The Tor Browser: comparison js/src/jit/MIR.h

--1:000000000000
+:af7b583c8f96
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+* vim: set ts=8 sts=4 et sw=4 tw=99:
+* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this
+* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+* Everything needed to build actual MIR instructions: the actual opcodes and
+* instructions, the instruction interface, and use chains.
+*/
+#ifndef jit_MIR_h
+#define jit_MIR_h
+#include "mozilla/Array.h"
+#include "jsinfer.h"
+#include "jit/CompilerRoot.h"
+#include "jit/FixedList.h"
+#include "jit/InlineList.h"
+#include "jit/IonAllocPolicy.h"
+#include "jit/IonMacroAssembler.h"
+#include "jit/MOpcodes.h"
+#include "jit/TypeDescrSet.h"
+#include "jit/TypePolicy.h"
+#include "vm/ScopeObject.h"
+#include "vm/TypedArrayObject.h"
+namespace js {
+class StringObject;
+namespace jit {
+class BaselineInspector;
+class ValueNumberData;
+class Range;
+static const inline
+MIRType MIRTypeFromValue(const js::Value &vp)
+{
+if (vp.isDouble())
+return MIRType_Double;
+if (vp.isMagic()) {
+switch (vp.whyMagic()) {
+case JS_OPTIMIZED_ARGUMENTS:
+return MIRType_MagicOptimizedArguments;
+case JS_OPTIMIZED_OUT:
+return MIRType_MagicOptimizedOut;
+case JS_ELEMENTS_HOLE:
+return MIRType_MagicHole;
+case JS_IS_CONSTRUCTING:
+return MIRType_MagicIsConstructing;
+default:
+MOZ_ASSERT(!"Unexpected magic constant");
+}
+}
+return MIRTypeFromValueType(vp.extractNonDoubleType());
+}
+#define MIR_FLAG_LIST(_)                                                        \
+_(InWorklist)                                                               \
+_(EmittedAtUses)                                                            \
+_(LoopInvariant)                                                            \
+_(Commutative)                                                              \
+_(Movable)       /* Allow LICM and GVN to move this instruction */          \
+_(Lowered)       /* (Debug only) has a virtual register */                  \
+_(Guard)         /* Not removable if uses == 0 */                           \
+\
+/* Keep the flagged instruction in resume points and do not substitute this
+* instruction by an UndefinedValue. This might be used by call inlining
+* when a function argument is not used by the inlined instructions.
+*/                                                                         \
+_(ImplicitlyUsed)                                                           \
+\
+/* The instruction has been marked dead for lazy removal from resume
+* points.
+*/                                                                         \
+_(Unused)                                                                   \
+/* Marks if an instruction has fewer uses than the original code.
+* E.g. UCE can remove code.
+* Every instruction where an use is/was removed from an instruction and
+* as a result the number of operands doesn't equal the original code
+* need to get marked as UseRemoved. This is important for truncation
+* analysis to know, since if all original uses are still present,
+* it can ignore resumepoints.
+* Currently this is done for every pass after IonBuilder and before
+* Truncate Doubles. So every time removeUse is called, UseRemoved needs
+* to get set.
+*/                                                                         \
+_(UseRemoved)
+class MDefinition;
+class MInstruction;
+class MBasicBlock;
+class MNode;
+class MUse;
+class MIRGraph;
+class MResumePoint;
+// Represents a use of a node.
+class MUse : public TempObject, public InlineListNode<MUse>
+{
+friend class MDefinition;
+MDefinition *producer_; // MDefinition that is being used.
+MNode *consumer_;       // The node that is using this operand.
+uint32_t index_;        // The index of this operand in its consumer.
+MUse(MDefinition *producer, MNode *consumer, uint32_t index)
+: producer_(producer),
+consumer_(consumer),
+index_(index)
+{ }
+public:
+// Default constructor for use in vectors.
+MUse()
+: producer_(nullptr), consumer_(nullptr), index_(0)
+{ }
+// Set data inside the MUse.
+void set(MDefinition *producer, MNode *consumer, uint32_t index) {
+producer_ = producer;
+consumer_ = consumer;
+index_ = index;
+}
+MDefinition *producer() const {
+JS_ASSERT(producer_ != nullptr);
+return producer_;
+}
+bool hasProducer() const {
+return producer_ != nullptr;
+}
+MNode *consumer() const {
+JS_ASSERT(consumer_ != nullptr);
+return consumer_;
+}
+uint32_t index() const {
+return index_;
+}
+};
+typedef InlineList<MUse>::iterator MUseIterator;
+// A node is an entry in the MIR graph. It has two kinds:
+//   MInstruction: an instruction which appears in the IR stream.
+//   MResumePoint: a list of instructions that correspond to the state of the
+//                 interpreter/Baseline stack.
+//
+// Nodes can hold references to MDefinitions. Each MDefinition has a list of
+// nodes holding such a reference (its use chain).
+class MNode : public TempObject
+{
+friend class MDefinition;
+protected:
+MBasicBlock *block_;    // Containing basic block.
+public:
+enum Kind {
+Definition,
+ResumePoint
+};
+MNode()
+: block_(nullptr)
+{ }
+MNode(MBasicBlock *block)
+: block_(block)
+{ }
+virtual Kind kind() const = 0;
+// Returns the definition at a given operand.
+virtual MDefinition *getOperand(size_t index) const = 0;
+virtual size_t numOperands() const = 0;
+bool isDefinition() const {
+return kind() == Definition;
+}
+bool isResumePoint() const {
+return kind() == ResumePoint;
+}
+MBasicBlock *block() const {
+return block_;
+}
+// Instructions needing to hook into type analysis should return a
+// TypePolicy.
+virtual TypePolicy *typePolicy() {
+return nullptr;
+}
+// Replaces an already-set operand during iteration over a use chain.
+MUseIterator replaceOperand(MUseIterator use, MDefinition *ins);
+// Replaces an already-set operand, updating use information.
+void replaceOperand(size_t index, MDefinition *ins);
+// Resets the operand to an uninitialized state, breaking the link
+// with the previous operand's producer.
+void discardOperand(size_t index);
+inline MDefinition *toDefinition();
+inline MResumePoint *toResumePoint();
+protected:
+// Sets an unset operand, updating use information.
+virtual void setOperand(size_t index, MDefinition *operand) = 0;
+// Gets the MUse corresponding to given operand.
+virtual MUse *getUseFor(size_t index) = 0;
+};
+class AliasSet {
+private:
+uint32_t flags_;
+public:
+enum Flag {
+None_             = 0,
+ObjectFields      = 1 << 0, // shape, class, slots, length etc.
+Element           = 1 << 1, // A member of obj->elements.
+DynamicSlot       = 1 << 2, // A member of obj->slots.
+FixedSlot         = 1 << 3, // A member of obj->fixedSlots().
+TypedArrayElement = 1 << 4, // A typed array element.
+DOMProperty       = 1 << 5, // A DOM property
+FrameArgument     = 1 << 6, // An argument kept on the stack frame
+AsmJSGlobalVar    = 1 << 7, // An asm.js global var
+AsmJSHeap         = 1 << 8, // An asm.js heap load
+TypedArrayLength  = 1 << 9,// A typed array's length
+Last              = TypedArrayLength,
+Any               = Last | (Last - 1),
+NumCategories     = 10,
+// Indicates load or store.
+Store_            = 1 << 31
+};
+static_assert((1 << NumCategories) - 1 == Any,
+"NumCategories must include all flags present in Any");
+AliasSet(uint32_t flags)
+: flags_(flags)
+{
+}
+public:
+inline bool isNone() const {
+return flags_ == None_;
+}
+uint32_t flags() const {
+return flags_ & Any;
+}
+inline bool isStore() const {
+return !!(flags_ & Store_);
+}
+inline bool isLoad() const {
+return !isStore() && !isNone();
+}
+inline AliasSet operator |(const AliasSet &other) const {
+return AliasSet(flags_ | other.flags_);
+}
+inline AliasSet operator &(const AliasSet &other) const {
+return AliasSet(flags_ & other.flags_);
+}
+static AliasSet None() {
+return AliasSet(None_);
+}
+static AliasSet Load(uint32_t flags) {
+JS_ASSERT(flags && !(flags & Store_));
+return AliasSet(flags);
+}
+static AliasSet Store(uint32_t flags) {
+JS_ASSERT(flags && !(flags & Store_));
+return AliasSet(flags | Store_);
+}
+};
+// An MDefinition is an SSA name.
+class MDefinition : public MNode
+{
+friend class MBasicBlock;
+public:
+enum Opcode {
+#   define DEFINE_OPCODES(op) Op_##op,
+MIR_OPCODE_LIST(DEFINE_OPCODES)
+#   undef DEFINE_OPCODES
+Op_Invalid
+};
+private:
+InlineList<MUse> uses_;        // Use chain.
+uint32_t id_;                  // Instruction ID, which after block re-ordering
+// is sorted within a basic block.
+ValueNumberData *valueNumber_; // The instruction's value number (see GVN for details in use)
+Range *range_;                 // Any computed range for this def.
+MIRType resultType_;           // Representation of result type.
+types::TemporaryTypeSet *resultTypeSet_; // Optional refinement of the result type.
+uint32_t flags_;                 // Bit flags.
+union {
+MDefinition *dependency_;  // Implicit dependency (store, call, etc.) of this instruction.
+// Used by alias analysis, GVN and LICM.
+uint32_t virtualRegister_;   // Used by lowering to map definitions to virtual registers.
+};
+// Track bailouts by storing the current pc in MIR instruction. Also used
+// for profiling and keeping track of what the last known pc was.
+jsbytecode *trackedPc_;
+private:
+enum Flag {
+None = 0,
+#   define DEFINE_FLAG(flag) flag,
+MIR_FLAG_LIST(DEFINE_FLAG)
+#   undef DEFINE_FLAG
+Total
+};
+bool hasFlags(uint32_t flags) const {
+return (flags_ & flags) == flags;
+}
+void removeFlags(uint32_t flags) {
+flags_ &= ~flags;
+}
+void setFlags(uint32_t flags) {
+flags_ |= flags;
+}
+protected:
+virtual void setBlock(MBasicBlock *block) {
+block_ = block;
+}
+public:
+MDefinition()
+: id_(0),
+valueNumber_(nullptr),
+range_(nullptr),
+resultType_(MIRType_None),
+resultTypeSet_(nullptr),
+flags_(0),
+dependency_(nullptr),
+trackedPc_(nullptr)
+{ }
+virtual Opcode op() const = 0;
+virtual const char *opName() const = 0;
+void printName(FILE *fp) const;
+static void PrintOpcodeName(FILE *fp, Opcode op);
+virtual void printOpcode(FILE *fp) const;
+void dump(FILE *fp) const;
+void dump() const;
+// For LICM.
+virtual bool neverHoist() const { return false; }
+// Also for LICM. Test whether this definition is likely to be a call, which
+// would clobber all or many of the floating-point registers, such that
+// hoisting floating-point constants out of containing loops isn't likely to
+// be worthwhile.
+virtual bool possiblyCalls() const { return false; }
+void setTrackedPc(jsbytecode *pc) {
+trackedPc_ = pc;
+}
+jsbytecode *trackedPc() {
+return trackedPc_;
+}
+// Return the range of this value, *before* any bailout checks. Contrast
+// this with the type() method, and the Range constructor which takes an
+// MDefinition*, which describe the value *after* any bailout checks.
+//
+// Warning: Range analysis is removing the bit-operations such as '| 0' at
+// the end of the transformations. Using this function to analyse any
+// operands after the truncate phase of the range analysis will lead to
+// errors. Instead, one should define the collectRangeInfoPreTrunc() to set
+// the right set of flags which are dependent on the range of the inputs.
+Range *range() const {
+JS_ASSERT(type() != MIRType_None);
+return range_;
+}
+void setRange(Range *range) {
+JS_ASSERT(type() != MIRType_None);
+range_ = range;
+}
+virtual HashNumber valueHash() const;
+virtual bool congruentTo(const MDefinition *ins) const {
+return false;
+}
+bool congruentIfOperandsEqual(const MDefinition *ins) const;
+virtual MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+virtual void analyzeEdgeCasesForward();
+virtual void analyzeEdgeCasesBackward();
+virtual bool truncate();
+virtual bool isOperandTruncated(size_t index) const;
+// Compute an absolute or symbolic range for the value of this node.
+virtual void computeRange(TempAllocator &alloc) {
+}
+// Collect information from the pre-truncated ranges.
+virtual void collectRangeInfoPreTrunc() {
+}
+MNode::Kind kind() const {
+return MNode::Definition;
+}
+uint32_t id() const {
+JS_ASSERT(block_);
+return id_;
+}
+void setId(uint32_t id) {
+id_ = id;
+}
+uint32_t valueNumber() const;
+void setValueNumber(uint32_t vn);
+ValueNumberData *valueNumberData() {
+return valueNumber_;
+}
+void clearValueNumberData() {
+valueNumber_ = nullptr;
+}
+void setValueNumberData(ValueNumberData *vn) {
+JS_ASSERT(valueNumber_ == nullptr);
+valueNumber_ = vn;
+}
+#define FLAG_ACCESSOR(flag) \
+bool is##flag() const {\
+return hasFlags(1 << flag);\
+}\
+void set##flag() {\
+JS_ASSERT(!hasFlags(1 << flag));\
+setFlags(1 << flag);\
+}\
+void setNot##flag() {\
+JS_ASSERT(hasFlags(1 << flag));\
+removeFlags(1 << flag);\
+}\
+void set##flag##Unchecked() {\
+setFlags(1 << flag);\
+}
+MIR_FLAG_LIST(FLAG_ACCESSOR)
+#undef FLAG_ACCESSOR
+// Return the type of this value. This may be speculative, and enforced
+// dynamically with the use of bailout checks. If all the bailout checks
+// pass, the value will have this type.
+//
+// Unless this is an MUrsh that has bailouts disabled, which, as a special
+// case, may return a value in (INT32_MAX,UINT32_MAX] even when its type()
+// is MIRType_Int32.
+MIRType type() const {
+return resultType_;
+}
+types::TemporaryTypeSet *resultTypeSet() const {
+return resultTypeSet_;
+}
+bool emptyResultTypeSet() const;
+bool mightBeType(MIRType type) const {
+MOZ_ASSERT(type != MIRType_Value);
+if (type == this->type())
+return true;
+if (MIRType_Value != this->type())
+return false;
+return !resultTypeSet() || resultTypeSet()->mightBeMIRType(type);
+}
+// Float32 specialization operations (see big comment in IonAnalysis before the Float32
+// specialization algorithm).
+virtual bool isFloat32Commutative() const { return false; }
+virtual bool canProduceFloat32() const { return false; }
+virtual bool canConsumeFloat32(MUse *use) const { return false; }
+virtual void trySpecializeFloat32(TempAllocator &alloc) {}
+#ifdef DEBUG
+// Used during the pass that checks that Float32 flow into valid MDefinitions
+virtual bool isConsistentFloat32Use(MUse *use) const {
+return type() == MIRType_Float32 || canConsumeFloat32(use);
+}
+#endif
+// Returns the beginning of this definition's use chain.
+MUseIterator usesBegin() const {
+return uses_.begin();
+}
+// Returns the end of this definition's use chain.
+MUseIterator usesEnd() const {
+return uses_.end();
+}
+bool canEmitAtUses() const {
+return !isEmittedAtUses();
+}
+// Removes a use at the given position
+MUseIterator removeUse(MUseIterator use);
+void removeUse(MUse *use) {
+uses_.remove(use);
+}
+// Number of uses of this instruction.
+size_t useCount() const;
+// Number of uses of this instruction.
+// (only counting MDefinitions, ignoring MResumePoints)
+size_t defUseCount() const;
+// Test whether this MDefinition has exactly one use.
+bool hasOneUse() const;
+// Test whether this MDefinition has exactly one use.
+// (only counting MDefinitions, ignoring MResumePoints)
+bool hasOneDefUse() const;
+// Test whether this MDefinition has at least one use.
+// (only counting MDefinitions, ignoring MResumePoints)
+bool hasDefUses() const;
+bool hasUses() const {
+return !uses_.empty();
+}
+virtual bool isControlInstruction() const {
+return false;
+}
+void addUse(MUse *use) {
+uses_.pushFront(use);
+}
+void replaceAllUsesWith(MDefinition *dom);
+// Mark this instruction as having replaced all uses of ins, as during GVN,
+// returning false if the replacement should not be performed. For use when
+// GVN eliminates instructions which are not equivalent to one another.
+virtual bool updateForReplacement(MDefinition *ins) {
+return true;
+}
+void setVirtualRegister(uint32_t vreg) {
+virtualRegister_ = vreg;
+#ifdef DEBUG
+setLoweredUnchecked();
+#endif
+}
+uint32_t virtualRegister() const {
+JS_ASSERT(isLowered());
+return virtualRegister_;
+}
+public:
+// Opcode testing and casts.
+#   define OPCODE_CASTS(opcode)                                             \
+bool is##opcode() const {                                               \
+return op() == Op_##opcode;                                         \
+}                                                                       \
+inline M##opcode *to##opcode();                                         \
+inline const M##opcode *to##opcode() const;
+MIR_OPCODE_LIST(OPCODE_CASTS)
+#   undef OPCODE_CASTS
+inline MInstruction *toInstruction();
+bool isInstruction() const {
+return !isPhi();
+}
+void setResultType(MIRType type) {
+resultType_ = type;
+}
+void setResultTypeSet(types::TemporaryTypeSet *types) {
+resultTypeSet_ = types;
+}
+MDefinition *dependency() const {
+return dependency_;
+}
+void setDependency(MDefinition *dependency) {
+dependency_ = dependency;
+}
+virtual AliasSet getAliasSet() const {
+// Instructions are effectful by default.
+return AliasSet::Store(AliasSet::Any);
+}
+bool isEffectful() const {
+return getAliasSet().isStore();
+}
+virtual bool mightAlias(const MDefinition *store) const {
+// Return whether this load may depend on the specified store, given
+// that the alias sets intersect. This may be refined to exclude
+// possible aliasing in cases where alias set flags are too imprecise.
+JS_ASSERT(!isEffectful() && store->isEffectful());
+JS_ASSERT(getAliasSet().flags() & store->getAliasSet().flags());
+return true;
+}
+};
+// An MUseDefIterator walks over uses in a definition, skipping any use that is
+// not a definition. Items from the use list must not be deleted during
+// iteration.
+class MUseDefIterator
+{
+MDefinition *def_;
+MUseIterator current_;
+MUseIterator search(MUseIterator start) {
+MUseIterator i(start);
+for (; i != def_->usesEnd(); i++) {
+if (i->consumer()->isDefinition())
+return i;
+}
+return def_->usesEnd();
+}
+public:
+MUseDefIterator(MDefinition *def)
+: def_(def),
+current_(search(def->usesBegin()))
+{ }
+operator bool() const {
+return current_ != def_->usesEnd();
+}
+MUseDefIterator operator ++(int) {
+MUseDefIterator old(*this);
+if (current_ != def_->usesEnd())
+current_++;
+current_ = search(current_);
+return old;
+}
+MUse *use() const {
+return *current_;
+}
+MDefinition *def() const {
+return current_->consumer()->toDefinition();
+}
+size_t index() const {
+return current_->index();
+}
+};
+// An instruction is an SSA name that is inserted into a basic block's IR
+// stream.
+class MInstruction
+: public MDefinition,
+public InlineListNode<MInstruction>
+{
+MResumePoint *resumePoint_;
+public:
+MInstruction()
+: resumePoint_(nullptr)
+{ }
+virtual bool accept(MInstructionVisitor *visitor) = 0;
+void setResumePoint(MResumePoint *resumePoint) {
+JS_ASSERT(!resumePoint_);
+resumePoint_ = resumePoint;
+}
+MResumePoint *resumePoint() const {
+return resumePoint_;
+}
+};
+#define INSTRUCTION_HEADER(opcode)                                          \
+Opcode op() const {                                                     \
+return MDefinition::Op_##opcode;                                    \
+}                                                                       \
+const char *opName() const {                                            \
+return #opcode;                                                     \
+}                                                                       \
+bool accept(MInstructionVisitor *visitor) {                             \
+return visitor->visit##opcode(this);                                \
+}
+template <size_t Arity>
+class MAryInstruction : public MInstruction
+{
+protected:
+mozilla::Array<MUse, Arity> operands_;
+void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {
+operands_[index].set(operand, this, index);
+operand->addUse(&operands_[index]);
+}
+MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {
+return &operands_[index];
+}
+public:
+MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {
+return operands_[index].producer();
+}
+size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {
+return Arity;
+}
+};
+class MNullaryInstruction : public MAryInstruction<0>
+{ };
+class MUnaryInstruction : public MAryInstruction<1>
+{
+protected:
+MUnaryInstruction(MDefinition *ins)
+{
+setOperand(0, ins);
+}
+public:
+MDefinition *input() const {
+return getOperand(0);
+}
+};
+class MBinaryInstruction : public MAryInstruction<2>
+{
+protected:
+MBinaryInstruction(MDefinition *left, MDefinition *right)
+{
+setOperand(0, left);
+setOperand(1, right);
+}
+public:
+MDefinition *lhs() const {
+return getOperand(0);
+}
+MDefinition *rhs() const {
+return getOperand(1);
+}
+protected:
+HashNumber valueHash() const
+{
+MDefinition *lhs = getOperand(0);
+MDefinition *rhs = getOperand(1);
+return op() ^ lhs->valueNumber() ^ rhs->valueNumber();
+}
+void swapOperands() {
+MDefinition *temp = getOperand(0);
+replaceOperand(0, getOperand(1));
+replaceOperand(1, temp);
+}
+bool binaryCongruentTo(const MDefinition *ins) const
+{
+if (op() != ins->op())
+return false;
+if (type() != ins->type())
+return false;
+if (isEffectful() || ins->isEffectful())
+return false;
+const MDefinition *left = getOperand(0);
+const MDefinition *right = getOperand(1);
+const MDefinition *tmp;
+if (isCommutative() && left->valueNumber() > right->valueNumber()) {
+tmp = right;
+right = left;
+left = tmp;
+}
+const MBinaryInstruction *bi = static_cast<const MBinaryInstruction *>(ins);
+const MDefinition *insLeft = bi->getOperand(0);
+const MDefinition *insRight = bi->getOperand(1);
+if (isCommutative() && insLeft->valueNumber() > insRight->valueNumber()) {
+tmp = insRight;
+insRight = insLeft;
+insLeft = tmp;
+}
+return (left->valueNumber() == insLeft->valueNumber()) &&
+(right->valueNumber() == insRight->valueNumber());
+}
+// Return true if the operands to this instruction are both unsigned,
+// in which case any wrapping operands were replaced with the underlying
+// int32 operands.
+bool tryUseUnsignedOperands();
+};
+class MTernaryInstruction : public MAryInstruction<3>
+{
+protected:
+MTernaryInstruction(MDefinition *first, MDefinition *second, MDefinition *third)
+{
+setOperand(0, first);
+setOperand(1, second);
+setOperand(2, third);
+}
+protected:
+HashNumber valueHash() const
+{
+MDefinition *first = getOperand(0);
+MDefinition *second = getOperand(1);
+MDefinition *third = getOperand(2);
+return op() ^ first->valueNumber() ^ second->valueNumber() ^ third->valueNumber();
+}
+};
+class MQuaternaryInstruction : public MAryInstruction<4>
+{
+protected:
+MQuaternaryInstruction(MDefinition *first, MDefinition *second,
+MDefinition *third, MDefinition *fourth)
+{
+setOperand(0, first);
+setOperand(1, second);
+setOperand(2, third);
+setOperand(3, fourth);
+}
+protected:
+HashNumber valueHash() const
+{
+MDefinition *first = getOperand(0);
+MDefinition *second = getOperand(1);
+MDefinition *third = getOperand(2);
+MDefinition *fourth = getOperand(3);
+return op() ^ first->valueNumber() ^ second->valueNumber() ^
+third->valueNumber() ^ fourth->valueNumber();
+}
+};
+// Generates an LSnapshot without further effect.
+class MStart : public MNullaryInstruction
+{
+public:
+enum StartType {
+StartType_Default,
+StartType_Osr
+};
+private:
+StartType startType_;
+private:
+MStart(StartType startType)
+: startType_(startType)
+{ }
+public:
+INSTRUCTION_HEADER(Start)
+static MStart *New(TempAllocator &alloc, StartType startType) {
+return new(alloc) MStart(startType);
+}
+StartType startType() {
+return startType_;
+}
+};
+// Instruction marking on entrypoint for on-stack replacement.
+// OSR may occur at loop headers (at JSOP_TRACE).
+// There is at most one MOsrEntry per MIRGraph.
+class MOsrEntry : public MNullaryInstruction
+{
+protected:
+MOsrEntry() {
+setResultType(MIRType_Pointer);
+}
+public:
+INSTRUCTION_HEADER(OsrEntry)
+static MOsrEntry *New(TempAllocator &alloc) {
+return new(alloc) MOsrEntry;
+}
+};
+// No-op instruction. This cannot be moved or eliminated, and is intended for
+// anchoring resume points at arbitrary points in a block.
+class MNop : public MNullaryInstruction
+{
+protected:
+MNop() {
+}
+public:
+INSTRUCTION_HEADER(Nop)
+static MNop *New(TempAllocator &alloc) {
+return new(alloc) MNop();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// A constant js::Value.
+class MConstant : public MNullaryInstruction
+{
+Value value_;
+protected:
+MConstant(const Value &v, types::CompilerConstraintList *constraints);
+public:
+INSTRUCTION_HEADER(Constant)
+static MConstant *New(TempAllocator &alloc, const Value &v,
+types::CompilerConstraintList *constraints = nullptr);
+static MConstant *NewAsmJS(TempAllocator &alloc, const Value &v, MIRType type);
+const js::Value &value() const {
+return value_;
+}
+const js::Value *vp() const {
+return &value_;
+}
+const bool valueToBoolean() const {
+// A hack to avoid this wordy pattern everywhere in the JIT.
+return ToBoolean(HandleValue::fromMarkedLocation(&value_));
+}
+void printOpcode(FILE *fp) const;
+HashNumber valueHash() const;
+bool congruentTo(const MDefinition *ins) const;
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool updateForReplacement(MDefinition *def) {
+MConstant *c = def->toConstant();
+// During constant folding, we don't want to replace a float32
+// value by a double value.
+if (type() == MIRType_Float32)
+return c->type() == MIRType_Float32;
+if (type() == MIRType_Double)
+return c->type() != MIRType_Float32;
+return true;
+}
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool canProduceFloat32() const;
+};
+// Deep clone a constant JSObject.
+class MCloneLiteral
+: public MUnaryInstruction,
+public ObjectPolicy<0>
+{
+protected:
+MCloneLiteral(MDefinition *obj)
+: MUnaryInstruction(obj)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(CloneLiteral)
+static MCloneLiteral *New(TempAllocator &alloc, MDefinition *obj);
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MParameter : public MNullaryInstruction
+{
+int32_t index_;
+public:
+static const int32_t THIS_SLOT = -1;
+MParameter(int32_t index, types::TemporaryTypeSet *types)
+: index_(index)
+{
+setResultType(MIRType_Value);
+setResultTypeSet(types);
+}
+public:
+INSTRUCTION_HEADER(Parameter)
+static MParameter *New(TempAllocator &alloc, int32_t index, types::TemporaryTypeSet *types);
+int32_t index() const {
+return index_;
+}
+void printOpcode(FILE *fp) const;
+HashNumber valueHash() const;
+bool congruentTo(const MDefinition *ins) const;
+};
+class MCallee : public MNullaryInstruction
+{
+public:
+MCallee()
+{
+setResultType(MIRType_Object);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Callee)
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+static MCallee *New(TempAllocator &alloc) {
+return new(alloc) MCallee();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MControlInstruction : public MInstruction
+{
+public:
+MControlInstruction()
+{ }
+virtual size_t numSuccessors() const = 0;
+virtual MBasicBlock *getSuccessor(size_t i) const = 0;
+virtual void replaceSuccessor(size_t i, MBasicBlock *successor) = 0;
+bool isControlInstruction() const {
+return true;
+}
+void printOpcode(FILE *fp) const;
+};
+class MTableSwitch MOZ_FINAL
+: public MControlInstruction,
+public NoFloatPolicy<0>
+{
+// The successors of the tableswitch
+// - First successor = the default case
+// - Successor 2 and higher = the cases sorted on case index.
+Vector<MBasicBlock*, 0, IonAllocPolicy> successors_;
+Vector<size_t, 0, IonAllocPolicy> cases_;
+// Contains the blocks/cases that still need to get build
+Vector<MBasicBlock*, 0, IonAllocPolicy> blocks_;
+MUse operand_;
+int32_t low_;
+int32_t high_;
+MTableSwitch(TempAllocator &alloc, MDefinition *ins,
+int32_t low, int32_t high)
+: successors_(alloc),
+cases_(alloc),
+blocks_(alloc),
+low_(low),
+high_(high)
+{
+setOperand(0, ins);
+}
+protected:
+void setOperand(size_t index, MDefinition *operand) {
+JS_ASSERT(index == 0);
+operand_.set(operand, this, index);
+operand->addUse(&operand_);
+}
+MUse *getUseFor(size_t index) {
+JS_ASSERT(index == 0);
+return &operand_;
+}
+public:
+INSTRUCTION_HEADER(TableSwitch)
+static MTableSwitch *New(TempAllocator &alloc, MDefinition *ins, int32_t low, int32_t high);
+size_t numSuccessors() const {
+return successors_.length();
+}
+size_t addSuccessor(MBasicBlock *successor) {
+JS_ASSERT(successors_.length() < (size_t)(high_ - low_ + 2));
+JS_ASSERT(!successors_.empty());
+successors_.append(successor);
+return successors_.length() - 1;
+}
+MBasicBlock *getSuccessor(size_t i) const {
+JS_ASSERT(i < numSuccessors());
+return successors_[i];
+}
+void replaceSuccessor(size_t i, MBasicBlock *successor) {
+JS_ASSERT(i < numSuccessors());
+successors_[i] = successor;
+}
+MBasicBlock** blocks() {
+return &blocks_[0];
+}
+size_t numBlocks() const {
+return blocks_.length();
+}
+int32_t low() const {
+return low_;
+}
+int32_t high() const {
+return high_;
+}
+MBasicBlock *getDefault() const {
+return getSuccessor(0);
+}
+MBasicBlock *getCase(size_t i) const {
+return getSuccessor(cases_[i]);
+}
+size_t numCases() const {
+return high() - low() + 1;
+}
+size_t addDefault(MBasicBlock *block) {
+JS_ASSERT(successors_.empty());
+successors_.append(block);
+return 0;
+}
+void addCase(size_t successorIndex) {
+cases_.append(successorIndex);
+}
+MBasicBlock *getBlock(size_t i) const {
+JS_ASSERT(i < numBlocks());
+return blocks_[i];
+}
+void addBlock(MBasicBlock *block) {
+blocks_.append(block);
+}
+MDefinition *getOperand(size_t index) const {
+JS_ASSERT(index == 0);
+return operand_.producer();
+}
+size_t numOperands() const {
+return 1;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+template <size_t Arity, size_t Successors>
+class MAryControlInstruction : public MControlInstruction
+{
+mozilla::Array<MUse, Arity> operands_;
+mozilla::Array<MBasicBlock *, Successors> successors_;
+protected:
+void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {
+operands_[index].set(operand, this, index);
+operand->addUse(&operands_[index]);
+}
+void setSuccessor(size_t index, MBasicBlock *successor) {
+successors_[index] = successor;
+}
+MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {
+return &operands_[index];
+}
+public:
+MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {
+return operands_[index].producer();
+}
+size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {
+return Arity;
+}
+size_t numSuccessors() const MOZ_FINAL MOZ_OVERRIDE {
+return Successors;
+}
+MBasicBlock *getSuccessor(size_t i) const MOZ_FINAL MOZ_OVERRIDE {
+return successors_[i];
+}
+void replaceSuccessor(size_t i, MBasicBlock *succ) MOZ_FINAL MOZ_OVERRIDE {
+successors_[i] = succ;
+}
+};
+// Jump to the start of another basic block.
+class MGoto : public MAryControlInstruction<0, 1>
+{
+MGoto(MBasicBlock *target) {
+setSuccessor(0, target);
+}
+public:
+INSTRUCTION_HEADER(Goto)
+static MGoto *New(TempAllocator &alloc, MBasicBlock *target);
+MBasicBlock *target() {
+return getSuccessor(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+enum BranchDirection {
+FALSE_BRANCH,
+TRUE_BRANCH
+};
+static inline BranchDirection
+NegateBranchDirection(BranchDirection dir)
+{
+return (dir == FALSE_BRANCH) ? TRUE_BRANCH : FALSE_BRANCH;
+}
+// Tests if the input instruction evaluates to true or false, and jumps to the
+// start of a corresponding basic block.
+class MTest
+: public MAryControlInstruction<1, 2>,
+public TestPolicy
+{
+bool operandMightEmulateUndefined_;
+MTest(MDefinition *ins, MBasicBlock *if_true, MBasicBlock *if_false)
+: operandMightEmulateUndefined_(true)
+{
+setOperand(0, ins);
+setSuccessor(0, if_true);
+setSuccessor(1, if_false);
+}
+public:
+INSTRUCTION_HEADER(Test)
+static MTest *New(TempAllocator &alloc, MDefinition *ins,
+MBasicBlock *ifTrue, MBasicBlock *ifFalse);
+MDefinition *input() const {
+return getOperand(0);
+}
+MBasicBlock *ifTrue() const {
+return getSuccessor(0);
+}
+MBasicBlock *ifFalse() const {
+return getSuccessor(1);
+}
+MBasicBlock *branchSuccessor(BranchDirection dir) const {
+return (dir == TRUE_BRANCH) ? ifTrue() : ifFalse();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void infer();
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void filtersUndefinedOrNull(bool trueBranch, MDefinition **subject, bool *filtersUndefined,
+bool *filtersNull);
+void markOperandCantEmulateUndefined() {
+operandMightEmulateUndefined_ = false;
+}
+bool operandMightEmulateUndefined() const {
+return operandMightEmulateUndefined_;
+}
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+return true;
+}
+#endif
+};
+// Returns from this function to the previous caller.
+class MReturn
+: public MAryControlInstruction<1, 0>,
+public BoxInputsPolicy
+{
+MReturn(MDefinition *ins) {
+setOperand(0, ins);
+}
+public:
+INSTRUCTION_HEADER(Return)
+static MReturn *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MReturn(ins);
+}
+MDefinition *input() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MThrow
+: public MAryControlInstruction<1, 0>,
+public BoxInputsPolicy
+{
+MThrow(MDefinition *ins) {
+setOperand(0, ins);
+}
+public:
+INSTRUCTION_HEADER(Throw)
+static MThrow *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MThrow(ins);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Fabricate a type set containing only the type of the specified object.
+types::TemporaryTypeSet *
+MakeSingletonTypeSet(types::CompilerConstraintList *constraints, JSObject *obj);
+bool
+MergeTypes(MIRType *ptype, types::TemporaryTypeSet **ptypeSet,
+MIRType newType, types::TemporaryTypeSet *newTypeSet);
+class MNewArray : public MNullaryInstruction
+{
+public:
+enum AllocatingBehaviour {
+NewArray_Allocating,
+NewArray_Unallocating
+};
+private:
+// Number of space to allocate for the array.
+uint32_t count_;
+// Template for the created object.
+CompilerRootObject templateObject_;
+gc::InitialHeap initialHeap_;
+// Allocate space at initialization or not
+AllocatingBehaviour allocating_;
+MNewArray(types::CompilerConstraintList *constraints, uint32_t count, JSObject *templateObject,
+gc::InitialHeap initialHeap, AllocatingBehaviour allocating)
+: count_(count),
+templateObject_(templateObject),
+initialHeap_(initialHeap),
+allocating_(allocating)
+{
+setResultType(MIRType_Object);
+if (!templateObject->hasSingletonType())
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+}
+public:
+INSTRUCTION_HEADER(NewArray)
+static MNewArray *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+uint32_t count, JSObject *templateObject,
+gc::InitialHeap initialHeap, AllocatingBehaviour allocating)
+{
+return new(alloc) MNewArray(constraints, count, templateObject, initialHeap, allocating);
+}
+uint32_t count() const {
+return count_;
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+gc::InitialHeap initialHeap() const {
+return initialHeap_;
+}
+bool isAllocating() const {
+return allocating_ == NewArray_Allocating;
+}
+// Returns true if the code generator should call through to the
+// VM rather than the fast path.
+bool shouldUseVM() const;
+// NewArray is marked as non-effectful because all our allocations are
+// either lazy when we are using "new Array(length)" or bounded by the
+// script or the stack size when we are using "new Array(...)" or "[...]"
+// notations.  So we might have to allocate the array twice if we bail
+// during the computation of the first element of the square braket
+// notation.
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MNewObject : public MNullaryInstruction
+{
+CompilerRootObject templateObject_;
+gc::InitialHeap initialHeap_;
+bool templateObjectIsClassPrototype_;
+MNewObject(types::CompilerConstraintList *constraints, JSObject *templateObject,
+gc::InitialHeap initialHeap, bool templateObjectIsClassPrototype)
+: templateObject_(templateObject),
+initialHeap_(initialHeap),
+templateObjectIsClassPrototype_(templateObjectIsClassPrototype)
+{
+JS_ASSERT_IF(templateObjectIsClassPrototype, !shouldUseVM());
+setResultType(MIRType_Object);
+if (!templateObject->hasSingletonType())
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+}
+public:
+INSTRUCTION_HEADER(NewObject)
+static MNewObject *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+JSObject *templateObject, gc::InitialHeap initialHeap,
+bool templateObjectIsClassPrototype)
+{
+return new(alloc) MNewObject(constraints, templateObject, initialHeap,
+templateObjectIsClassPrototype);
+}
+// Returns true if the code generator should call through to the
+// VM rather than the fast path.
+bool shouldUseVM() const;
+bool templateObjectIsClassPrototype() const {
+return templateObjectIsClassPrototype_;
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+gc::InitialHeap initialHeap() const {
+return initialHeap_;
+}
+};
+// Could be allocating either a new array or a new object.
+class MNewPar : public MUnaryInstruction
+{
+CompilerRootObject templateObject_;
+MNewPar(MDefinition *cx, JSObject *templateObject)
+: MUnaryInstruction(cx),
+templateObject_(templateObject)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewPar);
+static MNewPar *New(TempAllocator &alloc, MDefinition *cx, JSObject *templateObject) {
+return new(alloc) MNewPar(cx, templateObject);
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+};
+// Creates a new derived type object. At runtime, this is just a call
+// to `BinaryBlock::createDerived()`. That is, the MIR itself does not
+// compile to particularly optimized code. However, using a distinct
+// MIR for creating derived type objects allows the compiler to
+// optimize ephemeral typed objects as would be created for a
+// reference like `a.b.c` -- here, the `a.b` will create an ephemeral
+// derived type object that aliases the memory of `a` itself. The
+// specific nature of `a.b` is revealed by using
+// `MNewDerivedTypedObject` rather than `MGetProperty` or what have
+// you. Moreover, the compiler knows that there are no side-effects,
+// so `MNewDerivedTypedObject` instructions can be reordered or pruned
+// as dead code.
+class MNewDerivedTypedObject
+: public MTernaryInstruction,
+public Mix3Policy<ObjectPolicy<0>,
+ObjectPolicy<1>,
+IntPolicy<2> >
+{
+private:
+TypeDescrSet set_;
+MNewDerivedTypedObject(TypeDescrSet set,
+MDefinition *type,
+MDefinition *owner,
+MDefinition *offset)
+: MTernaryInstruction(type, owner, offset),
+set_(set)
+{
+setMovable();
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewDerivedTypedObject);
+static MNewDerivedTypedObject *New(TempAllocator &alloc, TypeDescrSet set,
+MDefinition *type, MDefinition *owner, MDefinition *offset)
+{
+return new(alloc) MNewDerivedTypedObject(set, type, owner, offset);
+}
+TypeDescrSet set() const {
+return set_;
+}
+MDefinition *type() const {
+return getOperand(0);
+}
+MDefinition *owner() const {
+return getOperand(1);
+}
+MDefinition *offset() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Abort parallel execution.
+class MAbortPar : public MAryControlInstruction<0, 0>
+{
+MAbortPar()
+: MAryControlInstruction<0, 0>()
+{
+setResultType(MIRType_None);
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(AbortPar);
+static MAbortPar *New(TempAllocator &alloc) {
+return new(alloc) MAbortPar();
+}
+};
+// Setting __proto__ in an object literal.
+class MMutateProto
+: public MAryInstruction<2>,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+protected:
+MMutateProto(MDefinition *obj, MDefinition *value)
+{
+setOperand(0, obj);
+setOperand(1, value);
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(MutateProto)
+static MMutateProto *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value)
+{
+return new(alloc) MMutateProto(obj, value);
+}
+MDefinition *getObject() const {
+return getOperand(0);
+}
+MDefinition *getValue() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Slow path for adding a property to an object without a known base.
+class MInitProp
+: public MAryInstruction<2>,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+public:
+CompilerRootPropertyName name_;
+protected:
+MInitProp(MDefinition *obj, PropertyName *name, MDefinition *value)
+: name_(name)
+{
+setOperand(0, obj);
+setOperand(1, value);
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(InitProp)
+static MInitProp *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,
+MDefinition *value)
+{
+return new(alloc) MInitProp(obj, name, value);
+}
+MDefinition *getObject() const {
+return getOperand(0);
+}
+MDefinition *getValue() const {
+return getOperand(1);
+}
+PropertyName *propertyName() const {
+return name_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MInitPropGetterSetter
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >
+{
+CompilerRootPropertyName name_;
+MInitPropGetterSetter(MDefinition *obj, PropertyName *name, MDefinition *value)
+: MBinaryInstruction(obj, value),
+name_(name)
+{ }
+public:
+INSTRUCTION_HEADER(InitPropGetterSetter)
+static MInitPropGetterSetter *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,
+MDefinition *value)
+{
+return new(alloc) MInitPropGetterSetter(obj, name, value);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+PropertyName *name() const {
+return name_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MInitElem
+: public MAryInstruction<3>,
+public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, BoxPolicy<2> >
+{
+MInitElem(MDefinition *obj, MDefinition *id, MDefinition *value)
+{
+setOperand(0, obj);
+setOperand(1, id);
+setOperand(2, value);
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(InitElem)
+static MInitElem *New(TempAllocator &alloc, MDefinition *obj, MDefinition *id,
+MDefinition *value)
+{
+return new(alloc) MInitElem(obj, id, value);
+}
+MDefinition *getObject() const {
+return getOperand(0);
+}
+MDefinition *getId() const {
+return getOperand(1);
+}
+MDefinition *getValue() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MInitElemGetterSetter
+: public MTernaryInstruction,
+public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2> >
+{
+MInitElemGetterSetter(MDefinition *obj, MDefinition *id, MDefinition *value)
+: MTernaryInstruction(obj, id, value)
+{ }
+public:
+INSTRUCTION_HEADER(InitElemGetterSetter)
+static MInitElemGetterSetter *New(TempAllocator &alloc, MDefinition *obj, MDefinition *id,
+MDefinition *value)
+{
+return new(alloc) MInitElemGetterSetter(obj, id, value);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *idValue() const {
+return getOperand(1);
+}
+MDefinition *value() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MVariadicInstruction : public MInstruction
+{
+FixedList<MUse> operands_;
+protected:
+bool init(TempAllocator &alloc, size_t length) {
+return operands_.init(alloc, length);
+}
+public:
+// Will assert if called before initialization.
+MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {
+return operands_[index].producer();
+}
+size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {
+return operands_.length();
+}
+void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {
+operands_[index].set(operand, this, index);
+operand->addUse(&operands_[index]);
+}
+MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {
+return &operands_[index];
+}
+};
+class MCall
+: public MVariadicInstruction,
+public CallPolicy
+{
+private:
+// An MCall uses the MPrepareCall, MDefinition for the function, and
+// MPassArg instructions. They are stored in the same list.
+static const size_t FunctionOperandIndex   = 0;
+static const size_t NumNonArgumentOperands = 1;
+protected:
+// True if the call is for JSOP_NEW.
+bool construct_;
+// Monomorphic cache of single target from TI, or nullptr.
+CompilerRootFunction target_;
+// Original value of argc from the bytecode.
+uint32_t numActualArgs_;
+bool needsArgCheck_;
+MCall(JSFunction *target, uint32_t numActualArgs, bool construct)
+: construct_(construct),
+target_(target),
+numActualArgs_(numActualArgs),
+needsArgCheck_(true)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(Call)
+static MCall *New(TempAllocator &alloc, JSFunction *target, size_t maxArgc, size_t numActualArgs,
+bool construct, bool isDOMCall);
+void initFunction(MDefinition *func) {
+return setOperand(FunctionOperandIndex, func);
+}
+bool needsArgCheck() const {
+return needsArgCheck_;
+}
+void disableArgCheck() {
+needsArgCheck_ = false;
+}
+MDefinition *getFunction() const {
+return getOperand(FunctionOperandIndex);
+}
+void replaceFunction(MInstruction *newfunc) {
+replaceOperand(FunctionOperandIndex, newfunc);
+}
+void addArg(size_t argnum, MDefinition *arg);
+MDefinition *getArg(uint32_t index) const {
+return getOperand(NumNonArgumentOperands + index);
+}
+static size_t IndexOfThis() {
+return NumNonArgumentOperands;
+}
+static size_t IndexOfArgument(size_t index) {
+return NumNonArgumentOperands + index + 1; // +1 to skip |this|.
+}
+static size_t IndexOfStackArg(size_t index) {
+return NumNonArgumentOperands + index;
+}
+// For TI-informed monomorphic callsites.
+JSFunction *getSingleTarget() const {
+return target_;
+}
+bool isConstructing() const {
+return construct_;
+}
+// The number of stack arguments is the max between the number of formal
+// arguments and the number of actual arguments. The number of stack
+// argument includes the |undefined| padding added in case of underflow.
+// Includes |this|.
+uint32_t numStackArgs() const {
+return numOperands() - NumNonArgumentOperands;
+}
+// Does not include |this|.
+uint32_t numActualArgs() const {
+return numActualArgs_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+virtual bool isCallDOMNative() const {
+return false;
+}
+// A method that can be called to tell the MCall to figure out whether it's
+// movable or not.  This can't be done in the constructor, because it
+// depends on the arguments to the call, and those aren't passed to the
+// constructor but are set up later via addArg.
+virtual void computeMovable() {
+}
+};
+class MCallDOMNative : public MCall
+{
+// A helper class for MCalls for DOM natives.  Note that this is NOT
+// actually a separate MIR op from MCall, because all sorts of places use
+// isCall() to check for calls and all we really want is to overload a few
+// virtual things from MCall.
+protected:
+MCallDOMNative(JSFunction *target, uint32_t numActualArgs)
+: MCall(target, numActualArgs, false)
+{
+// If our jitinfo is not marked movable, that means that our C++
+// implementation is fallible or that we have no hope of ever doing the
+// sort of argument analysis that would allow us to detemine that we're
+// side-effect-free.  In the latter case we wouldn't get DCEd no matter
+// what, but for the former case we have to explicitly say that we can't
+// be DCEd.
+if (!getJitInfo()->isMovable)
+setGuard();
+}
+friend MCall *MCall::New(TempAllocator &alloc, JSFunction *target, size_t maxArgc,
+size_t numActualArgs, bool construct, bool isDOMCall);
+const JSJitInfo *getJitInfo() const;
+public:
+virtual AliasSet getAliasSet() const MOZ_OVERRIDE;
+virtual bool congruentTo(const MDefinition *ins) const MOZ_OVERRIDE;
+virtual bool isCallDOMNative() const MOZ_OVERRIDE {
+return true;
+}
+virtual void computeMovable() MOZ_OVERRIDE;
+};
+// arr.splice(start, deleteCount) with unused return value.
+class MArraySplice
+: public MTernaryInstruction,
+public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2> >
+{
+private:
+MArraySplice(MDefinition *object, MDefinition *start, MDefinition *deleteCount)
+: MTernaryInstruction(object, start, deleteCount)
+{ }
+public:
+INSTRUCTION_HEADER(ArraySplice)
+static MArraySplice *New(TempAllocator &alloc, MDefinition *object,
+MDefinition *start, MDefinition *deleteCount)
+{
+return new(alloc) MArraySplice(object, start, deleteCount);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *start() const {
+return getOperand(1);
+}
+MDefinition *deleteCount() const {
+return getOperand(2);
+}
+bool possiblyCalls() const {
+return true;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+// fun.apply(self, arguments)
+class MApplyArgs
+: public MAryInstruction<3>,
+public MixPolicy<ObjectPolicy<0>, MixPolicy<IntPolicy<1>, BoxPolicy<2> > >
+{
+protected:
+// Monomorphic cache of single target from TI, or nullptr.
+CompilerRootFunction target_;
+MApplyArgs(JSFunction *target, MDefinition *fun, MDefinition *argc, MDefinition *self)
+: target_(target)
+{
+setOperand(0, fun);
+setOperand(1, argc);
+setOperand(2, self);
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(ApplyArgs)
+static MApplyArgs *New(TempAllocator &alloc, JSFunction *target, MDefinition *fun,
+MDefinition *argc, MDefinition *self);
+MDefinition *getFunction() const {
+return getOperand(0);
+}
+// For TI-informed monomorphic callsites.
+JSFunction *getSingleTarget() const {
+return target_;
+}
+MDefinition *getArgc() const {
+return getOperand(1);
+}
+MDefinition *getThis() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MBail : public MNullaryInstruction
+{
+protected:
+MBail()
+{
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(Bail)
+static MBail *
+New(TempAllocator &alloc) {
+return new(alloc) MBail();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MAssertFloat32 : public MUnaryInstruction
+{
+protected:
+bool mustBeFloat32_;
+MAssertFloat32(MDefinition *value, bool mustBeFloat32)
+: MUnaryInstruction(value), mustBeFloat32_(mustBeFloat32)
+{
+}
+public:
+INSTRUCTION_HEADER(AssertFloat32)
+static MAssertFloat32 *New(TempAllocator &alloc, MDefinition *value, bool mustBeFloat32) {
+return new(alloc) MAssertFloat32(value, mustBeFloat32);
+}
+bool canConsumeFloat32(MUse *use) const { return true; }
+bool mustBeFloat32() const { return mustBeFloat32_; }
+};
+class MGetDynamicName
+: public MAryInstruction<2>,
+public MixPolicy<ObjectPolicy<0>, ConvertToStringPolicy<1> >
+{
+protected:
+MGetDynamicName(MDefinition *scopeChain, MDefinition *name)
+{
+setOperand(0, scopeChain);
+setOperand(1, name);
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(GetDynamicName)
+static MGetDynamicName *
+New(TempAllocator &alloc, MDefinition *scopeChain, MDefinition *name) {
+return new(alloc) MGetDynamicName(scopeChain, name);
+}
+MDefinition *getScopeChain() const {
+return getOperand(0);
+}
+MDefinition *getName() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Bailout if the input string contains 'arguments' or 'eval'.
+class MFilterArgumentsOrEval
+: public MAryInstruction<1>,
+public BoxExceptPolicy<0, MIRType_String>
+{
+protected:
+MFilterArgumentsOrEval(MDefinition *string)
+{
+setOperand(0, string);
+setGuard();
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(FilterArgumentsOrEval)
+static MFilterArgumentsOrEval *New(TempAllocator &alloc, MDefinition *string) {
+return new(alloc) MFilterArgumentsOrEval(string);
+}
+MDefinition *getString() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MCallDirectEval
+: public MAryInstruction<3>,
+public MixPolicy<ObjectPolicy<0>,
+MixPolicy<BoxExceptPolicy<1, MIRType_String>, BoxPolicy<2> > >
+{
+protected:
+MCallDirectEval(MDefinition *scopeChain, MDefinition *string, MDefinition *thisValue,
+jsbytecode *pc)
+: pc_(pc)
+{
+setOperand(0, scopeChain);
+setOperand(1, string);
+setOperand(2, thisValue);
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(CallDirectEval)
+static MCallDirectEval *
+New(TempAllocator &alloc, MDefinition *scopeChain, MDefinition *string, MDefinition *thisValue,
+jsbytecode *pc)
+{
+return new(alloc) MCallDirectEval(scopeChain, string, thisValue, pc);
+}
+MDefinition *getScopeChain() const {
+return getOperand(0);
+}
+MDefinition *getString() const {
+return getOperand(1);
+}
+MDefinition *getThisValue() const {
+return getOperand(2);
+}
+jsbytecode  *pc() const {
+return pc_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+private:
+jsbytecode *pc_;
+};
+class MCompare
+: public MBinaryInstruction,
+public ComparePolicy
+{
+public:
+enum CompareType {
+// Anything compared to Undefined
+Compare_Undefined,
+// Anything compared to Null
+Compare_Null,
+// Undefined compared to Boolean
+// Null      compared to Boolean
+// Double    compared to Boolean
+// String    compared to Boolean
+// Object    compared to Boolean
+// Value     compared to Boolean
+Compare_Boolean,
+// Int32   compared to Int32
+// Boolean compared to Boolean
+Compare_Int32,
+Compare_Int32MaybeCoerceBoth,
+Compare_Int32MaybeCoerceLHS,
+Compare_Int32MaybeCoerceRHS,
+// Int32 compared as unsigneds
+Compare_UInt32,
+// Double compared to Double
+Compare_Double,
+Compare_DoubleMaybeCoerceLHS,
+Compare_DoubleMaybeCoerceRHS,
+// Float compared to Float
+Compare_Float32,
+// String compared to String
+Compare_String,
+// Undefined compared to String
+// Null      compared to String
+// Boolean   compared to String
+// Int32     compared to String
+// Double    compared to String
+// Object    compared to String
+// Value     compared to String
+Compare_StrictString,
+// Object compared to Object
+Compare_Object,
+// Compare 2 values bitwise
+Compare_Value,
+// All other possible compares
+Compare_Unknown
+};
+private:
+CompareType compareType_;
+JSOp jsop_;
+bool operandMightEmulateUndefined_;
+bool operandsAreNeverNaN_;
+// When a floating-point comparison is converted to an integer comparison
+// (when range analysis proves it safe), we need to convert the operands
+// to integer as well.
+bool truncateOperands_;
+MCompare(MDefinition *left, MDefinition *right, JSOp jsop)
+: MBinaryInstruction(left, right),
+compareType_(Compare_Unknown),
+jsop_(jsop),
+operandMightEmulateUndefined_(true),
+operandsAreNeverNaN_(false),
+truncateOperands_(false)
+{
+setResultType(MIRType_Boolean);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Compare)
+static MCompare *New(TempAllocator &alloc, MDefinition *left, MDefinition *right, JSOp op);
+static MCompare *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right, JSOp op,
+CompareType compareType);
+bool tryFold(bool *result);
+bool evaluateConstantOperands(bool *result);
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void filtersUndefinedOrNull(bool trueBranch, MDefinition **subject, bool *filtersUndefined,
+bool *filtersNull);
+void infer(BaselineInspector *inspector, jsbytecode *pc);
+CompareType compareType() const {
+return compareType_;
+}
+bool isInt32Comparison() const {
+return compareType() == Compare_Int32 ||
+compareType() == Compare_Int32MaybeCoerceBoth ||
+compareType() == Compare_Int32MaybeCoerceLHS ||
+compareType() == Compare_Int32MaybeCoerceRHS;
+}
+bool isDoubleComparison() const {
+return compareType() == Compare_Double ||
+compareType() == Compare_DoubleMaybeCoerceLHS ||
+compareType() == Compare_DoubleMaybeCoerceRHS;
+}
+bool isFloat32Comparison() const {
+return compareType() == Compare_Float32;
+}
+void setCompareType(CompareType type) {
+compareType_ = type;
+}
+MIRType inputType();
+JSOp jsop() const {
+return jsop_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+void markNoOperandEmulatesUndefined() {
+operandMightEmulateUndefined_ = false;
+}
+bool operandMightEmulateUndefined() const {
+return operandMightEmulateUndefined_;
+}
+bool operandsAreNeverNaN() const {
+return operandsAreNeverNaN_;
+}
+AliasSet getAliasSet() const {
+// Strict equality is never effectful.
+if (jsop_ == JSOP_STRICTEQ || jsop_ == JSOP_STRICTNE)
+return AliasSet::None();
+if (compareType_ == Compare_Unknown)
+return AliasSet::Store(AliasSet::Any);
+JS_ASSERT(compareType_ <= Compare_Value);
+return AliasSet::None();
+}
+void printOpcode(FILE *fp) const;
+void collectRangeInfoPreTrunc();
+void trySpecializeFloat32(TempAllocator &alloc);
+bool isFloat32Commutative() const { return true; }
+bool truncate();
+bool isOperandTruncated(size_t index) const;
+# ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+// Both sides of the compare can be Float32
+return compareType_ == Compare_Float32;
+}
+# endif
+protected:
+bool congruentTo(const MDefinition *ins) const {
+if (!binaryCongruentTo(ins))
+return false;
+return compareType() == ins->toCompare()->compareType() &&
+jsop() == ins->toCompare()->jsop();
+}
+};
+// Takes a typed value and returns an untyped value.
+class MBox : public MUnaryInstruction
+{
+MBox(TempAllocator &alloc, MDefinition *ins)
+: MUnaryInstruction(ins)
+{
+setResultType(MIRType_Value);
+if (ins->resultTypeSet()) {
+setResultTypeSet(ins->resultTypeSet());
+} else if (ins->type() != MIRType_Value) {
+types::Type ntype = ins->type() == MIRType_Object
+? types::Type::AnyObjectType()
+: types::Type::PrimitiveType(ValueTypeFromMIRType(ins->type()));
+setResultTypeSet(alloc.lifoAlloc()->new_<types::TemporaryTypeSet>(ntype));
+}
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Box)
+static MBox *New(TempAllocator &alloc, MDefinition *ins)
+{
+// Cannot box a box.
+JS_ASSERT(ins->type() != MIRType_Value);
+return new(alloc) MBox(alloc, ins);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Note: the op may have been inverted during lowering (to put constants in a
+// position where they can be immediates), so it is important to use the
+// lir->jsop() instead of the mir->jsop() when it is present.
+static inline Assembler::Condition
+JSOpToCondition(MCompare::CompareType compareType, JSOp op)
+{
+bool isSigned = (compareType != MCompare::Compare_UInt32);
+return JSOpToCondition(op, isSigned);
+}
+// Takes a typed value and checks if it is a certain type. If so, the payload
+// is unpacked and returned as that type. Otherwise, it is considered a
+// deoptimization.
+class MUnbox : public MUnaryInstruction, public BoxInputsPolicy
+{
+public:
+enum Mode {
+Fallible,       // Check the type, and deoptimize if unexpected.
+Infallible,     // Type guard is not necessary.
+TypeBarrier     // Guard on the type, and act like a TypeBarrier on failure.
+};
+private:
+Mode mode_;
+BailoutKind bailoutKind_;
+MUnbox(MDefinition *ins, MIRType type, Mode mode, BailoutKind kind)
+: MUnaryInstruction(ins),
+mode_(mode)
+{
+JS_ASSERT(ins->type() == MIRType_Value);
+JS_ASSERT(type == MIRType_Boolean ||
+type == MIRType_Int32   ||
+type == MIRType_Double  ||
+type == MIRType_String  ||
+type == MIRType_Object);
+setResultType(type);
+setResultTypeSet(ins->resultTypeSet());
+setMovable();
+if (mode_ == TypeBarrier || mode_ == Fallible)
+setGuard();
+bailoutKind_ = kind;
+}
+public:
+INSTRUCTION_HEADER(Unbox)
+static MUnbox *New(TempAllocator &alloc, MDefinition *ins, MIRType type, Mode mode)
+{
+return new(alloc) MUnbox(ins, type, mode, Bailout_Normal);
+}
+static MUnbox *New(TempAllocator &alloc, MDefinition *ins, MIRType type, Mode mode,
+BailoutKind kind)
+{
+return new(alloc) MUnbox(ins, type, mode, kind);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+Mode mode() const {
+return mode_;
+}
+BailoutKind bailoutKind() const {
+// If infallible, no bailout should be generated.
+JS_ASSERT(fallible());
+return bailoutKind_;
+}
+bool fallible() const {
+return mode() != Infallible;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isUnbox() || ins->toUnbox()->mode() != mode())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void printOpcode(FILE *fp) const;
+void makeInfallible() {
+// Should only be called if we're already Infallible or TypeBarrier
+JS_ASSERT(mode() != Fallible);
+mode_ = Infallible;
+}
+};
+class MGuardObject : public MUnaryInstruction, public SingleObjectPolicy
+{
+MGuardObject(MDefinition *ins)
+: MUnaryInstruction(ins)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(GuardObject)
+static MGuardObject *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MGuardObject(ins);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MGuardString
+: public MUnaryInstruction,
+public StringPolicy<0>
+{
+MGuardString(MDefinition *ins)
+: MUnaryInstruction(ins)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_String);
+}
+public:
+INSTRUCTION_HEADER(GuardString)
+static MGuardString *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MGuardString(ins);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MAssertRange
+: public MUnaryInstruction
+{
+// This is the range checked by the assertion. Don't confuse this with the
+// range_ member or the range() accessor. Since MAssertRange doesn't return
+// a value, it doesn't use those.
+const Range *assertedRange_;
+MAssertRange(MDefinition *ins, const Range *assertedRange)
+: MUnaryInstruction(ins), assertedRange_(assertedRange)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(AssertRange)
+static MAssertRange *New(TempAllocator &alloc, MDefinition *ins, const Range *assertedRange) {
+return new(alloc) MAssertRange(ins, assertedRange);
+}
+const Range *assertedRange() const {
+return assertedRange_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void printOpcode(FILE *fp) const;
+};
+// Caller-side allocation of |this| for |new|:
+// Given a templateobject, construct |this| for JSOP_NEW
+class MCreateThisWithTemplate
+: public MNullaryInstruction
+{
+// Template for |this|, provided by TI
+CompilerRootObject templateObject_;
+gc::InitialHeap initialHeap_;
+MCreateThisWithTemplate(types::CompilerConstraintList *constraints, JSObject *templateObject,
+gc::InitialHeap initialHeap)
+: templateObject_(templateObject),
+initialHeap_(initialHeap)
+{
+setResultType(MIRType_Object);
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+}
+public:
+INSTRUCTION_HEADER(CreateThisWithTemplate);
+static MCreateThisWithTemplate *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+JSObject *templateObject, gc::InitialHeap initialHeap)
+{
+return new(alloc) MCreateThisWithTemplate(constraints, templateObject, initialHeap);
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+gc::InitialHeap initialHeap() const {
+return initialHeap_;
+}
+// Although creation of |this| modifies global state, it is safely repeatable.
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Caller-side allocation of |this| for |new|:
+// Given a prototype operand, construct |this| for JSOP_NEW.
+class MCreateThisWithProto
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >
+{
+MCreateThisWithProto(MDefinition *callee, MDefinition *prototype)
+: MBinaryInstruction(callee, prototype)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(CreateThisWithProto)
+static MCreateThisWithProto *New(TempAllocator &alloc, MDefinition *callee,
+MDefinition *prototype)
+{
+return new(alloc) MCreateThisWithProto(callee, prototype);
+}
+MDefinition *getCallee() const {
+return getOperand(0);
+}
+MDefinition *getPrototype() const {
+return getOperand(1);
+}
+// Although creation of |this| modifies global state, it is safely repeatable.
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Caller-side allocation of |this| for |new|:
+// Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING).
+class MCreateThis
+: public MUnaryInstruction,
+public ObjectPolicy<0>
+{
+MCreateThis(MDefinition *callee)
+: MUnaryInstruction(callee)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(CreateThis)
+static MCreateThis *New(TempAllocator &alloc, MDefinition *callee)
+{
+return new(alloc) MCreateThis(callee);
+}
+MDefinition *getCallee() const {
+return getOperand(0);
+}
+// Although creation of |this| modifies global state, it is safely repeatable.
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Eager initialization of arguments object.
+class MCreateArgumentsObject
+: public MUnaryInstruction,
+public ObjectPolicy<0>
+{
+MCreateArgumentsObject(MDefinition *callObj)
+: MUnaryInstruction(callObj)
+{
+setResultType(MIRType_Object);
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(CreateArgumentsObject)
+static MCreateArgumentsObject *New(TempAllocator &alloc, MDefinition *callObj) {
+return new(alloc) MCreateArgumentsObject(callObj);
+}
+MDefinition *getCallObject() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MGetArgumentsObjectArg
+: public MUnaryInstruction,
+public ObjectPolicy<0>
+{
+size_t argno_;
+MGetArgumentsObjectArg(MDefinition *argsObject, size_t argno)
+: MUnaryInstruction(argsObject),
+argno_(argno)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(GetArgumentsObjectArg)
+static MGetArgumentsObjectArg *New(TempAllocator &alloc, MDefinition *argsObj, size_t argno)
+{
+return new(alloc) MGetArgumentsObjectArg(argsObj, argno);
+}
+MDefinition *getArgsObject() const {
+return getOperand(0);
+}
+size_t argno() const {
+return argno_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::Any);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MSetArgumentsObjectArg
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+size_t argno_;
+MSetArgumentsObjectArg(MDefinition *argsObj, size_t argno, MDefinition *value)
+: MBinaryInstruction(argsObj, value),
+argno_(argno)
+{
+}
+public:
+INSTRUCTION_HEADER(SetArgumentsObjectArg)
+static MSetArgumentsObjectArg *New(TempAllocator &alloc, MDefinition *argsObj, size_t argno,
+MDefinition *value)
+{
+return new(alloc) MSetArgumentsObjectArg(argsObj, argno, value);
+}
+MDefinition *getArgsObject() const {
+return getOperand(0);
+}
+size_t argno() const {
+return argno_;
+}
+MDefinition *getValue() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::Any);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MRunOncePrologue
+: public MNullaryInstruction
+{
+protected:
+MRunOncePrologue()
+{
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(RunOncePrologue)
+static MRunOncePrologue *New(TempAllocator &alloc) {
+return new(alloc) MRunOncePrologue();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Given a MIRType_Value A and a MIRType_Object B:
+// If the Value may be safely unboxed to an Object, return Object(A).
+// Otherwise, return B.
+// Used to implement return behavior for inlined constructors.
+class MReturnFromCtor
+: public MAryInstruction<2>,
+public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
+{
+MReturnFromCtor(MDefinition *value, MDefinition *object) {
+setOperand(0, value);
+setOperand(1, object);
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(ReturnFromCtor)
+static MReturnFromCtor *New(TempAllocator &alloc, MDefinition *value, MDefinition *object)
+{
+return new(alloc) MReturnFromCtor(value, object);
+}
+MDefinition *getValue() const {
+return getOperand(0);
+}
+MDefinition *getObject() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+// Converts a primitive (either typed or untyped) to a double. If the input is
+// not primitive at runtime, a bailout occurs.
+class MToDouble
+: public MUnaryInstruction,
+public ToDoublePolicy
+{
+public:
+// Types of values which can be converted.
+enum ConversionKind {
+NonStringPrimitives,
+NonNullNonStringPrimitives,
+NumbersOnly
+};
+private:
+ConversionKind conversion_;
+MToDouble(MDefinition *def, ConversionKind conversion = NonStringPrimitives)
+: MUnaryInstruction(def), conversion_(conversion)
+{
+setResultType(MIRType_Double);
+setMovable();
+// An object might have "valueOf", which means it is effectful.
+if (def->mightBeType(MIRType_Object))
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(ToDouble)
+static MToDouble *New(TempAllocator &alloc, MDefinition *def,
+ConversionKind conversion = NonStringPrimitives)
+{
+return new(alloc) MToDouble(def, conversion);
+}
+static MToDouble *NewAsmJS(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MToDouble(def);
+}
+ConversionKind conversion() const {
+return conversion_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isToDouble() || ins->toToDouble()->conversion() != conversion())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool isOperandTruncated(size_t index) const;
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const { return true; }
+#endif
+};
+// Converts a primitive (either typed or untyped) to a float32. If the input is
+// not primitive at runtime, a bailout occurs.
+class MToFloat32
+: public MUnaryInstruction,
+public ToDoublePolicy
+{
+public:
+// Types of values which can be converted.
+enum ConversionKind {
+NonStringPrimitives,
+NonNullNonStringPrimitives,
+NumbersOnly
+};
+protected:
+ConversionKind conversion_;
+MToFloat32(MDefinition *def, ConversionKind conversion)
+: MUnaryInstruction(def), conversion_(conversion)
+{
+setResultType(MIRType_Float32);
+setMovable();
+// An object might have "valueOf", which means it is effectful.
+if (def->mightBeType(MIRType_Object))
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(ToFloat32)
+static MToFloat32 *New(TempAllocator &alloc, MDefinition *def,
+ConversionKind conversion = NonStringPrimitives)
+{
+return new(alloc) MToFloat32(def, conversion);
+}
+static MToFloat32 *NewAsmJS(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MToFloat32(def, NonStringPrimitives);
+}
+ConversionKind conversion() const {
+return conversion_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+virtual MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isToFloat32() || ins->toToFloat32()->conversion() != conversion())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+bool canConsumeFloat32(MUse *use) const { return true; }
+bool canProduceFloat32() const { return true; }
+};
+// Converts a uint32 to a double (coming from asm.js).
+class MAsmJSUnsignedToDouble
+: public MUnaryInstruction
+{
+MAsmJSUnsignedToDouble(MDefinition *def)
+: MUnaryInstruction(def)
+{
+setResultType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(AsmJSUnsignedToDouble);
+static MAsmJSUnsignedToDouble *NewAsmJS(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MAsmJSUnsignedToDouble(def);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Converts a uint32 to a float32 (coming from asm.js).
+class MAsmJSUnsignedToFloat32
+: public MUnaryInstruction
+{
+MAsmJSUnsignedToFloat32(MDefinition *def)
+: MUnaryInstruction(def)
+{
+setResultType(MIRType_Float32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(AsmJSUnsignedToFloat32);
+static MAsmJSUnsignedToFloat32 *NewAsmJS(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MAsmJSUnsignedToFloat32(def);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool canProduceFloat32() const { return true; }
+};
+// Converts a primitive (either typed or untyped) to an int32. If the input is
+// not primitive at runtime, a bailout occurs. If the input cannot be converted
+// to an int32 without loss (i.e. "5.5" or undefined) then a bailout occurs.
+class MToInt32
+: public MUnaryInstruction,
+public ToInt32Policy
+{
+bool canBeNegativeZero_;
+MacroAssembler::IntConversionInputKind conversion_;
+MToInt32(MDefinition *def, MacroAssembler::IntConversionInputKind conversion)
+: MUnaryInstruction(def),
+canBeNegativeZero_(true),
+conversion_(conversion)
+{
+setResultType(MIRType_Int32);
+setMovable();
+// An object might have "valueOf", which means it is effectful.
+if (def->mightBeType(MIRType_Object))
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(ToInt32)
+static MToInt32 *New(TempAllocator &alloc, MDefinition *def,
+MacroAssembler::IntConversionInputKind conversion =
+MacroAssembler::IntConversion_Any)
+{
+return new(alloc) MToInt32(def, conversion);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+// this only has backwards information flow.
+void analyzeEdgeCasesBackward();
+bool canBeNegativeZero() const {
+return canBeNegativeZero_;
+}
+void setCanBeNegativeZero(bool negativeZero) {
+canBeNegativeZero_ = negativeZero;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MacroAssembler::IntConversionInputKind conversion() const {
+return conversion_;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const { return true; }
+#endif
+};
+// Converts a value or typed input to a truncated int32, for use with bitwise
+// operations. This is an infallible ValueToECMAInt32.
+class MTruncateToInt32 : public MUnaryInstruction
+{
+MTruncateToInt32(MDefinition *def)
+: MUnaryInstruction(def)
+{
+setResultType(MIRType_Int32);
+setMovable();
+// An object might have "valueOf", which means it is effectful.
+if (def->mightBeType(MIRType_Object))
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(TruncateToInt32)
+static MTruncateToInt32 *New(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MTruncateToInt32(def);
+}
+static MTruncateToInt32 *NewAsmJS(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MTruncateToInt32(def);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+bool isOperandTruncated(size_t index) const;
+# ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+return true;
+}
+#endif
+};
+// Converts any type to a string
+class MToString : public MUnaryInstruction
+{
+MToString(MDefinition *def)
+: MUnaryInstruction(def)
+{
+// Converting an object to a string might be effectful.
+JS_ASSERT(!def->mightBeType(MIRType_Object));
+// NOP
+JS_ASSERT(def->type() != MIRType_String);
+setResultType(MIRType_String);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ToString)
+static MToString *New(TempAllocator &alloc, MDefinition *def)
+{
+return new(alloc) MToString(def);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+JS_ASSERT(!input()->mightBeType(MIRType_Object));
+return AliasSet::None();
+}
+};
+class MBitNot
+: public MUnaryInstruction,
+public BitwisePolicy
+{
+protected:
+MBitNot(MDefinition *input)
+: MUnaryInstruction(input)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(BitNot)
+static MBitNot *New(TempAllocator &alloc, MDefinition *input);
+static MBitNot *NewAsmJS(TempAllocator &alloc, MDefinition *input);
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void infer();
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+if (specialization_ == MIRType_None)
+return AliasSet::Store(AliasSet::Any);
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+class MTypeOf
+: public MUnaryInstruction,
+public BoxInputsPolicy
+{
+MIRType inputType_;
+bool inputMaybeCallableOrEmulatesUndefined_;
+MTypeOf(MDefinition *def, MIRType inputType)
+: MUnaryInstruction(def), inputType_(inputType),
+inputMaybeCallableOrEmulatesUndefined_(true)
+{
+setResultType(MIRType_String);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(TypeOf)
+static MTypeOf *New(TempAllocator &alloc, MDefinition *def, MIRType inputType) {
+return new(alloc) MTypeOf(def, inputType);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MIRType inputType() const {
+return inputType_;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void infer();
+bool inputMaybeCallableOrEmulatesUndefined() const {
+return inputMaybeCallableOrEmulatesUndefined_;
+}
+void markInputNotCallableOrEmulatesUndefined() {
+inputMaybeCallableOrEmulatesUndefined_ = false;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MToId
+: public MBinaryInstruction,
+public BoxInputsPolicy
+{
+MToId(MDefinition *object, MDefinition *index)
+: MBinaryInstruction(object, index)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(ToId)
+static MToId *New(TempAllocator &alloc, MDefinition *object, MDefinition *index) {
+return new(alloc) MToId(object, index);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MBinaryBitwiseInstruction
+: public MBinaryInstruction,
+public BitwisePolicy
+{
+protected:
+MBinaryBitwiseInstruction(MDefinition *left, MDefinition *right)
+: MBinaryInstruction(left, right)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+void specializeAsInt32();
+public:
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+MDefinition *foldUnnecessaryBitop();
+virtual MDefinition *foldIfZero(size_t operand) = 0;
+virtual MDefinition *foldIfNegOne(size_t operand) = 0;
+virtual MDefinition *foldIfEqual()  = 0;
+virtual void infer(BaselineInspector *inspector, jsbytecode *pc);
+bool congruentTo(const MDefinition *ins) const {
+return binaryCongruentTo(ins);
+}
+AliasSet getAliasSet() const {
+if (specialization_ >= MIRType_Object)
+return AliasSet::Store(AliasSet::Any);
+return AliasSet::None();
+}
+bool isOperandTruncated(size_t index) const;
+};
+class MBitAnd : public MBinaryBitwiseInstruction
+{
+MBitAnd(MDefinition *left, MDefinition *right)
+: MBinaryBitwiseInstruction(left, right)
+{ }
+public:
+INSTRUCTION_HEADER(BitAnd)
+static MBitAnd *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MBitAnd *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+return getOperand(operand); // 0 & x => 0;
+}
+MDefinition *foldIfNegOne(size_t operand) {
+return getOperand(1 - operand); // x & -1 => x
+}
+MDefinition *foldIfEqual() {
+return getOperand(0); // x & x => x;
+}
+void computeRange(TempAllocator &alloc);
+};
+class MBitOr : public MBinaryBitwiseInstruction
+{
+MBitOr(MDefinition *left, MDefinition *right)
+: MBinaryBitwiseInstruction(left, right)
+{ }
+public:
+INSTRUCTION_HEADER(BitOr)
+static MBitOr *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MBitOr *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+return getOperand(1 - operand); // 0 | x => x, so if ith is 0, return (1-i)th
+}
+MDefinition *foldIfNegOne(size_t operand) {
+return getOperand(operand); // x | -1 => -1
+}
+MDefinition *foldIfEqual() {
+return getOperand(0); // x | x => x
+}
+void computeRange(TempAllocator &alloc);
+};
+class MBitXor : public MBinaryBitwiseInstruction
+{
+MBitXor(MDefinition *left, MDefinition *right)
+: MBinaryBitwiseInstruction(left, right)
+{ }
+public:
+INSTRUCTION_HEADER(BitXor)
+static MBitXor *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MBitXor *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+return getOperand(1 - operand); // 0 ^ x => x
+}
+MDefinition *foldIfNegOne(size_t operand) {
+return this;
+}
+MDefinition *foldIfEqual() {
+return this;
+}
+void computeRange(TempAllocator &alloc);
+};
+class MShiftInstruction
+: public MBinaryBitwiseInstruction
+{
+protected:
+MShiftInstruction(MDefinition *left, MDefinition *right)
+: MBinaryBitwiseInstruction(left, right)
+{ }
+public:
+MDefinition *foldIfNegOne(size_t operand) {
+return this;
+}
+MDefinition *foldIfEqual() {
+return this;
+}
+virtual void infer(BaselineInspector *inspector, jsbytecode *pc);
+};
+class MLsh : public MShiftInstruction
+{
+MLsh(MDefinition *left, MDefinition *right)
+: MShiftInstruction(left, right)
+{ }
+public:
+INSTRUCTION_HEADER(Lsh)
+static MLsh *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MLsh *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+// 0 << x => 0
+// x << 0 => x
+return getOperand(0);
+}
+void computeRange(TempAllocator &alloc);
+};
+class MRsh : public MShiftInstruction
+{
+MRsh(MDefinition *left, MDefinition *right)
+: MShiftInstruction(left, right)
+{ }
+public:
+INSTRUCTION_HEADER(Rsh)
+static MRsh *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MRsh *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+// 0 >> x => 0
+// x >> 0 => x
+return getOperand(0);
+}
+void computeRange(TempAllocator &alloc);
+};
+class MUrsh : public MShiftInstruction
+{
+bool bailoutsDisabled_;
+MUrsh(MDefinition *left, MDefinition *right)
+: MShiftInstruction(left, right),
+bailoutsDisabled_(false)
+{ }
+public:
+INSTRUCTION_HEADER(Ursh)
+static MUrsh *New(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+static MUrsh *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right);
+MDefinition *foldIfZero(size_t operand) {
+// 0 >>> x => 0
+if (operand == 0)
+return getOperand(0);
+return this;
+}
+void infer(BaselineInspector *inspector, jsbytecode *pc);
+bool bailoutsDisabled() const {
+return bailoutsDisabled_;
+}
+bool fallible() const;
+void computeRange(TempAllocator &alloc);
+void collectRangeInfoPreTrunc();
+};
+class MBinaryArithInstruction
+: public MBinaryInstruction,
+public ArithPolicy
+{
+// Implicit truncate flag is set by the truncate backward range analysis
+// optimization phase, and by asm.js pre-processing. It is used in
+// NeedNegativeZeroCheck to check if the result of a multiplication needs to
+// produce -0 double value, and for avoiding overflow checks.
+// This optimization happens when the multiplication cannot be truncated
+// even if all uses are truncating its result, such as when the range
+// analysis detect a precision loss in the multiplication.
+bool implicitTruncate_;
+void inferFallback(BaselineInspector *inspector, jsbytecode *pc);
+public:
+MBinaryArithInstruction(MDefinition *left, MDefinition *right)
+: MBinaryInstruction(left, right),
+implicitTruncate_(false)
+{
+setMovable();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MIRType specialization() const {
+return specialization_;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+virtual double getIdentity() = 0;
+void infer(TempAllocator &alloc, BaselineInspector *inspector, jsbytecode *pc);
+void setInt32() {
+specialization_ = MIRType_Int32;
+setResultType(MIRType_Int32);
+}
+virtual void trySpecializeFloat32(TempAllocator &alloc);
+bool congruentTo(const MDefinition *ins) const {
+return binaryCongruentTo(ins);
+}
+AliasSet getAliasSet() const {
+if (specialization_ >= MIRType_Object)
+return AliasSet::Store(AliasSet::Any);
+return AliasSet::None();
+}
+bool isTruncated() const {
+return implicitTruncate_;
+}
+void setTruncated(bool truncate) {
+implicitTruncate_ = truncate;
+}
+};
+class MMinMax
+: public MBinaryInstruction,
+public ArithPolicy
+{
+bool isMax_;
+MMinMax(MDefinition *left, MDefinition *right, MIRType type, bool isMax)
+: MBinaryInstruction(left, right),
+isMax_(isMax)
+{
+JS_ASSERT(type == MIRType_Double || type == MIRType_Int32);
+setResultType(type);
+setMovable();
+specialization_ = type;
+}
+public:
+INSTRUCTION_HEADER(MinMax)
+static MMinMax *New(TempAllocator &alloc, MDefinition *left, MDefinition *right, MIRType type,
+bool isMax)
+{
+return new(alloc) MMinMax(left, right, type, isMax);
+}
+bool isMax() const {
+return isMax_;
+}
+MIRType specialization() const {
+return specialization_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isMinMax())
+return false;
+if (isMax() != ins->toMinMax()->isMax())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+class MAbs
+: public MUnaryInstruction,
+public ArithPolicy
+{
+bool implicitTruncate_;
+MAbs(MDefinition *num, MIRType type)
+: MUnaryInstruction(num),
+implicitTruncate_(false)
+{
+JS_ASSERT(IsNumberType(type));
+setResultType(type);
+setMovable();
+specialization_ = type;
+}
+public:
+INSTRUCTION_HEADER(Abs)
+static MAbs *New(TempAllocator &alloc, MDefinition *num, MIRType type) {
+return new(alloc) MAbs(num, type);
+}
+static MAbs *NewAsmJS(TempAllocator &alloc, MDefinition *num, MIRType type) {
+MAbs *ins = new(alloc) MAbs(num, type);
+if (type == MIRType_Int32)
+ins->implicitTruncate_ = true;
+return ins;
+}
+MDefinition *num() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+bool fallible() const;
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+bool isFloat32Commutative() const { return true; }
+void trySpecializeFloat32(TempAllocator &alloc);
+};
+// Inline implementation of Math.sqrt().
+class MSqrt
+: public MUnaryInstruction,
+public FloatingPointPolicy<0>
+{
+MSqrt(MDefinition *num, MIRType type)
+: MUnaryInstruction(num)
+{
+setResultType(type);
+setPolicyType(type);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Sqrt)
+static MSqrt *New(TempAllocator &alloc, MDefinition *num) {
+return new(alloc) MSqrt(num, MIRType_Double);
+}
+static MSqrt *NewAsmJS(TempAllocator &alloc, MDefinition *num, MIRType type) {
+JS_ASSERT(IsFloatingPointType(type));
+return new(alloc) MSqrt(num, type);
+}
+MDefinition *num() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+bool isFloat32Commutative() const { return true; }
+void trySpecializeFloat32(TempAllocator &alloc);
+};
+// Inline implementation of atan2 (arctangent of y/x).
+class MAtan2
+: public MBinaryInstruction,
+public MixPolicy<DoublePolicy<0>, DoublePolicy<1> >
+{
+MAtan2(MDefinition *y, MDefinition *x)
+: MBinaryInstruction(y, x)
+{
+setResultType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Atan2)
+static MAtan2 *New(TempAllocator &alloc, MDefinition *y, MDefinition *x) {
+return new(alloc) MAtan2(y, x);
+}
+MDefinition *y() const {
+return getOperand(0);
+}
+MDefinition *x() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Inline implementation of Math.hypot().
+class MHypot
+: public MBinaryInstruction,
+public MixPolicy<DoublePolicy<0>, DoublePolicy<1> >
+{
+MHypot(MDefinition *y, MDefinition *x)
+: MBinaryInstruction(x, y)
+{
+setResultType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Hypot)
+static MHypot *New(TempAllocator &alloc, MDefinition *x, MDefinition *y) {
+return new(alloc) MHypot(y, x);
+}
+MDefinition *x() const {
+return getOperand(0);
+}
+MDefinition *y() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Inline implementation of Math.pow().
+class MPow
+: public MBinaryInstruction,
+public PowPolicy
+{
+MPow(MDefinition *input, MDefinition *power, MIRType powerType)
+: MBinaryInstruction(input, power),
+PowPolicy(powerType)
+{
+setResultType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Pow)
+static MPow *New(TempAllocator &alloc, MDefinition *input, MDefinition *power,
+MIRType powerType)
+{
+JS_ASSERT(powerType == MIRType_Double || powerType == MIRType_Int32);
+return new(alloc) MPow(input, power, powerType);
+}
+MDefinition *input() const {
+return lhs();
+}
+MDefinition *power() const {
+return rhs();
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Inline implementation of Math.pow(x, 0.5), which subtly differs from Math.sqrt(x).
+class MPowHalf
+: public MUnaryInstruction,
+public DoublePolicy<0>
+{
+bool operandIsNeverNegativeInfinity_;
+bool operandIsNeverNegativeZero_;
+bool operandIsNeverNaN_;
+MPowHalf(MDefinition *input)
+: MUnaryInstruction(input),
+operandIsNeverNegativeInfinity_(false),
+operandIsNeverNegativeZero_(false),
+operandIsNeverNaN_(false)
+{
+setResultType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(PowHalf)
+static MPowHalf *New(TempAllocator &alloc, MDefinition *input) {
+return new(alloc) MPowHalf(input);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+bool operandIsNeverNegativeInfinity() const {
+return operandIsNeverNegativeInfinity_;
+}
+bool operandIsNeverNegativeZero() const {
+return operandIsNeverNegativeZero_;
+}
+bool operandIsNeverNaN() const {
+return operandIsNeverNaN_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void collectRangeInfoPreTrunc();
+};
+// Inline implementation of Math.random().
+class MRandom : public MNullaryInstruction
+{
+MRandom()
+{
+setResultType(MIRType_Double);
+}
+public:
+INSTRUCTION_HEADER(Random)
+static MRandom *New(TempAllocator &alloc) {
+return new(alloc) MRandom;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+void computeRange(TempAllocator &alloc);
+};
+class MMathFunction
+: public MUnaryInstruction,
+public FloatingPointPolicy<0>
+{
+public:
+enum Function {
+Log,
+Sin,
+Cos,
+Exp,
+Tan,
+ACos,
+ASin,
+ATan,
+Log10,
+Log2,
+Log1P,
+ExpM1,
+CosH,
+SinH,
+TanH,
+ACosH,
+ASinH,
+ATanH,
+Sign,
+Trunc,
+Cbrt,
+Floor,
+Ceil,
+Round
+};
+private:
+Function function_;
+const MathCache *cache_;
+MMathFunction(MDefinition *input, Function function, const MathCache *cache)
+: MUnaryInstruction(input), function_(function), cache_(cache)
+{
+setResultType(MIRType_Double);
+setPolicyType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(MathFunction)
+// A nullptr cache means this function will neither access nor update the cache.
+static MMathFunction *New(TempAllocator &alloc, MDefinition *input, Function function,
+const MathCache *cache)
+{
+return new(alloc) MMathFunction(input, function, cache);
+}
+Function function() const {
+return function_;
+}
+const MathCache *cache() const {
+return cache_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isMathFunction())
+return false;
+if (ins->toMathFunction()->function() != function())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+void printOpcode(FILE *fp) const;
+static const char *FunctionName(Function function);
+bool isFloat32Commutative() const {
+return function_ == Floor || function_ == Ceil || function_ == Round;
+}
+void trySpecializeFloat32(TempAllocator &alloc);
+void computeRange(TempAllocator &alloc);
+};
+class MAdd : public MBinaryArithInstruction
+{
+// Is this instruction really an int at heart?
+MAdd(MDefinition *left, MDefinition *right)
+: MBinaryArithInstruction(left, right)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(Add)
+static MAdd *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MAdd(left, right);
+}
+static MAdd *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right,
+MIRType type)
+{
+MAdd *add = new(alloc) MAdd(left, right);
+add->specialization_ = type;
+add->setResultType(type);
+if (type == MIRType_Int32) {
+add->setTruncated(true);
+add->setCommutative();
+}
+return add;
+}
+bool isFloat32Commutative() const { return true; }
+double getIdentity() {
+return 0;
+}
+bool fallible() const;
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool isOperandTruncated(size_t index) const;
+};
+class MSub : public MBinaryArithInstruction
+{
+MSub(MDefinition *left, MDefinition *right)
+: MBinaryArithInstruction(left, right)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(Sub)
+static MSub *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MSub(left, right);
+}
+static MSub *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right,
+MIRType type)
+{
+MSub *sub = new(alloc) MSub(left, right);
+sub->specialization_ = type;
+sub->setResultType(type);
+if (type == MIRType_Int32)
+sub->setTruncated(true);
+return sub;
+}
+double getIdentity() {
+return 0;
+}
+bool isFloat32Commutative() const { return true; }
+bool fallible() const;
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool isOperandTruncated(size_t index) const;
+};
+class MMul : public MBinaryArithInstruction
+{
+public:
+enum Mode {
+Normal,
+Integer
+};
+private:
+// Annotation the result could be a negative zero
+// and we need to guard this during execution.
+bool canBeNegativeZero_;
+Mode mode_;
+MMul(MDefinition *left, MDefinition *right, MIRType type, Mode mode)
+: MBinaryArithInstruction(left, right),
+canBeNegativeZero_(true),
+mode_(mode)
+{
+if (mode == Integer) {
+// This implements the required behavior for Math.imul, which
+// can never fail and always truncates its output to int32.
+canBeNegativeZero_ = false;
+setTruncated(true);
+setCommutative();
+}
+JS_ASSERT_IF(mode != Integer, mode == Normal);
+if (type != MIRType_Value)
+specialization_ = type;
+setResultType(type);
+}
+public:
+INSTRUCTION_HEADER(Mul)
+static MMul *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MMul(left, right, MIRType_Value, MMul::Normal);
+}
+static MMul *New(TempAllocator &alloc, MDefinition *left, MDefinition *right, MIRType type,
+Mode mode = Normal)
+{
+return new(alloc) MMul(left, right, type, mode);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void analyzeEdgeCasesForward();
+void analyzeEdgeCasesBackward();
+double getIdentity() {
+return 1;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isMul())
+return false;
+const MMul *mul = ins->toMul();
+if (canBeNegativeZero_ != mul->canBeNegativeZero())
+return false;
+if (mode_ != mul->mode())
+return false;
+return binaryCongruentTo(ins);
+}
+bool canOverflow() const;
+bool canBeNegativeZero() const {
+return canBeNegativeZero_;
+}
+void setCanBeNegativeZero(bool negativeZero) {
+canBeNegativeZero_ = negativeZero;
+}
+bool updateForReplacement(MDefinition *ins);
+bool fallible() const {
+return canBeNegativeZero_ || canOverflow();
+}
+void setSpecialization(MIRType type) {
+specialization_ = type;
+}
+bool isFloat32Commutative() const { return true; }
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool isOperandTruncated(size_t index) const;
+Mode mode() const { return mode_; }
+};
+class MDiv : public MBinaryArithInstruction
+{
+bool canBeNegativeZero_;
+bool canBeNegativeOverflow_;
+bool canBeDivideByZero_;
+bool canBeNegativeDividend_;
+bool unsigned_;
+// A Division can be truncated in 4 differents ways:
+//   1. Ignore Infinities (x / 0 --> 0).
+//   2. Ignore overflow (INT_MIN / -1 == (INT_MAX + 1) --> INT_MIN)
+//   3. Ignore negative zeros. (-0 --> 0)
+//   4. Ignore remainder. (3 / 4 --> 0)
+//
+// isTruncatedIndirectly is used to represent that we are interested in the
+// truncated result, but only if they it can safely flow in operations which
+// are computed modulo 2^32, such as (2) and (3).
+//
+// A division can return either Infinities (1) or a remainder (4) when both
+// operands are integers. Infinities are not safe, as they would have
+// absorbed other math operations. Remainders are not safe, as multiple can
+// add up to integers. This implies that we need to distinguish between a
+// division which is truncated directly (isTruncated) or which flow into
+// truncated operations (isTruncatedIndirectly).
+bool isTruncatedIndirectly_;
+MDiv(MDefinition *left, MDefinition *right, MIRType type)
+: MBinaryArithInstruction(left, right),
+canBeNegativeZero_(true),
+canBeNegativeOverflow_(true),
+canBeDivideByZero_(true),
+canBeNegativeDividend_(true),
+unsigned_(false),
+isTruncatedIndirectly_(false)
+{
+if (type != MIRType_Value)
+specialization_ = type;
+setResultType(type);
+}
+public:
+INSTRUCTION_HEADER(Div)
+static MDiv *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MDiv(left, right, MIRType_Value);
+}
+static MDiv *New(TempAllocator &alloc, MDefinition *left, MDefinition *right, MIRType type) {
+return new(alloc) MDiv(left, right, type);
+}
+static MDiv *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right,
+MIRType type, bool unsignd)
+{
+MDiv *div = new(alloc) MDiv(left, right, type);
+div->unsigned_ = unsignd;
+if (type == MIRType_Int32)
+div->setTruncated(true);
+return div;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void analyzeEdgeCasesForward();
+void analyzeEdgeCasesBackward();
+double getIdentity() {
+MOZ_ASSUME_UNREACHABLE("not used");
+}
+bool canBeNegativeZero() const {
+return canBeNegativeZero_;
+}
+void setCanBeNegativeZero(bool negativeZero) {
+canBeNegativeZero_ = negativeZero;
+}
+bool canBeNegativeOverflow() const {
+return canBeNegativeOverflow_;
+}
+bool canBeDivideByZero() const {
+return canBeDivideByZero_;
+}
+bool canBeNegativeDividend() const {
+return canBeNegativeDividend_;
+}
+bool isUnsigned() const {
+return unsigned_;
+}
+bool isTruncatedIndirectly() const {
+return isTruncatedIndirectly_;
+}
+void setTruncatedIndirectly(bool truncate) {
+isTruncatedIndirectly_ = truncate;
+}
+bool canTruncateInfinities() const {
+return isTruncated();
+}
+bool canTruncateRemainder() const {
+return isTruncated();
+}
+bool canTruncateOverflow() const {
+return isTruncated() || isTruncatedIndirectly();
+}
+bool canTruncateNegativeZero() const {
+return isTruncated() || isTruncatedIndirectly();
+}
+bool isFloat32Commutative() const { return true; }
+void computeRange(TempAllocator &alloc);
+bool fallible() const;
+bool truncate();
+void collectRangeInfoPreTrunc();
+};
+class MMod : public MBinaryArithInstruction
+{
+bool unsigned_;
+bool canBeNegativeDividend_;
+MMod(MDefinition *left, MDefinition *right, MIRType type)
+: MBinaryArithInstruction(left, right),
+unsigned_(false),
+canBeNegativeDividend_(true)
+{
+if (type != MIRType_Value)
+specialization_ = type;
+setResultType(type);
+}
+public:
+INSTRUCTION_HEADER(Mod)
+static MMod *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MMod(left, right, MIRType_Value);
+}
+static MMod *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right,
+MIRType type, bool unsignd)
+{
+MMod *mod = new(alloc) MMod(left, right, type);
+mod->unsigned_ = unsignd;
+if (type == MIRType_Int32)
+mod->setTruncated(true);
+return mod;
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+double getIdentity() {
+MOZ_ASSUME_UNREACHABLE("not used");
+}
+bool canBeNegativeDividend() const {
+JS_ASSERT(specialization_ == MIRType_Int32);
+return canBeNegativeDividend_;
+}
+bool canBeDivideByZero() const;
+bool canBePowerOfTwoDivisor() const;
+bool isUnsigned() const {
+return unsigned_;
+}
+bool fallible() const;
+void computeRange(TempAllocator &alloc);
+bool truncate();
+void collectRangeInfoPreTrunc();
+};
+class MConcat
+: public MBinaryInstruction,
+public MixPolicy<ConvertToStringPolicy<0>, ConvertToStringPolicy<1>>
+{
+MConcat(MDefinition *left, MDefinition *right)
+: MBinaryInstruction(left, right)
+{
+// At least one input should be definitely string
+JS_ASSERT(left->type() == MIRType_String || right->type() == MIRType_String);
+setMovable();
+setResultType(MIRType_String);
+}
+public:
+INSTRUCTION_HEADER(Concat)
+static MConcat *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MConcat(left, right);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MConcatPar
+: public MTernaryInstruction
+{
+MConcatPar(MDefinition *cx, MDefinition *left, MDefinition *right)
+: MTernaryInstruction(cx, left, right)
+{
+// Type analysis has already run, before replacing with the parallel
+// variant.
+JS_ASSERT(left->type() == MIRType_String && right->type() == MIRType_String);
+setMovable();
+setResultType(MIRType_String);
+}
+public:
+INSTRUCTION_HEADER(ConcatPar)
+static MConcatPar *New(TempAllocator &alloc, MDefinition *cx, MConcat *concat) {
+return new(alloc) MConcatPar(cx, concat->lhs(), concat->rhs());
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *lhs() const {
+return getOperand(1);
+}
+MDefinition *rhs() const {
+return getOperand(2);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MCharCodeAt
+: public MBinaryInstruction,
+public MixPolicy<StringPolicy<0>, IntPolicy<1> >
+{
+MCharCodeAt(MDefinition *str, MDefinition *index)
+: MBinaryInstruction(str, index)
+{
+setMovable();
+setResultType(MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(CharCodeAt)
+static MCharCodeAt *New(TempAllocator &alloc, MDefinition *str, MDefinition *index) {
+return new(alloc) MCharCodeAt(str, index);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+virtual AliasSet getAliasSet() const {
+// Strings are immutable, so there is no implicit dependency.
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+class MFromCharCode
+: public MUnaryInstruction,
+public IntPolicy<0>
+{
+MFromCharCode(MDefinition *code)
+: MUnaryInstruction(code)
+{
+setMovable();
+setResultType(MIRType_String);
+}
+public:
+INSTRUCTION_HEADER(FromCharCode)
+static MFromCharCode *New(TempAllocator &alloc, MDefinition *code) {
+return new(alloc) MFromCharCode(code);
+}
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MStringSplit
+: public MBinaryInstruction,
+public MixPolicy<StringPolicy<0>, StringPolicy<1> >
+{
+types::TypeObject *typeObject_;
+MStringSplit(types::CompilerConstraintList *constraints, MDefinition *string, MDefinition *sep,
+JSObject *templateObject)
+: MBinaryInstruction(string, sep),
+typeObject_(templateObject->type())
+{
+setResultType(MIRType_Object);
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+}
+public:
+INSTRUCTION_HEADER(StringSplit)
+static MStringSplit *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MDefinition *string, MDefinition *sep,
+JSObject *templateObject)
+{
+return new(alloc) MStringSplit(constraints, string, sep, templateObject);
+}
+types::TypeObject *typeObject() const {
+return typeObject_;
+}
+MDefinition *string() const {
+return getOperand(0);
+}
+MDefinition *separator() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+virtual AliasSet getAliasSet() const {
+// Although this instruction returns a new array, we don't have to mark
+// it as store instruction, see also MNewArray.
+return AliasSet::None();
+}
+};
+// Returns an object to use as |this| value. See also ComputeThis and
+// BoxNonStrictThis in Interpreter.h.
+class MComputeThis
+: public MUnaryInstruction,
+public BoxPolicy<0>
+{
+MComputeThis(MDefinition *def)
+: MUnaryInstruction(def)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(ComputeThis)
+static MComputeThis *New(TempAllocator &alloc, MDefinition *def) {
+return new(alloc) MComputeThis(def);
+}
+MDefinition *input() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+// Note: don't override getAliasSet: the thisObject hook can be
+// effectful.
+};
+// Load an arrow function's |this| value.
+class MLoadArrowThis
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MLoadArrowThis(MDefinition *callee)
+: MUnaryInstruction(callee)
+{
+setResultType(MIRType_Value);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(LoadArrowThis)
+static MLoadArrowThis *New(TempAllocator &alloc, MDefinition *callee) {
+return new(alloc) MLoadArrowThis(callee);
+}
+MDefinition *callee() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+// An arrow function's lexical |this| value is immutable.
+return AliasSet::None();
+}
+};
+class MPhi MOZ_FINAL : public MDefinition, public InlineForwardListNode<MPhi>
+{
+js::Vector<MUse, 2, IonAllocPolicy> inputs_;
+uint32_t slot_;
+bool hasBackedgeType_;
+bool triedToSpecialize_;
+bool isIterator_;
+bool canProduceFloat32_;
+bool canConsumeFloat32_;
+#if DEBUG
+bool specialized_;
+uint32_t capacity_;
+#endif
+protected:
+MUse *getUseFor(size_t index) {
+return &inputs_[index];
+}
+public:
+INSTRUCTION_HEADER(Phi)
+MPhi(TempAllocator &alloc, uint32_t slot, MIRType resultType)
+: inputs_(alloc),
+slot_(slot),
+hasBackedgeType_(false),
+triedToSpecialize_(false),
+isIterator_(false),
+canProduceFloat32_(false),
+canConsumeFloat32_(false)
+#if DEBUG
+, specialized_(false)
+, capacity_(0)
+#endif
+{
+setResultType(resultType);
+}
+static MPhi *New(TempAllocator &alloc, uint32_t slot, MIRType resultType = MIRType_Value) {
+return new(alloc) MPhi(alloc, slot, resultType);
+}
+void setOperand(size_t index, MDefinition *operand) {
+// Note: after the initial IonBuilder pass, it is OK to change phi
+// operands such that they do not include the type sets of their
+// operands. This can arise during e.g. value numbering, where
+// definitions producing the same value may have different type sets.
+JS_ASSERT(index < numOperands());
+inputs_[index].set(operand, this, index);
+operand->addUse(&inputs_[index]);
+}
+void removeOperand(size_t index);
+MDefinition *getOperand(size_t index) const {
+return inputs_[index].producer();
+}
+size_t numOperands() const {
+return inputs_.length();
+}
+uint32_t slot() const {
+return slot_;
+}
+bool hasBackedgeType() const {
+return hasBackedgeType_;
+}
+bool triedToSpecialize() const {
+return triedToSpecialize_;
+}
+void specialize(MIRType type) {
+triedToSpecialize_ = true;
+setResultType(type);
+}
+bool specializeType();
+// Whether this phi's type already includes information for def.
+bool typeIncludes(MDefinition *def);
+// Add types for this phi which speculate about new inputs that may come in
+// via a loop backedge.
+bool addBackedgeType(MIRType type, types::TemporaryTypeSet *typeSet);
+// Initializes the operands vector to the given capacity,
+// permitting use of addInput() instead of addInputSlow().
+bool reserveLength(size_t length);
+// Use only if capacity has been reserved by reserveLength
+void addInput(MDefinition *ins);
+// Appends a new input to the input vector. May call realloc_().
+// Prefer reserveLength() and addInput() instead, where possible.
+bool addInputSlow(MDefinition *ins, bool *ptypeChange = nullptr);
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+bool congruentTo(const MDefinition *ins) const;
+bool isIterator() const {
+return isIterator_;
+}
+void setIterator() {
+isIterator_ = true;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+MDefinition *operandIfRedundant() {
+// If this phi is redundant (e.g., phi(a,a) or b=phi(a,this)),
+// returns the operand that it will always be equal to (a, in
+// those two cases).
+MDefinition *first = getOperand(0);
+for (size_t i = 1, e = numOperands(); i < e; i++) {
+if (getOperand(i) != first && getOperand(i) != this)
+return nullptr;
+}
+return first;
+}
+bool canProduceFloat32() const {
+return canProduceFloat32_;
+}
+void setCanProduceFloat32(bool can) {
+canProduceFloat32_ = can;
+}
+bool canConsumeFloat32(MUse *use) const {
+return canConsumeFloat32_;
+}
+void setCanConsumeFloat32(bool can) {
+canConsumeFloat32_ = can;
+}
+};
+// The goal of a Beta node is to split a def at a conditionally taken
+// branch, so that uses dominated by it have a different name.
+class MBeta : public MUnaryInstruction
+{
+private:
+// This is the range induced by a comparison and branch in a preceding
+// block. Note that this does not reflect any range constraints from
+// the input value itself, so this value may differ from the range()
+// range after it is computed.
+const Range *comparison_;
+MBeta(MDefinition *val, const Range *comp)
+: MUnaryInstruction(val),
+comparison_(comp)
+{
+setResultType(val->type());
+setResultTypeSet(val->resultTypeSet());
+}
+public:
+INSTRUCTION_HEADER(Beta)
+void printOpcode(FILE *fp) const;
+static MBeta *New(TempAllocator &alloc, MDefinition *val, const Range *comp)
+{
+return new(alloc) MBeta(val, comp);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+// MIR representation of a Value on the OSR BaselineFrame.
+// The Value is indexed off of OsrFrameReg.
+class MOsrValue : public MUnaryInstruction
+{
+private:
+ptrdiff_t frameOffset_;
+MOsrValue(MOsrEntry *entry, ptrdiff_t frameOffset)
+: MUnaryInstruction(entry),
+frameOffset_(frameOffset)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(OsrValue)
+static MOsrValue *New(TempAllocator &alloc, MOsrEntry *entry, ptrdiff_t frameOffset) {
+return new(alloc) MOsrValue(entry, frameOffset);
+}
+ptrdiff_t frameOffset() const {
+return frameOffset_;
+}
+MOsrEntry *entry() {
+return getOperand(0)->toOsrEntry();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// MIR representation of a JSObject scope chain pointer on the OSR BaselineFrame.
+// The pointer is indexed off of OsrFrameReg.
+class MOsrScopeChain : public MUnaryInstruction
+{
+private:
+MOsrScopeChain(MOsrEntry *entry)
+: MUnaryInstruction(entry)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(OsrScopeChain)
+static MOsrScopeChain *New(TempAllocator &alloc, MOsrEntry *entry) {
+return new(alloc) MOsrScopeChain(entry);
+}
+MOsrEntry *entry() {
+return getOperand(0)->toOsrEntry();
+}
+};
+// MIR representation of a JSObject ArgumentsObject pointer on the OSR BaselineFrame.
+// The pointer is indexed off of OsrFrameReg.
+class MOsrArgumentsObject : public MUnaryInstruction
+{
+private:
+MOsrArgumentsObject(MOsrEntry *entry)
+: MUnaryInstruction(entry)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(OsrArgumentsObject)
+static MOsrArgumentsObject *New(TempAllocator &alloc, MOsrEntry *entry) {
+return new(alloc) MOsrArgumentsObject(entry);
+}
+MOsrEntry *entry() {
+return getOperand(0)->toOsrEntry();
+}
+};
+// MIR representation of the return value on the OSR BaselineFrame.
+// The Value is indexed off of OsrFrameReg.
+class MOsrReturnValue : public MUnaryInstruction
+{
+private:
+MOsrReturnValue(MOsrEntry *entry)
+: MUnaryInstruction(entry)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(OsrReturnValue)
+static MOsrReturnValue *New(TempAllocator &alloc, MOsrEntry *entry) {
+return new(alloc) MOsrReturnValue(entry);
+}
+MOsrEntry *entry() {
+return getOperand(0)->toOsrEntry();
+}
+};
+// Check the current frame for over-recursion past the global stack limit.
+class MCheckOverRecursed : public MNullaryInstruction
+{
+public:
+INSTRUCTION_HEADER(CheckOverRecursed)
+static MCheckOverRecursed *New(TempAllocator &alloc) {
+return new(alloc) MCheckOverRecursed();
+}
+};
+// Check the current frame for over-recursion past the global stack limit.
+// Uses the per-thread recursion limit.
+class MCheckOverRecursedPar : public MUnaryInstruction
+{
+MCheckOverRecursedPar(MDefinition *cx)
+: MUnaryInstruction(cx)
+{
+setResultType(MIRType_None);
+setGuard();
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(CheckOverRecursedPar);
+static MCheckOverRecursedPar *New(TempAllocator &alloc, MDefinition *cx) {
+return new(alloc) MCheckOverRecursedPar(cx);
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+};
+// Check for an interrupt (or rendezvous) in parallel mode.
+class MInterruptCheckPar : public MUnaryInstruction
+{
+MInterruptCheckPar(MDefinition *cx)
+: MUnaryInstruction(cx)
+{
+setResultType(MIRType_None);
+setGuard();
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(InterruptCheckPar);
+static MInterruptCheckPar *New(TempAllocator &alloc, MDefinition *cx) {
+return new(alloc) MInterruptCheckPar(cx);
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+};
+// Check whether we need to fire the interrupt handler.
+class MInterruptCheck : public MNullaryInstruction
+{
+MInterruptCheck() {
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(InterruptCheck)
+static MInterruptCheck *New(TempAllocator &alloc) {
+return new(alloc) MInterruptCheck();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// If not defined, set a global variable to |undefined|.
+class MDefVar : public MUnaryInstruction
+{
+CompilerRootPropertyName name_; // Target name to be defined.
+unsigned attrs_; // Attributes to be set.
+private:
+MDefVar(PropertyName *name, unsigned attrs, MDefinition *scopeChain)
+: MUnaryInstruction(scopeChain),
+name_(name),
+attrs_(attrs)
+{
+}
+public:
+INSTRUCTION_HEADER(DefVar)
+static MDefVar *New(TempAllocator &alloc, PropertyName *name, unsigned attrs,
+MDefinition *scopeChain)
+{
+return new(alloc) MDefVar(name, attrs, scopeChain);
+}
+PropertyName *name() const {
+return name_;
+}
+unsigned attrs() const {
+return attrs_;
+}
+MDefinition *scopeChain() const {
+return getOperand(0);
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MDefFun : public MUnaryInstruction
+{
+CompilerRootFunction fun_;
+private:
+MDefFun(JSFunction *fun, MDefinition *scopeChain)
+: MUnaryInstruction(scopeChain),
+fun_(fun)
+{}
+public:
+INSTRUCTION_HEADER(DefFun)
+static MDefFun *New(TempAllocator &alloc, JSFunction *fun, MDefinition *scopeChain) {
+return new(alloc) MDefFun(fun, scopeChain);
+}
+JSFunction *fun() const {
+return fun_;
+}
+MDefinition *scopeChain() const {
+return getOperand(0);
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MRegExp : public MNullaryInstruction
+{
+CompilerRoot<RegExpObject *> source_;
+bool mustClone_;
+MRegExp(types::CompilerConstraintList *constraints, RegExpObject *source, bool mustClone)
+: source_(source),
+mustClone_(mustClone)
+{
+setResultType(MIRType_Object);
+setResultTypeSet(MakeSingletonTypeSet(constraints, source));
+}
+public:
+INSTRUCTION_HEADER(RegExp)
+static MRegExp *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+RegExpObject *source, bool mustClone)
+{
+return new(alloc) MRegExp(constraints, source, mustClone);
+}
+bool mustClone() const {
+return mustClone_;
+}
+RegExpObject *source() const {
+return source_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MRegExpExec
+: public MBinaryInstruction,
+public MixPolicy<ConvertToStringPolicy<0>, ObjectPolicy<1>>
+{
+private:
+MRegExpExec(MDefinition *regexp, MDefinition *string)
+: MBinaryInstruction(string, regexp)
+{
+// May be object or null.
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(RegExpExec)
+static MRegExpExec *New(TempAllocator &alloc, MDefinition *regexp, MDefinition *string) {
+return new(alloc) MRegExpExec(regexp, string);
+}
+MDefinition *string() const {
+return getOperand(0);
+}
+MDefinition *regexp() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MRegExpTest
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<1>, ConvertToStringPolicy<0> >
+{
+private:
+MRegExpTest(MDefinition *regexp, MDefinition *string)
+: MBinaryInstruction(string, regexp)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(RegExpTest)
+static MRegExpTest *New(TempAllocator &alloc, MDefinition *regexp, MDefinition *string) {
+return new(alloc) MRegExpTest(regexp, string);
+}
+MDefinition *string() const {
+return getOperand(0);
+}
+MDefinition *regexp() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+template <class Policy1>
+class MStrReplace
+: public MTernaryInstruction,
+public Mix3Policy<StringPolicy<0>, Policy1, StringPolicy<2> >
+{
+protected:
+MStrReplace(MDefinition *string, MDefinition *pattern, MDefinition *replacement)
+: MTernaryInstruction(string, pattern, replacement)
+{
+setMovable();
+setResultType(MIRType_String);
+}
+public:
+MDefinition *string() const {
+return getOperand(0);
+}
+MDefinition *pattern() const {
+return getOperand(1);
+}
+MDefinition *replacement() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MRegExpReplace
+: public MStrReplace< ObjectPolicy<1> >
+{
+private:
+MRegExpReplace(MDefinition *string, MDefinition *pattern, MDefinition *replacement)
+: MStrReplace< ObjectPolicy<1> >(string, pattern, replacement)
+{
+}
+public:
+INSTRUCTION_HEADER(RegExpReplace);
+static MRegExpReplace *New(TempAllocator &alloc, MDefinition *string, MDefinition *pattern, MDefinition *replacement) {
+return new(alloc) MRegExpReplace(string, pattern, replacement);
+}
+};
+class MStringReplace
+: public MStrReplace< StringPolicy<1> >
+{
+private:
+MStringReplace(MDefinition *string, MDefinition *pattern, MDefinition *replacement)
+: MStrReplace< StringPolicy<1> >(string, pattern, replacement)
+{
+}
+public:
+INSTRUCTION_HEADER(StringReplace);
+static MStringReplace *New(TempAllocator &alloc, MDefinition *string, MDefinition *pattern, MDefinition *replacement) {
+return new(alloc) MStringReplace(string, pattern, replacement);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+struct LambdaFunctionInfo
+{
+// The functions used in lambdas are the canonical original function in
+// the script, and are immutable except for delazification. Record this
+// information while still on the main thread to avoid races.
+CompilerRootFunction fun;
+uint16_t flags;
+gc::Cell *scriptOrLazyScript;
+bool singletonType;
+bool useNewTypeForClone;
+LambdaFunctionInfo(JSFunction *fun)
+: fun(fun), flags(fun->flags()),
+scriptOrLazyScript(fun->hasScript()
+? (gc::Cell *) fun->nonLazyScript()
+: (gc::Cell *) fun->lazyScript()),
+singletonType(fun->hasSingletonType()),
+useNewTypeForClone(types::UseNewTypeForClone(fun))
+{}
+LambdaFunctionInfo(const LambdaFunctionInfo &info)
+: fun((JSFunction *) info.fun), flags(info.flags),
+scriptOrLazyScript(info.scriptOrLazyScript),
+singletonType(info.singletonType),
+useNewTypeForClone(info.useNewTypeForClone)
+{}
+};
+class MLambda
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+LambdaFunctionInfo info_;
+MLambda(types::CompilerConstraintList *constraints, MDefinition *scopeChain, JSFunction *fun)
+: MUnaryInstruction(scopeChain), info_(fun)
+{
+setResultType(MIRType_Object);
+if (!fun->hasSingletonType() && !types::UseNewTypeForClone(fun))
+setResultTypeSet(MakeSingletonTypeSet(constraints, fun));
+}
+public:
+INSTRUCTION_HEADER(Lambda)
+static MLambda *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MDefinition *scopeChain, JSFunction *fun)
+{
+return new(alloc) MLambda(constraints, scopeChain, fun);
+}
+MDefinition *scopeChain() const {
+return getOperand(0);
+}
+const LambdaFunctionInfo &info() const {
+return info_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MLambdaArrow
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+LambdaFunctionInfo info_;
+MLambdaArrow(types::CompilerConstraintList *constraints, MDefinition *scopeChain,
+MDefinition *this_, JSFunction *fun)
+: MBinaryInstruction(scopeChain, this_), info_(fun)
+{
+setResultType(MIRType_Object);
+MOZ_ASSERT(!types::UseNewTypeForClone(fun));
+if (!fun->hasSingletonType())
+setResultTypeSet(MakeSingletonTypeSet(constraints, fun));
+}
+public:
+INSTRUCTION_HEADER(LambdaArrow)
+static MLambdaArrow *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MDefinition *scopeChain, MDefinition *this_, JSFunction *fun)
+{
+return new(alloc) MLambdaArrow(constraints, scopeChain, this_, fun);
+}
+MDefinition *scopeChain() const {
+return getOperand(0);
+}
+MDefinition *thisDef() const {
+return getOperand(1);
+}
+const LambdaFunctionInfo &info() const {
+return info_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MLambdaPar
+: public MBinaryInstruction,
+public SingleObjectPolicy
+{
+LambdaFunctionInfo info_;
+MLambdaPar(MDefinition *cx, MDefinition *scopeChain, JSFunction *fun,
+types::TemporaryTypeSet *resultTypes, const LambdaFunctionInfo &info)
+: MBinaryInstruction(cx, scopeChain), info_(info)
+{
+JS_ASSERT(!info_.singletonType);
+JS_ASSERT(!info_.useNewTypeForClone);
+setResultType(MIRType_Object);
+setResultTypeSet(resultTypes);
+}
+public:
+INSTRUCTION_HEADER(LambdaPar);
+static MLambdaPar *New(TempAllocator &alloc, MDefinition *cx, MLambda *lambda) {
+return new(alloc) MLambdaPar(cx, lambda->scopeChain(), lambda->info().fun,
+lambda->resultTypeSet(), lambda->info());
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *scopeChain() const {
+return getOperand(1);
+}
+const LambdaFunctionInfo &info() const {
+return info_;
+}
+};
+// Determines the implicit |this| value for function calls.
+class MImplicitThis
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MImplicitThis(MDefinition *callee)
+: MUnaryInstruction(callee)
+{
+setResultType(MIRType_Value);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ImplicitThis)
+static MImplicitThis *New(TempAllocator &alloc, MDefinition *callee) {
+return new(alloc) MImplicitThis(callee);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *callee() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Returns obj->slots.
+class MSlots
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MSlots(MDefinition *object)
+: MUnaryInstruction(object)
+{
+setResultType(MIRType_Slots);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Slots)
+static MSlots *New(TempAllocator &alloc, MDefinition *object) {
+return new(alloc) MSlots(object);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Returns obj->elements.
+class MElements
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MElements(MDefinition *object)
+: MUnaryInstruction(object)
+{
+setResultType(MIRType_Elements);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Elements)
+static MElements *New(TempAllocator &alloc, MDefinition *object) {
+return new(alloc) MElements(object);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// A constant value for some object's array elements or typed array elements.
+class MConstantElements : public MNullaryInstruction
+{
+void *value_;
+protected:
+MConstantElements(void *v)
+: value_(v)
+{
+setResultType(MIRType_Elements);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ConstantElements)
+static MConstantElements *New(TempAllocator &alloc, void *v) {
+return new(alloc) MConstantElements(v);
+}
+void *value() const {
+return value_;
+}
+void printOpcode(FILE *fp) const;
+HashNumber valueHash() const {
+return (HashNumber)(size_t) value_;
+}
+bool congruentTo(const MDefinition *ins) const {
+return ins->isConstantElements() && ins->toConstantElements()->value() == value();
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Passes through an object's elements, after ensuring it is entirely doubles.
+class MConvertElementsToDoubles
+: public MUnaryInstruction
+{
+MConvertElementsToDoubles(MDefinition *elements)
+: MUnaryInstruction(elements)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Elements);
+}
+public:
+INSTRUCTION_HEADER(ConvertElementsToDoubles)
+static MConvertElementsToDoubles *New(TempAllocator &alloc, MDefinition *elements) {
+return new(alloc) MConvertElementsToDoubles(elements);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+// This instruction can read and write to the elements' contents.
+// However, it is alright to hoist this from loops which explicitly
+// read or write to the elements: such reads and writes will use double
+// values and can be reordered freely wrt this conversion, except that
+// definite double loads must follow the conversion. The latter
+// property is ensured by chaining this instruction with the elements
+// themselves, in the same manner as MBoundsCheck.
+return AliasSet::None();
+}
+};
+// If |elements| has the CONVERT_DOUBLE_ELEMENTS flag, convert value to
+// double. Else return the original value.
+class MMaybeToDoubleElement
+: public MBinaryInstruction,
+public IntPolicy<1>
+{
+MMaybeToDoubleElement(MDefinition *elements, MDefinition *value)
+: MBinaryInstruction(elements, value)
+{
+JS_ASSERT(elements->type() == MIRType_Elements);
+setMovable();
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(MaybeToDoubleElement)
+static MMaybeToDoubleElement *New(TempAllocator &alloc, MDefinition *elements,
+MDefinition *value)
+{
+return new(alloc) MMaybeToDoubleElement(elements, value);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Load the initialized length from an elements header.
+class MInitializedLength
+: public MUnaryInstruction
+{
+MInitializedLength(MDefinition *elements)
+: MUnaryInstruction(elements)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(InitializedLength)
+static MInitializedLength *New(TempAllocator &alloc, MDefinition *elements) {
+return new(alloc) MInitializedLength(elements);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+void computeRange(TempAllocator &alloc);
+};
+// Store to the initialized length in an elements header. Note the input is an
+// *index*, one less than the desired length.
+class MSetInitializedLength
+: public MAryInstruction<2>
+{
+MSetInitializedLength(MDefinition *elements, MDefinition *index) {
+setOperand(0, elements);
+setOperand(1, index);
+}
+public:
+INSTRUCTION_HEADER(SetInitializedLength)
+static MSetInitializedLength *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index) {
+return new(alloc) MSetInitializedLength(elements, index);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::ObjectFields);
+}
+};
+// Load the array length from an elements header.
+class MArrayLength
+: public MUnaryInstruction
+{
+MArrayLength(MDefinition *elements)
+: MUnaryInstruction(elements)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ArrayLength)
+static MArrayLength *New(TempAllocator &alloc, MDefinition *elements) {
+return new(alloc) MArrayLength(elements);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+void computeRange(TempAllocator &alloc);
+};
+// Store to the length in an elements header. Note the input is an *index*, one
+// less than the desired length.
+class MSetArrayLength
+: public MAryInstruction<2>
+{
+MSetArrayLength(MDefinition *elements, MDefinition *index) {
+setOperand(0, elements);
+setOperand(1, index);
+}
+public:
+INSTRUCTION_HEADER(SetArrayLength)
+static MSetArrayLength *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index) {
+return new(alloc) MSetArrayLength(elements, index);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::ObjectFields);
+}
+};
+// Read the length of a typed array.
+class MTypedArrayLength
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MTypedArrayLength(MDefinition *obj)
+: MUnaryInstruction(obj)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(TypedArrayLength)
+static MTypedArrayLength *New(TempAllocator &alloc, MDefinition *obj) {
+return new(alloc) MTypedArrayLength(obj);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::TypedArrayLength);
+}
+void computeRange(TempAllocator &alloc);
+};
+// Load a typed array's elements vector.
+class MTypedArrayElements
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MTypedArrayElements(MDefinition *object)
+: MUnaryInstruction(object)
+{
+setResultType(MIRType_Elements);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(TypedArrayElements)
+static MTypedArrayElements *New(TempAllocator &alloc, MDefinition *object) {
+return new(alloc) MTypedArrayElements(object);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Checks whether a typed object is neutered.
+class MNeuterCheck
+: public MUnaryInstruction
+{
+private:
+MNeuterCheck(MDefinition *object)
+: MUnaryInstruction(object)
+{
+JS_ASSERT(object->type() == MIRType_Object);
+setResultType(MIRType_Object);
+setResultTypeSet(object->resultTypeSet());
+setGuard();
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(NeuterCheck)
+static MNeuterCheck *New(TempAllocator &alloc, MDefinition *object) {
+return new(alloc) MNeuterCheck(object);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Load a binary data object's "elements", which is just its opaque
+// binary data space. Eventually this should probably be
+// unified with `MTypedArrayElements`.
+class MTypedObjectElements
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+private:
+MTypedObjectElements(MDefinition *object)
+: MUnaryInstruction(object)
+{
+setResultType(MIRType_Elements);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(TypedObjectElements)
+static MTypedObjectElements *New(TempAllocator &alloc, MDefinition *object) {
+return new(alloc) MTypedObjectElements(object);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Inlined version of the js::SetTypedObjectOffset() intrinsic.
+class MSetTypedObjectOffset
+: public MBinaryInstruction
+{
+private:
+MSetTypedObjectOffset(MDefinition *object, MDefinition *offset)
+: MBinaryInstruction(object, offset)
+{
+JS_ASSERT(object->type() == MIRType_Object);
+JS_ASSERT(offset->type() == MIRType_Int32);
+setResultType(MIRType_None);
+}
+public:
+INSTRUCTION_HEADER(SetTypedObjectOffset)
+static MSetTypedObjectOffset *New(TempAllocator &alloc,
+MDefinition *object,
+MDefinition *offset)
+{
+return new(alloc) MSetTypedObjectOffset(object, offset);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *offset() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+// This affects the result of MTypedObjectElements,
+// which is described as a load of ObjectFields.
+return AliasSet::Store(AliasSet::ObjectFields);
+}
+};
+// Perform !-operation
+class MNot
+: public MUnaryInstruction,
+public TestPolicy
+{
+bool operandMightEmulateUndefined_;
+bool operandIsNeverNaN_;
+public:
+MNot(MDefinition *input)
+: MUnaryInstruction(input),
+operandMightEmulateUndefined_(true),
+operandIsNeverNaN_(false)
+{
+setResultType(MIRType_Boolean);
+setMovable();
+}
+static MNot *New(TempAllocator &alloc, MDefinition *elements) {
+return new(alloc) MNot(elements);
+}
+static MNot *NewAsmJS(TempAllocator &alloc, MDefinition *elements) {
+MNot *ins = new(alloc) MNot(elements);
+ins->setResultType(MIRType_Int32);
+return ins;
+}
+INSTRUCTION_HEADER(Not);
+void infer();
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+void markOperandCantEmulateUndefined() {
+operandMightEmulateUndefined_ = false;
+}
+bool operandMightEmulateUndefined() const {
+return operandMightEmulateUndefined_;
+}
+bool operandIsNeverNaN() const {
+return operandIsNeverNaN_;
+}
+MDefinition *operand() const {
+return getOperand(0);
+}
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+void collectRangeInfoPreTrunc();
+void trySpecializeFloat32(TempAllocator &alloc);
+bool isFloat32Commutative() const { return true; }
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+return true;
+}
+#endif
+};
+// Bailout if index + minimum < 0 or index + maximum >= length. The length used
+// in a bounds check must not be negative, or the wrong result may be computed
+// (unsigned comparisons may be used).
+class MBoundsCheck
+: public MBinaryInstruction
+{
+// Range over which to perform the bounds check, may be modified by GVN.
+int32_t minimum_;
+int32_t maximum_;
+MBoundsCheck(MDefinition *index, MDefinition *length)
+: MBinaryInstruction(index, length), minimum_(0), maximum_(0)
+{
+setGuard();
+setMovable();
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(length->type() == MIRType_Int32);
+// Returns the checked index.
+setResultType(MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(BoundsCheck)
+static MBoundsCheck *New(TempAllocator &alloc, MDefinition *index, MDefinition *length) {
+return new(alloc) MBoundsCheck(index, length);
+}
+MDefinition *index() const {
+return getOperand(0);
+}
+MDefinition *length() const {
+return getOperand(1);
+}
+int32_t minimum() const {
+return minimum_;
+}
+void setMinimum(int32_t n) {
+minimum_ = n;
+}
+int32_t maximum() const {
+return maximum_;
+}
+void setMaximum(int32_t n) {
+maximum_ = n;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isBoundsCheck())
+return false;
+const MBoundsCheck *other = ins->toBoundsCheck();
+if (minimum() != other->minimum() || maximum() != other->maximum())
+return false;
+return congruentIfOperandsEqual(other);
+}
+virtual AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+// Bailout if index < minimum.
+class MBoundsCheckLower
+: public MUnaryInstruction
+{
+int32_t minimum_;
+bool fallible_;
+MBoundsCheckLower(MDefinition *index)
+: MUnaryInstruction(index), minimum_(0), fallible_(true)
+{
+setGuard();
+setMovable();
+JS_ASSERT(index->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(BoundsCheckLower)
+static MBoundsCheckLower *New(TempAllocator &alloc, MDefinition *index) {
+return new(alloc) MBoundsCheckLower(index);
+}
+MDefinition *index() const {
+return getOperand(0);
+}
+int32_t minimum() const {
+return minimum_;
+}
+void setMinimum(int32_t n) {
+minimum_ = n;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool fallible() const {
+return fallible_;
+}
+void collectRangeInfoPreTrunc();
+};
+// Load a value from a dense array's element vector and does a hole check if the
+// array is not known to be packed.
+class MLoadElement
+: public MBinaryInstruction,
+public SingleObjectPolicy
+{
+bool needsHoleCheck_;
+bool loadDoubles_;
+MLoadElement(MDefinition *elements, MDefinition *index, bool needsHoleCheck, bool loadDoubles)
+: MBinaryInstruction(elements, index),
+needsHoleCheck_(needsHoleCheck),
+loadDoubles_(loadDoubles)
+{
+if (needsHoleCheck) {
+// Uses may be optimized away based on this instruction's result
+// type. This means it's invalid to DCE this instruction, as we
+// have to invalidate when we read a hole.
+setGuard();
+}
+setResultType(MIRType_Value);
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(LoadElement)
+static MLoadElement *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+bool needsHoleCheck, bool loadDoubles) {
+return new(alloc) MLoadElement(elements, index, needsHoleCheck, loadDoubles);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+bool needsHoleCheck() const {
+return needsHoleCheck_;
+}
+bool loadDoubles() const {
+return loadDoubles_;
+}
+bool fallible() const {
+return needsHoleCheck();
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadElement())
+return false;
+const MLoadElement *other = ins->toLoadElement();
+if (needsHoleCheck() != other->needsHoleCheck())
+return false;
+if (loadDoubles() != other->loadDoubles())
+return false;
+return congruentIfOperandsEqual(other);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::Element);
+}
+};
+// Load a value from a dense array's element vector. If the index is
+// out-of-bounds, or the indexed slot has a hole, undefined is returned
+// instead.
+class MLoadElementHole
+: public MTernaryInstruction,
+public SingleObjectPolicy
+{
+bool needsNegativeIntCheck_;
+bool needsHoleCheck_;
+MLoadElementHole(MDefinition *elements, MDefinition *index, MDefinition *initLength, bool needsHoleCheck)
+: MTernaryInstruction(elements, index, initLength),
+needsNegativeIntCheck_(true),
+needsHoleCheck_(needsHoleCheck)
+{
+setResultType(MIRType_Value);
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(initLength->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(LoadElementHole)
+static MLoadElementHole *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+MDefinition *initLength, bool needsHoleCheck) {
+return new(alloc) MLoadElementHole(elements, index, initLength, needsHoleCheck);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+MDefinition *initLength() const {
+return getOperand(2);
+}
+bool needsNegativeIntCheck() const {
+return needsNegativeIntCheck_;
+}
+bool needsHoleCheck() const {
+return needsHoleCheck_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadElementHole())
+return false;
+const MLoadElementHole *other = ins->toLoadElementHole();
+if (needsHoleCheck() != other->needsHoleCheck())
+return false;
+if (needsNegativeIntCheck() != other->needsNegativeIntCheck())
+return false;
+return congruentIfOperandsEqual(other);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::Element);
+}
+void collectRangeInfoPreTrunc();
+};
+class MStoreElementCommon
+{
+bool needsBarrier_;
+MIRType elementType_;
+bool racy_; // if true, exempted from normal data race req. during par. exec.
+protected:
+MStoreElementCommon()
+: needsBarrier_(false),
+elementType_(MIRType_Value),
+racy_(false)
+{ }
+public:
+MIRType elementType() const {
+return elementType_;
+}
+void setElementType(MIRType elementType) {
+JS_ASSERT(elementType != MIRType_None);
+elementType_ = elementType;
+}
+bool needsBarrier() const {
+return needsBarrier_;
+}
+void setNeedsBarrier() {
+needsBarrier_ = true;
+}
+bool racy() const {
+return racy_;
+}
+void setRacy() {
+racy_ = true;
+}
+};
+// Store a value to a dense array slots vector.
+class MStoreElement
+: public MAryInstruction<3>,
+public MStoreElementCommon,
+public MixPolicy<SingleObjectPolicy, NoFloatPolicy<2> >
+{
+bool needsHoleCheck_;
+MStoreElement(MDefinition *elements, MDefinition *index, MDefinition *value, bool needsHoleCheck) {
+setOperand(0, elements);
+setOperand(1, index);
+setOperand(2, value);
+needsHoleCheck_ = needsHoleCheck;
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(StoreElement)
+static MStoreElement *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+MDefinition *value, bool needsHoleCheck) {
+return new(alloc) MStoreElement(elements, index, value, needsHoleCheck);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+MDefinition *value() const {
+return getOperand(2);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::Element);
+}
+bool needsHoleCheck() const {
+return needsHoleCheck_;
+}
+bool fallible() const {
+return needsHoleCheck();
+}
+};
+// Like MStoreElement, but supports indexes >= initialized length. The downside
+// is that we cannot hoist the elements vector and bounds check, since this
+// instruction may update the (initialized) length and reallocate the elements
+// vector.
+class MStoreElementHole
+: public MAryInstruction<4>,
+public MStoreElementCommon,
+public MixPolicy<SingleObjectPolicy, NoFloatPolicy<3> >
+{
+MStoreElementHole(MDefinition *object, MDefinition *elements,
+MDefinition *index, MDefinition *value) {
+setOperand(0, object);
+setOperand(1, elements);
+setOperand(2, index);
+setOperand(3, value);
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(StoreElementHole)
+static MStoreElementHole *New(TempAllocator &alloc, MDefinition *object, MDefinition *elements,
+MDefinition *index, MDefinition *value) {
+return new(alloc) MStoreElementHole(object, elements, index, value);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *elements() const {
+return getOperand(1);
+}
+MDefinition *index() const {
+return getOperand(2);
+}
+MDefinition *value() const {
+return getOperand(3);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+// StoreElementHole can update the initialized length, the array length
+// or reallocate obj->elements.
+return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
+}
+};
+// Array.prototype.pop or Array.prototype.shift on a dense array.
+class MArrayPopShift
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+public:
+enum Mode {
+Pop,
+Shift
+};
+private:
+Mode mode_;
+bool needsHoleCheck_;
+bool maybeUndefined_;
+MArrayPopShift(MDefinition *object, Mode mode, bool needsHoleCheck, bool maybeUndefined)
+: MUnaryInstruction(object), mode_(mode), needsHoleCheck_(needsHoleCheck),
+maybeUndefined_(maybeUndefined)
+{ }
+public:
+INSTRUCTION_HEADER(ArrayPopShift)
+static MArrayPopShift *New(TempAllocator &alloc, MDefinition *object, Mode mode,
+bool needsHoleCheck, bool maybeUndefined)
+{
+return new(alloc) MArrayPopShift(object, mode, needsHoleCheck, maybeUndefined);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+bool needsHoleCheck() const {
+return needsHoleCheck_;
+}
+bool maybeUndefined() const {
+return maybeUndefined_;
+}
+bool mode() const {
+return mode_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
+}
+};
+// Array.prototype.push on a dense array. Returns the new array length.
+class MArrayPush
+: public MBinaryInstruction,
+public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >
+{
+MArrayPush(MDefinition *object, MDefinition *value)
+: MBinaryInstruction(object, value)
+{
+setResultType(MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(ArrayPush)
+static MArrayPush *New(TempAllocator &alloc, MDefinition *object, MDefinition *value) {
+return new(alloc) MArrayPush(object, value);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
+}
+void computeRange(TempAllocator &alloc);
+};
+// Array.prototype.concat on two dense arrays.
+class MArrayConcat
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >
+{
+CompilerRootObject templateObj_;
+gc::InitialHeap initialHeap_;
+MArrayConcat(types::CompilerConstraintList *constraints, MDefinition *lhs, MDefinition *rhs,
+JSObject *templateObj, gc::InitialHeap initialHeap)
+: MBinaryInstruction(lhs, rhs),
+templateObj_(templateObj),
+initialHeap_(initialHeap)
+{
+setResultType(MIRType_Object);
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObj));
+}
+public:
+INSTRUCTION_HEADER(ArrayConcat)
+static MArrayConcat *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MDefinition *lhs, MDefinition *rhs,
+JSObject *templateObj, gc::InitialHeap initialHeap)
+{
+return new(alloc) MArrayConcat(constraints, lhs, rhs, templateObj, initialHeap);
+}
+JSObject *templateObj() const {
+return templateObj_;
+}
+gc::InitialHeap initialHeap() const {
+return initialHeap_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::Element | AliasSet::ObjectFields);
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MLoadTypedArrayElement
+: public MBinaryInstruction
+{
+ScalarTypeDescr::Type arrayType_;
+MLoadTypedArrayElement(MDefinition *elements, MDefinition *index,
+ScalarTypeDescr::Type arrayType)
+: MBinaryInstruction(elements, index), arrayType_(arrayType)
+{
+setResultType(MIRType_Value);
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
+}
+public:
+INSTRUCTION_HEADER(LoadTypedArrayElement)
+static MLoadTypedArrayElement *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+ScalarTypeDescr::Type arrayType)
+{
+return new(alloc) MLoadTypedArrayElement(elements, index, arrayType);
+}
+ScalarTypeDescr::Type arrayType() const {
+return arrayType_;
+}
+bool fallible() const {
+// Bailout if the result does not fit in an int32.
+return arrayType_ == ScalarTypeDescr::TYPE_UINT32 && type() == MIRType_Int32;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::TypedArrayElement);
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadTypedArrayElement())
+return false;
+const MLoadTypedArrayElement *other = ins->toLoadTypedArrayElement();
+if (arrayType_ != other->arrayType_)
+return false;
+return congruentIfOperandsEqual(other);
+}
+void printOpcode(FILE *fp) const;
+void computeRange(TempAllocator &alloc);
+bool canProduceFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
+};
+// Load a value from a typed array. Out-of-bounds accesses are handled using
+// a VM call.
+class MLoadTypedArrayElementHole
+: public MBinaryInstruction,
+public SingleObjectPolicy
+{
+int arrayType_;
+bool allowDouble_;
+MLoadTypedArrayElementHole(MDefinition *object, MDefinition *index, int arrayType, bool allowDouble)
+: MBinaryInstruction(object, index), arrayType_(arrayType), allowDouble_(allowDouble)
+{
+setResultType(MIRType_Value);
+setMovable();
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
+}
+public:
+INSTRUCTION_HEADER(LoadTypedArrayElementHole)
+static MLoadTypedArrayElementHole *New(TempAllocator &alloc, MDefinition *object, MDefinition *index,
+int arrayType, bool allowDouble)
+{
+return new(alloc) MLoadTypedArrayElementHole(object, index, arrayType, allowDouble);
+}
+int arrayType() const {
+return arrayType_;
+}
+bool allowDouble() const {
+return allowDouble_;
+}
+bool fallible() const {
+return arrayType_ == ScalarTypeDescr::TYPE_UINT32 && !allowDouble_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadTypedArrayElementHole())
+return false;
+const MLoadTypedArrayElementHole *other = ins->toLoadTypedArrayElementHole();
+if (arrayType() != other->arrayType())
+return false;
+if (allowDouble() != other->allowDouble())
+return false;
+return congruentIfOperandsEqual(other);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::TypedArrayElement);
+}
+bool canProduceFloat32() const { return arrayType_ == ScalarTypeDescr::TYPE_FLOAT32; }
+};
+// Load a value fallibly or infallibly from a statically known typed array.
+class MLoadTypedArrayElementStatic
+: public MUnaryInstruction,
+public ConvertToInt32Policy<0>
+{
+MLoadTypedArrayElementStatic(TypedArrayObject *typedArray, MDefinition *ptr)
+: MUnaryInstruction(ptr), typedArray_(typedArray), fallible_(true)
+{
+int type = typedArray_->type();
+if (type == ScalarTypeDescr::TYPE_FLOAT32)
+setResultType(MIRType_Float32);
+else if (type == ScalarTypeDescr::TYPE_FLOAT64)
+setResultType(MIRType_Double);
+else
+setResultType(MIRType_Int32);
+}
+CompilerRoot<TypedArrayObject*> typedArray_;
+bool fallible_;
+public:
+INSTRUCTION_HEADER(LoadTypedArrayElementStatic);
+static MLoadTypedArrayElementStatic *New(TempAllocator &alloc, TypedArrayObject *typedArray,
+MDefinition *ptr)
+{
+return new(alloc) MLoadTypedArrayElementStatic(typedArray, ptr);
+}
+ArrayBufferView::ViewType viewType() const {
+return (ArrayBufferView::ViewType) typedArray_->type();
+}
+void *base() const;
+size_t length() const;
+MDefinition *ptr() const { return getOperand(0); }
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::TypedArrayElement);
+}
+bool fallible() const {
+return fallible_;
+}
+void setInfallible() {
+fallible_ = false;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+void computeRange(TempAllocator &alloc);
+bool truncate();
+bool canProduceFloat32() const { return typedArray_->type() == ScalarTypeDescr::TYPE_FLOAT32; }
+};
+class MStoreTypedArrayElement
+: public MTernaryInstruction,
+public StoreTypedArrayPolicy
+{
+int arrayType_;
+// See note in MStoreElementCommon.
+bool racy_;
+MStoreTypedArrayElement(MDefinition *elements, MDefinition *index, MDefinition *value,
+int arrayType)
+: MTernaryInstruction(elements, index, value), arrayType_(arrayType), racy_(false)
+{
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
+}
+public:
+INSTRUCTION_HEADER(StoreTypedArrayElement)
+static MStoreTypedArrayElement *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+MDefinition *value, int arrayType)
+{
+return new(alloc) MStoreTypedArrayElement(elements, index, value, arrayType);
+}
+int arrayType() const {
+return arrayType_;
+}
+bool isByteArray() const {
+return (arrayType_ == ScalarTypeDescr::TYPE_INT8 ||
+arrayType_ == ScalarTypeDescr::TYPE_UINT8 ||
+arrayType_ == ScalarTypeDescr::TYPE_UINT8_CLAMPED);
+}
+bool isFloatArray() const {
+return (arrayType_ == ScalarTypeDescr::TYPE_FLOAT32 ||
+arrayType_ == ScalarTypeDescr::TYPE_FLOAT64);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+MDefinition *value() const {
+return getOperand(2);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::TypedArrayElement);
+}
+bool racy() const {
+return racy_;
+}
+void setRacy() {
+racy_ = true;
+}
+bool isOperandTruncated(size_t index) const;
+bool canConsumeFloat32(MUse *use) const {
+return use->index() == 2 && arrayType_ == ScalarTypeDescr::TYPE_FLOAT32;
+}
+};
+class MStoreTypedArrayElementHole
+: public MAryInstruction<4>,
+public StoreTypedArrayHolePolicy
+{
+int arrayType_;
+MStoreTypedArrayElementHole(MDefinition *elements, MDefinition *length, MDefinition *index,
+MDefinition *value, int arrayType)
+: MAryInstruction<4>(), arrayType_(arrayType)
+{
+setOperand(0, elements);
+setOperand(1, length);
+setOperand(2, index);
+setOperand(3, value);
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(length->type() == MIRType_Int32);
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(arrayType >= 0 && arrayType < ScalarTypeDescr::TYPE_MAX);
+}
+public:
+INSTRUCTION_HEADER(StoreTypedArrayElementHole)
+static MStoreTypedArrayElementHole *New(TempAllocator &alloc, MDefinition *elements,
+MDefinition *length, MDefinition *index,
+MDefinition *value, int arrayType)
+{
+return new(alloc) MStoreTypedArrayElementHole(elements, length, index, value, arrayType);
+}
+int arrayType() const {
+return arrayType_;
+}
+bool isByteArray() const {
+return (arrayType_ == ScalarTypeDescr::TYPE_INT8 ||
+arrayType_ == ScalarTypeDescr::TYPE_UINT8 ||
+arrayType_ == ScalarTypeDescr::TYPE_UINT8_CLAMPED);
+}
+bool isFloatArray() const {
+return (arrayType_ == ScalarTypeDescr::TYPE_FLOAT32 ||
+arrayType_ == ScalarTypeDescr::TYPE_FLOAT64);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *length() const {
+return getOperand(1);
+}
+MDefinition *index() const {
+return getOperand(2);
+}
+MDefinition *value() const {
+return getOperand(3);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::TypedArrayElement);
+}
+bool isOperandTruncated(size_t index) const;
+bool canConsumeFloat32(MUse *use) const {
+return use->index() == 3 && arrayType_ == ScalarTypeDescr::TYPE_FLOAT32;
+}
+};
+// Store a value infallibly to a statically known typed array.
+class MStoreTypedArrayElementStatic :
+public MBinaryInstruction
+, public StoreTypedArrayElementStaticPolicy
+{
+MStoreTypedArrayElementStatic(TypedArrayObject *typedArray, MDefinition *ptr, MDefinition *v)
+: MBinaryInstruction(ptr, v), typedArray_(typedArray)
+{}
+CompilerRoot<TypedArrayObject*> typedArray_;
+public:
+INSTRUCTION_HEADER(StoreTypedArrayElementStatic);
+static MStoreTypedArrayElementStatic *New(TempAllocator &alloc, TypedArrayObject *typedArray,
+MDefinition *ptr, MDefinition *v)
+{
+return new(alloc) MStoreTypedArrayElementStatic(typedArray, ptr, v);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+ArrayBufferView::ViewType viewType() const {
+return (ArrayBufferView::ViewType) typedArray_->type();
+}
+bool isFloatArray() const {
+return (viewType() == ArrayBufferView::TYPE_FLOAT32 ||
+viewType() == ArrayBufferView::TYPE_FLOAT64);
+}
+void *base() const;
+size_t length() const;
+MDefinition *ptr() const { return getOperand(0); }
+MDefinition *value() const { return getOperand(1); }
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::TypedArrayElement);
+}
+bool isOperandTruncated(size_t index) const;
+bool canConsumeFloat32(MUse *use) const {
+return use->index() == 1 && typedArray_->type() == ScalarTypeDescr::TYPE_FLOAT32;
+}
+};
+// Compute an "effective address", i.e., a compound computation of the form:
+//   base + index * scale + displacement
+class MEffectiveAddress : public MBinaryInstruction
+{
+MEffectiveAddress(MDefinition *base, MDefinition *index, Scale scale, int32_t displacement)
+: MBinaryInstruction(base, index), scale_(scale), displacement_(displacement)
+{
+JS_ASSERT(base->type() == MIRType_Int32);
+JS_ASSERT(index->type() == MIRType_Int32);
+setMovable();
+setResultType(MIRType_Int32);
+}
+Scale scale_;
+int32_t displacement_;
+public:
+INSTRUCTION_HEADER(EffectiveAddress);
+static MEffectiveAddress *New(TempAllocator &alloc, MDefinition *base, MDefinition *index,
+Scale s, int32_t d)
+{
+return new(alloc) MEffectiveAddress(base, index, s, d);
+}
+MDefinition *base() const {
+return lhs();
+}
+MDefinition *index() const {
+return rhs();
+}
+Scale scale() const {
+return scale_;
+}
+int32_t displacement() const {
+return displacement_;
+}
+};
+// Clamp input to range [0, 255] for Uint8ClampedArray.
+class MClampToUint8
+: public MUnaryInstruction,
+public ClampPolicy
+{
+MClampToUint8(MDefinition *input)
+: MUnaryInstruction(input)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ClampToUint8)
+static MClampToUint8 *New(TempAllocator &alloc, MDefinition *input) {
+return new(alloc) MClampToUint8(input);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+class MLoadFixedSlot
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+size_t slot_;
+protected:
+MLoadFixedSlot(MDefinition *obj, size_t slot)
+: MUnaryInstruction(obj), slot_(slot)
+{
+setResultType(MIRType_Value);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(LoadFixedSlot)
+static MLoadFixedSlot *New(TempAllocator &alloc, MDefinition *obj, size_t slot) {
+return new(alloc) MLoadFixedSlot(obj, slot);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+size_t slot() const {
+return slot_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadFixedSlot())
+return false;
+if (slot() != ins->toLoadFixedSlot()->slot())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::FixedSlot);
+}
+bool mightAlias(const MDefinition *store) const;
+};
+class MStoreFixedSlot
+: public MBinaryInstruction,
+public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >
+{
+bool needsBarrier_;
+size_t slot_;
+MStoreFixedSlot(MDefinition *obj, MDefinition *rval, size_t slot, bool barrier)
+: MBinaryInstruction(obj, rval),
+needsBarrier_(barrier),
+slot_(slot)
+{ }
+public:
+INSTRUCTION_HEADER(StoreFixedSlot)
+static MStoreFixedSlot *New(TempAllocator &alloc, MDefinition *obj, size_t slot,
+MDefinition *rval)
+{
+return new(alloc) MStoreFixedSlot(obj, rval, slot, false);
+}
+static MStoreFixedSlot *NewBarriered(TempAllocator &alloc, MDefinition *obj, size_t slot,
+MDefinition *rval)
+{
+return new(alloc) MStoreFixedSlot(obj, rval, slot, true);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+size_t slot() const {
+return slot_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::FixedSlot);
+}
+bool needsBarrier() const {
+return needsBarrier_;
+}
+void setNeedsBarrier() {
+needsBarrier_ = true;
+}
+};
+typedef Vector<JSObject *, 4, IonAllocPolicy> ObjectVector;
+typedef Vector<bool, 4, IonAllocPolicy> BoolVector;
+class InlinePropertyTable : public TempObject
+{
+struct Entry : public TempObject {
+CompilerRoot<types::TypeObject *> typeObj;
+CompilerRootFunction func;
+Entry(types::TypeObject *typeObj, JSFunction *func)
+: typeObj(typeObj), func(func)
+{ }
+};
+jsbytecode *pc_;
+MResumePoint *priorResumePoint_;
+Vector<Entry *, 4, IonAllocPolicy> entries_;
+public:
+InlinePropertyTable(TempAllocator &alloc, jsbytecode *pc)
+: pc_(pc), priorResumePoint_(nullptr), entries_(alloc)
+{ }
+void setPriorResumePoint(MResumePoint *resumePoint) {
+JS_ASSERT(priorResumePoint_ == nullptr);
+priorResumePoint_ = resumePoint;
+}
+MResumePoint *priorResumePoint() const {
+return priorResumePoint_;
+}
+jsbytecode *pc() const {
+return pc_;
+}
+bool addEntry(TempAllocator &alloc, types::TypeObject *typeObj, JSFunction *func) {
+return entries_.append(new(alloc) Entry(typeObj, func));
+}
+size_t numEntries() const {
+return entries_.length();
+}
+types::TypeObject *getTypeObject(size_t i) const {
+JS_ASSERT(i < numEntries());
+return entries_[i]->typeObj;
+}
+JSFunction *getFunction(size_t i) const {
+JS_ASSERT(i < numEntries());
+return entries_[i]->func;
+}
+bool hasFunction(JSFunction *func) const;
+types::TemporaryTypeSet *buildTypeSetForFunction(JSFunction *func) const;
+// Remove targets that vetoed inlining from the InlinePropertyTable.
+void trimTo(ObjectVector &targets, BoolVector &choiceSet);
+// Ensure that the InlinePropertyTable's domain is a subset of |targets|.
+void trimToTargets(ObjectVector &targets);
+};
+class CacheLocationList : public InlineConcatList<CacheLocationList>
+{
+public:
+CacheLocationList()
+: pc(nullptr),
+script(nullptr)
+{ }
+jsbytecode *pc;
+JSScript *script;
+};
+class MGetPropertyCache
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+CompilerRootPropertyName name_;
+bool idempotent_;
+bool monitoredResult_;
+CacheLocationList location_;
+InlinePropertyTable *inlinePropertyTable_;
+MGetPropertyCache(MDefinition *obj, PropertyName *name, bool monitoredResult)
+: MUnaryInstruction(obj),
+name_(name),
+idempotent_(false),
+monitoredResult_(monitoredResult),
+location_(),
+inlinePropertyTable_(nullptr)
+{
+setResultType(MIRType_Value);
+// The cache will invalidate if there are objects with e.g. lookup or
+// resolve hooks on the proto chain. setGuard ensures this check is not
+// eliminated.
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(GetPropertyCache)
+static MGetPropertyCache *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,
+bool monitoredResult) {
+return new(alloc) MGetPropertyCache(obj, name, monitoredResult);
+}
+InlinePropertyTable *initInlinePropertyTable(TempAllocator &alloc, jsbytecode *pc) {
+JS_ASSERT(inlinePropertyTable_ == nullptr);
+inlinePropertyTable_ = new(alloc) InlinePropertyTable(alloc, pc);
+return inlinePropertyTable_;
+}
+void clearInlinePropertyTable() {
+inlinePropertyTable_ = nullptr;
+}
+InlinePropertyTable *propTable() const {
+return inlinePropertyTable_;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+PropertyName *name() const {
+return name_;
+}
+bool idempotent() const {
+return idempotent_;
+}
+void setIdempotent() {
+idempotent_ = true;
+setMovable();
+}
+bool monitoredResult() const {
+return monitoredResult_;
+}
+CacheLocationList &location() {
+return location_;
+}
+TypePolicy *typePolicy() { return this; }
+bool congruentTo(const MDefinition *ins) const {
+if (!idempotent_)
+return false;
+if (!ins->isGetPropertyCache())
+return false;
+if (name() != ins->toGetPropertyCache()->name())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+if (idempotent_) {
+return AliasSet::Load(AliasSet::ObjectFields |
+AliasSet::FixedSlot |
+AliasSet::DynamicSlot);
+}
+return AliasSet::Store(AliasSet::Any);
+}
+void setBlock(MBasicBlock *block);
+bool updateForReplacement(MDefinition *ins);
+};
+// Emit code to load a value from an object's slots if its shape matches
+// one of the shapes observed by the baseline IC, else bails out.
+class MGetPropertyPolymorphic
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+struct Entry {
+// The shape to guard against.
+Shape *objShape;
+// The property to laod.
+Shape *shape;
+};
+Vector<Entry, 4, IonAllocPolicy> shapes_;
+CompilerRootPropertyName name_;
+MGetPropertyPolymorphic(TempAllocator &alloc, MDefinition *obj, PropertyName *name)
+: MUnaryInstruction(obj),
+shapes_(alloc),
+name_(name)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Value);
+}
+PropertyName *name() const {
+return name_;
+}
+public:
+INSTRUCTION_HEADER(GetPropertyPolymorphic)
+static MGetPropertyPolymorphic *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name) {
+return new(alloc) MGetPropertyPolymorphic(alloc, obj, name);
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isGetPropertyPolymorphic())
+return false;
+if (name() != ins->toGetPropertyPolymorphic()->name())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool addShape(Shape *objShape, Shape *shape) {
+Entry entry;
+entry.objShape = objShape;
+entry.shape = shape;
+return shapes_.append(entry);
+}
+size_t numShapes() const {
+return shapes_.length();
+}
+Shape *objShape(size_t i) const {
+return shapes_[i].objShape;
+}
+Shape *shape(size_t i) const {
+return shapes_[i].shape;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields | AliasSet::FixedSlot | AliasSet::DynamicSlot);
+}
+bool mightAlias(const MDefinition *store) const;
+};
+// Emit code to store a value to an object's slots if its shape matches
+// one of the shapes observed by the baseline IC, else bails out.
+class MSetPropertyPolymorphic
+: public MBinaryInstruction,
+public SingleObjectPolicy
+{
+struct Entry {
+// The shape to guard against.
+Shape *objShape;
+// The property to laod.
+Shape *shape;
+};
+Vector<Entry, 4, IonAllocPolicy> shapes_;
+bool needsBarrier_;
+MSetPropertyPolymorphic(TempAllocator &alloc, MDefinition *obj, MDefinition *value)
+: MBinaryInstruction(obj, value),
+shapes_(alloc),
+needsBarrier_(false)
+{
+}
+public:
+INSTRUCTION_HEADER(SetPropertyPolymorphic)
+static MSetPropertyPolymorphic *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value) {
+return new(alloc) MSetPropertyPolymorphic(alloc, obj, value);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool addShape(Shape *objShape, Shape *shape) {
+Entry entry;
+entry.objShape = objShape;
+entry.shape = shape;
+return shapes_.append(entry);
+}
+size_t numShapes() const {
+return shapes_.length();
+}
+Shape *objShape(size_t i) const {
+return shapes_[i].objShape;
+}
+Shape *shape(size_t i) const {
+return shapes_[i].shape;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+bool needsBarrier() const {
+return needsBarrier_;
+}
+void setNeedsBarrier() {
+needsBarrier_ = true;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::ObjectFields | AliasSet::FixedSlot | AliasSet::DynamicSlot);
+}
+};
+class MDispatchInstruction
+: public MControlInstruction,
+public SingleObjectPolicy
+{
+// Map from JSFunction* -> MBasicBlock.
+struct Entry {
+JSFunction *func;
+MBasicBlock *block;
+Entry(JSFunction *func, MBasicBlock *block)
+: func(func), block(block)
+{ }
+};
+Vector<Entry, 4, IonAllocPolicy> map_;
+// An optional fallback path that uses MCall.
+MBasicBlock *fallback_;
+MUse operand_;
+public:
+MDispatchInstruction(TempAllocator &alloc, MDefinition *input)
+: map_(alloc), fallback_(nullptr)
+{
+setOperand(0, input);
+}
+protected:
+void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {
+JS_ASSERT(index == 0);
+operand_.set(operand, this, 0);
+operand->addUse(&operand_);
+}
+MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {
+JS_ASSERT(index == 0);
+return &operand_;
+}
+MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {
+JS_ASSERT(index == 0);
+return operand_.producer();
+}
+size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {
+return 1;
+}
+public:
+void setSuccessor(size_t i, MBasicBlock *successor) {
+JS_ASSERT(i < numSuccessors());
+if (i == map_.length())
+fallback_ = successor;
+else
+map_[i].block = successor;
+}
+size_t numSuccessors() const MOZ_FINAL MOZ_OVERRIDE {
+return map_.length() + (fallback_ ? 1 : 0);
+}
+void replaceSuccessor(size_t i, MBasicBlock *successor) MOZ_FINAL MOZ_OVERRIDE {
+setSuccessor(i, successor);
+}
+MBasicBlock *getSuccessor(size_t i) const MOZ_FINAL MOZ_OVERRIDE {
+JS_ASSERT(i < numSuccessors());
+if (i == map_.length())
+return fallback_;
+return map_[i].block;
+}
+public:
+void addCase(JSFunction *func, MBasicBlock *block) {
+map_.append(Entry(func, block));
+}
+uint32_t numCases() const {
+return map_.length();
+}
+JSFunction *getCase(uint32_t i) const {
+return map_[i].func;
+}
+MBasicBlock *getCaseBlock(uint32_t i) const {
+return map_[i].block;
+}
+bool hasFallback() const {
+return bool(fallback_);
+}
+void addFallback(MBasicBlock *block) {
+JS_ASSERT(!hasFallback());
+fallback_ = block;
+}
+MBasicBlock *getFallback() const {
+JS_ASSERT(hasFallback());
+return fallback_;
+}
+public:
+MDefinition *input() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+// Polymorphic dispatch for inlining, keyed off incoming TypeObject.
+class MTypeObjectDispatch : public MDispatchInstruction
+{
+// Map TypeObject (of CallProp's Target Object) -> JSFunction (yielded by the CallProp).
+InlinePropertyTable *inlinePropertyTable_;
+MTypeObjectDispatch(TempAllocator &alloc, MDefinition *input, InlinePropertyTable *table)
+: MDispatchInstruction(alloc, input),
+inlinePropertyTable_(table)
+{ }
+public:
+INSTRUCTION_HEADER(TypeObjectDispatch)
+static MTypeObjectDispatch *New(TempAllocator &alloc, MDefinition *ins,
+InlinePropertyTable *table)
+{
+return new(alloc) MTypeObjectDispatch(alloc, ins, table);
+}
+InlinePropertyTable *propTable() const {
+return inlinePropertyTable_;
+}
+};
+// Polymorphic dispatch for inlining, keyed off incoming JSFunction*.
+class MFunctionDispatch : public MDispatchInstruction
+{
+MFunctionDispatch(TempAllocator &alloc, MDefinition *input)
+: MDispatchInstruction(alloc, input)
+{ }
+public:
+INSTRUCTION_HEADER(FunctionDispatch)
+static MFunctionDispatch *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MFunctionDispatch(alloc, ins);
+}
+};
+class MGetElementCache
+: public MBinaryInstruction
+{
+MixPolicy<ObjectPolicy<0>, BoxPolicy<1> > PolicyV;
+MixPolicy<ObjectPolicy<0>, IntPolicy<1> > PolicyT;
+// See the comment in IonBuilder::jsop_getelem.
+bool monitoredResult_;
+MGetElementCache(MDefinition *obj, MDefinition *value, bool monitoredResult)
+: MBinaryInstruction(obj, value), monitoredResult_(monitoredResult)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(GetElementCache)
+static MGetElementCache *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value,
+bool monitoredResult)
+{
+return new(alloc) MGetElementCache(obj, value, monitoredResult);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+bool monitoredResult() const {
+return monitoredResult_;
+}
+bool allowDoubleResult() const;
+TypePolicy *typePolicy() {
+if (type() == MIRType_Value)
+return &PolicyV;
+return &PolicyT;
+}
+};
+class MBindNameCache
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+CompilerRootPropertyName name_;
+CompilerRootScript script_;
+jsbytecode *pc_;
+MBindNameCache(MDefinition *scopeChain, PropertyName *name, JSScript *script, jsbytecode *pc)
+: MUnaryInstruction(scopeChain), name_(name), script_(script), pc_(pc)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(BindNameCache)
+static MBindNameCache *New(TempAllocator &alloc, MDefinition *scopeChain, PropertyName *name,
+JSScript *script, jsbytecode *pc)
+{
+return new(alloc) MBindNameCache(scopeChain, name, script, pc);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *scopeChain() const {
+return getOperand(0);
+}
+PropertyName *name() const {
+return name_;
+}
+JSScript *script() const {
+return script_;
+}
+jsbytecode *pc() const {
+return pc_;
+}
+};
+// Guard on an object's shape.
+class MGuardShape
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+CompilerRootShape shape_;
+BailoutKind bailoutKind_;
+MGuardShape(MDefinition *obj, Shape *shape, BailoutKind bailoutKind)
+: MUnaryInstruction(obj),
+shape_(shape),
+bailoutKind_(bailoutKind)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(GuardShape)
+static MGuardShape *New(TempAllocator &alloc, MDefinition *obj, Shape *shape,
+BailoutKind bailoutKind)
+{
+return new(alloc) MGuardShape(obj, shape, bailoutKind);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+const Shape *shape() const {
+return shape_;
+}
+BailoutKind bailoutKind() const {
+return bailoutKind_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isGuardShape())
+return false;
+if (shape() != ins->toGuardShape()->shape())
+return false;
+if (bailoutKind() != ins->toGuardShape()->bailoutKind())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Guard on an object's type, inclusively or exclusively.
+class MGuardObjectType
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+CompilerRoot<types::TypeObject *> typeObject_;
+bool bailOnEquality_;
+MGuardObjectType(MDefinition *obj, types::TypeObject *typeObject, bool bailOnEquality)
+: MUnaryInstruction(obj),
+typeObject_(typeObject),
+bailOnEquality_(bailOnEquality)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(GuardObjectType)
+static MGuardObjectType *New(TempAllocator &alloc, MDefinition *obj, types::TypeObject *typeObject,
+bool bailOnEquality) {
+return new(alloc) MGuardObjectType(obj, typeObject, bailOnEquality);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+const types::TypeObject *typeObject() const {
+return typeObject_;
+}
+bool bailOnEquality() const {
+return bailOnEquality_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isGuardObjectType())
+return false;
+if (typeObject() != ins->toGuardObjectType()->typeObject())
+return false;
+if (bailOnEquality() != ins->toGuardObjectType()->bailOnEquality())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Guard on an object's identity, inclusively or exclusively.
+class MGuardObjectIdentity
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+CompilerRoot<JSObject *> singleObject_;
+bool bailOnEquality_;
+MGuardObjectIdentity(MDefinition *obj, JSObject *singleObject, bool bailOnEquality)
+: MUnaryInstruction(obj),
+singleObject_(singleObject),
+bailOnEquality_(bailOnEquality)
+{
+setGuard();
+setMovable();
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(GuardObjectIdentity)
+static MGuardObjectIdentity *New(TempAllocator &alloc, MDefinition *obj, JSObject *singleObject,
+bool bailOnEquality) {
+return new(alloc) MGuardObjectIdentity(obj, singleObject, bailOnEquality);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+JSObject *singleObject() const {
+return singleObject_;
+}
+bool bailOnEquality() const {
+return bailOnEquality_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isGuardObjectIdentity())
+return false;
+if (singleObject() != ins->toGuardObjectIdentity()->singleObject())
+return false;
+if (bailOnEquality() != ins->toGuardObjectIdentity()->bailOnEquality())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Guard on an object's class.
+class MGuardClass
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+const Class *class_;
+MGuardClass(MDefinition *obj, const Class *clasp)
+: MUnaryInstruction(obj),
+class_(clasp)
+{
+setGuard();
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(GuardClass)
+static MGuardClass *New(TempAllocator &alloc, MDefinition *obj, const Class *clasp) {
+return new(alloc) MGuardClass(obj, clasp);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *obj() const {
+return getOperand(0);
+}
+const Class *getClass() const {
+return class_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isGuardClass())
+return false;
+if (getClass() != ins->toGuardClass()->getClass())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::ObjectFields);
+}
+};
+// Load from vp[slot] (slots that are not inline in an object).
+class MLoadSlot
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+uint32_t slot_;
+MLoadSlot(MDefinition *slots, uint32_t slot)
+: MUnaryInstruction(slots),
+slot_(slot)
+{
+setResultType(MIRType_Value);
+setMovable();
+JS_ASSERT(slots->type() == MIRType_Slots);
+}
+public:
+INSTRUCTION_HEADER(LoadSlot)
+static MLoadSlot *New(TempAllocator &alloc, MDefinition *slots, uint32_t slot) {
+return new(alloc) MLoadSlot(slots, slot);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *slots() const {
+return getOperand(0);
+}
+uint32_t slot() const {
+return slot_;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isLoadSlot())
+return false;
+if (slot() != ins->toLoadSlot()->slot())
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+JS_ASSERT(slots()->type() == MIRType_Slots);
+return AliasSet::Load(AliasSet::DynamicSlot);
+}
+bool mightAlias(const MDefinition *store) const;
+};
+// Inline call to access a function's environment (scope chain).
+class MFunctionEnvironment
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+public:
+MFunctionEnvironment(MDefinition *function)
+: MUnaryInstruction(function)
+{
+setResultType(MIRType_Object);
+setMovable();
+}
+INSTRUCTION_HEADER(FunctionEnvironment)
+static MFunctionEnvironment *New(TempAllocator &alloc, MDefinition *function) {
+return new(alloc) MFunctionEnvironment(function);
+}
+MDefinition *function() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+// A function's environment is fixed.
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Loads the current js::ForkJoinContext*.
+// Only applicable in ParallelExecution.
+class MForkJoinContext
+: public MNullaryInstruction
+{
+MForkJoinContext()
+: MNullaryInstruction()
+{
+setResultType(MIRType_ForkJoinContext);
+}
+public:
+INSTRUCTION_HEADER(ForkJoinContext);
+static MForkJoinContext *New(TempAllocator &alloc) {
+return new(alloc) MForkJoinContext();
+}
+AliasSet getAliasSet() const {
+// Indicate that this instruction reads nothing, stores nothing.
+// (For all intents and purposes)
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Calls the ForkJoinGetSlice stub, used for inlining the eponymous intrinsic.
+// Only applicable in ParallelExecution.
+class MForkJoinGetSlice
+: public MUnaryInstruction
+{
+MForkJoinGetSlice(MDefinition *cx)
+: MUnaryInstruction(cx)
+{
+setResultType(MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(ForkJoinGetSlice);
+static MForkJoinGetSlice *New(TempAllocator &alloc, MDefinition *cx) {
+return new(alloc) MForkJoinGetSlice(cx);
+}
+MDefinition *forkJoinContext() {
+return getOperand(0);
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Store to vp[slot] (slots that are not inline in an object).
+class MStoreSlot
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, NoFloatPolicy<1> >
+{
+uint32_t slot_;
+MIRType slotType_;
+bool needsBarrier_;
+MStoreSlot(MDefinition *slots, uint32_t slot, MDefinition *value, bool barrier)
+: MBinaryInstruction(slots, value),
+slot_(slot),
+slotType_(MIRType_Value),
+needsBarrier_(barrier)
+{
+JS_ASSERT(slots->type() == MIRType_Slots);
+}
+public:
+INSTRUCTION_HEADER(StoreSlot)
+static MStoreSlot *New(TempAllocator &alloc, MDefinition *slots, uint32_t slot,
+MDefinition *value)
+{
+return new(alloc) MStoreSlot(slots, slot, value, false);
+}
+static MStoreSlot *NewBarriered(TempAllocator &alloc, MDefinition *slots, uint32_t slot,
+MDefinition *value)
+{
+return new(alloc) MStoreSlot(slots, slot, value, true);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *slots() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+uint32_t slot() const {
+return slot_;
+}
+MIRType slotType() const {
+return slotType_;
+}
+void setSlotType(MIRType slotType) {
+JS_ASSERT(slotType != MIRType_None);
+slotType_ = slotType;
+}
+bool needsBarrier() const {
+return needsBarrier_;
+}
+void setNeedsBarrier() {
+needsBarrier_ = true;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::DynamicSlot);
+}
+};
+class MGetNameCache
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+public:
+enum AccessKind {
+NAMETYPEOF,
+NAME
+};
+private:
+CompilerRootPropertyName name_;
+AccessKind kind_;
+MGetNameCache(MDefinition *obj, PropertyName *name, AccessKind kind)
+: MUnaryInstruction(obj),
+name_(name),
+kind_(kind)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(GetNameCache)
+static MGetNameCache *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,
+AccessKind kind)
+{
+return new(alloc) MGetNameCache(obj, name, kind);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *scopeObj() const {
+return getOperand(0);
+}
+PropertyName *name() const {
+return name_;
+}
+AccessKind accessKind() const {
+return kind_;
+}
+};
+class MCallGetIntrinsicValue : public MNullaryInstruction
+{
+CompilerRootPropertyName name_;
+MCallGetIntrinsicValue(PropertyName *name)
+: name_(name)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(CallGetIntrinsicValue)
+static MCallGetIntrinsicValue *New(TempAllocator &alloc, PropertyName *name) {
+return new(alloc) MCallGetIntrinsicValue(name);
+}
+PropertyName *name() const {
+return name_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MCallsiteCloneCache
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+jsbytecode *callPc_;
+MCallsiteCloneCache(MDefinition *callee, jsbytecode *callPc)
+: MUnaryInstruction(callee),
+callPc_(callPc)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(CallsiteCloneCache);
+static MCallsiteCloneCache *New(TempAllocator &alloc, MDefinition *callee, jsbytecode *callPc) {
+return new(alloc) MCallsiteCloneCache(callee, callPc);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *callee() const {
+return getOperand(0);
+}
+jsbytecode *callPc() const {
+return callPc_;
+}
+// Callsite cloning is idempotent.
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MSetPropertyInstruction : public MBinaryInstruction
+{
+CompilerRootPropertyName name_;
+bool strict_;
+bool needsBarrier_;
+protected:
+MSetPropertyInstruction(MDefinition *obj, MDefinition *value, PropertyName *name,
+bool strict)
+: MBinaryInstruction(obj, value),
+name_(name), strict_(strict), needsBarrier_(true)
+{}
+public:
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+PropertyName *name() const {
+return name_;
+}
+bool strict() const {
+return strict_;
+}
+bool needsBarrier() const {
+return needsBarrier_;
+}
+void setNeedsBarrier() {
+needsBarrier_ = true;
+}
+};
+class MSetElementInstruction
+: public MTernaryInstruction
+{
+protected:
+MSetElementInstruction(MDefinition *object, MDefinition *index, MDefinition *value)
+: MTernaryInstruction(object, index, value)
+{
+}
+public:
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+MDefinition *value() const {
+return getOperand(2);
+}
+};
+class MDeleteProperty
+: public MUnaryInstruction,
+public BoxInputsPolicy
+{
+CompilerRootPropertyName name_;
+protected:
+MDeleteProperty(MDefinition *val, PropertyName *name)
+: MUnaryInstruction(val),
+name_(name)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(DeleteProperty)
+static MDeleteProperty *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name) {
+return new(alloc) MDeleteProperty(obj, name);
+}
+MDefinition *value() const {
+return getOperand(0);
+}
+PropertyName *name() const {
+return name_;
+}
+virtual TypePolicy *typePolicy() {
+return this;
+}
+};
+class MDeleteElement
+: public MBinaryInstruction,
+public BoxInputsPolicy
+{
+MDeleteElement(MDefinition *value, MDefinition *index)
+: MBinaryInstruction(value, index)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(DeleteElement)
+static MDeleteElement *New(TempAllocator &alloc, MDefinition *value, MDefinition *index) {
+return new(alloc) MDeleteElement(value, index);
+}
+MDefinition *value() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+virtual TypePolicy *typePolicy() {
+return this;
+}
+};
+// Note: This uses CallSetElementPolicy to always box its second input,
+// ensuring we don't need two LIR instructions to lower this.
+class MCallSetProperty
+: public MSetPropertyInstruction,
+public CallSetElementPolicy
+{
+MCallSetProperty(MDefinition *obj, MDefinition *value, PropertyName *name, bool strict)
+: MSetPropertyInstruction(obj, value, name, strict)
+{
+}
+public:
+INSTRUCTION_HEADER(CallSetProperty)
+static MCallSetProperty *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value,
+PropertyName *name, bool strict)
+{
+return new(alloc) MCallSetProperty(obj, value, name, strict);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MSetPropertyCache
+: public MSetPropertyInstruction,
+public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >
+{
+bool needsTypeBarrier_;
+MSetPropertyCache(MDefinition *obj, MDefinition *value, PropertyName *name, bool strict,
+bool typeBarrier)
+: MSetPropertyInstruction(obj, value, name, strict),
+needsTypeBarrier_(typeBarrier)
+{
+}
+public:
+INSTRUCTION_HEADER(SetPropertyCache)
+static MSetPropertyCache *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value,
+PropertyName *name, bool strict, bool typeBarrier)
+{
+return new(alloc) MSetPropertyCache(obj, value, name, strict, typeBarrier);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool needsTypeBarrier() const {
+return needsTypeBarrier_;
+}
+};
+class MSetElementCache
+: public MSetElementInstruction,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+bool strict_;
+bool guardHoles_;
+MSetElementCache(MDefinition *obj, MDefinition *index, MDefinition *value, bool strict,
+bool guardHoles)
+: MSetElementInstruction(obj, index, value),
+strict_(strict),
+guardHoles_(guardHoles)
+{
+}
+public:
+INSTRUCTION_HEADER(SetElementCache);
+static MSetElementCache *New(TempAllocator &alloc, MDefinition *obj, MDefinition *index,
+MDefinition *value, bool strict, bool guardHoles)
+{
+return new(alloc) MSetElementCache(obj, index, value, strict, guardHoles);
+}
+bool strict() const {
+return strict_;
+}
+bool guardHoles() const {
+return guardHoles_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool canConsumeFloat32(MUse *use) const { return use->index() == 2; }
+};
+class MCallGetProperty
+: public MUnaryInstruction,
+public BoxInputsPolicy
+{
+CompilerRootPropertyName name_;
+bool idempotent_;
+bool callprop_;
+MCallGetProperty(MDefinition *value, PropertyName *name, bool callprop)
+: MUnaryInstruction(value), name_(name),
+idempotent_(false),
+callprop_(callprop)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(CallGetProperty)
+static MCallGetProperty *New(TempAllocator &alloc, MDefinition *value, PropertyName *name,
+bool callprop)
+{
+return new(alloc) MCallGetProperty(value, name, callprop);
+}
+MDefinition *value() const {
+return getOperand(0);
+}
+PropertyName *name() const {
+return name_;
+}
+bool callprop() const {
+return callprop_;
+}
+TypePolicy *typePolicy() {
+return this;
+}
+// Constructors need to perform a GetProp on the function prototype.
+// Since getters cannot be set on the prototype, fetching is non-effectful.
+// The operation may be safely repeated in case of bailout.
+void setIdempotent() {
+idempotent_ = true;
+}
+AliasSet getAliasSet() const {
+if (!idempotent_)
+return AliasSet::Store(AliasSet::Any);
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Inline call to handle lhs[rhs]. The first input is a Value so that this
+// instruction can handle both objects and strings.
+class MCallGetElement
+: public MBinaryInstruction,
+public BoxInputsPolicy
+{
+MCallGetElement(MDefinition *lhs, MDefinition *rhs)
+: MBinaryInstruction(lhs, rhs)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(CallGetElement)
+static MCallGetElement *New(TempAllocator &alloc, MDefinition *lhs, MDefinition *rhs) {
+return new(alloc) MCallGetElement(lhs, rhs);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MCallSetElement
+: public MSetElementInstruction,
+public CallSetElementPolicy
+{
+MCallSetElement(MDefinition *object, MDefinition *index, MDefinition *value)
+: MSetElementInstruction(object, index, value)
+{
+}
+public:
+INSTRUCTION_HEADER(CallSetElement)
+static MCallSetElement *New(TempAllocator &alloc, MDefinition *object, MDefinition *index,
+MDefinition *value)
+{
+return new(alloc) MCallSetElement(object, index, value);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MCallInitElementArray
+: public MAryInstruction<2>,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+uint32_t index_;
+MCallInitElementArray(MDefinition *obj, uint32_t index, MDefinition *val)
+: index_(index)
+{
+setOperand(0, obj);
+setOperand(1, val);
+}
+public:
+INSTRUCTION_HEADER(CallInitElementArray)
+static MCallInitElementArray *New(TempAllocator &alloc, MDefinition *obj, uint32_t index,
+MDefinition *val)
+{
+return new(alloc) MCallInitElementArray(obj, index, val);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+uint32_t index() const {
+return index_;
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MSetDOMProperty
+: public MAryInstruction<2>,
+public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >
+{
+const JSJitSetterOp func_;
+MSetDOMProperty(const JSJitSetterOp func, MDefinition *obj, MDefinition *val)
+: func_(func)
+{
+setOperand(0, obj);
+setOperand(1, val);
+}
+public:
+INSTRUCTION_HEADER(SetDOMProperty)
+static MSetDOMProperty *New(TempAllocator &alloc, const JSJitSetterOp func, MDefinition *obj,
+MDefinition *val)
+{
+return new(alloc) MSetDOMProperty(func, obj, val);
+}
+const JSJitSetterOp fun() {
+return func_;
+}
+MDefinition *object() {
+return getOperand(0);
+}
+MDefinition *value()
+{
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MGetDOMProperty
+: public MAryInstruction<2>,
+public ObjectPolicy<0>
+{
+const JSJitInfo *info_;
+protected:
+MGetDOMProperty(const JSJitInfo *jitinfo, MDefinition *obj, MDefinition *guard)
+: info_(jitinfo)
+{
+JS_ASSERT(jitinfo);
+JS_ASSERT(jitinfo->type() == JSJitInfo::Getter);
+setOperand(0, obj);
+// Pin the guard as an operand if we want to hoist later
+setOperand(1, guard);
+// We are movable iff the jitinfo says we can be.
+if (isDomMovable()) {
+JS_ASSERT(jitinfo->aliasSet() != JSJitInfo::AliasEverything);
+setMovable();
+} else {
+// If we're not movable, that means we shouldn't be DCEd either,
+// because we might throw an exception when called, and getting rid
+// of that is observable.
+setGuard();
+}
+setResultType(MIRType_Value);
+}
+const JSJitInfo *info() const {
+return info_;
+}
+public:
+INSTRUCTION_HEADER(GetDOMProperty)
+static MGetDOMProperty *New(TempAllocator &alloc, const JSJitInfo *info, MDefinition *obj,
+MDefinition *guard)
+{
+return new(alloc) MGetDOMProperty(info, obj, guard);
+}
+const JSJitGetterOp fun() {
+return info_->getter;
+}
+bool isInfallible() const {
+return info_->isInfallible;
+}
+bool isDomMovable() const {
+return info_->isMovable;
+}
+JSJitInfo::AliasSet domAliasSet() const {
+return info_->aliasSet();
+}
+size_t domMemberSlotIndex() const {
+MOZ_ASSERT(info_->isInSlot);
+return info_->slotIndex;
+}
+MDefinition *object() {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!isDomMovable())
+return false;
+if (!ins->isGetDOMProperty())
+return false;
+// Checking the jitinfo is the same as checking the constant function
+if (!(info() == ins->toGetDOMProperty()->info()))
+return false;
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+JSJitInfo::AliasSet aliasSet = domAliasSet();
+if (aliasSet == JSJitInfo::AliasNone)
+return AliasSet::None();
+if (aliasSet == JSJitInfo::AliasDOMSets)
+return AliasSet::Load(AliasSet::DOMProperty);
+JS_ASSERT(aliasSet == JSJitInfo::AliasEverything);
+return AliasSet::Store(AliasSet::Any);
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MGetDOMMember : public MGetDOMProperty
+{
+// We inherit everything from MGetDOMProperty except our possiblyCalls value
+MGetDOMMember(const JSJitInfo *jitinfo, MDefinition *obj, MDefinition *guard)
+: MGetDOMProperty(jitinfo, obj, guard)
+{
+}
+public:
+INSTRUCTION_HEADER(GetDOMMember)
+static MGetDOMMember *New(TempAllocator &alloc, const JSJitInfo *info, MDefinition *obj,
+MDefinition *guard)
+{
+return new(alloc) MGetDOMMember(info, obj, guard);
+}
+bool possiblyCalls() const {
+return false;
+}
+};
+class MStringLength
+: public MUnaryInstruction,
+public StringPolicy<0>
+{
+MStringLength(MDefinition *string)
+: MUnaryInstruction(string)
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(StringLength)
+static MStringLength *New(TempAllocator &alloc, MDefinition *string) {
+return new(alloc) MStringLength(string);
+}
+MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *string() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+// The string |length| property is immutable, so there is no
+// implicit dependency.
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+// Inlined version of Math.floor().
+class MFloor
+: public MUnaryInstruction,
+public FloatingPointPolicy<0>
+{
+MFloor(MDefinition *num)
+: MUnaryInstruction(num)
+{
+setResultType(MIRType_Int32);
+setPolicyType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Floor)
+static MFloor *New(TempAllocator &alloc, MDefinition *num) {
+return new(alloc) MFloor(num);
+}
+MDefinition *num() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool isFloat32Commutative() const {
+return true;
+}
+void trySpecializeFloat32(TempAllocator &alloc);
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+return true;
+}
+#endif
+};
+// Inlined version of Math.round().
+class MRound
+: public MUnaryInstruction,
+public FloatingPointPolicy<0>
+{
+MRound(MDefinition *num)
+: MUnaryInstruction(num)
+{
+setResultType(MIRType_Int32);
+setPolicyType(MIRType_Double);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(Round)
+static MRound *New(TempAllocator &alloc, MDefinition *num) {
+return new(alloc) MRound(num);
+}
+MDefinition *num() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool isFloat32Commutative() const {
+return true;
+}
+void trySpecializeFloat32(TempAllocator &alloc);
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+return true;
+}
+#endif
+};
+class MIteratorStart
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+uint8_t flags_;
+MIteratorStart(MDefinition *obj, uint8_t flags)
+: MUnaryInstruction(obj), flags_(flags)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(IteratorStart)
+static MIteratorStart *New(TempAllocator &alloc, MDefinition *obj, uint8_t flags) {
+return new(alloc) MIteratorStart(obj, flags);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+uint8_t flags() const {
+return flags_;
+}
+};
+class MIteratorNext
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MIteratorNext(MDefinition *iter)
+: MUnaryInstruction(iter)
+{
+setResultType(MIRType_Value);
+}
+public:
+INSTRUCTION_HEADER(IteratorNext)
+static MIteratorNext *New(TempAllocator &alloc, MDefinition *iter) {
+return new(alloc) MIteratorNext(iter);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *iterator() const {
+return getOperand(0);
+}
+};
+class MIteratorMore
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MIteratorMore(MDefinition *iter)
+: MUnaryInstruction(iter)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(IteratorMore)
+static MIteratorMore *New(TempAllocator &alloc, MDefinition *iter) {
+return new(alloc) MIteratorMore(iter);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *iterator() const {
+return getOperand(0);
+}
+};
+class MIteratorEnd
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MIteratorEnd(MDefinition *iter)
+: MUnaryInstruction(iter)
+{ }
+public:
+INSTRUCTION_HEADER(IteratorEnd)
+static MIteratorEnd *New(TempAllocator &alloc, MDefinition *iter) {
+return new(alloc) MIteratorEnd(iter);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *iterator() const {
+return getOperand(0);
+}
+};
+// Implementation for 'in' operator.
+class MIn
+: public MBinaryInstruction,
+public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
+{
+MIn(MDefinition *key, MDefinition *obj)
+: MBinaryInstruction(key, obj)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(In)
+static MIn *New(TempAllocator &alloc, MDefinition *key, MDefinition *obj) {
+return new(alloc) MIn(key, obj);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Test whether the index is in the array bounds or a hole.
+class MInArray
+: public MQuaternaryInstruction,
+public ObjectPolicy<3>
+{
+bool needsHoleCheck_;
+bool needsNegativeIntCheck_;
+MInArray(MDefinition *elements, MDefinition *index,
+MDefinition *initLength, MDefinition *object,
+bool needsHoleCheck)
+: MQuaternaryInstruction(elements, index, initLength, object),
+needsHoleCheck_(needsHoleCheck),
+needsNegativeIntCheck_(true)
+{
+setResultType(MIRType_Boolean);
+setMovable();
+JS_ASSERT(elements->type() == MIRType_Elements);
+JS_ASSERT(index->type() == MIRType_Int32);
+JS_ASSERT(initLength->type() == MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(InArray)
+static MInArray *New(TempAllocator &alloc, MDefinition *elements, MDefinition *index,
+MDefinition *initLength, MDefinition *object,
+bool needsHoleCheck)
+{
+return new(alloc) MInArray(elements, index, initLength, object, needsHoleCheck);
+}
+MDefinition *elements() const {
+return getOperand(0);
+}
+MDefinition *index() const {
+return getOperand(1);
+}
+MDefinition *initLength() const {
+return getOperand(2);
+}
+MDefinition *object() const {
+return getOperand(3);
+}
+bool needsHoleCheck() const {
+return needsHoleCheck_;
+}
+bool needsNegativeIntCheck() const {
+return needsNegativeIntCheck_;
+}
+void collectRangeInfoPreTrunc();
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::Element);
+}
+bool congruentTo(const MDefinition *ins) const {
+if (!ins->isInArray())
+return false;
+const MInArray *other = ins->toInArray();
+if (needsHoleCheck() != other->needsHoleCheck())
+return false;
+if (needsNegativeIntCheck() != other->needsNegativeIntCheck())
+return false;
+return congruentIfOperandsEqual(other);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+// Implementation for instanceof operator with specific rhs.
+class MInstanceOf
+: public MUnaryInstruction,
+public InstanceOfPolicy
+{
+CompilerRootObject protoObj_;
+MInstanceOf(MDefinition *obj, JSObject *proto)
+: MUnaryInstruction(obj),
+protoObj_(proto)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(InstanceOf)
+static MInstanceOf *New(TempAllocator &alloc, MDefinition *obj, JSObject *proto) {
+return new(alloc) MInstanceOf(obj, proto);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+JSObject *prototypeObject() {
+return protoObj_;
+}
+};
+// Implementation for instanceof operator with unknown rhs.
+class MCallInstanceOf
+: public MBinaryInstruction,
+public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
+{
+MCallInstanceOf(MDefinition *obj, MDefinition *proto)
+: MBinaryInstruction(obj, proto)
+{
+setResultType(MIRType_Boolean);
+}
+public:
+INSTRUCTION_HEADER(CallInstanceOf)
+static MCallInstanceOf *New(TempAllocator &alloc, MDefinition *obj, MDefinition *proto) {
+return new(alloc) MCallInstanceOf(obj, proto);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MArgumentsLength : public MNullaryInstruction
+{
+MArgumentsLength()
+{
+setResultType(MIRType_Int32);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(ArgumentsLength)
+static MArgumentsLength *New(TempAllocator &alloc) {
+return new(alloc) MArgumentsLength();
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+// Arguments |length| cannot be mutated by Ion Code.
+return AliasSet::None();
+}
+void computeRange(TempAllocator &alloc);
+};
+// This MIR instruction is used to get an argument from the actual arguments.
+class MGetFrameArgument
+: public MUnaryInstruction,
+public IntPolicy<0>
+{
+bool scriptHasSetArg_;
+MGetFrameArgument(MDefinition *idx, bool scriptHasSetArg)
+: MUnaryInstruction(idx),
+scriptHasSetArg_(scriptHasSetArg)
+{
+setResultType(MIRType_Value);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(GetFrameArgument)
+static MGetFrameArgument *New(TempAllocator &alloc, MDefinition *idx, bool scriptHasSetArg) {
+return new(alloc) MGetFrameArgument(idx, scriptHasSetArg);
+}
+MDefinition *index() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+// If the script doesn't have any JSOP_SETARG ops, then this instruction is never
+// aliased.
+if (scriptHasSetArg_)
+return AliasSet::Load(AliasSet::FrameArgument);
+return AliasSet::None();
+}
+};
+// This MIR instruction is used to set an argument value in the frame.
+class MSetFrameArgument
+: public MUnaryInstruction,
+public NoFloatPolicy<0>
+{
+uint32_t argno_;
+MSetFrameArgument(uint32_t argno, MDefinition *value)
+: MUnaryInstruction(value),
+argno_(argno)
+{
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(SetFrameArgument)
+static MSetFrameArgument *New(TempAllocator &alloc, uint32_t argno, MDefinition *value) {
+return new(alloc) MSetFrameArgument(argno, value);
+}
+uint32_t argno() const {
+return argno_;
+}
+MDefinition *value() const {
+return getOperand(0);
+}
+bool congruentTo(const MDefinition *ins) const {
+return false;
+}
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::FrameArgument);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+};
+class MRestCommon
+{
+unsigned numFormals_;
+CompilerRootObject templateObject_;
+protected:
+MRestCommon(unsigned numFormals, JSObject *templateObject)
+: numFormals_(numFormals),
+templateObject_(templateObject)
+{ }
+public:
+unsigned numFormals() const {
+return numFormals_;
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+};
+class MRest
+: public MUnaryInstruction,
+public MRestCommon,
+public IntPolicy<0>
+{
+MRest(types::CompilerConstraintList *constraints, MDefinition *numActuals, unsigned numFormals,
+JSObject *templateObject)
+: MUnaryInstruction(numActuals),
+MRestCommon(numFormals, templateObject)
+{
+setResultType(MIRType_Object);
+setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+}
+public:
+INSTRUCTION_HEADER(Rest);
+static MRest *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MDefinition *numActuals, unsigned numFormals,
+JSObject *templateObject)
+{
+return new(alloc) MRest(constraints, numActuals, numFormals, templateObject);
+}
+MDefinition *numActuals() const {
+return getOperand(0);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MRestPar
+: public MBinaryInstruction,
+public MRestCommon,
+public IntPolicy<1>
+{
+MRestPar(MDefinition *cx, MDefinition *numActuals, unsigned numFormals,
+JSObject *templateObject, types::TemporaryTypeSet *resultTypes)
+: MBinaryInstruction(cx, numActuals),
+MRestCommon(numFormals, templateObject)
+{
+setResultType(MIRType_Object);
+setResultTypeSet(resultTypes);
+}
+public:
+INSTRUCTION_HEADER(RestPar);
+static MRestPar *New(TempAllocator &alloc, MDefinition *cx, MRest *rest) {
+return new(alloc) MRestPar(cx, rest->numActuals(), rest->numFormals(),
+rest->templateObject(), rest->resultTypeSet());
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *numActuals() const {
+return getOperand(1);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// Guard on an object being safe for writes by current parallel cx.
+// Must be either thread-local or else a handle into the destination array.
+class MGuardThreadExclusive
+: public MBinaryInstruction,
+public ObjectPolicy<1>
+{
+MGuardThreadExclusive(MDefinition *cx, MDefinition *obj)
+: MBinaryInstruction(cx, obj)
+{
+setResultType(MIRType_None);
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(GuardThreadExclusive);
+static MGuardThreadExclusive *New(TempAllocator &alloc, MDefinition *cx, MDefinition *obj) {
+return new(alloc) MGuardThreadExclusive(cx, obj);
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *object() const {
+return getOperand(1);
+}
+BailoutKind bailoutKind() const {
+return Bailout_Normal;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MFilterTypeSet
+: public MUnaryInstruction,
+public FilterTypeSetPolicy
+{
+MFilterTypeSet(MDefinition *def, types::TemporaryTypeSet *types)
+: MUnaryInstruction(def)
+{
+JS_ASSERT(!types->unknown());
+setResultType(types->getKnownMIRType());
+setResultTypeSet(types);
+}
+public:
+INSTRUCTION_HEADER(FilterTypeSet)
+static MFilterTypeSet *New(TempAllocator &alloc, MDefinition *def, types::TemporaryTypeSet *types) {
+return new(alloc) MFilterTypeSet(def, types);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *def) const {
+return false;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+virtual bool neverHoist() const {
+return resultTypeSet()->empty();
+}
+};
+// Given a value, guard that the value is in a particular TypeSet, then returns
+// that value.
+class MTypeBarrier
+: public MUnaryInstruction,
+public TypeBarrierPolicy
+{
+MTypeBarrier(MDefinition *def, types::TemporaryTypeSet *types)
+: MUnaryInstruction(def)
+{
+JS_ASSERT(!types->unknown());
+setResultType(types->getKnownMIRType());
+setResultTypeSet(types);
+setGuard();
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(TypeBarrier)
+static MTypeBarrier *New(TempAllocator &alloc, MDefinition *def, types::TemporaryTypeSet *types) {
+return new(alloc) MTypeBarrier(def, types);
+}
+void printOpcode(FILE *fp) const;
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *def) const {
+return false;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+virtual bool neverHoist() const {
+return resultTypeSet()->empty();
+}
+bool alwaysBails() const {
+// If mirtype of input doesn't agree with mirtype of barrier,
+// we will definitely bail.
+MIRType type = resultTypeSet()->getKnownMIRType();
+if (type == MIRType_Value)
+return false;
+if (input()->type() == MIRType_Value)
+return false;
+return input()->type() != type;
+}
+};
+// Like MTypeBarrier, guard that the value is in the given type set. This is
+// used before property writes to ensure the value being written is represented
+// in the property types for the object.
+class MMonitorTypes : public MUnaryInstruction, public BoxInputsPolicy
+{
+const types::TemporaryTypeSet *typeSet_;
+MMonitorTypes(MDefinition *def, const types::TemporaryTypeSet *types)
+: MUnaryInstruction(def),
+typeSet_(types)
+{
+setGuard();
+JS_ASSERT(!types->unknown());
+}
+public:
+INSTRUCTION_HEADER(MonitorTypes)
+static MMonitorTypes *New(TempAllocator &alloc, MDefinition *def, const types::TemporaryTypeSet *types) {
+return new(alloc) MMonitorTypes(def, types);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+const types::TemporaryTypeSet *typeSet() const {
+return typeSet_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Given a value being written to another object, update the generational store
+// buffer if the value is in the nursery and object is in the tenured heap.
+class MPostWriteBarrier : public MBinaryInstruction, public ObjectPolicy<0>
+{
+MPostWriteBarrier(MDefinition *obj, MDefinition *value)
+: MBinaryInstruction(obj, value)
+{
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(PostWriteBarrier)
+static MPostWriteBarrier *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value) {
+return new(alloc) MPostWriteBarrier(obj, value);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+MDefinition *value() const {
+return getOperand(1);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+#ifdef DEBUG
+bool isConsistentFloat32Use(MUse *use) const {
+// During lowering, values that neither have object nor value MIR type
+// are ignored, thus Float32 can show up at this point without any issue.
+return use->index() == 1;
+}
+#endif
+};
+class MNewSlots : public MNullaryInstruction
+{
+unsigned nslots_;
+MNewSlots(unsigned nslots)
+: nslots_(nslots)
+{
+setResultType(MIRType_Slots);
+}
+public:
+INSTRUCTION_HEADER(NewSlots)
+static MNewSlots *New(TempAllocator &alloc, unsigned nslots) {
+return new(alloc) MNewSlots(nslots);
+}
+unsigned nslots() const {
+return nslots_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+class MNewDeclEnvObject : public MNullaryInstruction
+{
+CompilerRootObject templateObj_;
+MNewDeclEnvObject(JSObject *templateObj)
+: MNullaryInstruction(),
+templateObj_(templateObj)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewDeclEnvObject);
+static MNewDeclEnvObject *New(TempAllocator &alloc, JSObject *templateObj) {
+return new(alloc) MNewDeclEnvObject(templateObj);
+}
+JSObject *templateObj() {
+return templateObj_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MNewCallObjectBase : public MUnaryInstruction
+{
+CompilerRootObject templateObj_;
+protected:
+MNewCallObjectBase(JSObject *templateObj, MDefinition *slots)
+: MUnaryInstruction(slots),
+templateObj_(templateObj)
+{
+setResultType(MIRType_Object);
+}
+public:
+MDefinition *slots() {
+return getOperand(0);
+}
+JSObject *templateObject() {
+return templateObj_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MNewCallObject : public MNewCallObjectBase
+{
+public:
+INSTRUCTION_HEADER(NewCallObject)
+MNewCallObject(JSObject *templateObj, MDefinition *slots)
+: MNewCallObjectBase(templateObj, slots)
+{}
+static MNewCallObject *
+New(TempAllocator &alloc, JSObject *templateObj, MDefinition *slots)
+{
+return new(alloc) MNewCallObject(templateObj, slots);
+}
+};
+class MNewRunOnceCallObject : public MNewCallObjectBase
+{
+public:
+INSTRUCTION_HEADER(NewRunOnceCallObject)
+MNewRunOnceCallObject(JSObject *templateObj, MDefinition *slots)
+: MNewCallObjectBase(templateObj, slots)
+{}
+static MNewRunOnceCallObject *
+New(TempAllocator &alloc, JSObject *templateObj, MDefinition *slots)
+{
+return new(alloc) MNewRunOnceCallObject(templateObj, slots);
+}
+};
+class MNewCallObjectPar : public MBinaryInstruction
+{
+CompilerRootObject templateObj_;
+MNewCallObjectPar(MDefinition *cx, JSObject *templateObj, MDefinition *slots)
+: MBinaryInstruction(cx, slots),
+templateObj_(templateObj)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewCallObjectPar);
+static MNewCallObjectPar *New(TempAllocator &alloc, MDefinition *cx, MNewCallObjectBase *callObj) {
+return new(alloc) MNewCallObjectPar(cx, callObj->templateObject(), callObj->slots());
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *slots() const {
+return getOperand(1);
+}
+JSObject *templateObj() const {
+return templateObj_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MNewStringObject :
+public MUnaryInstruction,
+public ConvertToStringPolicy<0>
+{
+CompilerRootObject templateObj_;
+MNewStringObject(MDefinition *input, JSObject *templateObj)
+: MUnaryInstruction(input),
+templateObj_(templateObj)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewStringObject)
+static MNewStringObject *New(TempAllocator &alloc, MDefinition *input, JSObject *templateObj) {
+return new(alloc) MNewStringObject(input, templateObj);
+}
+StringObject *templateObj() const;
+TypePolicy *typePolicy() {
+return this;
+}
+};
+// Node that represents that a script has begun executing. This comes at the
+// start of the function and is called once per function (including inline
+// ones)
+class MProfilerStackOp : public MNullaryInstruction
+{
+public:
+enum Type {
+Enter,        // a function has begun executing and it is not inline
+Exit,         // any function has exited (inlined or normal)
+InlineEnter,  // an inline function has begun executing
+InlineExit    // all instructions of an inline function are done, a
+// return from the inline function could have occurred
+// before this boundary
+};
+private:
+JSScript *script_;
+Type type_;
+unsigned inlineLevel_;
+MProfilerStackOp(JSScript *script, Type type, unsigned inlineLevel)
+: script_(script), type_(type), inlineLevel_(inlineLevel)
+{
+JS_ASSERT_IF(type != InlineExit, script != nullptr);
+JS_ASSERT_IF(type == InlineEnter, inlineLevel != 0);
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(ProfilerStackOp)
+static MProfilerStackOp *New(TempAllocator &alloc, JSScript *script, Type type,
+unsigned inlineLevel = 0) {
+return new(alloc) MProfilerStackOp(script, type, inlineLevel);
+}
+JSScript *script() {
+return script_;
+}
+Type type() {
+return type_;
+}
+unsigned inlineLevel() {
+return inlineLevel_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// This is an alias for MLoadFixedSlot.
+class MEnclosingScope : public MLoadFixedSlot
+{
+MEnclosingScope(MDefinition *obj)
+: MLoadFixedSlot(obj, ScopeObject::enclosingScopeSlot())
+{
+setResultType(MIRType_Object);
+}
+public:
+static MEnclosingScope *New(TempAllocator &alloc, MDefinition *obj) {
+return new(alloc) MEnclosingScope(obj);
+}
+AliasSet getAliasSet() const {
+// ScopeObject reserved slots are immutable.
+return AliasSet::None();
+}
+};
+// Creates a dense array of the given length.
+//
+// Note: the template object should be an *empty* dense array!
+class MNewDenseArrayPar : public MBinaryInstruction
+{
+CompilerRootObject templateObject_;
+MNewDenseArrayPar(MDefinition *cx, MDefinition *length, JSObject *templateObject)
+: MBinaryInstruction(cx, length),
+templateObject_(templateObject)
+{
+setResultType(MIRType_Object);
+}
+public:
+INSTRUCTION_HEADER(NewDenseArrayPar);
+static MNewDenseArrayPar *New(TempAllocator &alloc, MDefinition *cx, MDefinition *length,
+JSObject *templateObject)
+{
+return new(alloc) MNewDenseArrayPar(cx, length, templateObject);
+}
+MDefinition *forkJoinContext() const {
+return getOperand(0);
+}
+MDefinition *length() const {
+return getOperand(1);
+}
+JSObject *templateObject() const {
+return templateObject_;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+// A resume point contains the information needed to reconstruct the Baseline
+// state from a position in the JIT. See the big comment near resumeAfter() in
+// IonBuilder.cpp.
+class MResumePoint MOZ_FINAL : public MNode, public InlineForwardListNode<MResumePoint>
+{
+public:
+enum Mode {
+ResumeAt,    // Resume until before the current instruction
+ResumeAfter, // Resume after the current instruction
+Outer        // State before inlining.
+};
+private:
+friend class MBasicBlock;
+friend void AssertBasicGraphCoherency(MIRGraph &graph);
+FixedList<MUse> operands_;
+uint32_t stackDepth_;
+jsbytecode *pc_;
+MResumePoint *caller_;
+MInstruction *instruction_;
+Mode mode_;
+MResumePoint(MBasicBlock *block, jsbytecode *pc, MResumePoint *parent, Mode mode);
+void inherit(MBasicBlock *state);
+protected:
+// Initializes operands_ to an empty array of a fixed length.
+// The array may then be filled in by inherit().
+bool init(TempAllocator &alloc) {
+return operands_.init(alloc, stackDepth_);
+}
+// Overwrites an operand without updating its Uses.
+void setOperand(size_t index, MDefinition *operand) {
+JS_ASSERT(index < stackDepth_);
+operands_[index].set(operand, this, index);
+operand->addUse(&operands_[index]);
+}
+void clearOperand(size_t index) {
+JS_ASSERT(index < stackDepth_);
+operands_[index].set(nullptr, this, index);
+}
+MUse *getUseFor(size_t index) {
+return &operands_[index];
+}
+public:
+static MResumePoint *New(TempAllocator &alloc, MBasicBlock *block, jsbytecode *pc,
+MResumePoint *parent, Mode mode);
+MNode::Kind kind() const {
+return MNode::ResumePoint;
+}
+size_t numOperands() const {
+return stackDepth_;
+}
+MDefinition *getOperand(size_t index) const {
+JS_ASSERT(index < stackDepth_);
+return operands_[index].producer();
+}
+jsbytecode *pc() const {
+return pc_;
+}
+uint32_t stackDepth() const {
+return stackDepth_;
+}
+MResumePoint *caller() {
+return caller_;
+}
+void setCaller(MResumePoint *caller) {
+caller_ = caller;
+}
+uint32_t frameCount() const {
+uint32_t count = 1;
+for (MResumePoint *it = caller_; it; it = it->caller_)
+count++;
+return count;
+}
+MInstruction *instruction() {
+return instruction_;
+}
+void setInstruction(MInstruction *ins) {
+instruction_ = ins;
+}
+Mode mode() const {
+return mode_;
+}
+void discardUses() {
+for (size_t i = 0; i < stackDepth_; i++) {
+if (operands_[i].hasProducer())
+operands_[i].producer()->removeUse(&operands_[i]);
+}
+}
+bool writeRecoverData(CompactBufferWriter &writer) const;
+};
+class MIsCallable
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+MIsCallable(MDefinition *object)
+: MUnaryInstruction(object)
+{
+setResultType(MIRType_Boolean);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(IsCallable);
+static MIsCallable *New(TempAllocator &alloc, MDefinition *obj) {
+return new(alloc) MIsCallable(obj);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MHaveSameClass
+: public MBinaryInstruction,
+public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >
+{
+MHaveSameClass(MDefinition *left, MDefinition *right)
+: MBinaryInstruction(left, right)
+{
+setResultType(MIRType_Boolean);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(HaveSameClass);
+static MHaveSameClass *New(TempAllocator &alloc, MDefinition *left, MDefinition *right) {
+return new(alloc) MHaveSameClass(left, right);
+}
+TypePolicy *typePolicy() {
+return this;
+}
+bool congruentTo(const MDefinition *ins) const {
+return congruentIfOperandsEqual(ins);
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MHasClass
+: public MUnaryInstruction,
+public SingleObjectPolicy
+{
+const Class *class_;
+MHasClass(MDefinition *object, const Class *clasp)
+: MUnaryInstruction(object)
+, class_(clasp)
+{
+JS_ASSERT(object->type() == MIRType_Object);
+setResultType(MIRType_Boolean);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(HasClass);
+static MHasClass *New(TempAllocator &alloc, MDefinition *obj, const Class *clasp) {
+return new(alloc) MHasClass(obj, clasp);
+}
+MDefinition *object() const {
+return getOperand(0);
+}
+const Class *getClass() const {
+return class_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+// Increase the usecount of the provided script upon execution and test if
+// the usecount surpasses the threshold. Upon hit it will recompile the
+// outermost script (i.e. not the inlined script).
+class MRecompileCheck : public MNullaryInstruction
+{
+JSScript *script_;
+uint32_t recompileThreshold_;
+MRecompileCheck(JSScript *script, uint32_t recompileThreshold)
+: script_(script),
+recompileThreshold_(recompileThreshold)
+{
+setGuard();
+}
+public:
+INSTRUCTION_HEADER(RecompileCheck);
+static MRecompileCheck *New(TempAllocator &alloc, JSScript *script_, uint32_t useCount) {
+return new(alloc) MRecompileCheck(script_, useCount);
+}
+JSScript *script() const {
+return script_;
+}
+uint32_t recompileThreshold() const {
+return recompileThreshold_;
+}
+AliasSet getAliasSet() const {
+return AliasSet::None();
+}
+};
+class MAsmJSNeg : public MUnaryInstruction
+{
+MAsmJSNeg(MDefinition *op, MIRType type)
+: MUnaryInstruction(op)
+{
+setResultType(type);
+setMovable();
+}
+public:
+INSTRUCTION_HEADER(AsmJSNeg);
+static MAsmJSNeg *NewAsmJS(TempAllocator &alloc, MDefinition *op, MIRType type) {
+return new(alloc) MAsmJSNeg(op, type);
+}
+};
+class MAsmJSHeapAccess
+{
+ArrayBufferView::ViewType viewType_;
+bool skipBoundsCheck_;
+public:
+MAsmJSHeapAccess(ArrayBufferView::ViewType vt, bool s)
+: viewType_(vt), skipBoundsCheck_(s)
+{}
+ArrayBufferView::ViewType viewType() const { return viewType_; }
+bool skipBoundsCheck() const { return skipBoundsCheck_; }
+void setSkipBoundsCheck(bool v) { skipBoundsCheck_ = v; }
+};
+class MAsmJSLoadHeap : public MUnaryInstruction, public MAsmJSHeapAccess
+{
+MAsmJSLoadHeap(ArrayBufferView::ViewType vt, MDefinition *ptr)
+: MUnaryInstruction(ptr), MAsmJSHeapAccess(vt, false)
+{
+setMovable();
+if (vt == ArrayBufferView::TYPE_FLOAT32)
+setResultType(MIRType_Float32);
+else if (vt == ArrayBufferView::TYPE_FLOAT64)
+setResultType(MIRType_Double);
+else
+setResultType(MIRType_Int32);
+}
+public:
+INSTRUCTION_HEADER(AsmJSLoadHeap);
+static MAsmJSLoadHeap *New(TempAllocator &alloc, ArrayBufferView::ViewType vt, MDefinition *ptr) {
+return new(alloc) MAsmJSLoadHeap(vt, ptr);
+}
+MDefinition *ptr() const { return getOperand(0); }
+bool congruentTo(const MDefinition *ins) const;
+AliasSet getAliasSet() const {
+return AliasSet::Load(AliasSet::AsmJSHeap);
+}
+bool mightAlias(const MDefinition *def) const;
+};
+class MAsmJSStoreHeap : public MBinaryInstruction, public MAsmJSHeapAccess
+{
+MAsmJSStoreHeap(ArrayBufferView::ViewType vt, MDefinition *ptr, MDefinition *v)
+: MBinaryInstruction(ptr, v) , MAsmJSHeapAccess(vt, false)
+{}
+public:
+INSTRUCTION_HEADER(AsmJSStoreHeap);
+static MAsmJSStoreHeap *New(TempAllocator &alloc, ArrayBufferView::ViewType vt,
+MDefinition *ptr, MDefinition *v)
+{
+return new(alloc) MAsmJSStoreHeap(vt, ptr, v);
+}
+MDefinition *ptr() const { return getOperand(0); }
+MDefinition *value() const { return getOperand(1); }
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::AsmJSHeap);
+}
+};
+class MAsmJSLoadGlobalVar : public MNullaryInstruction
+{
+MAsmJSLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant)
+: globalDataOffset_(globalDataOffset), isConstant_(isConstant)
+{
+JS_ASSERT(IsNumberType(type));
+setResultType(type);
+setMovable();
+}
+unsigned globalDataOffset_;
+bool isConstant_;
+public:
+INSTRUCTION_HEADER(AsmJSLoadGlobalVar);
+static MAsmJSLoadGlobalVar *New(TempAllocator &alloc, MIRType type, unsigned globalDataOffset,
+bool isConstant)
+{
+return new(alloc) MAsmJSLoadGlobalVar(type, globalDataOffset, isConstant);
+}
+unsigned globalDataOffset() const { return globalDataOffset_; }
+bool congruentTo(const MDefinition *ins) const;
+AliasSet getAliasSet() const {
+return isConstant_ ? AliasSet::None() : AliasSet::Load(AliasSet::AsmJSGlobalVar);
+}
+bool mightAlias(const MDefinition *def) const;
+};
+class MAsmJSStoreGlobalVar : public MUnaryInstruction
+{
+MAsmJSStoreGlobalVar(unsigned globalDataOffset, MDefinition *v)
+: MUnaryInstruction(v), globalDataOffset_(globalDataOffset)
+{}
+unsigned globalDataOffset_;
+public:
+INSTRUCTION_HEADER(AsmJSStoreGlobalVar);
+static MAsmJSStoreGlobalVar *New(TempAllocator &alloc, unsigned globalDataOffset, MDefinition *v) {
+return new(alloc) MAsmJSStoreGlobalVar(globalDataOffset, v);
+}
+unsigned globalDataOffset() const { return globalDataOffset_; }
+MDefinition *value() const { return getOperand(0); }
+AliasSet getAliasSet() const {
+return AliasSet::Store(AliasSet::AsmJSGlobalVar);
+}
+};
+class MAsmJSLoadFuncPtr : public MUnaryInstruction
+{
+MAsmJSLoadFuncPtr(unsigned globalDataOffset, MDefinition *index)
+: MUnaryInstruction(index), globalDataOffset_(globalDataOffset)
+{
+setResultType(MIRType_Pointer);
+}
+unsigned globalDataOffset_;
+public:
+INSTRUCTION_HEADER(AsmJSLoadFuncPtr);
+static MAsmJSLoadFuncPtr *New(TempAllocator &alloc, unsigned globalDataOffset,
+MDefinition *index)
+{
+return new(alloc) MAsmJSLoadFuncPtr(globalDataOffset, index);
+}
+unsigned globalDataOffset() const { return globalDataOffset_; }
+MDefinition *index() const { return getOperand(0); }
+};
+class MAsmJSLoadFFIFunc : public MNullaryInstruction
+{
+MAsmJSLoadFFIFunc(unsigned globalDataOffset)
+: globalDataOffset_(globalDataOffset)
+{
+setResultType(MIRType_Pointer);
+}
+unsigned globalDataOffset_;
+public:
+INSTRUCTION_HEADER(AsmJSLoadFFIFunc);
+static MAsmJSLoadFFIFunc *New(TempAllocator &alloc, unsigned globalDataOffset)
+{
+return new(alloc) MAsmJSLoadFFIFunc(globalDataOffset);
+}
+unsigned globalDataOffset() const { return globalDataOffset_; }
+};
+class MAsmJSParameter : public MNullaryInstruction
+{
+ABIArg abi_;
+MAsmJSParameter(ABIArg abi, MIRType mirType)
+: abi_(abi)
+{
+setResultType(mirType);
+}
+public:
+INSTRUCTION_HEADER(AsmJSParameter);
+static MAsmJSParameter *New(TempAllocator &alloc, ABIArg abi, MIRType mirType) {
+return new(alloc) MAsmJSParameter(abi, mirType);
+}
+ABIArg abi() const { return abi_; }
+};
+class MAsmJSReturn : public MAryControlInstruction<1, 0>
+{
+MAsmJSReturn(MDefinition *ins) {
+setOperand(0, ins);
+}
+public:
+INSTRUCTION_HEADER(AsmJSReturn);
+static MAsmJSReturn *New(TempAllocator &alloc, MDefinition *ins) {
+return new(alloc) MAsmJSReturn(ins);
+}
+};
+class MAsmJSVoidReturn : public MAryControlInstruction<0, 0>
+{
+public:
+INSTRUCTION_HEADER(AsmJSVoidReturn);
+static MAsmJSVoidReturn *New(TempAllocator &alloc) {
+return new(alloc) MAsmJSVoidReturn();
+}
+};
+class MAsmJSPassStackArg : public MUnaryInstruction
+{
+MAsmJSPassStackArg(uint32_t spOffset, MDefinition *ins)
+: MUnaryInstruction(ins),
+spOffset_(spOffset)
+{}
+uint32_t spOffset_;
+public:
+INSTRUCTION_HEADER(AsmJSPassStackArg);
+static MAsmJSPassStackArg *New(TempAllocator &alloc, uint32_t spOffset, MDefinition *ins) {
+return new(alloc) MAsmJSPassStackArg(spOffset, ins);
+}
+uint32_t spOffset() const {
+return spOffset_;
+}
+void incrementOffset(uint32_t inc) {
+spOffset_ += inc;
+}
+MDefinition *arg() const {
+return getOperand(0);
+}
+};
+class MAsmJSCall MOZ_FINAL : public MInstruction
+{
+public:
+class Callee {
+public:
+enum Which { Internal, Dynamic, Builtin };
+private:
+Which which_;
+union {
+Label *internal_;
+MDefinition *dynamic_;
+AsmJSImmKind builtin_;
+} u;
+public:
+Callee() {}
+Callee(Label *callee) : which_(Internal) { u.internal_ = callee; }
+Callee(MDefinition *callee) : which_(Dynamic) { u.dynamic_ = callee; }
+Callee(AsmJSImmKind callee) : which_(Builtin) { u.builtin_ = callee; }
+Which which() const { return which_; }
+Label *internal() const { JS_ASSERT(which_ == Internal); return u.internal_; }
+MDefinition *dynamic() const { JS_ASSERT(which_ == Dynamic); return u.dynamic_; }
+AsmJSImmKind builtin() const { JS_ASSERT(which_ == Builtin); return u.builtin_; }
+};
+private:
+struct Operand {
+AnyRegister reg;
+MUse use;
+};
+CallSiteDesc desc_;
+Callee callee_;
+FixedList<MUse> operands_;
+FixedList<AnyRegister> argRegs_;
+size_t spIncrement_;
+MAsmJSCall(const CallSiteDesc &desc, Callee callee, size_t spIncrement)
+: desc_(desc), callee_(callee), spIncrement_(spIncrement)
+{ }
+protected:
+void setOperand(size_t index, MDefinition *operand) {
+operands_[index].set(operand, this, index);
+operand->addUse(&operands_[index]);
+}
+MUse *getUseFor(size_t index) {
+return &operands_[index];
+}
+public:
+INSTRUCTION_HEADER(AsmJSCall);
+struct Arg {
+AnyRegister reg;
+MDefinition *def;
+Arg(AnyRegister reg, MDefinition *def) : reg(reg), def(def) {}
+};
+typedef Vector<Arg, 8> Args;
+static MAsmJSCall *New(TempAllocator &alloc, const CallSiteDesc &desc, Callee callee,
+const Args &args, MIRType resultType, size_t spIncrement);
+size_t numOperands() const {
+return operands_.length();
+}
+MDefinition *getOperand(size_t index) const {
+JS_ASSERT(index < numOperands());
+return operands_[index].producer();
+}
+size_t numArgs() const {
+return argRegs_.length();
+}
+AnyRegister registerForArg(size_t index) const {
+JS_ASSERT(index < numArgs());
+return argRegs_[index];
+}
+const CallSiteDesc &desc() const {
+return desc_;
+}
+Callee callee() const {
+return callee_;
+}
+size_t dynamicCalleeOperandIndex() const {
+JS_ASSERT(callee_.which() == Callee::Dynamic);
+JS_ASSERT(numArgs() == numOperands() - 1);
+return numArgs();
+}
+size_t spIncrement() const {
+return spIncrement_;
+}
+bool possiblyCalls() const {
+return true;
+}
+};
+#undef INSTRUCTION_HEADER
+// Implement opcode casts now that the compiler can see the inheritance.
+#define OPCODE_CASTS(opcode)                                                \
+M##opcode *MDefinition::to##opcode()                                    \
+{                                                                       \
+JS_ASSERT(is##opcode());                                            \
+return static_cast<M##opcode *>(this);                              \
+}                                                                       \
+const M##opcode *MDefinition::to##opcode() const                        \
+{                                                                       \
+JS_ASSERT(is##opcode());                                            \
+return static_cast<const M##opcode *>(this);                        \
+}
+MIR_OPCODE_LIST(OPCODE_CASTS)
+#undef OPCODE_CASTS
+MDefinition *MNode::toDefinition()
+{
+JS_ASSERT(isDefinition());
+return (MDefinition *)this;
+}
+MResumePoint *MNode::toResumePoint()
+{
+JS_ASSERT(isResumePoint());
+return (MResumePoint *)this;
+}
+MInstruction *MDefinition::toInstruction()
+{
+JS_ASSERT(!isPhi());
+return (MInstruction *)this;
+}
+typedef Vector<MDefinition *, 8, IonAllocPolicy> MDefinitionVector;
+// Helper functions used to decide how to build MIR.
+bool ElementAccessIsDenseNative(MDefinition *obj, MDefinition *id);
+bool ElementAccessIsTypedArray(MDefinition *obj, MDefinition *id,
+ScalarTypeDescr::Type *arrayType);
+bool ElementAccessIsPacked(types::CompilerConstraintList *constraints, MDefinition *obj);
+bool ElementAccessHasExtraIndexedProperty(types::CompilerConstraintList *constraints,
+MDefinition *obj);
+MIRType DenseNativeElementType(types::CompilerConstraintList *constraints, MDefinition *obj);
+bool PropertyReadNeedsTypeBarrier(JSContext *propertycx,
+types::CompilerConstraintList *constraints,
+types::TypeObjectKey *object, PropertyName *name,
+types::TemporaryTypeSet *observed, bool updateObserved);
+bool PropertyReadNeedsTypeBarrier(JSContext *propertycx,
+types::CompilerConstraintList *constraints,
+MDefinition *obj, PropertyName *name,
+types::TemporaryTypeSet *observed);
+bool PropertyReadOnPrototypeNeedsTypeBarrier(types::CompilerConstraintList *constraints,
+MDefinition *obj, PropertyName *name,
+types::TemporaryTypeSet *observed);
+bool PropertyReadIsIdempotent(types::CompilerConstraintList *constraints,
+MDefinition *obj, PropertyName *name);
+void AddObjectsForPropertyRead(MDefinition *obj, PropertyName *name,
+types::TemporaryTypeSet *observed);
+bool PropertyWriteNeedsTypeBarrier(TempAllocator &alloc, types::CompilerConstraintList *constraints,
+MBasicBlock *current, MDefinition **pobj,
+PropertyName *name, MDefinition **pvalue,
+bool canModify);
+} // namespace jit
+} // namespace js
+#endif /* jit_MIR_h */

The Tor Browser / file comparison

comparison: js/src/jit/MIR.h

js/src/jit/MIR.h