

            if (Node::shouldSpeculateInteger(node->child1().node(), node->child2().node())) {

                node->child1().setUseKind(Int32Use);

                node->child2().setUseKind(Int32Use);

                break;

            }

            if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {

                fixDoubleEdge(node->child1());

                fixDoubleEdge(node->child2());

                break;

            }

            if (node->op() != CompareEq)

                break;

            if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString())

                break;

            if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

                node->child1().setUseKind(ObjectUse);

                node->child2().setUseKind(ObjectUse);

                break;

            }

            if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {

                node->child1().setUseKind(ObjectUse);

                node->child2().setUseKind(ObjectOrOtherUse);

                break;

            }

            if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {

                node->child1().setUseKind(ObjectOrOtherUse);

                node->child2().setUseKind(ObjectUse);

                break;

            }

            break;

        }

        case CompareStrictEq:

        case CompareStrictEqConstant: {

            if (node->op() == CompareStrictEqConstant)

                break;

            if (Node::shouldSpeculateInteger(node->child1().node(), node->child2().node())) {

                node->child1().setUseKind(Int32Use);

                node->child2().setUseKind(Int32Use);

                break;

            }

            if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {

                fixDoubleEdge(node->child1());

                fixDoubleEdge(node->child2());

                break;

            }

            if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString())

                break;

            if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

                node->child1().setUseKind(ObjectUse);

                node->child2().setUseKind(ObjectUse);

                break;

            }

            break;

        }

        case StringCharAt:

        case StringCharCodeAt: {

            // Currently we have no good way of refining these.

            ASSERT(node->arrayMode() == ArrayMode(Array::String));

            blessArrayOperation(node->child1(), node->child2(), node->child3());

            node->child1().setUseKind(KnownCellUse);

            node->child2().setUseKind(Int32Use);

            break;

        }

        case GetByVal: {

            node->setArrayMode(

                node->arrayMode().refine(

@@private:

                    node->child2()->prediction(),

                    SpecNone, node->flags()));

130 blessArrayOperation(node->child1(), node->child2(), 2);

345 blessArrayOperation(node->child1(), node->child2(), node->child3());

            
            ArrayMode arrayMode = node->arrayMode();

            if (arrayMode.type() == Array::Double

@@private:

                && !(node->flags() & NodeUsedAsOther))

                node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));

            switch (node->arrayMode().type()) {

            case Array::SelectUsingPredictions:

            case Array::Unprofiled:

            case Array::Undecided:

                RELEASE_ASSERT_NOT_REACHED();

                break;

            case Array::Generic:

#if USE(JSVALUE32_64)

                node->child1().setUseKind(CellUse); // Speculating cell due to register pressure on 32-bit.

#endif

                break;

            case Array::ForceExit:

                break;

            default:

                node->child1().setUseKind(KnownCellUse);

                node->child2().setUseKind(Int32Use);

                break;

            }

141375 break;

142376 }

        case StringCharAt:

        case StringCharCodeAt: {

            // Currently we have no good way of refining these.

            ASSERT(node->arrayMode() == ArrayMode(Array::String));

            blessArrayOperation(node->child1(), node->child2(), 2);

            
        case PutByVal:

        case PutByValAlias: {

            Edge& child1 = m_graph.varArgChild(node, 0);

            Edge& child2 = m_graph.varArgChild(node, 1);

            Edge& child3 = m_graph.varArgChild(node, 2);

            node->setArrayMode(

                node->arrayMode().refine(

                    child1->prediction(),

                    child2->prediction(),

                    child3->prediction()));

            blessArrayOperation(child1, child2, m_graph.varArgChild(node, 3));

            switch (node->arrayMode().modeForPut().type()) {

            case Array::SelectUsingPredictions:

            case Array::Unprofiled:

            case Array::Undecided:

                RELEASE_ASSERT_NOT_REACHED();

                break;

            case Array::ForceExit:

            case Array::Generic:

#if USE(JSVALUE32_64)

                // Due to register pressure on 32-bit, we speculate cell and

                // ignore the base-is-not-cell case entirely by letting the

                // baseline JIT handle it.

                child1.setUseKind(CellUse);

#endif

                break;

            case Array::Int32:

                child1.setUseKind(KnownCellUse);

                child2.setUseKind(Int32Use);

                child3.setUseKind(Int32Use);

                break;

            case Array::Double:

                child1.setUseKind(KnownCellUse);

                child2.setUseKind(Int32Use);

                fixDoubleEdge(child3, RealNumberUse);

                break;

            case Array::Int8Array:

            case Array::Int16Array:

            case Array::Int32Array:

            case Array::Uint8Array:

            case Array::Uint8ClampedArray:

            case Array::Uint16Array:

            case Array::Uint32Array:

                child1.setUseKind(KnownCellUse);

                child2.setUseKind(Int32Use);

                if (child3->shouldSpeculateInteger())

                    child3.setUseKind(Int32Use);

                else

                    fixDoubleEdge(child3);

                break;

            case Array::Float32Array:

            case Array::Float64Array:

                child1.setUseKind(KnownCellUse);

                child2.setUseKind(Int32Use);

                fixDoubleEdge(child3);

                break;

            default:

                child1.setUseKind(KnownCellUse);

                child2.setUseKind(Int32Use);

                break;

            }

            break;

        }

@@private:

                    node->child1()->prediction() & SpecCell,

                    SpecInt32,

                    node->child2()->prediction()));

166 blessArrayOperation(node->child1(), Edge(), 2);

460 blessArrayOperation(node->child1(), Edge(), node->child3());

461 node->child1().setUseKind(KnownCellUse);

167462

168463 switch (node->arrayMode().type()) {

            case Array::Int32:

                node->child2().setUseKind(Int32Use);

                break;

169467 case Array::Double:

170 fixDoubleEdge(1);

468 fixDoubleEdge(node->child2());

                break;

            default:

                break;

@@private:

        }

        case ArrayPop: {

            blessArrayOperation(node->child1(), Edge(), 1);

            break;

        }

        case BitAnd:

        case BitOr:

        case BitXor:

        case BitRShift:

        case BitLShift:

        case BitURShift: {

            fixIntEdge(node->children.child1());

            fixIntEdge(node->children.child2());

            break;

        }

        case CompareEq:

        case CompareLess:

        case CompareLessEq:

        case CompareGreater:

        case CompareGreaterEq:

        case CompareStrictEq: {

            if (Node::shouldSpeculateInteger(node->child1().node(), node->child2().node()))

                break;

            if (!Node::shouldSpeculateNumber(node->child1().node(), node->child2().node()))

                break;

            fixDoubleEdge(0);

            fixDoubleEdge(1);

477 blessArrayOperation(node->child1(), Edge(), node->child2());

478 node->child1().setUseKind(KnownCellUse);

            break;

        }

        case LogicalNot: {

            if (node->child1()->shouldSpeculateInteger())

                break;

            if (!node->child1()->shouldSpeculateNumber())

                break;

            fixDoubleEdge(0);

        case RegExpExec:

        case RegExpTest: {

            node->child1().setUseKind(CellUse);

            node->child2().setUseKind(CellUse);

            break;

        }

        case Branch: {

            if (!node->child1()->shouldSpeculateInteger()

                && node->child1()->shouldSpeculateNumber())

                fixDoubleEdge(0);

            if (node->child1()->shouldSpeculateBoolean())

                node->child1().setUseKind(BooleanUse);

            else if (node->child1()->shouldSpeculateObjectOrOther())

                node->child1().setUseKind(ObjectOrOtherUse);

            else if (node->child1()->shouldSpeculateInteger())

                node->child1().setUseKind(Int32Use);

            else if (node->child1()->shouldSpeculateNumber())

                fixDoubleEdge(node->child1());

            Node* logicalNot = node->child1().node();

            if (logicalNot->op() == LogicalNot

@@private:

            break;

        }

        case SetLocal: {

            if (node->variableAccessData()->isCaptured())

                break;

            if (!node->variableAccessData()->shouldUseDoubleFormat())

                break;

            fixDoubleEdge(0, ForwardSpeculation);

        case ToPrimitive: {

            if (node->child1()->shouldSpeculateInteger())

                node->child1().setUseKind(Int32Use);

            // FIXME: Add string speculation here.

            // https://bugs.webkit.org/show_bug.cgi?id=110175

            break;

        }

        case ArithAdd:

        case ValueAdd: {

            if (m_graph.addShouldSpeculateInteger(node))

        case NewArray: {

            for (unsigned i = m_graph.varArgNumChildren(node); i--;) {

                node->setIndexingType(

                    leastUpperBoundOfIndexingTypeAndType(

                        node->indexingType(), m_graph.varArgChild(node, i)->prediction()));

            }

            switch (node->indexingType()) {

            case ALL_BLANK_INDEXING_TYPES:

                CRASH();

                break;

            case ALL_UNDECIDED_INDEXING_TYPES:

                if (node->numChildren()) {

                    // This will only happen if the children have no type predictions. We

                    // would have already exited by now, but insert a forced exit just to

                    // be safe.

                    m_insertionSet.insertNode(

                        m_indexInBlock, DontRefChildren, DontRefNode, SpecNone, ForceOSRExit,

                        node->codeOrigin);

                }

                break;

            case ALL_INT32_INDEXING_TYPES:

                for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                    m_graph.m_varArgChildren[node->firstChild() + operandIndex].setUseKind(Int32Use);

                break;

            case ALL_DOUBLE_INDEXING_TYPES:

                for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)

                    m_graph.m_varArgChildren[node->firstChild() + operandIndex].setUseKind(RealNumberUse);

276575 break;

277 if (!Node::shouldSpeculateNumberExpectingDefined(node->child1().node(), node->child2().node()))

576 case ALL_CONTIGUOUS_INDEXING_TYPES:

577 case ALL_ARRAY_STORAGE_INDEXING_TYPES:

278578 break;

279 fixDoubleEdge(0);

280 fixDoubleEdge(1);

            default:

                CRASH();

                break;

            }

            break;

        }

        case ArithSub: {

            if (m_graph.addShouldSpeculateInteger(node)

                && node->canSpeculateInteger())

                break;

            fixDoubleEdge(0);

            fixDoubleEdge(1);

586 case NewArrayWithSize: {

587 node->child1().setUseKind(Int32Use);

            break;

        }

        case ArithNegate: {

            if (m_graph.negateShouldSpeculateInteger(node))

                break;

            fixDoubleEdge(0);

        case ConvertThis: {

            // FIXME: Use Phantom(type check) and Identity instead.

            // https://bugs.webkit.org/show_bug.cgi?id=110395

            if (isOtherSpeculation(node->child1()->prediction()))

                node->child1().setUseKind(OtherUse);

            else if (isObjectSpeculation(node->child1()->prediction()))

                node->child1().setUseKind(ObjectUse);

            break;

        }

        case ArithMin:

        case ArithMax:

        case ArithMod: {

            if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())

                && node->canSpeculateInteger())

                break;

            fixDoubleEdge(0);

            fixDoubleEdge(1);

601 case CreateThis: {

602 node->child1().setUseKind(CellUse);

            break;

        }

        case ArithMul: {

            if (m_graph.mulShouldSpeculateInteger(node))

                break;

            fixDoubleEdge(0);

            fixDoubleEdge(1);

        case GetMyArgumentByVal:

        case GetMyArgumentByValSafe: {

            node->child1().setUseKind(Int32Use);

316609 break;

317610 }

        case ArithDiv: {

            if (Node::shouldSpeculateIntegerForArithmetic(node->child1().node(), node->child2().node())

                && node->canSpeculateInteger()) {

                if (isX86() || isARMv7s())

                    break;

                injectInt32ToDoubleNode(0);

                injectInt32ToDoubleNode(1);

                // We don't need to do ref'ing on the children because we're stealing them from

                // the original division.

                Node* newDivision = m_insertionSet.insertNode(

                    m_indexInBlock, DontRefChildren, RefNode, SpecDouble, *node);

                node->setOp(DoubleAsInt32);

                node->children.initialize(Edge(newDivision, DoubleUse), Edge(), Edge());

                break;

            }

            fixDoubleEdge(0);

            fixDoubleEdge(1);

            
        case GetScopeRegisters:

        case PutScopedVar:

        case SkipTopScope:

        case SkipScope:

        case SetCallee:

        case SetMyScope:

        case PutStructure:

        case AllocatePropertyStorage:

        case ReallocatePropertyStorage:

        case GetScope:

        case GetButterfly: {

            node->child1().setUseKind(KnownCellUse);

            break;

        }

        case ArithAbs: {

            if (node->child1()->shouldSpeculateIntegerForArithmetic()

                && node->canSpeculateInteger())

        case GetById: {

            if (!node->child1()->shouldSpeculateCell())

                break;

            node->child1().setUseKind(CellUse);

            if (!isInt32Speculation(node->prediction()))

                break;

            if (codeBlock()->identifier(node->identifierNumber()) != globalData().propertyNames->length)

344634 break;

345 fixDoubleEdge(0);

            ArrayProfile* arrayProfile = 

                m_graph.baselineCodeBlockFor(node->codeOrigin)->getArrayProfile(

                    node->codeOrigin.bytecodeIndex);

            ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);

            if (arrayProfile) {

                arrayProfile->computeUpdatedPrediction(m_graph.baselineCodeBlockFor(node->codeOrigin));

                arrayMode = ArrayMode::fromObserved(arrayProfile, Array::Read, false);

                arrayMode = arrayMode.refine(

                    node->child1()->prediction(), node->prediction());

                if (arrayMode.supportsLength() && arrayProfile->hasDefiniteStructure()) {

                    m_insertionSet.insertNode(

                        m_indexInBlock, RefChildren, DontRefNode, SpecNone, CheckStructure,

                        node->codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())),

                        node->child1());

                }

            } else

                arrayMode = arrayMode.refine(node->child1()->prediction(), node->prediction());

            if (!arrayMode.supportsLength())

                break;

            node->setOp(GetArrayLength);

            ASSERT(node->flags() & NodeMustGenerate);

            node->clearFlags(NodeMustGenerate | NodeClobbersWorld);

            node->child1().setUseKind(KnownCellUse);

            m_graph.deref(node);

            node->setArrayMode(arrayMode);

            Node* storage = checkArray(arrayMode, node->codeOrigin, node->child1().node(), 0, lengthNeedsStorage, node->shouldGenerate());

            if (!storage)

                break;

            node->child2() = Edge(storage);

            break;

        }

349 case ArithSqrt: {

350 fixDoubleEdge(0);

        case GetByIdFlush: {

            if (node->child1()->shouldSpeculateCell())

                node->child1().setUseKind(CellUse);

            break;

        }

        case PutByVal:

        case PutByValAlias: {

            Edge child1 = m_graph.varArgChild(node, 0);

            Edge child2 = m_graph.varArgChild(node, 1);

            Edge child3 = m_graph.varArgChild(node, 2);

            node->setArrayMode(

                node->arrayMode().refine(

                    child1->prediction(),

                    child2->prediction(),

                    child3->prediction()));

            blessArrayOperation(child1, child2, 3);

        case CheckExecutable:

        case CheckStructure:

        case ForwardCheckStructure:

        case StructureTransitionWatchpoint:

        case ForwardStructureTransitionWatchpoint:

        case CheckFunction:

        case PutById:

        case PutByIdDirect:

        case CheckHasInstance: {

            node->child1().setUseKind(CellUse);

            break;

        }

367687

            switch (node->arrayMode().modeForPut().type()) {

            case Array::Double:

                fixDoubleEdge(2);

                break;

            case Array::Int8Array:

            case Array::Int16Array:

            case Array::Int32Array:

            case Array::Uint8Array:

            case Array::Uint8ClampedArray:

            case Array::Uint16Array:

            case Array::Uint32Array:

                if (!child3->shouldSpeculateInteger())

                    fixDoubleEdge(2);

                break;

            case Array::Float32Array:

            case Array::Float64Array:

                fixDoubleEdge(2);

        case CheckArray: {

            switch (node->arrayMode().type()) {

            case Array::String:

                node->child1().setUseKind(StringUse);

385692 break;

386693 default:

694 node->child1().setUseKind(CellUse);

                break;

            }

            break;

        }

        case NewArray: {

            for (unsigned i = m_graph.varArgNumChildren(node); i--;) {

                node->setIndexingType(

                    leastUpperBoundOfIndexingTypeAndType(

                        node->indexingType(), m_graph.varArgChild(node, i)->prediction()));

            }

            if (node->indexingType() == ArrayWithDouble) {

                for (unsigned i = m_graph.varArgNumChildren(node); i--;)

                    fixDoubleEdge(i);

            }

        case Arrayify:

        case ArrayifyToStructure: {

            node->child1().setUseKind(CellUse);

            if (node->child2())

                node->child2().setUseKind(Int32Use);

            break;

        }

        case GetByOffset: {

            if (!node->child1()->hasStorageResult())

                node->child1().setUseKind(KnownCellUse);

            break;

        }

        case PutByOffset: {

            if (!node->child1()->hasStorageResult())

                node->child1().setUseKind(KnownCellUse);

            node->child2().setUseKind(KnownCellUse);

            break;

        }

        case InstanceOf: {

            // FIXME: This appears broken: CheckHasInstance already does an unconditional cell

            // check. https://bugs.webkit.org/show_bug.cgi?id=107479

            if (!(node->child1()->prediction() & ~SpecCell))

                node->child1().setUseKind(CellUse);

            node->child2().setUseKind(CellUse);

            break;

        }

        case GetArrayLength:

        case Identity:

        case Nop:

        case Phi:

        case ForwardInt32ToDouble:

        case PhantomPutStructure:

        case GetIndexedPropertyStorage:

        case LastNodeType:

            RELEASE_ASSERT_NOT_REACHED();

            break;

#if !ASSERT_DISABLED    

        // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.

        case SetArgument:

        case Phantom:

        case JSConstant:

        case WeakJSConstant:

        case GetLocal:

        case GetCallee:

        case Flush:

        case PhantomLocal:

        case GetLocalUnlinked:

        case InlineStart:

        case GetMyScope:

        case GetScopedVar:

        case GetGlobalVar:

        case PutGlobalVar:

        case GlobalVarWatchpoint:

        case PutGlobalVarCheck:

        case AllocationProfileWatchpoint:

        case Call:

        case Construct:

        case NewObject:

        case NewArrayBuffer:

        case NewRegexp:

        case Resolve:

        case ResolveBase:

        case ResolveBaseStrictPut:

        case ResolveGlobal:

        case Breakpoint:

        case IsUndefined:

        case IsBoolean:

        case IsNumber:

        case IsString:

        case IsObject:

        case IsFunction:

        case StrCat:

        case CreateActivation:

        case TearOffActivation:

        case CreateArguments:

        case PhantomArguments:

        case TearOffArguments:

        case GetMyArgumentsLength:

        case GetMyArgumentsLengthSafe:

        case CheckArgumentsNotCreated:

        case NewFunction:

        case NewFunctionNoCheck:

        case NewFunctionExpression:

        case Jump:

        case Return:

        case Throw:

        case ThrowReferenceError:

        case GarbageValue:

        case CountExecution:

        case ForceOSRExit:

            break;

#else

405797 default:

406798 break;

799#endif

        }

#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)

@@private:

        
        Structure* structure = arrayMode.originalArrayStructure(m_graph, codeOrigin);

817 Edge indexEdge = index ? Edge(index, Int32Use) : Edge();

818

        if (arrayMode.doesConversion()) {

            if (structure) {

                if (m_indexInBlock > 0) {

@@private:

                
                m_insertionSet.insertNode(

                    m_indexInBlock, RefChildren, DontRefNode, SpecNone, ArrayifyToStructure, codeOrigin,

438 OpInfo(structure), OpInfo(arrayMode.asWord()), array, index);

833 OpInfo(structure), OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);

            } else {

                m_insertionSet.insertNode(

                    m_indexInBlock, RefChildren, DontRefNode, SpecNone, Arrayify, codeOrigin,

442 OpInfo(arrayMode.asWord()), array, index);

837 OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);

            }

        } else {

            if (structure) {

                m_insertionSet.insertNode(

                    m_indexInBlock, RefChildren, DontRefNode, SpecNone, CheckStructure, codeOrigin,

448 OpInfo(m_graph.addStructureSet(structure)), array);

843 OpInfo(m_graph.addStructureSet(structure)), Edge(array, CellUse));

            } else {

                m_insertionSet.insertNode(

                    m_indexInBlock, RefChildren, DontRefNode, SpecNone, CheckArray, codeOrigin,

452 OpInfo(arrayMode.asWord()), array);

847 OpInfo(arrayMode.asWord()), Edge(array, CellUse));

            }

        }

@@private:

                m_indexInBlock,

                shouldGenerate ? RefChildren : DontRefChildren,

                shouldGenerate ? RefNode : DontRefNode,

464 SpecNone, GetButterfly, codeOrigin, array);

859 SpecNone, GetButterfly, codeOrigin, Edge(array, KnownCellUse));

        }

        return m_insertionSet.insertNode(

            m_indexInBlock,

            shouldGenerate ? RefChildren : DontRefChildren,

            shouldGenerate ? RefNode : DontRefNode,

471 SpecNone, GetIndexedPropertyStorage, codeOrigin, OpInfo(arrayMode.asWord()), array);

866 SpecNone, GetIndexedPropertyStorage, codeOrigin, OpInfo(arrayMode.asWord()), Edge(array, KnownCellUse));

472867 }

473868

474 void blessArrayOperation(Edge base, Edge index, ~~unsi~~gned storageChild~~Idx~~)

869 void blessArrayOperation(Edge base, Edge index, Edge& storageChild)

475870 {

        if (m_graph.m_fixpointState > BeforeFixpoint)

            return;

        Node* node = m_currentNode;

        switch (node->arrayMode().type()) {

@@private:

            if (!storage)

                return;

502 ~~m_graph.child(node,~~ storageChild~~Idx)~~ = Edge(storage);

894 storageChild = Edge(storage);

            return;

        } }

    }

@@private:

    void fixIntEdge(Edge& edge)

    {

        Node* node = edge.node();

        if (node->op() != ValueToInt32)

            return;

        if (!node->child1()->shouldSpeculateInteger())

902 if (node->op() != ValueToInt32) {

903 edge.setUseKind(KnownInt32Use);

514904 return;

905 }

        
        Edge oldEdge = edge;

        Edge newEdge = node->child1();

        if (newEdge.useKind() != Int32Use) {

            edge.setUseKind(KnownInt32Use);

            return;

        }

        ASSERT(newEdge->shouldSpeculateInteger());

        m_graph.ref(newEdge);

        m_graph.deref(oldEdge);

        edge = newEdge;

    }

525 void fixDoubleEdge(~~unsi~~gned ch~~ildI~~ndex, SpeculationDirection direction = BackwardSpeculation)

923 void fixDoubleEdge(Edge& edge, UseKind useKind = NumberUse, SpeculationDirection direction = BackwardSpeculation)

526924 {

        Node* source = m_currentNode;

        Edge& edge = m_graph.child(source, childIndex);

530925 if (edge->prediction() & SpecDouble) {

531 edge.setUseKind(Do~~ubleU~~se);

926 edge.setUseKind(useKind);

            return;

        }

535 injectInt32ToDoubleNode(ch~~ildIndex~~, direction);

930 injectInt32ToDoubleNode(edge, useKind, direction);

536931 }

537932

538 void injectInt32ToDoubleNode(~~unsi~~gned ch~~ildI~~ndex, SpeculationDirection direction = BackwardSpeculation)

933 void injectInt32ToDoubleNode(Edge& edge, UseKind useKind = NumberUse, SpeculationDirection direction = BackwardSpeculation)

    {

        Node* result = m_insertionSet.insertNode(

            m_indexInBlock, DontRefChildren, RefNode, SpecDouble,

            direction == BackwardSpeculation ? Int32ToDouble : ForwardInt32ToDouble,

543 m_currentNode->codeOrigin, m_~~graph.child(m_currentNode, childIndex)~~.node());

938 m_currentNode->codeOrigin, Edge(edge.node(), NumberUse));

        
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)

        dataLogF(

            "(replacing @%u->@%u with @%u->@%u) ",

548 m_currentNode->index(), m_~~graph.child(m_currentNode, childIndex)~~->index(), m_currentNode->index(), result->index());

943 m_currentNode->index(), edge->index(), m_currentNode->index(), result->index());

549944#endif

550945

551 m_graph.child(m_currentNode, childIndex) = Edge(result, DoubleUse);

        edge = Edge(result, useKind);

    }

    void truncateConstantToInt32(Edge& edge)

    {

        Node* oldNode = edge.node();

        ASSERT(oldNode->hasConstant());

        JSValue value = m_graph.valueOfJSConstant(oldNode);

        if (value.isInt32())

            return;

        value = jsNumber(JSC::toInt32(value.asNumber()));

        ASSERT(value.isInt32());

        edge.setNode(m_insertionSet.insertNode(

            m_indexInBlock, DontRefChildren, RefNode, SpecInt32, JSConstant,

            m_currentNode->codeOrigin, OpInfo(codeBlock()->addOrFindConstant(value))));

        m_graph.deref(oldNode);

    }

    void truncateConstantsIfNecessary(Node* node, AddSpeculationMode mode)

    {

        if (mode != SpeculateIntegerAndTruncateConstants)

            return;

        ASSERT(node->child1()->hasConstant() || node->child2()->hasConstant());

        if (node->child1()->hasConstant())

            truncateConstantToInt32(node->child1());

        else

            truncateConstantToInt32(node->child2());

    }

    bool attemptToMakeIntegerAdd(Node* node)

    {

        AddSpeculationMode mode = m_graph.addSpeculationMode(node);

        if (mode == DontSpeculateInteger)

            return false;

        truncateConstantsIfNecessary(node, mode);

        node->child1().setUseKind(Int32Use);

        node->child2().setUseKind(Int32Use);

        return true;

    }

    BasicBlock* m_block;

143562

Source/JavaScriptCore/dfg/DFGGraph.cpp

@@void Graph::dump(PrintStream& out)

    }

}

// FIXME: Convert this to be iterative, not recursive.

#define DO_TO_CHILDREN(node, thingToDo) do {                            \

        Node* _node = (node);                                           \

        if (_node->flags() & NodeHasVarArgs) {                          \

            for (unsigned _childIdx = _node->firstChild();              \

                _childIdx < _node->firstChild() + _node->numChildren(); \

                _childIdx++) {                                          \

                if (!!m_varArgChildren[_childIdx])                      \

                    thingToDo(m_varArgChildren[_childIdx]);             \

            }                                                           \

        } else {                                                        \

            if (!_node->child1()) {                                     \

                ASSERT(                                                 \

                    !_node->child2()                                    \

                    && !_node->child3());                               \

                break;                                                  \

            }                                                           \

            thingToDo(_node->child1());                                 \

                                                                        \

            if (!_node->child2()) {                                     \

                ASSERT(!_node->child3());                               \

                break;                                                  \

            }                                                           \

            thingToDo(_node->child2());                                 \

                                                                        \

            if (!_node->child3())                                       \

                break;                                                  \

            thingToDo(_node->child3());                                 \

        }                                                               \

    } while (false)

380349void Graph::refChildren(Node* op)

381350{

382 DO_TO_CHILDREN(op, ref);

351 DFG_NODE_DO_TO_CHILDREN(*this, op, ref);

}

void Graph::derefChildren(Node* op)

{

387 DO_TO_CHILDREN(op, deref);

356 DFG_NODE_DO_TO_CHILDREN(*this, op, deref);

}

void Graph::dethread()

143562

Source/JavaScriptCore/dfg/DFGGraph.h

@@struct PutToBaseOperationData {

enum AddSpeculationMode {

    DontSpeculateInteger,

80 SpeculateIntegerB~~utAlwaysWatchOverfl~~ow,

80 SpeculateIntegerAndTruncateConstants,

    SpeculateInteger

};

@@public:

            refChildren(node);

        return node;

    }

103 Edge ref(Edge no~~deUs~~e)

103 Edge ref(Edge edge)

104104 {

105 ref(nodeUse.node());

106 return nodeUse;

        ref(edge.node());

        return edge;

    }

    Edge ref(Node*, Edge edge)

    {

        return ref(edge);

    }

    void deref(Node* node)

@@public:

        if (node->postfixDeref() == 1)

            derefChildren(node);

    }

118 void deref(Edge no~~deUs~~e)

122 void deref(Edge edge)

119123 {

120 deref(nodeUse.node());

        deref(edge.node());

    }

    void deref(Node*, Edge edge)

    {

        deref(edge);

    }

    // When a node's refCount goes from 0 to 1, it must (logically) recursively ref all of its children, and vice versa.

@@public:

            for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++)

                performSubstitutionForEdge(m_varArgChildren[childIdx], shouldGenerate);

        } else {

            performSubstitutionForEdge(node->children.child1(), shouldGenerate);

            performSubstitutionForEdge(node->children.child2(), shouldGenerate);

            performSubstitutionForEdge(node->children.child3(), shouldGenerate);

            performSubstitutionForEdge(node->child1(), shouldGenerate);

            performSubstitutionForEdge(node->child2(), shouldGenerate);

            performSubstitutionForEdge(node->child3(), shouldGenerate);

        }

    }

@@public:

    
    bool isPredictedNumerical(Node* node)

    {

        SpeculatedType left = node->child1()->prediction();

        SpeculatedType right = node->child2()->prediction();

        return isNumberSpeculation(left) && isNumberSpeculation(right);

541 return isNumerical(node->child1().useKind()) && isNumerical(node->child2().useKind());

    }

    // Note that a 'true' return does not actually mean that the ByVal access clobbers nothing.

@@private:

        if (doubleImmediate < -twoToThe48 || doubleImmediate > twoToThe48)

            return DontSpeculateInteger;

784 return nodeCanTruncateInteger(add->arithNodeFlags()) ? SpeculateIntegerB~~utAlwaysWatchOverfl~~ow : DontSpeculateInteger;

790 return nodeCanTruncateInteger(add->arithNodeFlags()) ? SpeculateIntegerAndTruncateConstants : DontSpeculateInteger;

    }

    bool mulImmediateShouldSpeculateInteger(Node* mul, Node* variable, Node* immediate)

@@inline BlockIndex Graph::blockIndexForBy

    return *binarySearch<BlockIndex, unsigned>(linkingTargets, linkingTargets.size(), bytecodeBegin, GetBytecodeBeginForBlock(*this));

}

#define DFG_NODE_DO_TO_CHILDREN(graph, node, thingToDo) do {            \

        Node* _node = (node);                                           \

        if (_node->flags() & NodeHasVarArgs) {                          \

            for (unsigned _childIdx = _node->firstChild();              \

                _childIdx < _node->firstChild() + _node->numChildren(); \

                _childIdx++) {                                          \

                if (!!(graph).m_varArgChildren[_childIdx])              \

                    thingToDo(_node, (graph).m_varArgChildren[_childIdx]); \

            }                                                           \

        } else {                                                        \

            if (!_node->child1()) {                                     \

                ASSERT(                                                 \

                    !_node->child2()                                    \

                    && !_node->child3());                               \

                break;                                                  \

            }                                                           \

            thingToDo(_node, _node->child1());                          \

                                                                        \

            if (!_node->child2()) {                                     \

                ASSERT(!_node->child3());                               \

                break;                                                  \

            }                                                           \

            thingToDo(_node, _node->child2());                          \

                                                                        \

            if (!_node->child3())                                       \

                break;                                                  \

            thingToDo(_node, _node->child3());                          \

        }                                                               \

    } while (false)

} } // namespace JSC::DFG

#endif

143562

Source/JavaScriptCore/dfg/DFGNode.h

@@struct Node {

        , m_prediction(SpecNone)

    {

        setOpAndDefaultFlags(op);

98 ASSERT(!!(m_flags & NodeHasVarArgs) == (children.kind() == AdjacencyList::Variable));

    }

    // Construct a node with up to 3 children, no immediate value.

102 Node(NodeType op, CodeOrigin codeOrigin, Node* child1 = 0~~, No~~de* child2 = 0~~, No~~de* child3 = 0)

101 Node(NodeType op, CodeOrigin codeOrigin, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())

        : codeOrigin(codeOrigin)

        , children(AdjacencyList::Fixed, child1, child2, child3)

        , m_virtualRegister(InvalidVirtualRegister)

@@struct Node {

    }

    // Construct a node with up to 3 children and an immediate value.

114 Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm, Node* child1 = 0~~, No~~de* child2 = 0~~, No~~de* child3 = 0)

113 Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())

        : codeOrigin(codeOrigin)

        , children(AdjacencyList::Fixed, child1, child2, child3)

        , m_virtualRegister(InvalidVirtualRegister)

@@struct Node {

    }

    // Construct a node with up to 3 children and two immediate values.

127 Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm1, OpInfo imm2, Node* child1 = 0~~, No~~de* child2 = 0~~, No~~de* child3 = 0)

126 Node(NodeType op, CodeOrigin codeOrigin, OpInfo imm1, OpInfo imm2, Edge child1 = Edge(), Edge child2 = Edge(), Edge child3 = Edge())

        : codeOrigin(codeOrigin)

        , children(AdjacencyList::Fixed, child1, child2, child3)

        , m_virtualRegister(InvalidVirtualRegister)

@@struct Node {

        convertToStructureTransitionWatchpoint(structureSet().singletonStructure());

    }

297 void convertToGetByOffset(unsigned storageAccessDataIndex, Node* storage)

296 void convertToGetByOffset(unsigned storageAccessDataIndex, Edge storage)

    {

        ASSERT(m_op == GetById || m_op == GetByIdFlush);

        m_opInfo = storageAccessDataIndex;

301 children.setChild1(~~Edge(~~storage));

300 children.setChild1(storage);

        m_op = GetByOffset;

        m_flags &= ~NodeClobbersWorld;

    }

306 void convertToPutByOffset(unsigned storageAccessDataIndex, Node* storage)

305 void convertToPutByOffset(unsigned storageAccessDataIndex, Edge storage)

    {

        ASSERT(m_op == PutById || m_op == PutByIdDirect);

        m_opInfo = storageAccessDataIndex;

        children.setChild3(children.child2());

        children.setChild2(children.child1());

312 children.setChild1(~~Edge(~~storage));

311 children.setChild1(storage);

        m_op = PutByOffset;

        m_flags &= ~NodeClobbersWorld;

    }

@@struct Node {

        case DoubleAsInt32:

        case PhantomArguments:

            return true;

952 case Phantom:

953951 case Nop:

954952 return false;

953 case Phantom:

954 return child1().useKindUnchecked() != UntypedUse || child2().useKindUnchecked() != UntypedUse || child3().useKindUnchecked() != UntypedUse;

        default:

            return shouldGenerate();

        }

@@struct Node {

        return m_refCount--;

    }

998 Edge child1()

998 Edge& child1()

    {

        ASSERT(!(m_flags & NodeHasVarArgs));

        return children.child1();

@@struct Node {

        return children.child1Unchecked();

    }

1012 Edge child2()

1012 Edge& child2()

    {

        ASSERT(!(m_flags & NodeHasVarArgs));

        return children.child2();

    }

1018 Edge child3()

1018 Edge& child3()

    {

        ASSERT(!(m_flags & NodeHasVarArgs));

        return children.child3();

@@struct Node {

        return children.numChildren();

    }

    UseKind binaryUseKind()

    {

        ASSERT(child1().useKind() == child2().useKind());

        return child1().useKind();

    }

    bool isBinaryUseKind(UseKind useKind)

    {

        return child1().useKind() == useKind && child2().useKind() == useKind;

    }

    SpeculatedType prediction()

    {

        return m_prediction;

143562

Source/JavaScriptCore/dfg/DFGNodeAllocator.h

namespace JSC { namespace DFG {

38 typedef Allocator<Node> NodeAllocator;

#if USE(JSVALUE64)

typedef Allocator<Node, 112> NodeAllocator;

#else

typedef Allocator<Node, 80> NodeAllocator;

#endif

} } // namespace JSC::DFG

143562

Source/JavaScriptCore/dfg/DFGNodeFlags.cpp

@@namespace JSC { namespace DFG {

const char* nodeFlagsAsString(NodeFlags flags)

{

37 if (!flags)

37 if (!(flags ^ NodeDoesNotExit))

        return "<empty>";

    static const int size = 128;

143562

Source/JavaScriptCore/dfg/DFGNodeType.h

@@namespace JSC { namespace DFG {

    macro(ForwardInt32ToDouble, NodeResultNumber) \

    /* Used to speculate that a double value is actually an integer. */\

    macro(DoubleAsInt32, NodeResultInt32) \

99 /* Used to record places where we must check if a value is a number. */\

100 macro(CheckNumber, NodeMustGenerate) \

    \

    /* Nodes for arithmetic operations. */\

    macro(ArithAdd, NodeResultNumber | NodeMustGenerate) \

143562

Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@private:

        case PutStructure:

        case TearOffActivation:

        case TearOffArguments:

808 case CheckNumber:

        case CheckArgumentsNotCreated:

        case GlobalVarWatchpoint:

        case GarbageValue:

143562

Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@namespace JSC { namespace DFG {

#if USE(JSVALUE32_64)

43 GPRReg SpeculativeJIT::fillInteger(Node* node, DataFormat& returnFormat)

43GPRReg SpeculativeJIT::fillInteger(Edge edge, DataFormat& returnFormat)

4444{

45 VirtualRegister virtualRegister = node->virtualRegister();

    ASSERT(!needsTypeCheck(edge, SpecInt32));

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    if (info.registerFormat() == DataFormatNone) {

        GPRReg gpr = allocate();

51 if (node->hasConstant()) {

53 if (edge->hasConstant()) {

5254 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

            if (isInt32Constant(node))

                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

            else if (isNumberConstant(node))

            if (isInt32Constant(edge.node()))

                m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

            else if (isNumberConstant(edge.node()))

5658 RELEASE_ASSERT_NOT_REACHED();

5759 else {

58 ASSERT(isJSConstant(node));

59 JSValue jsValue = valueOfJSConstant(node);

60 ASSERT(isJSConstant(edge.node()));

61 JSValue jsValue = valueOfJSConstant(edge.node());

                m_jit.move(MacroAssembler::Imm32(jsValue.payload()), gpr);

            }

        } else {

@@GPRReg SpeculativeJIT::fillInteger(Node*

    }

}

116 bool SpeculativeJIT::fillJSValue(Node* node, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)

118bool SpeculativeJIT::fillJSValue(Edge edge, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)

{

    // FIXME: For double we could fill with a FPR.

    UNUSED_PARAM(fpr);

121 VirtualRegister virtualRegister = node->virtualRegister();

123 VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

    case DataFormatNone: {

127 if (node->hasConstant()) {

129 if (edge->hasConstant()) {

128130 tagGPR = allocate();

129131 payloadGPR = allocate();

130 m_jit.move(Imm32(valueOfJSConstant(node).tag()), tagGPR);

131 m_jit.move(Imm32(valueOfJSConstant(node).payload()), payloadGPR);

132 m_jit.move(Imm32(valueOfJSConstant(edge.node()).tag()), tagGPR);

133 m_jit.move(Imm32(valueOfJSConstant(edge.node()).payload()), payloadGPR);

132134 m_gprs.retain(tagGPR, virtualRegister, SpillOrderConstant);

133135 m_gprs.retain(payloadGPR, virtualRegister, SpillOrderConstant);

134 info.fillJSValue(*m_stream, tagGPR, payloadGPR, isInt32Constant(node) ? DataFormatJSInteger : DataFormatJS);

136 info.fillJSValue(*m_stream, tagGPR, payloadGPR, isInt32Constant(edge.node()) ? DataFormatJSInteger : DataFormatJS);

        } else {

            DataFormat spillFormat = info.spillFormat();

            ASSERT(spillFormat != DataFormatNone && spillFormat != DataFormatStorage);

@@void SpeculativeJIT::emitCall(Node* node

}

template<bool strict>

847 GPRReg SpeculativeJIT::fillSpeculateIntInternal(Node* node, DataFormat& returnFormat, SpeculationDirection direction)

849GPRReg SpeculativeJIT::fillSpeculateIntInternal(Edge edge, DataFormat& returnFormat, SpeculationDirection direction)

848850{

849851#if DFG_ENABLE(DEBUG_VERBOSE)

850 dataLogF("SpecInt@%d ", node->index());

852 dataLogF("SpecInt@%d ", edge->index());

851853#endif

852 SpeculatedType type = m_state.forNode(node).m_type;

853 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));

    value.filter(SpecInt32);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

    case DataFormatNone: {

858 if ((node->hasConstant() && !isInt32Constant(node)) || info.spillFormat() == DataFormatDouble) {

863 if ((edge->hasConstant() && !isInt32Constant(edge.node())) || info.spillFormat() == DataFormatDouble) {

            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0, direction);

            returnFormat = DataFormatInteger;

            return allocate();

        }

864 if (node->hasConstant()) {

865 ASSERT(isInt32Constant(node));

869 if (edge->hasConstant()) {

870 ASSERT(isInt32Constant(edge.node()));

866871 GPRReg gpr = allocate();

867 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

872 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

            info.fillInteger(*m_stream, gpr);

            returnFormat = DataFormatInteger;

@@GPRReg SpeculativeJIT::fillSpeculateIntI

        ASSERT_UNUSED(spillFormat, (spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);

        // If we know this was spilled as an integer we can fill without checking.

878 if (~~!is~~Int32~~Speculation(type~~))

879 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)), direction);

883 if (type & ~SpecInt32)

884 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)), direction);

        GPRReg gpr = allocate();

        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);

@@GPRReg SpeculativeJIT::fillSpeculateIntI

        GPRReg payloadGPR = info.payloadGPR();

        m_gprs.lock(tagGPR);

        m_gprs.lock(payloadGPR);

896 if (~~!is~~Int32~~Speculation(type~~))

897 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::Int32Tag)), direction);

901 if (type & ~SpecInt32)

902 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::Int32Tag)), direction);

        m_gprs.unlock(tagGPR);

        m_gprs.release(tagGPR);

        m_gprs.release(payloadGPR);

@@GPRReg SpeculativeJIT::fillSpeculateIntI

    }

}

932 GPRReg SpeculativeJIT::fillSpeculateInt(Node* node, DataFormat& returnFormat, SpeculationDirection direction)

937GPRReg SpeculativeJIT::fillSpeculateInt(Edge edge, DataFormat& returnFormat, SpeculationDirection direction)

933938{

934 return fillSpeculateIntInternal<false>(node, returnFormat, direction);

939 return fillSpeculateIntInternal<false>(edge, returnFormat, direction);

935940}

936941

937 GPRReg SpeculativeJIT::fillSpeculateIntStrict(Node* node)

942GPRReg SpeculativeJIT::fillSpeculateIntStrict(Edge edge)

938943{

939944 DataFormat mustBeDataFormatInteger;

940 GPRReg result = fillSpeculateIntInternal<true>(node, mustBeDataFormatInteger, BackwardSpeculation);

945 GPRReg result = fillSpeculateIntInternal<true>(edge, mustBeDataFormatInteger, BackwardSpeculation);

    ASSERT(mustBeDataFormatInteger == DataFormatInteger);

    return result;

}

945 FPRReg SpeculativeJIT::fillSpeculateDouble(Node* node, SpeculationDirection direction)

950FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge, SpeculationDirection direction)

946951{

947952#if DFG_ENABLE(DEBUG_VERBOSE)

948 dataLogF("SpecDouble@%d ", node->index());

953 dataLogF("SpecDouble@%d ", edge->index());

949954#endif

950 SpeculatedType type = m_state.forNode(node).m_type;

951 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownNumberUse || !(value.m_type & ~SpecNumber));

    value.filter(SpecNumber);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    if (info.registerFormat() == DataFormatNone) {

956 if (node->hasConstant()) {

957 if (isInt32Constant(node)) {

964 if (edge->hasConstant()) {

965 if (isInt32Constant(edge.node())) {

958966 GPRReg gpr = allocate();

959 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

967 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

                info.fillInteger(*m_stream, gpr);

                unlock(gpr);

963 } else if (isNumberConstant(node)) {

971 } else if (isNumberConstant(edge.node())) {

964972 FPRReg fpr = fprAllocate();

965 m_jit.loadDouble(addressOfDoubleConstant(node), fpr);

973 m_jit.loadDouble(addressOfDoubleConstant(edge.node()), fpr);

                m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);

                info.fillDouble(*m_stream, fpr);

                return fpr;

@@FPRReg SpeculativeJIT::fillSpeculateDoub

            if (spillFormat != DataFormatJSInteger && spillFormat != DataFormatInteger) {

                JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag));

989 if (~~!is~~Number~~Speculation(type~~))

990 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), node, m_jit.branch32(MacroAssembler::AboveOrEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::LowestTag)), direction);

997 if (type & ~SpecNumber)

998 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::LowestTag)), direction);

                m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);

                hasUnboxedDouble = m_jit.jump();

@@FPRReg SpeculativeJIT::fillSpeculateDoub

        if (info.registerFormat() != DataFormatJSInteger) {

            FPRTemporary scratch(this);

            JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

1024 if (~~!is~~Number~~Speculation(type~~))

1025 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node, m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)), direction);

1032 if (type & ~SpecNumber)

1033 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)), direction);

            unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());

            hasUnboxedDouble = m_jit.jump();

            isInteger.link(&m_jit);

@@FPRReg SpeculativeJIT::fillSpeculateDoub

    }

}

1079 GPRReg SpeculativeJIT::fillSpeculateCell(Node* node, SpeculationDirection direction)

1087GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge, SpeculationDirection direction)

10801088{

10811089#if DFG_ENABLE(DEBUG_VERBOSE)

1082 dataLogF("SpecCell@%d ", node->index());

1090 dataLogF("SpecCell@%d ", edge->index());

10831091#endif

1084 SpeculatedType type = m_state.forNode(node).m_type;

1085 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownCellUse || !(value.m_type & ~SpecCell));

    value.filter(SpecCell);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

    case DataFormatNone: {

1091 if (node->hasConstant()) {

1092 JSValue jsValue = valueOfJSConstant(node);

1102 if (edge->hasConstant()) {

1103 JSValue jsValue = valueOfJSConstant(edge.node());

            GPRReg gpr = allocate();

            if (jsValue.isCell()) {

                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

@@GPRReg SpeculativeJIT::fillSpeculateCell

        }

        ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatCell);

1105 if (~~!is~~Cell~~Speculation(type~~))

1106 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)), direction);

1116 if (type & ~SpecCell)

1117 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)), direction);

        GPRReg gpr = allocate();

        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);

        m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);

@@GPRReg SpeculativeJIT::fillSpeculateCell

        GPRReg payloadGPR = info.payloadGPR();

        m_gprs.lock(tagGPR);

        m_gprs.lock(payloadGPR);

1126 if (~~!is~~Cell~~Speculation(type~~))

1127 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag)), direction);

1137 if (type & ~SpecCell)

1138 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag)), direction);

        m_gprs.unlock(tagGPR);

        m_gprs.release(tagGPR);

        m_gprs.release(payloadGPR);

@@GPRReg SpeculativeJIT::fillSpeculateCell

    }

}

1154 GPRReg SpeculativeJIT::fillSpeculateBoolean(Node* node, SpeculationDirection direction)

1165GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge, SpeculationDirection direction)

{

#if DFG_ENABLE(DEBUG_VERBOSE)

    dataLogF("SpecBool@%d   ", node->index());

#endif

1159 SpeculatedType type = m_state.forNode(node).m_type;

1160 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    value.filter(SpecBoolean);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

@@GPRReg SpeculativeJIT::fillSpeculateBool

            return allocate();

        }

1170 if (node->hasConstant()) {

1171 JSValue jsValue = valueOfJSConstant(node);

1183 if (edge->hasConstant()) {

1184 JSValue jsValue = valueOfJSConstant(edge.node());

            GPRReg gpr = allocate();

            if (jsValue.isBoolean()) {

                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

@@GPRReg SpeculativeJIT::fillSpeculateBool

        ASSERT((info.spillFormat() & DataFormatJS) || info.spillFormat() == DataFormatBoolean);

1185 if (~~!is~~Boolean~~Speculation(type~~))

1186 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), node, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)), direction);

1198 if (type & ~SpecBoolean)

1199 speculationCheck(BadType, JSValueSource(JITCompiler::addressFor(virtualRegister)), edge, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)), direction);

        GPRReg gpr = allocate();

        m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);

@@GPRReg SpeculativeJIT::fillSpeculateBool

        GPRReg payloadGPR = info.payloadGPR();

        m_gprs.lock(tagGPR);

        m_gprs.lock(payloadGPR);

1207 if (~~!is~~Boolean~~Speculation(type~~))

1208 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::BooleanTag)), direction);

1220 if (type & ~SpecBoolean)

1221 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), edge, m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::BooleanTag)), direction);

        m_gprs.unlock(tagGPR);

        m_gprs.release(tagGPR);

@@void SpeculativeJIT::compileObjectEquali

    GPRReg op2GPR = op2.gpr();

    if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint()); 

        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(), 

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectEquali

                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));

        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(), 

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectEquali

void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)

{

    SpeculateCellOperand op1(this, leftChild);

1330 JSValueOperand op2(this, rightChild);

1331 JSValueOperand op2(this, rightChild, ManualOperandSpeculation);

    GPRTemporary result(this);

    GPRReg op1GPR = op1.gpr();

@@void SpeculativeJIT::compileObjectToObje

    
    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectToObje

    // We know that within this branch, rightChild must be a cell.

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, 

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectToObje

    
    // We know that within this branch, rightChild must not be a cell. Check if that is enough to

    // prove that it is either null or undefined.

1415 if (~~(m_state.forNod~~e(rightChild~~).m_type~~ ~~& ~~~SpecCell) & ~SpecOther) {

1406 if (needsTypeCheck(rightChild, SpecCell | SpecOther)) {

        m_jit.move(op2TagGPR, resultGPR);

        m_jit.or32(TrustedImm32(1), resultGPR);

1419 s~~peculation~~Check(

1420 ~~BadType,~~ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,

1410 typeCheck(

1411 JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,

            m_jit.branch32(

                MacroAssembler::NotEqual, resultGPR,

                MacroAssembler::TrustedImm32(JSValue::NullTag)));

@@void SpeculativeJIT::compilePeepHoleObje

    BlockIndex notTaken = branchNode->notTakenBlockIndex();

    SpeculateCellOperand op1(this, leftChild);

1442 JSValueOperand op2(this, rightChild);

1433 JSValueOperand op2(this, rightChild, ManualOperandSpeculation);

    GPRTemporary result(this);

    GPRReg op1GPR = op1.gpr();

@@void SpeculativeJIT::compilePeepHoleObje

    
    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compilePeepHoleObje

    // We know that within this branch, rightChild must be a cell.

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compilePeepHoleObje

    
    // We know that within this branch, rightChild must not be a cell. Check if that is enough to

    // prove that it is either null or undefined.

1523 if (~~(m_state.forNod~~e(rightChild~~).m_type~~ ~~& ~~~SpecCell) & ~SpecOther)

1504 if (!needsTypeCheck(rightChild, SpecCell | SpecOther))

        rightNotCell.link(&m_jit);

    else {

        jump(notTaken, ForceJump);

@@void SpeculativeJIT::compilePeepHoleObje

        m_jit.move(op2TagGPR, resultGPR);

        m_jit.or32(TrustedImm32(1), resultGPR);

1532 s~~peculation~~Check(

1533 ~~BadType,~~ JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild,

1513 typeCheck(

1514 JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild, SpecCell | SpecOther,

            m_jit.branch32(

                MacroAssembler::NotEqual, resultGPR,

                MacroAssembler::TrustedImm32(JSValue::NullTag)));

@@void SpeculativeJIT::compileValueAdd(Nod

    jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);

}

1590 void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse~~, bool needSpeculationCheck~~)

1571void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)

15911572{

1592 JSValueOperand value(this, nodeUse);

1573 JSValueOperand value(this, nodeUse, ManualOperandSpeculation);

    GPRTemporary resultPayload(this);

    GPRReg valueTagGPR = value.tagGPR();

    GPRReg valuePayloadGPR = value.payloadGPR();

@@void SpeculativeJIT::compileObjectOrOthe

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal,

                MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), structureGPR);

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        MacroAssembler::Jump isNotMasqueradesAsUndefined = 

            m_jit.branchTest8(

@@void SpeculativeJIT::compileObjectOrOthe

    notCell.link(&m_jit);

    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);

1643 if (needS~~peculation~~Check) {

1622 if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {

16441623 m_jit.move(valueTagGPR, resultPayloadGPR);

16451624 m_jit.or32(TrustedImm32(1), resultPayloadGPR);

1646 speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,

1625 typeCheck(

1626 JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,

            m_jit.branch32(

                MacroAssembler::NotEqual, 

                resultPayloadGPR, 

@@void SpeculativeJIT::compileObjectOrOthe

void SpeculativeJIT::compileLogicalNot(Node* node)

{

1661 if (node->child1()->shouldSpeculateBoolean()) {

1641 switch (node->child1().useKind()) {

1642 case BooleanUse: {

        SpeculateBooleanOperand value(this, node->child1());

        GPRTemporary result(this, value);

        m_jit.xor32(TrustedImm32(1), value.gpr(), result.gpr());

        booleanResult(result.gpr(), node);

        return;

    }

    if (node->child1()->shouldSpeculateObjectOrOther()) {

        compileObjectOrOtherLogicalNot(node->child1(), 

            !isObjectOrOtherSpeculation(m_state.forNode(node->child1()).m_type));

        
    case ObjectOrOtherUse: {

        compileObjectOrOtherLogicalNot(node->child1());

16711652 return;

16721653 }

1673 if (node->child1()->shouldSpeculateInteger()) {

1654

1655 case Int32Use: {

        SpeculateIntegerOperand value(this, node->child1());

        GPRTemporary resultPayload(this, value);

        m_jit.compare32(MacroAssembler::Equal, value.gpr(), MacroAssembler::TrustedImm32(0), resultPayload.gpr());

        booleanResult(resultPayload.gpr(), node);

        return;

    }

1680 if (node->child1()->shouldSpeculateNumber()) {

1662

1663 case NumberUse: {

        SpeculateDoubleOperand value(this, node->child1());

        FPRTemporary scratch(this);

        GPRTemporary resultPayload(this);

@@void SpeculativeJIT::compileLogicalNot(N

        return;

    }

    JSValueOperand arg1(this, node->child1());

    GPRTemporary resultPayload(this, arg1, false);

    GPRReg arg1TagGPR = arg1.tagGPR();

    GPRReg arg1PayloadGPR = arg1.payloadGPR();

    GPRReg resultPayloadGPR = resultPayload.gpr();

    case UntypedUse: {

        JSValueOperand arg1(this, node->child1());

        GPRTemporary resultPayload(this, arg1, false);

        GPRReg arg1TagGPR = arg1.tagGPR();

        GPRReg arg1PayloadGPR = arg1.payloadGPR();

        GPRReg resultPayloadGPR = resultPayload.gpr();

16971681

1698 arg1.use();

1682 arg1.use();

16991683

1700 JITCompiler::Jump slowCase = m_jit.branch32(JITCompiler::NotEqual, arg1TagGPR, TrustedImm32(JSValue::BooleanTag));

1684 JITCompiler::Jump slowCase = m_jit.branch32(JITCompiler::NotEqual, arg1TagGPR, TrustedImm32(JSValue::BooleanTag));

17011685

1702 m_jit.move(arg1PayloadGPR, resultPayloadGPR);

1686 m_jit.move(arg1PayloadGPR, resultPayloadGPR);

17031687

    addSlowPathGenerator(

        slowPathCall(

            slowCase, this, dfgConvertJSValueToBoolean, resultPayloadGPR, arg1TagGPR,

            arg1PayloadGPR));

        addSlowPathGenerator(

            slowPathCall(

                slowCase, this, dfgConvertJSValueToBoolean, resultPayloadGPR, arg1TagGPR,

                arg1PayloadGPR));

17081692

1709 m_jit.xor32(TrustedImm32(1), resultPayloadGPR);

1710 booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);

        m_jit.xor32(TrustedImm32(1), resultPayloadGPR);

        booleanResult(resultPayloadGPR, node, UseChildrenCalledExplicitly);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        break;

    }

17111702}

17121703

1713 void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken~~, bool needSpeculationCheck~~)

1704void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken)

17141705{

1715 JSValueOperand value(this, nodeUse);

1706 JSValueOperand value(this, nodeUse, ManualOperandSpeculation);

    GPRTemporary scratch(this);

    GPRReg valueTagGPR = value.tagGPR();

    GPRReg valuePayloadGPR = value.payloadGPR();

@@void SpeculativeJIT::emitObjectOrOtherBr

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), scratchGPR);

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    scratchGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, (~SpecCell) | SpecObject,

            m_jit.branchPtr(

                MacroAssembler::Equal, 

                scratchGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));

@@void SpeculativeJIT::emitObjectOrOtherBr

    notCell.link(&m_jit);

    COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);

1758 if (needS~~peculation~~Check) {

1747 if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {

17591748 m_jit.move(valueTagGPR, scratchGPR);

17601749 m_jit.or32(TrustedImm32(1), scratchGPR);

1761 speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));

        typeCheck(

            JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, SpecCell | SpecOther,

            m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));

    }

    jump(notTaken);

@@void SpeculativeJIT::emitBranch(Node* no

    BlockIndex taken = node->takenBlockIndex();

    BlockIndex notTaken = node->notTakenBlockIndex();

1774 if (node->shouldSpeculateBoolean()) {

1765 switch (node->child1().useKind()) {

1766 case BooleanUse: {

        SpeculateBooleanOperand value(this, node->child1());

        MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;

@@void SpeculativeJIT::emitBranch(Node* no

        return;

    }

    if (node->child1()->shouldSpeculateObjectOrOther()) {

        emitObjectOrOtherBranch(node->child1(), taken, notTaken, 

            !isObjectOrOtherSpeculation(m_state.forNode(node->child1()).m_type));

1784 case ObjectOrOtherUse: {

1785 emitObjectOrOtherBranch(node->child1(), taken, notTaken);

        return;

    }

1798 if (node->child1()->shouldSpeculateNumber()) {

1799 if (node->child1()->shouldSpeculateInteger()) {

    case NumberUse:

    case Int32Use: {

        if (node->child1().useKind() == Int32Use) {

            bool invert = false;

            if (taken == nextBlock()) {

@@void SpeculativeJIT::emitBranch(Node* no

        return;

    }

    JSValueOperand value(this, node->child1());

    value.fill();

    GPRReg valueTagGPR = value.tagGPR();

    GPRReg valuePayloadGPR = value.payloadGPR();

    case UntypedUse: {

        JSValueOperand value(this, node->child1());

        value.fill();

        GPRReg valueTagGPR = value.tagGPR();

        GPRReg valuePayloadGPR = value.payloadGPR();

18271820

1828 GPRTemporary result(this);

1829 GPRReg resultGPR = result.gpr();

1821 GPRTemporary result(this);

1822 GPRReg resultGPR = result.gpr();

18301823

1831 use(node->child1());

1824 use(node->child1());

18321825

    JITCompiler::Jump fastPath = m_jit.branch32(JITCompiler::Equal, valueTagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag));

    JITCompiler::Jump slowPath = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, JITCompiler::TrustedImm32(JSValue::BooleanTag));

    fastPath.link(&m_jit);

    branchTest32(JITCompiler::Zero, valuePayloadGPR, notTaken);

    jump(taken, ForceJump);

1826 JITCompiler::Jump fastPath = m_jit.branch32(JITCompiler::Equal, valueTagGPR, JITCompiler::TrustedImm32(JSValue::Int32Tag));

1827 JITCompiler::Jump slowPath = m_jit.branch32(JITCompiler::NotEqual, valueTagGPR, JITCompiler::TrustedImm32(JSValue::BooleanTag));

18391828

    slowPath.link(&m_jit);

    silentSpillAllRegisters(resultGPR);

    callOperation(dfgConvertJSValueToBoolean, resultGPR, valueTagGPR, valuePayloadGPR);

    silentFillAllRegisters(resultGPR);

        fastPath.link(&m_jit);

        branchTest32(JITCompiler::Zero, valuePayloadGPR, notTaken);

        jump(taken, ForceJump);

        slowPath.link(&m_jit);

        silentSpillAllRegisters(resultGPR);

        callOperation(dfgConvertJSValueToBoolean, resultGPR, valueTagGPR, valuePayloadGPR);

        silentFillAllRegisters(resultGPR);

18441837

1845 branchTest32(JITCompiler::NonZero, resultGPR, taken);

1846 jump(notTaken);

1838 branchTest32(JITCompiler::NonZero, resultGPR, taken);

1839 jump(notTaken);

18471840

1848 noResult(node, UseChildrenCalledExplicitly);

        noResult(node, UseChildrenCalledExplicitly);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        break;

    }

}

template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType>

@@void SpeculativeJIT::compile(Node* node)

        break;

    case Identity: {

        // This could be done a lot better. We take the cheap way out because Identity

        // is only going to stick around after CSE if we had prediction weirdness.

        JSValueOperand operand(this, node->child1());

        GPRTemporary resultTag(this);

        GPRTemporary resultPayload(this);

        m_jit.move(operand.tagGPR(), resultTag.gpr());

        m_jit.move(operand.payloadGPR(), resultPayload.gpr());

        jsValueResult(resultTag.gpr(), resultPayload.gpr(), node);

1933 RELEASE_ASSERT_NOT_REACHED();

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            // If the CFA is tracking this variable and it found that the variable

            // cannot have been assigned, then don't attempt to proceed.

            if (value.isClear()) {

1951 // FIXME: We should trap instead.

1952 // https://bugs.webkit.org/show_bug.cgi?id=110383

                terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);

                break;

            }

@@void SpeculativeJIT::compile(Node* node)

            }

            SpeculatedType predictedType = node->variableAccessData()->argumentAwarePrediction();

            if (m_generationInfo[node->child1()->virtualRegister()].registerFormat() == DataFormatDouble) {

2058 SpeculateDoubleOperand value(this, ~~Edge(~~node->child1()~~.node(), D~~oubl~~eUs~~e));

2053 SpeculateDoubleOperand value(this, node->child1(), BackwardSpeculation, ManualOperandSpeculation);

                m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node->local()));

                noResult(node);

                recordSetLocal(node->local(), ValueSource(DoubleInJSStack));

@@void SpeculativeJIT::compile(Node* node)

        break;

    }

    case CheckNumber: {

        if (!isNumberSpeculation(m_state.forNode(node->child1()).m_type)) {

            JSValueOperand op1(this, node->child1());

            JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, op1.tagGPR(), TrustedImm32(JSValue::Int32Tag));

            speculationCheck(

                BadType, JSValueRegs(op1.tagGPR(), op1.payloadGPR()), node->child1(),

                m_jit.branch32(MacroAssembler::AboveOrEqual, op1.tagGPR(), TrustedImm32(JSValue::LowestTag)));

            isInteger.link(&m_jit);

        }

        noResult(node);

        break;

    }

    case ValueAdd:

    case ArithAdd:

        compileAdd(node);

@@void SpeculativeJIT::compile(Node* node)

        break;

    case ArithDiv: {

2217 ~~if (Node::shouldSpeculateIntegerForAr~~it~~hmetic~~(node->chil~~d1().node(), node->child2().node~~())

2218 ~~&& node->canSpeculate~~Int~~eger())~~ {

2199 switch (node->binaryUseKind()) {

2200 case Int32Use: {

#if CPU(X86)

            compileIntegerArithDivForX86(node);

#elif CPU(APPLE_ARMV7S)

@@void SpeculativeJIT::compile(Node* node)

#endif

            break;

        }

        
        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1);

        FPRReg reg1 = op1.fpr();

        FPRReg reg2 = op2.fpr();

        m_jit.divDouble(reg1, reg2, result.fpr());

        doubleResult(result.fpr(), node);

            
        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            SpeculateDoubleOperand op2(this, node->child2());

            FPRTemporary result(this, op1);

            FPRReg reg1 = op1.fpr();

            FPRReg reg2 = op2.fpr();

            m_jit.divDouble(reg1, reg2, result.fpr());

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

    }

    case ArithAbs: {

2247 if (node->child1()->~~shouldSpeculateIntegerForArithmetic~~()

2248 ~~&& node->canSpeculate~~Int~~eger())~~ {

2237 switch (node->child1().useKind()) {

2238 case Int32Use: {

            SpeculateIntegerOperand op1(this, node->child1());

            GPRTemporary result(this, op1);

            GPRTemporary scratch(this);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        SpeculateDoubleOperand op1(this, node->child1());

        FPRTemporary result(this);

        m_jit.absDouble(op1.fpr(), result.fpr());

        doubleResult(result.fpr(), node);

            
        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            FPRTemporary result(this);

            m_jit.absDouble(op1.fpr(), result.fpr());

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

    case ArithMin:

    case ArithMax: {

2272 ~~if (Node::shouldSpeculateIntegerForAr~~it~~hmetic~~(node->chil~~d1().node(), node->child2().node~~())

2273 ~~&& node->canSpeculate~~Int~~eger())~~ {

2271 switch (node->binaryUseKind()) {

2272 case Int32Use: {

            SpeculateStrictInt32Operand op1(this, node->child1());

            SpeculateStrictInt32Operand op2(this, node->child2());

            GPRTemporary result(this, op1);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1);

        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            SpeculateDoubleOperand op2(this, node->child2());

            FPRTemporary result(this, op1);

22952295

2296 MacroAssembler::JumpList done;

22972297

2298 MacroAssembler::Jump op1Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleLessThan : MacroAssembler::DoubleGreaterThan, op1.fpr(), op2.fpr());

22992299

2300 // op2 is eather the lesser one or one of then is NaN

2301 MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1.fpr(), op2.fpr());

2300 // op2 is eather the lesser one or one of then is NaN

2301 MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1.fpr(), op2.fpr());

23022302

        // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 

        // op1 + op2 and putting it into result.

        m_jit.addDouble(op1.fpr(), op2.fpr(), result.fpr());

        done.append(m_jit.jump());

            // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 

            // op1 + op2 and putting it into result.

            m_jit.addDouble(op1.fpr(), op2.fpr(), result.fpr());

            done.append(m_jit.jump());

23072307

2308 op2Less.link(&m_jit);

2309 m_jit.moveDouble(op2.fpr(), result.fpr());

2308 op2Less.link(&m_jit);

2309 m_jit.moveDouble(op2.fpr(), result.fpr());

23102310

2311 if (op1.fpr() != result.fpr()) {

2312 done.append(m_jit.jump());

2311 if (op1.fpr() != result.fpr()) {

2312 done.append(m_jit.jump());

23132313

            op1Less.link(&m_jit);

            m_jit.moveDouble(op1.fpr(), result.fpr());

        } else

            op1Less.link(&m_jit);

                op1Less.link(&m_jit);

                m_jit.moveDouble(op1.fpr(), result.fpr());

            } else

                op1Less.link(&m_jit);

23182318

2319 done.link(&m_jit);

23202320

2321 doubleResult(result.fpr(), node);

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            SpeculateDoubleOperand value(this, node->child2());

            FPRReg valueFPR = value.fpr();

            if (!isRealNumberSpeculation(m_state.forNode(node->child2()).m_type)) {

                // FIXME: We need a way of profiling these, and we need to hoist them into

                // SpeculateDoubleOperand.

                speculationCheck(

                    BadType, JSValueRegs(), 0,

                    m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));

            }

            DFG_TYPE_CHECK(

                JSValueRegs(), node->child2(), SpecRealNumber,

                m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));

            
            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);

            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));

@@void SpeculativeJIT::compile(Node* node)

    }

    case ToPrimitive: {

3238 if (node->child1()->shouldSpeculateInteger()) {

3241 switch (node->child1().useKind()) {

3242 case Int32Use: {

            // It's really profitable to speculate integer, since it's really cheap,

            // it means we don't have to do any real work, and we emit a lot less code.

@@void SpeculativeJIT::compile(Node* node)

            integerResult(result.gpr(), node);

            break;

        }

        case UntypedUse: {

            JSValueOperand op1(this, node->child1());

            GPRTemporary resultTag(this, op1);

            GPRTemporary resultPayload(this, op1, false);

32513260

        // FIXME: Add string speculation here.

        JSValueOperand op1(this, node->child1());

        GPRTemporary resultTag(this, op1);

        GPRTemporary resultPayload(this, op1, false);

        GPRReg op1TagGPR = op1.tagGPR();

        GPRReg op1PayloadGPR = op1.payloadGPR();

        GPRReg resultTagGPR = resultTag.gpr();

        GPRReg resultPayloadGPR = resultPayload.gpr();

            GPRReg op1TagGPR = op1.tagGPR();

            GPRReg op1PayloadGPR = op1.payloadGPR();

            GPRReg resultTagGPR = resultTag.gpr();

            GPRReg resultPayloadGPR = resultPayload.gpr();

32623265

3263 op1.use();

3266 op1.use();

32643267

        if (!(m_state.forNode(node->child1()).m_type & ~(SpecNumber | SpecBoolean))) {

            m_jit.move(op1TagGPR, resultTagGPR);

            m_jit.move(op1PayloadGPR, resultPayloadGPR);

        } else {

            MacroAssembler::Jump alreadyPrimitive = m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, TrustedImm32(JSValue::CellTag));

            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1PayloadGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));

            if (!(m_state.forNode(node->child1()).m_type & ~(SpecNumber | SpecBoolean))) {

                m_jit.move(op1TagGPR, resultTagGPR);

                m_jit.move(op1PayloadGPR, resultPayloadGPR);

            } else {

                MacroAssembler::Jump alreadyPrimitive = m_jit.branch32(MacroAssembler::NotEqual, op1TagGPR, TrustedImm32(JSValue::CellTag));

                MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1PayloadGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));

32713274

            alreadyPrimitive.link(&m_jit);

            m_jit.move(op1TagGPR, resultTagGPR);

            m_jit.move(op1PayloadGPR, resultPayloadGPR);

                alreadyPrimitive.link(&m_jit);

                m_jit.move(op1TagGPR, resultTagGPR);

                m_jit.move(op1PayloadGPR, resultPayloadGPR);

32753278

            addSlowPathGenerator(

                slowPathCall(

                    notPrimitive, this, operationToPrimitive,

                    JSValueRegs(resultTagGPR, resultPayloadGPR), op1TagGPR, op1PayloadGPR));

        }

                addSlowPathGenerator(

                    slowPathCall(

                        notPrimitive, this, operationToPrimitive,

                        JSValueRegs(resultTagGPR, resultPayloadGPR), op1TagGPR, op1PayloadGPR));

            }

32813284

3282 jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);

            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

                case ALL_DOUBLE_INDEXING_TYPES: {

                    SpeculateDoubleOperand operand(this, use);

                    FPRReg opFPR = operand.fpr();

                    if (!isRealNumberSpeculation(m_state.forNode(use).m_type)) {

                        // FIXME: We need a way of profiling these, and we need to hoist them into

                        // SpeculateDoubleOperand.

                        speculationCheck(

                            BadType, JSValueRegs(), 0,

                            m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                    }

                    DFG_TYPE_CHECK(

                        JSValueRegs(), use, SpecRealNumber,

                        m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

        
                    m_jit.storeDouble(opFPR, MacroAssembler::Address(storageGPR, sizeof(double) * operandIdx));

                    break;

@@void SpeculativeJIT::compile(Node* node)

            case ALL_DOUBLE_INDEXING_TYPES: {

                SpeculateDoubleOperand operand(this, use);

                FPRReg opFPR = operand.fpr();

                if (!isRealNumberSpeculation(m_state.forNode(use).m_type)) {

                    // FIXME: We need a way of profiling these, and we need to hoist them into

                    // SpeculateDoubleOperand.

                    speculationCheck(

                        BadType, JSValueRegs(), 0,

                        m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                }

                DFG_TYPE_CHECK(

                    JSValueRegs(), use, SpecRealNumber,

                    m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                
                m_jit.storeDouble(opFPR, reinterpret_cast<char*>(buffer + operandIdx));

                break;

@@void SpeculativeJIT::compile(Node* node)

    }

    case ConvertThis: {

        if (isObjectSpeculation(m_state.forNode(node->child1()).m_type)) {

            SpeculateCellOperand thisValue(this, node->child1());

            GPRTemporary result(this, thisValue);

            m_jit.move(thisValue.gpr(), result.gpr());

            cellResult(result.gpr(), node);

            break;

        }

        if (isOtherSpeculation(node->child1()->prediction())) {

            JSValueOperand thisValue(this, node->child1());

        switch (node->child1().useKind()) {

        case OtherUse: {

            JSValueOperand thisValue(this, node->child1(), ManualOperandSpeculation);

            GPRTemporary scratch(this);

            GPRReg thisValueTagGPR = thisValue.tagGPR();

            GPRReg scratchGPR = scratch.gpr();

            COMPILE_ASSERT((JSValue::UndefinedTag | 1) == JSValue::NullTag, UndefinedTag_OR_1_EQUALS_NullTag);

            m_jit.move(thisValueTagGPR, scratchGPR);

            m_jit.or32(TrustedImm32(1), scratchGPR);

            // This is hard. It would be better to save the value, but we can't quite do it,

            // since this operation does not otherwise get the payload.

            speculationCheck(BadType, JSValueRegs(), 0, m_jit.branch32(MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));

            if (needsTypeCheck(node->child1(), SpecOther)) {

                m_jit.move(thisValueTagGPR, scratchGPR);

                m_jit.or32(TrustedImm32(1), scratchGPR);

                // This is hard. It would be better to save the value, but we can't quite do it,

                // since this operation does not otherwise get the payload.

                typeCheck(

                    JSValueRegs(), node->child1(), SpecOther,

                    m_jit.branch32(

                        MacroAssembler::NotEqual, scratchGPR, TrustedImm32(JSValue::NullTag)));

            }

            
            m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.globalThisObjectFor(node->codeOrigin)), scratchGPR);

            cellResult(scratchGPR, node);

            break;

        }

3669 if ~~(is~~ObjectSp~~eculation(node->child1()->prediction()))~~ {

3669 case ObjectUse: {

            SpeculateCellOperand thisValue(this, node->child1());

            GPRReg thisValueGPR = thisValue.gpr();

3673 if (!isObjectSpeculation(m_state.forNode(node->child1()).m_type))

3674 speculationCheck(BadType, JSValueSource::unboxedCell(thisValueGPR), node->child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::structureOffset()), JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

            DFG_TYPE_CHECK(

                JSValueSource::unboxedCell(thisValueGPR), node->child1(), SpecObject,

                m_jit.branchPtr(

                    JITCompiler::Equal,

                    JITCompiler::Address(thisValueGPR, JSCell::structureOffset()),

                    JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

            
            GPRTemporary result(this, thisValue);

            GPRReg resultGPR = result.gpr();

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        JSValueOperand thisValue(this, node->child1());

        GPRReg thisValueTagGPR = thisValue.tagGPR();

        GPRReg thisValuePayloadGPR = thisValue.payloadGPR();

        flushRegisters();

        GPRResult2 resultTag(this);

        GPRResult resultPayload(this);

        callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);

        cellResult(resultPayload.gpr(), node);

        case UntypedUse: {

            JSValueOperand thisValue(this, node->child1());

            GPRReg thisValueTagGPR = thisValue.tagGPR();

            GPRReg thisValuePayloadGPR = thisValue.payloadGPR();

            flushRegisters();

            GPRResult2 resultTag(this);

            GPRResult resultPayload(this);

            callOperation(operationConvertThis, resultTag.gpr(), resultPayload.gpr(), thisValueTagGPR, thisValuePayloadGPR);

            cellResult(resultPayload.gpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

3909 if (isCellSpeculation(node->child1()->prediction())) {

3921 switch (node->child1().useKind()) {

3922 case CellUse: {

            SpeculateCellOperand base(this, node->child1());

            GPRReg baseGPR = base.gpr();

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        JSValueOperand base(this, node->child1());

        GPRReg baseTagGPR = base.tagGPR();

        GPRReg basePayloadGPR = base.payloadGPR();

        case UntypedUse: {

            JSValueOperand base(this, node->child1());

            GPRReg baseTagGPR = base.tagGPR();

            GPRReg basePayloadGPR = base.payloadGPR();

39323946

        GPRResult resultTag(this);

        GPRResult2 resultPayload(this);

        GPRReg resultTagGPR = resultTag.gpr();

        GPRReg resultPayloadGPR = resultPayload.gpr();

            GPRResult resultTag(this);

            GPRResult2 resultPayload(this);

            GPRReg resultTagGPR = resultTag.gpr();

            GPRReg resultPayloadGPR = resultPayload.gpr();

39373951

3938 base.use();

3952 base.use();

39393953

3940 flushRegisters();

3954 flushRegisters();

39413955

3942 JITCompiler::Jump notCell = m_jit.branch32(JITCompiler::NotEqual, baseTagGPR, TrustedImm32(JSValue::CellTag));

3956 JITCompiler::Jump notCell = m_jit.branch32(JITCompiler::NotEqual, baseTagGPR, TrustedImm32(JSValue::CellTag));

39433957

3944 cachedGetById(node->codeOrigin, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);

3958 cachedGetById(node->codeOrigin, baseTagGPR, basePayloadGPR, resultTagGPR, resultPayloadGPR, node->identifierNumber(), notCell, DontSpill);

39453959

3946 jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);

            jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

        
    case CheckStructure:

    case ForwardCheckStructure: {

        AbstractValue& value = m_state.forNode(node->child1());

        if (value.m_currentKnownStructure.isSubsetOf(node->structureSet())

            && isCellSpeculation(value.m_type)) {

            noResult(node);

            break;

        }

        SpeculationDirection direction = node->op() == ForwardCheckStructure ? ForwardSpeculation : BackwardSpeculation;

        SpeculateCellOperand base(this, node->child1(), direction);

@@void SpeculativeJIT::compile(Node* node)

        JITCompiler::Jump isOK = m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(op1.gpr(), JSCell::structureOffset()), TrustedImmPtr(node->structure()));

        m_jit.breakpoint();

        isOK.link(&m_jit);

4049#else

4050 speculaceCell(node->child1());

#endif

        noResult(node);

@@void SpeculativeJIT::compile(Node* node)

    }

    case PhantomPutStructure: {

4058 ASSERT(isKnownCell(node->child1().node()));

        ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());

        m_jit.addWeakReferenceTransition(

            node->codeOrigin.codeOriginOwner(),

@@void SpeculativeJIT::compile(Node* node)

        flushRegisters();

4410 ASSERT(node->child1().useKind() == UntypedUse || node->child1().useKind() == CellUse || node->child1().useKind() == StringUse);

4411

43934412 JITCompiler::Jump isNotCell = m_jit.branch32(JITCompiler::NotEqual, tagGPR, JITCompiler::TrustedImm32(JSValue::CellTag));

4394 if (node->child1()->~~shoul~~dS~~peculateCell(~~))

4413 if (node->child1().useKind() != UntypedUse)

43954414 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node->child1(), isNotCell);

43964415

4397 if (!node->child1()->shouldSpeculateObject()) {

4416 if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {

43984417 m_jit.loadPtr(JITCompiler::Address(payloadGPR, JSCell::structureOffset()), tempGPR);

43994418 JITCompiler::Jump notString = m_jit.branch8(JITCompiler::NotEqual, JITCompiler::Address(tempGPR, Structure::typeInfoTypeOffset()), TrustedImm32(StringType));

4400 if (node->child1()->~~shouldSpeculate~~String())

4401 ~~speculationCheck(BadType,~~ JSValueRegs(tagGPR, payloadGPR), node->child1(), notString);

4419 if (node->child1().useKind() == StringUse)

4420 DFG_TYPE_CHECK(JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecString, notString);

44024421 m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.stringString()), resultGPR);

44034422 doneJumps.append(m_jit.jump());

4404 if (!node->child1()->~~shouldSpeculate~~String()) {

4423 if (node->child1().useKind() != StringUse) {

                notString.link(&m_jit);

                callOperation(operationTypeOf, resultGPR, payloadGPR);

                doneJumps.append(m_jit.jump());

@@void SpeculativeJIT::compile(Node* node)

            doneJumps.append(m_jit.jump());

        }

4414 if (!node->child1()->~~shoul~~dS~~peculateCell()~~) {

4433 if (node->child1().useKind() == UntypedUse) {

            isNotCell.link(&m_jit);

            m_jit.add32(TrustedImm32(1), tagGPR, tempGPR);

@@void SpeculativeJIT::compile(Node* node)

        break;

    case Phantom:

        DFG_NODE_DO_TO_CHILDREN(m_jit.graph(), node, speculate);

        noResult(node);

        break;

    case PhantomLocal:

        // This is a no-op.

        noResult(node);

143562

Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@namespace JSC { namespace DFG {

#if USE(JSVALUE64)

42 GPRReg SpeculativeJIT::fillInteger(Node* node, DataFormat& returnFormat)

42GPRReg SpeculativeJIT::fillInteger(Edge edge, DataFormat& returnFormat)

4343{

44 VirtualRegister virtualRegister = node->virtualRegister();

    ASSERT(!needsTypeCheck(edge, SpecInt32));

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    if (info.registerFormat() == DataFormatNone) {

        GPRReg gpr = allocate();

50 if (node->hasConstant()) {

52 if (edge->hasConstant()) {

5153 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

52 if (isInt32Constant(node)) {

53 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

54 if (isInt32Constant(edge.node())) {

55 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

                info.fillInteger(*m_stream, gpr);

                returnFormat = DataFormatInteger;

                return gpr;

            }

58 if (isNumberConstant(node)) {

59 JSValue jsValue = jsNumber(valueOfNumberConstant(node));

60 if (isNumberConstant(edge.node())) {

61 JSValue jsValue = jsNumber(valueOfNumberConstant(edge.node()));

6062 m_jit.move(MacroAssembler::Imm64(JSValue::encode(jsValue)), gpr);

6163 } else {

62 ASSERT(isJSConstant(node));

63 JSValue jsValue = valueOfJSConstant(node);

64 ASSERT(isJSConstant(edge.node()));

65 JSValue jsValue = valueOfJSConstant(edge.node());

                m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);

            }

        } else if (info.spillFormat() == DataFormatInteger) {

@@GPRReg SpeculativeJIT::fillInteger(Node*

    }

}

120 GPRReg SpeculativeJIT::fillJSValue(Node* node)

122GPRReg SpeculativeJIT::fillJSValue(Edge edge)

121123{

122 VirtualRegister virtualRegister = node->virtualRegister();

124 VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

    case DataFormatNone: {

        GPRReg gpr = allocate();

129 if (node->hasConstant()) {

130 if (isInt32Constant(node)) {

131 if (edge->hasConstant()) {

132 if (isInt32Constant(edge.node())) {

131133 info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);

132 JSValue jsValue = jsNumber(valueOfInt32Constant(node));

134 JSValue jsValue = jsNumber(valueOfInt32Constant(edge.node()));

133135 m_jit.move(MacroAssembler::Imm64(JSValue::encode(jsValue)), gpr);

134 } else if (isNumberConstant(node)) {

136 } else if (isNumberConstant(edge.node())) {

135137 info.fillJSValue(*m_stream, gpr, DataFormatJSDouble);

136 JSValue jsValue(JSValue::EncodeAsDouble, valueOfNumberConstant(node));

138 JSValue jsValue(JSValue::EncodeAsDouble, valueOfNumberConstant(edge.node()));

137139 m_jit.move(MacroAssembler::Imm64(JSValue::encode(jsValue)), gpr);

138140 } else {

139 ASSERT(isJSConstant(node));

140 JSValue jsValue = valueOfJSConstant(node);

141 ASSERT(isJSConstant(edge.node()));

142 JSValue jsValue = valueOfJSConstant(edge.node());

                m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);

                info.fillJSValue(*m_stream, gpr, DataFormatJS);

            }

@@void SpeculativeJIT::emitCall(Node* node

}

template<bool strict>

805 GPRReg SpeculativeJIT::fillSpeculateIntInternal(Node* node, DataFormat& returnFormat, SpeculationDirection direction)

807GPRReg SpeculativeJIT::fillSpeculateIntInternal(Edge edge, DataFormat& returnFormat, SpeculationDirection direction)

806808{

807809#if DFG_ENABLE(DEBUG_VERBOSE)

808 dataLogF("SpecInt@%d ", node->index());

810 dataLogF("SpecInt@%d ", edge->index());

809811#endif

810 SpeculatedType type = m_state.forNode(node).m_type;

811 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownInt32Use || !(value.m_type & ~SpecInt32));

    value.filter(SpecInt32);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

    case DataFormatNone: {

816 if ((node->hasConstant() && !isInt32Constant(node)) || info.spillFormat() == DataFormatDouble) {

821 if ((edge->hasConstant() && !isInt32Constant(edge.node())) || info.spillFormat() == DataFormatDouble) {

            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0, direction);

            returnFormat = DataFormatInteger;

            return allocate();

@@GPRReg SpeculativeJIT::fillSpeculateIntI

        

        GPRReg gpr = allocate();

824 if (node->hasConstant()) {

829 if (edge->hasConstant()) {

825830 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

826 ASSERT(isInt32Constant(node));

827 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

831 ASSERT(isInt32Constant(edge.node()));

832 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

            info.fillInteger(*m_stream, gpr);

            returnFormat = DataFormatInteger;

            return gpr;

@@GPRReg SpeculativeJIT::fillSpeculateIntI

        // Check the value is an integer.

        GPRReg gpr = info.gpr();

        m_gprs.lock(gpr);

867 if (~~!is~~Int32~~Speculation(type~~))

868 speculationCheck(BadType, JSValueRegs(gpr), node, m_jit.branch64(MacroAssembler::Below, gpr, GPRInfo::tagTypeNumberRegister), direction);

872 if (type & ~SpecInt32)

873 speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branch64(MacroAssembler::Below, gpr, GPRInfo::tagTypeNumberRegister), direction);

        info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);

        // If !strict we're done, return.

        if (!strict) {

@@GPRReg SpeculativeJIT::fillSpeculateIntI

    case DataFormatDouble:

    case DataFormatJSDouble: {

913 if (node->hasConstant() && isInt32Constant(node)) {

918 if (edge->hasConstant() && isInt32Constant(edge.node())) {

914919 GPRReg gpr = allocate();

915 ASSERT(isInt32Constant(node));

916 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(node)), gpr);

920 ASSERT(isInt32Constant(edge.node()));

921 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(edge.node())), gpr);

            returnFormat = DataFormatInteger;

            return gpr;

        }

@@GPRReg SpeculativeJIT::fillSpeculateIntI

    }

}

939 GPRReg SpeculativeJIT::fillSpeculateInt(Node* node, DataFormat& returnFormat, SpeculationDirection direction)

944GPRReg SpeculativeJIT::fillSpeculateInt(Edge edge, DataFormat& returnFormat, SpeculationDirection direction)

940945{

941 return fillSpeculateIntInternal<false>(node, returnFormat, direction);

946 return fillSpeculateIntInternal<false>(edge, returnFormat, direction);

942947}

943948

944 GPRReg SpeculativeJIT::fillSpeculateIntStrict(Node* node)

949GPRReg SpeculativeJIT::fillSpeculateIntStrict(Edge edge)

945950{

946951 DataFormat mustBeDataFormatInteger;

947 GPRReg result = fillSpeculateIntInternal<true>(node, mustBeDataFormatInteger, BackwardSpeculation);

952 GPRReg result = fillSpeculateIntInternal<true>(edge, mustBeDataFormatInteger, BackwardSpeculation);

    RELEASE_ASSERT(mustBeDataFormatInteger == DataFormatInteger);

    return result;

}

952 FPRReg SpeculativeJIT::fillSpeculateDouble(Node* node, SpeculationDirection direction)

957FPRReg SpeculativeJIT::fillSpeculateDouble(Edge edge, SpeculationDirection direction)

953958{

954959#if DFG_ENABLE(DEBUG_VERBOSE)

955 dataLogF("SpecDouble@%d ", node->index());

960 dataLogF("SpecDouble@%d ", edge->index());

956961#endif

957 SpeculatedType type = m_state.forNode(node).m_type;

958 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownNumberUse || !(value.m_type & ~SpecNumber));

    value.filter(SpecNumber);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    if (info.registerFormat() == DataFormatNone) {

962 if (node->hasConstant()) {

970 if (edge->hasConstant()) {

963971 GPRReg gpr = allocate();

964972

965 if (isInt32Constant(node)) {

973 if (isInt32Constant(edge.node())) {

966974 FPRReg fpr = fprAllocate();

967 m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(static_cast<double>(valueOfInt32Constant(node)))), gpr);

975 m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(static_cast<double>(valueOfInt32Constant(edge.node())))), gpr);

                m_jit.move64ToDouble(gpr, fpr);

                unlock(gpr);

@@FPRReg SpeculativeJIT::fillSpeculateDoub

                info.fillDouble(*m_stream, fpr);

                return fpr;

            }

975 if (isNumberConstant(node)) {

983 if (isNumberConstant(edge.node())) {

976984 FPRReg fpr = fprAllocate();

977 m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(node))), gpr);

985 m_jit.move(MacroAssembler::Imm64(reinterpretDoubleToInt64(valueOfNumberConstant(edge.node()))), gpr);

                m_jit.move64ToDouble(gpr, fpr);

                unlock(gpr);

@@FPRReg SpeculativeJIT::fillSpeculateDoub

        JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, jsValueGpr, GPRInfo::tagTypeNumberRegister);

1041 if (~~!is~~Number~~Speculation(type~~))

1042 speculationCheck(BadType, JSValueRegs(jsValueGpr), node, m_jit.branchTest64(MacroAssembler::Zero, jsValueGpr, GPRInfo::tagTypeNumberRegister), direction);

1049 if (type & ~SpecNumber)

1050 speculationCheck(BadType, JSValueRegs(jsValueGpr), edge, m_jit.branchTest64(MacroAssembler::Zero, jsValueGpr, GPRInfo::tagTypeNumberRegister), direction);

        // First, if we get here we have a double encoded as a JSValue

        m_jit.move(jsValueGpr, tempGpr);

@@FPRReg SpeculativeJIT::fillSpeculateDoub

    }

}

1105 GPRReg SpeculativeJIT::fillSpeculateCell(Node* node, SpeculationDirection direction)

1113GPRReg SpeculativeJIT::fillSpeculateCell(Edge edge, SpeculationDirection direction)

11061114{

11071115#if DFG_ENABLE(DEBUG_VERBOSE)

1108 dataLogF("SpecCell@%d ", node->index());

1116 dataLogF("SpecCell@%d ", edge->index());

11091117#endif

1110 SpeculatedType type = m_state.forNode(node).m_type;

1111 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    ASSERT(edge.useKind() != KnownCellUse || !(value.m_type & ~SpecCell));

    value.filter(SpecCell);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

@@GPRReg SpeculativeJIT::fillSpeculateCell

        

        GPRReg gpr = allocate();

1123 if (node->hasConstant()) {

1124 JSValue jsValue = valueOfJSConstant(node);

1134 if (edge->hasConstant()) {

1135 JSValue jsValue = valueOfJSConstant(edge.node());

            if (jsValue.isCell()) {

                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

                m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);

@@GPRReg SpeculativeJIT::fillSpeculateCell

        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);

        info.fillJSValue(*m_stream, gpr, DataFormatJS);

1139 if (~~!is~~Cell~~Speculation(type~~))

1140 speculationCheck(BadType, JSValueRegs(gpr), node, m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), direction);

1150 if (type & ~SpecCell)

1151 speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), direction);

        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);

        return gpr;

    }

@@GPRReg SpeculativeJIT::fillSpeculateCell

    case DataFormatJS: {

        GPRReg gpr = info.gpr();

        m_gprs.lock(gpr);

1155 if (~~!is~~Cell~~Speculation(type~~))

1156 speculationCheck(BadType, JSValueRegs(gpr), node, m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), direction);

1166 if (type & ~SpecCell)

1167 speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister), direction);

        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);

        return gpr;

    }

@@GPRReg SpeculativeJIT::fillSpeculateCell

    }

}

1180 GPRReg SpeculativeJIT::fillSpeculateBoolean(Node* node, SpeculationDirection direction)

1191GPRReg SpeculativeJIT::fillSpeculateBoolean(Edge edge, SpeculationDirection direction)

11811192{

11821193#if DFG_ENABLE(DEBUG_VERBOSE)

1183 dataLogF("SpecBool@%d ", node->index());

1194 dataLogF("SpecBool@%d ", edge->index());

11841195#endif

1185 SpeculatedType type = m_state.forNode(node).m_type;

1186 VirtualRegister virtualRegister = node->virtualRegister();

    AbstractValue& value = m_state.forNode(edge);

    SpeculatedType type = value.m_type;

    value.filter(SpecBoolean);

    VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

@@GPRReg SpeculativeJIT::fillSpeculateBool

        

        GPRReg gpr = allocate();

1198 if (node->hasConstant()) {

1199 JSValue jsValue = valueOfJSConstant(node);

1211 if (edge->hasConstant()) {

1212 JSValue jsValue = valueOfJSConstant(edge.node());

            if (jsValue.isBoolean()) {

                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);

                m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);

@@GPRReg SpeculativeJIT::fillSpeculateBool

        m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);

        info.fillJSValue(*m_stream, gpr, DataFormatJS);

1214 if (~~!is~~Boolean~~Speculation(type)~~) {

1227 if (type & ~SpecBoolean) {

12151228 m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);

1216 speculationCheck(BadType, JSValueRegs(gpr), node, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg), direction);

1229 speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg), direction);

            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);

        }

        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);

@@GPRReg SpeculativeJIT::fillSpeculateBool

    case DataFormatJS: {

        GPRReg gpr = info.gpr();

        m_gprs.lock(gpr);

1233 if (~~!is~~Boolean~~Speculation(type)~~) {

1246 if (type & ~SpecBoolean) {

12341247 m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);

1235 speculationCheck(BadType, JSValueRegs(gpr), node, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg), direction);

1248 speculationCheck(BadType, JSValueRegs(gpr), edge, m_jit.branchTest64(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg), direction);

            m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);

        }

        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);

@@void SpeculativeJIT::compileObjectEquali

   
    if (m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(node->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(node->child1()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), node->child1(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node->child1(),

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectEquali

                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));

        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(node->child2()).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op2GPR), node->child2(), SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node->child2(),

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectEquali

void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)

{

    SpeculateCellOperand op1(this, leftChild);

1357 JSValueOperand op2(this, rightChild);

1358 JSValueOperand op2(this, rightChild, ManualOperandSpeculation);

    GPRTemporary result(this);

    GPRReg op1GPR = op1.gpr();

@@void SpeculativeJIT::compileObjectToObje

   
    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild,

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectToObje

    // We know that within this branch, rightChild must be a cell. 

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2GPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2GPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compileObjectToObje

    
    // We know that within this branch, rightChild must not be a cell. Check if that is enough to

    // prove that it is either null or undefined.

1440 if (~~(m_state.forNod~~e(rightChild~~).m_type~~ ~~& ~~~SpecCell) & ~SpecOther) {

1429 if (needsTypeCheck(rightChild, SpecCell | SpecOther)) {

        m_jit.move(op2GPR, resultGPR);

        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);

1444 s~~peculation~~Check(

1445 ~~BadType,~~ JSValueRegs(op2GPR), rightChild~~.node()~~,

1433 typeCheck(

1434 JSValueRegs(op2GPR), rightChild, SpecCell | SpecOther,

            m_jit.branch64(

                MacroAssembler::NotEqual, resultGPR,

                MacroAssembler::TrustedImm64(ValueNull)));

@@void SpeculativeJIT::compilePeepHoleObje

    BlockIndex notTaken = branchNode->notTakenBlockIndex();

    SpeculateCellOperand op1(this, leftChild);

1467 JSValueOperand op2(this, rightChild);

1456 JSValueOperand op2(this, rightChild, ManualOperandSpeculation);

    GPRTemporary result(this);

    GPRReg op1GPR = op1.gpr();

@@void SpeculativeJIT::compilePeepHoleObje

    
    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);

        if (m_state.forNode(leftChild).m_type & ~SpecObject) {

            speculationCheck(

                BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueSource::unboxedCell(op1GPR), leftChild, SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild, 

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compilePeepHoleObje

    // We know that within this branch, rightChild must be a cell. 

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2GPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);

        if ((m_state.forNode(rightChild).m_type & SpecCell) & ~SpecObject) {

            speculationCheck(

                BadType, JSValueRegs(op2GPR), rightChild,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    structureGPR, 

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(op2GPR), rightChild, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                structureGPR, 

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild,

            m_jit.branchTest8(

                MacroAssembler::NonZero, 

@@void SpeculativeJIT::compilePeepHoleObje

    
    // We know that within this branch, rightChild must not be a cell. Check if that is enough to

    // prove that it is either null or undefined.

1547 if (~~(m_state.forNod~~e(rightChild~~).m_type~~ ~~& ~~~SpecCell) & ~SpecOther)

1524 if (!needsTypeCheck(rightChild, SpecCell | SpecOther))

        rightNotCell.link(&m_jit);

    else {

        jump(notTaken, ForceJump);

@@void SpeculativeJIT::compilePeepHoleObje

        m_jit.move(op2GPR, resultGPR);

        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);

        speculationCheck(

            BadType, JSValueRegs(op2GPR), rightChild,

            m_jit.branch64(

1533 typeCheck(

1534 JSValueRegs(op2GPR), rightChild, SpecCell | SpecOther, m_jit.branch64(

                MacroAssembler::NotEqual, resultGPR,

                MacroAssembler::TrustedImm64(ValueNull)));

    }

@@void SpeculativeJIT::compileValueAdd(Nod

    jsValueResult(result.gpr(), node);

}

1612 void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse~~, bool needSpeculationCheck~~)

1588void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse)

16131589{

1614 JSValueOperand value(this, nodeUse);

1590 JSValueOperand value(this, nodeUse, ManualOperandSpeculation);

    GPRTemporary result(this);

    GPRReg valueGPR = value.gpr();

    GPRReg resultGPR = result.gpr();

@@void SpeculativeJIT::compileObjectOrOthe

    MacroAssembler::Jump notCell = m_jit.branchTest64(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    MacroAssembler::Address(valueGPR, JSCell::structureOffset()),

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal,

                MacroAssembler::Address(valueGPR, JSCell::structureOffset()),

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        GPRTemporary structure(this);

        GPRReg structureGPR = structure.gpr();

        m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), structureGPR);

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal,

                    structureGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal,

                structureGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        MacroAssembler::Jump isNotMasqueradesAsUndefined = 

            m_jit.branchTest8(

@@void SpeculativeJIT::compileObjectOrOthe

    

    notCell.link(&m_jit);

1663 if (needS~~peculation~~Check) {

1634 if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {

16641635 m_jit.move(valueGPR, resultGPR);

16651636 m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);

1666 s~~peculation~~Check(~~BadType, JSValueRegs(valueGPR), nodeUse,~~

1667 m_jit.branch64(

1637 typeCheck(

1638 JSValueRegs(valueGPR), nodeUse, SpecCell | SpecOther, m_jit.branch64(

                MacroAssembler::NotEqual, 

                resultGPR, 

                MacroAssembler::TrustedImm64(ValueNull)));

@@void SpeculativeJIT::compileObjectOrOthe

void SpeculativeJIT::compileLogicalNot(Node* node)

{

    if (node->child1()->shouldSpeculateObjectOrOther()) {

        compileObjectOrOtherLogicalNot(node->child1(),

            !isObjectOrOtherSpeculation(m_state.forNode(node->child1()).m_type));

    switch (node->child1().useKind()) {

    case ObjectOrOtherUse: {

        compileObjectOrOtherLogicalNot(node->child1());

16841655 return;

16851656 }

1686 if (node->child1()->shouldSpeculateInteger()) {

1657

1658 case Int32Use: {

        SpeculateIntegerOperand value(this, node->child1());

        GPRTemporary result(this, value);

        m_jit.compare32(MacroAssembler::Equal, value.gpr(), MacroAssembler::TrustedImm32(0), result.gpr());

@@void SpeculativeJIT::compileLogicalNot(N

        jsValueResult(result.gpr(), node, DataFormatJSBoolean);

        return;

    }

1694 if (node->child1()->shouldSpeculateNumber()) {

1666

1667 case NumberUse: {

        SpeculateDoubleOperand value(this, node->child1());

        FPRTemporary scratch(this);

        GPRTemporary result(this);

@@void SpeculativeJIT::compileLogicalNot(N

        return;

    }

    SpeculatedType prediction = node->child1()->prediction();

    if (isBooleanSpeculation(prediction)) {

        if (isBooleanSpeculation(m_state.forNode(node->child1()).m_type)) {

1679 case BooleanUse: {

1680 if (!needsTypeCheck(node->child1(), SpecBoolean)) {

            SpeculateBooleanOperand value(this, node->child1());

            GPRTemporary result(this, value);

@@void SpeculativeJIT::compileLogicalNot(N

            return;

        }

1719 JSValueOperand value(this, node->child1());

1691 JSValueOperand value(this, node->child1(), ManualOperandSpeculation);

        GPRTemporary result(this); // FIXME: We could reuse, but on speculation fail would need recovery to restore tag (akin to add).

        m_jit.move(value.gpr(), result.gpr());

        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), result.gpr());

1724 speculationCheck(BadType, JSValueRegs(value.gpr()), node->child1(), m_jit.branchTest64(JITCompiler::NonZero, result.gpr(), TrustedImm32(static_cast<int32_t>(~1))));

        typeCheck(

            JSValueRegs(value.gpr()), node->child1(), SpecBoolean, m_jit.branchTest64(

                JITCompiler::NonZero, result.gpr(), TrustedImm32(static_cast<int32_t>(~1))));

        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), result.gpr());

        // If we add a DataFormatBool, we should use it here.

        jsValueResult(result.gpr(), node, DataFormatJSBoolean);

        return;

    }

        
    case UntypedUse: {

        JSValueOperand arg1(this, node->child1());

        GPRTemporary result(this);

17311709

    JSValueOperand arg1(this, node->child1());

    GPRTemporary result(this);

    GPRReg arg1GPR = arg1.gpr();

    GPRReg resultGPR = result.gpr();

1710 GPRReg arg1GPR = arg1.gpr();

1711 GPRReg resultGPR = result.gpr();

17371712

1738 arg1.use();

1713 arg1.use();

17391714

    m_jit.move(arg1GPR, resultGPR);

    m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), resultGPR);

    JITCompiler::Jump slowCase = m_jit.branchTest64(JITCompiler::NonZero, resultGPR, TrustedImm32(static_cast<int32_t>(~1)));

        m_jit.move(arg1GPR, resultGPR);

        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), resultGPR);

        JITCompiler::Jump slowCase = m_jit.branchTest64(JITCompiler::NonZero, resultGPR, TrustedImm32(static_cast<int32_t>(~1)));

17431718

1744 addSlowPathGenerator(

1745 slowPathCall(slowCase, this, dfgConvertJSValueToBoolean, resultGPR, arg1GPR));

1719 addSlowPathGenerator(

1720 slowPathCall(slowCase, this, dfgConvertJSValueToBoolean, resultGPR, arg1GPR));

17461721

1747 m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), resultGPR);

1748 jsValueResult(resultGPR, node, DataFormatJSBoolean, UseChildrenCalledExplicitly);

        m_jit.xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), resultGPR);

        jsValueResult(resultGPR, node, DataFormatJSBoolean, UseChildrenCalledExplicitly);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        break;

    }

17491731}

17501732

1751 void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken~~, bool needSpeculationCheck~~)

1733void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken)

17521734{

1753 JSValueOperand value(this, nodeUse);

1735 JSValueOperand value(this, nodeUse, ManualOperandSpeculation);

    GPRTemporary scratch(this);

    GPRReg valueGPR = value.gpr();

    GPRReg scratchGPR = scratch.gpr();

@@void SpeculativeJIT::emitObjectOrOtherBr

    if (m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {

        m_jit.graph().globalObjectFor(m_currentNode->codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    MacroAssembler::Address(valueGPR, JSCell::structureOffset()),

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                MacroAssembler::Address(valueGPR, JSCell::structureOffset()),

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    } else {

        m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), scratchGPR);

        if (needSpeculationCheck) {

            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,

                m_jit.branchPtr(

                    MacroAssembler::Equal, 

                    scratchGPR,

                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        }

        DFG_TYPE_CHECK(

            JSValueRegs(valueGPR), nodeUse, (~SpecCell) | SpecObject, m_jit.branchPtr(

                MacroAssembler::Equal, 

                scratchGPR,

                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));

@@void SpeculativeJIT::emitObjectOrOtherBr

    
    notCell.link(&m_jit);

1794 if (needS~~peculation~~Check) {

1772 if (needsTypeCheck(nodeUse, SpecCell | SpecOther)) {

17951773 m_jit.move(valueGPR, scratchGPR);

17961774 m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), scratchGPR);

1797 speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, m_jit.branch64(MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImm64(ValueNull)));

        typeCheck(

            JSValueRegs(valueGPR), nodeUse, SpecCell | SpecOther, m_jit.branch64(

                MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImm64(ValueNull)));

    }

    jump(notTaken);

@@void SpeculativeJIT::emitBranch(Node* no

    BlockIndex taken = node->takenBlockIndex();

    BlockIndex notTaken = node->notTakenBlockIndex();

    if (node->child1()->shouldSpeculateObjectOrOther()) {

        emitObjectOrOtherBranch(node->child1(), taken, notTaken, 

            !isObjectOrOtherSpeculation(m_state.forNode(node->child1()).m_type));

    switch (node->child1().useKind()) {

    case ObjectOrOtherUse: {

        emitObjectOrOtherBranch(node->child1(), taken, notTaken);

18121792 return;

18131793 }

    
    if (node->child1()->shouldSpeculateNumber()) {

        if (node->child1()->shouldSpeculateInteger()) {

        
    case Int32Use:

    case NumberUse: {

        if (node->child1().useKind() == Int32Use) {

            bool invert = false;

            if (taken == nextBlock()) {

@@void SpeculativeJIT::emitBranch(Node* no

        return;

    }

1840 JSValueOperand value(this, node->child1());

1841 GPRReg valueGPR = value.gpr();

    case UntypedUse:

    case BooleanUse: {

        JSValueOperand value(this, node->child1(), ManualOperandSpeculation);

        GPRReg valueGPR = value.gpr();

18421825

    bool predictBoolean = isBooleanSpeculation(node->child1()->prediction());

    if (predictBoolean) {

        if (isBooleanSpeculation(m_state.forNode(node->child1()).m_type)) {

            MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;

        if (node->child1().useKind() == BooleanUse) {

            if (!needsTypeCheck(node->child1(), SpecBoolean)) {

                MacroAssembler::ResultCondition condition = MacroAssembler::NonZero;

18481829

            if (taken == nextBlock()) {

                condition = MacroAssembler::Zero;

                BlockIndex tmp = taken;

                taken = notTaken;

                notTaken = tmp;

            }

                if (taken == nextBlock()) {

                    condition = MacroAssembler::Zero;

                    BlockIndex tmp = taken;

                    taken = notTaken;

                    notTaken = tmp;

                }

18551836

            branchTest32(condition, valueGPR, TrustedImm32(true), taken);

            jump(notTaken);

        } else {

            branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);

            branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);

                branchTest32(condition, valueGPR, TrustedImm32(true), taken);

                jump(notTaken);

            } else {

                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);

                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);

18611842

            speculationCheck(BadType, JSValueRegs(valueGPR), node->child1(), m_jit.jump());

        }

        value.use();

    } else {

        GPRTemporary result(this);

        GPRReg resultGPR = result.gpr();

        if (node->child1()->prediction() & SpecInt32) {

            branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(0))), notTaken);

            branch64(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister, taken);

        }

                typeCheck(JSValueRegs(valueGPR), node->child1(), SpecBoolean, m_jit.jump());

            }

            value.use();

        } else {

            GPRTemporary result(this);

            GPRReg resultGPR = result.gpr();

            if (node->child1()->prediction() & SpecInt32) {

                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsNumber(0))), notTaken);

                branch64(MacroAssembler::AboveOrEqual, valueGPR, GPRInfo::tagTypeNumberRegister, taken);

            }

18731854

        if (node->child1()->prediction() & SpecBoolean) {

            branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);

            branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);

        }

            if (node->child1()->prediction() & SpecBoolean) {

                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(false))), notTaken);

                branch64(MacroAssembler::Equal, valueGPR, MacroAssembler::TrustedImm64(JSValue::encode(jsBoolean(true))), taken);

            }

18781859

1879 value.use();

1860 value.use();

18801861

        silentSpillAllRegisters(resultGPR);

        callOperation(dfgConvertJSValueToBoolean, resultGPR, valueGPR);

        silentFillAllRegisters(resultGPR);

            silentSpillAllRegisters(resultGPR);

            callOperation(dfgConvertJSValueToBoolean, resultGPR, valueGPR);

            silentFillAllRegisters(resultGPR);

18841865

1885 branchTest32(MacroAssembler::NonZero, resultGPR, taken);

1886 jump(notTaken);

            branchTest32(MacroAssembler::NonZero, resultGPR, taken);

            jump(notTaken);

        }

        noResult(node, UseChildrenCalledExplicitly);

        return;

18871872 }

18881873

1889 noResult(node, UseChildrenCalledExplicitly);

    default:

        RELEASE_ASSERT_NOT_REACHED();

    }

}

void SpeculativeJIT::compile(Node* node)

@@void SpeculativeJIT::compile(Node* node)

        break;

    case Identity: {

        // This could be done a lot better. We take the cheap way out because Identity

        // is only going to stick around after CSE if we had prediction weirdness.

        JSValueOperand operand(this, node->child1());

        GPRTemporary result(this, operand);

        m_jit.move(operand.gpr(), result.gpr());

        jsValueResult(result.gpr(), node);

1898 // CSE should always eliminate this.

1899 RELEASE_ASSERT_NOT_REACHED();

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            // If the CFA is tracking this variable and it found that the variable

            // cannot have been assigned, then don't attempt to proceed.

            if (value.isClear()) {

1917 // FIXME: We should trap instead.

1918 // https://bugs.webkit.org/show_bug.cgi?id=110383

                terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);

                break;

            }

@@void SpeculativeJIT::compile(Node* node)

        break;

    }

    case CheckNumber: {

        if (!isNumberSpeculation(m_state.forNode(node->child1()).m_type)) {

            JSValueOperand op1(this, node->child1());

            JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, op1.gpr(), GPRInfo::tagTypeNumberRegister);

            speculationCheck(

                BadType, JSValueRegs(op1.gpr()), node->child1().node(),

                m_jit.branchTest64(MacroAssembler::Zero, op1.gpr(), GPRInfo::tagTypeNumberRegister));

            isInteger.link(&m_jit);

        }

        noResult(node);

        break;

    }

    case ValueAdd:

    case ArithAdd:

        compileAdd(node);

@@void SpeculativeJIT::compile(Node* node)

        break;

    case ArithDiv: {

2165 ~~if (Node::shouldSpeculateIntegerForAr~~it~~hmetic~~(node->chil~~d1().node(), node->child2().node~~())

2166 ~~&& node->canSpeculate~~Int~~eger())~~ {

2137 switch (node->binaryUseKind()) {

2138 case Int32Use: {

            compileIntegerArithDivForX86(node);

            break;

        }

        
        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1);

        FPRReg reg1 = op1.fpr();

        FPRReg reg2 = op2.fpr();

        m_jit.divDouble(reg1, reg2, result.fpr());

        doubleResult(result.fpr(), node);

            
        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            SpeculateDoubleOperand op2(this, node->child2());

            FPRTemporary result(this, op1);

            FPRReg reg1 = op1.fpr();

            FPRReg reg2 = op2.fpr();

            m_jit.divDouble(reg1, reg2, result.fpr());

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

    }

    case ArithAbs: {

2189 if (node->child1()->~~shouldSpeculateIntegerForArithmetic~~()

2190 ~~&& node->canSpeculate~~Int~~eger())~~ {

2169 switch (node->child1().useKind()) {

2170 case Int32Use: {

            SpeculateIntegerOperand op1(this, node->child1());

            GPRTemporary result(this);

            GPRTemporary scratch(this);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        SpeculateDoubleOperand op1(this, node->child1());

        FPRTemporary result(this);

        m_jit.absDouble(op1.fpr(), result.fpr());

        doubleResult(result.fpr(), node);

        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            FPRTemporary result(this);

            m_jit.absDouble(op1.fpr(), result.fpr());

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

    case ArithMin:

    case ArithMax: {

2214 ~~if (Node::shouldSpeculateIntegerForAr~~it~~hmetic~~(node->chil~~d1().node(), node->child2().node~~())

2215 ~~&& node->canSpeculate~~Int~~eger())~~ {

2202 switch (node->binaryUseKind()) {

2203 case Int32Use: {

            SpeculateStrictInt32Operand op1(this, node->child1());

            SpeculateStrictInt32Operand op2(this, node->child2());

            GPRTemporary result(this, op1);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1);

        case NumberUse: {

            SpeculateDoubleOperand op1(this, node->child1());

            SpeculateDoubleOperand op2(this, node->child2());

            FPRTemporary result(this, op1);

22372226

2238 MacroAssembler::JumpList done;

2227 MacroAssembler::JumpList done;

22392228

2240 MacroAssembler::Jump op1Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleLessThan : MacroAssembler::DoubleGreaterThan, op1.fpr(), op2.fpr());

2229 MacroAssembler::Jump op1Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleLessThan : MacroAssembler::DoubleGreaterThan, op1.fpr(), op2.fpr());

22412230

2242 // op2 is eather the lesser one or one of then is NaN

2243 MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1.fpr(), op2.fpr());

2231 // op2 is eather the lesser one or one of then is NaN

2232 MacroAssembler::Jump op2Less = m_jit.branchDouble(op == ArithMin ? MacroAssembler::DoubleGreaterThanOrEqual : MacroAssembler::DoubleLessThanOrEqual, op1.fpr(), op2.fpr());

22442233

        // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 

        // op1 + op2 and putting it into result.

        m_jit.addDouble(op1.fpr(), op2.fpr(), result.fpr());

        done.append(m_jit.jump());

            // Unordered case. We don't know which of op1, op2 is NaN. Manufacture NaN by adding 

            // op1 + op2 and putting it into result.

            m_jit.addDouble(op1.fpr(), op2.fpr(), result.fpr());

            done.append(m_jit.jump());

22492238

2250 op2Less.link(&m_jit);

2251 m_jit.moveDouble(op2.fpr(), result.fpr());

2239 op2Less.link(&m_jit);

2240 m_jit.moveDouble(op2.fpr(), result.fpr());

22522241

2253 if (op1.fpr() != result.fpr()) {

2254 done.append(m_jit.jump());

2242 if (op1.fpr() != result.fpr()) {

2243 done.append(m_jit.jump());

22552244

            op1Less.link(&m_jit);

            m_jit.moveDouble(op1.fpr(), result.fpr());

        } else

            op1Less.link(&m_jit);

                op1Less.link(&m_jit);

                m_jit.moveDouble(op1.fpr(), result.fpr());

            } else

                op1Less.link(&m_jit);

22602249

2261 done.link(&m_jit);

2250 done.link(&m_jit);

22622251

2263 doubleResult(result.fpr(), node);

            doubleResult(result.fpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

        switch (arrayMode.type()) {

        case Array::Int32:

        case Array::Contiguous: {

2620 JSValueOperand value(this, child3);

2616 JSValueOperand value(this, child3, ManualOperandSpeculation);

            GPRReg valueReg = value.gpr();

            if (!m_compileOkay)

                return;

            if (arrayMode.type() == Array::Int32

                && !isInt32Speculation(m_state.forNode(child3).m_type)) {

                speculationCheck(

                    BadType, JSValueRegs(valueReg), child3,

                    m_jit.branch64(MacroAssembler::Below, valueReg, GPRInfo::tagTypeNumberRegister));

            if (arrayMode.type() == Array::Int32) {

                DFG_TYPE_CHECK(

                    JSValueRegs(valueReg), child3, SpecInt32,

                    m_jit.branch64(

                        MacroAssembler::Below, valueReg, GPRInfo::tagTypeNumberRegister));

            }

            if (arrayMode.type() == Array::Contiguous && Heap::isWriteBarrierEnabled()) {

@@void SpeculativeJIT::compile(Node* node)

        switch (node->arrayMode().type()) {

        case Array::Int32:

        case Array::Contiguous: {

2931 JSValueOperand value(this, node->child2());

2927 JSValueOperand value(this, node->child2(), ManualOperandSpeculation);

29322928 GPRReg valueGPR = value.gpr();

29332929

            if (node->arrayMode().type() == Array::Int32 && !isInt32Speculation(m_state.forNode(node->child2()).m_type)) {

                speculationCheck(

                    BadType, JSValueRegs(valueGPR), node->child2(),

                    m_jit.branch64(MacroAssembler::Below, valueGPR, GPRInfo::tagTypeNumberRegister));

            if (node->arrayMode().type() == Array::Int32) {

                DFG_TYPE_CHECK(

                    JSValueRegs(valueGPR), node->child2(), SpecInt32,

                    m_jit.branch64(

                        MacroAssembler::Below, valueGPR, GPRInfo::tagTypeNumberRegister));

            }

            if (node->arrayMode().type() != Array::Int32 && Heap::isWriteBarrierEnabled()) {

@@void SpeculativeJIT::compile(Node* node)

            SpeculateDoubleOperand value(this, node->child2());

            FPRReg valueFPR = value.fpr();

            if (!isRealNumberSpeculation(m_state.forNode(node->child2()).m_type)) {

                // FIXME: We need a way of profiling these, and we need to hoist them into

                // SpeculateDoubleOperand.

                speculationCheck(

                    BadType, JSValueRegs(), 0,

                    m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));

            }

            DFG_TYPE_CHECK(

                JSValueRegs(), node->child2(), SpecRealNumber,

                m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueFPR, valueFPR));

            
            m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), storageLengthGPR);

            MacroAssembler::Jump slowPath = m_jit.branch32(MacroAssembler::AboveOrEqual, storageLengthGPR, MacroAssembler::Address(storageGPR, Butterfly::offsetOfVectorLength()));

@@void SpeculativeJIT::compile(Node* node)

    }

    case ToPrimitive: {

3174 if (node->child1()->shouldSpeculateInteger()) {

3167 switch (node->child1().useKind()) {

3168 case Int32Use: {

            // It's really profitable to speculate integer, since it's really cheap,

            // it means we don't have to do any real work, and we emit a lot less code.

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        // FIXME: Add string speculation here.

        JSValueOperand op1(this, node->child1());

        GPRTemporary result(this, op1);

        case UntypedUse: {

            JSValueOperand op1(this, node->child1());

            GPRTemporary result(this, op1);

31933186

3194 GPRReg op1GPR = op1.gpr();

3195 GPRReg resultGPR = result.gpr();

3187 GPRReg op1GPR = op1.gpr();

3188 GPRReg resultGPR = result.gpr();

31963189

3197 op1.use();

3190 op1.use();

31983191

        if (!(m_state.forNode(node->child1()).m_type & ~(SpecNumber | SpecBoolean)))

            m_jit.move(op1GPR, resultGPR);

        else {

            MacroAssembler::Jump alreadyPrimitive = m_jit.branchTest64(MacroAssembler::NonZero, op1GPR, GPRInfo::tagMaskRegister);

            MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));

            if (!(m_state.forNode(node->child1()).m_type & ~(SpecNumber | SpecBoolean)))

                m_jit.move(op1GPR, resultGPR);

            else {

                MacroAssembler::Jump alreadyPrimitive = m_jit.branchTest64(MacroAssembler::NonZero, op1GPR, GPRInfo::tagMaskRegister);

                MacroAssembler::Jump notPrimitive = m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get()));

32043197

3205 alreadyPrimitive.link(&m_jit);

3206 m_jit.move(op1GPR, resultGPR);

3198 alreadyPrimitive.link(&m_jit);

3199 m_jit.move(op1GPR, resultGPR);

32073200

            addSlowPathGenerator(

                slowPathCall(notPrimitive, this, operationToPrimitive, resultGPR, op1GPR));

        }

                addSlowPathGenerator(

                    slowPathCall(notPrimitive, this, operationToPrimitive, resultGPR, op1GPR));

            }

32113204

3212 jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);

            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

                case ALL_DOUBLE_INDEXING_TYPES: {

                    SpeculateDoubleOperand operand(this, use);

                    FPRReg opFPR = operand.fpr();

                    if (!isRealNumberSpeculation(m_state.forNode(use).m_type)) {

                        // FIXME: We need a way of profiling these, and we need to hoist them into

                        // SpeculateDoubleOperand.

                        speculationCheck(

                            BadType, JSValueRegs(), 0,

                            m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                    }

                    DFG_TYPE_CHECK(

                        JSValueRegs(), use, SpecRealNumber,

                        m_jit.branchDouble(

                            MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                    m_jit.storeDouble(opFPR, MacroAssembler::Address(storageGPR, sizeof(double) * operandIdx));

                    break;

                }

                case ALL_INT32_INDEXING_TYPES:

                case ALL_CONTIGUOUS_INDEXING_TYPES: {

3267 JSValueOperand operand(this, use);

3263 JSValueOperand operand(this, use, ManualOperandSpeculation);

32683264 GPRReg opGPR = operand.gpr();

                    if (hasInt32(node->indexingType()) && !isInt32Speculation(m_state.forNode(use).m_type)) {

                        speculationCheck(

                            BadType, JSValueRegs(opGPR), use,

                            m_jit.branch64(MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));

                    if (hasInt32(node->indexingType())) {

                        DFG_TYPE_CHECK(

                            JSValueRegs(opGPR), use, SpecInt32,

                            m_jit.branch64(

                                MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));

                    }

                    m_jit.store64(opGPR, MacroAssembler::Address(storageGPR, sizeof(JSValue) * operandIdx));

                    break;

@@void SpeculativeJIT::compile(Node* node)

                GPRTemporary scratch(this);

                FPRReg opFPR = operand.fpr();

                GPRReg scratchGPR = scratch.gpr();

                if (!isRealNumberSpeculation(m_state.forNode(use).m_type)) {

                    // FIXME: We need a way of profiling these, and we need to hoist them into

                    // SpeculateDoubleOperand.

                    speculationCheck(

                        BadType, JSValueRegs(), 0,

                        m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                }

                DFG_TYPE_CHECK(

                    JSValueRegs(), use, SpecRealNumber,

                    m_jit.branchDouble(

                        MacroAssembler::DoubleNotEqualOrUnordered, opFPR, opFPR));

                m_jit.boxDouble(opFPR, scratchGPR);

                m_jit.store64(scratchGPR, buffer + operandIdx);

                break;

            }

            case ALL_INT32_INDEXING_TYPES: {

3335 JSValueOperand operand(this, use);

3328 JSValueOperand operand(this, use, ManualOperandSpeculation);

33363329 GPRReg opGPR = operand.gpr();

                if (hasInt32(node->indexingType()) && !isInt32Speculation(m_state.forNode(use).m_type)) {

                    speculationCheck(

                        BadType, JSValueRegs(opGPR), use,

                        m_jit.branch64(MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));

                if (hasInt32(node->indexingType())) {

                    DFG_TYPE_CHECK(

                        JSValueRegs(opGPR), use, SpecInt32,

                        m_jit.branch64(

                            MacroAssembler::Below, opGPR, GPRInfo::tagTypeNumberRegister));

                }

                m_jit.store64(opGPR, buffer + operandIdx);

                break;

@@void SpeculativeJIT::compile(Node* node)

    }

    case ConvertThis: {

        if (isObjectSpeculation(m_state.forNode(node->child1()).m_type)) {

            SpeculateCellOperand thisValue(this, node->child1());

            GPRTemporary result(this, thisValue);

            m_jit.move(thisValue.gpr(), result.gpr());

            cellResult(result.gpr(), node);

            break;

        }

        if (isOtherSpeculation(node->child1()->prediction())) {

            JSValueOperand thisValue(this, node->child1());

        switch (node->child1().useKind()) {

        case OtherUse: {

            JSValueOperand thisValue(this, node->child1(), ManualOperandSpeculation);

            GPRTemporary scratch(this);

            GPRReg thisValueGPR = thisValue.gpr();

            GPRReg scratchGPR = scratch.gpr();

3576 if (!i~~sOtherSpeculation(m_state.forNode~~(node->child1()~~).m_ty~~pe)) {

3563 if (needsTypeCheck(node->child1(), SpecOther)) {

35773564 m_jit.move(thisValueGPR, scratchGPR);

35783565 m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), scratchGPR);

3579 speculationCheck(BadType, JSValueRegs(thisValueGPR), node->child1(), m_jit.branch64(MacroAssembler::NotEqual, scratchGPR, MacroAssembler::TrustedImm64(ValueNull)));

                typeCheck(

                    JSValueRegs(thisValueGPR), node->child1(), SpecOther,

                    m_jit.branch64(

                        MacroAssembler::NotEqual, scratchGPR,

                        MacroAssembler::TrustedImm64(ValueNull)));

            }

            m_jit.move(MacroAssembler::TrustedImmPtr(m_jit.globalThisObjectFor(node->codeOrigin)), scratchGPR);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

3587 if ~~(is~~ObjectSp~~eculation(node->child1()->prediction()))~~ {

3578 case ObjectUse: {

            SpeculateCellOperand thisValue(this, node->child1());

            GPRTemporary result(this, thisValue);

            GPRReg thisValueGPR = thisValue.gpr();

            GPRReg resultGPR = result.gpr();

3593 if (!isObjectSpeculation(m_state.forNode(node->child1()).m_type))

3594 speculationCheck(BadType, JSValueSource::unboxedCell(thisValueGPR), node->child1(), m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(thisValueGPR, JSCell::structureOffset()), JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

            DFG_TYPE_CHECK(

                JSValueSource::unboxedCell(thisValueGPR), node->child1(), SpecObject,

                m_jit.branchPtr(

                    JITCompiler::Equal,

                    JITCompiler::Address(thisValueGPR, JSCell::structureOffset()),

                    JITCompiler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

            
            m_jit.move(thisValueGPR, resultGPR);

            cellResult(resultGPR, node);

            break;

        }

        
        JSValueOperand thisValue(this, node->child1());

        GPRReg thisValueGPR = thisValue.gpr();

        flushRegisters();

        GPRResult result(this);

        callOperation(operationConvertThis, result.gpr(), thisValueGPR);

        cellResult(result.gpr(), node);

            
        case UntypedUse: {

            JSValueOperand thisValue(this, node->child1());

            GPRReg thisValueGPR = thisValue.gpr();

            flushRegisters();

            GPRResult result(this);

            callOperation(operationConvertThis, result.gpr(), thisValueGPR);

            cellResult(result.gpr(), node);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);

            break;

        }

3779

3780 if (isCellSpeculation(node->child1()->prediction())) {

        switch (node->child1().useKind()) {

        case CellUse: {

            SpeculateCellOperand base(this, node->child1());

            GPRTemporary result(this, base);

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

        JSValueOperand base(this, node->child1());

        GPRTemporary result(this, base);

        GPRReg baseGPR = base.gpr();

        GPRReg resultGPR = result.gpr();

        case UntypedUse: {

            JSValueOperand base(this, node->child1());

            GPRTemporary result(this, base);

38003802

3801 base.use();

3803 GPRReg baseGPR = base.gpr();

3804 GPRReg resultGPR = result.gpr();

38023805

3803 ~~JITCompiler::Jump~~ ~~notCell~~ = ~~m_jit.branchTest64(JITCompiler::NonZero,~~ base~~GPR, GPRInfo::tagMaskRegister~~);

3806 base.use();

38043807

3805 cach~~edGetById(~~n~~ode->codeOrigin~~, baseGPR, ~~result~~GPR, nod~~e->identifierNumber(), notCell~~);

3808 JITCompiler::Jump notCell = m_jit.branchTest64(JITCompiler::NonZero, baseGPR, GPRInfo::tagMaskRegister);

38063809

3807 j~~sValu~~e~~Result(~~resultGPR, node~~, UseChildrenCalledExplicitly~~);

3810 cachedGetById(node->codeOrigin, baseGPR, resultGPR, node->identifierNumber(), notCell);

38083811

            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);

            break;

        }

3817

3818 if (isCellSpeculation(node->child1()->prediction())) {

        switch (node->child1().useKind()) {

        case CellUse: {

            SpeculateCellOperand base(this, node->child1());

            GPRReg baseGPR = base.gpr();

@@void SpeculativeJIT::compile(Node* node)

            break;

        }

3836 JSValueOperand base(this, node->child1());

3837 GPRReg baseGPR = base.gpr();

        case UntypedUse: {

            JSValueOperand base(this, node->child1());

            GPRReg baseGPR = base.gpr();

38383851

3839 GPRResult result(this);

3840 GPRReg resultGPR = result.gpr();

3852 GPRResult result(this);

3853 GPRReg resultGPR = result.gpr();

38413854

3842 base.use();

3843 flushRegisters();

3855 base.use();

3856 flushRegisters();

38443857

3845 JITCompiler::Jump notCell = m_jit.branchTest64(JITCompiler::NonZero, baseGPR, GPRInfo::tagMaskRegister);

3858 JITCompiler::Jump notCell = m_jit.branchTest64(JITCompiler::NonZero, baseGPR, GPRInfo::tagMaskRegister);

38463859

3847 cachedGetById(node->codeOrigin, baseGPR, resultGPR, node->identifierNumber(), notCell, DontSpill);

3860 cachedGetById(node->codeOrigin, baseGPR, resultGPR, node->identifierNumber(), notCell, DontSpill);

38483861

3849 jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);

3850

            jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

        break;

    }

@@void SpeculativeJIT::compile(Node* node)

        
    case CheckStructure:

    case ForwardCheckStructure: {

        AbstractValue& value = m_state.forNode(node->child1());

        if (value.m_currentKnownStructure.isSubsetOf(node->structureSet())

            && isCellSpeculation(value.m_type)) {

            noResult(node);

            break;

        }

        SpeculationDirection direction = node->op() == ForwardCheckStructure ? ForwardSpeculation : BackwardSpeculation;

        SpeculateCellOperand base(this, node->child1(), direction);

@@void SpeculativeJIT::compile(Node* node)

        JITCompiler::Jump isOK = m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(op1.gpr(), JSCell::structureOffset()), TrustedImmPtr(node->structure()));

        m_jit.breakpoint();

        isOK.link(&m_jit);

3957#else

3958 speculateCell(node->child1());

#endif

        noResult(node);

@@void SpeculativeJIT::compile(Node* node)

    }

    case PhantomPutStructure: {

3966 ASSERT(isKnownCell(node->child1().node()));

3967

        ASSERT(node->structureTransitionData().previousStructure->transitionWatchpointSetHasBeenInvalidated());

        m_jit.addWeakReferenceTransition(

            node->codeOrigin.codeOriginOwner(),

@@void SpeculativeJIT::compile(Node* node)

    }

    case TypeOf: {

4274 JSValueOperand value(this, node->child1());

4290 JSValueOperand value(this, node->child1(), ManualOperandSpeculation);

        GPRReg valueGPR = value.gpr();

        GPRTemporary temp(this);

        GPRReg tempGPR = temp.gpr();

@@void SpeculativeJIT::compile(Node* node)

        JITCompiler::JumpList doneJumps;

        flushRegisters();

4299

4300 ASSERT(node->child1().useKind() == UntypedUse || node->child1().useKind() == CellUse || node->child1().useKind() == StringUse);

42834301

42844302 JITCompiler::Jump isNotCell = m_jit.branchTest64(JITCompiler::NonZero, valueGPR, GPRInfo::tagMaskRegister);

4285 if (node->child1()->~~shoul~~dS~~peculateCell(~~))

4286 ~~speculationCheck(BadType,~~ JSValueSource(valueGPR), node->child1(), isNotCell);

4303 if (node->child1().useKind() != UntypedUse)

4304 DFG_TYPE_CHECK(JSValueSource(valueGPR), node->child1(), SpecCell, isNotCell);

42874305

4288 if (!node->child1()->shouldSpeculateObject()) {

4306 if (!node->child1()->shouldSpeculateObject() || node->child1().useKind() == StringUse) {

42894307 m_jit.loadPtr(JITCompiler::Address(valueGPR, JSCell::structureOffset()), tempGPR);

42904308 JITCompiler::Jump notString = m_jit.branch8(JITCompiler::NotEqual, JITCompiler::Address(tempGPR, Structure::typeInfoTypeOffset()), TrustedImm32(StringType));

4291 if (node->child1()->~~shouldSpeculate~~String())

4292 ~~speculationCheck(BadType,~~ JSValueSource(valueGPR), node->child1(), notString);

4309 if (node->child1().useKind() == StringUse)

4310 DFG_TYPE_CHECK(JSValueSource(valueGPR), node->child1(), SpecString, notString);

42934311 m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.stringString()), resultGPR);

42944312 doneJumps.append(m_jit.jump());

4295 if (!node->child1()->~~shouldSpeculate~~String()) {

4313 if (node->child1().useKind() != StringUse) {

                notString.link(&m_jit);

                callOperation(operationTypeOf, resultGPR, valueGPR);

                doneJumps.append(m_jit.jump());

@@void SpeculativeJIT::compile(Node* node)

            doneJumps.append(m_jit.jump());

        }

4305 if (!node->child1()->~~shoul~~dS~~peculateCell()~~) {

4323 if (node->child1().useKind() == UntypedUse) {

            isNotCell.link(&m_jit);

            JITCompiler::Jump notNumber = m_jit.branchTest64(JITCompiler::Zero, valueGPR, GPRInfo::tagTypeNumberRegister);

            m_jit.move(TrustedImmPtr(m_jit.globalData()->smallStrings.numberString()), resultGPR);

@@void SpeculativeJIT::compile(Node* node)

    }

    case Phantom:

        DFG_NODE_DO_TO_CHILDREN(m_jit.graph(), node, speculate);

        noResult(node);

        break;

    case PhantomLocal:

        // This is a no-op.

        noResult(node);

143562

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@void SpeculativeJIT::speculationCheck(Ex

{

    if (!m_compileOkay)

        return;

111 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

111 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    m_jit.appendExitInfo(jumpToFail);

    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(node), this, m_stream->size()));

}

void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail)

{

118 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

118 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpToFail);

}

@@OSRExitJumpPlaceholder SpeculativeJIT::s

{

    if (!m_compileOkay)

        return OSRExitJumpPlaceholder();

126 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

126 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    unsigned index = m_jit.codeBlock()->numberOfOSRExits();

    m_jit.appendExitInfo();

    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(node), this, m_stream->size()));

@@OSRExitJumpPlaceholder SpeculativeJIT::s

OSRExitJumpPlaceholder SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse)

{

135 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

135 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    return speculationCheck(kind, jsValueSource, nodeUse.node());

}

@@void SpeculativeJIT::speculationCheck(Ex

{

    if (!m_compileOkay)

        return;

143 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

143 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    m_jit.appendExitInfo(jumpsToFail);

    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(node), this, m_stream->size()));

}

void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, const MacroAssembler::JumpList& jumpsToFail)

{

150 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

150 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpsToFail);

}

@@void SpeculativeJIT::speculationCheck(Ex

{

    if (!m_compileOkay)

        return;

158 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

158 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    m_jit.codeBlock()->appendSpeculationRecovery(recovery);

    m_jit.appendExitInfo(jumpToFail);

    m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(node), this, m_stream->size(), m_jit.codeBlock()->numberOfSpeculationRecoveries()));

@@void SpeculativeJIT::speculationCheck(Ex

void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)

{

166 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

166 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    speculationCheck(kind, jsValueSource, nodeUse.node(), jumpToFail, recovery);

}

@@void SpeculativeJIT::speculationCheck(Ex

        convertLastOSRExitToForward();

}

void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge edge, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery, SpeculationDirection direction)

{

    speculationCheck(kind, jsValueSource, edge.node(), jumpToFail, recovery, direction);

}

JumpReplacementWatchpoint* SpeculativeJIT::speculationWatchpoint(ExitKind kind, JSValueSource jsValueSource, Node* node)

{

    if (!m_compileOkay)

        return 0;

181 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

186 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    m_jit.appendExitInfo(JITCompiler::JumpList());

    OSRExit& exit = m_jit.codeBlock()->osrExit(

        m_jit.codeBlock()->appendOSRExit(OSRExit(

@@JumpReplacementWatchpoint* SpeculativeJI

void SpeculativeJIT::forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node, MacroAssembler::Jump jumpToFail, const ValueRecovery& valueRecovery)

{

283 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

288 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    speculationCheck(kind, jsValueSource, node, jumpToFail);

    convertLastOSRExitToForward(valueRecovery);

}

void SpeculativeJIT::forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, Node* node, const MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& valueRecovery)

{

290 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

295 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    speculationCheck(kind, jsValueSource, node, jumpsToFail);

    convertLastOSRExitToForward(valueRecovery);

}

@@void SpeculativeJIT::speculationCheck(Ex

        speculationCheck(kind, jsValueSource, node, jumpToFail);

}

void SpeculativeJIT::speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge edge, MacroAssembler::Jump jumpToFail, SpeculationDirection direction)

{

    speculationCheck(kind, jsValueSource, edge.node(), jumpToFail, direction);

}

303313void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Node* node)

304314{

305 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

315 ASSERT(m_isCheckingArgumentTypes || m_canExit);

#if DFG_ENABLE(DEBUG_VERBOSE)

    dataLogF("SpeculativeJIT was terminated.\n");

#endif

@@void SpeculativeJIT::terminateSpeculativ

void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Edge nodeUse)

{

317 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

327 ASSERT(m_isCheckingArgumentTypes || m_canExit);

    terminateSpeculativeExecution(kind, jsValueRegs, nodeUse.node());

}

void SpeculativeJIT::terminateSpeculativeExecution(ExitKind kind, JSValueRegs jsValueRegs, Node* node, SpeculationDirection direction)

{

323 ASSERT(m_isCheckingArgumentTypes || m_c~~urrentNode->c~~anExit());

333 ASSERT(m_isCheckingArgumentTypes || m_canExit);

#if DFG_ENABLE(DEBUG_VERBOSE)

    dataLogF("SpeculativeJIT was terminated.\n");

#endif

@@void SpeculativeJIT::terminateSpeculativ

    m_compileOkay = false;

}

void SpeculativeJIT::typeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail)

{

    ASSERT(needsTypeCheck(edge, typesPassedThrough));

    m_state.forNode(edge).filter(typesPassedThrough);

    speculationCheck(BadType, source, edge, jumpToFail);

}

void SpeculativeJIT::forwardTypeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, const ValueRecovery& valueRecovery)

{

    typeCheck(source, edge, typesPassedThrough, jumpToFail);

    convertLastOSRExitToForward(valueRecovery);

}

void SpeculativeJIT::typeCheck(JSValueSource source, Edge edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, SpeculationDirection direction)

{

    typeCheck(source, edge, typesPassedThrough, jumpToFail);

    if (direction == ForwardSpeculation)

        convertLastOSRExitToForward();

}

void SpeculativeJIT::addSlowPathGenerator(PassOwnPtr<SlowPathGenerator> slowPathGenerator)

{

    m_slowPathGenerators.append(slowPathGenerator.leakPtr());

@@void SpeculativeJIT::arrayify(Node* node

    arrayify(node, base.gpr(), property.gpr());

}

875 GPRReg SpeculativeJIT::fillStorage(Node* node)

905GPRReg SpeculativeJIT::fillStorage(Edge edge)

876906{

877 VirtualRegister virtualRegister = node->virtualRegister();

907 VirtualRegister virtualRegister = edge->virtualRegister();

    GenerationInfo& info = m_generationInfo[virtualRegister];

    switch (info.registerFormat()) {

@@GPRReg SpeculativeJIT::fillStorage(Node*

        }

        // Must be a cell; fill it as a cell and then return the pointer.

891 return fillSpeculateCell(node, BackwardSpeculation);

921 return fillSpeculateCell(edge, BackwardSpeculation);

    }

    case DataFormatStorage: {

@@GPRReg SpeculativeJIT::fillStorage(Node*

    }

    default:

901 return fillSpeculateCell(node, BackwardSpeculation);

931 return fillSpeculateCell(edge, BackwardSpeculation);

    }

}

@@bool SpeculativeJIT::compilePeepHoleBran

        // so can be no intervening nodes to also reference the compare. 

        ASSERT(node->adjustedRefCount() == 1);

1512 if (~~Node::shouldSpeculateInteger(~~node->child1~~().node(), node->child2().node()))~~

1542 if (node->isBinaryUseKind(Int32Use))

15131543 compilePeepHoleIntegerBranch(node, branchNode, condition);

1514 else if (Node::~~shouldSpeculate~~Number~~(node->child1().node(), node->child2().node()))~~

1544 else if (node->isBinaryUseKind(NumberUse))

15151545 compilePeepHoleDoubleBranch(node, branchNode, doubleCondition);

15161546 else if (node->op() == CompareEq) {

1517 if (node->child1~~()->shouldSpeculate~~String~~() || node->child2()->shouldSpeculateString(~~)) {

1547 if (node->isBinaryUseKind(StringUse)) {

                nonSpeculativePeepholeBranch(node, branchNode, condition, operation);

                return true;

            }

1521 if (node->child1~~()->shouldSpeculate~~Object~~() && node->child2()->shouldSpeculateObject(~~))

1551 if (node->isBinaryUseKind(ObjectUse))

15221552 compilePeepHoleObjectEquality(node, branchNode);

1523 else if (node->child1()->~~shouldSpeculate~~Object() && node->child2()->~~shouldSpeculate~~ObjectOrOther())

1553 else if (node->child1().useKind() == ObjectUse && node->child2().useKind() == ObjectOrOtherUse)

15241554 compilePeepHoleObjectToObjectOrOtherEquality(node->child1(), node->child2(), branchNode);

1525 else if (node->child1()->~~shouldSpeculate~~ObjectOrOther() && node->child2()->~~shouldSpeculate~~Object())

1555 else if (node->child1().useKind() == ObjectOrOtherUse && node->child2().useKind() == ObjectUse)

                compilePeepHoleObjectToObjectOrOtherEquality(node->child2(), node->child1(), branchNode);

            else {

                nonSpeculativePeepholeBranch(node, branchNode, condition, operation);

@@void SpeculativeJIT::compile(BasicBlock&

    for (m_indexInBlock = 0; m_indexInBlock < block.size(); ++m_indexInBlock) {

        m_currentNode = block[m_indexInBlock];

#if !ASSERT_DISABLED

        m_canExit = m_currentNode->canExit();

#endif

        bool shouldExecuteEffects = m_state.startExecuting(m_currentNode);

        m_jit.setForNode(m_currentNode);

        m_codeOriginForOSR = m_currentNode->codeOrigin;

        if (!m_currentNode->shouldGenerate()) {

@@void SpeculativeJIT::compile(BasicBlock&

            }

        } else {

            if (verboseCompilationEnabled()) {

                dataLogF(

                    "SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x",

                    (int)m_currentNode->index(),

                    m_currentNode->codeOrigin.bytecodeIndex, m_jit.debugOffset());

17141753#if DFG_ENABLE(DEBUG_VERBOSE)

1715 dataLogF("SpeculativeJIT generating Node @%d (bc#%u) at JIT offset 0x%x ", (int)m_currentNode->index(), m_currentNode->codeOrigin.bytecodeIndex, m_jit.debugOffset());

                dataLog("   ");

#else

                dataLog("\n");

17161757#endif

1758 }

#if DFG_ENABLE(JIT_BREAK_ON_EVERY_NODE)

            m_jit.breakpoint();

#endif

@@void SpeculativeJIT::compile(BasicBlock&

#endif

        // Make sure that the abstract state is rematerialized for the next node.

1762 m_state.execute(m_indexInBlock);

1804 if (shouldExecuteEffects)

1805 m_state.executeEffects(m_indexInBlock);

        
        if (m_currentNode->shouldGenerate())

            checkConsistency();

@@void SpeculativeJIT::compileDoublePutByV

    FPRReg valueReg = value.fpr();

    

    if (!isRealNumberSpeculation(m_state.forNode(child3).m_type)) {

        // FIXME: We need a way of profiling these, and we need to hoist them into

        // SpeculateDoubleOperand.

        speculationCheck(

            BadType, JSValueRegs(), 0,

            m_jit.branchDouble(MacroAssembler::DoubleNotEqualOrUnordered, valueReg, valueReg));

    }

    DFG_TYPE_CHECK(

        JSValueRegs(), child3, SpecRealNumber,

        m_jit.branchDouble(

            MacroAssembler::DoubleNotEqualOrUnordered, valueReg, valueReg));

    
    if (!m_compileOkay)

        return;

@@GeneratedOperandType SpeculativeJIT::che

void SpeculativeJIT::compileValueToInt32(Node* node)

{

2107 if (node->child1()->shouldSpeculateInteger()) {

2147 switch (node->child1().useKind()) {

2148 case Int32Use: {

        SpeculateIntegerOperand op1(this, node->child1());

        GPRTemporary result(this, op1);

        m_jit.move(op1.gpr(), result.gpr());

@@void SpeculativeJIT::compileValueToInt32

        return;

    }

    if (node->child1()->shouldSpeculateBoolean()) {

        SpeculateBooleanOperand op1(this, node->child1());

        GPRTemporary result(this, op1);

        m_jit.move(op1.gpr(), result.gpr());

        m_jit.and32(JITCompiler::TrustedImm32(1), result.gpr());

        integerResult(result.gpr(), node);

        return;

    }

    switch (checkGeneratedTypeForToInt32(node->child1().node())) {

    case GeneratedOperandInteger: {

        SpeculateIntegerOperand op1(this, node->child1());

        GPRTemporary result(this, op1);

        m_jit.move(op1.gpr(), result.gpr());

        integerResult(result.gpr(), node, op1.format());

        return;

    }

    case GeneratedOperandDouble: {

        GPRTemporary result(this);

        SpeculateDoubleOperand op1(this, Edge(node->child1().node(), DoubleUse)); // SpeculateDoubleOperand will assert that this is a double use. We force it to think that it was a double use, since we are inferring that we ought to emit a double use quite late.

        FPRReg fpr = op1.fpr();

        GPRReg gpr = result.gpr();

        JITCompiler::Jump notTruncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateFailed);

    case NumberUse:

    case NotCellUse: {

        switch (checkGeneratedTypeForToInt32(node->child1().node())) {

        case GeneratedOperandInteger: {

            SpeculateIntegerOperand op1(this, node->child1(), BackwardSpeculation, ManualOperandSpeculation);

            GPRTemporary result(this, op1);

            m_jit.move(op1.gpr(), result.gpr());

            integerResult(result.gpr(), node, op1.format());

            return;

        }

        case GeneratedOperandDouble: {

            GPRTemporary result(this);

            SpeculateDoubleOperand op1(this, node->child1(), BackwardSpeculation, ManualOperandSpeculation);

            FPRReg fpr = op1.fpr();

            GPRReg gpr = result.gpr();

            JITCompiler::Jump notTruncatedToInteger = m_jit.branchTruncateDoubleToInt32(fpr, gpr, JITCompiler::BranchIfTruncateFailed);

21402172

2141 addSlowPathGenerator(slowPathCall(notTruncatedToInteger, this, toInt32, gpr, fpr));

2173 addSlowPathGenerator(slowPathCall(notTruncatedToInteger, this, toInt32, gpr, fpr));

21422174

        integerResult(gpr, node);

        return;

    }

    case GeneratedOperandJSValue: {

        GPRTemporary result(this);

            integerResult(gpr, node);

            return;

        }

        case GeneratedOperandJSValue: {

            GPRTemporary result(this);

21482180#if USE(JSVALUE64)

2149 JSValueOperand op1(this, node->child1());

2181 JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);

21502182

        GPRReg gpr = op1.gpr();

        GPRReg resultGpr = result.gpr();

        FPRTemporary tempFpr(this);

        FPRReg fpr = tempFpr.fpr();

        JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);

        JITCompiler::JumpList converted;

        if (!isNumberSpeculation(m_state.forNode(node->child1()).m_type)) {

            if (node->child1()->shouldSpeculateNumber())

                speculationCheck(BadType, JSValueRegs(gpr), node->child1(), m_jit.branchTest64(MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));

            else {

            GPRReg gpr = op1.gpr();

            GPRReg resultGpr = result.gpr();

            FPRTemporary tempFpr(this);

            FPRReg fpr = tempFpr.fpr();

            JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, gpr, GPRInfo::tagTypeNumberRegister);

            JITCompiler::JumpList converted;

            if (node->child1().useKind() == NumberUse) {

                DFG_TYPE_CHECK(

                    JSValueRegs(gpr), node->child1(), SpecNumber,

                    m_jit.branchTest64(

                        MacroAssembler::Zero, gpr, GPRInfo::tagTypeNumberRegister));

            } else {

21632197 JITCompiler::Jump isNumber = m_jit.branchTest64(MacroAssembler::NonZero, gpr, GPRInfo::tagTypeNumberRegister);

21642198

2165 if (m_state.forNode(node->child1()).m_type & SpecCell)

2166 speculationCheck(BadType, JSValueRegs(gpr), node->child1(), m_jit.branchTest64(JITCompiler::Zero, gpr, GPRInfo::tagMaskRegister));

                DFG_TYPE_CHECK(

                    JSValueRegs(gpr), node->child1(), ~SpecCell,

                    m_jit.branchTest64(

                        JITCompiler::Zero, gpr, GPRInfo::tagMaskRegister));

                
                // It's not a cell: so true turns into 1 and all else turns into 0.

                m_jit.compare64(JITCompiler::Equal, gpr, TrustedImm32(ValueTrue), resultGpr);

@@void SpeculativeJIT::compileValueToInt32

                
                isNumber.link(&m_jit);

            }

2174 }

21752210

        // First, if we get here we have a double encoded as a JSValue

        m_jit.move(gpr, resultGpr);

        unboxDouble(resultGpr, fpr);

            // First, if we get here we have a double encoded as a JSValue

            m_jit.move(gpr, resultGpr);

            unboxDouble(resultGpr, fpr);

21792214

        silentSpillAllRegisters(resultGpr);

        callOperation(toInt32, resultGpr, fpr);

        silentFillAllRegisters(resultGpr);

            silentSpillAllRegisters(resultGpr);

            callOperation(toInt32, resultGpr, fpr);

            silentFillAllRegisters(resultGpr);

21832218

2184 converted.append(m_jit.jump());

2219 converted.append(m_jit.jump());

21852220

2186 isInteger.link(&m_jit);

2187 m_jit.zeroExtend32ToPtr(gpr, resultGpr);

2221 isInteger.link(&m_jit);

2222 m_jit.zeroExtend32ToPtr(gpr, resultGpr);

21882223

2189 converted.link(&m_jit);

2224 converted.link(&m_jit);

21902225#else

        Node* childNode = node->child1().node();

        VirtualRegister virtualRegister = childNode->virtualRegister();

        GenerationInfo& info = m_generationInfo[virtualRegister];

            Node* childNode = node->child1().node();

            VirtualRegister virtualRegister = childNode->virtualRegister();

            GenerationInfo& info = m_generationInfo[virtualRegister];

21942229

2195 JSValueOperand op1(this, node->child1());

2230 JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);

21962231

2197 GPRReg payloadGPR = op1.payloadGPR();

2198 GPRReg resultGpr = result.gpr();

2232 GPRReg payloadGPR = op1.payloadGPR();

2233 GPRReg resultGpr = result.gpr();

21992234

        JITCompiler::JumpList converted;

        if (info.registerFormat() == DataFormatJSInteger)

            m_jit.move(payloadGPR, resultGpr);

        else {

            GPRReg tagGPR = op1.tagGPR();

            FPRTemporary tempFpr(this);

            FPRReg fpr = tempFpr.fpr();

            FPRTemporary scratch(this);

            JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

2235 JITCompiler::JumpList converted;

22112236

            if (!isNumberSpeculation(m_state.forNode(node->child1()).m_type)) {

                if (node->child1()->shouldSpeculateNumber())

                    speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node->child1(), m_jit.branch32(MacroAssembler::AboveOrEqual, tagGPR, TrustedImm32(JSValue::LowestTag)));

                else {

            if (info.registerFormat() == DataFormatJSInteger)

                m_jit.move(payloadGPR, resultGpr);

            else {

                GPRReg tagGPR = op1.tagGPR();

                FPRTemporary tempFpr(this);

                FPRReg fpr = tempFpr.fpr();

                FPRTemporary scratch(this);

                JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, tagGPR, TrustedImm32(JSValue::Int32Tag));

                if (node->child1().useKind() == NumberUse) {

                    DFG_TYPE_CHECK(

                        JSValueRegs(tagGPR, payloadGPR), node->child1(), SpecNumber,

                        m_jit.branch32(

                            MacroAssembler::AboveOrEqual, tagGPR,

                            TrustedImm32(JSValue::LowestTag)));

                } else {

22162254 JITCompiler::Jump isNumber = m_jit.branch32(MacroAssembler::Below, tagGPR, TrustedImm32(JSValue::LowestTag));

22172255

2218 if (m_state.forNode(node->child1()).m_type & SpecCell)

2219 speculationCheck(BadType, JSValueRegs(tagGPR, payloadGPR), node->child1(), m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::CellTag)));

                    DFG_TYPE_CHECK(

                        JSValueRegs(tagGPR, payloadGPR), node->child1(), ~SpecCell,

                        m_jit.branch32(

                            JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::CellTag)));

                    
                    // It's not a cell: so true turns into 1 and all else turns into 0.

                    JITCompiler::Jump isBoolean = m_jit.branch32(JITCompiler::Equal, tagGPR, TrustedImm32(JSValue::BooleanTag));

@@void SpeculativeJIT::compileValueToInt32

                    
                    isNumber.link(&m_jit);

                }

2232 }

22332272

2234 unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());

2273 unboxDouble(tagGPR, payloadGPR, fpr, scratch.fpr());

22352274

            silentSpillAllRegisters(resultGpr);

            callOperation(toInt32, resultGpr, fpr);

            silentFillAllRegisters(resultGpr);

                silentSpillAllRegisters(resultGpr);

                callOperation(toInt32, resultGpr, fpr);

                silentFillAllRegisters(resultGpr);

22392278

2240 converted.append(m_jit.jump());

2279 converted.append(m_jit.jump());

22412280

2242 isInteger.link(&m_jit);

2243 m_jit.move(payloadGPR, resultGpr);

2281 isInteger.link(&m_jit);

2282 m_jit.move(payloadGPR, resultGpr);

22442283

2245 converted.link(&m_jit);

2246 }

2284 converted.link(&m_jit);

2285 }

22472286#endif

2248 integerResult(resultGpr, node);

            integerResult(resultGpr, node);

            return;

        }

        case GeneratedOperandTypeUnknown:

            RELEASE_ASSERT_NOT_REACHED();

            return;

        }

        RELEASE_ASSERT_NOT_REACHED();

22492295 return;

22502296 }

2251 case GeneratedOperandTypeUnknown:

    
    case BooleanUse: {

        SpeculateBooleanOperand op1(this, node->child1());

        GPRTemporary result(this, op1);

        m_jit.move(op1.gpr(), result.gpr());

        m_jit.and32(JITCompiler::TrustedImm32(1), result.gpr());

        integerResult(result.gpr(), node);

        return;

    }

    default:

22522310 ASSERT(!m_compileOkay);

2253 b~~reak~~;

2311 return;

    }

}

@@void SpeculativeJIT::compileInt32ToDoubl

    ASSERT(!isInt32Constant(node->child1().node())); // This should have been constant folded.

    if (isInt32Speculation(m_state.forNode(node->child1()).m_type)) {

2316 SpeculateIntegerOperand op1(this, node->child1());

2374 SpeculateIntegerOperand op1(this, node->child1(), BackwardSpeculation, ManualOperandSpeculation);

        FPRTemporary result(this);

        m_jit.convertInt32ToDouble(op1.gpr(), result.fpr());

        doubleResult(result.fpr(), node);

        return;

    }

2323 JSValueOperand op1(this, node->child1());

2381 JSValueOperand op1(this, node->child1(), ManualOperandSpeculation);

    FPRTemporary result(this);

#if USE(JSVALUE64)

@@void SpeculativeJIT::compileInt32ToDoubl

    JITCompiler::Jump isInteger = m_jit.branch64(

        MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);

2336 if (!i~~sNumberS~~pe~~culation(m_state.forNode~~(node->child1()~~).m_ty~~pe)) {

2394 if (needsTypeCheck(node->child1(), SpecNumber)) {

23372395 if (node->op() == ForwardInt32ToDouble) {

2338 forwardS~~peculation~~Check(

2339 ~~BadType,~~ JSValueRegs(op1GPR), node->child1()~~.node()~~,

2396 forwardTypeCheck(

2397 JSValueRegs(op1GPR), node->child1(), SpecNumber,

                m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister),

                ValueRecovery::inGPR(op1GPR, DataFormatJS));

        } else {

2343 s~~peculation~~Check(

2344 ~~BadType,~~ JSValueRegs(op1GPR), node->child1(),

2401 typeCheck(

2402 JSValueRegs(op1GPR), node->child1(), SpecNumber,

                m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister));

        }

    }

@@void SpeculativeJIT::compileInt32ToDoubl

    JITCompiler::Jump isInteger = m_jit.branch32(

        MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));

2367 if (!i~~sNumberS~~pe~~culation(m_state.forNode~~(node->child1()~~).m_ty~~pe)) {

2425 if (needsTypeCheck(node->child1(), SpecNumber)) {

23682426 if (node->op() == ForwardInt32ToDouble) {

2369 forwardS~~peculation~~Check(

2370 ~~BadType,~~ JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1()~~.node()~~,

2427 forwardTypeCheck(

2428 JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecNumber,

                m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)),

                ValueRecovery::inPair(op1TagGPR, op1PayloadGPR));

        } else {

2374 s~~peculation~~Check(

2375 ~~BadType,~~ JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(),

2432 typeCheck(

2433 JSValueRegs(op1TagGPR, op1PayloadGPR), node->child1(), SpecNumber,

                m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)));

        }

    }

@@void SpeculativeJIT::compilePutByValForI

        m_jit.move(Imm32(toInt32(d)), scratchReg);

        value.adopt(scratch);

        valueGPR = scratchReg;

    } else if (valueUse->shouldSpeculateInteger()) {

        SpeculateIntegerOperand valueOp(this, valueUse);

        GPRTemporary scratch(this);

        GPRReg scratchReg = scratch.gpr();

        m_jit.move(valueOp.gpr(), scratchReg);

        if (rounding == ClampRounding) {

            ASSERT(elementSize == 1);

            compileClampIntegerToByte(m_jit, scratchReg);

        }

        value.adopt(scratch);

        valueGPR = scratchReg;

    } else if (rounding == ClampRounding) {

        ASSERT(elementSize == 1);

        SpeculateDoubleOperand valueOp(this, valueUse);

        GPRTemporary result(this);

        FPRTemporary floatScratch(this);

        FPRReg fpr = valueOp.fpr();

        GPRReg gpr = result.gpr();

        compileClampDoubleToByte(m_jit, gpr, fpr, floatScratch.fpr());

        value.adopt(result);

        valueGPR = gpr;

25492586 } else {

        SpeculateDoubleOperand valueOp(this, valueUse);

        GPRTemporary result(this);

        FPRReg fpr = valueOp.fpr();

        GPRReg gpr = result.gpr();

        MacroAssembler::Jump notNaN = m_jit.branchDouble(MacroAssembler::DoubleEqual, fpr, fpr);

        m_jit.xorPtr(gpr, gpr);

        MacroAssembler::Jump fixed = m_jit.jump();

        notNaN.link(&m_jit);

        MacroAssembler::Jump failed;

        if (signedness == SignedTypedArray)

            failed = m_jit.branchTruncateDoubleToInt32(fpr, gpr, MacroAssembler::BranchIfTruncateFailed);

        else

            failed = m_jit.branchTruncateDoubleToUint32(fpr, gpr, MacroAssembler::BranchIfTruncateFailed);

        addSlowPathGenerator(slowPathCall(failed, this, toInt32, gpr, fpr));

        fixed.link(&m_jit);

        value.adopt(result);

        valueGPR = gpr;

        switch (valueUse.useKind()) {

        case Int32Use: {

            SpeculateIntegerOperand valueOp(this, valueUse);

            GPRTemporary scratch(this);

            GPRReg scratchReg = scratch.gpr();

            m_jit.move(valueOp.gpr(), scratchReg);

            if (rounding == ClampRounding) {

                ASSERT(elementSize == 1);

                compileClampIntegerToByte(m_jit, scratchReg);

            }

            value.adopt(scratch);

            valueGPR = scratchReg;

            break;

        }

        case NumberUse: {

            if (rounding == ClampRounding) {

                ASSERT(elementSize == 1);

                SpeculateDoubleOperand valueOp(this, valueUse);

                GPRTemporary result(this);

                FPRTemporary floatScratch(this);

                FPRReg fpr = valueOp.fpr();

                GPRReg gpr = result.gpr();

                compileClampDoubleToByte(m_jit, gpr, fpr, floatScratch.fpr());

                value.adopt(result);

                valueGPR = gpr;

            } else {

                SpeculateDoubleOperand valueOp(this, valueUse);

                GPRTemporary result(this);

                FPRReg fpr = valueOp.fpr();

                GPRReg gpr = result.gpr();

                MacroAssembler::Jump notNaN = m_jit.branchDouble(MacroAssembler::DoubleEqual, fpr, fpr);

                m_jit.xorPtr(gpr, gpr);

                MacroAssembler::Jump fixed = m_jit.jump();

                notNaN.link(&m_jit);

                MacroAssembler::Jump failed;

                if (signedness == SignedTypedArray)

                    failed = m_jit.branchTruncateDoubleToInt32(fpr, gpr, MacroAssembler::BranchIfTruncateFailed);

                else

                    failed = m_jit.branchTruncateDoubleToUint32(fpr, gpr, MacroAssembler::BranchIfTruncateFailed);

                addSlowPathGenerator(slowPathCall(failed, this, toInt32, gpr, fpr));

                fixed.link(&m_jit);

                value.adopt(result);

                valueGPR = gpr;

            }

            break;

        }

        default:

            RELEASE_ASSERT_NOT_REACHED();

            break;

        }

25702642 }

2643

    ASSERT_UNUSED(valueGPR, valueGPR != property);

    ASSERT(valueGPR != base);

    ASSERT(valueGPR != storageReg);

@@void SpeculativeJIT::compileInstanceOfFo

void SpeculativeJIT::compileInstanceOf(Node* node)

{

2712 if ((!!(node->child1()->prediction() & ~SpecCell) && !!(m_state.forNode(node->child1()).m_type & ~SpecCell))

2713 || node->child1()->adjustedRefCount() == 1) {

2785 if (node->child1().useKind() == UntypedUse) {

        // It might not be a cell. Speculate less aggressively.

        // Or: it might only be used once (i.e. by us), so we get zero benefit

        // from speculating any more aggressively than we absolutely need to.

@@void SpeculativeJIT::compileSoftModulo(N

void SpeculativeJIT::compileAdd(Node* node)

{

2951 if (m_jit.graph().addShouldSpeculateInteger(node)) {

3023 switch (node->binaryUseKind()) {

3024 case Int32Use: {

29523025 if (isNumberConstant(node->child1().node())) {

2953 int32_t imm1 = valueOf~~Number~~Constant~~AsInt32~~(node->child1().node());

3026 int32_t imm1 = valueOfInt32Constant(node->child1().node());

            SpeculateIntegerOperand op2(this, node->child2());

            GPRTemporary result(this);

@@void SpeculativeJIT::compileAdd(Node* no

                
        if (isNumberConstant(node->child2().node())) {

            SpeculateIntegerOperand op1(this, node->child1());

2969 int32_t imm2 = valueOf~~Number~~Constant~~AsInt32~~(node->child2().node());

3042 int32_t imm2 = valueOfInt32Constant(node->child2().node());

            GPRTemporary result(this);

            if (nodeCanTruncateInteger(node->arithNodeFlags())) {

@@void SpeculativeJIT::compileAdd(Node* no

        integerResult(gprResult, node);

        return;

    }

3011

3012 if ~~(Node::shouldSpeculate~~Number~~ExpectingDefined(node->child1().node(), node->child2().node()))~~ {

3084

3085 case NumberUse: {

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1, op2);

@@void SpeculativeJIT::compileAdd(Node* no

        doubleResult(result.fpr(), node);

        return;

    }

3024

3025 if (node->op() == ValueAdd) {

        
    case UntypedUse: {

        RELEASE_ASSERT(node->op() == ValueAdd);

        compileValueAdd(node);

        return;

    }

    
    // We don't handle this yet. :-(

    terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);

        
    default:

        RELEASE_ASSERT_NOT_REACHED();

        break;

    }

}

void SpeculativeJIT::compileArithSub(Node* node)

{

3036 if (m_jit.graph().addShouldSpeculateInteger(node)) {

3112 switch (node->binaryUseKind()) {

3113 case Int32Use: {

30373114 if (isNumberConstant(node->child2().node())) {

30383115 SpeculateIntegerOperand op1(this, node->child1());

3039 int32_t imm2 = valueOf~~Number~~Constant~~AsInt32~~(node->child2().node());

3116 int32_t imm2 = valueOfInt32Constant(node->child2().node());

            GPRTemporary result(this);

            if (nodeCanTruncateInteger(node->arithNodeFlags())) {

@@void SpeculativeJIT::compileArithSub(Nod

        }

        if (isNumberConstant(node->child1().node())) {

3059 int32_t imm1 = valueOf~~Number~~Constant~~AsInt32~~(node->child1().node());

3136 int32_t imm1 = valueOfInt32Constant(node->child1().node());

            SpeculateIntegerOperand op2(this, node->child2());

            GPRTemporary result(this);

@@void SpeculativeJIT::compileArithSub(Nod

        return;

    }

    SpeculateDoubleOperand op1(this, node->child1());

    SpeculateDoubleOperand op2(this, node->child2());

    FPRTemporary result(this, op1);

    case NumberUse: {

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1);

30903168

    FPRReg reg1 = op1.fpr();

    FPRReg reg2 = op2.fpr();

    m_jit.subDouble(reg1, reg2, result.fpr());

        FPRReg reg1 = op1.fpr();

        FPRReg reg2 = op2.fpr();

        m_jit.subDouble(reg1, reg2, result.fpr());

30943172

3095 doubleResult(result.fpr(), node);

        doubleResult(result.fpr(), node);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return;

    }

}

void SpeculativeJIT::compileArithNegate(Node* node)

{

3100 if (m_jit.graph().negateShouldSpeculateInteger(node)) {

3185 switch (node->child1().useKind()) {

3186 case Int32Use: {

        SpeculateIntegerOperand op1(this, node->child1());

        GPRTemporary result(this);

@@void SpeculativeJIT::compileArithNegate(

        return;

    }

    SpeculateDoubleOperand op1(this, node->child1());

    FPRTemporary result(this);

    m_jit.negateDouble(op1.fpr(), result.fpr());

    doubleResult(result.fpr(), node);

    case NumberUse: {

        SpeculateDoubleOperand op1(this, node->child1());

        FPRTemporary result(this);

        m_jit.negateDouble(op1.fpr(), result.fpr());

        doubleResult(result.fpr(), node);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return;

    }

}

void SpeculativeJIT::compileArithMul(Node* node)

{

3128 if (m_jit.graph().mulShouldSpeculateInteger(node)) {

3222 switch (node->binaryUseKind()) {

3223 case Int32Use: {

        SpeculateIntegerOperand op1(this, node->child1());

        SpeculateIntegerOperand op2(this, node->child2());

        GPRTemporary result(this);

@@void SpeculativeJIT::compileArithMul(Nod

        integerResult(result.gpr(), node);

        return;

    }

    SpeculateDoubleOperand op1(this, node->child1());

    SpeculateDoubleOperand op2(this, node->child2());

    FPRTemporary result(this, op1, op2);

    FPRReg reg1 = op1.fpr();

    FPRReg reg2 = op2.fpr();

31663254

3167 m_jit.mulDouble(reg1, reg2, result.fpr());

    case NumberUse: {

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

        FPRTemporary result(this, op1, op2);

        FPRReg reg1 = op1.fpr();

        FPRReg reg2 = op2.fpr();

        m_jit.mulDouble(reg1, reg2, result.fpr());

31683264

3169 doubleResult(result.fpr(), node);

        doubleResult(result.fpr(), node);

        return;

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return;

    }

}

#if CPU(X86) || CPU(X86_64)

@@void SpeculativeJIT::compileIntegerArith

void SpeculativeJIT::compileArithMod(Node* node)

{

3279 ~~if (Node::shouldSpeculateIntegerForAr~~it~~hmetic~~(node->chil~~d1().node(), node->child2().node~~())

3280 ~~&& node->canSpeculate~~Int~~eger())~~ {

3382 switch (node->binaryUseKind()) {

3383 case Int32Use: {

        compileSoftModulo(node);

        return;

    }

3285 SpeculateDoubleOperand op1(this, node->child1());

3286 SpeculateDoubleOperand op2(this, node->child2());

    case NumberUse: {

        SpeculateDoubleOperand op1(this, node->child1());

        SpeculateDoubleOperand op2(this, node->child2());

32873391

3288 FPRReg op1FPR = op1.fpr();

3289 FPRReg op2FPR = op2.fpr();

3392 FPRReg op1FPR = op1.fpr();

3393 FPRReg op2FPR = op2.fpr();

32903394

3291 flushRegisters();

3395 flushRegisters();

32923396

    FPRResult result(this);

    callOperation(fmodAsDFGOperation, result.fpr(), op1FPR, op2FPR);

        FPRResult result(this);

        callOperation(fmodAsDFGOperation, result.fpr(), op1FPR, op2FPR);

        doubleResult(result.fpr(), node);

        return;

    }

32963404

3297 doubleResult(result.fpr(), node);

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return;

    }

}

// Returns true if the compare is fused with a subsequent branch.

@@bool SpeculativeJIT::compare(Node* node,

    if (compilePeepHoleBranch(node, condition, doubleCondition, operation))

        return true;

3306 if (~~Node::shouldSpeculateInteger(~~node->child1~~().node(), node->child2().node()~~)) {

3417 if (node->isBinaryUseKind(Int32Use)) {

        compileIntegerCompare(node, condition);

        return false;

    }

3310

3311 if (Node::~~shouldSpeculate~~Number~~(node->child1().node(), node->child2().node()~~)) {

3421

3422 if (node->isBinaryUseKind(NumberUse)) {

        compileDoubleCompare(node, doubleCondition);

        return false;

    }

    if (node->op() == CompareEq) {

3317 if (node->child1~~()->shouldSpeculate~~String~~() || node->child2()->shouldSpeculateString(~~)) {

3428 if (node->isBinaryUseKind(StringUse)) {

            nonSpeculativeNonPeepholeCompare(node, condition, operation);

            return false;

        }

3321

3322 if (node->child1~~()->shouldSpeculate~~Object~~() && node->child2()->shouldSpeculateObject(~~)) {

3432

3433 if (node->isBinaryUseKind(ObjectUse)) {

            compileObjectEquality(node);

            return false;

        }

3327 if (node->child1()->~~shouldSpeculate~~Object() && node->child2()->~~shouldSpeculate~~ObjectOrOther()) {

3438 if (node->child1().useKind() == ObjectUse && node->child2().useKind() == ObjectOrOtherUse) {

            compileObjectToObjectOrOtherEquality(node->child1(), node->child2());

            return false;

        }

3332 if (node->child1()->~~shouldSpeculate~~ObjectOrOther() && node->child2()->~~shouldSpeculate~~Object()) {

3443 if (node->child1().useKind() == ObjectOrOtherUse && node->child2().useKind() == ObjectUse) {

            compileObjectToObjectOrOtherEquality(node->child2(), node->child1());

            return false;

        }

@@bool SpeculativeJIT::compileStrictEqForC

bool SpeculativeJIT::compileStrictEq(Node* node)

{

3420 if (Node::shouldSpeculateInteger(node->child1().node(), node->child2().node())) {

3531 switch (node->binaryUseKind()) {

3532 case Int32Use: {

        unsigned branchIndexInBlock = detectPeepHoleBranch();

        if (branchIndexInBlock != UINT_MAX) {

            Node* branchNode = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);

@@bool SpeculativeJIT::compileStrictEq(Nod

        compileIntegerCompare(node, MacroAssembler::Equal);

        return false;

    }

3434

3435 if ~~(Node::shouldSpeculate~~Number~~(node->child1().node(), node->child2().node()))~~ {

3546

3547 case NumberUse: {

        unsigned branchIndexInBlock = detectPeepHoleBranch();

        if (branchIndexInBlock != UINT_MAX) {

            Node* branchNode = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);

@@bool SpeculativeJIT::compileStrictEq(Nod

        compileDoubleCompare(node, MacroAssembler::DoubleEqual);

        return false;

    }

3449

3450 if ~~(node->child1()->shouldSpeculate~~String() ~~|| node->child2()->shouldSpeculateString())~~

3561

3562 case StringUse: {

34513563 return nonSpeculativeStrictEq(node);

3452 if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {

    }

    case ObjectUse: {

        unsigned branchIndexInBlock = detectPeepHoleBranch();

        if (branchIndexInBlock != UINT_MAX) {

            Node* branchNode = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);

@@bool SpeculativeJIT::compileStrictEq(Nod

        compileObjectEquality(node);

        return false;

    }

3466

3467 return nonSpeculativeStrictEq(node);

        
    case UntypedUse: {

        return nonSpeculativeStrictEq(node);

    }

    default:

        RELEASE_ASSERT_NOT_REACHED();

        return false;

    }

}

void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node)

@@GPRReg SpeculativeJIT::temporaryRegister

    return temporary.gpr();

}

void SpeculativeJIT::speculateInt32(Edge edge)

{

    if (!needsTypeCheck(edge, SpecInt32))

        return;

    (SpeculateIntegerOperand(this, edge)).gpr();

}

void SpeculativeJIT::speculateNumber(Edge edge)

{

    if (!needsTypeCheck(edge, SpecNumber))

        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);

#if USE(JSVALUE64)

    JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, operand.gpr(), GPRInfo::tagTypeNumberRegister);

    typeCheck(

        JSValueRegs(operand.gpr()), edge, SpecNumber,

        m_jit.branchTest64(MacroAssembler::Zero, operand.gpr(), GPRInfo::tagTypeNumberRegister));

    isInteger.link(&m_jit);

#else

    JSValueOperand op1(this, edge);

    JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, operand.tagGPR(), TrustedImm32(JSValue::Int32Tag));

    typeCheck(

        JSValueRegs(operand.tagGPR(), op1.payloadGPR()), edge, SpecNumber,

        m_jit.branch32(MacroAssembler::AboveOrEqual, operand.tagGPR(), TrustedImm32(JSValue::LowestTag)));

    isInteger.link(&m_jit);

#endif

}

void SpeculativeJIT::speculateRealNumber(Edge edge)

{

    if (!needsTypeCheck(edge, SpecRealNumber))

        return;

    SpeculateDoubleOperand operand(this, edge);

    FPRReg fpr = operand.fpr();

    DFG_TYPE_CHECK(

        JSValueRegs(), edge, SpecRealNumber,

        m_jit.branchDouble(

            MacroAssembler::DoubleNotEqualOrUnordered, fpr, fpr));

}

void SpeculativeJIT::speculateBoolean(Edge edge)

{

    if (!needsTypeCheck(edge, SpecBoolean))

        return;

    (SpeculateBooleanOperand(this, edge)).gpr();

}

void SpeculativeJIT::speculateCell(Edge edge)

{

    if (!needsTypeCheck(edge, SpecCell))

        return;

    (SpeculateCellOperand(this, edge)).gpr();

}

void SpeculativeJIT::speculateObject(Edge edge)

{

    if (!needsTypeCheck(edge, SpecObject))

        return;

    SpeculateCellOperand operand(this, edge);

    DFG_TYPE_CHECK(

        JSValueSource::unboxedCell(operand.gpr()), edge, SpecObject, m_jit.branchPtr(

            MacroAssembler::Equal, 

            MacroAssembler::Address(operand.gpr(), JSCell::structureOffset()), 

            MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

}

void SpeculativeJIT::speculateObjectOrOther(Edge edge)

{

    if (!needsTypeCheck(edge, SpecObject | SpecOther))

        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);

    GPRTemporary temp(this);

    GPRReg tempGPR = temp.gpr();

#if USE(JSVALUE64)

    GPRReg gpr = operand.gpr();

    MacroAssembler::Jump notCell = m_jit.branchTest64(

        MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister);

    DFG_TYPE_CHECK(

        JSValueRegs(operand.gpr()), edge, (~SpecCell) | SpecObject, m_jit.branchPtr(

            MacroAssembler::Equal, 

            MacroAssembler::Address(gpr, JSCell::structureOffset()), 

            MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    MacroAssembler::Jump done = m_jit.jump();

    notCell.link(&m_jit);

    if (needsTypeCheck(edge, SpecCell | SpecOther)) {

        m_jit.move(gpr, tempGPR);

        m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), tempGPR);

        typeCheck(

            JSValueRegs(gpr), edge, SpecCell | SpecOther,

            m_jit.branch64(

                MacroAssembler::NotEqual, tempGPR,

                MacroAssembler::TrustedImm64(ValueNull)));

    }

    done.link(&m_jit);

#else

    GPRReg tagGPR = operand.tagGPR();

    GPRReg payloadGPR = operand.payloadGPR();

    MacroAssembler::Jump notCell =

        m_jit.branch32(MacroAssembler::NotEqual, tagGPR, TrustedImm32(JSValue::CellTag));

    DFG_TYPE_CHECK(

        JSValueRegs(tagGPR, payloadGPR), edge, (~SpecCell) | SpecObject, m_jit.branchPtr(

            MacroAssembler::Equal, 

            MacroAssembler::Address(payloadGPR, JSCell::structureOffset()), 

            MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

    MacroAssembler::Jump done = m_jit.jump();

    notCell.link(&m_jit);

    if (needsTypeCheck(edge, SpecCell | SpecOther)) {

        m_jit.move(tagGPR, tempGPR);

        m_jit.or32(TrustedImm32(1), tempGPR);

        typeCheck(

            JSValueRegs(tagGPR, payloadGPR), edge, SpecCell | SpecOther,

            m_jit.branch32(

                MacroAssembler::NotEqual, tempGPR,

                MacroAssembler::TrustedImm32(JSValue::NullTag)));

    }

    done.link(&m_jit);

#endif

}

void SpeculativeJIT::speculateString(Edge edge)

{

    if (!needsTypeCheck(edge, SpecString))

        return;

    SpeculateCellOperand operand(this, edge);

    DFG_TYPE_CHECK(

        JSValueSource::unboxedCell(operand.gpr()), edge, SpecString, m_jit.branchPtr(

            MacroAssembler::NotEqual, 

            MacroAssembler::Address(operand.gpr(), JSCell::structureOffset()), 

            MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));

}

void SpeculativeJIT::speculateNotCell(Edge edge)

{

    if (!needsTypeCheck(edge, ~SpecCell))

        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);

#if USE(JSVALUE64)

    typeCheck(

        JSValueRegs(operand.gpr()), edge, ~SpecCell,

        m_jit.branchTest64(

            JITCompiler::Zero, operand.gpr(), GPRInfo::tagMaskRegister));

#else

    typeCheck(

        JSValueRegs(operand.tagGPR(), operand.payloadGPR()), edge, ~SpecCell,

        m_jit.branch32(

            JITCompiler::Equal, operand.tagGPR(), TrustedImm32(JSValue::CellTag)));

#endif

}

void SpeculativeJIT::speculateOther(Edge edge)

{

    if (!needsTypeCheck(edge, SpecOther))

        return;

    JSValueOperand operand(this, edge, ManualOperandSpeculation);

    GPRTemporary temp(this);

    GPRReg tempGPR = temp.gpr();

#if USE(JSVALUE64)

    m_jit.move(operand.gpr(), tempGPR);

    m_jit.and64(MacroAssembler::TrustedImm32(~TagBitUndefined), tempGPR);

    typeCheck(

        JSValueRegs(operand.gpr()), edge, SpecOther,

        m_jit.branch64(

            MacroAssembler::NotEqual, tempGPR,

            MacroAssembler::TrustedImm64(ValueNull)));

#else

    m_jit.move(operand.tagGPR(), tempGPR);

    m_jit.or32(TrustedImm32(1), tempGPR);

    typeCheck(

        JSValueRegs(operand.tagGPR(), operand.payloadGPR()), edge, SpecOther,

        m_jit.branch32(MacroAssembler::NotEqual, tempGPR, TrustedImm32(JSValue::NullTag)));

#endif    

}

void SpeculativeJIT::speculate(Node*, Edge edge)

{

    switch (edge.useKind()) {

    case UntypedUse:

        break;

    case KnownInt32Use:

        ASSERT(!needsTypeCheck(edge, SpecInt32));

        break;

    case KnownNumberUse:

        ASSERT(!needsTypeCheck(edge, SpecNumber));

        break;

    case KnownCellUse:

        ASSERT(!needsTypeCheck(edge, SpecCell));

        break;

    case Int32Use:

        speculateInt32(edge);

        break;

    case RealNumberUse:

        speculateRealNumber(edge);

        break;

    case NumberUse:

        speculateNumber(edge);

        break;

    case BooleanUse:

        speculateBoolean(edge);

        break;

    case CellUse:

        speculateCell(edge);

        break;

    case ObjectUse:

        speculateObject(edge);

        break;

    case ObjectOrOtherUse:

        speculateObjectOrOther(edge);

        break;

    case StringUse:

        speculateString(edge);

        break;

    case NotCellUse:

        speculateNotCell(edge);

        break;

    case OtherUse:

        speculateOther(edge);

        break;

    default:

        RELEASE_ASSERT_NOT_REACHED();

        break;

    }

}

} } // namespace JSC::DFG

#endif

143562

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

@@public:

        }

    }

124 GPRReg fillInteger(Node*, DataFormat& returnFormat);

124 GPRReg fillInteger(Edge, DataFormat& returnFormat);

125125#if USE(JSVALUE64)

126 GPRReg fillJSValue(Node*);

126 GPRReg fillJSValue(Edge);

127127#elif USE(JSVALUE32_64)

128 bool fillJSValue(Node*, GPRReg&, GPRReg&, FPRReg&);

128 bool fillJSValue(Edge, GPRReg&, GPRReg&, FPRReg&);

129129#endif

130 GPRReg fillStorage(Node*);

130 GPRReg fillStorage(Edge);

    // lock and unlock GPR & FPR registers.

    void lock(GPRReg reg)

@@public:

    // Called by the speculative operand types, below, to fill operand to

    // machine registers, implicitly generating speculation checks as needed.

    GPRReg fillSpeculateInt(Node*, DataFormat& returnFormat, SpeculationDirection);

    GPRReg fillSpeculateIntStrict(Node*);

    FPRReg fillSpeculateDouble(Node*, SpeculationDirection);

    GPRReg fillSpeculateCell(Node*, SpeculationDirection);

    GPRReg fillSpeculateBoolean(Node*, SpeculationDirection);

    GPRReg fillSpeculateInt(Edge, DataFormat& returnFormat, SpeculationDirection);

    GPRReg fillSpeculateIntStrict(Edge);

    FPRReg fillSpeculateDouble(Edge, SpeculationDirection);

    GPRReg fillSpeculateCell(Edge, SpeculationDirection);

    GPRReg fillSpeculateBoolean(Edge, SpeculationDirection);

    GeneratedOperandType checkGeneratedTypeForToInt32(Node*);

    void addSlowPathGenerator(PassOwnPtr<SlowPathGenerator>);

@@public:

    bool isFunctionConstant(Node* node) { return m_jit.graph().isFunctionConstant(node); }

    int32_t valueOfInt32Constant(Node* node) { return m_jit.graph().valueOfInt32Constant(node); }

    double valueOfNumberConstant(Node* node) { return m_jit.graph().valueOfNumberConstant(node); }

    int32_t valueOfNumberConstantAsInt32(Node* node)

    {

        if (isInt32Constant(node))

            return valueOfInt32Constant(node);

        return JSC::toInt32(valueOfNumberConstant(node));

    }

#if USE(JSVALUE32_64)

    void* addressOfDoubleConstant(Node* node) { return m_jit.addressOfDoubleConstant(node); }

#endif

@@public:

    void compileObjectEquality(Node*);

    void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);

    void compileValueAdd(Node*);

2026 void compileObjectOrOtherLogicalNot(Edge value~~, bool needSpeculationCheck~~);

2020 void compileObjectOrOtherLogicalNot(Edge value);

20272021 void compileLogicalNot(Node*);

2028 void emitObjectOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken~~, bool needSpeculationCheck~~);

2022 void emitObjectOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken);

    void emitBranch(Node*);

    void compileIntegerCompare(Node*, MacroAssembler::RelationalCondition);

@@public:

    void forwardSpeculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail, const ValueRecovery& = ValueRecovery());

    void forwardSpeculationCheck(ExitKind, JSValueSource, Node*, const MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& = ValueRecovery());

    void speculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail, SpeculationDirection);

2175 void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail, SpeculationDirection);

21812176 void speculationCheck(ExitKind, JSValueSource, Node*, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&, SpeculationDirection);

2177 void speculationCheck(ExitKind, JSValueSource, Edge, MacroAssembler::Jump jumpToFail, const SpeculationRecovery&, SpeculationDirection);

    // Called when we statically determine that a speculation will fail.

    void terminateSpeculativeExecution(ExitKind, JSValueRegs, Node*);

    void terminateSpeculativeExecution(ExitKind, JSValueRegs, Edge);

@@public:

    JumpReplacementWatchpoint* forwardSpeculationWatchpoint(ExitKind = UncountableWatchpoint);

    JumpReplacementWatchpoint* speculationWatchpoint(ExitKind, SpeculationDirection);

    // Helpers for performing type checks on an edge stored in the given registers.

    bool needsTypeCheck(Edge edge, SpeculatedType typesPassedThrough) { return m_state.forNode(edge).m_type & ~typesPassedThrough; }

    void typeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail);

    void forwardTypeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, const ValueRecovery&);

    void typeCheck(JSValueSource, Edge, SpeculatedType typesPassedThrough, MacroAssembler::Jump jumpToFail, SpeculationDirection);

    void speculateInt32(Edge);

    void speculateNumber(Edge);

    void speculateRealNumber(Edge);

    void speculateBoolean(Edge);

    void speculateCell(Edge);

    void speculateObject(Edge);

    void speculateObjectOrOther(Edge);

    void speculateString(Edge);

    void speculateNotCell(Edge);

    void speculateOther(Edge);

    void speculate(Node*, Edge);

    const TypedArrayDescriptor* typedArrayDescriptor(ArrayMode);

    JITCompiler::Jump jumpSlowForUnwantedArrayMode(GPRReg tempWithIndexingTypeReg, ArrayMode, IndexingType, bool invert);

@@public:

    void arrayify(Node*);

    template<bool strict>

2200 GPRReg fillSpeculateIntInternal(Node*, DataFormat& returnFormat, SpeculationDirection);

2214 GPRReg fillSpeculateIntInternal(Edge, DataFormat& returnFormat, SpeculationDirection);

    
    // It is possible, during speculative generation, to reach a situation in which we

    // can statically determine a speculation will fail (for example, when two nodes

@@public:

    // The current node being generated.

    BlockIndex m_block;

    Node* m_currentNode;

#if !ASSERT_DISABLED

    bool m_canExit;

#endif

    unsigned m_indexInBlock;

    // Virtual and physical register maps.

    Vector<GenerationInfo, 32> m_generationInfo;

@@public:

class IntegerOperand {

public:

2308 explicit IntegerOperand(SpeculativeJIT* jit, Edge use)

2325 explicit IntegerOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)

23092326 : m_jit(jit)

2310 , m_nod~~e(use.no~~de())

2327 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

#ifndef NDEBUG

        , m_format(DataFormatNone)

#endif

    {

        ASSERT(m_jit);

2317 ASSERT(use.useKind() !~~= Double~~Use);

2318 if (jit->isFilled(m_node))

2334 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == KnownInt32Use);

2335 if (jit->isFilled(edge.node()))

            gpr();

    }

@@public:

        m_jit->unlock(m_gprOrInvalid);

    }

    Edge edge() const

    {

        return m_edge;

    }

23282350 Node* node() const

23292351 {

2330 return m_node;

2352 return edge().node();

    }

    DataFormat format()

@@public:

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2343 m_gprOrInvalid = m_jit->fillInteger(nod~~e()~~, m_format);

2365 m_gprOrInvalid = m_jit->fillInteger(m_edge, m_format);

        return m_gprOrInvalid;

    }

    void use()

    {

2349 m_jit->use(m_node);

2371 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2354 Node* m_node;

2376 Edge m_edge;

    GPRReg m_gprOrInvalid;

    DataFormat m_format;

};

class JSValueOperand {

public:

2361 explicit JSValueOperand(SpeculativeJIT* jit, Edge use)

2383 explicit JSValueOperand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)

23622384 : m_jit(jit)

2363 , m_nod~~e(use.no~~de())

2385 , m_edge(edge)

#if USE(JSVALUE64)

        , m_gprOrInvalid(InvalidGPRReg)

#elif USE(JSVALUE32_64)

@@public:

#endif

    {

        ASSERT(m_jit);

2371 ASSERT(use.useKind() !~~= Doubl~~eUse);

2393 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);

23722394#if USE(JSVALUE64)

2373 if (jit->isFilled(m_node))

2395 if (jit->isFilled(node()))

            gpr();

#elif USE(JSVALUE32_64)

        m_register.pair.tagGPR = InvalidGPRReg;

        m_register.pair.payloadGPR = InvalidGPRReg;

2378 if (jit->isFilled(m_node))

2400 if (jit->isFilled(node()))

            fill();

#endif

    }

@@public:

        }

#endif

    }

    
    Edge edge() const

    {

        return m_edge;

    }

    Node* node() const

    {

2402 return m_node;

2429 return edge().node();

    }

#if USE(JSVALUE64)

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2409 m_gprOrInvalid = m_jit->fillJSValue(nod~~e()~~);

2436 m_gprOrInvalid = m_jit->fillJSValue(m_edge);

        return m_gprOrInvalid;

    }

    JSValueRegs jsValueRegs()

@@public:

    void fill()

    {

        if (m_register.pair.tagGPR == InvalidGPRReg && m_register.pair.payloadGPR == InvalidGPRReg)

2422 m_isDouble = !m_jit->fillJSValue(nod~~e()~~, m_register.pair.tagGPR, m_register.pair.payloadGPR, m_register.fpr);

2449 m_isDouble = !m_jit->fillJSValue(m_edge, m_register.pair.tagGPR, m_register.pair.payloadGPR, m_register.fpr);

    }

    GPRReg tagGPR()

@@public:

    void use()

    {

2454 m_jit->use(m_node);

2481 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2459 Node* m_node;

2486 Edge m_edge;

#if USE(JSVALUE64)

    GPRReg m_gprOrInvalid;

#elif USE(JSVALUE32_64)

@@private:

class StorageOperand {

public:

2476 explicit StorageOperand(SpeculativeJIT* jit, Edge use)

2503 explicit StorageOperand(SpeculativeJIT* jit, Edge edge)

24772504 : m_jit(jit)

2478 , m_nod~~e(use.no~~de())

2505 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

    {

        ASSERT(m_jit);

2482 ASSERT(use.useKind() !~~= Doub~~leUse);

2483 if (jit->isFilled(m_node))

2509 ASSERT(edge.useKind() == UntypedUse || edge.useKind() == KnownCellUse);

2510 if (jit->isFilled(node()))

            gpr();

    }

@@public:

        m_jit->unlock(m_gprOrInvalid);

    }

    Edge edge() const

    {

        return m_edge;

    }

24932525 Node* node() const

24942526 {

2495 return m_node;

2527 return edge().node();

    }

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2501 m_gprOrInvalid = m_jit->fillStorage(node());

2533 m_gprOrInvalid = m_jit->fillStorage(edge());

        return m_gprOrInvalid;

    }

    void use()

    {

2507 m_jit->use(m_node);

2539 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2512 Node* m_node;

2544 Edge m_edge;

    GPRReg m_gprOrInvalid;

};

@@private:

class SpeculateIntegerOperand {

public:

2644 explicit SpeculateIntegerOperand(SpeculativeJIT* jit, Edge use, SpeculationDirection direction = BackwardSpeculation)

2676 explicit SpeculateIntegerOperand(SpeculativeJIT* jit, Edge edge, SpeculationDirection direction = BackwardSpeculation, OperandSpeculationMode mode = AutomaticOperandSpeculation)

26452677 : m_jit(jit)

2646 , m_nod~~e(use.no~~de())

2678 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

#ifndef NDEBUG

        , m_format(DataFormatNone)

@@public:

        , m_direction(direction)

    {

        ASSERT(m_jit);

2654 ASSERT(use.useKind() !~~= Double~~Use);

2655 if (jit->isFilled(m_node))

2686 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));

2687 if (jit->isFilled(node()))

            gpr();

    }

@@public:

        ASSERT(m_gprOrInvalid != InvalidGPRReg);

        m_jit->unlock(m_gprOrInvalid);

    }

    
    Edge edge() const

    {

        return m_edge;

    }

    Node* node() const

    {

2667 return m_node;

2704 return edge().node();

    }

    DataFormat format()

@@public:

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2680 m_gprOrInvalid = m_jit->fillSpeculateInt(node(), m_format, m_direction);

2717 m_gprOrInvalid = m_jit->fillSpeculateInt(edge(), m_format, m_direction);

        return m_gprOrInvalid;

    }

    void use()

    {

2686 m_jit->use(m_node);

2723 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2691 Node* m_node;

2728 Edge m_edge;

    GPRReg m_gprOrInvalid;

    DataFormat m_format;

    SpeculationDirection m_direction;

@@private:

class SpeculateStrictInt32Operand {

public:

2699 explicit SpeculateStrictInt32Operand(SpeculativeJIT* jit, Edge use)

2736 explicit SpeculateStrictInt32Operand(SpeculativeJIT* jit, Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)

27002737 : m_jit(jit)

2701 , m_nod~~e(use.no~~de())

2738 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

    {

        ASSERT(m_jit);

2705 ASSERT(use.useKind() !~~= Double~~Use);

2706 if (jit->isFilled(m_node))

2742 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));

2743 if (jit->isFilled(node()))

            gpr();

    }

@@public:

        ASSERT(m_gprOrInvalid != InvalidGPRReg);

        m_jit->unlock(m_gprOrInvalid);

    }

    
    Edge edge() const

    {

        return m_edge;

    }

    Node* node() const

    {

2718 return m_node;

2760 return edge().node();

    }

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2724 m_gprOrInvalid = m_jit->fillSpeculateIntStrict(node());

2766 m_gprOrInvalid = m_jit->fillSpeculateIntStrict(edge());

        return m_gprOrInvalid;

    }

    void use()

    {

2730 m_jit->use(m_node);

2772 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2735 Node* m_node;

2777 Edge m_edge;

    GPRReg m_gprOrInvalid;

};

class SpeculateDoubleOperand {

public:

2741 explicit SpeculateDoubleOperand(SpeculativeJIT* jit, Edge use, SpeculationDirection direction = BackwardSpeculation)

2783 explicit SpeculateDoubleOperand(SpeculativeJIT* jit, Edge edge, SpeculationDirection direction = BackwardSpeculation, OperandSpeculationMode mode = AutomaticOperandSpeculation)

27422784 : m_jit(jit)

2743 , m_nod~~e(use.no~~de())

2785 , m_edge(edge)

        , m_fprOrInvalid(InvalidFPRReg)

        , m_direction(direction)

    {

        ASSERT(m_jit);

2748 ASSERT(use.useKind() == DoubleUse);

2749 if (jit->isFilled(m_node))

2790 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == NumberUse || edge.useKind() == KnownNumberUse || edge.useKind() == RealNumberUse));

2791 if (jit->isFilled(node()))

            fpr();

    }

@@public:

        ASSERT(m_fprOrInvalid != InvalidFPRReg);

        m_jit->unlock(m_fprOrInvalid);

    }

    
    Edge edge() const

    {

        return m_edge;

    }

    Node* node() const

    {

2761 return m_node;

2808 return edge().node();

    }

    FPRReg fpr()

    {

        if (m_fprOrInvalid == InvalidFPRReg)

2767 m_fprOrInvalid = m_jit->fillSpeculateDouble(node(), m_direction);

2814 m_fprOrInvalid = m_jit->fillSpeculateDouble(edge(), m_direction);

        return m_fprOrInvalid;

    }

    void use()

    {

2773 m_jit->use(m_node);

2820 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2778 Node* m_node;

2825 Edge m_edge;

    FPRReg m_fprOrInvalid;

    SpeculationDirection m_direction;

};

class SpeculateCellOperand {

public:

2785 explicit SpeculateCellOperand(SpeculativeJIT* jit, Edge use, SpeculationDirection direction = BackwardSpeculation)

2832 explicit SpeculateCellOperand(SpeculativeJIT* jit, Edge edge, SpeculationDirection direction = BackwardSpeculation, OperandSpeculationMode mode = AutomaticOperandSpeculation)

27862833 : m_jit(jit)

2787 , m_nod~~e(use.no~~de())

2834 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

        , m_direction(direction)

    {

        ASSERT(m_jit);

2792 ASSERT(use.useKind() !~~= D~~oubleUse);

2793 if (jit->isFilled(m_node))

2839 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == CellUse || edge.useKind() == KnownCellUse || edge.useKind() == ObjectUse || edge.useKind() == StringUse));

2840 if (jit->isFilled(node()))

            gpr();

    }

@@public:

        ASSERT(m_gprOrInvalid != InvalidGPRReg);

        m_jit->unlock(m_gprOrInvalid);

    }

    
    Edge edge() const

    {

        return m_edge;

    }

    Node* node() const

    {

2805 return m_node;

2857 return edge().node();

    }

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2811 m_gprOrInvalid = m_jit->fillSpeculateCell(node(), m_direction);

2863 m_gprOrInvalid = m_jit->fillSpeculateCell(edge(), m_direction);

        return m_gprOrInvalid;

    }

    void use()

    {

2817 m_jit->use(m_node);

2869 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2822 Node* m_node;

2874 Edge m_edge;

    GPRReg m_gprOrInvalid;

    SpeculationDirection m_direction;

};

class SpeculateBooleanOperand {

public:

2829 explicit SpeculateBooleanOperand(SpeculativeJIT* jit, Edge use, SpeculationDirection direction = BackwardSpeculation)

2881 explicit SpeculateBooleanOperand(SpeculativeJIT* jit, Edge edge, SpeculationDirection direction = BackwardSpeculation, OperandSpeculationMode mode = AutomaticOperandSpeculation)

28302882 : m_jit(jit)

2831 , m_nod~~e(use.no~~de())

2883 , m_edge(edge)

        , m_gprOrInvalid(InvalidGPRReg)

        , m_direction(direction)

    {

        ASSERT(m_jit);

2836 ASSERT(use.useKind() !~~= Doub~~leUse);

2837 if (jit->isFilled(m_node))

2888 ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse);

2889 if (jit->isFilled(node()))

            gpr();

    }

@@public:

        m_jit->unlock(m_gprOrInvalid);

    }

    Edge edge() const

    {

        return m_edge;

    }

28472904 Node* node() const

28482905 {

2849 return m_node;

2906 return edge().node();

    }

    GPRReg gpr()

    {

        if (m_gprOrInvalid == InvalidGPRReg)

2855 m_gprOrInvalid = m_jit->fillSpeculateBoolean(node(), m_direction);

2912 m_gprOrInvalid = m_jit->fillSpeculateBoolean(edge(), m_direction);

        return m_gprOrInvalid;

    }

    void use()

    {

2861 m_jit->use(m_node);

2918 m_jit->use(node());

    }

private:

    SpeculativeJIT* m_jit;

2866 Node* m_node;

2923 Edge m_edge;

    GPRReg m_gprOrInvalid;

    SpeculationDirection m_direction;

};

#define DFG_TYPE_CHECK(source, edge, typesPassedThrough, jumpToFail) do { \

        if (!needsTypeCheck((edge), (typesPassedThrough)))              \

            break;                                                      \

        typeCheck((source), (edge), (typesPassedThrough), (jumpToFail)); \

    } while (0)

} } // namespace JSC::DFG

#endif

143562

Source/JavaScriptCore/ChangeLog

Source/JavaScriptCore/CMakeLists.txt

Source/JavaScriptCore/GNUmakefile.list.am

Source/JavaScriptCore/Target.pri

Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

Source/JavaScriptCore/dfg/DFGAbstractState.cpp

Source/JavaScriptCore/dfg/DFGAbstractState.h

Source/JavaScriptCore/dfg/DFGAbstractValue.h

Source/JavaScriptCore/dfg/DFGAdjacencyList.h

Source/JavaScriptCore/dfg/DFGAllocator.h

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Source/JavaScriptCore/dfg/DFGCSEPhase.cpp

Source/JavaScriptCore/dfg/DFGCommon.h

Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp

Source/JavaScriptCore/dfg/DFGDriver.cpp

Source/JavaScriptCore/dfg/DFGEdge.cpp

Source/JavaScriptCore/dfg/DFGEdge.h

Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

Source/JavaScriptCore/dfg/DFGGraph.cpp

Source/JavaScriptCore/dfg/DFGGraph.h

Source/JavaScriptCore/dfg/DFGNode.h

Source/JavaScriptCore/dfg/DFGNodeAllocator.h

Source/JavaScriptCore/dfg/DFGNodeFlags.cpp

Source/JavaScriptCore/dfg/DFGNodeType.h

Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp

Source/JavaScriptCore/dfg/DFGUseKind.cpp

Source/JavaScriptCore/dfg/DFGUseKind.h

Source/JavaScriptCore/dfg/DFGValidate.cpp