The Tor Browser / file revision

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-

  * vim: set ts=8 sts=4 et sw=4 tw=99:

  * This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /*

  * Everything needed to build actual MIR instructions: the actual opcodes and

  * instructions, the instruction interface, and use chains.

  */

 #ifndef jit_MIR_h

 #define jit_MIR_h

 #include "mozilla/Array.h"

 #include "jsinfer.h"

 #include "jit/CompilerRoot.h"

 #include "jit/FixedList.h"

 #include "jit/InlineList.h"

 #include "jit/IonAllocPolicy.h"

 #include "jit/IonMacroAssembler.h"

 #include "jit/MOpcodes.h"

 #include "jit/TypeDescrSet.h"

 #include "jit/TypePolicy.h"

 #include "vm/ScopeObject.h"

 #include "vm/TypedArrayObject.h"

 namespace js {

 class StringObject;

 namespace jit {

 class BaselineInspector;

 class ValueNumberData;

 class Range;

 static const inline

 MIRType MIRTypeFromValue(const js::Value &vp)

 {

     if (vp.isDouble())

         return MIRType_Double;

     if (vp.isMagic()) {

         switch (vp.whyMagic()) {

           case JS_OPTIMIZED_ARGUMENTS:

             return MIRType_MagicOptimizedArguments;

           case JS_OPTIMIZED_OUT:

             return MIRType_MagicOptimizedOut;

           case JS_ELEMENTS_HOLE:

             return MIRType_MagicHole;

           case JS_IS_CONSTRUCTING:

             return MIRType_MagicIsConstructing;

           default:

             MOZ_ASSERT(!"Unexpected magic constant");

         }

     }

     return MIRTypeFromValueType(vp.extractNonDoubleType());

 }

 #define MIR_FLAG_LIST(_)                                                        \

     _(InWorklist)                                                               \

     _(EmittedAtUses)                                                            \

     _(LoopInvariant)                                                            \

     _(Commutative)                                                              \

     _(Movable)       /* Allow LICM and GVN to move this instruction */          \

     _(Lowered)       /* (Debug only) has a virtual register */                  \

     _(Guard)         /* Not removable if uses == 0 */                           \

                                                                                 \

     /* Keep the flagged instruction in resume points and do not substitute this

      * instruction by an UndefinedValue. This might be used by call inlining

      * when a function argument is not used by the inlined instructions.

      */                                                                         \

     _(ImplicitlyUsed)                                                           \

                                                                                 \

     /* The instruction has been marked dead for lazy removal from resume

      * points.

      */                                                                         \

     _(Unused)                                                                   \

     /* Marks if an instruction has fewer uses than the original code.

      * E.g. UCE can remove code.

      * Every instruction where an use is/was removed from an instruction and

      * as a result the number of operands doesn't equal the original code

      * need to get marked as UseRemoved. This is important for truncation

      * analysis to know, since if all original uses are still present,

      * it can ignore resumepoints.

      * Currently this is done for every pass after IonBuilder and before

      * Truncate Doubles. So every time removeUse is called, UseRemoved needs

      * to get set.

      */                                                                         \

     _(UseRemoved)

 class MDefinition;

 class MInstruction;

 class MBasicBlock;

 class MNode;

 class MUse;

 class MIRGraph;

 class MResumePoint;

 // Represents a use of a node.

 class MUse : public TempObject, public InlineListNode<MUse>

 {

     friend class MDefinition;

     MDefinition *producer_; // MDefinition that is being used.

     MNode *consumer_;       // The node that is using this operand.

     uint32_t index_;        // The index of this operand in its consumer.

     MUse(MDefinition *producer, MNode *consumer, uint32_t index)

       : producer_(producer),

         consumer_(consumer),

         index_(index)

     { }

   public:

     // Default constructor for use in vectors.

     MUse()

       : producer_(nullptr), consumer_(nullptr), index_(0)

     { }

     // Set data inside the MUse.

     void set(MDefinition *producer, MNode *consumer, uint32_t index) {

         producer_ = producer;

         consumer_ = consumer;

         index_ = index;

     }

     MDefinition *producer() const {

         JS_ASSERT(producer_ != nullptr);

         return producer_;

     }

     bool hasProducer() const {

         return producer_ != nullptr;

     }

     MNode *consumer() const {

         JS_ASSERT(consumer_ != nullptr);

         return consumer_;

     }

     uint32_t index() const {

         return index_;

     }

 };

 typedef InlineList<MUse>::iterator MUseIterator;

 // A node is an entry in the MIR graph. It has two kinds:

 //   MInstruction: an instruction which appears in the IR stream.

 //   MResumePoint: a list of instructions that correspond to the state of the

 //                 interpreter/Baseline stack.

 //

 // Nodes can hold references to MDefinitions. Each MDefinition has a list of

 // nodes holding such a reference (its use chain).

 class MNode : public TempObject

 {

     friend class MDefinition;

   protected:

     MBasicBlock *block_;    // Containing basic block.

   public:

     enum Kind {

         Definition,

         ResumePoint

     };

     MNode()

       : block_(nullptr)

     { }

     MNode(MBasicBlock *block)

       : block_(block)

     { }

     virtual Kind kind() const = 0;

     // Returns the definition at a given operand.

     virtual MDefinition *getOperand(size_t index) const = 0;

     virtual size_t numOperands() const = 0;

     bool isDefinition() const {

         return kind() == Definition;

     }

     bool isResumePoint() const {

         return kind() == ResumePoint;

     }

     MBasicBlock *block() const {

         return block_;

     }

     // Instructions needing to hook into type analysis should return a

     // TypePolicy.

     virtual TypePolicy *typePolicy() {

         return nullptr;

     }

     // Replaces an already-set operand during iteration over a use chain.

     MUseIterator replaceOperand(MUseIterator use, MDefinition *ins);

     // Replaces an already-set operand, updating use information.

     void replaceOperand(size_t index, MDefinition *ins);

     // Resets the operand to an uninitialized state, breaking the link

     // with the previous operand's producer.

     void discardOperand(size_t index);

     inline MDefinition *toDefinition();

     inline MResumePoint *toResumePoint();

   protected:

     // Sets an unset operand, updating use information.

     virtual void setOperand(size_t index, MDefinition *operand) = 0;

     // Gets the MUse corresponding to given operand.

     virtual MUse *getUseFor(size_t index) = 0;

 };

 class AliasSet {

   private:

     uint32_t flags_;

   public:

     enum Flag {

         None_             = 0,

         ObjectFields      = 1 << 0, // shape, class, slots, length etc.

         Element           = 1 << 1, // A member of obj->elements.

         DynamicSlot       = 1 << 2, // A member of obj->slots.

         FixedSlot         = 1 << 3, // A member of obj->fixedSlots().

         TypedArrayElement = 1 << 4, // A typed array element.

         DOMProperty       = 1 << 5, // A DOM property

         FrameArgument     = 1 << 6, // An argument kept on the stack frame

         AsmJSGlobalVar    = 1 << 7, // An asm.js global var

         AsmJSHeap         = 1 << 8, // An asm.js heap load

         TypedArrayLength  = 1 << 9,// A typed array's length

         Last              = TypedArrayLength,

         Any               = Last | (Last - 1),

         NumCategories     = 10,

         // Indicates load or store.

         Store_            = 1 << 31

     };

     static_assert((1 << NumCategories) - 1 == Any,

                   "NumCategories must include all flags present in Any");

     AliasSet(uint32_t flags)

       : flags_(flags)

     {

     }

   public:

     inline bool isNone() const {

         return flags_ == None_;

     }

     uint32_t flags() const {

         return flags_ & Any;

     }

     inline bool isStore() const {

         return !!(flags_ & Store_);

     }

     inline bool isLoad() const {

         return !isStore() && !isNone();

     }

     inline AliasSet operator |(const AliasSet &other) const {

         return AliasSet(flags_ | other.flags_);

     }

     inline AliasSet operator &(const AliasSet &other) const {

         return AliasSet(flags_ & other.flags_);

     }

     static AliasSet None() {

         return AliasSet(None_);

     }

     static AliasSet Load(uint32_t flags) {

         JS_ASSERT(flags && !(flags & Store_));

         return AliasSet(flags);

     }

     static AliasSet Store(uint32_t flags) {

         JS_ASSERT(flags && !(flags & Store_));

         return AliasSet(flags | Store_);

     }

 };

 // An MDefinition is an SSA name.

 class MDefinition : public MNode

 {

     friend class MBasicBlock;

   public:

     enum Opcode {

 #   define DEFINE_OPCODES(op) Op_##op,

         MIR_OPCODE_LIST(DEFINE_OPCODES)

 #   undef DEFINE_OPCODES

         Op_Invalid

     };

   private:

     InlineList<MUse> uses_;        // Use chain.

     uint32_t id_;                  // Instruction ID, which after block re-ordering

                                    // is sorted within a basic block.

     ValueNumberData *valueNumber_; // The instruction's value number (see GVN for details in use)

     Range *range_;                 // Any computed range for this def.

     MIRType resultType_;           // Representation of result type.

     types::TemporaryTypeSet *resultTypeSet_; // Optional refinement of the result type.

     uint32_t flags_;                 // Bit flags.

     union {

         MDefinition *dependency_;  // Implicit dependency (store, call, etc.) of this instruction.

                                    // Used by alias analysis, GVN and LICM.

         uint32_t virtualRegister_;   // Used by lowering to map definitions to virtual registers.

     };

     // Track bailouts by storing the current pc in MIR instruction. Also used

     // for profiling and keeping track of what the last known pc was.

     jsbytecode *trackedPc_;

   private:

     enum Flag {

         None = 0,

 #   define DEFINE_FLAG(flag) flag,

         MIR_FLAG_LIST(DEFINE_FLAG)

 #   undef DEFINE_FLAG

         Total

     };

     bool hasFlags(uint32_t flags) const {

         return (flags_ & flags) == flags;

     }

     void removeFlags(uint32_t flags) {

         flags_ &= ~flags;

     }

     void setFlags(uint32_t flags) {

         flags_ |= flags;

     }

   protected:

     virtual void setBlock(MBasicBlock *block) {

         block_ = block;

     }

   public:

     MDefinition()

       : id_(0),

         valueNumber_(nullptr),

         range_(nullptr),

         resultType_(MIRType_None),

         resultTypeSet_(nullptr),

         flags_(0),

         dependency_(nullptr),

         trackedPc_(nullptr)

     { }

     virtual Opcode op() const = 0;

     virtual const char *opName() const = 0;

     void printName(FILE *fp) const;

     static void PrintOpcodeName(FILE *fp, Opcode op);

     virtual void printOpcode(FILE *fp) const;

     void dump(FILE *fp) const;

     void dump() const;

     // For LICM.

     virtual bool neverHoist() const { return false; }

     // Also for LICM. Test whether this definition is likely to be a call, which

     // would clobber all or many of the floating-point registers, such that

     // hoisting floating-point constants out of containing loops isn't likely to

     // be worthwhile.

     virtual bool possiblyCalls() const { return false; }

     void setTrackedPc(jsbytecode *pc) {

         trackedPc_ = pc;

     }

     jsbytecode *trackedPc() {

         return trackedPc_;

     }

     // Return the range of this value, *before* any bailout checks. Contrast

     // this with the type() method, and the Range constructor which takes an

     // MDefinition*, which describe the value *after* any bailout checks.

     //

     // Warning: Range analysis is removing the bit-operations such as '| 0' at

     // the end of the transformations. Using this function to analyse any

     // operands after the truncate phase of the range analysis will lead to

     // errors. Instead, one should define the collectRangeInfoPreTrunc() to set

     // the right set of flags which are dependent on the range of the inputs.

     Range *range() const {

         JS_ASSERT(type() != MIRType_None);

         return range_;

     }

     void setRange(Range *range) {

         JS_ASSERT(type() != MIRType_None);

         range_ = range;

     }

     virtual HashNumber valueHash() const;

     virtual bool congruentTo(const MDefinition *ins) const {

         return false;

     }

     bool congruentIfOperandsEqual(const MDefinition *ins) const;

     virtual MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);

     virtual void analyzeEdgeCasesForward();

     virtual void analyzeEdgeCasesBackward();

     virtual bool truncate();

     virtual bool isOperandTruncated(size_t index) const;

     // Compute an absolute or symbolic range for the value of this node.

     virtual void computeRange(TempAllocator &alloc) {

     }

     // Collect information from the pre-truncated ranges.

     virtual void collectRangeInfoPreTrunc() {

     }

     MNode::Kind kind() const {

         return MNode::Definition;

     }

     uint32_t id() const {

         JS_ASSERT(block_);

         return id_;

     }

     void setId(uint32_t id) {

         id_ = id;

     }

     uint32_t valueNumber() const;

     void setValueNumber(uint32_t vn);

     ValueNumberData *valueNumberData() {

         return valueNumber_;

     }

     void clearValueNumberData() {

         valueNumber_ = nullptr;

     }

     void setValueNumberData(ValueNumberData *vn) {

         JS_ASSERT(valueNumber_ == nullptr);

         valueNumber_ = vn;

     }

 #define FLAG_ACCESSOR(flag) \

     bool is##flag() const {\

         return hasFlags(1 << flag);\

     }\

     void set##flag() {\

         JS_ASSERT(!hasFlags(1 << flag));\

         setFlags(1 << flag);\

     }\

     void setNot##flag() {\

         JS_ASSERT(hasFlags(1 << flag));\

         removeFlags(1 << flag);\

     }\

     void set##flag##Unchecked() {\

         setFlags(1 << flag);\

     }

     MIR_FLAG_LIST(FLAG_ACCESSOR)

 #undef FLAG_ACCESSOR

     // Return the type of this value. This may be speculative, and enforced

     // dynamically with the use of bailout checks. If all the bailout checks

     // pass, the value will have this type.

     //

     // Unless this is an MUrsh that has bailouts disabled, which, as a special

     // case, may return a value in (INT32_MAX,UINT32_MAX] even when its type()

     // is MIRType_Int32.

     MIRType type() const {

         return resultType_;

     }

     types::TemporaryTypeSet *resultTypeSet() const {

         return resultTypeSet_;

     }

     bool emptyResultTypeSet() const;

     bool mightBeType(MIRType type) const {

         MOZ_ASSERT(type != MIRType_Value);

         if (type == this->type())

             return true;

         if (MIRType_Value != this->type())

             return false;

         return !resultTypeSet() || resultTypeSet()->mightBeMIRType(type);

     }

     // Float32 specialization operations (see big comment in IonAnalysis before the Float32

     // specialization algorithm).

     virtual bool isFloat32Commutative() const { return false; }

     virtual bool canProduceFloat32() const { return false; }

     virtual bool canConsumeFloat32(MUse *use) const { return false; }

     virtual void trySpecializeFloat32(TempAllocator &alloc) {}

 #ifdef DEBUG

     // Used during the pass that checks that Float32 flow into valid MDefinitions

     virtual bool isConsistentFloat32Use(MUse *use) const {

         return type() == MIRType_Float32 || canConsumeFloat32(use);

     }

 #endif

     // Returns the beginning of this definition's use chain.

     MUseIterator usesBegin() const {

         return uses_.begin();

     }

     // Returns the end of this definition's use chain.

     MUseIterator usesEnd() const {

         return uses_.end();

     }

     bool canEmitAtUses() const {

         return !isEmittedAtUses();

     }

     // Removes a use at the given position

     MUseIterator removeUse(MUseIterator use);

     void removeUse(MUse *use) {

         uses_.remove(use);

     }

     // Number of uses of this instruction.

     size_t useCount() const;

     // Number of uses of this instruction.

     // (only counting MDefinitions, ignoring MResumePoints)

     size_t defUseCount() const;

     // Test whether this MDefinition has exactly one use.

     bool hasOneUse() const;

     // Test whether this MDefinition has exactly one use.

     // (only counting MDefinitions, ignoring MResumePoints)

     bool hasOneDefUse() const;

     // Test whether this MDefinition has at least one use.

     // (only counting MDefinitions, ignoring MResumePoints)

     bool hasDefUses() const;

     bool hasUses() const {

         return !uses_.empty();

     }

     virtual bool isControlInstruction() const {

         return false;

     }

     void addUse(MUse *use) {

         uses_.pushFront(use);

     }

     void replaceAllUsesWith(MDefinition *dom);

     // Mark this instruction as having replaced all uses of ins, as during GVN,

     // returning false if the replacement should not be performed. For use when

     // GVN eliminates instructions which are not equivalent to one another.

     virtual bool updateForReplacement(MDefinition *ins) {

         return true;

     }

     void setVirtualRegister(uint32_t vreg) {

         virtualRegister_ = vreg;

 #ifdef DEBUG

         setLoweredUnchecked();

 #endif

     }

     uint32_t virtualRegister() const {

         JS_ASSERT(isLowered());

         return virtualRegister_;

     }

   public:

     // Opcode testing and casts.

 #   define OPCODE_CASTS(opcode)                                             \

     bool is##opcode() const {                                               \

         return op() == Op_##opcode;                                         \

     }                                                                       \

     inline M##opcode *to##opcode();                                         \

     inline const M##opcode *to##opcode() const;

     MIR_OPCODE_LIST(OPCODE_CASTS)

 #   undef OPCODE_CASTS

     inline MInstruction *toInstruction();

     bool isInstruction() const {

         return !isPhi();

     }

     void setResultType(MIRType type) {

         resultType_ = type;

     }

     void setResultTypeSet(types::TemporaryTypeSet *types) {

         resultTypeSet_ = types;

     }

     MDefinition *dependency() const {

         return dependency_;

     }

     void setDependency(MDefinition *dependency) {

         dependency_ = dependency;

     }

     virtual AliasSet getAliasSet() const {

         // Instructions are effectful by default.

         return AliasSet::Store(AliasSet::Any);

     }

     bool isEffectful() const {

         return getAliasSet().isStore();

     }

     virtual bool mightAlias(const MDefinition *store) const {

         // Return whether this load may depend on the specified store, given

         // that the alias sets intersect. This may be refined to exclude

         // possible aliasing in cases where alias set flags are too imprecise.

         JS_ASSERT(!isEffectful() && store->isEffectful());

         JS_ASSERT(getAliasSet().flags() & store->getAliasSet().flags());

         return true;

     }

 };

 // An MUseDefIterator walks over uses in a definition, skipping any use that is

 // not a definition. Items from the use list must not be deleted during

 // iteration.

 class MUseDefIterator

 {

     MDefinition *def_;

     MUseIterator current_;

     MUseIterator search(MUseIterator start) {

         MUseIterator i(start);

         for (; i != def_->usesEnd(); i++) {

             if (i->consumer()->isDefinition())

                 return i;

         }

         return def_->usesEnd();

     }

   public:

     MUseDefIterator(MDefinition *def)

       : def_(def),

         current_(search(def->usesBegin()))

     { }

     operator bool() const {

         return current_ != def_->usesEnd();

     }

     MUseDefIterator operator ++(int) {

         MUseDefIterator old(*this);

         if (current_ != def_->usesEnd())

             current_++;

         current_ = search(current_);

         return old;

     }

     MUse *use() const {

         return *current_;

     }

     MDefinition *def() const {

         return current_->consumer()->toDefinition();

     }

     size_t index() const {

         return current_->index();

     }

 };

 // An instruction is an SSA name that is inserted into a basic block's IR

 // stream.

 class MInstruction

   : public MDefinition,

     public InlineListNode<MInstruction>

 {

     MResumePoint *resumePoint_;

   public:

     MInstruction()

       : resumePoint_(nullptr)

     { }

     virtual bool accept(MInstructionVisitor *visitor) = 0;

     void setResumePoint(MResumePoint *resumePoint) {

         JS_ASSERT(!resumePoint_);

         resumePoint_ = resumePoint;

     }

     MResumePoint *resumePoint() const {

         return resumePoint_;

     }

 };

 #define INSTRUCTION_HEADER(opcode)                                          \

     Opcode op() const {                                                     \

         return MDefinition::Op_##opcode;                                    \

     }                                                                       \

     const char *opName() const {                                            \

         return #opcode;                                                     \

     }                                                                       \

     bool accept(MInstructionVisitor *visitor) {                             \

         return visitor->visit##opcode(this);                                \

     }

 template <size_t Arity>

 class MAryInstruction : public MInstruction

 {

   protected:

     mozilla::Array<MUse, Arity> operands_;

     void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {

         operands_[index].set(operand, this, index);

         operand->addUse(&operands_[index]);

     }

     MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {

         return &operands_[index];

     }

   public:

     MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {

         return operands_[index].producer();

     }

     size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {

         return Arity;

     }

 };

 class MNullaryInstruction : public MAryInstruction<0>

 { };

 class MUnaryInstruction : public MAryInstruction<1>

 {

   protected:

     MUnaryInstruction(MDefinition *ins)

     {

         setOperand(0, ins);

     }

   public:

     MDefinition *input() const {

         return getOperand(0);

     }

 };

 class MBinaryInstruction : public MAryInstruction<2>

 {

   protected:

     MBinaryInstruction(MDefinition *left, MDefinition *right)

     {

         setOperand(0, left);

         setOperand(1, right);

     }

   public:

     MDefinition *lhs() const {

         return getOperand(0);

     }

     MDefinition *rhs() const {

         return getOperand(1);

     }

   protected:

     HashNumber valueHash() const

     {

         MDefinition *lhs = getOperand(0);

         MDefinition *rhs = getOperand(1);

         return op() ^ lhs->valueNumber() ^ rhs->valueNumber();

     }

     void swapOperands() {

         MDefinition *temp = getOperand(0);

         replaceOperand(0, getOperand(1));

         replaceOperand(1, temp);

     }

     bool binaryCongruentTo(const MDefinition *ins) const

     {

         if (op() != ins->op())

             return false;

         if (type() != ins->type())

             return false;

         if (isEffectful() || ins->isEffectful())

             return false;

         const MDefinition *left = getOperand(0);

         const MDefinition *right = getOperand(1);

         const MDefinition *tmp;

         if (isCommutative() && left->valueNumber() > right->valueNumber()) {

             tmp = right;

             right = left;

             left = tmp;

         }

         const MBinaryInstruction *bi = static_cast<const MBinaryInstruction *>(ins);

         const MDefinition *insLeft = bi->getOperand(0);

         const MDefinition *insRight = bi->getOperand(1);

         if (isCommutative() && insLeft->valueNumber() > insRight->valueNumber()) {

             tmp = insRight;

             insRight = insLeft;

             insLeft = tmp;

         }

         return (left->valueNumber() == insLeft->valueNumber()) &&

                (right->valueNumber() == insRight->valueNumber());

     }

     // Return true if the operands to this instruction are both unsigned,

     // in which case any wrapping operands were replaced with the underlying

     // int32 operands.

     bool tryUseUnsignedOperands();

 };

 class MTernaryInstruction : public MAryInstruction<3>

 {

   protected:

     MTernaryInstruction(MDefinition *first, MDefinition *second, MDefinition *third)

     {

         setOperand(0, first);

         setOperand(1, second);

         setOperand(2, third);

     }

   protected:

     HashNumber valueHash() const

     {

         MDefinition *first = getOperand(0);

         MDefinition *second = getOperand(1);

         MDefinition *third = getOperand(2);

         return op() ^ first->valueNumber() ^ second->valueNumber() ^ third->valueNumber();

     }

 };

 class MQuaternaryInstruction : public MAryInstruction<4>

 {

   protected:

     MQuaternaryInstruction(MDefinition *first, MDefinition *second,

                            MDefinition *third, MDefinition *fourth)

     {

         setOperand(0, first);

         setOperand(1, second);

         setOperand(2, third);

         setOperand(3, fourth);

     }

   protected:

     HashNumber valueHash() const

     {

         MDefinition *first = getOperand(0);

         MDefinition *second = getOperand(1);

         MDefinition *third = getOperand(2);

         MDefinition *fourth = getOperand(3);

         return op() ^ first->valueNumber() ^ second->valueNumber() ^

                       third->valueNumber() ^ fourth->valueNumber();

     }

 };

 // Generates an LSnapshot without further effect.

 class MStart : public MNullaryInstruction

 {

   public:

     enum StartType {

         StartType_Default,

         StartType_Osr

     };

   private:

     StartType startType_;

   private:

     MStart(StartType startType)

       : startType_(startType)

     { }

   public:

     INSTRUCTION_HEADER(Start)

     static MStart *New(TempAllocator &alloc, StartType startType) {

         return new(alloc) MStart(startType);

     }

     StartType startType() {

         return startType_;

     }

 };

 // Instruction marking on entrypoint for on-stack replacement.

 // OSR may occur at loop headers (at JSOP_TRACE).

 // There is at most one MOsrEntry per MIRGraph.

 class MOsrEntry : public MNullaryInstruction

 {

   protected:

     MOsrEntry() {

         setResultType(MIRType_Pointer);

     }

   public:

     INSTRUCTION_HEADER(OsrEntry)

     static MOsrEntry *New(TempAllocator &alloc) {

         return new(alloc) MOsrEntry;

     }

 };

 // No-op instruction. This cannot be moved or eliminated, and is intended for

 // anchoring resume points at arbitrary points in a block.

 class MNop : public MNullaryInstruction

 {

   protected:

     MNop() {

     }

   public:

     INSTRUCTION_HEADER(Nop)

     static MNop *New(TempAllocator &alloc) {

         return new(alloc) MNop();

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 // A constant js::Value.

 class MConstant : public MNullaryInstruction

 {

     Value value_;

   protected:

     MConstant(const Value &v, types::CompilerConstraintList *constraints);

   public:

     INSTRUCTION_HEADER(Constant)

     static MConstant *New(TempAllocator &alloc, const Value &v,

                           types::CompilerConstraintList *constraints = nullptr);

     static MConstant *NewAsmJS(TempAllocator &alloc, const Value &v, MIRType type);

     const js::Value &value() const {

         return value_;

     }

     const js::Value *vp() const {

         return &value_;

     }

     const bool valueToBoolean() const {

         // A hack to avoid this wordy pattern everywhere in the JIT.

         return ToBoolean(HandleValue::fromMarkedLocation(&value_));

     }

     void printOpcode(FILE *fp) const;

     HashNumber valueHash() const;

     bool congruentTo(const MDefinition *ins) const;

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

     bool updateForReplacement(MDefinition *def) {

         MConstant *c = def->toConstant();

         // During constant folding, we don't want to replace a float32

         // value by a double value.

         if (type() == MIRType_Float32)

             return c->type() == MIRType_Float32;

         if (type() == MIRType_Double)

             return c->type() != MIRType_Float32;

         return true;

     }

     void computeRange(TempAllocator &alloc);

     bool truncate();

     bool canProduceFloat32() const;

 };

 // Deep clone a constant JSObject.

 class MCloneLiteral

   : public MUnaryInstruction,

     public ObjectPolicy<0>

 {

   protected:

     MCloneLiteral(MDefinition *obj)

       : MUnaryInstruction(obj)

     {

         setResultType(MIRType_Object);

     }

   public:

     INSTRUCTION_HEADER(CloneLiteral)

     static MCloneLiteral *New(TempAllocator &alloc, MDefinition *obj);

     TypePolicy *typePolicy() {

         return this;

     }

 };

 class MParameter : public MNullaryInstruction

 {

     int32_t index_;

   public:

     static const int32_t THIS_SLOT = -1;

     MParameter(int32_t index, types::TemporaryTypeSet *types)

       : index_(index)

     {

         setResultType(MIRType_Value);

         setResultTypeSet(types);

     }

   public:

     INSTRUCTION_HEADER(Parameter)

     static MParameter *New(TempAllocator &alloc, int32_t index, types::TemporaryTypeSet *types);

     int32_t index() const {

         return index_;

     }

     void printOpcode(FILE *fp) const;

     HashNumber valueHash() const;

     bool congruentTo(const MDefinition *ins) const;

 };

 class MCallee : public MNullaryInstruction

 {

   public:

     MCallee()

     {

         setResultType(MIRType_Object);

         setMovable();

     }

   public:

     INSTRUCTION_HEADER(Callee)

     bool congruentTo(const MDefinition *ins) const {

         return congruentIfOperandsEqual(ins);

     }

     static MCallee *New(TempAllocator &alloc) {

         return new(alloc) MCallee();

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MControlInstruction : public MInstruction

 {

   public:

     MControlInstruction()

     { }

     virtual size_t numSuccessors() const = 0;

     virtual MBasicBlock *getSuccessor(size_t i) const = 0;

     virtual void replaceSuccessor(size_t i, MBasicBlock *successor) = 0;

     bool isControlInstruction() const {

         return true;

     }

     void printOpcode(FILE *fp) const;

 };

 class MTableSwitch MOZ_FINAL

   : public MControlInstruction,

     public NoFloatPolicy<0>

 {

     // The successors of the tableswitch

     // - First successor = the default case

     // - Successor 2 and higher = the cases sorted on case index.

     Vector<MBasicBlock*, 0, IonAllocPolicy> successors_;

     Vector<size_t, 0, IonAllocPolicy> cases_;

     // Contains the blocks/cases that still need to get build

     Vector<MBasicBlock*, 0, IonAllocPolicy> blocks_;

     MUse operand_;

     int32_t low_;

     int32_t high_;

     MTableSwitch(TempAllocator &alloc, MDefinition *ins,

                  int32_t low, int32_t high)

       : successors_(alloc),

         cases_(alloc),

         blocks_(alloc),

         low_(low),

         high_(high)

     {

         setOperand(0, ins);

     }

   protected:

     void setOperand(size_t index, MDefinition *operand) {

         JS_ASSERT(index == 0);

         operand_.set(operand, this, index);

         operand->addUse(&operand_);

     }

     MUse *getUseFor(size_t index) {

         JS_ASSERT(index == 0);

         return &operand_;

     }

   public:

     INSTRUCTION_HEADER(TableSwitch)

     static MTableSwitch *New(TempAllocator &alloc, MDefinition *ins, int32_t low, int32_t high);

     size_t numSuccessors() const {

         return successors_.length();

     }

     size_t addSuccessor(MBasicBlock *successor) {

         JS_ASSERT(successors_.length() < (size_t)(high_ - low_ + 2));

         JS_ASSERT(!successors_.empty());

         successors_.append(successor);

         return successors_.length() - 1;

     }

     MBasicBlock *getSuccessor(size_t i) const {

         JS_ASSERT(i < numSuccessors());

         return successors_[i];

     }

     void replaceSuccessor(size_t i, MBasicBlock *successor) {

         JS_ASSERT(i < numSuccessors());

         successors_[i] = successor;

     }

     MBasicBlock** blocks() {

         return &blocks_[0];

     }

     size_t numBlocks() const {

         return blocks_.length();

     }

     int32_t low() const {

         return low_;

     }

     int32_t high() const {

         return high_;

     }

     MBasicBlock *getDefault() const {

         return getSuccessor(0);

     }

     MBasicBlock *getCase(size_t i) const {

         return getSuccessor(cases_[i]);

     }

     size_t numCases() const {

         return high() - low() + 1;

     }

     size_t addDefault(MBasicBlock *block) {

         JS_ASSERT(successors_.empty());

         successors_.append(block);

         return 0;

     }

     void addCase(size_t successorIndex) {

         cases_.append(successorIndex);

     }

     MBasicBlock *getBlock(size_t i) const {

         JS_ASSERT(i < numBlocks());

         return blocks_[i];

     }

     void addBlock(MBasicBlock *block) {

         blocks_.append(block);

     }

     MDefinition *getOperand(size_t index) const {

         JS_ASSERT(index == 0);

         return operand_.producer();

     }

     size_t numOperands() const {

         return 1;

     }

     TypePolicy *typePolicy() {

         return this;

     }

 };

 template <size_t Arity, size_t Successors>

 class MAryControlInstruction : public MControlInstruction

 {

     mozilla::Array<MUse, Arity> operands_;

     mozilla::Array<MBasicBlock *, Successors> successors_;

   protected:

     void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {

         operands_[index].set(operand, this, index);

         operand->addUse(&operands_[index]);

     }

     void setSuccessor(size_t index, MBasicBlock *successor) {

         successors_[index] = successor;

     }

     MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {

         return &operands_[index];

     }

   public:

     MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {

         return operands_[index].producer();

     }

     size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {

         return Arity;

     }

     size_t numSuccessors() const MOZ_FINAL MOZ_OVERRIDE {

         return Successors;

     }

     MBasicBlock *getSuccessor(size_t i) const MOZ_FINAL MOZ_OVERRIDE {

         return successors_[i];

     }

     void replaceSuccessor(size_t i, MBasicBlock *succ) MOZ_FINAL MOZ_OVERRIDE {

         successors_[i] = succ;

     }

 };

 // Jump to the start of another basic block.

 class MGoto : public MAryControlInstruction<0, 1>

 {

     MGoto(MBasicBlock *target) {

         setSuccessor(0, target);

     }

   public:

     INSTRUCTION_HEADER(Goto)

     static MGoto *New(TempAllocator &alloc, MBasicBlock *target);

     MBasicBlock *target() {

         return getSuccessor(0);

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 enum BranchDirection {

     FALSE_BRANCH,

     TRUE_BRANCH

 };

 static inline BranchDirection

 NegateBranchDirection(BranchDirection dir)

 {

     return (dir == FALSE_BRANCH) ? TRUE_BRANCH : FALSE_BRANCH;

 }

 // Tests if the input instruction evaluates to true or false, and jumps to the

 // start of a corresponding basic block.

 class MTest

   : public MAryControlInstruction<1, 2>,

     public TestPolicy

 {

     bool operandMightEmulateUndefined_;

     MTest(MDefinition *ins, MBasicBlock *if_true, MBasicBlock *if_false)

       : operandMightEmulateUndefined_(true)

     {

         setOperand(0, ins);

         setSuccessor(0, if_true);

         setSuccessor(1, if_false);

     }

   public:

     INSTRUCTION_HEADER(Test)

     static MTest *New(TempAllocator &alloc, MDefinition *ins,

                       MBasicBlock *ifTrue, MBasicBlock *ifFalse);

     MDefinition *input() const {

         return getOperand(0);

     }

     MBasicBlock *ifTrue() const {

         return getSuccessor(0);

     }

     MBasicBlock *ifFalse() const {

         return getSuccessor(1);

     }

     MBasicBlock *branchSuccessor(BranchDirection dir) const {

         return (dir == TRUE_BRANCH) ? ifTrue() : ifFalse();

     }

     TypePolicy *typePolicy() {

         return this;

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

     void infer();

     MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);

     void filtersUndefinedOrNull(bool trueBranch, MDefinition **subject, bool *filtersUndefined,

                                 bool *filtersNull);

     void markOperandCantEmulateUndefined() {

         operandMightEmulateUndefined_ = false;

     }

     bool operandMightEmulateUndefined() const {

         return operandMightEmulateUndefined_;

     }

 #ifdef DEBUG

     bool isConsistentFloat32Use(MUse *use) const {

         return true;

     }

 #endif

 };

 // Returns from this function to the previous caller.

 class MReturn

   : public MAryControlInstruction<1, 0>,

     public BoxInputsPolicy

 {

     MReturn(MDefinition *ins) {

         setOperand(0, ins);

     }

   public:

     INSTRUCTION_HEADER(Return)

     static MReturn *New(TempAllocator &alloc, MDefinition *ins) {

         return new(alloc) MReturn(ins);

     }

     MDefinition *input() const {

         return getOperand(0);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MThrow

   : public MAryControlInstruction<1, 0>,

     public BoxInputsPolicy

 {

     MThrow(MDefinition *ins) {

         setOperand(0, ins);

     }

   public:

     INSTRUCTION_HEADER(Throw)

     static MThrow *New(TempAllocator &alloc, MDefinition *ins) {

         return new(alloc) MThrow(ins);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     virtual AliasSet getAliasSet() const {

         return AliasSet::None();

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 // Fabricate a type set containing only the type of the specified object.

 types::TemporaryTypeSet *

 MakeSingletonTypeSet(types::CompilerConstraintList *constraints, JSObject *obj);

 bool

 MergeTypes(MIRType *ptype, types::TemporaryTypeSet **ptypeSet,

            MIRType newType, types::TemporaryTypeSet *newTypeSet);

 class MNewArray : public MNullaryInstruction

 {

   public:

     enum AllocatingBehaviour {

         NewArray_Allocating,

         NewArray_Unallocating

     };

   private:

     // Number of space to allocate for the array.

     uint32_t count_;

     // Template for the created object.

     CompilerRootObject templateObject_;

     gc::InitialHeap initialHeap_;

     // Allocate space at initialization or not

     AllocatingBehaviour allocating_;

     MNewArray(types::CompilerConstraintList *constraints, uint32_t count, JSObject *templateObject,

               gc::InitialHeap initialHeap, AllocatingBehaviour allocating)

       : count_(count),

         templateObject_(templateObject),

         initialHeap_(initialHeap),

         allocating_(allocating)

     {

         setResultType(MIRType_Object);

         if (!templateObject->hasSingletonType())

             setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));

     }

   public:

     INSTRUCTION_HEADER(NewArray)

     static MNewArray *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,

                           uint32_t count, JSObject *templateObject,

                           gc::InitialHeap initialHeap, AllocatingBehaviour allocating)

     {

         return new(alloc) MNewArray(constraints, count, templateObject, initialHeap, allocating);

     }

     uint32_t count() const {

         return count_;

     }

     JSObject *templateObject() const {

         return templateObject_;

     }

     gc::InitialHeap initialHeap() const {

         return initialHeap_;

     }

     bool isAllocating() const {

         return allocating_ == NewArray_Allocating;

     }

     // Returns true if the code generator should call through to the

     // VM rather than the fast path.

     bool shouldUseVM() const;

     // NewArray is marked as non-effectful because all our allocations are

     // either lazy when we are using "new Array(length)" or bounded by the

     // script or the stack size when we are using "new Array(...)" or "[...]"

     // notations.  So we might have to allocate the array twice if we bail

     // during the computation of the first element of the square braket

     // notation.

     virtual AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MNewObject : public MNullaryInstruction

 {

     CompilerRootObject templateObject_;

     gc::InitialHeap initialHeap_;

     bool templateObjectIsClassPrototype_;

     MNewObject(types::CompilerConstraintList *constraints, JSObject *templateObject,

                gc::InitialHeap initialHeap, bool templateObjectIsClassPrototype)

       : templateObject_(templateObject),

         initialHeap_(initialHeap),

         templateObjectIsClassPrototype_(templateObjectIsClassPrototype)

     {

         JS_ASSERT_IF(templateObjectIsClassPrototype, !shouldUseVM());

         setResultType(MIRType_Object);

         if (!templateObject->hasSingletonType())

             setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));

     }

   public:

     INSTRUCTION_HEADER(NewObject)

     static MNewObject *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,

                            JSObject *templateObject, gc::InitialHeap initialHeap,

                            bool templateObjectIsClassPrototype)

     {

         return new(alloc) MNewObject(constraints, templateObject, initialHeap,

                                      templateObjectIsClassPrototype);

     }

     // Returns true if the code generator should call through to the

     // VM rather than the fast path.

     bool shouldUseVM() const;

     bool templateObjectIsClassPrototype() const {

         return templateObjectIsClassPrototype_;

     }

     JSObject *templateObject() const {

         return templateObject_;

     }

     gc::InitialHeap initialHeap() const {

         return initialHeap_;

     }

 };

 // Could be allocating either a new array or a new object.

 class MNewPar : public MUnaryInstruction

 {

     CompilerRootObject templateObject_;

     MNewPar(MDefinition *cx, JSObject *templateObject)

       : MUnaryInstruction(cx),

         templateObject_(templateObject)

     {

         setResultType(MIRType_Object);

     }

   public:

     INSTRUCTION_HEADER(NewPar);

     static MNewPar *New(TempAllocator &alloc, MDefinition *cx, JSObject *templateObject) {

         return new(alloc) MNewPar(cx, templateObject);

     }

     MDefinition *forkJoinContext() const {

         return getOperand(0);

     }

     JSObject *templateObject() const {

         return templateObject_;

     }

 };

 // Creates a new derived type object. At runtime, this is just a call

 // to `BinaryBlock::createDerived()`. That is, the MIR itself does not

 // compile to particularly optimized code. However, using a distinct

 // MIR for creating derived type objects allows the compiler to

 // optimize ephemeral typed objects as would be created for a

 // reference like `a.b.c` -- here, the `a.b` will create an ephemeral

 // derived type object that aliases the memory of `a` itself. The

 // specific nature of `a.b` is revealed by using

 // `MNewDerivedTypedObject` rather than `MGetProperty` or what have

 // you. Moreover, the compiler knows that there are no side-effects,

 // so `MNewDerivedTypedObject` instructions can be reordered or pruned

 // as dead code.

 class MNewDerivedTypedObject

   : public MTernaryInstruction,

     public Mix3Policy<ObjectPolicy<0>,

                       ObjectPolicy<1>,

                       IntPolicy<2> >

 {

   private:

     TypeDescrSet set_;

     MNewDerivedTypedObject(TypeDescrSet set,

                            MDefinition *type,

                            MDefinition *owner,

                            MDefinition *offset)

       : MTernaryInstruction(type, owner, offset),

         set_(set)

     {

         setMovable();

         setResultType(MIRType_Object);

     }

   public:

     INSTRUCTION_HEADER(NewDerivedTypedObject);

     static MNewDerivedTypedObject *New(TempAllocator &alloc, TypeDescrSet set,

                                        MDefinition *type, MDefinition *owner, MDefinition *offset)

     {

         return new(alloc) MNewDerivedTypedObject(set, type, owner, offset);

     }

     TypeDescrSet set() const {

         return set_;

     }

     MDefinition *type() const {

         return getOperand(0);

     }

     MDefinition *owner() const {

         return getOperand(1);

     }

     MDefinition *offset() const {

         return getOperand(2);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     virtual AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 // Abort parallel execution.

 class MAbortPar : public MAryControlInstruction<0, 0>

 {

     MAbortPar()

       : MAryControlInstruction<0, 0>()

     {

         setResultType(MIRType_None);

         setGuard();

     }

   public:

     INSTRUCTION_HEADER(AbortPar);

     static MAbortPar *New(TempAllocator &alloc) {

         return new(alloc) MAbortPar();

     }

 };

 // Setting __proto__ in an object literal.

 class MMutateProto

   : public MAryInstruction<2>,

     public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >

 {

   protected:

     MMutateProto(MDefinition *obj, MDefinition *value)

     {

         setOperand(0, obj);

         setOperand(1, value);

         setResultType(MIRType_None);

     }

   public:

     INSTRUCTION_HEADER(MutateProto)

     static MMutateProto *New(TempAllocator &alloc, MDefinition *obj, MDefinition *value)

     {

         return new(alloc) MMutateProto(obj, value);

     }

     MDefinition *getObject() const {

         return getOperand(0);

     }

     MDefinition *getValue() const {

         return getOperand(1);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 // Slow path for adding a property to an object without a known base.

 class MInitProp

   : public MAryInstruction<2>,

     public MixPolicy<ObjectPolicy<0>, BoxPolicy<1> >

 {

   public:

     CompilerRootPropertyName name_;

   protected:

     MInitProp(MDefinition *obj, PropertyName *name, MDefinition *value)

       : name_(name)

     {

         setOperand(0, obj);

         setOperand(1, value);

         setResultType(MIRType_None);

     }

   public:

     INSTRUCTION_HEADER(InitProp)

     static MInitProp *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,

                           MDefinition *value)

     {

         return new(alloc) MInitProp(obj, name, value);

     }

     MDefinition *getObject() const {

         return getOperand(0);

     }

     MDefinition *getValue() const {

         return getOperand(1);

     }

     PropertyName *propertyName() const {

         return name_;

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 class MInitPropGetterSetter

   : public MBinaryInstruction,

     public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >

 {

     CompilerRootPropertyName name_;

     MInitPropGetterSetter(MDefinition *obj, PropertyName *name, MDefinition *value)

       : MBinaryInstruction(obj, value),

         name_(name)

     { }

   public:

     INSTRUCTION_HEADER(InitPropGetterSetter)

     static MInitPropGetterSetter *New(TempAllocator &alloc, MDefinition *obj, PropertyName *name,

                                       MDefinition *value)

     {

         return new(alloc) MInitPropGetterSetter(obj, name, value);

     }

     MDefinition *object() const {

         return getOperand(0);

     }

     MDefinition *value() const {

         return getOperand(1);

     }

     PropertyName *name() const {

         return name_;

     }

     TypePolicy *typePolicy() {

         return this;

     }

 };

 class MInitElem

   : public MAryInstruction<3>,

     public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, BoxPolicy<2> >

 {

     MInitElem(MDefinition *obj, MDefinition *id, MDefinition *value)

     {

         setOperand(0, obj);

         setOperand(1, id);

         setOperand(2, value);

         setResultType(MIRType_None);

     }

   public:

     INSTRUCTION_HEADER(InitElem)

     static MInitElem *New(TempAllocator &alloc, MDefinition *obj, MDefinition *id,

                           MDefinition *value)

     {

         return new(alloc) MInitElem(obj, id, value);

     }

     MDefinition *getObject() const {

         return getOperand(0);

     }

     MDefinition *getId() const {

         return getOperand(1);

     }

     MDefinition *getValue() const {

         return getOperand(2);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 class MInitElemGetterSetter

   : public MTernaryInstruction,

     public Mix3Policy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2> >

 {

     MInitElemGetterSetter(MDefinition *obj, MDefinition *id, MDefinition *value)

       : MTernaryInstruction(obj, id, value)

     { }

   public:

     INSTRUCTION_HEADER(InitElemGetterSetter)

     static MInitElemGetterSetter *New(TempAllocator &alloc, MDefinition *obj, MDefinition *id,

                                       MDefinition *value)

     {

         return new(alloc) MInitElemGetterSetter(obj, id, value);

     }

     MDefinition *object() const {

         return getOperand(0);

     }

     MDefinition *idValue() const {

         return getOperand(1);

     }

     MDefinition *value() const {

         return getOperand(2);

     }

     TypePolicy *typePolicy() {

         return this;

     }

 };

 class MVariadicInstruction : public MInstruction

 {

     FixedList<MUse> operands_;

   protected:

     bool init(TempAllocator &alloc, size_t length) {

         return operands_.init(alloc, length);

     }

   public:

     // Will assert if called before initialization.

     MDefinition *getOperand(size_t index) const MOZ_FINAL MOZ_OVERRIDE {

         return operands_[index].producer();

     }

     size_t numOperands() const MOZ_FINAL MOZ_OVERRIDE {

         return operands_.length();

     }

     void setOperand(size_t index, MDefinition *operand) MOZ_FINAL MOZ_OVERRIDE {

         operands_[index].set(operand, this, index);

         operand->addUse(&operands_[index]);

     }

     MUse *getUseFor(size_t index) MOZ_FINAL MOZ_OVERRIDE {

         return &operands_[index];

     }

 };

 class MCall

   : public MVariadicInstruction,

     public CallPolicy

 {

   private:

     // An MCall uses the MPrepareCall, MDefinition for the function, and

     // MPassArg instructions. They are stored in the same list.

     static const size_t FunctionOperandIndex   = 0;

     static const size_t NumNonArgumentOperands = 1;

   protected:

     // True if the call is for JSOP_NEW.

     bool construct_;

     // Monomorphic cache of single target from TI, or nullptr.

     CompilerRootFunction target_;

     // Original value of argc from the bytecode.

     uint32_t numActualArgs_;

     bool needsArgCheck_;

     MCall(JSFunction *target, uint32_t numActualArgs, bool construct)

       : construct_(construct),

         target_(target),

         numActualArgs_(numActualArgs),

         needsArgCheck_(true)

     {

         setResultType(MIRType_Value);

     }

   public:

     INSTRUCTION_HEADER(Call)

     static MCall *New(TempAllocator &alloc, JSFunction *target, size_t maxArgc, size_t numActualArgs,

                       bool construct, bool isDOMCall);

     void initFunction(MDefinition *func) {

         return setOperand(FunctionOperandIndex, func);

     }

     bool needsArgCheck() const {

         return needsArgCheck_;

     }

     void disableArgCheck() {

         needsArgCheck_ = false;

     }

     MDefinition *getFunction() const {

         return getOperand(FunctionOperandIndex);

     }

     void replaceFunction(MInstruction *newfunc) {

         replaceOperand(FunctionOperandIndex, newfunc);

     }

     void addArg(size_t argnum, MDefinition *arg);

     MDefinition *getArg(uint32_t index) const {

         return getOperand(NumNonArgumentOperands + index);

     }

     static size_t IndexOfThis() {

         return NumNonArgumentOperands;

     }

     static size_t IndexOfArgument(size_t index) {

         return NumNonArgumentOperands + index + 1; // +1 to skip |this|.

     }

     static size_t IndexOfStackArg(size_t index) {

         return NumNonArgumentOperands + index;

     }

     // For TI-informed monomorphic callsites.

     JSFunction *getSingleTarget() const {

         return target_;

     }

     bool isConstructing() const {

         return construct_;

     }

     // The number of stack arguments is the max between the number of formal

     // arguments and the number of actual arguments. The number of stack

     // argument includes the |undefined| padding added in case of underflow.

     // Includes |this|.

     uint32_t numStackArgs() const {

         return numOperands() - NumNonArgumentOperands;

     }

     // Does not include |this|.

     uint32_t numActualArgs() const {

         return numActualArgs_;

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

     virtual bool isCallDOMNative() const {

         return false;

     }

     // A method that can be called to tell the MCall to figure out whether it's

     // movable or not.  This can't be done in the constructor, because it

     // depends on the arguments to the call, and those aren't passed to the

     // constructor but are set up later via addArg.

     virtual void computeMovable() {

     }

 };

 class MCallDOMNative : public MCall

 {

     // A helper class for MCalls for DOM natives.  Note that this is NOT

     // actually a separate MIR op from MCall, because all sorts of places use

     // isCall() to check for calls and all we really want is to overload a few

     // virtual things from MCall.

   protected:

     MCallDOMNative(JSFunction *target, uint32_t numActualArgs)

         : MCall(target, numActualArgs, false)

     {

         // If our jitinfo is not marked movable, that means that our C++

         // implementation is fallible or that we have no hope of ever doing the

         // sort of argument analysis that would allow us to detemine that we're

         // side-effect-free.  In the latter case we wouldn't get DCEd no matter

         // what, but for the former case we have to explicitly say that we can't

         // be DCEd.

         if (!getJitInfo()->isMovable)

             setGuard();

     }

     friend MCall *MCall::New(TempAllocator &alloc, JSFunction *target, size_t maxArgc,

                              size_t numActualArgs, bool construct, bool isDOMCall);

     const JSJitInfo *getJitInfo() const;

   public:

     virtual AliasSet getAliasSet() const MOZ_OVERRIDE;

     virtual bool congruentTo(const MDefinition *ins) const MOZ_OVERRIDE;

     virtual bool isCallDOMNative() const MOZ_OVERRIDE {

         return true;

     }

     virtual void computeMovable() MOZ_OVERRIDE;

 };

 // arr.splice(start, deleteCount) with unused return value.

 class MArraySplice

   : public MTernaryInstruction,

     public Mix3Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2> >

 {

   private:

     MArraySplice(MDefinition *object, MDefinition *start, MDefinition *deleteCount)

       : MTernaryInstruction(object, start, deleteCount)

     { }

   public:

     INSTRUCTION_HEADER(ArraySplice)

     static MArraySplice *New(TempAllocator &alloc, MDefinition *object,

                              MDefinition *start, MDefinition *deleteCount)

     {

         return new(alloc) MArraySplice(object, start, deleteCount);

     }

     MDefinition *object() const {

         return getOperand(0);

     }

     MDefinition *start() const {

         return getOperand(1);

     }

     MDefinition *deleteCount() const {

         return getOperand(2);

     }

     bool possiblyCalls() const {

         return true;

     }

     TypePolicy *typePolicy() {

         return this;

     }

 };

 // fun.apply(self, arguments)

 class MApplyArgs

   : public MAryInstruction<3>,

     public MixPolicy<ObjectPolicy<0>, MixPolicy<IntPolicy<1>, BoxPolicy<2> > >

 {

   protected:

     // Monomorphic cache of single target from TI, or nullptr.

     CompilerRootFunction target_;

     MApplyArgs(JSFunction *target, MDefinition *fun, MDefinition *argc, MDefinition *self)

       : target_(target)

     {

         setOperand(0, fun);

         setOperand(1, argc);

         setOperand(2, self);

         setResultType(MIRType_Value);

     }

   public:

     INSTRUCTION_HEADER(ApplyArgs)

     static MApplyArgs *New(TempAllocator &alloc, JSFunction *target, MDefinition *fun,

                            MDefinition *argc, MDefinition *self);

     MDefinition *getFunction() const {

         return getOperand(0);

     }

     // For TI-informed monomorphic callsites.

     JSFunction *getSingleTarget() const {

         return target_;

     }

     MDefinition *getArgc() const {

         return getOperand(1);

     }

     MDefinition *getThis() const {

         return getOperand(2);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 class MBail : public MNullaryInstruction

 {

   protected:

     MBail()

     {

         setGuard();

     }

   public:

     INSTRUCTION_HEADER(Bail)

     static MBail *

     New(TempAllocator &alloc) {

         return new(alloc) MBail();

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MAssertFloat32 : public MUnaryInstruction

 {

   protected:

     bool mustBeFloat32_;

     MAssertFloat32(MDefinition *value, bool mustBeFloat32)

       : MUnaryInstruction(value), mustBeFloat32_(mustBeFloat32)

     {

     }

   public:

     INSTRUCTION_HEADER(AssertFloat32)

     static MAssertFloat32 *New(TempAllocator &alloc, MDefinition *value, bool mustBeFloat32) {

         return new(alloc) MAssertFloat32(value, mustBeFloat32);

     }

     bool canConsumeFloat32(MUse *use) const { return true; }

     bool mustBeFloat32() const { return mustBeFloat32_; }

 };

 class MGetDynamicName

   : public MAryInstruction<2>,

     public MixPolicy<ObjectPolicy<0>, ConvertToStringPolicy<1> >

 {

   protected:

     MGetDynamicName(MDefinition *scopeChain, MDefinition *name)

     {

         setOperand(0, scopeChain);

         setOperand(1, name);

         setResultType(MIRType_Value);

     }

   public:

     INSTRUCTION_HEADER(GetDynamicName)

     static MGetDynamicName *

     New(TempAllocator &alloc, MDefinition *scopeChain, MDefinition *name) {

         return new(alloc) MGetDynamicName(scopeChain, name);

     }

     MDefinition *getScopeChain() const {

         return getOperand(0);

     }

     MDefinition *getName() const {

         return getOperand(1);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 // Bailout if the input string contains 'arguments' or 'eval'.

 class MFilterArgumentsOrEval

   : public MAryInstruction<1>,

     public BoxExceptPolicy<0, MIRType_String>

 {

   protected:

     MFilterArgumentsOrEval(MDefinition *string)

     {

         setOperand(0, string);

         setGuard();

         setResultType(MIRType_None);

     }

   public:

     INSTRUCTION_HEADER(FilterArgumentsOrEval)

     static MFilterArgumentsOrEval *New(TempAllocator &alloc, MDefinition *string) {

         return new(alloc) MFilterArgumentsOrEval(string);

     }

     MDefinition *getString() const {

         return getOperand(0);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

 };

 class MCallDirectEval

   : public MAryInstruction<3>,

     public MixPolicy<ObjectPolicy<0>,

                      MixPolicy<BoxExceptPolicy<1, MIRType_String>, BoxPolicy<2> > >

 {

   protected:

     MCallDirectEval(MDefinition *scopeChain, MDefinition *string, MDefinition *thisValue,

                     jsbytecode *pc)

         : pc_(pc)

     {

         setOperand(0, scopeChain);

         setOperand(1, string);

         setOperand(2, thisValue);

         setResultType(MIRType_Value);

     }

   public:

     INSTRUCTION_HEADER(CallDirectEval)

     static MCallDirectEval *

     New(TempAllocator &alloc, MDefinition *scopeChain, MDefinition *string, MDefinition *thisValue,

         jsbytecode *pc)

     {

         return new(alloc) MCallDirectEval(scopeChain, string, thisValue, pc);

     }

     MDefinition *getScopeChain() const {

         return getOperand(0);

     }

     MDefinition *getString() const {

         return getOperand(1);

     }

     MDefinition *getThisValue() const {

         return getOperand(2);

     }

     jsbytecode  *pc() const {

         return pc_;

     }

     TypePolicy *typePolicy() {

         return this;

     }

     bool possiblyCalls() const {

         return true;

     }

   private:

     jsbytecode *pc_;

 };

 class MCompare

   : public MBinaryInstruction,

     public ComparePolicy

 {

   public:

     enum CompareType {

         // Anything compared to Undefined

         Compare_Undefined,

         // Anything compared to Null

         Compare_Null,

         // Undefined compared to Boolean

         // Null      compared to Boolean

         // Double    compared to Boolean

         // String    compared to Boolean

         // Object    compared to Boolean

         // Value     compared to Boolean

         Compare_Boolean,

         // Int32   compared to Int32

         // Boolean compared to Boolean

         Compare_Int32,

         Compare_Int32MaybeCoerceBoth,

         Compare_Int32MaybeCoerceLHS,

         Compare_Int32MaybeCoerceRHS,

         // Int32 compared as unsigneds

         Compare_UInt32,

         // Double compared to Double

         Compare_Double,

         Compare_DoubleMaybeCoerceLHS,

         Compare_DoubleMaybeCoerceRHS,

         // Float compared to Float

         Compare_Float32,

         // String compared to String

         Compare_String,

         // Undefined compared to String

         // Null      compared to String

         // Boolean   compared to String

         // Int32     compared to String

         // Double    compared to String

         // Object    compared to String

         // Value     compared to String

         Compare_StrictString,

         // Object compared to Object

         Compare_Object,

         // Compare 2 values bitwise

         Compare_Value,

         // All other possible compares

         Compare_Unknown

     };

   private:

     CompareType compareType_;

     JSOp jsop_;

     bool operandMightEmulateUndefined_;

     bool operandsAreNeverNaN_;

     // When a floating-point comparison is converted to an integer comparison

     // (when range analysis proves it safe), we need to convert the operands

     // to integer as well.

     bool truncateOperands_;

     MCompare(MDefinition *left, MDefinition *right, JSOp jsop)

       : MBinaryInstruction(left, right),

         compareType_(Compare_Unknown),

         jsop_(jsop),

         operandMightEmulateUndefined_(true),

         operandsAreNeverNaN_(false),

         truncateOperands_(false)

     {

         setResultType(MIRType_Boolean);

         setMovable();

     }

   public:

     INSTRUCTION_HEADER(Compare)

     static MCompare *New(TempAllocator &alloc, MDefinition *left, MDefinition *right, JSOp op);

     static MCompare *NewAsmJS(TempAllocator &alloc, MDefinition *left, MDefinition *right, JSOp op,

                               CompareType compareType);

     bool tryFold(bool *result);

     bool evaluateConstantOperands(bool *result);

     MDefinition *foldsTo(TempAllocator &alloc, bool useValueNumbers);

     void filtersUndefinedOrNull(bool trueBranch, MDefinition **subject, bool *filtersUndefined,

                                 bool *filtersNull);

     void infer(BaselineInspector *inspector, jsbytecode *pc);

     CompareType compareType() const {

         return compareType_;

     }

     bool isInt32Comparison() const {

         return compareType() == Compare_Int32 ||

                compareType() == Compare_Int32MaybeCoerceBoth ||

                compareType() == Compare_Int32MaybeCoerceLHS ||

                compareType() == Compare_Int32MaybeCoerceRHS;

     }

     bool isDoubleComparison() const {

         return compareType() == Compare_Double ||

                compareType() == Compare_DoubleMaybeCoerceLHS ||

                compareType() == Compare_DoubleMaybeCoerceRHS;

     }

     bool isFloat32Comparison() const {

         return compareType() == Compare_Float32;

     }

     void setCompareType(CompareType type) {

         compareType_ = type;

     }

     MIRType inputType();

     JSOp jsop() const {

         return jsop_;

     }

     TypePolicy *typePolicy() {

         return this;

     }

     void markNoOperandEmulatesUndefined() {

         operandMightEmulateUndefined_ = false;

     }

     bool operandMightEmulateUndefined() const {

         return operandMightEmulateUndefined_;

     }

     bool operandsAreNeverNaN() const {

         return operandsAreNeverNaN_;

     }

     AliasSet getAliasSet() const {

         // Strict equality is never effectful.

         if (jsop_ == JSOP_STRICTEQ || jsop_ == JSOP_STRICTNE)

             return AliasSet::None();

         if (compareType_ == Compare_Unknown)

             return AliasSet::Store(AliasSet::Any);

         JS_ASSERT(compareType_ <= Compare_Value);

         return AliasSet::None();

     }

     void printOpcode(FILE *fp) const;

     void collectRangeInfoPreTrunc();

     void trySpecializeFloat32(TempAllocator &alloc);

     bool isFloat32Commutative() const { return true; }

     bool truncate();

     bool isOperandTruncated(size_t index) const;

 # ifdef DEBUG

     bool isConsistentFloat32Use(MUse *use) const {

         // Both sides of the compare can be Float32

         return compareType_ == Compare_Float32;

     }

 # endif

   protected:

     bool congruentTo(const MDefinition *ins) const {

         if (!binaryCongruentTo(ins))

             return false;

         return compareType() == ins->toCompare()->compareType() &&

                jsop() == ins->toCompare()->jsop();

     }

 };

 // Takes a typed value and returns an untyped value.

 class MBox : public MUnaryInstruction

 {

     MBox(TempAllocator &alloc, MDefinition *ins)

       : MUnaryInstruction(ins)

     {

         setResultType(MIRType_Value);

         if (ins->resultTypeSet()) {

             setResultTypeSet(ins->resultTypeSet());

         } else if (ins->type() != MIRType_Value) {

             types::Type ntype = ins->type() == MIRType_Object

                                 ? types::Type::AnyObjectType()

                                 : types::Type::PrimitiveType(ValueTypeFromMIRType(ins->type()));

             setResultTypeSet(alloc.lifoAlloc()->new_<types::TemporaryTypeSet>(ntype));

         }

         setMovable();

     }

   public:

     INSTRUCTION_HEADER(Box)

     static MBox *New(TempAllocator &alloc, MDefinition *ins)

     {

         // Cannot box a box.

         JS_ASSERT(ins->type() != MIRType_Value);

         return new(alloc) MBox(alloc, ins);

     }

     bool congruentTo(const MDefinition *ins) const {

         return congruentIfOperandsEqual(ins);

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 // Note: the op may have been inverted during lowering (to put constants in a

 // position where they can be immediates), so it is important to use the

 // lir->jsop() instead of the mir->jsop() when it is present.

 static inline Assembler::Condition

 JSOpToCondition(MCompare::CompareType compareType, JSOp op)

 {

     bool isSigned = (compareType != MCompare::Compare_UInt32);

     return JSOpToCondition(op, isSigned);

 }

 // Takes a typed value and checks if it is a certain type. If so, the payload

 // is unpacked and returned as that type. Otherwise, it is considered a

 // deoptimization.

 class MUnbox : public MUnaryInstruction, public BoxInputsPolicy

 {

   public:

     enum Mode {

         Fallible,       // Check the type, and deoptimize if unexpected.

         Infallible,     // Type guard is not necessary.

         TypeBarrier     // Guard on the type, and act like a TypeBarrier on failure.

     };

   private:

     Mode mode_;

     BailoutKind bailoutKind_;

     MUnbox(MDefinition *ins, MIRType type, Mode mode, BailoutKind kind)

       : MUnaryInstruction(ins),

         mode_(mode)

     {

         JS_ASSERT(ins->type() == MIRType_Value);

         JS_ASSERT(type == MIRType_Boolean ||

                   type == MIRType_Int32   ||

                   type == MIRType_Double  ||

                   type == MIRType_String  ||

                   type == MIRType_Object);

         setResultType(type);

         setResultTypeSet(ins->resultTypeSet());

         setMovable();

         if (mode_ == TypeBarrier || mode_ == Fallible)

             setGuard();

         bailoutKind_ = kind;

     }

   public:

     INSTRUCTION_HEADER(Unbox)

     static MUnbox *New(TempAllocator &alloc, MDefinition *ins, MIRType type, Mode mode)

     {

         return new(alloc) MUnbox(ins, type, mode, Bailout_Normal);

     }

     static MUnbox *New(TempAllocator &alloc, MDefinition *ins, MIRType type, Mode mode,

                        BailoutKind kind)

     {

         return new(alloc) MUnbox(ins, type, mode, kind);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     Mode mode() const {

         return mode_;

     }

     BailoutKind bailoutKind() const {

         // If infallible, no bailout should be generated.

         JS_ASSERT(fallible());

         return bailoutKind_;

     }

     bool fallible() const {

         return mode() != Infallible;

     }

     bool congruentTo(const MDefinition *ins) const {

         if (!ins->isUnbox() || ins->toUnbox()->mode() != mode())

             return false;

         return congruentIfOperandsEqual(ins);

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

     void printOpcode(FILE *fp) const;

     void makeInfallible() {

         // Should only be called if we're already Infallible or TypeBarrier

         JS_ASSERT(mode() != Fallible);

         mode_ = Infallible;

     }

 };

 class MGuardObject : public MUnaryInstruction, public SingleObjectPolicy

 {

     MGuardObject(MDefinition *ins)

       : MUnaryInstruction(ins)

     {

         setGuard();

         setMovable();

         setResultType(MIRType_Object);

     }

   public:

     INSTRUCTION_HEADER(GuardObject)

     static MGuardObject *New(TempAllocator &alloc, MDefinition *ins) {

         return new(alloc) MGuardObject(ins);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MGuardString

   : public MUnaryInstruction,

     public StringPolicy<0>

 {

     MGuardString(MDefinition *ins)

       : MUnaryInstruction(ins)

     {

         setGuard();

         setMovable();

         setResultType(MIRType_String);

     }

   public:

     INSTRUCTION_HEADER(GuardString)

     static MGuardString *New(TempAllocator &alloc, MDefinition *ins) {

         return new(alloc) MGuardString(ins);

     }

     TypePolicy *typePolicy() {

         return this;

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 class MAssertRange

   : public MUnaryInstruction

 {

     // This is the range checked by the assertion. Don't confuse this with the

     // range_ member or the range() accessor. Since MAssertRange doesn't return

     // a value, it doesn't use those.

     const Range *assertedRange_;

     MAssertRange(MDefinition *ins, const Range *assertedRange)

       : MUnaryInstruction(ins), assertedRange_(assertedRange)

     {

         setGuard();

         setMovable();

         setResultType(MIRType_None);

     }

   public:

     INSTRUCTION_HEADER(AssertRange)

     static MAssertRange *New(TempAllocator &alloc, MDefinition *ins, const Range *assertedRange) {

         return new(alloc) MAssertRange(ins, assertedRange);

     }

     const Range *assertedRange() const {

         return assertedRange_;

     }

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

     void printOpcode(FILE *fp) const;

 };

 // Caller-side allocation of |this| for |new|:

 // Given a templateobject, construct |this| for JSOP_NEW

 class MCreateThisWithTemplate

   : public MNullaryInstruction

 {

     // Template for |this|, provided by TI

     CompilerRootObject templateObject_;

     gc::InitialHeap initialHeap_;

     MCreateThisWithTemplate(types::CompilerConstraintList *constraints, JSObject *templateObject,

                             gc::InitialHeap initialHeap)

       : templateObject_(templateObject),

         initialHeap_(initialHeap)

     {

         setResultType(MIRType_Object);

         setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));

     }

   public:

     INSTRUCTION_HEADER(CreateThisWithTemplate);

     static MCreateThisWithTemplate *New(TempAllocator &alloc, types::CompilerConstraintList *constraints,

                                         JSObject *templateObject, gc::InitialHeap initialHeap)

     {

         return new(alloc) MCreateThisWithTemplate(constraints, templateObject, initialHeap);

     }

     JSObject *templateObject() const {

         return templateObject_;

     }

     gc::InitialHeap initialHeap() const {

         return initialHeap_;

     }

     // Although creation of |this| modifies global state, it is safely repeatable.

     AliasSet getAliasSet() const {

         return AliasSet::None();

     }

 };

 // Caller-side allocation of |this| for |new|:

 // Given a prototype operand, construct |this| for JSOP_NEW.

 class MCreateThisWithProto

   : public MBinaryInstruction,

     public MixPolicy<ObjectPolicy<0>, ObjectPolicy<1> >

 {

     MCreateThisWithProto(MDefinition *callee, MDefinition *prototype)

       : MBinaryInstruction(callee, prototype)

     {

         setResultType(MIRType_Object);

     }

   public:

     INSTRUCTION_HEADER(CreateThisWithProto)

     static MCreateThisWithProto *New(TempAllocator &alloc, MDefinition *callee,

                                      MDefinition *prototype)

     {

         return new(alloc) MCreateThisWithProto(callee, prototype);

     }

     MDefinition *getCallee() const {

         return getOperand(0);

     }

     MDefinition *getPrototype() const {

         return getOperand(1);

     }

     // Although creation of |this| modifies global state, it is safely repeatable.