The Tor Browser: js/src/jit/Lowering.cpp@6474c204b198 (annotated)

js/src/jit/Lowering.cpp@6474c204b198 (annotated)

js/src/jit/Lowering.cpp

Wed, 31 Dec 2014 06:09:35 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 06:09:35 +0100
changeset 0: 6474c204b198
permissions: -rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "jit/Lowering.h"
 #include "mozilla/DebugOnly.h"
 #include "jsanalyze.h"
 #include "jit/IonSpewer.h"
 #include "jit/LIR.h"
 #include "jit/MIR.h"
 #include "jit/MIRGraph.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
 #include "jsopcodeinlines.h"
 #include "jit/shared/Lowering-shared-inl.h"
 using namespace js;
 using namespace jit;
 using mozilla::DebugOnly;
 using JS::GenericNaN;
 bool
 LIRGenerator::visitCloneLiteral(MCloneLiteral *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->input()->type() == MIRType_Object);
     LCloneLiteral *lir = new(alloc()) LCloneLiteral(useRegisterAtStart(ins->input()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitParameter(MParameter *param)
 {
     ptrdiff_t offset;
     if (param->index() == MParameter::THIS_SLOT)
         offset = THIS_FRAME_ARGSLOT;
     else
         offset = 1 + param->index();
     LParameter *ins = new(alloc()) LParameter;
     if (!defineBox(ins, param, LDefinition::PRESET))
         return false;
     offset *= sizeof(Value);
 #if defined(JS_NUNBOX32)
 # if defined(IS_BIG_ENDIAN)
     ins->getDef(0)->setOutput(LArgument(offset));
     ins->getDef(1)->setOutput(LArgument(offset + 4));
 # else
     ins->getDef(0)->setOutput(LArgument(offset + 4));
     ins->getDef(1)->setOutput(LArgument(offset));
 # endif
 #elif defined(JS_PUNBOX64)
     ins->getDef(0)->setOutput(LArgument(offset));
 #endif
     return true;
 }
 bool
 LIRGenerator::visitCallee(MCallee *ins)
 {
     return define(new(alloc()) LCallee(), ins);
 }
 bool
 LIRGenerator::visitGoto(MGoto *ins)
 {
     return add(new(alloc()) LGoto(ins->target()));
 }
 bool
 LIRGenerator::visitTableSwitch(MTableSwitch *tableswitch)
 {
     MDefinition *opd = tableswitch->getOperand(0);
     // There should be at least 1 successor. The default case!
     JS_ASSERT(tableswitch->numSuccessors() > 0);
     // If there are no cases, the default case is always taken.
     if (tableswitch->numSuccessors() == 1)
         return add(new(alloc()) LGoto(tableswitch->getDefault()));
     // If we don't know the type.
     if (opd->type() == MIRType_Value) {
         LTableSwitchV *lir = newLTableSwitchV(tableswitch);
         if (!useBox(lir, LTableSwitchV::InputValue, opd))
             return false;
         return add(lir);
     }
     // Case indices are numeric, so other types will always go to the default case.
     if (opd->type() != MIRType_Int32 && opd->type() != MIRType_Double)
         return add(new(alloc()) LGoto(tableswitch->getDefault()));
     // Return an LTableSwitch, capable of handling either an integer or
     // floating-point index.
     LAllocation index;
     LDefinition tempInt;
     if (opd->type() == MIRType_Int32) {
         index = useRegisterAtStart(opd);
         tempInt = tempCopy(opd, 0);
     } else {
         index = useRegister(opd);
         tempInt = temp(LDefinition::GENERAL);
     }
     return add(newLTableSwitch(index, tempInt, tableswitch));
 }
 bool
 LIRGenerator::visitCheckOverRecursed(MCheckOverRecursed *ins)
 {
     LCheckOverRecursed *lir = new(alloc()) LCheckOverRecursed();
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitCheckOverRecursedPar(MCheckOverRecursedPar *ins)
 {
     LCheckOverRecursedPar *lir =
         new(alloc()) LCheckOverRecursedPar(useRegister(ins->forkJoinContext()), temp());
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitDefVar(MDefVar *ins)
 {
     LDefVar *lir = new(alloc()) LDefVar(useRegisterAtStart(ins->scopeChain()));
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitDefFun(MDefFun *ins)
 {
     LDefFun *lir = new(alloc()) LDefFun(useRegisterAtStart(ins->scopeChain()));
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitNewSlots(MNewSlots *ins)
 {
     // No safepoint needed, since we don't pass a cx.
     LNewSlots *lir = new(alloc()) LNewSlots(tempFixed(CallTempReg0), tempFixed(CallTempReg1),
                                             tempFixed(CallTempReg2));
     if (!assignSnapshot(lir))
         return false;
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitNewArray(MNewArray *ins)
 {
     LNewArray *lir = new(alloc()) LNewArray(temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitNewObject(MNewObject *ins)
 {
     LNewObject *lir = new(alloc()) LNewObject(temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitNewDeclEnvObject(MNewDeclEnvObject *ins)
 {
     LNewDeclEnvObject *lir = new(alloc()) LNewDeclEnvObject(temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitNewCallObject(MNewCallObject *ins)
 {
     LAllocation slots;
     if (ins->slots()->type() == MIRType_Slots)
         slots = useRegister(ins->slots());
     else
         slots = LConstantIndex::Bogus();
     LInstruction *lir;
     if (ins->templateObject()->hasSingletonType()) {
         LNewSingletonCallObject *singletonLir = new(alloc()) LNewSingletonCallObject(slots);
         if (!define(singletonLir, ins))
             return false;
         lir = singletonLir;
     } else {
         LNewCallObject *normalLir = new(alloc()) LNewCallObject(slots, temp());
         if (!define(normalLir, ins))
             return false;
         lir = normalLir;
     }
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitNewRunOnceCallObject(MNewRunOnceCallObject *ins)
 {
     LAllocation slots;
     if (ins->slots()->type() == MIRType_Slots)
         slots = useRegister(ins->slots());
     else
         slots = LConstantIndex::Bogus();
     LNewSingletonCallObject *lir = new(alloc()) LNewSingletonCallObject(slots);
     if (!define(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitNewDerivedTypedObject(MNewDerivedTypedObject *ins)
 {
     LNewDerivedTypedObject *lir =
         new(alloc()) LNewDerivedTypedObject(useRegisterAtStart(ins->type()),
                                             useRegisterAtStart(ins->owner()),
                                             useRegisterAtStart(ins->offset()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitNewCallObjectPar(MNewCallObjectPar *ins)
 {
     const LAllocation &parThreadContext = useRegister(ins->forkJoinContext());
     const LDefinition &temp1 = temp();
     const LDefinition &temp2 = temp();
     LNewCallObjectPar *lir;
     if (ins->slots()->type() == MIRType_Slots) {
         const LAllocation &slots = useRegister(ins->slots());
         lir = LNewCallObjectPar::NewWithSlots(alloc(), parThreadContext, slots, temp1, temp2);
     } else {
         lir = LNewCallObjectPar::NewSansSlots(alloc(), parThreadContext, temp1, temp2);
     }
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitNewStringObject(MNewStringObject *ins)
 {
     JS_ASSERT(ins->input()->type() == MIRType_String);
     LNewStringObject *lir = new(alloc()) LNewStringObject(useRegister(ins->input()), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitAbortPar(MAbortPar *ins)
 {
     LAbortPar *lir = new(alloc()) LAbortPar();
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitInitElem(MInitElem *ins)
 {
     LInitElem *lir = new(alloc()) LInitElem(useRegisterAtStart(ins->getObject()));
     if (!useBoxAtStart(lir, LInitElem::IdIndex, ins->getId()))
         return false;
     if (!useBoxAtStart(lir, LInitElem::ValueIndex, ins->getValue()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitInitElemGetterSetter(MInitElemGetterSetter *ins)
 {
     LInitElemGetterSetter *lir =
         new(alloc()) LInitElemGetterSetter(useRegisterAtStart(ins->object()),
                                            useRegisterAtStart(ins->value()));
     if (!useBoxAtStart(lir, LInitElemGetterSetter::IdIndex, ins->idValue()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitMutateProto(MMutateProto *ins)
 {
     LMutateProto *lir = new(alloc()) LMutateProto(useRegisterAtStart(ins->getObject()));
     if (!useBoxAtStart(lir, LMutateProto::ValueIndex, ins->getValue()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitInitProp(MInitProp *ins)
 {
     LInitProp *lir = new(alloc()) LInitProp(useRegisterAtStart(ins->getObject()));
     if (!useBoxAtStart(lir, LInitProp::ValueIndex, ins->getValue()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitInitPropGetterSetter(MInitPropGetterSetter *ins)
 {
     LInitPropGetterSetter *lir =
         new(alloc()) LInitPropGetterSetter(useRegisterAtStart(ins->object()),
                                            useRegisterAtStart(ins->value()));
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCreateThisWithTemplate(MCreateThisWithTemplate *ins)
 {
     LCreateThisWithTemplate *lir = new(alloc()) LCreateThisWithTemplate(temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCreateThisWithProto(MCreateThisWithProto *ins)
 {
     LCreateThisWithProto *lir =
         new(alloc()) LCreateThisWithProto(useRegisterOrConstantAtStart(ins->getCallee()),
                                           useRegisterOrConstantAtStart(ins->getPrototype()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCreateThis(MCreateThis *ins)
 {
     LCreateThis *lir = new(alloc()) LCreateThis(useRegisterOrConstantAtStart(ins->getCallee()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCreateArgumentsObject(MCreateArgumentsObject *ins)
 {
     // LAllocation callObj = useRegisterAtStart(ins->getCallObject());
     LAllocation callObj = useFixed(ins->getCallObject(), CallTempReg0);
     LCreateArgumentsObject *lir = new(alloc()) LCreateArgumentsObject(callObj, tempFixed(CallTempReg1));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetArgumentsObjectArg(MGetArgumentsObjectArg *ins)
 {
     LAllocation argsObj = useRegister(ins->getArgsObject());
     LGetArgumentsObjectArg *lir = new(alloc()) LGetArgumentsObjectArg(argsObj, temp());
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitSetArgumentsObjectArg(MSetArgumentsObjectArg *ins)
 {
     LAllocation argsObj = useRegister(ins->getArgsObject());
     LSetArgumentsObjectArg *lir = new(alloc()) LSetArgumentsObjectArg(argsObj, temp());
     if (!useBox(lir, LSetArgumentsObjectArg::ValueIndex, ins->getValue()))
         return false;
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitReturnFromCtor(MReturnFromCtor *ins)
 {
     LReturnFromCtor *lir = new(alloc()) LReturnFromCtor(useRegister(ins->getObject()));
     if (!useBox(lir, LReturnFromCtor::ValueIndex, ins->getValue()))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitComputeThis(MComputeThis *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->input()->type() == MIRType_Value);
     LComputeThis *lir = new(alloc()) LComputeThis();
     // Don't use useBoxAtStart because ComputeThis has a safepoint and needs to
     // have its inputs in different registers than its return value so that
     // they aren't clobbered.
     if (!useBox(lir, LComputeThis::ValueIndex, ins->input()))
         return false;
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLoadArrowThis(MLoadArrowThis *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Value);
     JS_ASSERT(ins->callee()->type() == MIRType_Object);
     LLoadArrowThis *lir = new(alloc()) LLoadArrowThis(useRegister(ins->callee()));
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::lowerCallArguments(MCall *call)
 {
     uint32_t argc = call->numStackArgs();
     if (argc > maxargslots_)
         maxargslots_ = argc;
     for (size_t i = 0; i < argc; i++) {
         MDefinition *arg = call->getArg(i);
         uint32_t argslot = argc - i;
         // Values take a slow path.
         if (arg->type() == MIRType_Value) {
             LStackArgV *stack = new(alloc()) LStackArgV(argslot);
             if (!useBox(stack, 0, arg) || !add(stack))
                 return false;
         } else {
             // Known types can move constant types and/or payloads.
             LStackArgT *stack = new(alloc()) LStackArgT(argslot, arg->type(), useRegisterOrConstant(arg));
             if (!add(stack))
                 return false;
         }
     }
     return true;
 }
 bool
 LIRGenerator::visitCall(MCall *call)
 {
     JS_ASSERT(CallTempReg0 != CallTempReg1);
     JS_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
     JS_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
     JS_ASSERT(call->getFunction()->type() == MIRType_Object);
     if (!lowerCallArguments(call))
         return false;
     // Height of the current argument vector.
     JSFunction *target = call->getSingleTarget();
     // Call DOM functions.
     if (call->isCallDOMNative()) {
         JS_ASSERT(target && target->isNative());
         Register cxReg, objReg, privReg, argsReg;
         GetTempRegForIntArg(0, 0, &cxReg);
         GetTempRegForIntArg(1, 0, &objReg);
         GetTempRegForIntArg(2, 0, &privReg);
         mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &argsReg);
         MOZ_ASSERT(ok, "How can we not have four temp registers?");
         LCallDOMNative *lir = new(alloc()) LCallDOMNative(tempFixed(cxReg), tempFixed(objReg),
                                                           tempFixed(privReg), tempFixed(argsReg));
         return defineReturn(lir, call) && assignSafepoint(lir, call);
     }
     // Call known functions.
     if (target) {
         if (target->isNative()) {
             Register cxReg, numReg, vpReg, tmpReg;
             GetTempRegForIntArg(0, 0, &cxReg);
             GetTempRegForIntArg(1, 0, &numReg);
             GetTempRegForIntArg(2, 0, &vpReg);
             // Even though this is just a temp reg, use the same API to avoid
             // register collisions.
             mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &tmpReg);
             MOZ_ASSERT(ok, "How can we not have four temp registers?");
             LCallNative *lir = new(alloc()) LCallNative(tempFixed(cxReg), tempFixed(numReg),
                                                         tempFixed(vpReg), tempFixed(tmpReg));
             return defineReturn(lir, call) && assignSafepoint(lir, call);
         }
         LCallKnown *lir = new(alloc()) LCallKnown(useFixed(call->getFunction(), CallTempReg0),
                                                   tempFixed(CallTempReg2));
         return defineReturn(lir, call) && assignSafepoint(lir, call);
     }
     // Call anything, using the most generic code.
     LCallGeneric *lir = new(alloc()) LCallGeneric(useFixed(call->getFunction(), CallTempReg0),
                                                   tempFixed(ArgumentsRectifierReg),
                                                   tempFixed(CallTempReg2));
     return defineReturn(lir, call) && assignSafepoint(lir, call);
 }
 bool
 LIRGenerator::visitApplyArgs(MApplyArgs *apply)
 {
     JS_ASSERT(apply->getFunction()->type() == MIRType_Object);
     // Assert if we cannot build a rectifier frame.
     JS_ASSERT(CallTempReg0 != ArgumentsRectifierReg);
     JS_ASSERT(CallTempReg1 != ArgumentsRectifierReg);
     // Assert if the return value is already erased.
     JS_ASSERT(CallTempReg2 != JSReturnReg_Type);
     JS_ASSERT(CallTempReg2 != JSReturnReg_Data);
     LApplyArgsGeneric *lir = new(alloc()) LApplyArgsGeneric(
         useFixed(apply->getFunction(), CallTempReg3),
         useFixed(apply->getArgc(), CallTempReg0),
         tempFixed(CallTempReg1),  // object register
         tempFixed(CallTempReg2)); // copy register
     MDefinition *self = apply->getThis();
     if (!useBoxFixed(lir, LApplyArgsGeneric::ThisIndex, self, CallTempReg4, CallTempReg5))
         return false;
     // Bailout is only needed in the case of possible non-JSFunction callee.
     if (!apply->getSingleTarget() && !assignSnapshot(lir))
         return false;
     if (!defineReturn(lir, apply))
         return false;
     if (!assignSafepoint(lir, apply))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitBail(MBail *bail)
 {
     LBail *lir = new(alloc()) LBail();
     return assignSnapshot(lir) && add(lir, bail);
 }
 bool
 LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
 {
     MIRType type = assertion->input()->type();
     DebugOnly<bool> checkIsFloat32 = assertion->mustBeFloat32();
     if (!allowFloat32Optimizations())
         return true;
     if (type != MIRType_Value && !js_JitOptions.eagerCompilation) {
         JS_ASSERT_IF(checkIsFloat32, type == MIRType_Float32);
         JS_ASSERT_IF(!checkIsFloat32, type != MIRType_Float32);
     }
     return true;
 }
 bool
 LIRGenerator::visitArraySplice(MArraySplice *ins)
 {
     LArraySplice *lir = new(alloc()) LArraySplice(useRegisterAtStart(ins->object()),
                                                   useRegisterAtStart(ins->start()),
                                                   useRegisterAtStart(ins->deleteCount()));
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetDynamicName(MGetDynamicName *ins)
 {
     MDefinition *scopeChain = ins->getScopeChain();
     JS_ASSERT(scopeChain->type() == MIRType_Object);
     MDefinition *name = ins->getName();
     JS_ASSERT(name->type() == MIRType_String);
     LGetDynamicName *lir = new(alloc()) LGetDynamicName(useFixed(scopeChain, CallTempReg0),
                                                         useFixed(name, CallTempReg1),
                                                         tempFixed(CallTempReg2),
                                                         tempFixed(CallTempReg3),
                                                         tempFixed(CallTempReg4));
     return assignSnapshot(lir) && defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitFilterArgumentsOrEval(MFilterArgumentsOrEval *ins)
 {
     MDefinition *string = ins->getString();
     MOZ_ASSERT(string->type() == MIRType_String || string->type() == MIRType_Value);
     LInstruction *lir;
     if (string->type() == MIRType_String) {
         lir = new(alloc()) LFilterArgumentsOrEvalS(useFixed(string, CallTempReg0),
                                                    tempFixed(CallTempReg1),
                                                    tempFixed(CallTempReg2));
     } else {
         lir = new(alloc()) LFilterArgumentsOrEvalV(tempFixed(CallTempReg0),
                                                    tempFixed(CallTempReg1),
                                                    tempFixed(CallTempReg2));
         if (!useBoxFixed(lir, LFilterArgumentsOrEvalV::Input, string,
                          CallTempReg3, CallTempReg4))
         {
             return false;
         }
     }
     return assignSnapshot(lir) && add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallDirectEval(MCallDirectEval *ins)
 {
     MDefinition *scopeChain = ins->getScopeChain();
     JS_ASSERT(scopeChain->type() == MIRType_Object);
     MDefinition *string = ins->getString();
     JS_ASSERT(string->type() == MIRType_String || string->type() == MIRType_Value);
     MDefinition *thisValue = ins->getThisValue();
     LInstruction *lir;
     if (string->type() == MIRType_String) {
         lir = new(alloc()) LCallDirectEvalS(useRegisterAtStart(scopeChain),
                                             useRegisterAtStart(string));
     } else {
         lir = new(alloc()) LCallDirectEvalV(useRegisterAtStart(scopeChain));
         if (!useBoxAtStart(lir, LCallDirectEvalV::Argument, string))
             return false;
     }
     if (string->type() == MIRType_String) {
         if (!useBoxAtStart(lir, LCallDirectEvalS::ThisValue, thisValue))
             return false;
     } else {
         if (!useBoxAtStart(lir, LCallDirectEvalV::ThisValue, thisValue))
             return false;
     }
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 static JSOp
 ReorderComparison(JSOp op, MDefinition **lhsp, MDefinition **rhsp)
 {
     MDefinition *lhs = *lhsp;
     MDefinition *rhs = *rhsp;
     if (lhs->isConstant()) {
         *rhsp = lhs;
         *lhsp = rhs;
         return ReverseCompareOp(op);
     }
     return op;
 }
 static void
 ReorderCommutative(MDefinition **lhsp, MDefinition **rhsp)
 {
     MDefinition *lhs = *lhsp;
     MDefinition *rhs = *rhsp;
     // Ensure that if there is a constant, then it is in rhs.
     // In addition, since clobbering binary operations clobber the left
     // operand, prefer a non-constant lhs operand with no further uses.
     if (rhs->isConstant())
         return;
     // lhs and rhs are used by the commutative operator. If they have any
     // *other* uses besides, try to reorder to avoid clobbering them. To
     // be fully precise, we should check whether this is the *last* use,
     // but checking hasOneDefUse() is a decent approximation which doesn't
     // require any extra analysis.
     JS_ASSERT(lhs->defUseCount() > 0);
     JS_ASSERT(rhs->defUseCount() > 0);
     if (lhs->isConstant() || (rhs->hasOneDefUse() && !lhs->hasOneDefUse())) {
         *rhsp = lhs;
         *lhsp = rhs;
     }
 }
 bool
 LIRGenerator::visitTest(MTest *test)
 {
     MDefinition *opd = test->getOperand(0);
     MBasicBlock *ifTrue = test->ifTrue();
     MBasicBlock *ifFalse = test->ifFalse();
     // String is converted to length of string in the type analysis phase (see
     // TestPolicy).
     JS_ASSERT(opd->type() != MIRType_String);
     if (opd->type() == MIRType_Value) {
         LDefinition temp0, temp1;
         if (test->operandMightEmulateUndefined()) {
             temp0 = temp();
             temp1 = temp();
         } else {
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
         LTestVAndBranch *lir = new(alloc()) LTestVAndBranch(ifTrue, ifFalse, tempDouble(), temp0, temp1);
         if (!useBox(lir, LTestVAndBranch::Input, opd))
             return false;
         return add(lir, test);
     }
     if (opd->type() == MIRType_Object) {
         // If the object might emulate undefined, we have to test for that.
         if (test->operandMightEmulateUndefined())
             return add(new(alloc()) LTestOAndBranch(useRegister(opd), ifTrue, ifFalse, temp()), test);
         // Otherwise we know it's truthy.
         return add(new(alloc()) LGoto(ifTrue));
     }
     // These must be explicitly sniffed out since they are constants and have
     // no payload.
     if (opd->type() == MIRType_Undefined || opd->type() == MIRType_Null)
         return add(new(alloc()) LGoto(ifFalse));
     // Constant Double operand.
     if (opd->type() == MIRType_Double && opd->isConstant()) {
         bool result = opd->toConstant()->valueToBoolean();
         return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
     // Constant Float32 operand.
     if (opd->type() == MIRType_Float32 && opd->isConstant()) {
         bool result = opd->toConstant()->valueToBoolean();
         return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
     // Constant Int32 operand.
     if (opd->type() == MIRType_Int32 && opd->isConstant()) {
         int32_t num = opd->toConstant()->value().toInt32();
         return add(new(alloc()) LGoto(num ? ifTrue : ifFalse));
     }
     // Constant Boolean operand.
     if (opd->type() == MIRType_Boolean && opd->isConstant()) {
         bool result = opd->toConstant()->value().toBoolean();
         return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
     }
     // Check if the operand for this test is a compare operation. If it is, we want
     // to emit an LCompare*AndBranch rather than an LTest*AndBranch, to fuse the
     // compare and jump instructions.
     if (opd->isCompare() && opd->isEmittedAtUses()) {
         MCompare *comp = opd->toCompare();
         MDefinition *left = comp->lhs();
         MDefinition *right = comp->rhs();
         // Try to fold the comparison so that we don't have to handle all cases.
         bool result;
         if (comp->tryFold(&result))
             return add(new(alloc()) LGoto(result ? ifTrue : ifFalse));
         // Emit LCompare*AndBranch.
         // Compare and branch null/undefined.
         // The second operand has known null/undefined type,
         // so just test the first operand.
         if (comp->compareType() == MCompare::Compare_Null ||
             comp->compareType() == MCompare::Compare_Undefined)
         {
             if (left->type() == MIRType_Object) {
                 MOZ_ASSERT(comp->operandMightEmulateUndefined(),
                            "MCompare::tryFold should handle the never-emulates-undefined case");
                 LEmulatesUndefinedAndBranch *lir =
                     new(alloc()) LEmulatesUndefinedAndBranch(comp, useRegister(left),
                                                              ifTrue, ifFalse, temp());
                 return add(lir, test);
             }
             LDefinition tmp, tmpToUnbox;
             if (comp->operandMightEmulateUndefined()) {
                 tmp = temp();
                 tmpToUnbox = tempToUnbox();
             } else {
                 tmp = LDefinition::BogusTemp();
                 tmpToUnbox = LDefinition::BogusTemp();
             }
             LIsNullOrLikeUndefinedAndBranch *lir =
                 new(alloc()) LIsNullOrLikeUndefinedAndBranch(comp, ifTrue, ifFalse,
                                                              tmp, tmpToUnbox);
             if (!useBox(lir, LIsNullOrLikeUndefinedAndBranch::Value, left))
                 return false;
             return add(lir, test);
         }
         // Compare and branch booleans.
         if (comp->compareType() == MCompare::Compare_Boolean) {
             JS_ASSERT(left->type() == MIRType_Value);
             JS_ASSERT(right->type() == MIRType_Boolean);
             LAllocation rhs = useRegisterOrConstant(right);
             LCompareBAndBranch *lir = new(alloc()) LCompareBAndBranch(comp, rhs, ifTrue, ifFalse);
             if (!useBox(lir, LCompareBAndBranch::Lhs, left))
                 return false;
             return add(lir, test);
         }
         // Compare and branch Int32 or Object pointers.
         if (comp->isInt32Comparison() ||
             comp->compareType() == MCompare::Compare_UInt32 ||
             comp->compareType() == MCompare::Compare_Object)
         {
             JSOp op = ReorderComparison(comp->jsop(), &left, &right);
             LAllocation lhs = useRegister(left);
             LAllocation rhs;
             if (comp->isInt32Comparison() || comp->compareType() == MCompare::Compare_UInt32)
                 rhs = useAnyOrConstant(right);
             else
                 rhs = useRegister(right);
             LCompareAndBranch *lir = new(alloc()) LCompareAndBranch(comp, op, lhs, rhs,
                                                                     ifTrue, ifFalse);
             return add(lir, test);
         }
         // Compare and branch doubles.
         if (comp->isDoubleComparison()) {
             LAllocation lhs = useRegister(left);
             LAllocation rhs = useRegister(right);
             LCompareDAndBranch *lir = new(alloc()) LCompareDAndBranch(comp, lhs, rhs,
                                                                       ifTrue, ifFalse);
             return add(lir, test);
         }
         // Compare and branch floats.
         if (comp->isFloat32Comparison()) {
             LAllocation lhs = useRegister(left);
             LAllocation rhs = useRegister(right);
             LCompareFAndBranch *lir = new(alloc()) LCompareFAndBranch(comp, lhs, rhs,
                                                                       ifTrue, ifFalse);
             return add(lir, test);
         }
         // Compare values.
         if (comp->compareType() == MCompare::Compare_Value) {
             LCompareVAndBranch *lir = new(alloc()) LCompareVAndBranch(comp, ifTrue, ifFalse);
             if (!useBoxAtStart(lir, LCompareVAndBranch::LhsInput, left))
                 return false;
             if (!useBoxAtStart(lir, LCompareVAndBranch::RhsInput, right))
                 return false;
             return add(lir, test);
         }
     }
     // Check if the operand for this test is a bitand operation. If it is, we want
     // to emit an LBitAndAndBranch rather than an LTest*AndBranch.
     if (opd->isBitAnd() && opd->isEmittedAtUses()) {
         MDefinition *lhs = opd->getOperand(0);
         MDefinition *rhs = opd->getOperand(1);
         if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
             ReorderCommutative(&lhs, &rhs);
             return lowerForBitAndAndBranch(new(alloc()) LBitAndAndBranch(ifTrue, ifFalse), test, lhs, rhs);
         }
     }
     if (opd->type() == MIRType_Double)
         return add(new(alloc()) LTestDAndBranch(useRegister(opd), ifTrue, ifFalse));
     if (opd->type() == MIRType_Float32)
         return add(new(alloc()) LTestFAndBranch(useRegister(opd), ifTrue, ifFalse));
     JS_ASSERT(opd->type() == MIRType_Int32 || opd->type() == MIRType_Boolean);
     return add(new(alloc()) LTestIAndBranch(useRegister(opd), ifTrue, ifFalse));
 }
 bool
 LIRGenerator::visitFunctionDispatch(MFunctionDispatch *ins)
 {
     LFunctionDispatch *lir = new(alloc()) LFunctionDispatch(useRegister(ins->input()));
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitTypeObjectDispatch(MTypeObjectDispatch *ins)
 {
     LTypeObjectDispatch *lir = new(alloc()) LTypeObjectDispatch(useRegister(ins->input()), temp());
     return add(lir, ins);
 }
 static inline bool
 CanEmitCompareAtUses(MInstruction *ins)
 {
     if (!ins->canEmitAtUses())
         return false;
     bool foundTest = false;
     for (MUseIterator iter(ins->usesBegin()); iter != ins->usesEnd(); iter++) {
         MNode *node = iter->consumer();
         if (!node->isDefinition())
             return false;
         if (!node->toDefinition()->isTest())
             return false;
         if (foundTest)
             return false;
         foundTest = true;
     }
     return true;
 }
 bool
 LIRGenerator::visitCompare(MCompare *comp)
 {
     MDefinition *left = comp->lhs();
     MDefinition *right = comp->rhs();
     // Try to fold the comparison so that we don't have to handle all cases.
     bool result;
     if (comp->tryFold(&result))
         return define(new(alloc()) LInteger(result), comp);
     // Move below the emitAtUses call if we ever implement
     // LCompareSAndBranch. Doing this now wouldn't be wrong, but doesn't
     // make sense and avoids confusion.
     if (comp->compareType() == MCompare::Compare_String) {
         LCompareS *lir = new(alloc()) LCompareS(useRegister(left), useRegister(right), temp());
         if (!define(lir, comp))
             return false;
         return assignSafepoint(lir, comp);
     }
     // Strict compare between value and string
     if (comp->compareType() == MCompare::Compare_StrictString) {
         JS_ASSERT(left->type() == MIRType_Value);
         JS_ASSERT(right->type() == MIRType_String);
         LCompareStrictS *lir = new(alloc()) LCompareStrictS(useRegister(right), temp(), tempToUnbox());
         if (!useBox(lir, LCompareStrictS::Lhs, left))
             return false;
         if (!define(lir, comp))
             return false;
         return assignSafepoint(lir, comp);
     }
     // Unknown/unspecialized compare use a VM call.
     if (comp->compareType() == MCompare::Compare_Unknown) {
         LCompareVM *lir = new(alloc()) LCompareVM();
         if (!useBoxAtStart(lir, LCompareVM::LhsInput, left))
             return false;
         if (!useBoxAtStart(lir, LCompareVM::RhsInput, right))
             return false;
         return defineReturn(lir, comp) && assignSafepoint(lir, comp);
     }
     // Sniff out if the output of this compare is used only for a branching.
     // If it is, then we will emit an LCompare*AndBranch instruction in place
     // of this compare and any test that uses this compare. Thus, we can
     // ignore this Compare.
     if (CanEmitCompareAtUses(comp))
         return emitAtUses(comp);
     // Compare Null and Undefined.
     if (comp->compareType() == MCompare::Compare_Null ||
         comp->compareType() == MCompare::Compare_Undefined)
     {
         if (left->type() == MIRType_Object) {
             MOZ_ASSERT(comp->operandMightEmulateUndefined(),
                        "MCompare::tryFold should have folded this away");
             return define(new(alloc()) LEmulatesUndefined(useRegister(left)), comp);
         }
         LDefinition tmp, tmpToUnbox;
         if (comp->operandMightEmulateUndefined()) {
             tmp = temp();
             tmpToUnbox = tempToUnbox();
         } else {
             tmp = LDefinition::BogusTemp();
             tmpToUnbox = LDefinition::BogusTemp();
         }
         LIsNullOrLikeUndefined *lir = new(alloc()) LIsNullOrLikeUndefined(tmp, tmpToUnbox);
         if (!useBox(lir, LIsNullOrLikeUndefined::Value, left))
             return false;
         return define(lir, comp);
     }
     // Compare booleans.
     if (comp->compareType() == MCompare::Compare_Boolean) {
         JS_ASSERT(left->type() == MIRType_Value);
         JS_ASSERT(right->type() == MIRType_Boolean);
         LCompareB *lir = new(alloc()) LCompareB(useRegisterOrConstant(right));
         if (!useBox(lir, LCompareB::Lhs, left))
             return false;
         return define(lir, comp);
     }
     // Compare Int32 or Object pointers.
     if (comp->isInt32Comparison() ||
         comp->compareType() == MCompare::Compare_UInt32 ||
         comp->compareType() == MCompare::Compare_Object)
     {
         JSOp op = ReorderComparison(comp->jsop(), &left, &right);
         LAllocation lhs = useRegister(left);
         LAllocation rhs;
         if (comp->isInt32Comparison() ||
             comp->compareType() == MCompare::Compare_UInt32)
         {
             rhs = useAnyOrConstant(right);
         } else {
             rhs = useRegister(right);
         }
         return define(new(alloc()) LCompare(op, lhs, rhs), comp);
     }
     // Compare doubles.
     if (comp->isDoubleComparison())
         return define(new(alloc()) LCompareD(useRegister(left), useRegister(right)), comp);
     // Compare float32.
     if (comp->isFloat32Comparison())
         return define(new(alloc()) LCompareF(useRegister(left), useRegister(right)), comp);
     // Compare values.
     if (comp->compareType() == MCompare::Compare_Value) {
         LCompareV *lir = new(alloc()) LCompareV();
         if (!useBoxAtStart(lir, LCompareV::LhsInput, left))
             return false;
         if (!useBoxAtStart(lir, LCompareV::RhsInput, right))
             return false;
         return define(lir, comp);
     }
     MOZ_ASSUME_UNREACHABLE("Unrecognized compare type.");
 }
 bool
 LIRGenerator::lowerBitOp(JSOp op, MInstruction *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
     if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
         ReorderCommutative(&lhs, &rhs);
         return lowerForALU(new(alloc()) LBitOpI(op), ins, lhs, rhs);
     }
     LBitOpV *lir = new(alloc()) LBitOpV(op);
     if (!useBoxAtStart(lir, LBitOpV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBitOpV::RhsInput, rhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitTypeOf(MTypeOf *ins)
 {
     MDefinition *opd = ins->input();
     JS_ASSERT(opd->type() == MIRType_Value);
     LTypeOfV *lir = new(alloc()) LTypeOfV(tempToUnbox());
     if (!useBox(lir, LTypeOfV::Input, opd))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitToId(MToId *ins)
 {
     LToIdV *lir = new(alloc()) LToIdV(tempDouble());
     if (!useBox(lir, LToIdV::Object, ins->lhs()))
         return false;
     if (!useBox(lir, LToIdV::Index, ins->rhs()))
         return false;
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitBitNot(MBitNot *ins)
 {
     MDefinition *input = ins->getOperand(0);
     if (input->type() == MIRType_Int32)
         return lowerForALU(new(alloc()) LBitNotI(), ins, input);
     LBitNotV *lir = new(alloc()) LBitNotV;
     if (!useBoxAtStart(lir, LBitNotV::Input, input))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 static bool
 CanEmitBitAndAtUses(MInstruction *ins)
 {
     if (!ins->canEmitAtUses())
         return false;
     if (ins->getOperand(0)->type() != MIRType_Int32 || ins->getOperand(1)->type() != MIRType_Int32)
         return false;
     MUseIterator iter(ins->usesBegin());
     if (iter == ins->usesEnd())
         return false;
     MNode *node = iter->consumer();
     if (!node->isDefinition())
         return false;
     if (!node->toDefinition()->isTest())
         return false;
     iter++;
     return iter == ins->usesEnd();
 }
 bool
 LIRGenerator::visitBitAnd(MBitAnd *ins)
 {
     // Sniff out if the output of this bitand is used only for a branching.
     // If it is, then we will emit an LBitAndAndBranch instruction in place
     // of this bitand and any test that uses this bitand. Thus, we can
     // ignore this BitAnd.
     if (CanEmitBitAndAtUses(ins))
         return emitAtUses(ins);
     return lowerBitOp(JSOP_BITAND, ins);
 }
 bool
 LIRGenerator::visitBitOr(MBitOr *ins)
 {
     return lowerBitOp(JSOP_BITOR, ins);
 }
 bool
 LIRGenerator::visitBitXor(MBitXor *ins)
 {
     return lowerBitOp(JSOP_BITXOR, ins);
 }
 bool
 LIRGenerator::lowerShiftOp(JSOp op, MShiftInstruction *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
     if (lhs->type() == MIRType_Int32 && rhs->type() == MIRType_Int32) {
         if (ins->type() == MIRType_Double) {
             JS_ASSERT(op == JSOP_URSH);
             return lowerUrshD(ins->toUrsh());
         }
         LShiftI *lir = new(alloc()) LShiftI(op);
         if (op == JSOP_URSH) {
             if (ins->toUrsh()->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
                 return false;
         }
         return lowerForShift(lir, ins, lhs, rhs);
     }
     JS_ASSERT(ins->specialization() == MIRType_None);
     if (op == JSOP_URSH) {
         // Result is either int32 or double so we have to use BinaryV.
         return lowerBinaryV(JSOP_URSH, ins);
     }
     LBitOpV *lir = new(alloc()) LBitOpV(op);
     if (!useBoxAtStart(lir, LBitOpV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBitOpV::RhsInput, rhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLsh(MLsh *ins)
 {
     return lowerShiftOp(JSOP_LSH, ins);
 }
 bool
 LIRGenerator::visitRsh(MRsh *ins)
 {
     return lowerShiftOp(JSOP_RSH, ins);
 }
 bool
 LIRGenerator::visitUrsh(MUrsh *ins)
 {
     return lowerShiftOp(JSOP_URSH, ins);
 }
 bool
 LIRGenerator::visitFloor(MFloor *ins)
 {
     MIRType type = ins->num()->type();
     JS_ASSERT(IsFloatingPointType(type));
     if (type == MIRType_Double) {
         LFloor *lir = new(alloc()) LFloor(useRegister(ins->num()));
         if (!assignSnapshot(lir))
             return false;
         return define(lir, ins);
     }
     LFloorF *lir = new(alloc()) LFloorF(useRegister(ins->num()));
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitRound(MRound *ins)
 {
     MIRType type = ins->num()->type();
     JS_ASSERT(IsFloatingPointType(type));
     if (type == MIRType_Double) {
         LRound *lir = new (alloc()) LRound(useRegister(ins->num()), tempDouble());
         if (!assignSnapshot(lir))
             return false;
         return define(lir, ins);
     }
     LRoundF *lir = new (alloc()) LRoundF(useRegister(ins->num()), tempDouble());
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitMinMax(MMinMax *ins)
 {
     MDefinition *first = ins->getOperand(0);
     MDefinition *second = ins->getOperand(1);
     ReorderCommutative(&first, &second);
     if (ins->specialization() == MIRType_Int32) {
         LMinMaxI *lir = new(alloc()) LMinMaxI(useRegisterAtStart(first), useRegisterOrConstant(second));
         return defineReuseInput(lir, ins, 0);
     }
     LMinMaxD *lir = new(alloc()) LMinMaxD(useRegisterAtStart(first), useRegister(second));
     return defineReuseInput(lir, ins, 0);
 }
 bool
 LIRGenerator::visitAbs(MAbs *ins)
 {
     MDefinition *num = ins->num();
     JS_ASSERT(IsNumberType(num->type()));
     if (num->type() == MIRType_Int32) {
         LAbsI *lir = new(alloc()) LAbsI(useRegisterAtStart(num));
         // needed to handle abs(INT32_MIN)
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return defineReuseInput(lir, ins, 0);
     }
     if (num->type() == MIRType_Float32) {
         LAbsF *lir = new(alloc()) LAbsF(useRegisterAtStart(num));
         return defineReuseInput(lir, ins, 0);
     }
     LAbsD *lir = new(alloc()) LAbsD(useRegisterAtStart(num));
     return defineReuseInput(lir, ins, 0);
 }
 bool
 LIRGenerator::visitSqrt(MSqrt *ins)
 {
     MDefinition *num = ins->num();
     JS_ASSERT(IsFloatingPointType(num->type()));
     if (num->type() == MIRType_Double) {
         LSqrtD *lir = new(alloc()) LSqrtD(useRegisterAtStart(num));
         return define(lir, ins);
     }
     LSqrtF *lir = new(alloc()) LSqrtF(useRegisterAtStart(num));
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitAtan2(MAtan2 *ins)
 {
     MDefinition *y = ins->y();
     JS_ASSERT(y->type() == MIRType_Double);
     MDefinition *x = ins->x();
     JS_ASSERT(x->type() == MIRType_Double);
     LAtan2D *lir = new(alloc()) LAtan2D(useRegisterAtStart(y), useRegisterAtStart(x), tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitHypot(MHypot *ins)
 {
     MDefinition *x = ins->x();
     JS_ASSERT(x->type() == MIRType_Double);
     MDefinition *y = ins->y();
     JS_ASSERT(y->type() == MIRType_Double);
     LHypot *lir = new(alloc()) LHypot(useRegisterAtStart(x), useRegisterAtStart(y), tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitPow(MPow *ins)
 {
     MDefinition *input = ins->input();
     JS_ASSERT(input->type() == MIRType_Double);
     MDefinition *power = ins->power();
     JS_ASSERT(power->type() == MIRType_Int32 || power->type() == MIRType_Double);
     if (power->type() == MIRType_Int32) {
         // Note: useRegisterAtStart here is safe, the temp is a GP register so
         // it will never get the same register.
         LPowI *lir = new(alloc()) LPowI(useRegisterAtStart(input), useFixed(power, CallTempReg1),
                                         tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
     LPowD *lir = new(alloc()) LPowD(useRegisterAtStart(input), useRegisterAtStart(power),
                                     tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitRandom(MRandom *ins)
 {
     LRandom *lir = new(alloc()) LRandom(tempFixed(CallTempReg0), tempFixed(CallTempReg1));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitMathFunction(MMathFunction *ins)
 {
     JS_ASSERT(IsFloatingPointType(ins->type()));
     JS_ASSERT_IF(ins->type() == MIRType_Double, ins->input()->type() == MIRType_Double);
     JS_ASSERT_IF(ins->type() == MIRType_Float32, ins->input()->type() == MIRType_Float32);
     if (ins->type() == MIRType_Double) {
         // Note: useRegisterAtStart is safe here, the temp is not a FP register.
         LMathFunctionD *lir = new(alloc()) LMathFunctionD(useRegisterAtStart(ins->input()),
                                                           tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
     LMathFunctionF *lir = new(alloc()) LMathFunctionF(useRegisterAtStart(ins->input()),
                                                       tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 // Try to mark an add or sub instruction as able to recover its input when
 // bailing out.
 template <typename S, typename T>
 static void
 MaybeSetRecoversInput(S *mir, T *lir)
 {
     JS_ASSERT(lir->mirRaw() == mir);
     if (!mir->fallible())
         return;
     if (lir->output()->policy() != LDefinition::MUST_REUSE_INPUT)
         return;
     // The original operands to an add or sub can't be recovered if they both
     // use the same register.
     if (lir->lhs()->isUse() && lir->rhs()->isUse() &&
         lir->lhs()->toUse()->virtualRegister() == lir->rhs()->toUse()->virtualRegister())
     {
         return;
     }
     // Add instructions that are on two different values can recover
     // the input they clobbered via MUST_REUSE_INPUT. Thus, a copy
     // of that input does not need to be kept alive in the snapshot
     // for the instruction.
     lir->setRecoversInput();
     const LUse *input = lir->getOperand(lir->output()->getReusedInput())->toUse();
     lir->snapshot()->rewriteRecoveredInput(*input);
 }
 bool
 LIRGenerator::visitAdd(MAdd *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
     JS_ASSERT(lhs->type() == rhs->type());
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs);
         LAddI *lir = new(alloc()) LAddI;
         if (ins->fallible() && !assignSnapshot(lir, Bailout_BaselineInfo))
             return false;
         if (!lowerForALU(lir, ins, lhs, rhs))
             return false;
         MaybeSetRecoversInput(ins, lir);
         return true;
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         ReorderCommutative(&lhs, &rhs);
         return lowerForFPU(new(alloc()) LMathD(JSOP_ADD), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         ReorderCommutative(&lhs, &rhs);
         return lowerForFPU(new(alloc()) LMathF(JSOP_ADD), ins, lhs, rhs);
     }
     return lowerBinaryV(JSOP_ADD, ins);
 }
 bool
 LIRGenerator::visitSub(MSub *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == rhs->type());
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         LSubI *lir = new(alloc()) LSubI;
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         if (!lowerForALU(lir, ins, lhs, rhs))
             return false;
         MaybeSetRecoversInput(ins, lir);
         return true;
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         return lowerForFPU(new(alloc()) LMathD(JSOP_SUB), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         return lowerForFPU(new(alloc()) LMathF(JSOP_SUB), ins, lhs, rhs);
     }
     return lowerBinaryV(JSOP_SUB, ins);
 }
 bool
 LIRGenerator::visitMul(MMul *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == rhs->type());
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         ReorderCommutative(&lhs, &rhs);
         // If our RHS is a constant -1 and we don't have to worry about
         // overflow, we can optimize to an LNegI.
         if (!ins->fallible() && rhs->isConstant() && rhs->toConstant()->value() == Int32Value(-1))
             return defineReuseInput(new(alloc()) LNegI(useRegisterAtStart(lhs)), ins, 0);
         return lowerMulI(ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         ReorderCommutative(&lhs, &rhs);
         // If our RHS is a constant -1.0, we can optimize to an LNegD.
         if (rhs->isConstant() && rhs->toConstant()->value() == DoubleValue(-1.0))
             return defineReuseInput(new(alloc()) LNegD(useRegisterAtStart(lhs)), ins, 0);
         return lowerForFPU(new(alloc()) LMathD(JSOP_MUL), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         ReorderCommutative(&lhs, &rhs);
         // We apply the same optimizations as for doubles
         if (rhs->isConstant() && rhs->toConstant()->value() == Float32Value(-1.0f))
             return defineReuseInput(new(alloc()) LNegF(useRegisterAtStart(lhs)), ins, 0);
         return lowerForFPU(new(alloc()) LMathF(JSOP_MUL), ins, lhs, rhs);
     }
     return lowerBinaryV(JSOP_MUL, ins);
 }
 bool
 LIRGenerator::visitDiv(MDiv *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == rhs->type());
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(lhs->type() == MIRType_Int32);
         return lowerDivI(ins);
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(lhs->type() == MIRType_Double);
         return lowerForFPU(new(alloc()) LMathD(JSOP_DIV), ins, lhs, rhs);
     }
     if (ins->specialization() == MIRType_Float32) {
         JS_ASSERT(lhs->type() == MIRType_Float32);
         return lowerForFPU(new(alloc()) LMathF(JSOP_DIV), ins, lhs, rhs);
     }
     return lowerBinaryV(JSOP_DIV, ins);
 }
 bool
 LIRGenerator::visitMod(MMod *ins)
 {
     JS_ASSERT(ins->lhs()->type() == ins->rhs()->type());
     if (ins->specialization() == MIRType_Int32) {
         JS_ASSERT(ins->type() == MIRType_Int32);
         JS_ASSERT(ins->lhs()->type() == MIRType_Int32);
         return lowerModI(ins);
     }
     if (ins->specialization() == MIRType_Double) {
         JS_ASSERT(ins->type() == MIRType_Double);
         JS_ASSERT(ins->lhs()->type() == MIRType_Double);
         JS_ASSERT(ins->rhs()->type() == MIRType_Double);
         // Note: useRegisterAtStart is safe here, the temp is not a FP register.
         LModD *lir = new(alloc()) LModD(useRegisterAtStart(ins->lhs()), useRegisterAtStart(ins->rhs()),
                                         tempFixed(CallTempReg0));
         return defineReturn(lir, ins);
     }
     return lowerBinaryV(JSOP_MOD, ins);
 }
 bool
 LIRGenerator::lowerBinaryV(JSOp op, MBinaryInstruction *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Value);
     LBinaryV *lir = new(alloc()) LBinaryV(op);
     if (!useBoxAtStart(lir, LBinaryV::LhsInput, lhs))
         return false;
     if (!useBoxAtStart(lir, LBinaryV::RhsInput, rhs))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitConcat(MConcat *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     MDefinition *rhs = ins->getOperand(1);
     JS_ASSERT(lhs->type() == MIRType_String);
     JS_ASSERT(rhs->type() == MIRType_String);
     JS_ASSERT(ins->type() == MIRType_String);
     LConcat *lir = new(alloc()) LConcat(useFixedAtStart(lhs, CallTempReg0),
                                         useFixedAtStart(rhs, CallTempReg1),
                                         tempFixed(CallTempReg0),
                                         tempFixed(CallTempReg1),
                                         tempFixed(CallTempReg2),
                                         tempFixed(CallTempReg3),
                                         tempFixed(CallTempReg4));
     if (!defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg5))))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitConcatPar(MConcatPar *ins)
 {
     MDefinition *cx = ins->forkJoinContext();
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == MIRType_String);
     JS_ASSERT(rhs->type() == MIRType_String);
     JS_ASSERT(ins->type() == MIRType_String);
     LConcatPar *lir = new(alloc()) LConcatPar(useFixed(cx, CallTempReg4),
                                               useFixedAtStart(lhs, CallTempReg0),
                                               useFixedAtStart(rhs, CallTempReg1),
                                               tempFixed(CallTempReg0),
                                               tempFixed(CallTempReg1),
                                               tempFixed(CallTempReg2),
                                               tempFixed(CallTempReg3));
     if (!defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg5))))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCharCodeAt(MCharCodeAt *ins)
 {
     MDefinition *str = ins->getOperand(0);
     MDefinition *idx = ins->getOperand(1);
     JS_ASSERT(str->type() == MIRType_String);
     JS_ASSERT(idx->type() == MIRType_Int32);
     LCharCodeAt *lir = new(alloc()) LCharCodeAt(useRegister(str), useRegister(idx));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitFromCharCode(MFromCharCode *ins)
 {
     MDefinition *code = ins->getOperand(0);
     JS_ASSERT(code->type() == MIRType_Int32);
     LFromCharCode *lir = new(alloc()) LFromCharCode(useRegister(code));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitStart(MStart *start)
 {
     // Create a snapshot that captures the initial state of the function.
     LStart *lir = new(alloc()) LStart;
     if (!assignSnapshot(lir))
         return false;
     if (start->startType() == MStart::StartType_Default)
         lirGraph_.setEntrySnapshot(lir->snapshot());
     return add(lir);
 }
 bool
 LIRGenerator::visitNop(MNop *nop)
 {
     return true;
 }
 bool
 LIRGenerator::visitOsrEntry(MOsrEntry *entry)
 {
     LOsrEntry *lir = new(alloc()) LOsrEntry;
     return defineFixed(lir, entry, LAllocation(AnyRegister(OsrFrameReg)));
 }
 bool
 LIRGenerator::visitOsrValue(MOsrValue *value)
 {
     LOsrValue *lir = new(alloc()) LOsrValue(useRegister(value->entry()));
     return defineBox(lir, value);
 }
 bool
 LIRGenerator::visitOsrReturnValue(MOsrReturnValue *value)
 {
     LOsrReturnValue *lir = new(alloc()) LOsrReturnValue(useRegister(value->entry()));
     return defineBox(lir, value);
 }
 bool
 LIRGenerator::visitOsrScopeChain(MOsrScopeChain *object)
 {
     LOsrScopeChain *lir = new(alloc()) LOsrScopeChain(useRegister(object->entry()));
     return define(lir, object);
 }
 bool
 LIRGenerator::visitOsrArgumentsObject(MOsrArgumentsObject *object)
 {
     LOsrArgumentsObject *lir = new(alloc()) LOsrArgumentsObject(useRegister(object->entry()));
     return define(lir, object);
 }
 bool
 LIRGenerator::visitToDouble(MToDouble *convert)
 {
     MDefinition *opd = convert->input();
     mozilla::DebugOnly<MToDouble::ConversionKind> conversion = convert->conversion();
     switch (opd->type()) {
       case MIRType_Value:
       {
         LValueToDouble *lir = new(alloc()) LValueToDouble();
         if (!useBox(lir, LValueToDouble::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert);
       }
       case MIRType_Null:
         JS_ASSERT(conversion != MToDouble::NumbersOnly && conversion != MToDouble::NonNullNonStringPrimitives);
         return lowerConstantDouble(0, convert);
       case MIRType_Undefined:
         JS_ASSERT(conversion != MToDouble::NumbersOnly);
         return lowerConstantDouble(GenericNaN(), convert);
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToDouble::NumbersOnly);
         /* FALLTHROUGH */
       case MIRType_Int32:
       {
         LInt32ToDouble *lir = new(alloc()) LInt32ToDouble(useRegister(opd));
         return define(lir, convert);
       }
       case MIRType_Float32:
       {
         LFloat32ToDouble *lir = new(alloc()) LFloat32ToDouble(useRegisterAtStart(opd));
         return define(lir, convert);
       }
       case MIRType_Double:
         return redefine(convert, opd);
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 bool
 LIRGenerator::visitToFloat32(MToFloat32 *convert)
 {
     MDefinition *opd = convert->input();
     mozilla::DebugOnly<MToFloat32::ConversionKind> conversion = convert->conversion();
     switch (opd->type()) {
       case MIRType_Value:
       {
         LValueToFloat32 *lir = new(alloc()) LValueToFloat32();
         if (!useBox(lir, LValueToFloat32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert);
       }
       case MIRType_Null:
         JS_ASSERT(conversion != MToFloat32::NonStringPrimitives);
         return lowerConstantFloat32(0, convert);
       case MIRType_Undefined:
         JS_ASSERT(conversion != MToFloat32::NumbersOnly);
         return lowerConstantFloat32(GenericNaN(), convert);
       case MIRType_Boolean:
         JS_ASSERT(conversion != MToFloat32::NumbersOnly);
         /* FALLTHROUGH */
       case MIRType_Int32:
       {
         LInt32ToFloat32 *lir = new(alloc()) LInt32ToFloat32(useRegister(opd));
         return define(lir, convert);
       }
       case MIRType_Double:
       {
         LDoubleToFloat32 *lir = new(alloc()) LDoubleToFloat32(useRegister(opd));
         return define(lir, convert);
       }
       case MIRType_Float32:
         return redefine(convert, opd);
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
         MOZ_ASSUME_UNREACHABLE("unexpected type");
         return false;
     }
 }
 bool
 LIRGenerator::visitToInt32(MToInt32 *convert)
 {
     MDefinition *opd = convert->input();
     switch (opd->type()) {
       case MIRType_Value:
       {
         LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::NORMAL);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, convert) && assignSafepoint(lir, convert);
       }
       case MIRType_Null:
         return define(new(alloc()) LInteger(0), convert);
       case MIRType_Int32:
       case MIRType_Boolean:
         return redefine(convert, opd);
       case MIRType_Float32:
       {
         LFloat32ToInt32 *lir = new(alloc()) LFloat32ToInt32(useRegister(opd));
         return assignSnapshot(lir) && define(lir, convert);
       }
       case MIRType_Double:
       {
         LDoubleToInt32 *lir = new(alloc()) LDoubleToInt32(useRegister(opd));
         return assignSnapshot(lir) && define(lir, convert);
       }
       case MIRType_String:
       case MIRType_Object:
       case MIRType_Undefined:
         // Objects might be effectful. Undefined coerces to NaN, not int32.
         MOZ_ASSUME_UNREACHABLE("ToInt32 invalid input type");
         return false;
       default:
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 bool
 LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
 {
     MDefinition *opd = truncate->input();
     switch (opd->type()) {
       case MIRType_Value:
       {
         LValueToInt32 *lir = new(alloc()) LValueToInt32(tempDouble(), temp(), LValueToInt32::TRUNCATE);
         if (!useBox(lir, LValueToInt32::Input, opd))
             return false;
         return assignSnapshot(lir) && define(lir, truncate) && assignSafepoint(lir, truncate);
       }
       case MIRType_Null:
       case MIRType_Undefined:
         return define(new(alloc()) LInteger(0), truncate);
       case MIRType_Int32:
       case MIRType_Boolean:
         return redefine(truncate, opd);
       case MIRType_Double:
         return lowerTruncateDToInt32(truncate);
       case MIRType_Float32:
         return lowerTruncateFToInt32(truncate);
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 bool
 LIRGenerator::visitToString(MToString *ins)
 {
     MDefinition *opd = ins->input();
     switch (opd->type()) {
       case MIRType_Null: {
         const JSAtomState &names = GetIonContext()->runtime->names();
         LPointer *lir = new(alloc()) LPointer(names.null);
         return define(lir, ins);
       }
       case MIRType_Undefined: {
         const JSAtomState &names = GetIonContext()->runtime->names();
         LPointer *lir = new(alloc()) LPointer(names.undefined);
         return define(lir, ins);
       }
       case MIRType_Boolean: {
         LBooleanToString *lir = new(alloc()) LBooleanToString(useRegister(opd));
         return define(lir, ins);
       }
       case MIRType_Double: {
         LDoubleToString *lir = new(alloc()) LDoubleToString(useRegister(opd), temp());
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
       case MIRType_Int32: {
         LIntToString *lir = new(alloc()) LIntToString(useRegister(opd));
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
       case MIRType_Value: {
         JS_ASSERT(!opd->mightBeType(MIRType_Object));
         LPrimitiveToString *lir = new(alloc()) LPrimitiveToString(tempToUnbox());
         if (!useBox(lir, LPrimitiveToString::Input, opd))
             return false;
         if (!define(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
       }
       default:
         // Objects might be effectful. (see ToPrimitive)
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 static bool
 MustCloneRegExpForCall(MCall *call, uint32_t useIndex)
 {
     // We have a regex literal flowing into a call. Return |false| iff
     // this is a native call that does not let the regex escape.
     JSFunction *target = call->getSingleTarget();
     if (!target || !target->isNative())
         return true;
     if (useIndex == MCall::IndexOfThis() &&
         (target->native() == regexp_exec || target->native() == regexp_test))
     {
         return false;
     }
     if (useIndex == MCall::IndexOfArgument(0) &&
         (target->native() == str_split ||
          target->native() == str_replace ||
          target->native() == str_match ||
          target->native() == str_search))
     {
         return false;
     }
     return true;
 }
 static bool
 MustCloneRegExp(MRegExp *regexp)
 {
     if (regexp->mustClone())
         return true;
     // If this regex literal only flows into known natives that don't let
     // it escape, we don't have to clone it.
     for (MUseIterator iter(regexp->usesBegin()); iter != regexp->usesEnd(); iter++) {
         MNode *node = iter->consumer();
         if (!node->isDefinition())
             return true;
         MDefinition *def = node->toDefinition();
         if (def->isRegExpTest() && iter->index() == 1) {
             // Optimized RegExp.prototype.test.
             JS_ASSERT(def->toRegExpTest()->regexp() == regexp);
             continue;
         }
         if (def->isCall() && !MustCloneRegExpForCall(def->toCall(), iter->index()))
             continue;
         return true;
     }
     return false;
 }
 bool
 LIRGenerator::visitRegExp(MRegExp *ins)
 {
     if (!MustCloneRegExp(ins)) {
         RegExpObject *source = ins->source();
         return define(new(alloc()) LPointer(source), ins);
     }
     LRegExp *lir = new(alloc()) LRegExp();
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitRegExpExec(MRegExpExec *ins)
 {
     JS_ASSERT(ins->regexp()->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     LRegExpExec *lir = new(alloc()) LRegExpExec(useRegisterAtStart(ins->regexp()),
                                                 useRegisterAtStart(ins->string()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitRegExpTest(MRegExpTest *ins)
 {
     JS_ASSERT(ins->regexp()->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     LRegExpTest *lir = new(alloc()) LRegExpTest(useRegisterAtStart(ins->regexp()),
                                                 useRegisterAtStart(ins->string()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitRegExpReplace(MRegExpReplace *ins)
 {
     JS_ASSERT(ins->pattern()->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     JS_ASSERT(ins->replacement()->type() == MIRType_String);
     LRegExpReplace *lir = new(alloc()) LRegExpReplace(useRegisterOrConstantAtStart(ins->string()),
                                                       useRegisterAtStart(ins->pattern()),
                                                       useRegisterOrConstantAtStart(ins->replacement()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitStringReplace(MStringReplace *ins)
 {
     JS_ASSERT(ins->pattern()->type() == MIRType_String);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     JS_ASSERT(ins->replacement()->type() == MIRType_String);
     LStringReplace *lir = new(alloc()) LStringReplace(useRegisterOrConstantAtStart(ins->string()),
                                                       useRegisterAtStart(ins->pattern()),
                                                       useRegisterOrConstantAtStart(ins->replacement()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLambda(MLambda *ins)
 {
     if (ins->info().singletonType || ins->info().useNewTypeForClone) {
         // If the function has a singleton type, this instruction will only be
         // executed once so we don't bother inlining it.
         //
         // If UseNewTypeForClone is true, we will assign a singleton type to
         // the clone and we have to clone the script, we can't do that inline.
         LLambdaForSingleton *lir = new(alloc()) LLambdaForSingleton(useRegisterAtStart(ins->scopeChain()));
         return defineReturn(lir, ins) && assignSafepoint(lir, ins);
     }
     LLambda *lir = new(alloc()) LLambda(useRegister(ins->scopeChain()), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLambdaArrow(MLambdaArrow *ins)
 {
     MOZ_ASSERT(ins->scopeChain()->type() == MIRType_Object);
     MOZ_ASSERT(ins->thisDef()->type() == MIRType_Value);
     LLambdaArrow *lir = new(alloc()) LLambdaArrow(useRegister(ins->scopeChain()), temp());
     if (!useBox(lir, LLambdaArrow::ThisValue, ins->thisDef()))
         return false;
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLambdaPar(MLambdaPar *ins)
 {
     JS_ASSERT(!ins->info().singletonType);
     JS_ASSERT(!ins->info().useNewTypeForClone);
     LLambdaPar *lir = new(alloc()) LLambdaPar(useRegister(ins->forkJoinContext()),
                                               useRegister(ins->scopeChain()),
                                               temp(), temp());
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitImplicitThis(MImplicitThis *ins)
 {
     JS_ASSERT(ins->callee()->type() == MIRType_Object);
     LImplicitThis *lir = new(alloc()) LImplicitThis(useRegister(ins->callee()));
     return assignSnapshot(lir) && defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitSlots(MSlots *ins)
 {
     return define(new(alloc()) LSlots(useRegisterAtStart(ins->object())), ins);
 }
 bool
 LIRGenerator::visitElements(MElements *ins)
 {
     return define(new(alloc()) LElements(useRegisterAtStart(ins->object())), ins);
 }
 bool
 LIRGenerator::visitConstantElements(MConstantElements *ins)
 {
     return define(new(alloc()) LPointer(ins->value(), LPointer::NON_GC_THING), ins);
 }
 bool
 LIRGenerator::visitConvertElementsToDoubles(MConvertElementsToDoubles *ins)
 {
     LInstruction *check = new(alloc()) LConvertElementsToDoubles(useRegister(ins->elements()));
     return add(check, ins) && assignSafepoint(check, ins);
 }
 bool
 LIRGenerator::visitMaybeToDoubleElement(MMaybeToDoubleElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->value()->type() == MIRType_Int32);
     LMaybeToDoubleElement *lir = new(alloc()) LMaybeToDoubleElement(useRegisterAtStart(ins->elements()),
                                                                     useRegisterAtStart(ins->value()),
                                                                     tempDouble());
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 {
     switch (ins->type()) {
       case MIRType_Value:
         return defineBox(new(alloc()) LLoadSlotV(useRegister(ins->slots())), ins);
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
       default:
         return define(new(alloc()) LLoadSlotT(useRegister(ins->slots())), ins);
     }
 }
 bool
 LIRGenerator::visitFunctionEnvironment(MFunctionEnvironment *ins)
 {
     return define(new(alloc()) LFunctionEnvironment(useRegisterAtStart(ins->function())), ins);
 }
 bool
 LIRGenerator::visitForkJoinContext(MForkJoinContext *ins)
 {
     LForkJoinContext *lir = new(alloc()) LForkJoinContext(tempFixed(CallTempReg0));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitGuardThreadExclusive(MGuardThreadExclusive *ins)
 {
     // FIXME (Bug 956281) -- For now, we always generate the most
     // general form of write guard check. we could employ TI feedback
     // to optimize this if we know that the object being tested is a
     // typed object or know that it is definitely NOT a typed object.
     LGuardThreadExclusive *lir =
         new(alloc()) LGuardThreadExclusive(useFixed(ins->forkJoinContext(), CallTempReg0),
                                            useFixed(ins->object(), CallTempReg1),
                                            tempFixed(CallTempReg2));
     lir->setMir(ins);
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitInterruptCheck(MInterruptCheck *ins)
 {
     // Implicit interrupt checks require asm.js signal handlers to be
     // installed. ARM does not yet use implicit interrupt checks, see
     // bug 864220.
 #ifndef JS_CODEGEN_ARM
     if (GetIonContext()->runtime->signalHandlersInstalled()) {
         LInterruptCheckImplicit *lir = new(alloc()) LInterruptCheckImplicit();
         return add(lir, ins) && assignSafepoint(lir, ins);
     }
 #endif
     LInterruptCheck *lir = new(alloc()) LInterruptCheck();
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitInterruptCheckPar(MInterruptCheckPar *ins)
 {
     LInterruptCheckPar *lir =
         new(alloc()) LInterruptCheckPar(useRegister(ins->forkJoinContext()), temp());
     if (!add(lir, ins))
         return false;
     if (!assignSafepoint(lir, ins))
         return false;
     return true;
 }
 bool
 LIRGenerator::visitNewPar(MNewPar *ins)
 {
     LNewPar *lir = new(alloc()) LNewPar(useRegister(ins->forkJoinContext()), temp(), temp());
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitNewDenseArrayPar(MNewDenseArrayPar *ins)
 {
     LNewDenseArrayPar *lir =
         new(alloc()) LNewDenseArrayPar(useFixed(ins->forkJoinContext(), CallTempReg0),
                                        useFixed(ins->length(), CallTempReg1),
                                        tempFixed(CallTempReg2),
                                        tempFixed(CallTempReg3),
                                        tempFixed(CallTempReg4));
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitStoreSlot(MStoreSlot *ins)
 {
     LInstruction *lir;
     switch (ins->value()->type()) {
       case MIRType_Value:
         lir = new(alloc()) LStoreSlotV(useRegister(ins->slots()));
         if (!useBox(lir, LStoreSlotV::Value, ins->value()))
             return false;
         return add(lir, ins);
       case MIRType_Double:
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
       case MIRType_Float32:
         MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be stored in a slot.");
       default:
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegisterOrConstant(ins->value())),
                    ins);
     }
     return true;
 }
 bool
 LIRGenerator::visitFilterTypeSet(MFilterTypeSet *ins)
 {
     return redefine(ins, ins->input());
 }
 bool
 LIRGenerator::visitTypeBarrier(MTypeBarrier *ins)
 {
     // Requesting a non-GC pointer is safe here since we never re-enter C++
     // from inside a type barrier test.
     const types::TemporaryTypeSet *types = ins->resultTypeSet();
     bool needTemp = !types->unknownObject() && types->getObjectCount() > 0;
     MIRType inputType = ins->getOperand(0)->type();
     DebugOnly<MIRType> outputType = ins->type();
     JS_ASSERT(inputType == outputType);
     // Handle typebarrier that will always bail.
     // (Emit LBail for visibility).
     if (ins->alwaysBails()) {
         LBail *bail = new(alloc()) LBail();
         if (!assignSnapshot(bail))
             return false;
         return redefine(ins, ins->input()) && add(bail, ins);
     }
     // Handle typebarrier with Value as input.
     if (inputType == MIRType_Value) {
         LDefinition tmp = needTemp ? temp() : tempToUnbox();
         LTypeBarrierV *barrier = new(alloc()) LTypeBarrierV(tmp);
         if (!useBox(barrier, LTypeBarrierV::Input, ins->input()))
             return false;
         if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->input()) && add(barrier, ins);
     }
     // Handle typebarrier with specific TypeObject/SingleObjects.
     if (inputType == MIRType_Object && !types->hasType(types::Type::AnyObjectType()))
     {
         LDefinition tmp = needTemp ? temp() : LDefinition::BogusTemp();
         LTypeBarrierO *barrier = new(alloc()) LTypeBarrierO(useRegister(ins->getOperand(0)), tmp);
         if (!assignSnapshot(barrier))
             return false;
         return redefine(ins, ins->getOperand(0)) && add(barrier, ins);
     }
     // Handle remaining cases: No-op, unbox did everything.
     return redefine(ins, ins->getOperand(0));
 }
 bool
 LIRGenerator::visitMonitorTypes(MMonitorTypes *ins)
 {
     // Requesting a non-GC pointer is safe here since we never re-enter C++
     // from inside a type check.
     const types::TemporaryTypeSet *types = ins->typeSet();
     bool needTemp = !types->unknownObject() && types->getObjectCount() > 0;
     LDefinition tmp = needTemp ? temp() : tempToUnbox();
     LMonitorTypes *lir = new(alloc()) LMonitorTypes(tmp);
     if (!useBox(lir, LMonitorTypes::Input, ins->input()))
         return false;
     return assignSnapshot(lir, Bailout_Normal) && add(lir, ins);
 }
 bool
 LIRGenerator::visitPostWriteBarrier(MPostWriteBarrier *ins)
 {
 #ifdef JSGC_GENERATIONAL
     switch (ins->value()->type()) {
       case MIRType_Object: {
         LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
         LPostWriteBarrierO *lir =
             new(alloc()) LPostWriteBarrierO(useRegisterOrConstant(ins->object()),
                                             useRegister(ins->value()), tmp);
         return add(lir, ins) && assignSafepoint(lir, ins);
       }
       case MIRType_Value: {
         LDefinition tmp = needTempForPostBarrier() ? temp() : LDefinition::BogusTemp();
         LPostWriteBarrierV *lir =
             new(alloc()) LPostWriteBarrierV(useRegisterOrConstant(ins->object()), tmp);
         if (!useBox(lir, LPostWriteBarrierV::Input, ins->value()))
             return false;
         return add(lir, ins) && assignSafepoint(lir, ins);
       }
       default:
         // Currently, only objects can be in the nursery. Other instruction
         // types cannot hold nursery pointers.
         return true;
     }
 #endif // JSGC_GENERATIONAL
     return true;
 }
 bool
 LIRGenerator::visitArrayLength(MArrayLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     return define(new(alloc()) LArrayLength(useRegisterAtStart(ins->elements())), ins);
 }
 bool
 LIRGenerator::visitSetArrayLength(MSetArrayLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->index()->isConstant());
     return add(new(alloc()) LSetArrayLength(useRegister(ins->elements()),
                                             useRegisterOrConstant(ins->index())), ins);
 }
 bool
 LIRGenerator::visitTypedArrayLength(MTypedArrayLength *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     return define(new(alloc()) LTypedArrayLength(useRegisterAtStart(ins->object())), ins);
 }
 bool
 LIRGenerator::visitTypedArrayElements(MTypedArrayElements *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Elements);
     return define(new(alloc()) LTypedArrayElements(useRegisterAtStart(ins->object())), ins);
 }
 bool
 LIRGenerator::visitTypedObjectElements(MTypedObjectElements *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Elements);
     return define(new(alloc()) LTypedObjectElements(useRegisterAtStart(ins->object())), ins);
 }
 bool
 LIRGenerator::visitSetTypedObjectOffset(MSetTypedObjectOffset *ins)
 {
     return add(new(alloc()) LSetTypedObjectOffset(
                    useRegister(ins->object()),
                    useRegister(ins->offset()),
                    temp()),
                ins);
 }
 bool
 LIRGenerator::visitInitializedLength(MInitializedLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     return define(new(alloc()) LInitializedLength(useRegisterAtStart(ins->elements())), ins);
 }
 bool
 LIRGenerator::visitSetInitializedLength(MSetInitializedLength *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->index()->isConstant());
     return add(new(alloc()) LSetInitializedLength(useRegister(ins->elements()),
                                                   useRegisterOrConstant(ins->index())), ins);
 }
 bool
 LIRGenerator::visitNot(MNot *ins)
 {
     MDefinition *op = ins->operand();
     // String is converted to length of string in the type analysis phase (see
     // TestPolicy).
     JS_ASSERT(op->type() != MIRType_String);
     // - boolean: x xor 1
     // - int32: LCompare(x, 0)
     // - double: LCompare(x, 0)
     // - null or undefined: true
     // - object: false if it never emulates undefined, else LNotO(x)
     switch (op->type()) {
       case MIRType_Boolean: {
         MConstant *cons = MConstant::New(alloc(), Int32Value(1));
         ins->block()->insertBefore(ins, cons);
         return lowerForALU(new(alloc()) LBitOpI(JSOP_BITXOR), ins, op, cons);
       }
       case MIRType_Int32: {
         return define(new(alloc()) LNotI(useRegisterAtStart(op)), ins);
       }
       case MIRType_Double:
         return define(new(alloc()) LNotD(useRegister(op)), ins);
       case MIRType_Float32:
         return define(new(alloc()) LNotF(useRegister(op)), ins);
       case MIRType_Undefined:
       case MIRType_Null:
         return define(new(alloc()) LInteger(1), ins);
       case MIRType_Object: {
         // Objects that don't emulate undefined can be constant-folded.
         if (!ins->operandMightEmulateUndefined())
             return define(new(alloc()) LInteger(0), ins);
         // All others require further work.
         return define(new(alloc()) LNotO(useRegister(op)), ins);
       }
       case MIRType_Value: {
         LDefinition temp0, temp1;
         if (ins->operandMightEmulateUndefined()) {
             temp0 = temp();
             temp1 = temp();
         } else {
             temp0 = LDefinition::BogusTemp();
             temp1 = LDefinition::BogusTemp();
         }
         LNotV *lir = new(alloc()) LNotV(tempDouble(), temp0, temp1);
         if (!useBox(lir, LNotV::Input, op))
             return false;
         return define(lir, ins);
       }
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected MIRType.");
     }
 }
 bool
 LIRGenerator::visitNeuterCheck(MNeuterCheck *ins)
 {
     LNeuterCheck *chk = new(alloc()) LNeuterCheck(useRegister(ins->object()),
                                                   temp());
     if (!assignSnapshot(chk, Bailout_BoundsCheck))
         return false;
     return redefine(ins, ins->input()) && add(chk, ins);
 }
 bool
 LIRGenerator::visitBoundsCheck(MBoundsCheck *ins)
 {
     LInstruction *check;
     if (ins->minimum() || ins->maximum()) {
         check = new(alloc()) LBoundsCheckRange(useRegisterOrConstant(ins->index()),
                                                useAny(ins->length()),
                                                temp());
     } else {
         check = new(alloc()) LBoundsCheck(useRegisterOrConstant(ins->index()),
                                           useAnyOrConstant(ins->length()));
     }
     return assignSnapshot(check, Bailout_BoundsCheck) && add(check, ins);
 }
 bool
 LIRGenerator::visitBoundsCheckLower(MBoundsCheckLower *ins)
 {
     if (!ins->fallible())
         return true;
     LInstruction *check = new(alloc()) LBoundsCheckLower(useRegister(ins->index()));
     return assignSnapshot(check, Bailout_BoundsCheck) && add(check, ins);
 }
 bool
 LIRGenerator::visitInArray(MInArray *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->initLength()->type() == MIRType_Int32);
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Boolean);
     LAllocation object;
     if (ins->needsNegativeIntCheck())
         object = useRegister(ins->object());
     else
         object = LConstantIndex::Bogus();
     LInArray *lir = new(alloc()) LInArray(useRegister(ins->elements()),
                                           useRegisterOrConstant(ins->index()),
                                           useRegister(ins->initLength()),
                                           object);
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLoadElement(MLoadElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     switch (ins->type()) {
       case MIRType_Value:
       {
         LLoadElementV *lir = new(alloc()) LLoadElementV(useRegister(ins->elements()),
                                                useRegisterOrConstant(ins->index()));
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return defineBox(lir, ins);
       }
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
       default:
       {
         LLoadElementT *lir = new(alloc()) LLoadElementT(useRegister(ins->elements()),
                                                useRegisterOrConstant(ins->index()));
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return define(lir, ins);
       }
     }
 }
 bool
 LIRGenerator::visitLoadElementHole(MLoadElementHole *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->initLength()->type() == MIRType_Int32);
     JS_ASSERT(ins->type() == MIRType_Value);
     LLoadElementHole *lir = new(alloc()) LLoadElementHole(useRegister(ins->elements()),
                                                           useRegisterOrConstant(ins->index()),
                                                           useRegister(ins->initLength()));
     if (ins->needsNegativeIntCheck() && !assignSnapshot(lir))
         return false;
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitStoreElement(MStoreElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     const LUse elements = useRegister(ins->elements());
     const LAllocation index = useRegisterOrConstant(ins->index());
     switch (ins->value()->type()) {
       case MIRType_Value:
       {
         LInstruction *lir = new(alloc()) LStoreElementV(elements, index);
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         if (!useBox(lir, LStoreElementV::Value, ins->value()))
             return false;
         return add(lir, ins);
       }
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
         LInstruction *lir = new(alloc()) LStoreElementT(elements, index, value);
         if (ins->fallible() && !assignSnapshot(lir))
             return false;
         return add(lir, ins);
       }
     }
 }
 bool
 LIRGenerator::visitStoreElementHole(MStoreElementHole *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     const LUse object = useRegister(ins->object());
     const LUse elements = useRegister(ins->elements());
     const LAllocation index = useRegisterOrConstant(ins->index());
     LInstruction *lir;
     switch (ins->value()->type()) {
       case MIRType_Value:
         lir = new(alloc()) LStoreElementHoleV(object, elements, index);
         if (!useBox(lir, LStoreElementHoleV::Value, ins->value()))
             return false;
         break;
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
         lir = new(alloc()) LStoreElementHoleT(object, elements, index, value);
         break;
       }
     }
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitEffectiveAddress(MEffectiveAddress *ins)
 {
     return define(new(alloc()) LEffectiveAddress(useRegister(ins->base()), useRegister(ins->index())), ins);
 }
 bool
 LIRGenerator::visitArrayPopShift(MArrayPopShift *ins)
 {
     LUse object = useRegister(ins->object());
     switch (ins->type()) {
       case MIRType_Value:
       {
         LArrayPopShiftV *lir = new(alloc()) LArrayPopShiftV(object, temp(), temp());
         return defineBox(lir, ins) && assignSafepoint(lir, ins);
       }
       case MIRType_Undefined:
       case MIRType_Null:
         MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
       default:
       {
         LArrayPopShiftT *lir = new(alloc()) LArrayPopShiftT(object, temp(), temp());
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
     }
 }
 bool
 LIRGenerator::visitArrayPush(MArrayPush *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Int32);
     LUse object = useRegister(ins->object());
     switch (ins->value()->type()) {
       case MIRType_Value:
       {
         LArrayPushV *lir = new(alloc()) LArrayPushV(object, temp());
         if (!useBox(lir, LArrayPushV::Value, ins->value()))
             return false;
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
       default:
       {
         const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
         LArrayPushT *lir = new(alloc()) LArrayPushT(object, value, temp());
         return define(lir, ins) && assignSafepoint(lir, ins);
       }
     }
 }
 bool
 LIRGenerator::visitArrayConcat(MArrayConcat *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->lhs()->type() == MIRType_Object);
     JS_ASSERT(ins->rhs()->type() == MIRType_Object);
     LArrayConcat *lir = new(alloc()) LArrayConcat(useFixed(ins->lhs(), CallTempReg1),
                                                   useFixed(ins->rhs(), CallTempReg2),
                                                   tempFixed(CallTempReg3),
                                                   tempFixed(CallTempReg4));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitStringSplit(MStringSplit *ins)
 {
     JS_ASSERT(ins->type() == MIRType_Object);
     JS_ASSERT(ins->string()->type() == MIRType_String);
     JS_ASSERT(ins->separator()->type() == MIRType_String);
     LStringSplit *lir = new(alloc()) LStringSplit(useRegisterAtStart(ins->string()),
                                                   useRegisterAtStart(ins->separator()));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLoadTypedArrayElement(MLoadTypedArrayElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     const LUse elements = useRegister(ins->elements());
     const LAllocation index = useRegisterOrConstant(ins->index());
     JS_ASSERT(IsNumberType(ins->type()));
     // We need a temp register for Uint32Array with known double result.
     LDefinition tempDef = LDefinition::BogusTemp();
     if (ins->arrayType() == ScalarTypeDescr::TYPE_UINT32 && IsFloatingPointType(ins->type()))
         tempDef = temp();
     LLoadTypedArrayElement *lir = new(alloc()) LLoadTypedArrayElement(elements, index, tempDef);
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
 {
     MDefinition *in = ins->input();
     switch (in->type()) {
       case MIRType_Boolean:
         return redefine(ins, in);
       case MIRType_Int32:
         return defineReuseInput(new(alloc()) LClampIToUint8(useRegisterAtStart(in)), ins, 0);
       case MIRType_Double:
         return define(new(alloc()) LClampDToUint8(useRegisterAtStart(in), tempCopy(in, 0)), ins);
       case MIRType_Value:
       {
         LClampVToUint8 *lir = new(alloc()) LClampVToUint8(tempDouble());
         if (!useBox(lir, LClampVToUint8::Input, in))
             return false;
         return assignSnapshot(lir) && define(lir, ins) && assignSafepoint(lir, ins);
       }
       default:
         MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 bool
 LIRGenerator::visitLoadTypedArrayElementHole(MLoadTypedArrayElementHole *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->type() == MIRType_Value);
     const LUse object = useRegister(ins->object());
     const LAllocation index = useRegisterOrConstant(ins->index());
     LLoadTypedArrayElementHole *lir = new(alloc()) LLoadTypedArrayElementHole(object, index);
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitLoadTypedArrayElementStatic(MLoadTypedArrayElementStatic *ins)
 {
     LLoadTypedArrayElementStatic *lir =
         new(alloc()) LLoadTypedArrayElementStatic(useRegisterAtStart(ins->ptr()));
     if (ins->fallible() && !assignSnapshot(lir))
         return false;
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitStoreTypedArrayElement(MStoreTypedArrayElement *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     if (ins->isFloatArray()) {
         DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
         JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT32,
                      ins->value()->type() == MIRType_Float32);
         JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT64,
                      ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
     }
     LUse elements = useRegister(ins->elements());
     LAllocation index = useRegisterOrConstant(ins->index());
     LAllocation value;
     // For byte arrays, the value has to be in a byte register on x86.
     if (ins->isByteArray())
         value = useByteOpRegisterOrNonDoubleConstant(ins->value());
     else
         value = useRegisterOrNonDoubleConstant(ins->value());
     return add(new(alloc()) LStoreTypedArrayElement(elements, index, value), ins);
 }
 bool
 LIRGenerator::visitStoreTypedArrayElementHole(MStoreTypedArrayElementHole *ins)
 {
     JS_ASSERT(ins->elements()->type() == MIRType_Elements);
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     JS_ASSERT(ins->length()->type() == MIRType_Int32);
     if (ins->isFloatArray()) {
         DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
         JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT32,
                      ins->value()->type() == MIRType_Float32);
         JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == ScalarTypeDescr::TYPE_FLOAT64,
                      ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
     }
     LUse elements = useRegister(ins->elements());
     LAllocation length = useAnyOrConstant(ins->length());
     LAllocation index = useRegisterOrConstant(ins->index());
     LAllocation value;
     // For byte arrays, the value has to be in a byte register on x86.
     if (ins->isByteArray())
         value = useByteOpRegisterOrNonDoubleConstant(ins->value());
     else
         value = useRegisterOrNonDoubleConstant(ins->value());
     return add(new(alloc()) LStoreTypedArrayElementHole(elements, length, index, value), ins);
 }
 bool
 LIRGenerator::visitLoadFixedSlot(MLoadFixedSlot *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
         LLoadFixedSlotV *lir = new(alloc()) LLoadFixedSlotV(useRegister(ins->object()));
         return defineBox(lir, ins);
     }
     LLoadFixedSlotT *lir = new(alloc()) LLoadFixedSlotT(useRegister(ins->object()));
     return define(lir, ins);
 }
 bool
 LIRGenerator::visitStoreFixedSlot(MStoreFixedSlot *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->value()->type() == MIRType_Value) {
         LStoreFixedSlotV *lir = new(alloc()) LStoreFixedSlotV(useRegister(ins->object()));
         if (!useBox(lir, LStoreFixedSlotV::Value, ins->value()))
             return false;
         return add(lir, ins);
     }
     LStoreFixedSlotT *lir = new(alloc()) LStoreFixedSlotT(useRegister(ins->object()),
                                                           useRegisterOrConstant(ins->value()));
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitGetNameCache(MGetNameCache *ins)
 {
     JS_ASSERT(ins->scopeObj()->type() == MIRType_Object);
     LGetNameCache *lir = new(alloc()) LGetNameCache(useRegister(ins->scopeObj()));
     if (!defineBox(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallGetIntrinsicValue(MCallGetIntrinsicValue *ins)
 {
     LCallGetIntrinsicValue *lir = new(alloc()) LCallGetIntrinsicValue();
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallsiteCloneCache(MCallsiteCloneCache *ins)
 {
     JS_ASSERT(ins->callee()->type() == MIRType_Object);
     LCallsiteCloneCache *lir = new(alloc()) LCallsiteCloneCache(useRegister(ins->callee()));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetPropertyCache(MGetPropertyCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
         LGetPropertyCacheV *lir = new(alloc()) LGetPropertyCacheV(useRegister(ins->object()));
         if (!defineBox(lir, ins))
             return false;
         return assignSafepoint(lir, ins);
     }
     LGetPropertyCacheT *lir = new(alloc()) LGetPropertyCacheT(useRegister(ins->object()),
                                                               tempForDispatchCache(ins->type()));
     if (!define(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetPropertyPolymorphic(MGetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
         LGetPropertyPolymorphicV *lir = new(alloc()) LGetPropertyPolymorphicV(useRegister(ins->obj()));
         return assignSnapshot(lir, Bailout_ShapeGuard) && defineBox(lir, ins);
     }
     LDefinition maybeTemp = (ins->type() == MIRType_Double) ? temp() : LDefinition::BogusTemp();
     LGetPropertyPolymorphicT *lir = new(alloc()) LGetPropertyPolymorphicT(useRegister(ins->obj()), maybeTemp);
     return assignSnapshot(lir, Bailout_ShapeGuard) && define(lir, ins);
 }
 bool
 LIRGenerator::visitSetPropertyPolymorphic(MSetPropertyPolymorphic *ins)
 {
     JS_ASSERT(ins->obj()->type() == MIRType_Object);
     if (ins->value()->type() == MIRType_Value) {
         LSetPropertyPolymorphicV *lir = new(alloc()) LSetPropertyPolymorphicV(useRegister(ins->obj()), temp());
         if (!useBox(lir, LSetPropertyPolymorphicV::Value, ins->value()))
             return false;
         return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
     }
     LAllocation value = useRegisterOrConstant(ins->value());
     LSetPropertyPolymorphicT *lir =
         new(alloc()) LSetPropertyPolymorphicT(useRegister(ins->obj()), value, ins->value()->type(), temp());
     return assignSnapshot(lir, Bailout_ShapeGuard) && add(lir, ins);
 }
 bool
 LIRGenerator::visitGetElementCache(MGetElementCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
         JS_ASSERT(ins->index()->type() == MIRType_Value);
         LGetElementCacheV *lir = new(alloc()) LGetElementCacheV(useRegister(ins->object()));
         if (!useBox(lir, LGetElementCacheV::Index, ins->index()))
             return false;
         return defineBox(lir, ins) && assignSafepoint(lir, ins);
     }
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
     LGetElementCacheT *lir = new(alloc()) LGetElementCacheT(useRegister(ins->object()),
                                                             useRegister(ins->index()),
                                                             tempForDispatchCache(ins->type()));
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitBindNameCache(MBindNameCache *ins)
 {
     JS_ASSERT(ins->scopeChain()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Object);
     LBindNameCache *lir = new(alloc()) LBindNameCache(useRegister(ins->scopeChain()));
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGuardObjectIdentity(MGuardObjectIdentity *ins)
 {
     LGuardObjectIdentity *guard = new(alloc()) LGuardObjectIdentity(useRegister(ins->obj()));
     return assignSnapshot(guard) && add(guard, ins) && redefine(ins, ins->obj());
 }
 bool
 LIRGenerator::visitGuardClass(MGuardClass *ins)
 {
     LDefinition t = temp();
     LGuardClass *guard = new(alloc()) LGuardClass(useRegister(ins->obj()), t);
     return assignSnapshot(guard) && add(guard, ins);
 }
 bool
 LIRGenerator::visitGuardObject(MGuardObject *ins)
 {
     // The type policy does all the work, so at this point the input
     // is guaranteed to be an object.
     JS_ASSERT(ins->input()->type() == MIRType_Object);
     return redefine(ins, ins->input());
 }
 bool
 LIRGenerator::visitGuardString(MGuardString *ins)
 {
     // The type policy does all the work, so at this point the input
     // is guaranteed to be a string.
     JS_ASSERT(ins->input()->type() == MIRType_String);
     return redefine(ins, ins->input());
 }
 bool
 LIRGenerator::visitAssertRange(MAssertRange *ins)
 {
     MDefinition *input = ins->input();
     LInstruction *lir = nullptr;
     switch (input->type()) {
       case MIRType_Boolean:
       case MIRType_Int32:
         lir = new(alloc()) LAssertRangeI(useRegisterAtStart(input));
         break;
       case MIRType_Double:
         lir = new(alloc()) LAssertRangeD(useRegister(input), tempDouble());
         break;
       case MIRType_Float32:
         lir = new(alloc()) LAssertRangeF(useRegister(input), tempFloat32());
         break;
       case MIRType_Value:
         lir = new(alloc()) LAssertRangeV(tempToUnbox(), tempDouble(), tempDouble());
         if (!useBox(lir, LAssertRangeV::Input, input))
             return false;
         break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unexpected Range for MIRType");
         break;
     }
     lir->setMir(ins);
     return add(lir);
 }
 bool
 LIRGenerator::visitCallGetProperty(MCallGetProperty *ins)
 {
     LCallGetProperty *lir = new(alloc()) LCallGetProperty();
     if (!useBoxAtStart(lir, LCallGetProperty::Value, ins->value()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallGetElement(MCallGetElement *ins)
 {
     JS_ASSERT(ins->lhs()->type() == MIRType_Value);
     JS_ASSERT(ins->rhs()->type() == MIRType_Value);
     LCallGetElement *lir = new(alloc()) LCallGetElement();
     if (!useBoxAtStart(lir, LCallGetElement::LhsInput, ins->lhs()))
         return false;
     if (!useBoxAtStart(lir, LCallGetElement::RhsInput, ins->rhs()))
         return false;
     if (!defineReturn(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallSetProperty(MCallSetProperty *ins)
 {
     LInstruction *lir = new(alloc()) LCallSetProperty(useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallSetProperty::Value, ins->value()))
         return false;
     if (!add(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitDeleteProperty(MDeleteProperty *ins)
 {
     LCallDeleteProperty *lir = new(alloc()) LCallDeleteProperty();
     if(!useBoxAtStart(lir, LCallDeleteProperty::Value, ins->value()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitDeleteElement(MDeleteElement *ins)
 {
     LCallDeleteElement *lir = new(alloc()) LCallDeleteElement();
     if(!useBoxAtStart(lir, LCallDeleteElement::Value, ins->value()))
         return false;
     if(!useBoxAtStart(lir, LCallDeleteElement::Index, ins->index()))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitSetPropertyCache(MSetPropertyCache *ins)
 {
     LUse obj = useRegisterAtStart(ins->object());
     LDefinition slots = tempCopy(ins->object(), 0);
     LDefinition dispatchTemp = tempForDispatchCache();
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetPropertyCacheV(obj, slots, dispatchTemp);
         if (!useBox(lir, LSetPropertyCacheV::Value, ins->value()))
             return false;
     } else {
         LAllocation value = useRegisterOrConstant(ins->value());
         lir = new(alloc()) LSetPropertyCacheT(obj, slots, value, dispatchTemp, ins->value()->type());
     }
     if (!add(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitSetElementCache(MSetElementCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->index()->type() == MIRType_Value);
     // Due to lack of registers on x86, we reuse the object register as a
     // temporary. This register may be used in a 1-byte store, which on x86
     // again has constraints; thus the use of |useByteOpRegister| over
     // |useRegister| below.
     LInstruction *lir;
     if (ins->value()->type() == MIRType_Value) {
         lir = new(alloc()) LSetElementCacheV(useByteOpRegister(ins->object()), tempToUnbox(),
                                              temp(), tempDouble());
         if (!useBox(lir, LSetElementCacheV::Index, ins->index()))
             return false;
         if (!useBox(lir, LSetElementCacheV::Value, ins->value()))
             return false;
     } else {
         lir = new(alloc()) LSetElementCacheT(useByteOpRegister(ins->object()),
                                              useRegisterOrConstant(ins->value()),
                                              tempToUnbox(), temp(), tempDouble());
         if (!useBox(lir, LSetElementCacheT::Index, ins->index()))
             return false;
     }
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallSetElement(MCallSetElement *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->index()->type() == MIRType_Value);
     JS_ASSERT(ins->value()->type() == MIRType_Value);
     LCallSetElement *lir = new(alloc()) LCallSetElement();
     lir->setOperand(0, useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallSetElement::Index, ins->index()))
         return false;
     if (!useBoxAtStart(lir, LCallSetElement::Value, ins->value()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallInitElementArray(MCallInitElementArray *ins)
 {
     LCallInitElementArray *lir = new(alloc()) LCallInitElementArray();
     lir->setOperand(0, useRegisterAtStart(ins->object()));
     if (!useBoxAtStart(lir, LCallInitElementArray::Value, ins->value()))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIteratorStart(MIteratorStart *ins)
 {
     // Call a stub if this is not a simple for-in loop.
     if (ins->flags() != JSITER_ENUMERATE) {
         LCallIteratorStart *lir = new(alloc()) LCallIteratorStart(useRegisterAtStart(ins->object()));
         return defineReturn(lir, ins) && assignSafepoint(lir, ins);
     }
     LIteratorStart *lir = new(alloc()) LIteratorStart(useRegister(ins->object()), temp(), temp(), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIteratorNext(MIteratorNext *ins)
 {
     LIteratorNext *lir = new(alloc()) LIteratorNext(useRegister(ins->iterator()), temp());
     return defineBox(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIteratorMore(MIteratorMore *ins)
 {
     LIteratorMore *lir = new(alloc()) LIteratorMore(useRegister(ins->iterator()), temp());
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIteratorEnd(MIteratorEnd *ins)
 {
     LIteratorEnd *lir = new(alloc()) LIteratorEnd(useRegister(ins->iterator()), temp(), temp(), temp());
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitStringLength(MStringLength *ins)
 {
     JS_ASSERT(ins->string()->type() == MIRType_String);
     return define(new(alloc()) LStringLength(useRegisterAtStart(ins->string())), ins);
 }
 bool
 LIRGenerator::visitArgumentsLength(MArgumentsLength *ins)
 {
     return define(new(alloc()) LArgumentsLength(), ins);
 }
 bool
 LIRGenerator::visitGetFrameArgument(MGetFrameArgument *ins)
 {
     LGetFrameArgument *lir = new(alloc()) LGetFrameArgument(useRegisterOrConstant(ins->index()));
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitSetFrameArgument(MSetFrameArgument *ins)
 {
     MDefinition *input = ins->input();
     if (input->type() == MIRType_Value) {
         LSetFrameArgumentV *lir = new(alloc()) LSetFrameArgumentV();
         if (!useBox(lir, LSetFrameArgumentV::Input, input))
             return false;
         return add(lir, ins);
     }
     if (input->type() == MIRType_Undefined || input->type() == MIRType_Null) {
         Value val = input->type() == MIRType_Undefined ? UndefinedValue() : NullValue();
         LSetFrameArgumentC *lir = new(alloc()) LSetFrameArgumentC(val);
         return add(lir, ins);
     }
     LSetFrameArgumentT *lir = new(alloc()) LSetFrameArgumentT(useRegister(input));
     return add(lir, ins);
 }
 bool
 LIRGenerator::visitRunOncePrologue(MRunOncePrologue *ins)
 {
     LRunOncePrologue *lir = new(alloc()) LRunOncePrologue;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitRest(MRest *ins)
 {
     JS_ASSERT(ins->numActuals()->type() == MIRType_Int32);
     LRest *lir = new(alloc()) LRest(useFixed(ins->numActuals(), CallTempReg0),
                                     tempFixed(CallTempReg1),
                                     tempFixed(CallTempReg2),
                                     tempFixed(CallTempReg3));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitRestPar(MRestPar *ins)
 {
     JS_ASSERT(ins->numActuals()->type() == MIRType_Int32);
     LRestPar *lir = new(alloc()) LRestPar(useFixed(ins->forkJoinContext(), CallTempReg0),
                                           useFixed(ins->numActuals(), CallTempReg1),
                                           tempFixed(CallTempReg2),
                                           tempFixed(CallTempReg3),
                                           tempFixed(CallTempReg4));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitThrow(MThrow *ins)
 {
     MDefinition *value = ins->getOperand(0);
     JS_ASSERT(value->type() == MIRType_Value);
     LThrow *lir = new(alloc()) LThrow;
     if (!useBoxAtStart(lir, LThrow::Value, value))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIn(MIn *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Object);
     LIn *lir = new(alloc()) LIn(useRegisterAtStart(rhs));
     if (!useBoxAtStart(lir, LIn::LHS, lhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitInstanceOf(MInstanceOf *ins)
 {
     MDefinition *lhs = ins->getOperand(0);
     JS_ASSERT(lhs->type() == MIRType_Value || lhs->type() == MIRType_Object);
     if (lhs->type() == MIRType_Object) {
         LInstanceOfO *lir = new(alloc()) LInstanceOfO(useRegister(lhs));
         return define(lir, ins) && assignSafepoint(lir, ins);
     }
     LInstanceOfV *lir = new(alloc()) LInstanceOfV();
     return useBox(lir, LInstanceOfV::LHS, lhs) && define(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitCallInstanceOf(MCallInstanceOf *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == MIRType_Value);
     JS_ASSERT(rhs->type() == MIRType_Object);
     LCallInstanceOf *lir = new(alloc()) LCallInstanceOf(useRegisterAtStart(rhs));
     if (!useBoxAtStart(lir, LCallInstanceOf::LHS, lhs))
         return false;
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitProfilerStackOp(MProfilerStackOp *ins)
 {
     LProfilerStackOp *lir = new(alloc()) LProfilerStackOp(temp());
     if (!add(lir, ins))
         return false;
     // If slow assertions are enabled, then this node will result in a callVM
     // out to a C++ function for the assertions, so we will need a safepoint.
     return !gen->options.spsSlowAssertionsEnabled() || assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitIsCallable(MIsCallable *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Boolean);
     return define(new(alloc()) LIsCallable(useRegister(ins->object())), ins);
 }
 bool
 LIRGenerator::visitHaveSameClass(MHaveSameClass *ins)
 {
     MDefinition *lhs = ins->lhs();
     MDefinition *rhs = ins->rhs();
     JS_ASSERT(lhs->type() == MIRType_Object);
     JS_ASSERT(rhs->type() == MIRType_Object);
     return define(new(alloc()) LHaveSameClass(useRegister(lhs), useRegister(rhs), temp()), ins);
 }
 bool
 LIRGenerator::visitHasClass(MHasClass *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     JS_ASSERT(ins->type() == MIRType_Boolean);
     return define(new(alloc()) LHasClass(useRegister(ins->object())), ins);
 }
 bool
 LIRGenerator::visitAsmJSLoadGlobalVar(MAsmJSLoadGlobalVar *ins)
 {
     return define(new(alloc()) LAsmJSLoadGlobalVar, ins);
 }
 bool
 LIRGenerator::visitAsmJSStoreGlobalVar(MAsmJSStoreGlobalVar *ins)
 {
     return add(new(alloc()) LAsmJSStoreGlobalVar(useRegisterAtStart(ins->value())), ins);
 }
 bool
 LIRGenerator::visitAsmJSLoadFFIFunc(MAsmJSLoadFFIFunc *ins)
 {
     return define(new(alloc()) LAsmJSLoadFFIFunc, ins);
 }
 bool
 LIRGenerator::visitAsmJSParameter(MAsmJSParameter *ins)
 {
     ABIArg abi = ins->abi();
     if (abi.argInRegister())
         return defineFixed(new(alloc()) LAsmJSParameter, ins, LAllocation(abi.reg()));
     JS_ASSERT(IsNumberType(ins->type()));
     return defineFixed(new(alloc()) LAsmJSParameter, ins, LArgument(abi.offsetFromArgBase()));
 }
 bool
 LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
 {
     MDefinition *rval = ins->getOperand(0);
     LAsmJSReturn *lir = new(alloc()) LAsmJSReturn;
     if (IsFloatingPointType(rval->type()))
         lir->setOperand(0, useFixed(rval, ReturnFloatReg));
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
     else
         MOZ_ASSUME_UNREACHABLE("Unexpected asm.js return type");
     return add(lir);
 }
 bool
 LIRGenerator::visitAsmJSVoidReturn(MAsmJSVoidReturn *ins)
 {
     return add(new(alloc()) LAsmJSVoidReturn);
 }
 bool
 LIRGenerator::visitAsmJSPassStackArg(MAsmJSPassStackArg *ins)
 {
     if (IsFloatingPointType(ins->arg()->type())) {
         JS_ASSERT(!ins->arg()->isEmittedAtUses());
         return add(new(alloc()) LAsmJSPassStackArg(useRegisterAtStart(ins->arg())), ins);
     }
     return add(new(alloc()) LAsmJSPassStackArg(useRegisterOrConstantAtStart(ins->arg())), ins);
 }
 bool
 LIRGenerator::visitAsmJSCall(MAsmJSCall *ins)
 {
     gen->setPerformsAsmJSCall();
     LAllocation *args = gen->allocate<LAllocation>(ins->numOperands());
     if (!args)
         return false;
     for (unsigned i = 0; i < ins->numArgs(); i++)
         args[i] = useFixed(ins->getOperand(i), ins->registerForArg(i));
     if (ins->callee().which() == MAsmJSCall::Callee::Dynamic)
         args[ins->dynamicCalleeOperandIndex()] = useFixed(ins->callee().dynamic(), CallTempReg0);
     LInstruction *lir = new(alloc()) LAsmJSCall(args, ins->numOperands());
     if (ins->type() == MIRType_None) {
         return add(lir, ins);
     }
     return defineReturn(lir, ins);
 }
 bool
 LIRGenerator::visitSetDOMProperty(MSetDOMProperty *ins)
 {
     MDefinition *val = ins->value();
     Register cxReg, objReg, privReg, valueReg;
     GetTempRegForIntArg(0, 0, &cxReg);
     GetTempRegForIntArg(1, 0, &objReg);
     GetTempRegForIntArg(2, 0, &privReg);
     GetTempRegForIntArg(3, 0, &valueReg);
     LSetDOMProperty *lir = new(alloc()) LSetDOMProperty(tempFixed(cxReg),
                                                         useFixed(ins->object(), objReg),
                                                         tempFixed(privReg),
                                                         tempFixed(valueReg));
     // Keep using GetTempRegForIntArg, since we want to make sure we
     // don't clobber registers we're already using.
     Register tempReg1, tempReg2;
     GetTempRegForIntArg(4, 0, &tempReg1);
     mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(5, 0, &tempReg2);
     MOZ_ASSERT(ok, "How can we not have six temp registers?");
     if (!useBoxFixed(lir, LSetDOMProperty::Value, val, tempReg1, tempReg2))
         return false;
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetDOMProperty(MGetDOMProperty *ins)
 {
     Register cxReg, objReg, privReg, valueReg;
     GetTempRegForIntArg(0, 0, &cxReg);
     GetTempRegForIntArg(1, 0, &objReg);
     GetTempRegForIntArg(2, 0, &privReg);
     mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &valueReg);
     MOZ_ASSERT(ok, "How can we not have four temp registers?");
     LGetDOMProperty *lir = new(alloc()) LGetDOMProperty(tempFixed(cxReg),
                                                         useFixed(ins->object(), objReg),
                                                         tempFixed(privReg),
                                                         tempFixed(valueReg));
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 bool
 LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
 {
     MOZ_ASSERT(ins->isDomMovable(), "Members had better be movable");
     // We wish we could assert that ins->domAliasSet() == JSJitInfo::AliasNone,
     // but some MGetDOMMembers are for [Pure], not [Constant] properties, whose
     // value can in fact change as a result of DOM setters and method calls.
     MOZ_ASSERT(ins->domAliasSet() != JSJitInfo::AliasEverything,
                "Member gets had better not alias the world");
     LGetDOMMember *lir =
         new(alloc()) LGetDOMMember(useRegister(ins->object()));
     return defineBox(lir, ins);
 }
 bool
 LIRGenerator::visitRecompileCheck(MRecompileCheck *ins)
 {
     LRecompileCheck *lir = new(alloc()) LRecompileCheck(temp());
     if (!add(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 static void
 SpewResumePoint(MBasicBlock *block, MInstruction *ins, MResumePoint *resumePoint)
 {
     fprintf(IonSpewFile, "Current resume point %p details:\n", (void *)resumePoint);
     fprintf(IonSpewFile, "    frame count: %u\n", resumePoint->frameCount());
     if (ins) {
         fprintf(IonSpewFile, "    taken after: ");
         ins->printName(IonSpewFile);
     } else {
         fprintf(IonSpewFile, "    taken at block %d entry", block->id());
     }
     fprintf(IonSpewFile, "\n");
     fprintf(IonSpewFile, "    pc: %p (script: %p, offset: %d)\n",
             (void *)resumePoint->pc(),
             (void *)resumePoint->block()->info().script(),
             int(resumePoint->block()->info().script()->pcToOffset(resumePoint->pc())));
     for (size_t i = 0, e = resumePoint->numOperands(); i < e; i++) {
         MDefinition *in = resumePoint->getOperand(i);
         fprintf(IonSpewFile, "    slot%u: ", (unsigned)i);
         in->printName(IonSpewFile);
         fprintf(IonSpewFile, "\n");
     }
 }
 bool
 LIRGenerator::visitInstruction(MInstruction *ins)
 {
     if (!gen->ensureBallast())
         return false;
     if (!ins->accept(this))
         return false;
     if (ins->possiblyCalls())
         gen->setPerformsCall();
     if (ins->resumePoint())
         updateResumeState(ins);
     if (gen->errored())
         return false;
 #ifdef DEBUG
     ins->setInWorklistUnchecked();
 #endif
     // If no safepoint was created, there's no need for an OSI point.
     if (LOsiPoint *osiPoint = popOsiPoint()) {
         if (!add(osiPoint))
             return false;
     }
     return true;
 }
 bool
 LIRGenerator::definePhis()
 {
     size_t lirIndex = 0;
     MBasicBlock *block = current->mir();
     for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd(); phi++) {
         if (phi->type() == MIRType_Value) {
             if (!defineUntypedPhi(*phi, lirIndex))
                 return false;
             lirIndex += BOX_PIECES;
         } else {
             if (!defineTypedPhi(*phi, lirIndex))
                 return false;
             lirIndex += 1;
         }
     }
     return true;
 }
 void
 LIRGenerator::updateResumeState(MInstruction *ins)
 {
     lastResumePoint_ = ins->resumePoint();
     if (IonSpewEnabled(IonSpew_Snapshots) && lastResumePoint_)
         SpewResumePoint(nullptr, ins, lastResumePoint_);
 }
 void
 LIRGenerator::updateResumeState(MBasicBlock *block)
 {
     lastResumePoint_ = block->entryResumePoint();
     if (IonSpewEnabled(IonSpew_Snapshots) && lastResumePoint_)
         SpewResumePoint(block, nullptr, lastResumePoint_);
 }
 bool
 LIRGenerator::visitBlock(MBasicBlock *block)
 {
     current = block->lir();
     updateResumeState(block);
     if (!definePhis())
         return false;
     if (gen->optimizationInfo().registerAllocator() == RegisterAllocator_LSRA) {
         if (!add(new(alloc()) LLabel()))
             return false;
     }
     for (MInstructionIterator iter = block->begin(); *iter != block->lastIns(); iter++) {
         if (!visitInstruction(*iter))
             return false;
     }
     if (block->successorWithPhis()) {
         // If we have a successor with phis, lower the phi input now that we
         // are approaching the join point.
         MBasicBlock *successor = block->successorWithPhis();
         uint32_t position = block->positionInPhiSuccessor();
         size_t lirIndex = 0;
         for (MPhiIterator phi(successor->phisBegin()); phi != successor->phisEnd(); phi++) {
             MDefinition *opd = phi->getOperand(position);
             if (!ensureDefined(opd))
                 return false;
             JS_ASSERT(opd->type() == phi->type());
             if (phi->type() == MIRType_Value) {
                 lowerUntypedPhiInput(*phi, position, successor->lir(), lirIndex);
                 lirIndex += BOX_PIECES;
             } else {
                 lowerTypedPhiInput(*phi, position, successor->lir(), lirIndex);
                 lirIndex += 1;
             }
         }
     }
     // Now emit the last instruction, which is some form of branch.
     if (!visitInstruction(block->lastIns()))
         return false;
     return true;
 }
 bool
 LIRGenerator::precreatePhi(LBlock *block, MPhi *phi)
 {
     LPhi *lir = LPhi::New(gen, phi);
     if (!lir)
         return false;
     if (!block->addPhi(lir))
         return false;
     return true;
 }
 bool
 LIRGenerator::generate()
 {
     // Create all blocks and prep all phis beforehand.
     for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
         if (gen->shouldCancel("Lowering (preparation loop)"))
             return false;
         current = LBlock::New(alloc(), *block);
         if (!current)
             return false;
         if (!lirGraph_.addBlock(current))
             return false;
         block->assignLir(current);
         // For each MIR phi, add LIR phis as appropriate. We'll fill in their
         // operands on each incoming edge, and set their definitions at the
         // start of their defining block.
         for (MPhiIterator phi(block->phisBegin()); phi != block->phisEnd(); phi++) {
             int numPhis = (phi->type() == MIRType_Value) ? BOX_PIECES : 1;
             for (int i = 0; i < numPhis; i++) {
                 if (!precreatePhi(block->lir(), *phi))
                     return false;
             }
         }
     }
     for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
         if (gen->shouldCancel("Lowering (main loop)"))
             return false;
         if (!visitBlock(*block))
             return false;
     }
     if (graph.osrBlock())
         lirGraph_.setOsrBlock(graph.osrBlock()->lir());
     lirGraph_.setArgumentSlotCount(maxargslots_);
     return true;
 }

The Tor Browser / annotate

js/src/jit/Lowering.cpp@6474c204b198 (annotated)

js/src/jit/Lowering.cpp