michael@0: /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
michael@0:  * vim: set ts=8 sts=4 et sw=4 tw=99:
michael@0:  * This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #include "jit/CodeGenerator.h"
michael@0: 
michael@0: #include "mozilla/Assertions.h"
michael@0: #include "mozilla/Attributes.h"
michael@0: #include "mozilla/DebugOnly.h"
michael@0: 
michael@0: #include "jslibmath.h"
michael@0: #include "jsmath.h"
michael@0: #include "jsnum.h"
michael@0: #include "jsprf.h"
michael@0: 
michael@0: #include "builtin/Eval.h"
michael@0: #include "builtin/TypedObject.h"
michael@0: #ifdef JSGC_GENERATIONAL
michael@0: # include "gc/Nursery.h"
michael@0: #endif
michael@0: #include "jit/IonCaches.h"
michael@0: #include "jit/IonLinker.h"
michael@0: #include "jit/IonOptimizationLevels.h"
michael@0: #include "jit/IonSpewer.h"
michael@0: #include "jit/MIRGenerator.h"
michael@0: #include "jit/MoveEmitter.h"
michael@0: #include "jit/ParallelFunctions.h"
michael@0: #include "jit/ParallelSafetyAnalysis.h"
michael@0: #include "jit/RangeAnalysis.h"
michael@0: #include "vm/ForkJoin.h"
michael@0: #include "vm/TraceLogging.h"
michael@0: 
michael@0: #include "jsboolinlines.h"
michael@0: 
michael@0: #include "jit/ExecutionMode-inl.h"
michael@0: #include "jit/shared/CodeGenerator-shared-inl.h"
michael@0: #include "vm/Interpreter-inl.h"
michael@0: 
michael@0: using namespace js;
michael@0: using namespace js::jit;
michael@0: 
michael@0: using mozilla::DebugOnly;
michael@0: using mozilla::FloatingPoint;
michael@0: using mozilla::Maybe;
michael@0: using mozilla::NegativeInfinity;
michael@0: using mozilla::PositiveInfinity;
michael@0: using JS::GenericNaN;
michael@0: 
michael@0: namespace js {
michael@0: namespace jit {
michael@0: 
michael@0: // This out-of-line cache is used to do a double dispatch including it-self and
michael@0: // the wrapped IonCache.
michael@0: class OutOfLineUpdateCache :
michael@0:   public OutOfLineCodeBase<CodeGenerator>,
michael@0:   public IonCacheVisitor
michael@0: {
michael@0:   private:
michael@0:     LInstruction *lir_;
michael@0:     size_t cacheIndex_;
michael@0:     AddCacheState state_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineUpdateCache(LInstruction *lir, size_t cacheIndex)
michael@0:       : lir_(lir),
michael@0:         cacheIndex_(cacheIndex)
michael@0:     { }
michael@0: 
michael@0:     void bind(MacroAssembler *masm) {
michael@0:         // The binding of the initial jump is done in
michael@0:         // CodeGenerator::visitOutOfLineCache.
michael@0:     }
michael@0: 
michael@0:     size_t getCacheIndex() const {
michael@0:         return cacheIndex_;
michael@0:     }
michael@0:     LInstruction *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0:     AddCacheState &state() {
michael@0:         return state_;
michael@0:     }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineCache(this);
michael@0:     }
michael@0: 
michael@0:     // ICs' visit functions delegating the work to the CodeGen visit funtions.
michael@0: #define VISIT_CACHE_FUNCTION(op)                                        \
michael@0:     bool visit##op##IC(CodeGenerator *codegen) {                        \
michael@0:         CodeGenerator::DataPtr<op##IC> ic(codegen, getCacheIndex());    \
michael@0:         return codegen->visit##op##IC(this, ic);                        \
michael@0:     }
michael@0: 
michael@0:     IONCACHE_KIND_LIST(VISIT_CACHE_FUNCTION)
michael@0: #undef VISIT_CACHE_FUNCTION
michael@0: };
michael@0: 
michael@0: // This function is declared here because it needs to instantiate an
michael@0: // OutOfLineUpdateCache, but we want to keep it visible inside the
michael@0: // CodeGeneratorShared such as we can specialize inline caches in function of
michael@0: // the architecture.
michael@0: bool
michael@0: CodeGeneratorShared::addCache(LInstruction *lir, size_t cacheIndex)
michael@0: {
michael@0:     if (cacheIndex == SIZE_MAX)
michael@0:         return false;
michael@0: 
michael@0:     DataPtr<IonCache> cache(this, cacheIndex);
michael@0:     MInstruction *mir = lir->mirRaw()->toInstruction();
michael@0:     if (mir->resumePoint())
michael@0:         cache->setScriptedLocation(mir->block()->info().script(),
michael@0:                                    mir->resumePoint()->pc());
michael@0:     else
michael@0:         cache->setIdempotent();
michael@0: 
michael@0:     OutOfLineUpdateCache *ool = new(alloc()) OutOfLineUpdateCache(lir, cacheIndex);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     // OOL-specific state depends on the type of cache.
michael@0:     cache->initializeAddCacheState(lir, &ool->state());
michael@0: 
michael@0:     cache->emitInitialJump(masm, ool->state());
michael@0:     masm.bind(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineCache(OutOfLineUpdateCache *ool)
michael@0: {
michael@0:     DataPtr<IonCache> cache(this, ool->getCacheIndex());
michael@0: 
michael@0:     // Register the location of the OOL path in the IC.
michael@0:     cache->setFallbackLabel(masm.labelForPatch());
michael@0:     cache->bindInitialJump(masm, ool->state());
michael@0: 
michael@0:     // Dispatch to ICs' accept functions.
michael@0:     return cache->accept(this, ool);
michael@0: }
michael@0: 
michael@0: StringObject *
michael@0: MNewStringObject::templateObj() const {
michael@0:     return &templateObj_->as<StringObject>();
michael@0: }
michael@0: 
michael@0: CodeGenerator::CodeGenerator(MIRGenerator *gen, LIRGraph *graph, MacroAssembler *masm)
michael@0:   : CodeGeneratorSpecific(gen, graph, masm)
michael@0:   , ionScriptLabels_(gen->alloc())
michael@0: {
michael@0: }
michael@0: 
michael@0: CodeGenerator::~CodeGenerator()
michael@0: {
michael@0:     JS_ASSERT_IF(!gen->compilingAsmJS(), masm.numAsmJSAbsoluteLinks() == 0);
michael@0: }
michael@0: 
michael@0: typedef bool (*StringToNumberFn)(ThreadSafeContext *, JSString *, double *);
michael@0: typedef bool (*StringToNumberParFn)(ForkJoinContext *, JSString *, double *);
michael@0: static const VMFunctionsModal StringToNumberInfo = VMFunctionsModal(
michael@0:     FunctionInfo<StringToNumberFn>(StringToNumber),
michael@0:     FunctionInfo<StringToNumberParFn>(StringToNumberPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitValueToInt32(LValueToInt32 *lir)
michael@0: {
michael@0:     ValueOperand operand = ToValue(lir, LValueToInt32::Input);
michael@0:     Register output = ToRegister(lir->output());
michael@0:     FloatRegister temp = ToFloatRegister(lir->tempFloat());
michael@0: 
michael@0:     MDefinition *input;
michael@0:     if (lir->mode() == LValueToInt32::NORMAL)
michael@0:         input = lir->mirNormal()->input();
michael@0:     else
michael@0:         input = lir->mirTruncate()->input();
michael@0: 
michael@0:     Label fails;
michael@0:     if (lir->mode() == LValueToInt32::TRUNCATE) {
michael@0:         OutOfLineCode *oolDouble = oolTruncateDouble(temp, output);
michael@0:         if (!oolDouble)
michael@0:             return false;
michael@0: 
michael@0:         // We can only handle strings in truncation contexts, like bitwise
michael@0:         // operations.
michael@0:         Label *stringEntry, *stringRejoin;
michael@0:         Register stringReg;
michael@0:         if (input->mightBeType(MIRType_String)) {
michael@0:             stringReg = ToRegister(lir->temp());
michael@0:             OutOfLineCode *oolString = oolCallVM(StringToNumberInfo, lir, (ArgList(), stringReg),
michael@0:                                                  StoreFloatRegisterTo(temp));
michael@0:             if (!oolString)
michael@0:                 return false;
michael@0:             stringEntry = oolString->entry();
michael@0:             stringRejoin = oolString->rejoin();
michael@0:         } else {
michael@0:             stringReg = InvalidReg;
michael@0:             stringEntry = nullptr;
michael@0:             stringRejoin = nullptr;
michael@0:         }
michael@0: 
michael@0:         masm.truncateValueToInt32(operand, input, stringEntry, stringRejoin, oolDouble->entry(),
michael@0:                                   stringReg, temp, output, &fails);
michael@0:         masm.bind(oolDouble->rejoin());
michael@0:     } else {
michael@0:         masm.convertValueToInt32(operand, input, temp, output, &fails,
michael@0:                                  lir->mirNormal()->canBeNegativeZero(),
michael@0:                                  lir->mirNormal()->conversion());
michael@0:     }
michael@0: 
michael@0:     return bailoutFrom(&fails, lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitValueToDouble(LValueToDouble *lir)
michael@0: {
michael@0:     MToDouble *mir = lir->mir();
michael@0:     ValueOperand operand = ToValue(lir, LValueToDouble::Input);
michael@0:     FloatRegister output = ToFloatRegister(lir->output());
michael@0: 
michael@0:     Register tag = masm.splitTagForTest(operand);
michael@0: 
michael@0:     Label isDouble, isInt32, isBool, isNull, isUndefined, done;
michael@0:     bool hasBoolean = false, hasNull = false, hasUndefined = false;
michael@0: 
michael@0:     masm.branchTestDouble(Assembler::Equal, tag, &isDouble);
michael@0:     masm.branchTestInt32(Assembler::Equal, tag, &isInt32);
michael@0: 
michael@0:     if (mir->conversion() != MToDouble::NumbersOnly) {
michael@0:         masm.branchTestBoolean(Assembler::Equal, tag, &isBool);
michael@0:         masm.branchTestUndefined(Assembler::Equal, tag, &isUndefined);
michael@0:         hasBoolean = true;
michael@0:         hasUndefined = true;
michael@0:         if (mir->conversion() != MToDouble::NonNullNonStringPrimitives) {
michael@0:             masm.branchTestNull(Assembler::Equal, tag, &isNull);
michael@0:             hasNull = true;
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     if (!bailout(lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     if (hasNull) {
michael@0:         masm.bind(&isNull);
michael@0:         masm.loadConstantDouble(0.0, output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     if (hasUndefined) {
michael@0:         masm.bind(&isUndefined);
michael@0:         masm.loadConstantDouble(GenericNaN(), output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     if (hasBoolean) {
michael@0:         masm.bind(&isBool);
michael@0:         masm.boolValueToDouble(operand, output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     masm.bind(&isInt32);
michael@0:     masm.int32ValueToDouble(operand, output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&isDouble);
michael@0:     masm.unboxDouble(operand, output);
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitValueToFloat32(LValueToFloat32 *lir)
michael@0: {
michael@0:     MToFloat32 *mir = lir->mir();
michael@0:     ValueOperand operand = ToValue(lir, LValueToFloat32::Input);
michael@0:     FloatRegister output = ToFloatRegister(lir->output());
michael@0: 
michael@0:     Register tag = masm.splitTagForTest(operand);
michael@0: 
michael@0:     Label isDouble, isInt32, isBool, isNull, isUndefined, done;
michael@0:     bool hasBoolean = false, hasNull = false, hasUndefined = false;
michael@0: 
michael@0:     masm.branchTestDouble(Assembler::Equal, tag, &isDouble);
michael@0:     masm.branchTestInt32(Assembler::Equal, tag, &isInt32);
michael@0: 
michael@0:     if (mir->conversion() != MToFloat32::NumbersOnly) {
michael@0:         masm.branchTestBoolean(Assembler::Equal, tag, &isBool);
michael@0:         masm.branchTestUndefined(Assembler::Equal, tag, &isUndefined);
michael@0:         hasBoolean = true;
michael@0:         hasUndefined = true;
michael@0:         if (mir->conversion() != MToFloat32::NonNullNonStringPrimitives) {
michael@0:             masm.branchTestNull(Assembler::Equal, tag, &isNull);
michael@0:             hasNull = true;
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     if (!bailout(lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     if (hasNull) {
michael@0:         masm.bind(&isNull);
michael@0:         masm.loadConstantFloat32(0.0f, output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     if (hasUndefined) {
michael@0:         masm.bind(&isUndefined);
michael@0:         masm.loadConstantFloat32(float(GenericNaN()), output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     if (hasBoolean) {
michael@0:         masm.bind(&isBool);
michael@0:         masm.boolValueToFloat32(operand, output);
michael@0:         masm.jump(&done);
michael@0:     }
michael@0: 
michael@0:     masm.bind(&isInt32);
michael@0:     masm.int32ValueToFloat32(operand, output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&isDouble);
michael@0:     masm.unboxDouble(operand, output);
michael@0:     masm.convertDoubleToFloat32(output, output);
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInt32ToDouble(LInt32ToDouble *lir)
michael@0: {
michael@0:     masm.convertInt32ToDouble(ToRegister(lir->input()), ToFloatRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFloat32ToDouble(LFloat32ToDouble *lir)
michael@0: {
michael@0:     masm.convertFloat32ToDouble(ToFloatRegister(lir->input()), ToFloatRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitDoubleToFloat32(LDoubleToFloat32 *lir)
michael@0: {
michael@0:     masm.convertDoubleToFloat32(ToFloatRegister(lir->input()), ToFloatRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInt32ToFloat32(LInt32ToFloat32 *lir)
michael@0: {
michael@0:     masm.convertInt32ToFloat32(ToRegister(lir->input()), ToFloatRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitDoubleToInt32(LDoubleToInt32 *lir)
michael@0: {
michael@0:     Label fail;
michael@0:     FloatRegister input = ToFloatRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     masm.convertDoubleToInt32(input, output, &fail, lir->mir()->canBeNegativeZero());
michael@0:     if (!bailoutFrom(&fail, lir->snapshot()))
michael@0:         return false;
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFloat32ToInt32(LFloat32ToInt32 *lir)
michael@0: {
michael@0:     Label fail;
michael@0:     FloatRegister input = ToFloatRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     masm.convertFloat32ToInt32(input, output, &fail, lir->mir()->canBeNegativeZero());
michael@0:     if (!bailoutFrom(&fail, lir->snapshot()))
michael@0:         return false;
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::emitOOLTestObject(Register objreg,
michael@0:                                  Label *ifEmulatesUndefined,
michael@0:                                  Label *ifDoesntEmulateUndefined,
michael@0:                                  Register scratch)
michael@0: {
michael@0:     saveVolatile(scratch);
michael@0:     masm.setupUnalignedABICall(1, scratch);
michael@0:     masm.passABIArg(objreg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::EmulatesUndefined));
michael@0:     masm.storeCallResult(scratch);
michael@0:     restoreVolatile(scratch);
michael@0: 
michael@0:     masm.branchIfTrueBool(scratch, ifEmulatesUndefined);
michael@0:     masm.jump(ifDoesntEmulateUndefined);
michael@0: }
michael@0: 
michael@0: // Base out-of-line code generator for all tests of the truthiness of an
michael@0: // object, where the object might not be truthy.  (Recall that per spec all
michael@0: // objects are truthy, but we implement the JSCLASS_EMULATES_UNDEFINED class
michael@0: // flag to permit objects to look like |undefined| in certain contexts,
michael@0: // including in object truthiness testing.)  We check truthiness inline except
michael@0: // when we're testing it on a proxy (or if TI guarantees us that the specified
michael@0: // object will never emulate |undefined|), in which case out-of-line code will
michael@0: // call EmulatesUndefined for a conclusive answer.
michael@0: class OutOfLineTestObject : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     Register objreg_;
michael@0:     Register scratch_;
michael@0: 
michael@0:     Label *ifEmulatesUndefined_;
michael@0:     Label *ifDoesntEmulateUndefined_;
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     bool initialized() { return ifEmulatesUndefined_ != nullptr; }
michael@0: #endif
michael@0: 
michael@0:   public:
michael@0:     OutOfLineTestObject()
michael@0: #ifdef DEBUG
michael@0:       : ifEmulatesUndefined_(nullptr), ifDoesntEmulateUndefined_(nullptr)
michael@0: #endif
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) MOZ_FINAL MOZ_OVERRIDE {
michael@0:         MOZ_ASSERT(initialized());
michael@0:         codegen->emitOOLTestObject(objreg_, ifEmulatesUndefined_, ifDoesntEmulateUndefined_,
michael@0:                                    scratch_);
michael@0:         return true;
michael@0:     }
michael@0: 
michael@0:     // Specify the register where the object to be tested is found, labels to
michael@0:     // jump to if the object is truthy or falsy, and a scratch register for
michael@0:     // use in the out-of-line path.
michael@0:     void setInputAndTargets(Register objreg, Label *ifEmulatesUndefined, Label *ifDoesntEmulateUndefined,
michael@0:                             Register scratch)
michael@0:     {
michael@0:         MOZ_ASSERT(!initialized());
michael@0:         MOZ_ASSERT(ifEmulatesUndefined);
michael@0:         objreg_ = objreg;
michael@0:         scratch_ = scratch;
michael@0:         ifEmulatesUndefined_ = ifEmulatesUndefined;
michael@0:         ifDoesntEmulateUndefined_ = ifDoesntEmulateUndefined;
michael@0:     }
michael@0: };
michael@0: 
michael@0: // A subclass of OutOfLineTestObject containing two extra labels, for use when
michael@0: // the ifTruthy/ifFalsy labels are needed in inline code as well as out-of-line
michael@0: // code.  The user should bind these labels in inline code, and specify them as
michael@0: // targets via setInputAndTargets, as appropriate.
michael@0: class OutOfLineTestObjectWithLabels : public OutOfLineTestObject
michael@0: {
michael@0:     Label label1_;
michael@0:     Label label2_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineTestObjectWithLabels() { }
michael@0: 
michael@0:     Label *label1() { return &label1_; }
michael@0:     Label *label2() { return &label2_; }
michael@0: };
michael@0: 
michael@0: void
michael@0: CodeGenerator::testObjectEmulatesUndefinedKernel(Register objreg,
michael@0:                                                  Label *ifEmulatesUndefined,
michael@0:                                                  Label *ifDoesntEmulateUndefined,
michael@0:                                                  Register scratch, OutOfLineTestObject *ool)
michael@0: {
michael@0:     ool->setInputAndTargets(objreg, ifEmulatesUndefined, ifDoesntEmulateUndefined, scratch);
michael@0: 
michael@0:     // Perform a fast-path check of the object's class flags if the object's
michael@0:     // not a proxy.  Let out-of-line code handle the slow cases that require
michael@0:     // saving registers, making a function call, and restoring registers.
michael@0:     masm.branchTestObjectTruthy(false, objreg, scratch, ool->entry(), ifEmulatesUndefined);
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::branchTestObjectEmulatesUndefined(Register objreg,
michael@0:                                                  Label *ifEmulatesUndefined,
michael@0:                                                  Label *ifDoesntEmulateUndefined,
michael@0:                                                  Register scratch, OutOfLineTestObject *ool)
michael@0: {
michael@0:     MOZ_ASSERT(!ifDoesntEmulateUndefined->bound(),
michael@0:                "ifDoesntEmulateUndefined will be bound to the fallthrough path");
michael@0: 
michael@0:     testObjectEmulatesUndefinedKernel(objreg, ifEmulatesUndefined, ifDoesntEmulateUndefined,
michael@0:                                       scratch, ool);
michael@0:     masm.bind(ifDoesntEmulateUndefined);
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::testObjectEmulatesUndefined(Register objreg,
michael@0:                                            Label *ifEmulatesUndefined,
michael@0:                                            Label *ifDoesntEmulateUndefined,
michael@0:                                            Register scratch, OutOfLineTestObject *ool)
michael@0: {
michael@0:     testObjectEmulatesUndefinedKernel(objreg, ifEmulatesUndefined, ifDoesntEmulateUndefined,
michael@0:                                       scratch, ool);
michael@0:     masm.jump(ifDoesntEmulateUndefined);
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::testValueTruthyKernel(const ValueOperand &value,
michael@0:                                      const LDefinition *scratch1, const LDefinition *scratch2,
michael@0:                                      FloatRegister fr,
michael@0:                                      Label *ifTruthy, Label *ifFalsy,
michael@0:                                      OutOfLineTestObject *ool)
michael@0: {
michael@0:     Register tag = masm.splitTagForTest(value);
michael@0: 
michael@0:     // Eventually we will want some sort of type filter here. For now, just
michael@0:     // emit all easy cases. For speed we use the cached tag for all comparison,
michael@0:     // except for doubles, which we test last (as the operation can clobber the
michael@0:     // tag, which may be in ScratchReg).
michael@0:     masm.branchTestUndefined(Assembler::Equal, tag, ifFalsy);
michael@0:     masm.branchTestNull(Assembler::Equal, tag, ifFalsy);
michael@0: 
michael@0:     Label notBoolean;
michael@0:     masm.branchTestBoolean(Assembler::NotEqual, tag, &notBoolean);
michael@0:     masm.branchTestBooleanTruthy(false, value, ifFalsy);
michael@0:     masm.jump(ifTruthy);
michael@0:     masm.bind(&notBoolean);
michael@0: 
michael@0:     Label notInt32;
michael@0:     masm.branchTestInt32(Assembler::NotEqual, tag, &notInt32);
michael@0:     masm.branchTestInt32Truthy(false, value, ifFalsy);
michael@0:     masm.jump(ifTruthy);
michael@0:     masm.bind(&notInt32);
michael@0: 
michael@0:     if (ool) {
michael@0:         Label notObject;
michael@0: 
michael@0:         masm.branchTestObject(Assembler::NotEqual, tag, &notObject);
michael@0: 
michael@0:         Register objreg = masm.extractObject(value, ToRegister(scratch1));
michael@0:         testObjectEmulatesUndefined(objreg, ifFalsy, ifTruthy, ToRegister(scratch2), ool);
michael@0: 
michael@0:         masm.bind(&notObject);
michael@0:     } else {
michael@0:         masm.branchTestObject(Assembler::Equal, tag, ifTruthy);
michael@0:     }
michael@0: 
michael@0:     // Test if a string is non-empty.
michael@0:     Label notString;
michael@0:     masm.branchTestString(Assembler::NotEqual, tag, &notString);
michael@0:     masm.branchTestStringTruthy(false, value, ifFalsy);
michael@0:     masm.jump(ifTruthy);
michael@0:     masm.bind(&notString);
michael@0: 
michael@0:     // If we reach here the value is a double.
michael@0:     masm.unboxDouble(value, fr);
michael@0:     masm.branchTestDoubleTruthy(false, fr, ifFalsy);
michael@0: 
michael@0:     // Fall through for truthy.
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::testValueTruthy(const ValueOperand &value,
michael@0:                                const LDefinition *scratch1, const LDefinition *scratch2,
michael@0:                                FloatRegister fr,
michael@0:                                Label *ifTruthy, Label *ifFalsy,
michael@0:                                OutOfLineTestObject *ool)
michael@0: {
michael@0:     testValueTruthyKernel(value, scratch1, scratch2, fr, ifTruthy, ifFalsy, ool);
michael@0:     masm.jump(ifTruthy);
michael@0: }
michael@0: 
michael@0: Label *
michael@0: CodeGenerator::getJumpLabelForBranch(MBasicBlock *block)
michael@0: {
michael@0:     if (!labelForBackedgeWithImplicitCheck(block))
michael@0:         return block->lir()->label();
michael@0: 
michael@0:     // We need to use a patchable jump for this backedge, but want to treat
michael@0:     // this as a normal label target to simplify codegen. Efficiency isn't so
michael@0:     // important here as these tests are extremely unlikely to be used in loop
michael@0:     // backedges, so emit inline code for the patchable jump. Heap allocating
michael@0:     // the label allows it to be used by out of line blocks.
michael@0:     Label *res = GetIonContext()->temp->lifoAlloc()->new_<Label>();
michael@0:     Label after;
michael@0:     masm.jump(&after);
michael@0:     masm.bind(res);
michael@0:     jumpToBlock(block);
michael@0:     masm.bind(&after);
michael@0:     return res;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTestOAndBranch(LTestOAndBranch *lir)
michael@0: {
michael@0:     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
michael@0:                "Objects which can't emulate undefined should have been constant-folded");
michael@0: 
michael@0:     OutOfLineTestObject *ool = new(alloc()) OutOfLineTestObject();
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Label *truthy = getJumpLabelForBranch(lir->ifTruthy());
michael@0:     Label *falsy = getJumpLabelForBranch(lir->ifFalsy());
michael@0: 
michael@0:     testObjectEmulatesUndefined(ToRegister(lir->input()), falsy, truthy,
michael@0:                                 ToRegister(lir->temp()), ool);
michael@0:     return true;
michael@0: 
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTestVAndBranch(LTestVAndBranch *lir)
michael@0: {
michael@0:     OutOfLineTestObject *ool = nullptr;
michael@0:     if (lir->mir()->operandMightEmulateUndefined()) {
michael@0:         ool = new(alloc()) OutOfLineTestObject();
michael@0:         if (!addOutOfLineCode(ool))
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     Label *truthy = getJumpLabelForBranch(lir->ifTruthy());
michael@0:     Label *falsy = getJumpLabelForBranch(lir->ifFalsy());
michael@0: 
michael@0:     testValueTruthy(ToValue(lir, LTestVAndBranch::Input),
michael@0:                     lir->temp1(), lir->temp2(),
michael@0:                     ToFloatRegister(lir->tempFloat()),
michael@0:                     truthy, falsy, ool);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFunctionDispatch(LFunctionDispatch *lir)
michael@0: {
michael@0:     MFunctionDispatch *mir = lir->mir();
michael@0:     Register input = ToRegister(lir->input());
michael@0:     Label *lastLabel;
michael@0:     size_t casesWithFallback;
michael@0: 
michael@0:     // Determine if the last case is fallback or an ordinary case.
michael@0:     if (!mir->hasFallback()) {
michael@0:         JS_ASSERT(mir->numCases() > 0);
michael@0:         casesWithFallback = mir->numCases();
michael@0:         lastLabel = mir->getCaseBlock(mir->numCases() - 1)->lir()->label();
michael@0:     } else {
michael@0:         casesWithFallback = mir->numCases() + 1;
michael@0:         lastLabel = mir->getFallback()->lir()->label();
michael@0:     }
michael@0: 
michael@0:     // Compare function pointers, except for the last case.
michael@0:     for (size_t i = 0; i < casesWithFallback - 1; i++) {
michael@0:         JS_ASSERT(i < mir->numCases());
michael@0:         JSFunction *func = mir->getCase(i);
michael@0:         LBlock *target = mir->getCaseBlock(i)->lir();
michael@0:         masm.branchPtr(Assembler::Equal, input, ImmGCPtr(func), target->label());
michael@0:     }
michael@0: 
michael@0:     // Jump to the last case.
michael@0:     masm.jump(lastLabel);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypeObjectDispatch(LTypeObjectDispatch *lir)
michael@0: {
michael@0:     MTypeObjectDispatch *mir = lir->mir();
michael@0:     Register input = ToRegister(lir->input());
michael@0:     Register temp = ToRegister(lir->temp());
michael@0: 
michael@0:     // Hold the incoming TypeObject.
michael@0:     masm.loadPtr(Address(input, JSObject::offsetOfType()), temp);
michael@0: 
michael@0:     // Compare TypeObjects.
michael@0:     InlinePropertyTable *propTable = mir->propTable();
michael@0:     for (size_t i = 0; i < mir->numCases(); i++) {
michael@0:         JSFunction *func = mir->getCase(i);
michael@0:         LBlock *target = mir->getCaseBlock(i)->lir();
michael@0: 
michael@0:         DebugOnly<bool> found = false;
michael@0:         for (size_t j = 0; j < propTable->numEntries(); j++) {
michael@0:             if (propTable->getFunction(j) != func)
michael@0:                 continue;
michael@0:             types::TypeObject *typeObj = propTable->getTypeObject(j);
michael@0:             masm.branchPtr(Assembler::Equal, temp, ImmGCPtr(typeObj), target->label());
michael@0:             found = true;
michael@0:         }
michael@0:         JS_ASSERT(found);
michael@0:     }
michael@0: 
michael@0:     // Unknown function: jump to fallback block.
michael@0:     LBlock *fallback = mir->getFallback()->lir();
michael@0:     masm.jump(fallback->label());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBooleanToString(LBooleanToString *lir)
michael@0: {
michael@0:     Register input = ToRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     const JSAtomState &names = GetIonContext()->runtime->names();
michael@0:     Label true_, done;
michael@0: 
michael@0:     masm.branchTest32(Assembler::NonZero, input, input, &true_);
michael@0:     masm.movePtr(ImmGCPtr(names.false_), output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&true_);
michael@0:     masm.movePtr(ImmGCPtr(names.true_), output);
michael@0: 
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::emitIntToString(Register input, Register output, Label *ool)
michael@0: {
michael@0:     masm.branch32(Assembler::AboveOrEqual, input, Imm32(StaticStrings::INT_STATIC_LIMIT), ool);
michael@0: 
michael@0:     // Fast path for small integers.
michael@0:     masm.movePtr(ImmPtr(&GetIonContext()->runtime->staticStrings().intStaticTable), output);
michael@0:     masm.loadPtr(BaseIndex(output, input, ScalePointer), output);
michael@0: }
michael@0: 
michael@0: typedef JSFlatString *(*IntToStringFn)(ThreadSafeContext *, int);
michael@0: typedef JSFlatString *(*IntToStringParFn)(ForkJoinContext *, int);
michael@0: static const VMFunctionsModal IntToStringInfo = VMFunctionsModal(
michael@0:     FunctionInfo<IntToStringFn>(Int32ToString<CanGC>),
michael@0:     FunctionInfo<IntToStringParFn>(IntToStringPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIntToString(LIntToString *lir)
michael@0: {
michael@0:     Register input = ToRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(IntToStringInfo, lir, (ArgList(), input),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     emitIntToString(input, output, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSString *(*DoubleToStringFn)(ThreadSafeContext *, double);
michael@0: typedef JSString *(*DoubleToStringParFn)(ForkJoinContext *, double);
michael@0: static const VMFunctionsModal DoubleToStringInfo = VMFunctionsModal(
michael@0:     FunctionInfo<DoubleToStringFn>(NumberToString<CanGC>),
michael@0:     FunctionInfo<DoubleToStringParFn>(DoubleToStringPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitDoubleToString(LDoubleToString *lir)
michael@0: {
michael@0:     FloatRegister input = ToFloatRegister(lir->input());
michael@0:     Register temp = ToRegister(lir->tempInt());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(DoubleToStringInfo, lir, (ArgList(), input),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     // Try double to integer conversion and run integer to string code.
michael@0:     masm.convertDoubleToInt32(input, temp, ool->entry(), true);
michael@0:     emitIntToString(temp, output, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSString *(*PrimitiveToStringFn)(JSContext *, HandleValue);
michael@0: typedef JSString *(*PrimitiveToStringParFn)(ForkJoinContext *, HandleValue);
michael@0: static const VMFunctionsModal PrimitiveToStringInfo = VMFunctionsModal(
michael@0:     FunctionInfo<PrimitiveToStringFn>(ToStringSlow),
michael@0:     FunctionInfo<PrimitiveToStringParFn>(PrimitiveToStringPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPrimitiveToString(LPrimitiveToString *lir)
michael@0: {
michael@0:     ValueOperand input = ToValue(lir, LPrimitiveToString::Input);
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(PrimitiveToStringInfo, lir, (ArgList(), input),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     Label done;
michael@0:     Register tag = masm.splitTagForTest(input);
michael@0:     const JSAtomState &names = GetIonContext()->runtime->names();
michael@0: 
michael@0:     // String
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_String)) {
michael@0:         Label notString;
michael@0:         masm.branchTestString(Assembler::NotEqual, tag, &notString);
michael@0:         masm.unboxString(input, output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notString);
michael@0:     }
michael@0: 
michael@0:     // Integer
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_Int32)) {
michael@0:         Label notInteger;
michael@0:         masm.branchTestInt32(Assembler::NotEqual, tag, &notInteger);
michael@0:         Register unboxed = ToTempUnboxRegister(lir->tempToUnbox());
michael@0:         unboxed = masm.extractInt32(input, unboxed);
michael@0:         emitIntToString(unboxed, output, ool->entry());
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notInteger);
michael@0:     }
michael@0: 
michael@0:     // Double
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_Double)) {
michael@0:         // Note: no fastpath. Need two extra registers and can only convert doubles
michael@0:         // that fit integers and are smaller than StaticStrings::INT_STATIC_LIMIT.
michael@0:         masm.branchTestDouble(Assembler::Equal, tag, ool->entry());
michael@0:     }
michael@0: 
michael@0:     // Undefined
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_Undefined)) {
michael@0:         Label notUndefined;
michael@0:         masm.branchTestUndefined(Assembler::NotEqual, tag, &notUndefined);
michael@0:         masm.movePtr(ImmGCPtr(names.undefined), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notUndefined);
michael@0:     }
michael@0: 
michael@0:     // Null
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_Null)) {
michael@0:         Label notNull;
michael@0:         masm.branchTestNull(Assembler::NotEqual, tag, &notNull);
michael@0:         masm.movePtr(ImmGCPtr(names.null), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notNull);
michael@0:     }
michael@0: 
michael@0:     // Boolean
michael@0:     if (lir->mir()->input()->mightBeType(MIRType_Boolean)) {
michael@0:         Label notBoolean, true_;
michael@0:         masm.branchTestBoolean(Assembler::NotEqual, tag, &notBoolean);
michael@0:         masm.branchTestBooleanTruthy(true, input, &true_);
michael@0:         masm.movePtr(ImmGCPtr(names.false_), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&true_);
michael@0:         masm.movePtr(ImmGCPtr(names.true_), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notBoolean);
michael@0:     }
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     // Objects are not supported or we see a type that wasn't accounted for.
michael@0:     masm.assumeUnreachable("Unexpected type for MPrimitiveToString.");
michael@0: #endif
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*CloneRegExpObjectFn)(JSContext *, JSObject *);
michael@0: static const VMFunction CloneRegExpObjectInfo =
michael@0:     FunctionInfo<CloneRegExpObjectFn>(CloneRegExpObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRegExp(LRegExp *lir)
michael@0: {
michael@0:     pushArg(ImmGCPtr(lir->mir()->source()));
michael@0:     return callVM(CloneRegExpObjectInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*RegExpExecRawFn)(JSContext *cx, HandleObject regexp,
michael@0:                                 HandleString input, MutableHandleValue output);
michael@0: static const VMFunction RegExpExecRawInfo = FunctionInfo<RegExpExecRawFn>(regexp_exec_raw);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRegExpExec(LRegExpExec *lir)
michael@0: {
michael@0:     pushArg(ToRegister(lir->string()));
michael@0:     pushArg(ToRegister(lir->regexp()));
michael@0:     return callVM(RegExpExecRawInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*RegExpTestRawFn)(JSContext *cx, HandleObject regexp,
michael@0:                                 HandleString input, bool *result);
michael@0: static const VMFunction RegExpTestRawInfo = FunctionInfo<RegExpTestRawFn>(regexp_test_raw);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRegExpTest(LRegExpTest *lir)
michael@0: {
michael@0:     pushArg(ToRegister(lir->string()));
michael@0:     pushArg(ToRegister(lir->regexp()));
michael@0:     return callVM(RegExpTestRawInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef JSString *(*RegExpReplaceFn)(JSContext *, HandleString, HandleObject, HandleString);
michael@0: static const VMFunction RegExpReplaceInfo = FunctionInfo<RegExpReplaceFn>(RegExpReplace);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRegExpReplace(LRegExpReplace *lir)
michael@0: {
michael@0:     if (lir->replacement()->isConstant())
michael@0:         pushArg(ImmGCPtr(lir->replacement()->toConstant()->toString()));
michael@0:     else
michael@0:         pushArg(ToRegister(lir->replacement()));
michael@0: 
michael@0:     pushArg(ToRegister(lir->pattern()));
michael@0: 
michael@0:     if (lir->string()->isConstant())
michael@0:         pushArg(ImmGCPtr(lir->string()->toConstant()->toString()));
michael@0:     else
michael@0:         pushArg(ToRegister(lir->string()));
michael@0: 
michael@0:     return callVM(RegExpReplaceInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef JSString *(*StringReplaceFn)(JSContext *, HandleString, HandleString, HandleString);
michael@0: static const VMFunction StringReplaceInfo = FunctionInfo<StringReplaceFn>(StringReplace);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStringReplace(LStringReplace *lir)
michael@0: {
michael@0:     if (lir->replacement()->isConstant())
michael@0:         pushArg(ImmGCPtr(lir->replacement()->toConstant()->toString()));
michael@0:     else
michael@0:         pushArg(ToRegister(lir->replacement()));
michael@0: 
michael@0:     if (lir->pattern()->isConstant())
michael@0:         pushArg(ImmGCPtr(lir->pattern()->toConstant()->toString()));
michael@0:     else
michael@0:         pushArg(ToRegister(lir->pattern()));
michael@0: 
michael@0:     if (lir->string()->isConstant())
michael@0:         pushArg(ImmGCPtr(lir->string()->toConstant()->toString()));
michael@0:     else
michael@0:         pushArg(ToRegister(lir->string()));
michael@0: 
michael@0:     return callVM(StringReplaceInfo, lir);
michael@0: }
michael@0: 
michael@0: 
michael@0: typedef JSObject *(*LambdaFn)(JSContext *, HandleFunction, HandleObject);
michael@0: static const VMFunction LambdaInfo = FunctionInfo<LambdaFn>(js::Lambda);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLambdaForSingleton(LLambdaForSingleton *lir)
michael@0: {
michael@0:     pushArg(ToRegister(lir->scopeChain()));
michael@0:     pushArg(ImmGCPtr(lir->mir()->info().fun));
michael@0:     return callVM(LambdaInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLambda(LLambda *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->scopeChain());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0:     const LambdaFunctionInfo &info = lir->mir()->info();
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(LambdaInfo, lir, (ArgList(), ImmGCPtr(info.fun), scopeChain),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     JS_ASSERT(!info.singletonType);
michael@0: 
michael@0:     masm.newGCThing(output, tempReg, info.fun, ool->entry(), gc::DefaultHeap);
michael@0:     masm.initGCThing(output, tempReg, info.fun);
michael@0: 
michael@0:     emitLambdaInit(output, scopeChain, info);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*LambdaArrowFn)(JSContext *, HandleFunction, HandleObject, HandleValue);
michael@0: static const VMFunction LambdaArrowInfo = FunctionInfo<LambdaArrowFn>(js::LambdaArrow);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLambdaArrow(LLambdaArrow *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->scopeChain());
michael@0:     ValueOperand thisv = ToValue(lir, LLambdaArrow::ThisValue);
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0:     const LambdaFunctionInfo &info = lir->mir()->info();
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(LambdaArrowInfo, lir,
michael@0:                                    (ArgList(), ImmGCPtr(info.fun), scopeChain, thisv),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     MOZ_ASSERT(!info.useNewTypeForClone);
michael@0: 
michael@0:     if (info.singletonType) {
michael@0:         // If the function has a singleton type, this instruction will only be
michael@0:         // executed once so we don't bother inlining it.
michael@0:         masm.jump(ool->entry());
michael@0:         masm.bind(ool->rejoin());
michael@0:         return true;
michael@0:     }
michael@0: 
michael@0:     masm.newGCThing(output, tempReg, info.fun, ool->entry(), gc::DefaultHeap);
michael@0:     masm.initGCThing(output, tempReg, info.fun);
michael@0: 
michael@0:     emitLambdaInit(output, scopeChain, info);
michael@0: 
michael@0:     // Initialize extended slots. Lexical |this| is stored in the first one.
michael@0:     MOZ_ASSERT(info.flags & JSFunction::EXTENDED);
michael@0:     static_assert(FunctionExtended::NUM_EXTENDED_SLOTS == 2, "All slots must be initialized");
michael@0:     static_assert(FunctionExtended::ARROW_THIS_SLOT == 0, "|this| must be stored in first slot");
michael@0:     masm.storeValue(thisv, Address(output, FunctionExtended::offsetOfExtendedSlot(0)));
michael@0:     masm.storeValue(UndefinedValue(), Address(output, FunctionExtended::offsetOfExtendedSlot(1)));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::emitLambdaInit(Register output, Register scopeChain,
michael@0:                               const LambdaFunctionInfo &info)
michael@0: {
michael@0:     MOZ_ASSERT(!!(info.flags & JSFunction::ARROW) == !!(info.flags & JSFunction::EXTENDED));
michael@0: 
michael@0:     // Initialize nargs and flags. We do this with a single uint32 to avoid
michael@0:     // 16-bit writes.
michael@0:     union {
michael@0:         struct S {
michael@0:             uint16_t nargs;
michael@0:             uint16_t flags;
michael@0:         } s;
michael@0:         uint32_t word;
michael@0:     } u;
michael@0:     u.s.nargs = info.fun->nargs();
michael@0:     u.s.flags = info.flags;
michael@0: 
michael@0:     JS_ASSERT(JSFunction::offsetOfFlags() == JSFunction::offsetOfNargs() + 2);
michael@0:     masm.store32(Imm32(u.word), Address(output, JSFunction::offsetOfNargs()));
michael@0:     masm.storePtr(ImmGCPtr(info.scriptOrLazyScript),
michael@0:                   Address(output, JSFunction::offsetOfNativeOrScript()));
michael@0:     masm.storePtr(scopeChain, Address(output, JSFunction::offsetOfEnvironment()));
michael@0:     masm.storePtr(ImmGCPtr(info.fun->displayAtom()), Address(output, JSFunction::offsetOfAtom()));
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLambdaPar(LLambdaPar *lir)
michael@0: {
michael@0:     Register resultReg = ToRegister(lir->output());
michael@0:     Register cxReg = ToRegister(lir->forkJoinContext());
michael@0:     Register scopeChainReg = ToRegister(lir->scopeChain());
michael@0:     Register tempReg1 = ToRegister(lir->getTemp0());
michael@0:     Register tempReg2 = ToRegister(lir->getTemp1());
michael@0:     const LambdaFunctionInfo &info = lir->mir()->info();
michael@0: 
michael@0:     JS_ASSERT(scopeChainReg != resultReg);
michael@0: 
michael@0:     emitAllocateGCThingPar(lir, resultReg, cxReg, tempReg1, tempReg2, info.fun);
michael@0:     emitLambdaInit(resultReg, scopeChainReg, info);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLabel(LLabel *lir)
michael@0: {
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNop(LNop *lir)
michael@0: {
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsiPoint(LOsiPoint *lir)
michael@0: {
michael@0:     // Note: markOsiPoint ensures enough space exists between the last
michael@0:     // LOsiPoint and this one to patch adjacent call instructions.
michael@0: 
michael@0:     JS_ASSERT(masm.framePushed() == frameSize());
michael@0: 
michael@0:     uint32_t osiCallPointOffset;
michael@0:     if (!markOsiPoint(lir, &osiCallPointOffset))
michael@0:         return false;
michael@0: 
michael@0:     LSafepoint *safepoint = lir->associatedSafepoint();
michael@0:     JS_ASSERT(!safepoint->osiCallPointOffset());
michael@0:     safepoint->setOsiCallPointOffset(osiCallPointOffset);
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     // There should be no movegroups or other instructions between
michael@0:     // an instruction and its OsiPoint. This is necessary because
michael@0:     // we use the OsiPoint's snapshot from within VM calls.
michael@0:     for (LInstructionReverseIterator iter(current->rbegin(lir)); iter != current->rend(); iter++) {
michael@0:         if (*iter == lir || iter->isNop())
michael@0:             continue;
michael@0:         JS_ASSERT(!iter->isMoveGroup());
michael@0:         JS_ASSERT(iter->safepoint() == safepoint);
michael@0:         break;
michael@0:     }
michael@0: #endif
michael@0: 
michael@0: #ifdef CHECK_OSIPOINT_REGISTERS
michael@0:     if (shouldVerifyOsiPointRegs(safepoint))
michael@0:         verifyOsiPointRegs(safepoint);
michael@0: #endif
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGoto(LGoto *lir)
michael@0: {
michael@0:     jumpToBlock(lir->target());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line path to execute any move groups between the start of a loop
michael@0: // header and its interrupt check, then invoke the interrupt handler.
michael@0: class OutOfLineInterruptCheckImplicit : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:   public:
michael@0:     LBlock *block;
michael@0:     LInterruptCheckImplicit *lir;
michael@0: 
michael@0:     OutOfLineInterruptCheckImplicit(LBlock *block, LInterruptCheckImplicit *lir)
michael@0:       : block(block), lir(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineInterruptCheckImplicit(this);
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineInterruptCheckImplicit(OutOfLineInterruptCheckImplicit *ool)
michael@0: {
michael@0: #ifdef CHECK_OSIPOINT_REGISTERS
michael@0:     // This is path is entered from the patched back-edge of the loop. This
michael@0:     // means that the JitAtivation flags used for checking the validity of the
michael@0:     // OSI points are not reseted by the path generated by generateBody, so we
michael@0:     // have to reset it here.
michael@0:     resetOsiPointRegs(ool->lir->safepoint());
michael@0: #endif
michael@0: 
michael@0:     LInstructionIterator iter = ool->block->begin();
michael@0:     for (; iter != ool->block->end(); iter++) {
michael@0:         if (iter->isLabel()) {
michael@0:             // Nothing to do.
michael@0:         } else if (iter->isMoveGroup()) {
michael@0:             // Replay this move group that preceds the interrupt check at the
michael@0:             // start of the loop header. Any incoming jumps here will be from
michael@0:             // the backedge and will skip over the move group emitted inline.
michael@0:             visitMoveGroup(iter->toMoveGroup());
michael@0:         } else {
michael@0:             break;
michael@0:         }
michael@0:     }
michael@0:     JS_ASSERT(*iter == ool->lir);
michael@0: 
michael@0:     saveLive(ool->lir);
michael@0:     if (!callVM(InterruptCheckInfo, ool->lir))
michael@0:         return false;
michael@0:     restoreLive(ool->lir);
michael@0:     masm.jump(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInterruptCheckImplicit(LInterruptCheckImplicit *lir)
michael@0: {
michael@0:     OutOfLineInterruptCheckImplicit *ool = new(alloc()) OutOfLineInterruptCheckImplicit(current, lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     lir->setOolEntry(ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTableSwitch(LTableSwitch *ins)
michael@0: {
michael@0:     MTableSwitch *mir = ins->mir();
michael@0:     Label *defaultcase = mir->getDefault()->lir()->label();
michael@0:     const LAllocation *temp;
michael@0: 
michael@0:     if (mir->getOperand(0)->type() != MIRType_Int32) {
michael@0:         temp = ins->tempInt()->output();
michael@0: 
michael@0:         // The input is a double, so try and convert it to an integer.
michael@0:         // If it does not fit in an integer, take the default case.
michael@0:         masm.convertDoubleToInt32(ToFloatRegister(ins->index()), ToRegister(temp), defaultcase, false);
michael@0:     } else {
michael@0:         temp = ins->index();
michael@0:     }
michael@0: 
michael@0:     return emitTableSwitchDispatch(mir, ToRegister(temp), ToRegisterOrInvalid(ins->tempPointer()));
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTableSwitchV(LTableSwitchV *ins)
michael@0: {
michael@0:     MTableSwitch *mir = ins->mir();
michael@0:     Label *defaultcase = mir->getDefault()->lir()->label();
michael@0: 
michael@0:     Register index = ToRegister(ins->tempInt());
michael@0:     ValueOperand value = ToValue(ins, LTableSwitchV::InputValue);
michael@0:     Register tag = masm.extractTag(value, index);
michael@0:     masm.branchTestNumber(Assembler::NotEqual, tag, defaultcase);
michael@0: 
michael@0:     Label unboxInt, isInt;
michael@0:     masm.branchTestInt32(Assembler::Equal, tag, &unboxInt);
michael@0:     {
michael@0:         FloatRegister floatIndex = ToFloatRegister(ins->tempFloat());
michael@0:         masm.unboxDouble(value, floatIndex);
michael@0:         masm.convertDoubleToInt32(floatIndex, index, defaultcase, false);
michael@0:         masm.jump(&isInt);
michael@0:     }
michael@0: 
michael@0:     masm.bind(&unboxInt);
michael@0:     masm.unboxInt32(value, index);
michael@0: 
michael@0:     masm.bind(&isInt);
michael@0: 
michael@0:     return emitTableSwitchDispatch(mir, index, ToRegisterOrInvalid(ins->tempPointer()));
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*DeepCloneObjectLiteralFn)(JSContext *, HandleObject, NewObjectKind);
michael@0: static const VMFunction DeepCloneObjectLiteralInfo =
michael@0:     FunctionInfo<DeepCloneObjectLiteralFn>(DeepCloneObjectLiteral);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCloneLiteral(LCloneLiteral *lir)
michael@0: {
michael@0:     pushArg(ImmWord(js::MaybeSingletonObject));
michael@0:     pushArg(ToRegister(lir->output()));
michael@0:     return callVM(DeepCloneObjectLiteralInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitParameter(LParameter *lir)
michael@0: {
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallee(LCallee *lir)
michael@0: {
michael@0:     // read number of actual arguments from the JS frame.
michael@0:     Register callee = ToRegister(lir->output());
michael@0:     Address ptr(StackPointer, frameSize() + IonJSFrameLayout::offsetOfCalleeToken());
michael@0: 
michael@0:     masm.loadPtr(ptr, callee);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStart(LStart *lir)
michael@0: {
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitReturn(LReturn *lir)
michael@0: {
michael@0: #if defined(JS_NUNBOX32)
michael@0:     DebugOnly<LAllocation *> type    = lir->getOperand(TYPE_INDEX);
michael@0:     DebugOnly<LAllocation *> payload = lir->getOperand(PAYLOAD_INDEX);
michael@0:     JS_ASSERT(ToRegister(type)    == JSReturnReg_Type);
michael@0:     JS_ASSERT(ToRegister(payload) == JSReturnReg_Data);
michael@0: #elif defined(JS_PUNBOX64)
michael@0:     DebugOnly<LAllocation *> result = lir->getOperand(0);
michael@0:     JS_ASSERT(ToRegister(result) == JSReturnReg);
michael@0: #endif
michael@0:     // Don't emit a jump to the return label if this is the last block.
michael@0:     if (current->mir() != *gen->graph().poBegin())
michael@0:         masm.jump(&returnLabel_);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsrEntry(LOsrEntry *lir)
michael@0: {
michael@0:     // Remember the OSR entry offset into the code buffer.
michael@0:     masm.flushBuffer();
michael@0:     setOsrEntryOffset(masm.size());
michael@0: 
michael@0: #ifdef JS_TRACE_LOGGING
michael@0:     if (gen->info().executionMode() == SequentialExecution) {
michael@0:         if (!emitTracelogStopEvent(TraceLogger::Baseline))
michael@0:             return false;
michael@0:         if (!emitTracelogStartEvent(TraceLogger::IonMonkey))
michael@0:             return false;
michael@0:     }
michael@0: #endif
michael@0: 
michael@0:     // Allocate the full frame for this function.
michael@0:     uint32_t size = frameSize();
michael@0:     if (size != 0)
michael@0:         masm.subPtr(Imm32(size), StackPointer);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsrScopeChain(LOsrScopeChain *lir)
michael@0: {
michael@0:     const LAllocation *frame   = lir->getOperand(0);
michael@0:     const LDefinition *object  = lir->getDef(0);
michael@0: 
michael@0:     const ptrdiff_t frameOffset = BaselineFrame::reverseOffsetOfScopeChain();
michael@0: 
michael@0:     masm.loadPtr(Address(ToRegister(frame), frameOffset), ToRegister(object));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsrArgumentsObject(LOsrArgumentsObject *lir)
michael@0: {
michael@0:     const LAllocation *frame   = lir->getOperand(0);
michael@0:     const LDefinition *object  = lir->getDef(0);
michael@0: 
michael@0:     const ptrdiff_t frameOffset = BaselineFrame::reverseOffsetOfArgsObj();
michael@0: 
michael@0:     masm.loadPtr(Address(ToRegister(frame), frameOffset), ToRegister(object));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsrValue(LOsrValue *value)
michael@0: {
michael@0:     const LAllocation *frame   = value->getOperand(0);
michael@0:     const ValueOperand out     = ToOutValue(value);
michael@0: 
michael@0:     const ptrdiff_t frameOffset = value->mir()->frameOffset();
michael@0: 
michael@0:     masm.loadValue(Address(ToRegister(frame), frameOffset), out);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOsrReturnValue(LOsrReturnValue *lir)
michael@0: {
michael@0:     const LAllocation *frame   = lir->getOperand(0);
michael@0:     const ValueOperand out     = ToOutValue(lir);
michael@0: 
michael@0:     Address flags = Address(ToRegister(frame), BaselineFrame::reverseOffsetOfFlags());
michael@0:     Address retval = Address(ToRegister(frame), BaselineFrame::reverseOffsetOfReturnValue());
michael@0: 
michael@0:     masm.moveValue(UndefinedValue(), out);
michael@0: 
michael@0:     Label done;
michael@0:     masm.branchTest32(Assembler::Zero, flags, Imm32(BaselineFrame::HAS_RVAL), &done);
michael@0:     masm.loadValue(retval, out);
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStackArgT(LStackArgT *lir)
michael@0: {
michael@0:     const LAllocation *arg = lir->getArgument();
michael@0:     MIRType argType = lir->type();
michael@0:     uint32_t argslot = lir->argslot();
michael@0:     JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
michael@0: 
michael@0:     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
michael@0:     Address dest(StackPointer, stack_offset);
michael@0: 
michael@0:     if (arg->isFloatReg())
michael@0:         masm.storeDouble(ToFloatRegister(arg), dest);
michael@0:     else if (arg->isRegister())
michael@0:         masm.storeValue(ValueTypeFromMIRType(argType), ToRegister(arg), dest);
michael@0:     else
michael@0:         masm.storeValue(*(arg->toConstant()), dest);
michael@0: 
michael@0:     uint32_t slot = StackOffsetToSlot(stack_offset);
michael@0:     JS_ASSERT(slot - 1u < graph.totalSlotCount());
michael@0:     return pushedArgumentSlots_.append(slot);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStackArgV(LStackArgV *lir)
michael@0: {
michael@0:     ValueOperand val = ToValue(lir, 0);
michael@0:     uint32_t argslot = lir->argslot();
michael@0:     JS_ASSERT(argslot - 1u < graph.argumentSlotCount());
michael@0: 
michael@0:     int32_t stack_offset = StackOffsetOfPassedArg(argslot);
michael@0: 
michael@0:     masm.storeValue(val, Address(StackPointer, stack_offset));
michael@0: 
michael@0:     uint32_t slot = StackOffsetToSlot(stack_offset);
michael@0:     JS_ASSERT(slot - 1u < graph.totalSlotCount());
michael@0:     return pushedArgumentSlots_.append(slot);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMoveGroup(LMoveGroup *group)
michael@0: {
michael@0:     if (!group->numMoves())
michael@0:         return true;
michael@0: 
michael@0:     MoveResolver &resolver = masm.moveResolver();
michael@0: 
michael@0:     for (size_t i = 0; i < group->numMoves(); i++) {
michael@0:         const LMove &move = group->getMove(i);
michael@0: 
michael@0:         const LAllocation *from = move.from();
michael@0:         const LAllocation *to = move.to();
michael@0:         LDefinition::Type type = move.type();
michael@0: 
michael@0:         // No bogus moves.
michael@0:         JS_ASSERT(*from != *to);
michael@0:         JS_ASSERT(!from->isConstant());
michael@0: 
michael@0:         MoveOp::Type moveType;
michael@0:         switch (type) {
michael@0:           case LDefinition::OBJECT:
michael@0:           case LDefinition::SLOTS:
michael@0: #ifdef JS_NUNBOX32
michael@0:           case LDefinition::TYPE:
michael@0:           case LDefinition::PAYLOAD:
michael@0: #else
michael@0:           case LDefinition::BOX:
michael@0: #endif
michael@0:           case LDefinition::GENERAL: moveType = MoveOp::GENERAL; break;
michael@0:           case LDefinition::INT32:   moveType = MoveOp::INT32;   break;
michael@0:           case LDefinition::FLOAT32: moveType = MoveOp::FLOAT32; break;
michael@0:           case LDefinition::DOUBLE:  moveType = MoveOp::DOUBLE;  break;
michael@0:           default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
michael@0:         }
michael@0: 
michael@0:         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), moveType))
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     if (!resolver.resolve())
michael@0:         return false;
michael@0: 
michael@0:     MoveEmitter emitter(masm);
michael@0:     emitter.emit(resolver);
michael@0:     emitter.finish();
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInteger(LInteger *lir)
michael@0: {
michael@0:     masm.move32(Imm32(lir->getValue()), ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPointer(LPointer *lir)
michael@0: {
michael@0:     if (lir->kind() == LPointer::GC_THING)
michael@0:         masm.movePtr(ImmGCPtr(lir->gcptr()), ToRegister(lir->output()));
michael@0:     else
michael@0:         masm.movePtr(ImmPtr(lir->ptr()), ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSlots(LSlots *lir)
michael@0: {
michael@0:     Address slots(ToRegister(lir->object()), JSObject::offsetOfSlots());
michael@0:     masm.loadPtr(slots, ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreSlotV(LStoreSlotV *store)
michael@0: {
michael@0:     Register base = ToRegister(store->slots());
michael@0:     int32_t offset = store->mir()->slot() * sizeof(Value);
michael@0: 
michael@0:     const ValueOperand value = ToValue(store, LStoreSlotV::Value);
michael@0: 
michael@0:     if (store->mir()->needsBarrier())
michael@0:        emitPreBarrier(Address(base, offset), MIRType_Value);
michael@0: 
michael@0:     masm.storeValue(value, Address(base, offset));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitGetPropertyPolymorphic(LInstruction *ins, Register obj, Register scratch,
michael@0:                                           const TypedOrValueRegister &output)
michael@0: {
michael@0:     MGetPropertyPolymorphic *mir = ins->mirRaw()->toGetPropertyPolymorphic();
michael@0:     JS_ASSERT(mir->numShapes() > 1);
michael@0: 
michael@0:     masm.loadObjShape(obj, scratch);
michael@0: 
michael@0:     Label done;
michael@0:     for (size_t i = 0; i < mir->numShapes(); i++) {
michael@0:         Label next;
michael@0:         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
michael@0: 
michael@0:         Shape *shape = mir->shape(i);
michael@0:         if (shape->slot() < shape->numFixedSlots()) {
michael@0:             // Fixed slot.
michael@0:             masm.loadTypedOrValue(Address(obj, JSObject::getFixedSlotOffset(shape->slot())),
michael@0:                                   output);
michael@0:         } else {
michael@0:             // Dynamic slot.
michael@0:             uint32_t offset = (shape->slot() - shape->numFixedSlots()) * sizeof(js::Value);
michael@0:             masm.loadPtr(Address(obj, JSObject::offsetOfSlots()), scratch);
michael@0:             masm.loadTypedOrValue(Address(scratch, offset), output);
michael@0:         }
michael@0: 
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&next);
michael@0:     }
michael@0: 
michael@0:     // Bailout if no shape matches.
michael@0:     if (!bailout(ins->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyPolymorphicV(LGetPropertyPolymorphicV *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->obj());
michael@0:     ValueOperand output = GetValueOutput(ins);
michael@0:     return emitGetPropertyPolymorphic(ins, obj, output.scratchReg(), output);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyPolymorphicT(LGetPropertyPolymorphicT *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->obj());
michael@0:     TypedOrValueRegister output(ins->mir()->type(), ToAnyRegister(ins->output()));
michael@0:     Register temp = (output.type() == MIRType_Double)
michael@0:                     ? ToRegister(ins->temp())
michael@0:                     : output.typedReg().gpr();
michael@0:     return emitGetPropertyPolymorphic(ins, obj, temp, output);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitSetPropertyPolymorphic(LInstruction *ins, Register obj, Register scratch,
michael@0:                                           const ConstantOrRegister &value)
michael@0: {
michael@0:     MSetPropertyPolymorphic *mir = ins->mirRaw()->toSetPropertyPolymorphic();
michael@0:     JS_ASSERT(mir->numShapes() > 1);
michael@0: 
michael@0:     masm.loadObjShape(obj, scratch);
michael@0: 
michael@0:     Label done;
michael@0:     for (size_t i = 0; i < mir->numShapes(); i++) {
michael@0:         Label next;
michael@0:         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
michael@0: 
michael@0:         Shape *shape = mir->shape(i);
michael@0:         if (shape->slot() < shape->numFixedSlots()) {
michael@0:             // Fixed slot.
michael@0:             Address addr(obj, JSObject::getFixedSlotOffset(shape->slot()));
michael@0:             if (mir->needsBarrier())
michael@0:                 emitPreBarrier(addr, MIRType_Value);
michael@0:             masm.storeConstantOrRegister(value, addr);
michael@0:         } else {
michael@0:             // Dynamic slot.
michael@0:             masm.loadPtr(Address(obj, JSObject::offsetOfSlots()), scratch);
michael@0:             Address addr(scratch, (shape->slot() - shape->numFixedSlots()) * sizeof(js::Value));
michael@0:             if (mir->needsBarrier())
michael@0:                 emitPreBarrier(addr, MIRType_Value);
michael@0:             masm.storeConstantOrRegister(value, addr);
michael@0:         }
michael@0: 
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&next);
michael@0:     }
michael@0: 
michael@0:     // Bailout if no shape matches.
michael@0:     if (!bailout(ins->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyPolymorphicV(LSetPropertyPolymorphicV *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->obj());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     ValueOperand value = ToValue(ins, LSetPropertyPolymorphicV::Value);
michael@0:     return emitSetPropertyPolymorphic(ins, obj, temp, TypedOrValueRegister(value));
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyPolymorphicT(LSetPropertyPolymorphicT *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->obj());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0: 
michael@0:     ConstantOrRegister value;
michael@0:     if (ins->mir()->value()->isConstant())
michael@0:         value = ConstantOrRegister(ins->mir()->value()->toConstant()->value());
michael@0:     else
michael@0:         value = TypedOrValueRegister(ins->mir()->value()->type(), ToAnyRegister(ins->value()));
michael@0: 
michael@0:     return emitSetPropertyPolymorphic(ins, obj, temp, value);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitElements(LElements *lir)
michael@0: {
michael@0:     Address elements(ToRegister(lir->object()), JSObject::offsetOfElements());
michael@0:     masm.loadPtr(elements, ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*ConvertElementsToDoublesFn)(JSContext *, uintptr_t);
michael@0: static const VMFunction ConvertElementsToDoublesInfo =
michael@0:     FunctionInfo<ConvertElementsToDoublesFn>(ObjectElements::ConvertElementsToDoubles);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitConvertElementsToDoubles(LConvertElementsToDoubles *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(ConvertElementsToDoublesInfo, lir,
michael@0:                                    (ArgList(), elements), StoreNothing());
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     Address convertedAddress(elements, ObjectElements::offsetOfFlags());
michael@0:     Imm32 bit(ObjectElements::CONVERT_DOUBLE_ELEMENTS);
michael@0:     masm.branchTest32(Assembler::Zero, convertedAddress, bit, ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMaybeToDoubleElement(LMaybeToDoubleElement *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     Register value = ToRegister(lir->value());
michael@0:     ValueOperand out = ToOutValue(lir);
michael@0: 
michael@0:     FloatRegister temp = ToFloatRegister(lir->tempFloat());
michael@0:     Label convert, done;
michael@0: 
michael@0:     // If the CONVERT_DOUBLE_ELEMENTS flag is set, convert the int32
michael@0:     // value to double. Else, just box it.
michael@0:     masm.branchTest32(Assembler::NonZero,
michael@0:                       Address(elements, ObjectElements::offsetOfFlags()),
michael@0:                       Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS),
michael@0:                       &convert);
michael@0: 
michael@0:     masm.tagValue(JSVAL_TYPE_INT32, value, out);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&convert);
michael@0:     masm.convertInt32ToDouble(value, temp);
michael@0:     masm.boxDouble(temp, out);
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFunctionEnvironment(LFunctionEnvironment *lir)
michael@0: {
michael@0:     Address environment(ToRegister(lir->function()), JSFunction::offsetOfEnvironment());
michael@0:     masm.loadPtr(environment, ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitForkJoinContext(LForkJoinContext *lir)
michael@0: {
michael@0:     const Register tempReg = ToRegister(lir->getTempReg());
michael@0: 
michael@0:     masm.setupUnalignedABICall(0, tempReg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ForkJoinContextPar));
michael@0:     JS_ASSERT(ToRegister(lir->output()) == ReturnReg);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGuardThreadExclusive(LGuardThreadExclusive *lir)
michael@0: {
michael@0:     JS_ASSERT(gen->info().executionMode() == ParallelExecution);
michael@0: 
michael@0:     const Register tempReg = ToRegister(lir->getTempReg());
michael@0:     masm.setupUnalignedABICall(2, tempReg);
michael@0:     masm.passABIArg(ToRegister(lir->forkJoinContext()));
michael@0:     masm.passABIArg(ToRegister(lir->object()));
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ParallelWriteGuard));
michael@0: 
michael@0:     OutOfLineAbortPar *bail = oolAbortPar(ParallelBailoutIllegalWrite, lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0: 
michael@0:     // branch to the OOL failure code if false is returned
michael@0:     masm.branchIfFalseBool(ReturnReg, bail->entry());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGuardObjectIdentity(LGuardObjectIdentity *guard)
michael@0: {
michael@0:     Register obj = ToRegister(guard->input());
michael@0: 
michael@0:     Assembler::Condition cond =
michael@0:         guard->mir()->bailOnEquality() ? Assembler::Equal : Assembler::NotEqual;
michael@0:     return bailoutCmpPtr(cond, obj, ImmGCPtr(guard->mir()->singleObject()), guard->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypeBarrierV(LTypeBarrierV *lir)
michael@0: {
michael@0:     ValueOperand operand = ToValue(lir, LTypeBarrierV::Input);
michael@0:     Register scratch = ToTempRegisterOrInvalid(lir->temp());
michael@0: 
michael@0:     Label miss;
michael@0:     masm.guardTypeSet(operand, lir->mir()->resultTypeSet(), scratch, &miss);
michael@0:     if (!bailoutFrom(&miss, lir->snapshot()))
michael@0:         return false;
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypeBarrierO(LTypeBarrierO *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register scratch = ToTempRegisterOrInvalid(lir->temp());
michael@0: 
michael@0:     Label miss;
michael@0:     masm.guardObjectType(obj, lir->mir()->resultTypeSet(), scratch, &miss);
michael@0:     if (!bailoutFrom(&miss, lir->snapshot()))
michael@0:         return false;
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMonitorTypes(LMonitorTypes *lir)
michael@0: {
michael@0:     ValueOperand operand = ToValue(lir, LMonitorTypes::Input);
michael@0:     Register scratch = ToTempUnboxRegister(lir->temp());
michael@0: 
michael@0:     Label matched, miss;
michael@0:     masm.guardTypeSet(operand, lir->mir()->typeSet(), scratch, &miss);
michael@0:     if (!bailoutFrom(&miss, lir->snapshot()))
michael@0:         return false;
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: #ifdef JSGC_GENERATIONAL
michael@0: // Out-of-line path to update the store buffer.
michael@0: class OutOfLineCallPostWriteBarrier : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LInstruction *lir_;
michael@0:     const LAllocation *object_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineCallPostWriteBarrier(LInstruction *lir, const LAllocation *object)
michael@0:       : lir_(lir), object_(object)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineCallPostWriteBarrier(this);
michael@0:     }
michael@0: 
michael@0:     LInstruction *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0:     const LAllocation *object() const {
michael@0:         return object_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineCallPostWriteBarrier(OutOfLineCallPostWriteBarrier *ool)
michael@0: {
michael@0:     saveLiveVolatile(ool->lir());
michael@0: 
michael@0:     const LAllocation *obj = ool->object();
michael@0: 
michael@0:     GeneralRegisterSet regs = GeneralRegisterSet::Volatile();
michael@0: 
michael@0:     Register objreg;
michael@0:     bool isGlobal = false;
michael@0:     if (obj->isConstant()) {
michael@0:         JSObject *object = &obj->toConstant()->toObject();
michael@0:         isGlobal = object->is<GlobalObject>();
michael@0:         objreg = regs.takeAny();
michael@0:         masm.movePtr(ImmGCPtr(object), objreg);
michael@0:     } else {
michael@0:         objreg = ToRegister(obj);
michael@0:         regs.takeUnchecked(objreg);
michael@0:     }
michael@0: 
michael@0:     Register runtimereg = regs.takeAny();
michael@0:     masm.mov(ImmPtr(GetIonContext()->runtime), runtimereg);
michael@0: 
michael@0:     void (*fun)(JSRuntime*, JSObject*) = isGlobal ? PostGlobalWriteBarrier : PostWriteBarrier;
michael@0:     masm.setupUnalignedABICall(2, regs.takeAny());
michael@0:     masm.passABIArg(runtimereg);
michael@0:     masm.passABIArg(objreg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, fun));
michael@0: 
michael@0:     restoreLiveVolatile(ool->lir());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: #endif
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPostWriteBarrierO(LPostWriteBarrierO *lir)
michael@0: {
michael@0: #ifdef JSGC_GENERATIONAL
michael@0:     OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Register temp = ToTempRegisterOrInvalid(lir->temp());
michael@0: 
michael@0:     if (lir->object()->isConstant()) {
michael@0: #ifdef DEBUG
michael@0:         const Nursery &nursery = GetIonContext()->runtime->gcNursery();
michael@0:         JS_ASSERT(!nursery.isInside(&lir->object()->toConstant()->toObject()));
michael@0: #endif
michael@0:     } else {
michael@0:         masm.branchPtrInNurseryRange(ToRegister(lir->object()), temp, ool->rejoin());
michael@0:     }
michael@0: 
michael@0:     masm.branchPtrInNurseryRange(ToRegister(lir->value()), temp, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0: #endif
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPostWriteBarrierV(LPostWriteBarrierV *lir)
michael@0: {
michael@0: #ifdef JSGC_GENERATIONAL
michael@0:     OutOfLineCallPostWriteBarrier *ool = new(alloc()) OutOfLineCallPostWriteBarrier(lir, lir->object());
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Register temp = ToTempRegisterOrInvalid(lir->temp());
michael@0: 
michael@0:     if (lir->object()->isConstant()) {
michael@0: #ifdef DEBUG
michael@0:         const Nursery &nursery = GetIonContext()->runtime->gcNursery();
michael@0:         JS_ASSERT(!nursery.isInside(&lir->object()->toConstant()->toObject()));
michael@0: #endif
michael@0:     } else {
michael@0:         masm.branchPtrInNurseryRange(ToRegister(lir->object()), temp, ool->rejoin());
michael@0:     }
michael@0: 
michael@0:     ValueOperand value = ToValue(lir, LPostWriteBarrierV::Input);
michael@0:     masm.branchValueIsNurseryObject(value, temp, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0: #endif
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallNative(LCallNative *call)
michael@0: {
michael@0:     JSFunction *target = call->getSingleTarget();
michael@0:     JS_ASSERT(target);
michael@0:     JS_ASSERT(target->isNative());
michael@0: 
michael@0:     int callargslot = call->argslot();
michael@0:     int unusedStack = StackOffsetOfPassedArg(callargslot);
michael@0: 
michael@0:     // Registers used for callWithABI() argument-passing.
michael@0:     const Register argContextReg   = ToRegister(call->getArgContextReg());
michael@0:     const Register argUintNReg     = ToRegister(call->getArgUintNReg());
michael@0:     const Register argVpReg        = ToRegister(call->getArgVpReg());
michael@0: 
michael@0:     // Misc. temporary registers.
michael@0:     const Register tempReg = ToRegister(call->getTempReg());
michael@0: 
michael@0:     DebugOnly<uint32_t> initialStack = masm.framePushed();
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // Sequential native functions have the signature:
michael@0:     //  bool (*)(JSContext *, unsigned, Value *vp)
michael@0:     // and parallel native functions have the signature:
michael@0:     //  ParallelResult (*)(ForkJoinContext *, unsigned, Value *vp)
michael@0:     // Where vp[0] is space for an outparam, vp[1] is |this|, and vp[2] onward
michael@0:     // are the function arguments.
michael@0: 
michael@0:     // Allocate space for the outparam, moving the StackPointer to what will be &vp[1].
michael@0:     masm.adjustStack(unusedStack);
michael@0: 
michael@0:     // Push a Value containing the callee object: natives are allowed to access their callee before
michael@0:     // setitng the return value. The StackPointer is moved to &vp[0].
michael@0:     masm.Push(ObjectValue(*target));
michael@0: 
michael@0:     // Preload arguments into registers.
michael@0:     //
michael@0:     // Note that for parallel execution, loadContext does an ABI call, so we
michael@0:     // need to do this before we load the other argument registers, otherwise
michael@0:     // we'll hose them.
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     masm.loadContext(argContextReg, tempReg, executionMode);
michael@0:     masm.move32(Imm32(call->numStackArgs()), argUintNReg);
michael@0:     masm.movePtr(StackPointer, argVpReg);
michael@0: 
michael@0:     masm.Push(argUintNReg);
michael@0: 
michael@0:     // Construct native exit frame.
michael@0:     uint32_t safepointOffset;
michael@0:     if (!masm.buildFakeExitFrame(tempReg, &safepointOffset))
michael@0:         return false;
michael@0:     masm.enterFakeExitFrame(argContextReg, tempReg, executionMode);
michael@0: 
michael@0:     if (!markSafepointAt(safepointOffset, call))
michael@0:         return false;
michael@0: 
michael@0:     // Construct and execute call.
michael@0:     masm.setupUnalignedABICall(3, tempReg);
michael@0:     masm.passABIArg(argContextReg);
michael@0:     masm.passABIArg(argUintNReg);
michael@0:     masm.passABIArg(argVpReg);
michael@0: 
michael@0:     switch (executionMode) {
michael@0:       case SequentialExecution:
michael@0:         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, target->native()));
michael@0:         break;
michael@0: 
michael@0:       case ParallelExecution:
michael@0:         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, target->parallelNative()));
michael@0:         break;
michael@0: 
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     // Test for failure.
michael@0:     masm.branchIfFalseBool(ReturnReg, masm.failureLabel(executionMode));
michael@0: 
michael@0:     // Load the outparam vp[0] into output register(s).
michael@0:     masm.loadValue(Address(StackPointer, IonNativeExitFrameLayout::offsetOfResult()), JSReturnOperand);
michael@0: 
michael@0:     // The next instruction is removing the footer of the exit frame, so there
michael@0:     // is no need for leaveFakeExitFrame.
michael@0: 
michael@0:     // Move the StackPointer back to its original location, unwinding the native exit frame.
michael@0:     masm.adjustStack(IonNativeExitFrameLayout::Size() - unusedStack);
michael@0:     JS_ASSERT(masm.framePushed() == initialStack);
michael@0: 
michael@0:     dropArguments(call->numStackArgs() + 1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallDOMNative(LCallDOMNative *call)
michael@0: {
michael@0:     JSFunction *target = call->getSingleTarget();
michael@0:     JS_ASSERT(target);
michael@0:     JS_ASSERT(target->isNative());
michael@0:     JS_ASSERT(target->jitInfo());
michael@0:     JS_ASSERT(call->mir()->isCallDOMNative());
michael@0: 
michael@0:     int callargslot = call->argslot();
michael@0:     int unusedStack = StackOffsetOfPassedArg(callargslot);
michael@0: 
michael@0:     // Registers used for callWithABI() argument-passing.
michael@0:     const Register argJSContext = ToRegister(call->getArgJSContext());
michael@0:     const Register argObj       = ToRegister(call->getArgObj());
michael@0:     const Register argPrivate   = ToRegister(call->getArgPrivate());
michael@0:     const Register argArgs      = ToRegister(call->getArgArgs());
michael@0: 
michael@0:     DebugOnly<uint32_t> initialStack = masm.framePushed();
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // DOM methods have the signature:
michael@0:     //  bool (*)(JSContext *, HandleObject, void *private, const JSJitMethodCallArgs& args)
michael@0:     // Where args is initialized from an argc and a vp, vp[0] is space for an
michael@0:     // outparam and the callee, vp[1] is |this|, and vp[2] onward are the
michael@0:     // function arguments.  Note that args stores the argv, not the vp, and
michael@0:     // argv == vp + 2.
michael@0: 
michael@0:     // Nestle the stack up against the pushed arguments, leaving StackPointer at
michael@0:     // &vp[1]
michael@0:     masm.adjustStack(unusedStack);
michael@0:     // argObj is filled with the extracted object, then returned.
michael@0:     Register obj = masm.extractObject(Address(StackPointer, 0), argObj);
michael@0:     JS_ASSERT(obj == argObj);
michael@0: 
michael@0:     // Push a Value containing the callee object: natives are allowed to access their callee before
michael@0:     // setitng the return value. After this the StackPointer points to &vp[0].
michael@0:     masm.Push(ObjectValue(*target));
michael@0: 
michael@0:     // Now compute the argv value.  Since StackPointer is pointing to &vp[0] and
michael@0:     // argv is &vp[2] we just need to add 2*sizeof(Value) to the current
michael@0:     // StackPointer.
michael@0:     JS_STATIC_ASSERT(JSJitMethodCallArgsTraits::offsetOfArgv == 0);
michael@0:     JS_STATIC_ASSERT(JSJitMethodCallArgsTraits::offsetOfArgc ==
michael@0:                      IonDOMMethodExitFrameLayoutTraits::offsetOfArgcFromArgv);
michael@0:     masm.computeEffectiveAddress(Address(StackPointer, 2 * sizeof(Value)), argArgs);
michael@0: 
michael@0:     // GetReservedSlot(obj, DOM_OBJECT_SLOT).toPrivate()
michael@0:     masm.loadPrivate(Address(obj, JSObject::getFixedSlotOffset(0)), argPrivate);
michael@0: 
michael@0:     // Push argc from the call instruction into what will become the IonExitFrame
michael@0:     masm.Push(Imm32(call->numStackArgs()));
michael@0: 
michael@0:     // Push our argv onto the stack
michael@0:     masm.Push(argArgs);
michael@0:     // And store our JSJitMethodCallArgs* in argArgs.
michael@0:     masm.movePtr(StackPointer, argArgs);
michael@0: 
michael@0:     // Push |this| object for passing HandleObject. We push after argc to
michael@0:     // maintain the same sp-relative location of the object pointer with other
michael@0:     // DOMExitFrames.
michael@0:     masm.Push(argObj);
michael@0:     masm.movePtr(StackPointer, argObj);
michael@0: 
michael@0:     // Construct native exit frame.
michael@0:     uint32_t safepointOffset;
michael@0:     if (!masm.buildFakeExitFrame(argJSContext, &safepointOffset))
michael@0:         return false;
michael@0:     masm.enterFakeExitFrame(ION_FRAME_DOMMETHOD);
michael@0: 
michael@0:     if (!markSafepointAt(safepointOffset, call))
michael@0:         return false;
michael@0: 
michael@0:     // Construct and execute call.
michael@0:     masm.setupUnalignedABICall(4, argJSContext);
michael@0: 
michael@0:     masm.loadJSContext(argJSContext);
michael@0: 
michael@0:     masm.passABIArg(argJSContext);
michael@0:     masm.passABIArg(argObj);
michael@0:     masm.passABIArg(argPrivate);
michael@0:     masm.passABIArg(argArgs);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, target->jitInfo()->method));
michael@0: 
michael@0:     if (target->jitInfo()->isInfallible) {
michael@0:         masm.loadValue(Address(StackPointer, IonDOMMethodExitFrameLayout::offsetOfResult()),
michael@0:                        JSReturnOperand);
michael@0:     } else {
michael@0:         // Test for failure.
michael@0:         masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
michael@0: 
michael@0:         // Load the outparam vp[0] into output register(s).
michael@0:         masm.loadValue(Address(StackPointer, IonDOMMethodExitFrameLayout::offsetOfResult()),
michael@0:                        JSReturnOperand);
michael@0:     }
michael@0: 
michael@0:     // The next instruction is removing the footer of the exit frame, so there
michael@0:     // is no need for leaveFakeExitFrame.
michael@0: 
michael@0:     // Move the StackPointer back to its original location, unwinding the native exit frame.
michael@0:     masm.adjustStack(IonDOMMethodExitFrameLayout::Size() - unusedStack);
michael@0:     JS_ASSERT(masm.framePushed() == initialStack);
michael@0: 
michael@0:     dropArguments(call->numStackArgs() + 1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*GetIntrinsicValueFn)(JSContext *cx, HandlePropertyName, MutableHandleValue);
michael@0: static const VMFunction GetIntrinsicValueInfo =
michael@0:     FunctionInfo<GetIntrinsicValueFn>(GetIntrinsicValue);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir)
michael@0: {
michael@0:     pushArg(ImmGCPtr(lir->mir()->name()));
michael@0:     return callVM(GetIntrinsicValueInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*InvokeFunctionFn)(JSContext *, HandleObject, uint32_t, Value *, Value *);
michael@0: static const VMFunction InvokeFunctionInfo = FunctionInfo<InvokeFunctionFn>(InvokeFunction);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitCallInvokeFunction(LInstruction *call, Register calleereg,
michael@0:                                       uint32_t argc, uint32_t unusedStack)
michael@0: {
michael@0:     // Nestle %esp up to the argument vector.
michael@0:     // Each path must account for framePushed_ separately, for callVM to be valid.
michael@0:     masm.freeStack(unusedStack);
michael@0: 
michael@0:     pushArg(StackPointer); // argv.
michael@0:     pushArg(Imm32(argc));  // argc.
michael@0:     pushArg(calleereg);    // JSFunction *.
michael@0: 
michael@0:     if (!callVM(InvokeFunctionInfo, call))
michael@0:         return false;
michael@0: 
michael@0:     // Un-nestle %esp from the argument vector. No prefix was pushed.
michael@0:     masm.reserveStack(unusedStack);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallGeneric(LCallGeneric *call)
michael@0: {
michael@0:     Register calleereg = ToRegister(call->getFunction());
michael@0:     Register objreg    = ToRegister(call->getTempObject());
michael@0:     Register nargsreg  = ToRegister(call->getNargsReg());
michael@0:     uint32_t unusedStack = StackOffsetOfPassedArg(call->argslot());
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     Label invoke, thunk, makeCall, end;
michael@0: 
michael@0:     // Known-target case is handled by LCallKnown.
michael@0:     JS_ASSERT(!call->hasSingleTarget());
michael@0: 
michael@0:     // Generate an ArgumentsRectifier.
michael@0:     JitCode *argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier(executionMode);
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // Guard that calleereg is actually a function object.
michael@0:     masm.loadObjClass(calleereg, nargsreg);
michael@0:     masm.branchPtr(Assembler::NotEqual, nargsreg, ImmPtr(&JSFunction::class_), &invoke);
michael@0: 
michael@0:     // Guard that calleereg is an interpreted function with a JSScript.
michael@0:     // If we are constructing, also ensure the callee is a constructor.
michael@0:     if (call->mir()->isConstructing())
michael@0:         masm.branchIfNotInterpretedConstructor(calleereg, nargsreg, &invoke);
michael@0:     else
michael@0:         masm.branchIfFunctionHasNoScript(calleereg, &invoke);
michael@0: 
michael@0:     // Knowing that calleereg is a non-native function, load the JSScript.
michael@0:     masm.loadPtr(Address(calleereg, JSFunction::offsetOfNativeOrScript()), objreg);
michael@0: 
michael@0:     // Load script jitcode.
michael@0:     masm.loadBaselineOrIonRaw(objreg, objreg, executionMode, &invoke);
michael@0: 
michael@0:     // Nestle the StackPointer up to the argument vector.
michael@0:     masm.freeStack(unusedStack);
michael@0: 
michael@0:     // Construct the IonFramePrefix.
michael@0:     uint32_t descriptor = MakeFrameDescriptor(masm.framePushed(), JitFrame_IonJS);
michael@0:     masm.Push(Imm32(call->numActualArgs()));
michael@0:     masm.Push(calleereg);
michael@0:     masm.Push(Imm32(descriptor));
michael@0: 
michael@0:     // Check whether the provided arguments satisfy target argc.
michael@0:     masm.load16ZeroExtend(Address(calleereg, JSFunction::offsetOfNargs()), nargsreg);
michael@0:     masm.branch32(Assembler::Above, nargsreg, Imm32(call->numStackArgs()), &thunk);
michael@0:     masm.jump(&makeCall);
michael@0: 
michael@0:     // Argument fixed needed. Load the ArgumentsRectifier.
michael@0:     masm.bind(&thunk);
michael@0:     {
michael@0:         JS_ASSERT(ArgumentsRectifierReg != objreg);
michael@0:         masm.movePtr(ImmGCPtr(argumentsRectifier), objreg); // Necessary for GC marking.
michael@0:         masm.loadPtr(Address(objreg, JitCode::offsetOfCode()), objreg);
michael@0:         masm.move32(Imm32(call->numStackArgs()), ArgumentsRectifierReg);
michael@0:     }
michael@0: 
michael@0:     // Finally call the function in objreg.
michael@0:     masm.bind(&makeCall);
michael@0:     uint32_t callOffset = masm.callIon(objreg);
michael@0:     if (!markSafepointAt(callOffset, call))
michael@0:         return false;
michael@0: 
michael@0:     // Increment to remove IonFramePrefix; decrement to fill FrameSizeClass.
michael@0:     // The return address has already been removed from the Ion frame.
michael@0:     int prefixGarbage = sizeof(IonJSFrameLayout) - sizeof(void *);
michael@0:     masm.adjustStack(prefixGarbage - unusedStack);
michael@0:     masm.jump(&end);
michael@0: 
michael@0:     // Handle uncompiled or native functions.
michael@0:     masm.bind(&invoke);
michael@0:     switch (executionMode) {
michael@0:       case SequentialExecution:
michael@0:         if (!emitCallInvokeFunction(call, calleereg, call->numActualArgs(), unusedStack))
michael@0:             return false;
michael@0:         break;
michael@0: 
michael@0:       case ParallelExecution:
michael@0:         if (!emitCallToUncompiledScriptPar(call, calleereg))
michael@0:             return false;
michael@0:         break;
michael@0: 
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     masm.bind(&end);
michael@0: 
michael@0:     // If the return value of the constructing function is Primitive,
michael@0:     // replace the return value with the Object from CreateThis.
michael@0:     if (call->mir()->isConstructing()) {
michael@0:         Label notPrimitive;
michael@0:         masm.branchTestPrimitive(Assembler::NotEqual, JSReturnOperand, &notPrimitive);
michael@0:         masm.loadValue(Address(StackPointer, unusedStack), JSReturnOperand);
michael@0:         masm.bind(&notPrimitive);
michael@0:     }
michael@0: 
michael@0:     if (!checkForAbortPar(call))
michael@0:         return false;
michael@0: 
michael@0:     dropArguments(call->numStackArgs() + 1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Generates a call to CallToUncompiledScriptPar() and then bails out.
michael@0: // |calleeReg| should contain the JSFunction*.
michael@0: bool
michael@0: CodeGenerator::emitCallToUncompiledScriptPar(LInstruction *lir, Register calleeReg)
michael@0: {
michael@0:     OutOfLineCode *bail = oolAbortPar(ParallelBailoutCalledToUncompiledScript, lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0: 
michael@0:     masm.movePtr(calleeReg, CallTempReg0);
michael@0:     masm.setupUnalignedABICall(1, CallTempReg1);
michael@0:     masm.passABIArg(CallTempReg0);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, CallToUncompiledScriptPar));
michael@0:     masm.jump(bail->entry());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallKnown(LCallKnown *call)
michael@0: {
michael@0:     Register calleereg = ToRegister(call->getFunction());
michael@0:     Register objreg    = ToRegister(call->getTempObject());
michael@0:     uint32_t unusedStack = StackOffsetOfPassedArg(call->argslot());
michael@0:     DebugOnly<JSFunction *> target = call->getSingleTarget();
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     Label end, uncompiled;
michael@0: 
michael@0:     // Native single targets are handled by LCallNative.
michael@0:     JS_ASSERT(!target->isNative());
michael@0:     // Missing arguments must have been explicitly appended by the IonBuilder.
michael@0:     JS_ASSERT(target->nargs() <= call->numStackArgs());
michael@0: 
michael@0:     JS_ASSERT_IF(call->mir()->isConstructing(), target->isInterpretedConstructor());
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // The calleereg is known to be a non-native function, but might point to
michael@0:     // a LazyScript instead of a JSScript.
michael@0:     masm.branchIfFunctionHasNoScript(calleereg, &uncompiled);
michael@0: 
michael@0:     // Knowing that calleereg is a non-native function, load the JSScript.
michael@0:     masm.loadPtr(Address(calleereg, JSFunction::offsetOfNativeOrScript()), objreg);
michael@0: 
michael@0:     // Load script jitcode.
michael@0:     if (call->mir()->needsArgCheck())
michael@0:         masm.loadBaselineOrIonRaw(objreg, objreg, executionMode, &uncompiled);
michael@0:     else
michael@0:         masm.loadBaselineOrIonNoArgCheck(objreg, objreg, executionMode, &uncompiled);
michael@0: 
michael@0:     // Nestle the StackPointer up to the argument vector.
michael@0:     masm.freeStack(unusedStack);
michael@0: 
michael@0:     // Construct the IonFramePrefix.
michael@0:     uint32_t descriptor = MakeFrameDescriptor(masm.framePushed(), JitFrame_IonJS);
michael@0:     masm.Push(Imm32(call->numActualArgs()));
michael@0:     masm.Push(calleereg);
michael@0:     masm.Push(Imm32(descriptor));
michael@0: 
michael@0:     // Finally call the function in objreg.
michael@0:     uint32_t callOffset = masm.callIon(objreg);
michael@0:     if (!markSafepointAt(callOffset, call))
michael@0:         return false;
michael@0: 
michael@0:     // Increment to remove IonFramePrefix; decrement to fill FrameSizeClass.
michael@0:     // The return address has already been removed from the Ion frame.
michael@0:     int prefixGarbage = sizeof(IonJSFrameLayout) - sizeof(void *);
michael@0:     masm.adjustStack(prefixGarbage - unusedStack);
michael@0:     masm.jump(&end);
michael@0: 
michael@0:     // Handle uncompiled functions.
michael@0:     masm.bind(&uncompiled);
michael@0:     switch (executionMode) {
michael@0:       case SequentialExecution:
michael@0:         if (!emitCallInvokeFunction(call, calleereg, call->numActualArgs(), unusedStack))
michael@0:             return false;
michael@0:         break;
michael@0: 
michael@0:       case ParallelExecution:
michael@0:         if (!emitCallToUncompiledScriptPar(call, calleereg))
michael@0:             return false;
michael@0:         break;
michael@0: 
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     masm.bind(&end);
michael@0: 
michael@0:     if (!checkForAbortPar(call))
michael@0:         return false;
michael@0: 
michael@0:     // If the return value of the constructing function is Primitive,
michael@0:     // replace the return value with the Object from CreateThis.
michael@0:     if (call->mir()->isConstructing()) {
michael@0:         Label notPrimitive;
michael@0:         masm.branchTestPrimitive(Assembler::NotEqual, JSReturnOperand, &notPrimitive);
michael@0:         masm.loadValue(Address(StackPointer, unusedStack), JSReturnOperand);
michael@0:         masm.bind(&notPrimitive);
michael@0:     }
michael@0: 
michael@0:     dropArguments(call->numStackArgs() + 1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::checkForAbortPar(LInstruction *lir)
michael@0: {
michael@0:     // In parallel mode, if we call another ion-compiled function and
michael@0:     // it returns JS_ION_ERROR, that indicates a bailout that we have
michael@0:     // to propagate up the stack.
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     if (executionMode == ParallelExecution) {
michael@0:         OutOfLinePropagateAbortPar *bail = oolPropagateAbortPar(lir);
michael@0:         if (!bail)
michael@0:             return false;
michael@0:         masm.branchTestMagic(Assembler::Equal, JSReturnOperand, bail->entry());
michael@0:     }
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitCallInvokeFunction(LApplyArgsGeneric *apply, Register extraStackSize)
michael@0: {
michael@0:     Register objreg = ToRegister(apply->getTempObject());
michael@0:     JS_ASSERT(objreg != extraStackSize);
michael@0: 
michael@0:     // Push the space used by the arguments.
michael@0:     masm.movePtr(StackPointer, objreg);
michael@0:     masm.Push(extraStackSize);
michael@0: 
michael@0:     pushArg(objreg);                           // argv.
michael@0:     pushArg(ToRegister(apply->getArgc()));     // argc.
michael@0:     pushArg(ToRegister(apply->getFunction())); // JSFunction *.
michael@0: 
michael@0:     // This specialization og callVM restore the extraStackSize after the call.
michael@0:     if (!callVM(InvokeFunctionInfo, apply, &extraStackSize))
michael@0:         return false;
michael@0: 
michael@0:     masm.Pop(extraStackSize);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Do not bailout after the execution of this function since the stack no longer
michael@0: // correspond to what is expected by the snapshots.
michael@0: void
michael@0: CodeGenerator::emitPushArguments(LApplyArgsGeneric *apply, Register extraStackSpace)
michael@0: {
michael@0:     // Holds the function nargs. Initially undefined.
michael@0:     Register argcreg = ToRegister(apply->getArgc());
michael@0: 
michael@0:     Register copyreg = ToRegister(apply->getTempObject());
michael@0:     size_t argvOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs();
michael@0:     Label end;
michael@0: 
michael@0:     // Initialize the loop counter AND Compute the stack usage (if == 0)
michael@0:     masm.movePtr(argcreg, extraStackSpace);
michael@0:     masm.branchTestPtr(Assembler::Zero, argcreg, argcreg, &end);
michael@0: 
michael@0:     // Copy arguments.
michael@0:     {
michael@0:         Register count = extraStackSpace; // <- argcreg
michael@0:         Label loop;
michael@0:         masm.bind(&loop);
michael@0: 
michael@0:         // We remove sizeof(void*) from argvOffset because withtout it we target
michael@0:         // the address after the memory area that we want to copy.
michael@0:         BaseIndex disp(StackPointer, argcreg, ScaleFromElemWidth(sizeof(Value)), argvOffset - sizeof(void*));
michael@0: 
michael@0:         // Do not use Push here because other this account to 1 in the framePushed
michael@0:         // instead of 0.  These push are only counted by argcreg.
michael@0:         masm.loadPtr(disp, copyreg);
michael@0:         masm.push(copyreg);
michael@0: 
michael@0:         // Handle 32 bits architectures.
michael@0:         if (sizeof(Value) == 2 * sizeof(void*)) {
michael@0:             masm.loadPtr(disp, copyreg);
michael@0:             masm.push(copyreg);
michael@0:         }
michael@0: 
michael@0:         masm.decBranchPtr(Assembler::NonZero, count, Imm32(1), &loop);
michael@0:     }
michael@0: 
michael@0:     // Compute the stack usage.
michael@0:     masm.movePtr(argcreg, extraStackSpace);
michael@0:     masm.lshiftPtr(Imm32::ShiftOf(ScaleFromElemWidth(sizeof(Value))), extraStackSpace);
michael@0: 
michael@0:     // Join with all arguments copied and the extra stack usage computed.
michael@0:     masm.bind(&end);
michael@0: 
michael@0:     // Push |this|.
michael@0:     masm.addPtr(Imm32(sizeof(Value)), extraStackSpace);
michael@0:     masm.pushValue(ToValue(apply, LApplyArgsGeneric::ThisIndex));
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::emitPopArguments(LApplyArgsGeneric *apply, Register extraStackSpace)
michael@0: {
michael@0:     // Pop |this| and Arguments.
michael@0:     masm.freeStack(extraStackSpace);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitApplyArgsGeneric(LApplyArgsGeneric *apply)
michael@0: {
michael@0:     // Holds the function object.
michael@0:     Register calleereg = ToRegister(apply->getFunction());
michael@0: 
michael@0:     // Temporary register for modifying the function object.
michael@0:     Register objreg = ToRegister(apply->getTempObject());
michael@0:     Register copyreg = ToRegister(apply->getTempCopy());
michael@0: 
michael@0:     // Holds the function nargs. Initially undefined.
michael@0:     Register argcreg = ToRegister(apply->getArgc());
michael@0: 
michael@0:     // Unless already known, guard that calleereg is actually a function object.
michael@0:     if (!apply->hasSingleTarget()) {
michael@0:         masm.loadObjClass(calleereg, objreg);
michael@0: 
michael@0:         ImmPtr ptr = ImmPtr(&JSFunction::class_);
michael@0:         if (!bailoutCmpPtr(Assembler::NotEqual, objreg, ptr, apply->snapshot()))
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     // Copy the arguments of the current function.
michael@0:     emitPushArguments(apply, copyreg);
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // If the function is known to be uncompilable, only emit the call to InvokeFunction.
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     if (apply->hasSingleTarget()) {
michael@0:         JSFunction *target = apply->getSingleTarget();
michael@0:         if (target->isNative()) {
michael@0:             if (!emitCallInvokeFunction(apply, copyreg))
michael@0:                 return false;
michael@0:             emitPopArguments(apply, copyreg);
michael@0:             return true;
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     Label end, invoke;
michael@0: 
michael@0:     // Guard that calleereg is an interpreted function with a JSScript:
michael@0:     if (!apply->hasSingleTarget()) {
michael@0:         masm.branchIfFunctionHasNoScript(calleereg, &invoke);
michael@0:     } else {
michael@0:         // Native single targets are handled by LCallNative.
michael@0:         JS_ASSERT(!apply->getSingleTarget()->isNative());
michael@0:     }
michael@0: 
michael@0:     // Knowing that calleereg is a non-native function, load the JSScript.
michael@0:     masm.loadPtr(Address(calleereg, JSFunction::offsetOfNativeOrScript()), objreg);
michael@0: 
michael@0:     // Load script jitcode.
michael@0:     masm.loadBaselineOrIonRaw(objreg, objreg, executionMode, &invoke);
michael@0: 
michael@0:     // Call with an Ion frame or a rectifier frame.
michael@0:     {
michael@0:         // Create the frame descriptor.
michael@0:         unsigned pushed = masm.framePushed();
michael@0:         masm.addPtr(Imm32(pushed), copyreg);
michael@0:         masm.makeFrameDescriptor(copyreg, JitFrame_IonJS);
michael@0: 
michael@0:         masm.Push(argcreg);
michael@0:         masm.Push(calleereg);
michael@0:         masm.Push(copyreg); // descriptor
michael@0: 
michael@0:         Label underflow, rejoin;
michael@0: 
michael@0:         // Check whether the provided arguments satisfy target argc.
michael@0:         if (!apply->hasSingleTarget()) {
michael@0:             masm.load16ZeroExtend(Address(calleereg, JSFunction::offsetOfNargs()), copyreg);
michael@0:             masm.branch32(Assembler::Below, argcreg, copyreg, &underflow);
michael@0:         } else {
michael@0:             masm.branch32(Assembler::Below, argcreg, Imm32(apply->getSingleTarget()->nargs()),
michael@0:                           &underflow);
michael@0:         }
michael@0: 
michael@0:         // Skip the construction of the rectifier frame because we have no
michael@0:         // underflow.
michael@0:         masm.jump(&rejoin);
michael@0: 
michael@0:         // Argument fixup needed. Get ready to call the argumentsRectifier.
michael@0:         {
michael@0:             masm.bind(&underflow);
michael@0: 
michael@0:             // Hardcode the address of the argumentsRectifier code.
michael@0:             JitCode *argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier(executionMode);
michael@0: 
michael@0:             JS_ASSERT(ArgumentsRectifierReg != objreg);
michael@0:             masm.movePtr(ImmGCPtr(argumentsRectifier), objreg); // Necessary for GC marking.
michael@0:             masm.loadPtr(Address(objreg, JitCode::offsetOfCode()), objreg);
michael@0:             masm.movePtr(argcreg, ArgumentsRectifierReg);
michael@0:         }
michael@0: 
michael@0:         masm.bind(&rejoin);
michael@0: 
michael@0:         // Finally call the function in objreg, as assigned by one of the paths above.
michael@0:         uint32_t callOffset = masm.callIon(objreg);
michael@0:         if (!markSafepointAt(callOffset, apply))
michael@0:             return false;
michael@0: 
michael@0:         // Recover the number of arguments from the frame descriptor.
michael@0:         masm.loadPtr(Address(StackPointer, 0), copyreg);
michael@0:         masm.rshiftPtr(Imm32(FRAMESIZE_SHIFT), copyreg);
michael@0:         masm.subPtr(Imm32(pushed), copyreg);
michael@0: 
michael@0:         // Increment to remove IonFramePrefix; decrement to fill FrameSizeClass.
michael@0:         // The return address has already been removed from the Ion frame.
michael@0:         int prefixGarbage = sizeof(IonJSFrameLayout) - sizeof(void *);
michael@0:         masm.adjustStack(prefixGarbage);
michael@0:         masm.jump(&end);
michael@0:     }
michael@0: 
michael@0:     // Handle uncompiled or native functions.
michael@0:     {
michael@0:         masm.bind(&invoke);
michael@0:         if (!emitCallInvokeFunction(apply, copyreg))
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     // Pop arguments and continue.
michael@0:     masm.bind(&end);
michael@0:     emitPopArguments(apply, copyreg);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*ArraySpliceDenseFn)(JSContext *, HandleObject, uint32_t, uint32_t);
michael@0: static const VMFunction ArraySpliceDenseInfo = FunctionInfo<ArraySpliceDenseFn>(ArraySpliceDense);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArraySplice(LArraySplice *lir)
michael@0: {
michael@0:     pushArg(ToRegister(lir->getDeleteCount()));
michael@0:     pushArg(ToRegister(lir->getStart()));
michael@0:     pushArg(ToRegister(lir->getObject()));
michael@0:     return callVM(ArraySpliceDenseInfo, lir);
michael@0: }
michael@0: 
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBail(LBail *lir)
michael@0: {
michael@0:     return bailout(lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetDynamicName(LGetDynamicName *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->getScopeChain());
michael@0:     Register name = ToRegister(lir->getName());
michael@0:     Register temp1 = ToRegister(lir->temp1());
michael@0:     Register temp2 = ToRegister(lir->temp2());
michael@0:     Register temp3 = ToRegister(lir->temp3());
michael@0: 
michael@0:     masm.loadJSContext(temp3);
michael@0: 
michael@0:     /* Make space for the outparam. */
michael@0:     masm.adjustStack(-int32_t(sizeof(Value)));
michael@0:     masm.movePtr(StackPointer, temp2);
michael@0: 
michael@0:     masm.setupUnalignedABICall(4, temp1);
michael@0:     masm.passABIArg(temp3);
michael@0:     masm.passABIArg(scopeChain);
michael@0:     masm.passABIArg(name);
michael@0:     masm.passABIArg(temp2);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, GetDynamicName));
michael@0: 
michael@0:     const ValueOperand out = ToOutValue(lir);
michael@0: 
michael@0:     masm.loadValue(Address(StackPointer, 0), out);
michael@0:     masm.adjustStack(sizeof(Value));
michael@0: 
michael@0:     Label undefined;
michael@0:     masm.branchTestUndefined(Assembler::Equal, out, &undefined);
michael@0:     return bailoutFrom(&undefined, lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitFilterArgumentsOrEval(LInstruction *lir, Register string,
michael@0:                                          Register temp1, Register temp2)
michael@0: {
michael@0:     masm.loadJSContext(temp2);
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp1);
michael@0:     masm.passABIArg(temp2);
michael@0:     masm.passABIArg(string);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, FilterArgumentsOrEval));
michael@0: 
michael@0:     Label bail;
michael@0:     masm.branchIfFalseBool(ReturnReg, &bail);
michael@0:     return bailoutFrom(&bail, lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFilterArgumentsOrEvalS(LFilterArgumentsOrEvalS *lir)
michael@0: {
michael@0:     return emitFilterArgumentsOrEval(lir, ToRegister(lir->getString()),
michael@0:                                      ToRegister(lir->temp1()),
michael@0:                                      ToRegister(lir->temp2()));
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFilterArgumentsOrEvalV(LFilterArgumentsOrEvalV *lir)
michael@0: {
michael@0:     ValueOperand input = ToValue(lir, LFilterArgumentsOrEvalV::Input);
michael@0: 
michael@0:     // Act as nop on non-strings.
michael@0:     Label done;
michael@0:     masm.branchTestString(Assembler::NotEqual, input, &done);
michael@0: 
michael@0:     if (!emitFilterArgumentsOrEval(lir, masm.extractString(input, ToRegister(lir->temp3())),
michael@0:                                    ToRegister(lir->temp1()), ToRegister(lir->temp2())))
michael@0:     {
michael@0:         return false;
michael@0:     }
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*DirectEvalSFn)(JSContext *, HandleObject, HandleScript, HandleValue, HandleString,
michael@0:                               jsbytecode *, MutableHandleValue);
michael@0: static const VMFunction DirectEvalStringInfo = FunctionInfo<DirectEvalSFn>(DirectEvalStringFromIon);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallDirectEvalS(LCallDirectEvalS *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->getScopeChain());
michael@0:     Register string = ToRegister(lir->getString());
michael@0: 
michael@0:     pushArg(ImmPtr(lir->mir()->pc()));
michael@0:     pushArg(string);
michael@0:     pushArg(ToValue(lir, LCallDirectEvalS::ThisValue));
michael@0:     pushArg(ImmGCPtr(gen->info().script()));
michael@0:     pushArg(scopeChain);
michael@0: 
michael@0:     return callVM(DirectEvalStringInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*DirectEvalVFn)(JSContext *, HandleObject, HandleScript, HandleValue, HandleValue,
michael@0:                               jsbytecode *, MutableHandleValue);
michael@0: static const VMFunction DirectEvalValueInfo = FunctionInfo<DirectEvalVFn>(DirectEvalValueFromIon);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallDirectEvalV(LCallDirectEvalV *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->getScopeChain());
michael@0: 
michael@0:     pushArg(ImmPtr(lir->mir()->pc()));
michael@0:     pushArg(ToValue(lir, LCallDirectEvalV::Argument));
michael@0:     pushArg(ToValue(lir, LCallDirectEvalV::ThisValue));
michael@0:     pushArg(ImmGCPtr(gen->info().script()));
michael@0:     pushArg(scopeChain);
michael@0: 
michael@0:     return callVM(DirectEvalValueInfo, lir);
michael@0: }
michael@0: 
michael@0: // Registers safe for use before generatePrologue().
michael@0: static const uint32_t EntryTempMask = Registers::TempMask & ~(1 << OsrFrameReg.code());
michael@0: 
michael@0: bool
michael@0: CodeGenerator::generateArgumentsChecks(bool bailout)
michael@0: {
michael@0:     // This function can be used the normal way to check the argument types,
michael@0:     // before entering the function and bailout when arguments don't match.
michael@0:     // For debug purpose, this is can also be used to force/check that the
michael@0:     // arguments are correct. Upon fail it will hit a breakpoint.
michael@0: 
michael@0:     MIRGraph &mir = gen->graph();
michael@0:     MResumePoint *rp = mir.entryResumePoint();
michael@0: 
michael@0:     // Reserve the amount of stack the actual frame will use. We have to undo
michael@0:     // this before falling through to the method proper though, because the
michael@0:     // monomorphic call case will bypass this entire path.
michael@0:     masm.reserveStack(frameSize());
michael@0: 
michael@0:     // No registers are allocated yet, so it's safe to grab anything.
michael@0:     Register temp = GeneralRegisterSet(EntryTempMask).getAny();
michael@0: 
michael@0:     CompileInfo &info = gen->info();
michael@0: 
michael@0:     Label miss;
michael@0:     for (uint32_t i = info.startArgSlot(); i < info.endArgSlot(); i++) {
michael@0:         // All initial parameters are guaranteed to be MParameters.
michael@0:         MParameter *param = rp->getOperand(i)->toParameter();
michael@0:         const types::TypeSet *types = param->resultTypeSet();
michael@0:         if (!types || types->unknown())
michael@0:             continue;
michael@0: 
michael@0:         // Calculate the offset on the stack of the argument.
michael@0:         // (i - info.startArgSlot())    - Compute index of arg within arg vector.
michael@0:         // ... * sizeof(Value)          - Scale by value size.
michael@0:         // ArgToStackOffset(...)        - Compute displacement within arg vector.
michael@0:         int32_t offset = ArgToStackOffset((i - info.startArgSlot()) * sizeof(Value));
michael@0:         masm.guardTypeSet(Address(StackPointer, offset), types, temp, &miss);
michael@0:     }
michael@0: 
michael@0:     if (miss.used()) {
michael@0:         if (bailout) {
michael@0:             if (!bailoutFrom(&miss, graph.entrySnapshot()))
michael@0:                 return false;
michael@0:         } else {
michael@0:             Label success;
michael@0:             masm.jump(&success);
michael@0:             masm.bind(&miss);
michael@0:             masm.assumeUnreachable("Argument check fail.");
michael@0:             masm.bind(&success);
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     masm.freeStack(frameSize());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line path to report over-recursed error and fail.
michael@0: class CheckOverRecursedFailure : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LCheckOverRecursed *lir_;
michael@0: 
michael@0:   public:
michael@0:     CheckOverRecursedFailure(LCheckOverRecursed *lir)
michael@0:       : lir_(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitCheckOverRecursedFailure(this);
michael@0:     }
michael@0: 
michael@0:     LCheckOverRecursed *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCheckOverRecursed(LCheckOverRecursed *lir)
michael@0: {
michael@0:     // If we don't push anything on the stack, skip the check.
michael@0:     if (omitOverRecursedCheck())
michael@0:         return true;
michael@0: 
michael@0:     // Ensure that this frame will not cross the stack limit.
michael@0:     // This is a weak check, justified by Ion using the C stack: we must always
michael@0:     // be some distance away from the actual limit, since if the limit is
michael@0:     // crossed, an error must be thrown, which requires more frames.
michael@0:     //
michael@0:     // It must always be possible to trespass past the stack limit.
michael@0:     // Ion may legally place frames very close to the limit. Calling additional
michael@0:     // C functions may then violate the limit without any checking.
michael@0: 
michael@0:     // Since Ion frames exist on the C stack, the stack limit may be
michael@0:     // dynamically set by JS_SetThreadStackLimit() and JS_SetNativeStackQuota().
michael@0:     const void *limitAddr = GetIonContext()->runtime->addressOfJitStackLimit();
michael@0: 
michael@0:     CheckOverRecursedFailure *ool = new(alloc()) CheckOverRecursedFailure(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     // Conditional forward (unlikely) branch to failure.
michael@0:     masm.branchPtr(Assembler::AboveOrEqual, AbsoluteAddress(limitAddr), StackPointer, ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*DefVarOrConstFn)(JSContext *, HandlePropertyName, unsigned, HandleObject);
michael@0: static const VMFunction DefVarOrConstInfo =
michael@0:     FunctionInfo<DefVarOrConstFn>(DefVarOrConst);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitDefVar(LDefVar *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->scopeChain());
michael@0: 
michael@0:     pushArg(scopeChain); // JSObject *
michael@0:     pushArg(Imm32(lir->mir()->attrs())); // unsigned
michael@0:     pushArg(ImmGCPtr(lir->mir()->name())); // PropertyName *
michael@0: 
michael@0:     if (!callVM(DefVarOrConstInfo, lir))
michael@0:         return false;
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*DefFunOperationFn)(JSContext *, HandleScript, HandleObject, HandleFunction);
michael@0: static const VMFunction DefFunOperationInfo = FunctionInfo<DefFunOperationFn>(DefFunOperation);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitDefFun(LDefFun *lir)
michael@0: {
michael@0:     Register scopeChain = ToRegister(lir->scopeChain());
michael@0: 
michael@0:     pushArg(ImmGCPtr(lir->mir()->fun()));
michael@0:     pushArg(scopeChain);
michael@0:     pushArg(ImmGCPtr(current->mir()->info().script()));
michael@0: 
michael@0:     return callVM(DefFunOperationInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*ReportOverRecursedFn)(JSContext *);
michael@0: static const VMFunction CheckOverRecursedInfo =
michael@0:     FunctionInfo<ReportOverRecursedFn>(CheckOverRecursed);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCheckOverRecursedFailure(CheckOverRecursedFailure *ool)
michael@0: {
michael@0:     // The OOL path is hit if the recursion depth has been exceeded.
michael@0:     // Throw an InternalError for over-recursion.
michael@0: 
michael@0:     // LFunctionEnvironment can appear before LCheckOverRecursed, so we have
michael@0:     // to save all live registers to avoid crashes if CheckOverRecursed triggers
michael@0:     // a GC.
michael@0:     saveLive(ool->lir());
michael@0: 
michael@0:     if (!callVM(CheckOverRecursedInfo, ool->lir()))
michael@0:         return false;
michael@0: 
michael@0:     restoreLive(ool->lir());
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line path to report over-recursed error and fail.
michael@0: class CheckOverRecursedFailurePar : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LCheckOverRecursedPar *lir_;
michael@0: 
michael@0:   public:
michael@0:     CheckOverRecursedFailurePar(LCheckOverRecursedPar *lir)
michael@0:       : lir_(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitCheckOverRecursedFailurePar(this);
michael@0:     }
michael@0: 
michael@0:     LCheckOverRecursedPar *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCheckOverRecursedPar(LCheckOverRecursedPar *lir)
michael@0: {
michael@0:     // See above: unlike visitCheckOverRecursed(), this code runs in
michael@0:     // parallel mode and hence uses the jitStackLimit from the current
michael@0:     // thread state.  Also, we must check the interrupt flags because
michael@0:     // on interrupt or abort, only the stack limit for the main thread
michael@0:     // is reset, not the worker threads.  See comment in vm/ForkJoin.h
michael@0:     // for more details.
michael@0: 
michael@0:     Register cxReg = ToRegister(lir->forkJoinContext());
michael@0:     Register tempReg = ToRegister(lir->getTempReg());
michael@0: 
michael@0:     masm.loadPtr(Address(cxReg, offsetof(ForkJoinContext, perThreadData)), tempReg);
michael@0:     masm.loadPtr(Address(tempReg, offsetof(PerThreadData, jitStackLimit)), tempReg);
michael@0: 
michael@0:     // Conditional forward (unlikely) branch to failure.
michael@0:     CheckOverRecursedFailurePar *ool = new(alloc()) CheckOverRecursedFailurePar(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0:     masm.branchPtr(Assembler::BelowOrEqual, StackPointer, tempReg, ool->entry());
michael@0:     masm.checkInterruptFlagPar(tempReg, ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCheckOverRecursedFailurePar(CheckOverRecursedFailurePar *ool)
michael@0: {
michael@0:     OutOfLinePropagateAbortPar *bail = oolPropagateAbortPar(ool->lir());
michael@0:     if (!bail)
michael@0:         return false;
michael@0: 
michael@0:     // Avoid saving/restoring the temp register since we will put the
michael@0:     // ReturnReg into it below and we don't want to clobber that
michael@0:     // during PopRegsInMask():
michael@0:     LCheckOverRecursedPar *lir = ool->lir();
michael@0:     Register tempReg = ToRegister(lir->getTempReg());
michael@0:     RegisterSet saveSet(lir->safepoint()->liveRegs());
michael@0:     saveSet.takeUnchecked(tempReg);
michael@0: 
michael@0:     masm.PushRegsInMask(saveSet);
michael@0:     masm.movePtr(ToRegister(lir->forkJoinContext()), CallTempReg0);
michael@0:     masm.setupUnalignedABICall(1, CallTempReg1);
michael@0:     masm.passABIArg(CallTempReg0);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, CheckOverRecursedPar));
michael@0:     masm.movePtr(ReturnReg, tempReg);
michael@0:     masm.PopRegsInMask(saveSet);
michael@0:     masm.branchIfFalseBool(tempReg, bail->entry());
michael@0:     masm.jump(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line path to report over-recursed error and fail.
michael@0: class OutOfLineInterruptCheckPar : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:   public:
michael@0:     LInterruptCheckPar *const lir;
michael@0: 
michael@0:     OutOfLineInterruptCheckPar(LInterruptCheckPar *lir)
michael@0:       : lir(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineInterruptCheckPar(this);
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInterruptCheckPar(LInterruptCheckPar *lir)
michael@0: {
michael@0:     // First check for cx->shared->interrupt_.
michael@0:     OutOfLineInterruptCheckPar *ool = new(alloc()) OutOfLineInterruptCheckPar(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Register tempReg = ToRegister(lir->getTempReg());
michael@0:     masm.checkInterruptFlagPar(tempReg, ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineInterruptCheckPar(OutOfLineInterruptCheckPar *ool)
michael@0: {
michael@0:     OutOfLinePropagateAbortPar *bail = oolPropagateAbortPar(ool->lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0: 
michael@0:     // Avoid saving/restoring the temp register since we will put the
michael@0:     // ReturnReg into it below and we don't want to clobber that
michael@0:     // during PopRegsInMask():
michael@0:     LInterruptCheckPar *lir = ool->lir;
michael@0:     Register tempReg = ToRegister(lir->getTempReg());
michael@0:     RegisterSet saveSet(lir->safepoint()->liveRegs());
michael@0:     saveSet.takeUnchecked(tempReg);
michael@0: 
michael@0:     masm.PushRegsInMask(saveSet);
michael@0:     masm.movePtr(ToRegister(ool->lir->forkJoinContext()), CallTempReg0);
michael@0:     masm.setupUnalignedABICall(1, CallTempReg1);
michael@0:     masm.passABIArg(CallTempReg0);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, InterruptCheckPar));
michael@0:     masm.movePtr(ReturnReg, tempReg);
michael@0:     masm.PopRegsInMask(saveSet);
michael@0:     masm.branchIfFalseBool(tempReg, bail->entry());
michael@0:     masm.jump(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: IonScriptCounts *
michael@0: CodeGenerator::maybeCreateScriptCounts()
michael@0: {
michael@0:     // If scripts are being profiled, create a new IonScriptCounts and attach
michael@0:     // it to the script. This must be done on the main thread.
michael@0:     JSContext *cx = GetIonContext()->cx;
michael@0:     if (!cx || !cx->runtime()->profilingScripts)
michael@0:         return nullptr;
michael@0: 
michael@0:     CompileInfo *outerInfo = &gen->info();
michael@0:     JSScript *script = outerInfo->script();
michael@0:     if (!script)
michael@0:         return nullptr;
michael@0: 
michael@0:     if (!script->hasScriptCounts() && !script->initScriptCounts(cx))
michael@0:         return nullptr;
michael@0: 
michael@0:     IonScriptCounts *counts = js_new<IonScriptCounts>();
michael@0:     if (!counts || !counts->init(graph.numBlocks())) {
michael@0:         js_delete(counts);
michael@0:         return nullptr;
michael@0:     }
michael@0: 
michael@0:     for (size_t i = 0; i < graph.numBlocks(); i++) {
michael@0:         MBasicBlock *block = graph.getBlock(i)->mir();
michael@0: 
michael@0:         // Find a PC offset in the outermost script to use. If this block
michael@0:         // is from an inlined script, find a location in the outer script
michael@0:         // to associate information about the inlining with.
michael@0:         MResumePoint *resume = block->entryResumePoint();
michael@0:         while (resume->caller())
michael@0:             resume = resume->caller();
michael@0: 
michael@0:         uint32_t offset = script->pcToOffset(resume->pc());
michael@0:         if (!counts->block(i).init(block->id(), offset, block->numSuccessors())) {
michael@0:             js_delete(counts);
michael@0:             return nullptr;
michael@0:         }
michael@0: 
michael@0:         for (size_t j = 0; j < block->numSuccessors(); j++)
michael@0:             counts->block(i).setSuccessor(j, block->getSuccessor(j)->id());
michael@0:     }
michael@0: 
michael@0:     script->addIonCounts(counts);
michael@0:     return counts;
michael@0: }
michael@0: 
michael@0: // Structure for managing the state tracked for a block by script counters.
michael@0: struct ScriptCountBlockState
michael@0: {
michael@0:     IonBlockCounts &block;
michael@0:     MacroAssembler &masm;
michael@0: 
michael@0:     Sprinter printer;
michael@0: 
michael@0:   public:
michael@0:     ScriptCountBlockState(IonBlockCounts *block, MacroAssembler *masm)
michael@0:       : block(*block), masm(*masm), printer(GetIonContext()->cx)
michael@0:     {
michael@0:     }
michael@0: 
michael@0:     bool init()
michael@0:     {
michael@0:         if (!printer.init())
michael@0:             return false;
michael@0: 
michael@0:         // Bump the hit count for the block at the start. This code is not
michael@0:         // included in either the text for the block or the instruction byte
michael@0:         // counts.
michael@0:         masm.inc64(AbsoluteAddress(block.addressOfHitCount()));
michael@0: 
michael@0:         // Collect human readable assembly for the code generated in the block.
michael@0:         masm.setPrinter(&printer);
michael@0: 
michael@0:         return true;
michael@0:     }
michael@0: 
michael@0:     void visitInstruction(LInstruction *ins)
michael@0:     {
michael@0:         // Prefix stream of assembly instructions with their LIR instruction
michael@0:         // name and any associated high level info.
michael@0:         if (const char *extra = ins->extraName())
michael@0:             printer.printf("[%s:%s]\n", ins->opName(), extra);
michael@0:         else
michael@0:             printer.printf("[%s]\n", ins->opName());
michael@0:     }
michael@0: 
michael@0:     ~ScriptCountBlockState()
michael@0:     {
michael@0:         masm.setPrinter(nullptr);
michael@0: 
michael@0:         block.setCode(printer.string());
michael@0:     }
michael@0: };
michael@0: 
michael@0: #ifdef DEBUG
michael@0: bool
michael@0: CodeGenerator::branchIfInvalidated(Register temp, Label *invalidated)
michael@0: {
michael@0:     CodeOffsetLabel label = masm.movWithPatch(ImmWord(uintptr_t(-1)), temp);
michael@0:     if (!ionScriptLabels_.append(label))
michael@0:         return false;
michael@0: 
michael@0:     // If IonScript::refcount != 0, the script has been invalidated.
michael@0:     masm.branch32(Assembler::NotEqual,
michael@0:                   Address(temp, IonScript::offsetOfRefcount()),
michael@0:                   Imm32(0),
michael@0:                   invalidated);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mir)
michael@0: {
michael@0:     if (lir->numDefs() == 0)
michael@0:         return true;
michael@0: 
michael@0:     JS_ASSERT(lir->numDefs() == 1);
michael@0:     Register output = ToRegister(lir->getDef(0));
michael@0: 
michael@0:     GeneralRegisterSet regs(GeneralRegisterSet::All());
michael@0:     regs.take(output);
michael@0: 
michael@0:     Register temp = regs.takeAny();
michael@0:     masm.push(temp);
michael@0: 
michael@0:     // Don't check if the script has been invalidated. In that case invalid
michael@0:     // types are expected (until we reach the OsiPoint and bailout).
michael@0:     Label done;
michael@0:     if (!branchIfInvalidated(temp, &done))
michael@0:         return false;
michael@0: 
michael@0:     if (mir->type() == MIRType_Object &&
michael@0:         mir->resultTypeSet() &&
michael@0:         !mir->resultTypeSet()->unknownObject())
michael@0:     {
michael@0:         // We have a result TypeSet, assert this object is in it.
michael@0:         Label miss, ok;
michael@0:         if (mir->resultTypeSet()->getObjectCount() > 0)
michael@0:             masm.guardObjectType(output, mir->resultTypeSet(), temp, &miss);
michael@0:         else
michael@0:             masm.jump(&miss);
michael@0:         masm.jump(&ok);
michael@0: 
michael@0:         masm.bind(&miss);
michael@0:         masm.assumeUnreachable("MIR instruction returned object with unexpected type");
michael@0: 
michael@0:         masm.bind(&ok);
michael@0:     }
michael@0: 
michael@0:     // Check that we have a valid GC pointer.
michael@0:     if (gen->info().executionMode() != ParallelExecution) {
michael@0:         saveVolatile();
michael@0:         masm.setupUnalignedABICall(2, temp);
michael@0:         masm.loadJSContext(temp);
michael@0:         masm.passABIArg(temp);
michael@0:         masm.passABIArg(output);
michael@0:         masm.callWithABINoProfiling(mir->type() == MIRType_Object
michael@0:                                     ? JS_FUNC_TO_DATA_PTR(void *, AssertValidObjectPtr)
michael@0:                                     : JS_FUNC_TO_DATA_PTR(void *, AssertValidStringPtr));
michael@0:         restoreVolatile();
michael@0:     }
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     masm.pop(temp);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitValueResultChecks(LInstruction *lir, MDefinition *mir)
michael@0: {
michael@0:     if (lir->numDefs() == 0)
michael@0:         return true;
michael@0: 
michael@0:     JS_ASSERT(lir->numDefs() == BOX_PIECES);
michael@0:     if (!lir->getDef(0)->output()->isRegister())
michael@0:         return true;
michael@0: 
michael@0:     ValueOperand output = ToOutValue(lir);
michael@0: 
michael@0:     GeneralRegisterSet regs(GeneralRegisterSet::All());
michael@0:     regs.take(output);
michael@0: 
michael@0:     Register temp1 = regs.takeAny();
michael@0:     Register temp2 = regs.takeAny();
michael@0:     masm.push(temp1);
michael@0:     masm.push(temp2);
michael@0: 
michael@0:     // Don't check if the script has been invalidated. In that case invalid
michael@0:     // types are expected (until we reach the OsiPoint and bailout).
michael@0:     Label done;
michael@0:     if (!branchIfInvalidated(temp1, &done))
michael@0:         return false;
michael@0: 
michael@0:     if (mir->resultTypeSet() && !mir->resultTypeSet()->unknown()) {
michael@0:         // We have a result TypeSet, assert this value is in it.
michael@0:         Label miss, ok;
michael@0:         masm.guardTypeSet(output, mir->resultTypeSet(), temp1, &miss);
michael@0:         masm.jump(&ok);
michael@0: 
michael@0:         masm.bind(&miss);
michael@0:         masm.assumeUnreachable("MIR instruction returned value with unexpected type");
michael@0: 
michael@0:         masm.bind(&ok);
michael@0:     }
michael@0: 
michael@0:     // Check that we have a valid GC pointer.
michael@0:     if (gen->info().executionMode() != ParallelExecution) {
michael@0:         saveVolatile();
michael@0: 
michael@0:         masm.pushValue(output);
michael@0:         masm.movePtr(StackPointer, temp1);
michael@0: 
michael@0:         masm.setupUnalignedABICall(2, temp2);
michael@0:         masm.loadJSContext(temp2);
michael@0:         masm.passABIArg(temp2);
michael@0:         masm.passABIArg(temp1);
michael@0:         masm.callWithABINoProfiling(JS_FUNC_TO_DATA_PTR(void *, AssertValidValue));
michael@0:         masm.popValue(output);
michael@0:         restoreVolatile();
michael@0:     }
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     masm.pop(temp2);
michael@0:     masm.pop(temp1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitDebugResultChecks(LInstruction *ins)
michael@0: {
michael@0:     // In debug builds, check that LIR instructions return valid values.
michael@0: 
michael@0:     MDefinition *mir = ins->mirRaw();
michael@0:     if (!mir)
michael@0:         return true;
michael@0: 
michael@0:     switch (mir->type()) {
michael@0:       case MIRType_Object:
michael@0:       case MIRType_String:
michael@0:         return emitObjectOrStringResultChecks(ins, mir);
michael@0:       case MIRType_Value:
michael@0:         return emitValueResultChecks(ins, mir);
michael@0:       default:
michael@0:         return true;
michael@0:     }
michael@0: }
michael@0: #endif
michael@0: 
michael@0: bool
michael@0: CodeGenerator::generateBody()
michael@0: {
michael@0:     IonScriptCounts *counts = maybeCreateScriptCounts();
michael@0: 
michael@0: #if defined(JS_ION_PERF)
michael@0:     PerfSpewer *perfSpewer = &perfSpewer_;
michael@0:     if (gen->compilingAsmJS())
michael@0:         perfSpewer = &gen->perfSpewer();
michael@0: #endif
michael@0: 
michael@0:     for (size_t i = 0; i < graph.numBlocks(); i++) {
michael@0:         current = graph.getBlock(i);
michael@0:         masm.bind(current->label());
michael@0: 
michael@0:         mozilla::Maybe<ScriptCountBlockState> blockCounts;
michael@0:         if (counts) {
michael@0:             blockCounts.construct(&counts->block(i), &masm);
michael@0:             if (!blockCounts.ref().init())
michael@0:                 return false;
michael@0:         }
michael@0: 
michael@0: #if defined(JS_ION_PERF)
michael@0:         perfSpewer->startBasicBlock(current->mir(), masm);
michael@0: #endif
michael@0: 
michael@0:         for (LInstructionIterator iter = current->begin(); iter != current->end(); iter++) {
michael@0:             IonSpewStart(IonSpew_Codegen, "instruction %s", iter->opName());
michael@0: #ifdef DEBUG
michael@0:             if (const char *extra = iter->extraName())
michael@0:                 IonSpewCont(IonSpew_Codegen, ":%s", extra);
michael@0: #endif
michael@0:             IonSpewFin(IonSpew_Codegen);
michael@0: 
michael@0:             if (counts)
michael@0:                 blockCounts.ref().visitInstruction(*iter);
michael@0: 
michael@0:             if (iter->safepoint() && pushedArgumentSlots_.length()) {
michael@0:                 if (!markArgumentSlots(iter->safepoint()))
michael@0:                     return false;
michael@0:             }
michael@0: 
michael@0: #ifdef CHECK_OSIPOINT_REGISTERS
michael@0:             if (iter->safepoint())
michael@0:                 resetOsiPointRegs(iter->safepoint());
michael@0: #endif
michael@0: 
michael@0:             if (!callTraceLIR(i, *iter))
michael@0:                 return false;
michael@0: 
michael@0:             if (!iter->accept(this))
michael@0:                 return false;
michael@0: 
michael@0: #ifdef DEBUG
michael@0:             if (!emitDebugResultChecks(*iter))
michael@0:                 return false;
michael@0: #endif
michael@0:         }
michael@0:         if (masm.oom())
michael@0:             return false;
michael@0: 
michael@0: #if defined(JS_ION_PERF)
michael@0:         perfSpewer->endBasicBlock(masm);
michael@0: #endif
michael@0:     }
michael@0: 
michael@0:     JS_ASSERT(pushedArgumentSlots_.empty());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line object allocation for LNewArray.
michael@0: class OutOfLineNewArray : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LNewArray *lir_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineNewArray(LNewArray *lir)
michael@0:       : lir_(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineNewArray(this);
michael@0:     }
michael@0: 
michael@0:     LNewArray *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: typedef JSObject *(*NewInitArrayFn)(JSContext *, uint32_t, types::TypeObject *);
michael@0: static const VMFunction NewInitArrayInfo =
michael@0:     FunctionInfo<NewInitArrayFn>(NewInitArray);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewArrayCallVM(LNewArray *lir)
michael@0: {
michael@0:     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
michael@0: 
michael@0:     Register objReg = ToRegister(lir->output());
michael@0: 
michael@0:     JS_ASSERT(!lir->isCall());
michael@0:     saveLive(lir);
michael@0: 
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0:     types::TypeObject *type =
michael@0:         templateObject->hasSingletonType() ? nullptr : templateObject->type();
michael@0: 
michael@0:     pushArg(ImmGCPtr(type));
michael@0:     pushArg(Imm32(lir->mir()->count()));
michael@0: 
michael@0:     if (!callVM(NewInitArrayInfo, lir))
michael@0:         return false;
michael@0: 
michael@0:     if (ReturnReg != objReg)
michael@0:         masm.movePtr(ReturnReg, objReg);
michael@0: 
michael@0:     restoreLive(lir);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewDerivedTypedObjectFn)(JSContext *,
michael@0:                                              HandleObject type,
michael@0:                                              HandleObject owner,
michael@0:                                              int32_t offset);
michael@0: static const VMFunction CreateDerivedTypedObjInfo =
michael@0:     FunctionInfo<NewDerivedTypedObjectFn>(CreateDerivedTypedObj);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewDerivedTypedObject(LNewDerivedTypedObject *lir)
michael@0: {
michael@0:     // Not yet made safe for par exec:
michael@0:     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
michael@0: 
michael@0:     pushArg(ToRegister(lir->offset()));
michael@0:     pushArg(ToRegister(lir->owner()));
michael@0:     pushArg(ToRegister(lir->type()));
michael@0:     return callVM(CreateDerivedTypedObjInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewSlots(LNewSlots *lir)
michael@0: {
michael@0:     Register temp1 = ToRegister(lir->temp1());
michael@0:     Register temp2 = ToRegister(lir->temp2());
michael@0:     Register temp3 = ToRegister(lir->temp3());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     masm.mov(ImmPtr(GetIonContext()->runtime), temp1);
michael@0:     masm.mov(ImmWord(lir->mir()->nslots()), temp2);
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp3);
michael@0:     masm.passABIArg(temp1);
michael@0:     masm.passABIArg(temp2);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NewSlots));
michael@0: 
michael@0:     if (!bailoutTestPtr(Assembler::Zero, output, output, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool CodeGenerator::visitAtan2D(LAtan2D *lir)
michael@0: {
michael@0:     Register temp = ToRegister(lir->temp());
michael@0:     FloatRegister y = ToFloatRegister(lir->y());
michael@0:     FloatRegister x = ToFloatRegister(lir->x());
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp);
michael@0:     masm.passABIArg(y, MoveOp::DOUBLE);
michael@0:     masm.passABIArg(x, MoveOp::DOUBLE);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaAtan2), MoveOp::DOUBLE);
michael@0: 
michael@0:     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool CodeGenerator::visitHypot(LHypot *lir)
michael@0: {
michael@0:     Register temp = ToRegister(lir->temp());
michael@0:     FloatRegister x = ToFloatRegister(lir->x());
michael@0:     FloatRegister y = ToFloatRegister(lir->y());
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp);
michael@0:     masm.passABIArg(x, MoveOp::DOUBLE);
michael@0:     masm.passABIArg(y, MoveOp::DOUBLE);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaHypot), MoveOp::DOUBLE);
michael@0: 
michael@0:     JS_ASSERT(ToFloatRegister(lir->output()) == ReturnFloatReg);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewArray(LNewArray *lir)
michael@0: {
michael@0:     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0:     DebugOnly<uint32_t> count = lir->mir()->count();
michael@0: 
michael@0:     JS_ASSERT(count < JSObject::NELEMENTS_LIMIT);
michael@0: 
michael@0:     if (lir->mir()->shouldUseVM())
michael@0:         return visitNewArrayCallVM(lir);
michael@0: 
michael@0:     OutOfLineNewArray *ool = new(alloc()) OutOfLineNewArray(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     masm.newGCThing(objReg, tempReg, templateObject, ool->entry(), lir->mir()->initialHeap());
michael@0:     masm.initGCThing(objReg, tempReg, templateObject);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineNewArray(OutOfLineNewArray *ool)
michael@0: {
michael@0:     if (!visitNewArrayCallVM(ool->lir()))
michael@0:         return false;
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // Out-of-line object allocation for JSOP_NEWOBJECT.
michael@0: class OutOfLineNewObject : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LNewObject *lir_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineNewObject(LNewObject *lir)
michael@0:       : lir_(lir)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineNewObject(this);
michael@0:     }
michael@0: 
michael@0:     LNewObject *lir() const {
michael@0:         return lir_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: typedef JSObject *(*NewInitObjectFn)(JSContext *, HandleObject);
michael@0: static const VMFunction NewInitObjectInfo = FunctionInfo<NewInitObjectFn>(NewInitObject);
michael@0: 
michael@0: typedef JSObject *(*NewInitObjectWithClassPrototypeFn)(JSContext *, HandleObject);
michael@0: static const VMFunction NewInitObjectWithClassPrototypeInfo =
michael@0:     FunctionInfo<NewInitObjectWithClassPrototypeFn>(NewInitObjectWithClassPrototype);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewObjectVMCall(LNewObject *lir)
michael@0: {
michael@0:     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
michael@0: 
michael@0:     Register objReg = ToRegister(lir->output());
michael@0: 
michael@0:     JS_ASSERT(!lir->isCall());
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ImmGCPtr(lir->mir()->templateObject()));
michael@0: 
michael@0:     // If we're making a new object with a class prototype (that is, an object
michael@0:     // that derives its class from its prototype instead of being
michael@0:     // JSObject::class_'d) from self-hosted code, we need a different init
michael@0:     // function.
michael@0:     if (lir->mir()->templateObjectIsClassPrototype()) {
michael@0:         if (!callVM(NewInitObjectWithClassPrototypeInfo, lir))
michael@0:             return false;
michael@0:     } else if (!callVM(NewInitObjectInfo, lir)) {
michael@0:         return false;
michael@0:     }
michael@0: 
michael@0:     if (ReturnReg != objReg)
michael@0:         masm.movePtr(ReturnReg, objReg);
michael@0: 
michael@0:     restoreLive(lir);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewObject(LNewObject *lir)
michael@0: {
michael@0:     JS_ASSERT(gen->info().executionMode() == SequentialExecution);
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0: 
michael@0:     if (lir->mir()->shouldUseVM())
michael@0:         return visitNewObjectVMCall(lir);
michael@0: 
michael@0:     OutOfLineNewObject *ool = new(alloc()) OutOfLineNewObject(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     masm.newGCThing(objReg, tempReg, templateObject, ool->entry(), lir->mir()->initialHeap());
michael@0:     masm.initGCThing(objReg, tempReg, templateObject);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineNewObject(OutOfLineNewObject *ool)
michael@0: {
michael@0:     if (!visitNewObjectVMCall(ool->lir()))
michael@0:         return false;
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef js::DeclEnvObject *(*NewDeclEnvObjectFn)(JSContext *, HandleFunction, gc::InitialHeap);
michael@0: static const VMFunction NewDeclEnvObjectInfo =
michael@0:     FunctionInfo<NewDeclEnvObjectFn>(DeclEnvObject::createTemplateObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewDeclEnvObject(LNewDeclEnvObject *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0:     JSObject *templateObj = lir->mir()->templateObj();
michael@0:     CompileInfo &info = lir->mir()->block()->info();
michael@0: 
michael@0:     // If we have a template object, we can inline call object creation.
michael@0:     OutOfLineCode *ool = oolCallVM(NewDeclEnvObjectInfo, lir,
michael@0:                                    (ArgList(), ImmGCPtr(info.funMaybeLazy()),
michael@0:                                     Imm32(gc::DefaultHeap)),
michael@0:                                    StoreRegisterTo(objReg));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     masm.newGCThing(objReg, tempReg, templateObj, ool->entry(), gc::DefaultHeap);
michael@0:     masm.initGCThing(objReg, tempReg, templateObj);
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewCallObjectFn)(JSContext *, HandleShape, HandleTypeObject, HeapSlot *);
michael@0: static const VMFunction NewCallObjectInfo =
michael@0:     FunctionInfo<NewCallObjectFn>(NewCallObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewCallObject(LNewCallObject *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0: 
michael@0:     JSObject *templateObj = lir->mir()->templateObject();
michael@0: 
michael@0:     OutOfLineCode *ool;
michael@0:     if (lir->slots()->isRegister()) {
michael@0:         ool = oolCallVM(NewCallObjectInfo, lir,
michael@0:                         (ArgList(), ImmGCPtr(templateObj->lastProperty()),
michael@0:                                     ImmGCPtr(templateObj->type()),
michael@0:                                     ToRegister(lir->slots())),
michael@0:                         StoreRegisterTo(objReg));
michael@0:     } else {
michael@0:         ool = oolCallVM(NewCallObjectInfo, lir,
michael@0:                         (ArgList(), ImmGCPtr(templateObj->lastProperty()),
michael@0:                                     ImmGCPtr(templateObj->type()),
michael@0:                                     ImmPtr(nullptr)),
michael@0:                         StoreRegisterTo(objReg));
michael@0:     }
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0: #ifdef JSGC_GENERATIONAL
michael@0:     if (templateObj->hasDynamicSlots()) {
michael@0:         // Slot initialization is unbarriered in this case, so we must either
michael@0:         // allocate in the nursery or bail if that is not possible.
michael@0:         masm.jump(ool->entry());
michael@0:     } else
michael@0: #endif
michael@0:     {
michael@0:         // Inline call object creation, using the OOL path only for tricky cases.
michael@0:         masm.newGCThing(objReg, tempReg, templateObj, ool->entry(), gc::DefaultHeap);
michael@0:         masm.initGCThing(objReg, tempReg, templateObj);
michael@0:     }
michael@0: 
michael@0:     if (lir->slots()->isRegister())
michael@0:         masm.storePtr(ToRegister(lir->slots()), Address(objReg, JSObject::offsetOfSlots()));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewSingletonCallObjectFn)(JSContext *, HandleShape, HeapSlot *);
michael@0: static const VMFunction NewSingletonCallObjectInfo =
michael@0:     FunctionInfo<NewSingletonCallObjectFn>(NewSingletonCallObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewSingletonCallObject(LNewSingletonCallObject *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->output());
michael@0: 
michael@0:     JSObject *templateObj = lir->mir()->templateObject();
michael@0: 
michael@0:     OutOfLineCode *ool;
michael@0:     if (lir->slots()->isRegister()) {
michael@0:         ool = oolCallVM(NewSingletonCallObjectInfo, lir,
michael@0:                         (ArgList(), ImmGCPtr(templateObj->lastProperty()),
michael@0:                                     ToRegister(lir->slots())),
michael@0:                         StoreRegisterTo(objReg));
michael@0:     } else {
michael@0:         ool = oolCallVM(NewSingletonCallObjectInfo, lir,
michael@0:                         (ArgList(), ImmGCPtr(templateObj->lastProperty()),
michael@0:                                     ImmPtr(nullptr)),
michael@0:                         StoreRegisterTo(objReg));
michael@0:     }
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     // Objects can only be given singleton types in VM calls.  We make the call
michael@0:     // out of line to not bloat inline code, even if (naively) this seems like
michael@0:     // extra work.
michael@0:     masm.jump(ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewCallObjectPar(LNewCallObjectPar *lir)
michael@0: {
michael@0:     Register resultReg = ToRegister(lir->output());
michael@0:     Register cxReg = ToRegister(lir->forkJoinContext());
michael@0:     Register tempReg1 = ToRegister(lir->getTemp0());
michael@0:     Register tempReg2 = ToRegister(lir->getTemp1());
michael@0:     JSObject *templateObj = lir->mir()->templateObj();
michael@0: 
michael@0:     emitAllocateGCThingPar(lir, resultReg, cxReg, tempReg1, tempReg2, templateObj);
michael@0: 
michael@0:     // NB: !lir->slots()->isRegister() implies that there is no slots
michael@0:     // array at all, and the memory is already zeroed when copying
michael@0:     // from the template object
michael@0: 
michael@0:     if (lir->slots()->isRegister()) {
michael@0:         Register slotsReg = ToRegister(lir->slots());
michael@0:         JS_ASSERT(slotsReg != resultReg);
michael@0:         masm.storePtr(slotsReg, Address(resultReg, JSObject::offsetOfSlots()));
michael@0:     }
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewDenseArrayPar(LNewDenseArrayPar *lir)
michael@0: {
michael@0:     Register cxReg = ToRegister(lir->forkJoinContext());
michael@0:     Register lengthReg = ToRegister(lir->length());
michael@0:     Register tempReg0 = ToRegister(lir->getTemp0());
michael@0:     Register tempReg1 = ToRegister(lir->getTemp1());
michael@0:     Register tempReg2 = ToRegister(lir->getTemp2());
michael@0:     JSObject *templateObj = lir->mir()->templateObject();
michael@0: 
michael@0:     // Allocate the array into tempReg2.  Don't use resultReg because it
michael@0:     // may alias cxReg etc.
michael@0:     emitAllocateGCThingPar(lir, tempReg2, cxReg, tempReg0, tempReg1, templateObj);
michael@0: 
michael@0:     // Invoke a C helper to allocate the elements.  For convenience,
michael@0:     // this helper also returns the array back to us, or nullptr, which
michael@0:     // obviates the need to preserve the register across the call.  In
michael@0:     // reality, we should probably just have the C helper also
michael@0:     // *allocate* the array, but that would require that it initialize
michael@0:     // the various fields of the object, and I didn't want to
michael@0:     // duplicate the code in initGCThing() that already does such an
michael@0:     // admirable job.
michael@0:     masm.setupUnalignedABICall(3, tempReg0);
michael@0:     masm.passABIArg(cxReg);
michael@0:     masm.passABIArg(tempReg2);
michael@0:     masm.passABIArg(lengthReg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ExtendArrayPar));
michael@0: 
michael@0:     Register resultReg = ToRegister(lir->output());
michael@0:     JS_ASSERT(resultReg == ReturnReg);
michael@0:     OutOfLineAbortPar *bail = oolAbortPar(ParallelBailoutOutOfMemory, lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0:     masm.branchTestPtr(Assembler::Zero, resultReg, resultReg, bail->entry());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewStringObjectFn)(JSContext *, HandleString);
michael@0: static const VMFunction NewStringObjectInfo = FunctionInfo<NewStringObjectFn>(NewStringObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewStringObject(LNewStringObject *lir)
michael@0: {
michael@0:     Register input = ToRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register temp = ToRegister(lir->temp());
michael@0: 
michael@0:     StringObject *templateObj = lir->mir()->templateObj();
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(NewStringObjectInfo, lir, (ArgList(), input),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     masm.newGCThing(output, temp, templateObj, ool->entry(), gc::DefaultHeap);
michael@0:     masm.initGCThing(output, temp, templateObj);
michael@0: 
michael@0:     masm.loadStringLength(input, temp);
michael@0: 
michael@0:     masm.storeValue(JSVAL_TYPE_STRING, input, Address(output, StringObject::offsetOfPrimitiveValue()));
michael@0:     masm.storeValue(JSVAL_TYPE_INT32, temp, Address(output, StringObject::offsetOfLength()));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNewPar(LNewPar *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register cxReg = ToRegister(lir->forkJoinContext());
michael@0:     Register tempReg1 = ToRegister(lir->getTemp0());
michael@0:     Register tempReg2 = ToRegister(lir->getTemp1());
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0:     emitAllocateGCThingPar(lir, objReg, cxReg, tempReg1, tempReg2, templateObject);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: class OutOfLineNewGCThingPar : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0: public:
michael@0:     LInstruction *lir;
michael@0:     gc::AllocKind allocKind;
michael@0:     Register objReg;
michael@0:     Register cxReg;
michael@0: 
michael@0:     OutOfLineNewGCThingPar(LInstruction *lir, gc::AllocKind allocKind, Register objReg,
michael@0:                            Register cxReg)
michael@0:       : lir(lir), allocKind(allocKind), objReg(objReg), cxReg(cxReg)
michael@0:     {}
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineNewGCThingPar(this);
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitAllocateGCThingPar(LInstruction *lir, Register objReg, Register cxReg,
michael@0:                                       Register tempReg1, Register tempReg2, JSObject *templateObj)
michael@0: {
michael@0:     gc::AllocKind allocKind = templateObj->tenuredGetAllocKind();
michael@0:     OutOfLineNewGCThingPar *ool = new(alloc()) OutOfLineNewGCThingPar(lir, allocKind, objReg, cxReg);
michael@0:     if (!ool || !addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     masm.newGCThingPar(objReg, cxReg, tempReg1, tempReg2, templateObj, ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0:     masm.initGCThing(objReg, tempReg1, templateObj);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineNewGCThingPar(OutOfLineNewGCThingPar *ool)
michael@0: {
michael@0:     // As a fallback for allocation in par. exec. mode, we invoke the
michael@0:     // C helper NewGCThingPar(), which calls into the GC code.  If it
michael@0:     // returns nullptr, we bail.  If returns non-nullptr, we rejoin the
michael@0:     // original instruction.
michael@0:     Register out = ool->objReg;
michael@0: 
michael@0:     saveVolatile(out);
michael@0:     masm.setupUnalignedABICall(2, out);
michael@0:     masm.passABIArg(ool->cxReg);
michael@0:     masm.move32(Imm32(ool->allocKind), out);
michael@0:     masm.passABIArg(out);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NewGCThingPar));
michael@0:     masm.storeCallResult(out);
michael@0:     restoreVolatile(out);
michael@0: 
michael@0:     OutOfLineAbortPar *bail = oolAbortPar(ParallelBailoutOutOfMemory, ool->lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0:     masm.branchTestPtr(Assembler::Zero, out, out, bail->entry());
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAbortPar(LAbortPar *lir)
michael@0: {
michael@0:     OutOfLineAbortPar *bail = oolAbortPar(ParallelBailoutUnsupported, lir);
michael@0:     if (!bail)
michael@0:         return false;
michael@0:     masm.jump(bail->entry());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool(*InitElemFn)(JSContext *cx, HandleObject obj,
michael@0:                           HandleValue id, HandleValue value);
michael@0: static const VMFunction InitElemInfo =
michael@0:     FunctionInfo<InitElemFn>(InitElemOperation);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInitElem(LInitElem *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->getObject());
michael@0: 
michael@0:     pushArg(ToValue(lir, LInitElem::ValueIndex));
michael@0:     pushArg(ToValue(lir, LInitElem::IdIndex));
michael@0:     pushArg(objReg);
michael@0: 
michael@0:     return callVM(InitElemInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*InitElemGetterSetterFn)(JSContext *, jsbytecode *, HandleObject, HandleValue,
michael@0:                                        HandleObject);
michael@0: static const VMFunction InitElemGetterSetterInfo =
michael@0:     FunctionInfo<InitElemGetterSetterFn>(InitGetterSetterOperation);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInitElemGetterSetter(LInitElemGetterSetter *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register value = ToRegister(lir->value());
michael@0: 
michael@0:     pushArg(value);
michael@0:     pushArg(ToValue(lir, LInitElemGetterSetter::IdIndex));
michael@0:     pushArg(obj);
michael@0:     pushArg(ImmPtr(lir->mir()->resumePoint()->pc()));
michael@0: 
michael@0:     return callVM(InitElemGetterSetterInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool(*MutatePrototypeFn)(JSContext *cx, HandleObject obj, HandleValue value);
michael@0: static const VMFunction MutatePrototypeInfo =
michael@0:     FunctionInfo<MutatePrototypeFn>(MutatePrototype);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMutateProto(LMutateProto *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->getObject());
michael@0: 
michael@0:     pushArg(ToValue(lir, LMutateProto::ValueIndex));
michael@0:     pushArg(objReg);
michael@0: 
michael@0:     return callVM(MutatePrototypeInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool(*InitPropFn)(JSContext *cx, HandleObject obj,
michael@0:                           HandlePropertyName name, HandleValue value);
michael@0: static const VMFunction InitPropInfo =
michael@0:     FunctionInfo<InitPropFn>(InitProp);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInitProp(LInitProp *lir)
michael@0: {
michael@0:     Register objReg = ToRegister(lir->getObject());
michael@0: 
michael@0:     pushArg(ToValue(lir, LInitProp::ValueIndex));
michael@0:     pushArg(ImmGCPtr(lir->mir()->propertyName()));
michael@0:     pushArg(objReg);
michael@0: 
michael@0:     return callVM(InitPropInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool(*InitPropGetterSetterFn)(JSContext *, jsbytecode *, HandleObject, HandlePropertyName,
michael@0:                                       HandleObject);
michael@0: static const VMFunction InitPropGetterSetterInfo =
michael@0:     FunctionInfo<InitPropGetterSetterFn>(InitGetterSetterOperation);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInitPropGetterSetter(LInitPropGetterSetter *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register value = ToRegister(lir->value());
michael@0: 
michael@0:     pushArg(value);
michael@0:     pushArg(ImmGCPtr(lir->mir()->name()));
michael@0:     pushArg(obj);
michael@0:     pushArg(ImmPtr(lir->mir()->resumePoint()->pc()));
michael@0: 
michael@0:     return callVM(InitPropGetterSetterInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*CreateThisFn)(JSContext *cx, HandleObject callee, MutableHandleValue rval);
michael@0: static const VMFunction CreateThisInfoCodeGen = FunctionInfo<CreateThisFn>(CreateThis);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCreateThis(LCreateThis *lir)
michael@0: {
michael@0:     const LAllocation *callee = lir->getCallee();
michael@0: 
michael@0:     if (callee->isConstant())
michael@0:         pushArg(ImmGCPtr(&callee->toConstant()->toObject()));
michael@0:     else
michael@0:         pushArg(ToRegister(callee));
michael@0: 
michael@0:     return callVM(CreateThisInfoCodeGen, lir);
michael@0: }
michael@0: 
michael@0: static JSObject *
michael@0: CreateThisForFunctionWithProtoWrapper(JSContext *cx, js::HandleObject callee, JSObject *proto)
michael@0: {
michael@0:     return CreateThisForFunctionWithProto(cx, callee, proto);
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*CreateThisWithProtoFn)(JSContext *cx, HandleObject callee, JSObject *proto);
michael@0: static const VMFunction CreateThisWithProtoInfo =
michael@0: FunctionInfo<CreateThisWithProtoFn>(CreateThisForFunctionWithProtoWrapper);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCreateThisWithProto(LCreateThisWithProto *lir)
michael@0: {
michael@0:     const LAllocation *callee = lir->getCallee();
michael@0:     const LAllocation *proto = lir->getPrototype();
michael@0: 
michael@0:     if (proto->isConstant())
michael@0:         pushArg(ImmGCPtr(&proto->toConstant()->toObject()));
michael@0:     else
michael@0:         pushArg(ToRegister(proto));
michael@0: 
michael@0:     if (callee->isConstant())
michael@0:         pushArg(ImmGCPtr(&callee->toConstant()->toObject()));
michael@0:     else
michael@0:         pushArg(ToRegister(callee));
michael@0: 
michael@0:     return callVM(CreateThisWithProtoInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewGCObjectFn)(JSContext *cx, gc::AllocKind allocKind,
michael@0:                                    gc::InitialHeap initialHeap);
michael@0: static const VMFunction NewGCObjectInfo =
michael@0:     FunctionInfo<NewGCObjectFn>(js::jit::NewGCObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCreateThisWithTemplate(LCreateThisWithTemplate *lir)
michael@0: {
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0:     gc::AllocKind allocKind = templateObject->tenuredGetAllocKind();
michael@0:     gc::InitialHeap initialHeap = lir->mir()->initialHeap();
michael@0:     Register objReg = ToRegister(lir->output());
michael@0:     Register tempReg = ToRegister(lir->temp());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(NewGCObjectInfo, lir,
michael@0:                                    (ArgList(), Imm32(allocKind), Imm32(initialHeap)),
michael@0:                                    StoreRegisterTo(objReg));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     // Allocate. If the FreeList is empty, call to VM, which may GC.
michael@0:     masm.newGCThing(objReg, tempReg, templateObject, ool->entry(), lir->mir()->initialHeap());
michael@0: 
michael@0:     // Initialize based on the templateObject.
michael@0:     masm.bind(ool->rejoin());
michael@0:     masm.initGCThing(objReg, tempReg, templateObject);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*NewIonArgumentsObjectFn)(JSContext *cx, IonJSFrameLayout *frame, HandleObject);
michael@0: static const VMFunction NewIonArgumentsObjectInfo =
michael@0:     FunctionInfo<NewIonArgumentsObjectFn>((NewIonArgumentsObjectFn) ArgumentsObject::createForIon);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCreateArgumentsObject(LCreateArgumentsObject *lir)
michael@0: {
michael@0:     // This should be getting constructed in the first block only, and not any OSR entry blocks.
michael@0:     JS_ASSERT(lir->mir()->block()->id() == 0);
michael@0: 
michael@0:     const LAllocation *callObj = lir->getCallObject();
michael@0:     Register temp = ToRegister(lir->getTemp(0));
michael@0: 
michael@0:     masm.movePtr(StackPointer, temp);
michael@0:     masm.addPtr(Imm32(frameSize()), temp);
michael@0: 
michael@0:     pushArg(ToRegister(callObj));
michael@0:     pushArg(temp);
michael@0:     return callVM(NewIonArgumentsObjectInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetArgumentsObjectArg(LGetArgumentsObjectArg *lir)
michael@0: {
michael@0:     Register temp = ToRegister(lir->getTemp(0));
michael@0:     Register argsObj = ToRegister(lir->getArgsObject());
michael@0:     ValueOperand out = ToOutValue(lir);
michael@0: 
michael@0:     masm.loadPrivate(Address(argsObj, ArgumentsObject::getDataSlotOffset()), temp);
michael@0:     Address argAddr(temp, ArgumentsData::offsetOfArgs() + lir->mir()->argno() * sizeof(Value));
michael@0:     masm.loadValue(argAddr, out);
michael@0: #ifdef DEBUG
michael@0:     Label success;
michael@0:     masm.branchTestMagic(Assembler::NotEqual, out, &success);
michael@0:     masm.assumeUnreachable("Result from ArgumentObject shouldn't be JSVAL_TYPE_MAGIC.");
michael@0:     masm.bind(&success);
michael@0: #endif
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetArgumentsObjectArg(LSetArgumentsObjectArg *lir)
michael@0: {
michael@0:     Register temp = ToRegister(lir->getTemp(0));
michael@0:     Register argsObj = ToRegister(lir->getArgsObject());
michael@0:     ValueOperand value = ToValue(lir, LSetArgumentsObjectArg::ValueIndex);
michael@0: 
michael@0:     masm.loadPrivate(Address(argsObj, ArgumentsObject::getDataSlotOffset()), temp);
michael@0:     Address argAddr(temp, ArgumentsData::offsetOfArgs() + lir->mir()->argno() * sizeof(Value));
michael@0:     emitPreBarrier(argAddr, MIRType_Value);
michael@0: #ifdef DEBUG
michael@0:     Label success;
michael@0:     masm.branchTestMagic(Assembler::NotEqual, argAddr, &success);
michael@0:     masm.assumeUnreachable("Result in ArgumentObject shouldn't be JSVAL_TYPE_MAGIC.");
michael@0:     masm.bind(&success);
michael@0: #endif
michael@0:     masm.storeValue(value, argAddr);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitReturnFromCtor(LReturnFromCtor *lir)
michael@0: {
michael@0:     ValueOperand value = ToValue(lir, LReturnFromCtor::ValueIndex);
michael@0:     Register obj = ToRegister(lir->getObject());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     Label valueIsObject, end;
michael@0: 
michael@0:     masm.branchTestObject(Assembler::Equal, value, &valueIsObject);
michael@0: 
michael@0:     // Value is not an object. Return that other object.
michael@0:     masm.movePtr(obj, output);
michael@0:     masm.jump(&end);
michael@0: 
michael@0:     // Value is an object. Return unbox(Value).
michael@0:     masm.bind(&valueIsObject);
michael@0:     Register payload = masm.extractObject(value, output);
michael@0:     if (payload != output)
michael@0:         masm.movePtr(payload, output);
michael@0: 
michael@0:     masm.bind(&end);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*BoxNonStrictThisFn)(JSContext *, HandleValue);
michael@0: static const VMFunction BoxNonStrictThisInfo = FunctionInfo<BoxNonStrictThisFn>(BoxNonStrictThis);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitComputeThis(LComputeThis *lir)
michael@0: {
michael@0:     ValueOperand value = ToValue(lir, LComputeThis::ValueIndex);
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(BoxNonStrictThisInfo, lir, (ArgList(), value),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     masm.branchTestObject(Assembler::NotEqual, value, ool->entry());
michael@0:     masm.unboxObject(value, output);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadArrowThis(LLoadArrowThis *lir)
michael@0: {
michael@0:     Register callee = ToRegister(lir->callee());
michael@0:     ValueOperand output = ToOutValue(lir);
michael@0:     masm.loadValue(Address(callee, FunctionExtended::offsetOfArrowThisSlot()), output);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayLength(LArrayLength *lir)
michael@0: {
michael@0:     Address length(ToRegister(lir->elements()), ObjectElements::offsetOfLength());
michael@0:     masm.load32(length, ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetArrayLength(LSetArrayLength *lir)
michael@0: {
michael@0:     Address length(ToRegister(lir->elements()), ObjectElements::offsetOfLength());
michael@0:     Int32Key newLength = ToInt32Key(lir->index());
michael@0: 
michael@0:     masm.bumpKey(&newLength, 1);
michael@0:     masm.storeKey(newLength, length);
michael@0:     // Restore register value if it is used/captured after.
michael@0:     masm.bumpKey(&newLength, -1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypedArrayLength(LTypedArrayLength *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register out = ToRegister(lir->output());
michael@0:     masm.unboxInt32(Address(obj, TypedArrayObject::lengthOffset()), out);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypedArrayElements(LTypedArrayElements *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register out = ToRegister(lir->output());
michael@0:     masm.loadPtr(Address(obj, TypedArrayObject::dataOffset()), out);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNeuterCheck(LNeuterCheck *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register temp = ToRegister(lir->temp());
michael@0: 
michael@0:     masm.extractObject(Address(obj, TypedObject::offsetOfOwnerSlot()), temp);
michael@0:     masm.unboxInt32(Address(temp, ArrayBufferObject::flagsOffset()), temp);
michael@0: 
michael@0:     Imm32 flag(ArrayBufferObject::neuteredFlag());
michael@0:     if (!bailoutTest32(Assembler::NonZero, temp, flag, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypedObjectElements(LTypedObjectElements *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register out = ToRegister(lir->output());
michael@0:     masm.loadPtr(Address(obj, TypedObject::offsetOfDataSlot()), out);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetTypedObjectOffset(LSetTypedObjectOffset *lir)
michael@0: {
michael@0:     Register object = ToRegister(lir->object());
michael@0:     Register offset = ToRegister(lir->offset());
michael@0:     Register temp0 = ToRegister(lir->temp0());
michael@0: 
michael@0:     // `offset` is an absolute offset into the base buffer. One way
michael@0:     // to implement this instruction would be load the base address
michael@0:     // from the buffer and add `offset`. But that'd be an extra load.
michael@0:     // We can instead load the current base pointer and current
michael@0:     // offset, compute the difference with `offset`, and then adjust
michael@0:     // the current base pointer. This is two loads but to adjacent
michael@0:     // fields in the same object, which should come in the same cache
michael@0:     // line.
michael@0:     //
michael@0:     // The C code I would probably write is the following:
michael@0:     //
michael@0:     // void SetTypedObjectOffset(TypedObject *obj, int32_t offset) {
michael@0:     //     int32_t temp0 = obj->byteOffset;
michael@0:     //     obj->pointer = obj->pointer - temp0 + offset;
michael@0:     //     obj->byteOffset = offset;
michael@0:     // }
michael@0:     //
michael@0:     // But what we actually compute is more like this, because it
michael@0:     // saves us a temporary to do it this way:
michael@0:     //
michael@0:     // void SetTypedObjectOffset(TypedObject *obj, int32_t offset) {
michael@0:     //     int32_t temp0 = obj->byteOffset;
michael@0:     //     obj->pointer = obj->pointer - (temp0 - offset);
michael@0:     //     obj->byteOffset = offset;
michael@0:     // }
michael@0: 
michael@0:     // temp0 = typedObj->byteOffset;
michael@0:     masm.unboxInt32(Address(object, TypedObject::offsetOfByteOffsetSlot()), temp0);
michael@0: 
michael@0:     // temp0 -= offset;
michael@0:     masm.subPtr(offset, temp0);
michael@0: 
michael@0:     // obj->pointer -= temp0;
michael@0:     masm.subPtr(temp0, Address(object, TypedObject::offsetOfDataSlot()));
michael@0: 
michael@0:     // obj->byteOffset = offset;
michael@0:     masm.storeValue(JSVAL_TYPE_INT32, offset,
michael@0:                     Address(object, TypedObject::offsetOfByteOffsetSlot()));
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStringLength(LStringLength *lir)
michael@0: {
michael@0:     Register input = ToRegister(lir->string());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     masm.loadStringLength(input, output);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMinMaxI(LMinMaxI *ins)
michael@0: {
michael@0:     Register first = ToRegister(ins->first());
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     JS_ASSERT(first == output);
michael@0: 
michael@0:     Label done;
michael@0:     Assembler::Condition cond = ins->mir()->isMax()
michael@0:                                 ? Assembler::GreaterThan
michael@0:                                 : Assembler::LessThan;
michael@0: 
michael@0:     if (ins->second()->isConstant()) {
michael@0:         masm.branch32(cond, first, Imm32(ToInt32(ins->second())), &done);
michael@0:         masm.move32(Imm32(ToInt32(ins->second())), output);
michael@0:     } else {
michael@0:         masm.branch32(cond, first, ToRegister(ins->second()), &done);
michael@0:         masm.move32(ToRegister(ins->second()), output);
michael@0:     }
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAbsI(LAbsI *ins)
michael@0: {
michael@0:     Register input = ToRegister(ins->input());
michael@0:     Label positive;
michael@0: 
michael@0:     JS_ASSERT(input == ToRegister(ins->output()));
michael@0:     masm.branchTest32(Assembler::NotSigned, input, input, &positive);
michael@0:     masm.neg32(input);
michael@0: #ifdef JS_CODEGEN_MIPS
michael@0:     LSnapshot *snapshot = ins->snapshot();
michael@0:     if (snapshot && !bailoutCmp32(Assembler::Equal, input, Imm32(INT32_MIN), snapshot))
michael@0:         return false;
michael@0: #else
michael@0:     if (ins->snapshot() && !bailoutIf(Assembler::Overflow, ins->snapshot()))
michael@0:         return false;
michael@0: #endif
michael@0:     masm.bind(&positive);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPowI(LPowI *ins)
michael@0: {
michael@0:     FloatRegister value = ToFloatRegister(ins->value());
michael@0:     Register power = ToRegister(ins->power());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0: 
michael@0:     JS_ASSERT(power != temp);
michael@0: 
michael@0:     // In all implementations, setupUnalignedABICall() relinquishes use of
michael@0:     // its scratch register. We can therefore save an input register by
michael@0:     // reusing the scratch register to pass constants to callWithABI.
michael@0:     masm.setupUnalignedABICall(2, temp);
michael@0:     masm.passABIArg(value, MoveOp::DOUBLE);
michael@0:     masm.passABIArg(power);
michael@0: 
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::powi), MoveOp::DOUBLE);
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitPowD(LPowD *ins)
michael@0: {
michael@0:     FloatRegister value = ToFloatRegister(ins->value());
michael@0:     FloatRegister power = ToFloatRegister(ins->power());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp);
michael@0:     masm.passABIArg(value, MoveOp::DOUBLE);
michael@0:     masm.passABIArg(power, MoveOp::DOUBLE);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ecmaPow), MoveOp::DOUBLE);
michael@0: 
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRandom(LRandom *ins)
michael@0: {
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     Register temp2 = ToRegister(ins->temp2());
michael@0: 
michael@0:     masm.loadJSContext(temp);
michael@0: 
michael@0:     masm.setupUnalignedABICall(1, temp2);
michael@0:     masm.passABIArg(temp);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, math_random_no_outparam), MoveOp::DOUBLE);
michael@0: 
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
michael@0: {
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     FloatRegister input = ToFloatRegister(ins->input());
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0: 
michael@0:     const MathCache *mathCache = ins->mir()->cache();
michael@0: 
michael@0:     masm.setupUnalignedABICall(mathCache ? 2 : 1, temp);
michael@0:     if (mathCache) {
michael@0:         masm.movePtr(ImmPtr(mathCache), temp);
michael@0:         masm.passABIArg(temp);
michael@0:     }
michael@0:     masm.passABIArg(input, MoveOp::DOUBLE);
michael@0: 
michael@0: #   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
michael@0: 
michael@0:     void *funptr = nullptr;
michael@0:     switch (ins->mir()->function()) {
michael@0:       case MMathFunction::Log:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_log));
michael@0:         break;
michael@0:       case MMathFunction::Sin:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_sin));
michael@0:         break;
michael@0:       case MMathFunction::Cos:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_cos));
michael@0:         break;
michael@0:       case MMathFunction::Exp:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_exp));
michael@0:         break;
michael@0:       case MMathFunction::Tan:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_tan));
michael@0:         break;
michael@0:       case MMathFunction::ATan:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_atan));
michael@0:         break;
michael@0:       case MMathFunction::ASin:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_asin));
michael@0:         break;
michael@0:       case MMathFunction::ACos:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_acos));
michael@0:         break;
michael@0:       case MMathFunction::Log10:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_log10));
michael@0:         break;
michael@0:       case MMathFunction::Log2:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_log2));
michael@0:         break;
michael@0:       case MMathFunction::Log1P:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_log1p));
michael@0:         break;
michael@0:       case MMathFunction::ExpM1:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_expm1));
michael@0:         break;
michael@0:       case MMathFunction::CosH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_cosh));
michael@0:         break;
michael@0:       case MMathFunction::SinH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_sinh));
michael@0:         break;
michael@0:       case MMathFunction::TanH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_tanh));
michael@0:         break;
michael@0:       case MMathFunction::ACosH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_acosh));
michael@0:         break;
michael@0:       case MMathFunction::ASinH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_asinh));
michael@0:         break;
michael@0:       case MMathFunction::ATanH:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_atanh));
michael@0:         break;
michael@0:       case MMathFunction::Sign:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_sign));
michael@0:         break;
michael@0:       case MMathFunction::Trunc:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_trunc));
michael@0:         break;
michael@0:       case MMathFunction::Cbrt:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, MAYBE_CACHED(js::math_cbrt));
michael@0:         break;
michael@0:       case MMathFunction::Floor:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_floor_impl);
michael@0:         break;
michael@0:       case MMathFunction::Ceil:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_ceil_impl);
michael@0:         break;
michael@0:       case MMathFunction::Round:
michael@0:         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_round_impl);
michael@0:         break;
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Unknown math function");
michael@0:     }
michael@0: 
michael@0: #   undef MAYBE_CACHED
michael@0: 
michael@0:     masm.callWithABI(funptr, MoveOp::DOUBLE);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
michael@0: {
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     FloatRegister input = ToFloatRegister(ins->input());
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0: 
michael@0:     masm.setupUnalignedABICall(1, temp);
michael@0:     masm.passABIArg(input, MoveOp::FLOAT32);
michael@0: 
michael@0:     void *funptr = nullptr;
michael@0:     switch (ins->mir()->function()) {
michael@0:       case MMathFunction::Floor: funptr = JS_FUNC_TO_DATA_PTR(void *, floorf);           break;
michael@0:       case MMathFunction::Round: funptr = JS_FUNC_TO_DATA_PTR(void *, math_roundf_impl); break;
michael@0:       case MMathFunction::Ceil:  funptr = JS_FUNC_TO_DATA_PTR(void *, ceilf);            break;
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
michael@0:     }
michael@0: 
michael@0:     masm.callWithABI(funptr, MoveOp::FLOAT32);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitModD(LModD *ins)
michael@0: {
michael@0:     FloatRegister lhs = ToFloatRegister(ins->lhs());
michael@0:     FloatRegister rhs = ToFloatRegister(ins->rhs());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0: 
michael@0:     JS_ASSERT(ToFloatRegister(ins->output()) == ReturnFloatReg);
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, temp);
michael@0:     masm.passABIArg(lhs, MoveOp::DOUBLE);
michael@0:     masm.passABIArg(rhs, MoveOp::DOUBLE);
michael@0: 
michael@0:     if (gen->compilingAsmJS())
michael@0:         masm.callWithABI(AsmJSImm_ModD, MoveOp::DOUBLE);
michael@0:     else
michael@0:         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, NumberMod), MoveOp::DOUBLE);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*BinaryFn)(JSContext *, MutableHandleValue, MutableHandleValue, MutableHandleValue);
michael@0: typedef bool (*BinaryParFn)(ForkJoinContext *, HandleValue, HandleValue, MutableHandleValue);
michael@0: 
michael@0: static const VMFunction AddInfo = FunctionInfo<BinaryFn>(js::AddValues);
michael@0: static const VMFunction SubInfo = FunctionInfo<BinaryFn>(js::SubValues);
michael@0: static const VMFunction MulInfo = FunctionInfo<BinaryFn>(js::MulValues);
michael@0: static const VMFunction DivInfo = FunctionInfo<BinaryFn>(js::DivValues);
michael@0: static const VMFunction ModInfo = FunctionInfo<BinaryFn>(js::ModValues);
michael@0: static const VMFunctionsModal UrshInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BinaryFn>(js::UrshValues),
michael@0:     FunctionInfo<BinaryParFn>(UrshValuesPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBinaryV(LBinaryV *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LBinaryV::RhsInput));
michael@0:     pushArg(ToValue(lir, LBinaryV::LhsInput));
michael@0: 
michael@0:     switch (lir->jsop()) {
michael@0:       case JSOP_ADD:
michael@0:         return callVM(AddInfo, lir);
michael@0: 
michael@0:       case JSOP_SUB:
michael@0:         return callVM(SubInfo, lir);
michael@0: 
michael@0:       case JSOP_MUL:
michael@0:         return callVM(MulInfo, lir);
michael@0: 
michael@0:       case JSOP_DIV:
michael@0:         return callVM(DivInfo, lir);
michael@0: 
michael@0:       case JSOP_MOD:
michael@0:         return callVM(ModInfo, lir);
michael@0: 
michael@0:       case JSOP_URSH:
michael@0:         return callVM(UrshInfo, lir);
michael@0: 
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Unexpected binary op");
michael@0:     }
michael@0: }
michael@0: 
michael@0: typedef bool (*StringCompareFn)(JSContext *, HandleString, HandleString, bool *);
michael@0: typedef bool (*StringCompareParFn)(ForkJoinContext *, HandleString, HandleString, bool *);
michael@0: static const VMFunctionsModal StringsEqualInfo = VMFunctionsModal(
michael@0:     FunctionInfo<StringCompareFn>(jit::StringsEqual<true>),
michael@0:     FunctionInfo<StringCompareParFn>(jit::StringsEqualPar));
michael@0: static const VMFunctionsModal StringsNotEqualInfo = VMFunctionsModal(
michael@0:     FunctionInfo<StringCompareFn>(jit::StringsEqual<false>),
michael@0:     FunctionInfo<StringCompareParFn>(jit::StringsUnequalPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitCompareS(LInstruction *lir, JSOp op, Register left, Register right,
michael@0:                             Register output, Register temp)
michael@0: {
michael@0:     JS_ASSERT(lir->isCompareS() || lir->isCompareStrictS());
michael@0: 
michael@0:     OutOfLineCode *ool = nullptr;
michael@0: 
michael@0:     if (op == JSOP_EQ || op == JSOP_STRICTEQ) {
michael@0:         ool = oolCallVM(StringsEqualInfo, lir, (ArgList(), left, right),  StoreRegisterTo(output));
michael@0:     } else {
michael@0:         JS_ASSERT(op == JSOP_NE || op == JSOP_STRICTNE);
michael@0:         ool = oolCallVM(StringsNotEqualInfo, lir, (ArgList(), left, right), StoreRegisterTo(output));
michael@0:     }
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     masm.compareStrings(op, left, right, output, temp, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCompareStrictS(LCompareStrictS *lir)
michael@0: {
michael@0:     JSOp op = lir->mir()->jsop();
michael@0:     JS_ASSERT(op == JSOP_STRICTEQ || op == JSOP_STRICTNE);
michael@0: 
michael@0:     const ValueOperand leftV = ToValue(lir, LCompareStrictS::Lhs);
michael@0:     Register right = ToRegister(lir->right());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register temp = ToRegister(lir->temp());
michael@0:     Register tempToUnbox = ToTempUnboxRegister(lir->tempToUnbox());
michael@0: 
michael@0:     Label string, done;
michael@0: 
michael@0:     masm.branchTestString(Assembler::Equal, leftV, &string);
michael@0:     masm.move32(Imm32(op == JSOP_STRICTNE), output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&string);
michael@0:     Register left = masm.extractString(leftV, tempToUnbox);
michael@0:     if (!emitCompareS(lir, op, left, right, output, temp))
michael@0:         return false;
michael@0: 
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCompareS(LCompareS *lir)
michael@0: {
michael@0:     JSOp op = lir->mir()->jsop();
michael@0:     Register left = ToRegister(lir->left());
michael@0:     Register right = ToRegister(lir->right());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register temp = ToRegister(lir->temp());
michael@0: 
michael@0:     return emitCompareS(lir, op, left, right, output, temp);
michael@0: }
michael@0: 
michael@0: typedef bool (*CompareFn)(JSContext *, MutableHandleValue, MutableHandleValue, bool *);
michael@0: typedef bool (*CompareParFn)(ForkJoinContext *, MutableHandleValue, MutableHandleValue, bool *);
michael@0: static const VMFunctionsModal EqInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::LooselyEqual<true>),
michael@0:     FunctionInfo<CompareParFn>(jit::LooselyEqualPar));
michael@0: static const VMFunctionsModal NeInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::LooselyEqual<false>),
michael@0:     FunctionInfo<CompareParFn>(jit::LooselyUnequalPar));
michael@0: static const VMFunctionsModal StrictEqInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::StrictlyEqual<true>),
michael@0:     FunctionInfo<CompareParFn>(jit::StrictlyEqualPar));
michael@0: static const VMFunctionsModal StrictNeInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::StrictlyEqual<false>),
michael@0:     FunctionInfo<CompareParFn>(jit::StrictlyUnequalPar));
michael@0: static const VMFunctionsModal LtInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::LessThan),
michael@0:     FunctionInfo<CompareParFn>(jit::LessThanPar));
michael@0: static const VMFunctionsModal LeInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::LessThanOrEqual),
michael@0:     FunctionInfo<CompareParFn>(jit::LessThanOrEqualPar));
michael@0: static const VMFunctionsModal GtInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::GreaterThan),
michael@0:     FunctionInfo<CompareParFn>(jit::GreaterThanPar));
michael@0: static const VMFunctionsModal GeInfo = VMFunctionsModal(
michael@0:     FunctionInfo<CompareFn>(jit::GreaterThanOrEqual),
michael@0:     FunctionInfo<CompareParFn>(jit::GreaterThanOrEqualPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCompareVM(LCompareVM *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LBinaryV::RhsInput));
michael@0:     pushArg(ToValue(lir, LBinaryV::LhsInput));
michael@0: 
michael@0:     switch (lir->mir()->jsop()) {
michael@0:       case JSOP_EQ:
michael@0:         return callVM(EqInfo, lir);
michael@0: 
michael@0:       case JSOP_NE:
michael@0:         return callVM(NeInfo, lir);
michael@0: 
michael@0:       case JSOP_STRICTEQ:
michael@0:         return callVM(StrictEqInfo, lir);
michael@0: 
michael@0:       case JSOP_STRICTNE:
michael@0:         return callVM(StrictNeInfo, lir);
michael@0: 
michael@0:       case JSOP_LT:
michael@0:         return callVM(LtInfo, lir);
michael@0: 
michael@0:       case JSOP_LE:
michael@0:         return callVM(LeInfo, lir);
michael@0: 
michael@0:       case JSOP_GT:
michael@0:         return callVM(GtInfo, lir);
michael@0: 
michael@0:       case JSOP_GE:
michael@0:         return callVM(GeInfo, lir);
michael@0: 
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Unexpected compare op");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIsNullOrLikeUndefined(LIsNullOrLikeUndefined *lir)
michael@0: {
michael@0:     JSOp op = lir->mir()->jsop();
michael@0:     MCompare::CompareType compareType = lir->mir()->compareType();
michael@0:     JS_ASSERT(compareType == MCompare::Compare_Undefined ||
michael@0:               compareType == MCompare::Compare_Null);
michael@0: 
michael@0:     const ValueOperand value = ToValue(lir, LIsNullOrLikeUndefined::Value);
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     if (op == JSOP_EQ || op == JSOP_NE) {
michael@0:         MOZ_ASSERT(lir->mir()->lhs()->type() != MIRType_Object ||
michael@0:                    lir->mir()->operandMightEmulateUndefined(),
michael@0:                    "Operands which can't emulate undefined should have been folded");
michael@0: 
michael@0:         OutOfLineTestObjectWithLabels *ool = nullptr;
michael@0:         Maybe<Label> label1, label2;
michael@0:         Label *nullOrLikeUndefined;
michael@0:         Label *notNullOrLikeUndefined;
michael@0:         if (lir->mir()->operandMightEmulateUndefined()) {
michael@0:             ool = new(alloc()) OutOfLineTestObjectWithLabels();
michael@0:             if (!addOutOfLineCode(ool))
michael@0:                 return false;
michael@0:             nullOrLikeUndefined = ool->label1();
michael@0:             notNullOrLikeUndefined = ool->label2();
michael@0:         } else {
michael@0:             label1.construct();
michael@0:             label2.construct();
michael@0:             nullOrLikeUndefined = label1.addr();
michael@0:             notNullOrLikeUndefined = label2.addr();
michael@0:         }
michael@0: 
michael@0:         Register tag = masm.splitTagForTest(value);
michael@0: 
michael@0:         masm.branchTestNull(Assembler::Equal, tag, nullOrLikeUndefined);
michael@0:         masm.branchTestUndefined(Assembler::Equal, tag, nullOrLikeUndefined);
michael@0: 
michael@0:         if (ool) {
michael@0:             // Check whether it's a truthy object or a falsy object that emulates
michael@0:             // undefined.
michael@0:             masm.branchTestObject(Assembler::NotEqual, tag, notNullOrLikeUndefined);
michael@0: 
michael@0:             Register objreg = masm.extractObject(value, ToTempUnboxRegister(lir->tempToUnbox()));
michael@0:             branchTestObjectEmulatesUndefined(objreg, nullOrLikeUndefined, notNullOrLikeUndefined,
michael@0:                                               ToRegister(lir->temp()), ool);
michael@0:             // fall through
michael@0:         }
michael@0: 
michael@0:         Label done;
michael@0: 
michael@0:         // It's not null or undefined, and if it's an object it doesn't
michael@0:         // emulate undefined, so it's not like undefined.
michael@0:         masm.move32(Imm32(op == JSOP_NE), output);
michael@0:         masm.jump(&done);
michael@0: 
michael@0:         masm.bind(nullOrLikeUndefined);
michael@0:         masm.move32(Imm32(op == JSOP_EQ), output);
michael@0: 
michael@0:         // Both branches meet here.
michael@0:         masm.bind(&done);
michael@0:         return true;
michael@0:     }
michael@0: 
michael@0:     JS_ASSERT(op == JSOP_STRICTEQ || op == JSOP_STRICTNE);
michael@0: 
michael@0:     Assembler::Condition cond = JSOpToCondition(compareType, op);
michael@0:     if (compareType == MCompare::Compare_Null)
michael@0:         masm.testNullSet(cond, value, output);
michael@0:     else
michael@0:         masm.testUndefinedSet(cond, value, output);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIsNullOrLikeUndefinedAndBranch(LIsNullOrLikeUndefinedAndBranch *lir)
michael@0: {
michael@0:     JSOp op = lir->cmpMir()->jsop();
michael@0:     MCompare::CompareType compareType = lir->cmpMir()->compareType();
michael@0:     JS_ASSERT(compareType == MCompare::Compare_Undefined ||
michael@0:               compareType == MCompare::Compare_Null);
michael@0: 
michael@0:     const ValueOperand value = ToValue(lir, LIsNullOrLikeUndefinedAndBranch::Value);
michael@0: 
michael@0:     if (op == JSOP_EQ || op == JSOP_NE) {
michael@0:         MBasicBlock *ifTrue;
michael@0:         MBasicBlock *ifFalse;
michael@0: 
michael@0:         if (op == JSOP_EQ) {
michael@0:             ifTrue = lir->ifTrue();
michael@0:             ifFalse = lir->ifFalse();
michael@0:         } else {
michael@0:             // Swap branches.
michael@0:             ifTrue = lir->ifFalse();
michael@0:             ifFalse = lir->ifTrue();
michael@0:             op = JSOP_EQ;
michael@0:         }
michael@0: 
michael@0:         MOZ_ASSERT(lir->cmpMir()->lhs()->type() != MIRType_Object ||
michael@0:                    lir->cmpMir()->operandMightEmulateUndefined(),
michael@0:                    "Operands which can't emulate undefined should have been folded");
michael@0: 
michael@0:         OutOfLineTestObject *ool = nullptr;
michael@0:         if (lir->cmpMir()->operandMightEmulateUndefined()) {
michael@0:             ool = new(alloc()) OutOfLineTestObject();
michael@0:             if (!addOutOfLineCode(ool))
michael@0:                 return false;
michael@0:         }
michael@0: 
michael@0:         Register tag = masm.splitTagForTest(value);
michael@0: 
michael@0:         Label *ifTrueLabel = getJumpLabelForBranch(ifTrue);
michael@0:         Label *ifFalseLabel = getJumpLabelForBranch(ifFalse);
michael@0: 
michael@0:         masm.branchTestNull(Assembler::Equal, tag, ifTrueLabel);
michael@0:         masm.branchTestUndefined(Assembler::Equal, tag, ifTrueLabel);
michael@0: 
michael@0:         if (ool) {
michael@0:             masm.branchTestObject(Assembler::NotEqual, tag, ifFalseLabel);
michael@0: 
michael@0:             // Objects that emulate undefined are loosely equal to null/undefined.
michael@0:             Register objreg = masm.extractObject(value, ToTempUnboxRegister(lir->tempToUnbox()));
michael@0:             Register scratch = ToRegister(lir->temp());
michael@0:             testObjectEmulatesUndefined(objreg, ifTrueLabel, ifFalseLabel, scratch, ool);
michael@0:         } else {
michael@0:             masm.jump(ifFalseLabel);
michael@0:         }
michael@0:         return true;
michael@0:     }
michael@0: 
michael@0:     JS_ASSERT(op == JSOP_STRICTEQ || op == JSOP_STRICTNE);
michael@0: 
michael@0:     Assembler::Condition cond = JSOpToCondition(compareType, op);
michael@0:     if (compareType == MCompare::Compare_Null)
michael@0:         testNullEmitBranch(cond, value, lir->ifTrue(), lir->ifFalse());
michael@0:     else
michael@0:         testUndefinedEmitBranch(cond, value, lir->ifTrue(), lir->ifFalse());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitEmulatesUndefined(LEmulatesUndefined *lir)
michael@0: {
michael@0:     MOZ_ASSERT(lir->mir()->compareType() == MCompare::Compare_Undefined ||
michael@0:                lir->mir()->compareType() == MCompare::Compare_Null);
michael@0:     MOZ_ASSERT(lir->mir()->lhs()->type() == MIRType_Object);
michael@0:     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
michael@0:                "If the object couldn't emulate undefined, this should have been folded.");
michael@0: 
michael@0:     JSOp op = lir->mir()->jsop();
michael@0:     MOZ_ASSERT(op == JSOP_EQ || op == JSOP_NE, "Strict equality should have been folded");
michael@0: 
michael@0:     OutOfLineTestObjectWithLabels *ool = new(alloc()) OutOfLineTestObjectWithLabels();
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Label *emulatesUndefined = ool->label1();
michael@0:     Label *doesntEmulateUndefined = ool->label2();
michael@0: 
michael@0:     Register objreg = ToRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     branchTestObjectEmulatesUndefined(objreg, emulatesUndefined, doesntEmulateUndefined,
michael@0:                                       output, ool);
michael@0: 
michael@0:     Label done;
michael@0: 
michael@0:     masm.move32(Imm32(op == JSOP_NE), output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(emulatesUndefined);
michael@0:     masm.move32(Imm32(op == JSOP_EQ), output);
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitEmulatesUndefinedAndBranch(LEmulatesUndefinedAndBranch *lir)
michael@0: {
michael@0:     MOZ_ASSERT(lir->cmpMir()->compareType() == MCompare::Compare_Undefined ||
michael@0:                lir->cmpMir()->compareType() == MCompare::Compare_Null);
michael@0:     MOZ_ASSERT(lir->cmpMir()->operandMightEmulateUndefined(),
michael@0:                "Operands which can't emulate undefined should have been folded");
michael@0: 
michael@0:     JSOp op = lir->cmpMir()->jsop();
michael@0:     MOZ_ASSERT(op == JSOP_EQ || op == JSOP_NE, "Strict equality should have been folded");
michael@0: 
michael@0:     OutOfLineTestObject *ool = new(alloc()) OutOfLineTestObject();
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Label *equal;
michael@0:     Label *unequal;
michael@0: 
michael@0:     {
michael@0:         MBasicBlock *ifTrue;
michael@0:         MBasicBlock *ifFalse;
michael@0: 
michael@0:         if (op == JSOP_EQ) {
michael@0:             ifTrue = lir->ifTrue();
michael@0:             ifFalse = lir->ifFalse();
michael@0:         } else {
michael@0:             // Swap branches.
michael@0:             ifTrue = lir->ifFalse();
michael@0:             ifFalse = lir->ifTrue();
michael@0:             op = JSOP_EQ;
michael@0:         }
michael@0: 
michael@0:         equal = getJumpLabelForBranch(ifTrue);
michael@0:         unequal = getJumpLabelForBranch(ifFalse);
michael@0:     }
michael@0: 
michael@0:     Register objreg = ToRegister(lir->input());
michael@0: 
michael@0:     testObjectEmulatesUndefined(objreg, equal, unequal, ToRegister(lir->temp()), ool);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSString *(*ConcatStringsFn)(ThreadSafeContext *, HandleString, HandleString);
michael@0: typedef JSString *(*ConcatStringsParFn)(ForkJoinContext *, HandleString, HandleString);
michael@0: static const VMFunctionsModal ConcatStringsInfo = VMFunctionsModal(
michael@0:     FunctionInfo<ConcatStringsFn>(ConcatStrings<CanGC>),
michael@0:     FunctionInfo<ConcatStringsParFn>(ConcatStringsPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitConcat(LInstruction *lir, Register lhs, Register rhs, Register output)
michael@0: {
michael@0:     OutOfLineCode *ool = oolCallVM(ConcatStringsInfo, lir, (ArgList(), lhs, rhs),
michael@0:                                    StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     ExecutionMode mode = gen->info().executionMode();
michael@0:     JitCode *stringConcatStub = gen->compartment->jitCompartment()->stringConcatStub(mode);
michael@0:     masm.call(stringConcatStub);
michael@0:     masm.branchTestPtr(Assembler::Zero, output, output, ool->entry());
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitConcat(LConcat *lir)
michael@0: {
michael@0:     Register lhs = ToRegister(lir->lhs());
michael@0:     Register rhs = ToRegister(lir->rhs());
michael@0: 
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     JS_ASSERT(lhs == CallTempReg0);
michael@0:     JS_ASSERT(rhs == CallTempReg1);
michael@0:     JS_ASSERT(ToRegister(lir->temp1()) == CallTempReg0);
michael@0:     JS_ASSERT(ToRegister(lir->temp2()) == CallTempReg1);
michael@0:     JS_ASSERT(ToRegister(lir->temp3()) == CallTempReg2);
michael@0:     JS_ASSERT(ToRegister(lir->temp4()) == CallTempReg3);
michael@0:     JS_ASSERT(ToRegister(lir->temp5()) == CallTempReg4);
michael@0:     JS_ASSERT(output == CallTempReg5);
michael@0: 
michael@0:     return emitConcat(lir, lhs, rhs, output);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitConcatPar(LConcatPar *lir)
michael@0: {
michael@0:     DebugOnly<Register> cx = ToRegister(lir->forkJoinContext());
michael@0:     Register lhs = ToRegister(lir->lhs());
michael@0:     Register rhs = ToRegister(lir->rhs());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     JS_ASSERT(lhs == CallTempReg0);
michael@0:     JS_ASSERT(rhs == CallTempReg1);
michael@0:     JS_ASSERT((Register)cx == CallTempReg4);
michael@0:     JS_ASSERT(ToRegister(lir->temp1()) == CallTempReg0);
michael@0:     JS_ASSERT(ToRegister(lir->temp2()) == CallTempReg1);
michael@0:     JS_ASSERT(ToRegister(lir->temp3()) == CallTempReg2);
michael@0:     JS_ASSERT(ToRegister(lir->temp4()) == CallTempReg3);
michael@0:     JS_ASSERT(output == CallTempReg5);
michael@0: 
michael@0:     return emitConcat(lir, lhs, rhs, output);
michael@0: }
michael@0: 
michael@0: static void
michael@0: CopyStringChars(MacroAssembler &masm, Register to, Register from, Register len, Register scratch)
michael@0: {
michael@0:     // Copy |len| jschars from |from| to |to|. Assumes len > 0 (checked below in
michael@0:     // debug builds), and when done |to| must point to the next available char.
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     Label ok;
michael@0:     masm.branch32(Assembler::GreaterThan, len, Imm32(0), &ok);
michael@0:     masm.assumeUnreachable("Length should be greater than 0.");
michael@0:     masm.bind(&ok);
michael@0: #endif
michael@0: 
michael@0:     JS_STATIC_ASSERT(sizeof(jschar) == 2);
michael@0: 
michael@0:     Label start;
michael@0:     masm.bind(&start);
michael@0:     masm.load16ZeroExtend(Address(from, 0), scratch);
michael@0:     masm.store16(scratch, Address(to, 0));
michael@0:     masm.addPtr(Imm32(2), from);
michael@0:     masm.addPtr(Imm32(2), to);
michael@0:     masm.branchSub32(Assembler::NonZero, Imm32(1), len, &start);
michael@0: }
michael@0: 
michael@0: JitCode *
michael@0: JitCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
michael@0: {
michael@0:     MacroAssembler masm(cx);
michael@0: 
michael@0:     Register lhs = CallTempReg0;
michael@0:     Register rhs = CallTempReg1;
michael@0:     Register temp1 = CallTempReg2;
michael@0:     Register temp2 = CallTempReg3;
michael@0:     Register temp3 = CallTempReg4;
michael@0:     Register output = CallTempReg5;
michael@0: 
michael@0:     // In parallel execution, we pass in the ForkJoinContext in CallTempReg4, as
michael@0:     // by the time we need to use the temp3 we no longer have need of the
michael@0:     // cx.
michael@0:     Register forkJoinContext = CallTempReg4;
michael@0: 
michael@0:     Label failure, failurePopTemps;
michael@0: 
michael@0:     // If lhs is empty, return rhs.
michael@0:     Label leftEmpty;
michael@0:     masm.loadStringLength(lhs, temp1);
michael@0:     masm.branchTest32(Assembler::Zero, temp1, temp1, &leftEmpty);
michael@0: 
michael@0:     // If rhs is empty, return lhs.
michael@0:     Label rightEmpty;
michael@0:     masm.loadStringLength(rhs, temp2);
michael@0:     masm.branchTest32(Assembler::Zero, temp2, temp2, &rightEmpty);
michael@0: 
michael@0:     masm.add32(temp1, temp2);
michael@0: 
michael@0:     // Check if we can use a JSFatInlineString.
michael@0:     Label isFatInline;
michael@0:     masm.branch32(Assembler::BelowOrEqual, temp2, Imm32(JSFatInlineString::MAX_FAT_INLINE_LENGTH),
michael@0:                   &isFatInline);
michael@0: 
michael@0:     // Ensure result length <= JSString::MAX_LENGTH.
michael@0:     masm.branch32(Assembler::Above, temp2, Imm32(JSString::MAX_LENGTH), &failure);
michael@0: 
michael@0:     // Allocate a new rope.
michael@0:     switch (mode) {
michael@0:       case SequentialExecution:
michael@0:         masm.newGCString(output, temp3, &failure);
michael@0:         break;
michael@0:       case ParallelExecution:
michael@0:         masm.push(temp1);
michael@0:         masm.push(temp2);
michael@0:         masm.newGCStringPar(output, forkJoinContext, temp1, temp2, &failurePopTemps);
michael@0:         masm.pop(temp2);
michael@0:         masm.pop(temp1);
michael@0:         break;
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     // Store lengthAndFlags.
michael@0:     JS_STATIC_ASSERT(JSString::ROPE_FLAGS == 0);
michael@0:     masm.lshiftPtr(Imm32(JSString::LENGTH_SHIFT), temp2);
michael@0:     masm.storePtr(temp2, Address(output, JSString::offsetOfLengthAndFlags()));
michael@0: 
michael@0:     // Store left and right nodes.
michael@0:     masm.storePtr(lhs, Address(output, JSRope::offsetOfLeft()));
michael@0:     masm.storePtr(rhs, Address(output, JSRope::offsetOfRight()));
michael@0:     masm.ret();
michael@0: 
michael@0:     masm.bind(&leftEmpty);
michael@0:     masm.mov(rhs, output);
michael@0:     masm.ret();
michael@0: 
michael@0:     masm.bind(&rightEmpty);
michael@0:     masm.mov(lhs, output);
michael@0:     masm.ret();
michael@0: 
michael@0:     masm.bind(&isFatInline);
michael@0: 
michael@0:     // State: lhs length in temp1, result length in temp2.
michael@0: 
michael@0:     // Ensure both strings are linear (flags != 0).
michael@0:     JS_STATIC_ASSERT(JSString::ROPE_FLAGS == 0);
michael@0:     masm.branchTestPtr(Assembler::Zero, Address(lhs, JSString::offsetOfLengthAndFlags()),
michael@0:                        Imm32(JSString::FLAGS_MASK), &failure);
michael@0:     masm.branchTestPtr(Assembler::Zero, Address(rhs, JSString::offsetOfLengthAndFlags()),
michael@0:                        Imm32(JSString::FLAGS_MASK), &failure);
michael@0: 
michael@0:     // Allocate a JSFatInlineString.
michael@0:     switch (mode) {
michael@0:       case SequentialExecution:
michael@0:         masm.newGCFatInlineString(output, temp3, &failure);
michael@0:         break;
michael@0:       case ParallelExecution:
michael@0:         masm.push(temp1);
michael@0:         masm.push(temp2);
michael@0:         masm.newGCFatInlineStringPar(output, forkJoinContext, temp1, temp2, &failurePopTemps);
michael@0:         masm.pop(temp2);
michael@0:         masm.pop(temp1);
michael@0:         break;
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     // Set lengthAndFlags.
michael@0:     masm.lshiftPtr(Imm32(JSString::LENGTH_SHIFT), temp2);
michael@0:     masm.orPtr(Imm32(JSString::FIXED_FLAGS), temp2);
michael@0:     masm.storePtr(temp2, Address(output, JSString::offsetOfLengthAndFlags()));
michael@0: 
michael@0:     // Set chars pointer, keep in temp2 for copy loop below.
michael@0:     masm.computeEffectiveAddress(Address(output, JSFatInlineString::offsetOfInlineStorage()), temp2);
michael@0:     masm.storePtr(temp2, Address(output, JSFatInlineString::offsetOfChars()));
michael@0: 
michael@0:     {
michael@0:         // We use temp3 in this block, which in parallel execution also holds
michael@0:         // a live ForkJoinContext pointer. If we are compiling for parallel
michael@0:         // execution, be sure to save and restore the ForkJoinContext.
michael@0:         if (mode == ParallelExecution)
michael@0:             masm.push(temp3);
michael@0: 
michael@0:         // Copy lhs chars. Temp1 still holds the lhs length. Note that this
michael@0:         // advances temp2 to point to the next char. Note that this also
michael@0:         // repurposes the lhs register.
michael@0:         masm.loadPtr(Address(lhs, JSString::offsetOfChars()), lhs);
michael@0:         CopyStringChars(masm, temp2, lhs, temp1, temp3);
michael@0: 
michael@0:         // Copy rhs chars.
michael@0:         masm.loadStringLength(rhs, temp1);
michael@0:         masm.loadPtr(Address(rhs, JSString::offsetOfChars()), rhs);
michael@0:         CopyStringChars(masm, temp2, rhs, temp1, temp3);
michael@0: 
michael@0:         if (mode == ParallelExecution)
michael@0:             masm.pop(temp3);
michael@0:     }
michael@0: 
michael@0:     // Null-terminate.
michael@0:     masm.store16(Imm32(0), Address(temp2, 0));
michael@0:     masm.ret();
michael@0: 
michael@0:     masm.bind(&failurePopTemps);
michael@0:     masm.pop(temp2);
michael@0:     masm.pop(temp1);
michael@0: 
michael@0:     masm.bind(&failure);
michael@0:     masm.movePtr(ImmPtr(nullptr), output);
michael@0:     masm.ret();
michael@0: 
michael@0:     Linker linker(masm);
michael@0:     AutoFlushICache afc("StringConcatStub");
michael@0:     JitCode *code = linker.newCode<CanGC>(cx, JSC::OTHER_CODE);
michael@0: 
michael@0: #ifdef JS_ION_PERF
michael@0:     writePerfSpewerJitCodeProfile(code, "StringConcatStub");
michael@0: #endif
michael@0: 
michael@0:     return code;
michael@0: }
michael@0: 
michael@0: typedef bool (*CharCodeAtFn)(JSContext *, HandleString, int32_t, uint32_t *);
michael@0: static const VMFunction CharCodeAtInfo = FunctionInfo<CharCodeAtFn>(jit::CharCodeAt);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCharCodeAt(LCharCodeAt *lir)
michael@0: {
michael@0:     Register str = ToRegister(lir->str());
michael@0:     Register index = ToRegister(lir->index());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(CharCodeAtInfo, lir, (ArgList(), str, index), StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     Address lengthAndFlagsAddr(str, JSString::offsetOfLengthAndFlags());
michael@0:     masm.branchTest32(Assembler::Zero, lengthAndFlagsAddr, Imm32(JSString::FLAGS_MASK), ool->entry());
michael@0: 
michael@0:     // getChars
michael@0:     Address charsAddr(str, JSString::offsetOfChars());
michael@0:     masm.loadPtr(charsAddr, output);
michael@0:     masm.load16ZeroExtend(BaseIndex(output, index, TimesTwo, 0), output);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSFlatString *(*StringFromCharCodeFn)(JSContext *, int32_t);
michael@0: static const VMFunction StringFromCharCodeInfo = FunctionInfo<StringFromCharCodeFn>(jit::StringFromCharCode);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitFromCharCode(LFromCharCode *lir)
michael@0: {
michael@0:     Register code = ToRegister(lir->code());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(StringFromCharCodeInfo, lir, (ArgList(), code), StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     // OOL path if code >= UNIT_STATIC_LIMIT.
michael@0:     masm.branch32(Assembler::AboveOrEqual, code, Imm32(StaticStrings::UNIT_STATIC_LIMIT),
michael@0:                   ool->entry());
michael@0: 
michael@0:     masm.movePtr(ImmPtr(&GetIonContext()->runtime->staticStrings().unitStaticTable), output);
michael@0:     masm.loadPtr(BaseIndex(output, code, ScalePointer), output);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*StringSplitFn)(JSContext *, HandleTypeObject, HandleString, HandleString);
michael@0: static const VMFunction StringSplitInfo = FunctionInfo<StringSplitFn>(js::str_split_string);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStringSplit(LStringSplit *lir)
michael@0: {
michael@0:     pushArg(ToRegister(lir->separator()));
michael@0:     pushArg(ToRegister(lir->string()));
michael@0:     pushArg(ImmGCPtr(lir->mir()->typeObject()));
michael@0: 
michael@0:     return callVM(StringSplitInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInitializedLength(LInitializedLength *lir)
michael@0: {
michael@0:     Address initLength(ToRegister(lir->elements()), ObjectElements::offsetOfInitializedLength());
michael@0:     masm.load32(initLength, ToRegister(lir->output()));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetInitializedLength(LSetInitializedLength *lir)
michael@0: {
michael@0:     Address initLength(ToRegister(lir->elements()), ObjectElements::offsetOfInitializedLength());
michael@0:     Int32Key index = ToInt32Key(lir->index());
michael@0: 
michael@0:     masm.bumpKey(&index, 1);
michael@0:     masm.storeKey(index, initLength);
michael@0:     // Restore register value if it is used/captured after.
michael@0:     masm.bumpKey(&index, -1);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNotO(LNotO *lir)
michael@0: {
michael@0:     MOZ_ASSERT(lir->mir()->operandMightEmulateUndefined(),
michael@0:                "This should be constant-folded if the object can't emulate undefined.");
michael@0: 
michael@0:     OutOfLineTestObjectWithLabels *ool = new(alloc()) OutOfLineTestObjectWithLabels();
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Label *ifEmulatesUndefined = ool->label1();
michael@0:     Label *ifDoesntEmulateUndefined = ool->label2();
michael@0: 
michael@0:     Register objreg = ToRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     branchTestObjectEmulatesUndefined(objreg, ifEmulatesUndefined, ifDoesntEmulateUndefined,
michael@0:                                       output, ool);
michael@0:     // fall through
michael@0: 
michael@0:     Label join;
michael@0: 
michael@0:     masm.move32(Imm32(0), output);
michael@0:     masm.jump(&join);
michael@0: 
michael@0:     masm.bind(ifEmulatesUndefined);
michael@0:     masm.move32(Imm32(1), output);
michael@0: 
michael@0:     masm.bind(&join);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNotV(LNotV *lir)
michael@0: {
michael@0:     Maybe<Label> ifTruthyLabel, ifFalsyLabel;
michael@0:     Label *ifTruthy;
michael@0:     Label *ifFalsy;
michael@0: 
michael@0:     OutOfLineTestObjectWithLabels *ool = nullptr;
michael@0:     if (lir->mir()->operandMightEmulateUndefined()) {
michael@0:         ool = new(alloc()) OutOfLineTestObjectWithLabels();
michael@0:         if (!addOutOfLineCode(ool))
michael@0:             return false;
michael@0:         ifTruthy = ool->label1();
michael@0:         ifFalsy = ool->label2();
michael@0:     } else {
michael@0:         ifTruthyLabel.construct();
michael@0:         ifFalsyLabel.construct();
michael@0:         ifTruthy = ifTruthyLabel.addr();
michael@0:         ifFalsy = ifFalsyLabel.addr();
michael@0:     }
michael@0: 
michael@0:     testValueTruthyKernel(ToValue(lir, LNotV::Input), lir->temp1(), lir->temp2(),
michael@0:                           ToFloatRegister(lir->tempFloat()),
michael@0:                           ifTruthy, ifFalsy, ool);
michael@0: 
michael@0:     Label join;
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     // Note that the testValueTruthyKernel call above may choose to fall through
michael@0:     // to ifTruthy instead of branching there.
michael@0:     masm.bind(ifTruthy);
michael@0:     masm.move32(Imm32(0), output);
michael@0:     masm.jump(&join);
michael@0: 
michael@0:     masm.bind(ifFalsy);
michael@0:     masm.move32(Imm32(1), output);
michael@0: 
michael@0:     // both branches meet here.
michael@0:     masm.bind(&join);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBoundsCheck(LBoundsCheck *lir)
michael@0: {
michael@0:     if (lir->index()->isConstant()) {
michael@0:         // Use uint32 so that the comparison is unsigned.
michael@0:         uint32_t index = ToInt32(lir->index());
michael@0:         if (lir->length()->isConstant()) {
michael@0:             uint32_t length = ToInt32(lir->length());
michael@0:             if (index < length)
michael@0:                 return true;
michael@0:             return bailout(lir->snapshot());
michael@0:         }
michael@0:         return bailoutCmp32(Assembler::BelowOrEqual, ToOperand(lir->length()), Imm32(index),
michael@0:                             lir->snapshot());
michael@0:     }
michael@0:     if (lir->length()->isConstant()) {
michael@0:         return bailoutCmp32(Assembler::AboveOrEqual, ToRegister(lir->index()),
michael@0:                              Imm32(ToInt32(lir->length())), lir->snapshot());
michael@0:     }
michael@0:     return bailoutCmp32(Assembler::BelowOrEqual, ToOperand(lir->length()),
michael@0:                         ToRegister(lir->index()), lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBoundsCheckRange(LBoundsCheckRange *lir)
michael@0: {
michael@0:     int32_t min = lir->mir()->minimum();
michael@0:     int32_t max = lir->mir()->maximum();
michael@0:     JS_ASSERT(max >= min);
michael@0: 
michael@0:     Register temp = ToRegister(lir->getTemp(0));
michael@0:     if (lir->index()->isConstant()) {
michael@0:         int32_t nmin, nmax;
michael@0:         int32_t index = ToInt32(lir->index());
michael@0:         if (SafeAdd(index, min, &nmin) && SafeAdd(index, max, &nmax) && nmin >= 0) {
michael@0:             return bailoutCmp32(Assembler::BelowOrEqual, ToOperand(lir->length()), Imm32(nmax),
michael@0:                                 lir->snapshot());
michael@0:         }
michael@0:         masm.mov(ImmWord(index), temp);
michael@0:     } else {
michael@0:         masm.mov(ToRegister(lir->index()), temp);
michael@0:     }
michael@0: 
michael@0:     // If the minimum and maximum differ then do an underflow check first.
michael@0:     // If the two are the same then doing an unsigned comparison on the
michael@0:     // length will also catch a negative index.
michael@0:     if (min != max) {
michael@0:         if (min != 0) {
michael@0:             Label bail;
michael@0:             masm.branchAdd32(Assembler::Overflow, Imm32(min), temp, &bail);
michael@0:             if (!bailoutFrom(&bail, lir->snapshot()))
michael@0:                 return false;
michael@0:         }
michael@0: 
michael@0:         if (!bailoutCmp32(Assembler::LessThan, temp, Imm32(0), lir->snapshot()))
michael@0:             return false;
michael@0: 
michael@0:         if (min != 0) {
michael@0:             int32_t diff;
michael@0:             if (SafeSub(max, min, &diff))
michael@0:                 max = diff;
michael@0:             else
michael@0:                 masm.sub32(Imm32(min), temp);
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     // Compute the maximum possible index. No overflow check is needed when
michael@0:     // max > 0. We can only wraparound to a negative number, which will test as
michael@0:     // larger than all nonnegative numbers in the unsigned comparison, and the
michael@0:     // length is required to be nonnegative (else testing a negative length
michael@0:     // would succeed on any nonnegative index).
michael@0:     if (max != 0) {
michael@0:         if (max < 0) {
michael@0:             Label bail;
michael@0:             masm.branchAdd32(Assembler::Overflow, Imm32(max), temp, &bail);
michael@0:             if (!bailoutFrom(&bail, lir->snapshot()))
michael@0:                 return false;
michael@0:         } else {
michael@0:             masm.add32(Imm32(max), temp);
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     return bailoutCmp32(Assembler::BelowOrEqual, ToOperand(lir->length()), temp, lir->snapshot());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBoundsCheckLower(LBoundsCheckLower *lir)
michael@0: {
michael@0:     int32_t min = lir->mir()->minimum();
michael@0:     return bailoutCmp32(Assembler::LessThan, ToRegister(lir->index()), Imm32(min),
michael@0:                         lir->snapshot());
michael@0: }
michael@0: 
michael@0: class OutOfLineStoreElementHole : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LInstruction *ins_;
michael@0:     Label rejoinStore_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineStoreElementHole(LInstruction *ins)
michael@0:       : ins_(ins)
michael@0:     {
michael@0:         JS_ASSERT(ins->isStoreElementHoleV() || ins->isStoreElementHoleT());
michael@0:     }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineStoreElementHole(this);
michael@0:     }
michael@0:     LInstruction *ins() const {
michael@0:         return ins_;
michael@0:     }
michael@0:     Label *rejoinStore() {
michael@0:         return &rejoinStore_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitStoreHoleCheck(Register elements, const LAllocation *index, LSnapshot *snapshot)
michael@0: {
michael@0:     Label bail;
michael@0:     if (index->isConstant()) {
michael@0:         masm.branchTestMagic(Assembler::Equal,
michael@0:                              Address(elements, ToInt32(index) * sizeof(js::Value)), &bail);
michael@0:     } else {
michael@0:         masm.branchTestMagic(Assembler::Equal,
michael@0:                              BaseIndex(elements, ToRegister(index), TimesEight), &bail);
michael@0:     }
michael@0:     return bailoutFrom(&bail, snapshot);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreElementT(LStoreElementT *store)
michael@0: {
michael@0:     Register elements = ToRegister(store->elements());
michael@0:     const LAllocation *index = store->index();
michael@0: 
michael@0:     if (store->mir()->needsBarrier())
michael@0:        emitPreBarrier(elements, index, store->mir()->elementType());
michael@0: 
michael@0:     if (store->mir()->needsHoleCheck() && !emitStoreHoleCheck(elements, index, store->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     storeElementTyped(store->value(), store->mir()->value()->type(), store->mir()->elementType(),
michael@0:                       elements, index);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreElementV(LStoreElementV *lir)
michael@0: {
michael@0:     const ValueOperand value = ToValue(lir, LStoreElementV::Value);
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     const LAllocation *index = lir->index();
michael@0: 
michael@0:     if (lir->mir()->needsBarrier())
michael@0:         emitPreBarrier(elements, index, MIRType_Value);
michael@0: 
michael@0:     if (lir->mir()->needsHoleCheck() && !emitStoreHoleCheck(elements, index, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     if (lir->index()->isConstant())
michael@0:         masm.storeValue(value, Address(elements, ToInt32(lir->index()) * sizeof(js::Value)));
michael@0:     else
michael@0:         masm.storeValue(value, BaseIndex(elements, ToRegister(lir->index()), TimesEight));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT *lir)
michael@0: {
michael@0:     OutOfLineStoreElementHole *ool = new(alloc()) OutOfLineStoreElementHole(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     const LAllocation *index = lir->index();
michael@0: 
michael@0:     // OOL path if index >= initializedLength.
michael@0:     Address initLength(elements, ObjectElements::offsetOfInitializedLength());
michael@0:     masm.branchKey(Assembler::BelowOrEqual, initLength, ToInt32Key(index), ool->entry());
michael@0: 
michael@0:     if (lir->mir()->needsBarrier())
michael@0:         emitPreBarrier(elements, index, lir->mir()->elementType());
michael@0: 
michael@0:     masm.bind(ool->rejoinStore());
michael@0:     storeElementTyped(lir->value(), lir->mir()->value()->type(), lir->mir()->elementType(),
michael@0:                       elements, index);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreElementHoleV(LStoreElementHoleV *lir)
michael@0: {
michael@0:     OutOfLineStoreElementHole *ool = new(alloc()) OutOfLineStoreElementHole(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     const LAllocation *index = lir->index();
michael@0:     const ValueOperand value = ToValue(lir, LStoreElementHoleV::Value);
michael@0: 
michael@0:     // OOL path if index >= initializedLength.
michael@0:     Address initLength(elements, ObjectElements::offsetOfInitializedLength());
michael@0:     masm.branchKey(Assembler::BelowOrEqual, initLength, ToInt32Key(index), ool->entry());
michael@0: 
michael@0:     if (lir->mir()->needsBarrier())
michael@0:         emitPreBarrier(elements, index, lir->mir()->elementType());
michael@0: 
michael@0:     masm.bind(ool->rejoinStore());
michael@0:     if (lir->index()->isConstant())
michael@0:         masm.storeValue(value, Address(elements, ToInt32(lir->index()) * sizeof(js::Value)));
michael@0:     else
michael@0:         masm.storeValue(value, BaseIndex(elements, ToRegister(lir->index()), TimesEight));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*SetDenseElementFn)(JSContext *, HandleObject, int32_t, HandleValue,
michael@0:                                   bool strict);
michael@0: typedef bool (*SetDenseElementParFn)(ForkJoinContext *, HandleObject, int32_t, HandleValue, bool);
michael@0: static const VMFunctionsModal SetDenseElementInfo = VMFunctionsModal(
michael@0:     FunctionInfo<SetDenseElementFn>(SetDenseElement),
michael@0:     FunctionInfo<SetDenseElementParFn>(SetDenseElementPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole *ool)
michael@0: {
michael@0:     Register object, elements;
michael@0:     LInstruction *ins = ool->ins();
michael@0:     const LAllocation *index;
michael@0:     MIRType valueType;
michael@0:     ConstantOrRegister value;
michael@0: 
michael@0:     if (ins->isStoreElementHoleV()) {
michael@0:         LStoreElementHoleV *store = ins->toStoreElementHoleV();
michael@0:         object = ToRegister(store->object());
michael@0:         elements = ToRegister(store->elements());
michael@0:         index = store->index();
michael@0:         valueType = store->mir()->value()->type();
michael@0:         value = TypedOrValueRegister(ToValue(store, LStoreElementHoleV::Value));
michael@0:     } else {
michael@0:         LStoreElementHoleT *store = ins->toStoreElementHoleT();
michael@0:         object = ToRegister(store->object());
michael@0:         elements = ToRegister(store->elements());
michael@0:         index = store->index();
michael@0:         valueType = store->mir()->value()->type();
michael@0:         if (store->value()->isConstant())
michael@0:             value = ConstantOrRegister(*store->value()->toConstant());
michael@0:         else
michael@0:             value = TypedOrValueRegister(valueType, ToAnyRegister(store->value()));
michael@0:     }
michael@0: 
michael@0:     // If index == initializedLength, try to bump the initialized length inline.
michael@0:     // If index > initializedLength, call a stub. Note that this relies on the
michael@0:     // condition flags sticking from the incoming branch.
michael@0:     Label callStub;
michael@0: #ifdef JS_CODEGEN_MIPS
michael@0:     // Had to reimplement for MIPS because there are no flags.
michael@0:     Address initLength(elements, ObjectElements::offsetOfInitializedLength());
michael@0:     masm.branchKey(Assembler::NotEqual, initLength, ToInt32Key(index), &callStub);
michael@0: #else
michael@0:     masm.j(Assembler::NotEqual, &callStub);
michael@0: #endif
michael@0: 
michael@0:     Int32Key key = ToInt32Key(index);
michael@0: 
michael@0:     // Check array capacity.
michael@0:     masm.branchKey(Assembler::BelowOrEqual, Address(elements, ObjectElements::offsetOfCapacity()),
michael@0:                    key, &callStub);
michael@0: 
michael@0:     // Update initialized length. The capacity guard above ensures this won't overflow,
michael@0:     // due to NELEMENTS_LIMIT.
michael@0:     masm.bumpKey(&key, 1);
michael@0:     masm.storeKey(key, Address(elements, ObjectElements::offsetOfInitializedLength()));
michael@0: 
michael@0:     // Update length if length < initializedLength.
michael@0:     Label dontUpdate;
michael@0:     masm.branchKey(Assembler::AboveOrEqual, Address(elements, ObjectElements::offsetOfLength()),
michael@0:                    key, &dontUpdate);
michael@0:     masm.storeKey(key, Address(elements, ObjectElements::offsetOfLength()));
michael@0:     masm.bind(&dontUpdate);
michael@0: 
michael@0:     masm.bumpKey(&key, -1);
michael@0: 
michael@0:     if (ins->isStoreElementHoleT() && valueType != MIRType_Double) {
michael@0:         // The inline path for StoreElementHoleT does not always store the type tag,
michael@0:         // so we do the store on the OOL path. We use MIRType_None for the element type
michael@0:         // so that storeElementTyped will always store the type tag.
michael@0:         storeElementTyped(ins->toStoreElementHoleT()->value(), valueType, MIRType_None, elements,
michael@0:                           index);
michael@0:         masm.jump(ool->rejoin());
michael@0:     } else {
michael@0:         // Jump to the inline path where we will store the value.
michael@0:         masm.jump(ool->rejoinStore());
michael@0:     }
michael@0: 
michael@0:     masm.bind(&callStub);
michael@0:     saveLive(ins);
michael@0: 
michael@0:     pushArg(Imm32(current->mir()->strict()));
michael@0:     pushArg(value);
michael@0:     if (index->isConstant())
michael@0:         pushArg(Imm32(ToInt32(index)));
michael@0:     else
michael@0:         pushArg(ToRegister(index));
michael@0:     pushArg(object);
michael@0:     if (!callVM(SetDenseElementInfo, ins))
michael@0:         return false;
michael@0: 
michael@0:     restoreLive(ins);
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*ArrayPopShiftFn)(JSContext *, HandleObject, MutableHandleValue);
michael@0: static const VMFunction ArrayPopDenseInfo = FunctionInfo<ArrayPopShiftFn>(jit::ArrayPopDense);
michael@0: static const VMFunction ArrayShiftDenseInfo = FunctionInfo<ArrayPopShiftFn>(jit::ArrayShiftDense);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitArrayPopShift(LInstruction *lir, const MArrayPopShift *mir, Register obj,
michael@0:                                  Register elementsTemp, Register lengthTemp, TypedOrValueRegister out)
michael@0: {
michael@0:     OutOfLineCode *ool;
michael@0: 
michael@0:     if (mir->mode() == MArrayPopShift::Pop) {
michael@0:         ool = oolCallVM(ArrayPopDenseInfo, lir, (ArgList(), obj), StoreValueTo(out));
michael@0:         if (!ool)
michael@0:             return false;
michael@0:     } else {
michael@0:         JS_ASSERT(mir->mode() == MArrayPopShift::Shift);
michael@0:         ool = oolCallVM(ArrayShiftDenseInfo, lir, (ArgList(), obj), StoreValueTo(out));
michael@0:         if (!ool)
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     // VM call if a write barrier is necessary.
michael@0:     masm.branchTestNeedsBarrier(Assembler::NonZero, lengthTemp, ool->entry());
michael@0: 
michael@0:     // Load elements and length.
michael@0:     masm.loadPtr(Address(obj, JSObject::offsetOfElements()), elementsTemp);
michael@0:     masm.load32(Address(elementsTemp, ObjectElements::offsetOfLength()), lengthTemp);
michael@0: 
michael@0:     // VM call if length != initializedLength.
michael@0:     Int32Key key = Int32Key(lengthTemp);
michael@0:     Address initLength(elementsTemp, ObjectElements::offsetOfInitializedLength());
michael@0:     masm.branchKey(Assembler::NotEqual, initLength, key, ool->entry());
michael@0: 
michael@0:     // Test for length != 0. On zero length either take a VM call or generate
michael@0:     // an undefined value, depending on whether the call is known to produce
michael@0:     // undefined.
michael@0:     Label done;
michael@0:     if (mir->maybeUndefined()) {
michael@0:         Label notEmpty;
michael@0:         masm.branchTest32(Assembler::NonZero, lengthTemp, lengthTemp, &notEmpty);
michael@0:         masm.moveValue(UndefinedValue(), out.valueReg());
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notEmpty);
michael@0:     } else {
michael@0:         masm.branchTest32(Assembler::Zero, lengthTemp, lengthTemp, ool->entry());
michael@0:     }
michael@0: 
michael@0:     masm.bumpKey(&key, -1);
michael@0: 
michael@0:     if (mir->mode() == MArrayPopShift::Pop) {
michael@0:         masm.loadElementTypedOrValue(BaseIndex(elementsTemp, lengthTemp, TimesEight), out,
michael@0:                                      mir->needsHoleCheck(), ool->entry());
michael@0:     } else {
michael@0:         JS_ASSERT(mir->mode() == MArrayPopShift::Shift);
michael@0:         masm.loadElementTypedOrValue(Address(elementsTemp, 0), out, mir->needsHoleCheck(),
michael@0:                                      ool->entry());
michael@0:     }
michael@0: 
michael@0:     // Handle the failure case when the array length is non-writable in the
michael@0:     // OOL path.  (Unlike in the adding-an-element cases, we can't rely on the
michael@0:     // capacity <= length invariant for such arrays to avoid an explicit
michael@0:     // check.)
michael@0:     Address elementFlags(elementsTemp, ObjectElements::offsetOfFlags());
michael@0:     Imm32 bit(ObjectElements::NONWRITABLE_ARRAY_LENGTH);
michael@0:     masm.branchTest32(Assembler::NonZero, elementFlags, bit, ool->entry());
michael@0: 
michael@0:     // Now adjust length and initializedLength.
michael@0:     masm.store32(lengthTemp, Address(elementsTemp, ObjectElements::offsetOfLength()));
michael@0:     masm.store32(lengthTemp, Address(elementsTemp, ObjectElements::offsetOfInitializedLength()));
michael@0: 
michael@0:     if (mir->mode() == MArrayPopShift::Shift) {
michael@0:         // Don't save the temp registers.
michael@0:         RegisterSet temps;
michael@0:         temps.add(elementsTemp);
michael@0:         temps.add(lengthTemp);
michael@0: 
michael@0:         saveVolatile(temps);
michael@0:         masm.setupUnalignedABICall(1, lengthTemp);
michael@0:         masm.passABIArg(obj);
michael@0:         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::ArrayShiftMoveElements));
michael@0:         restoreVolatile(temps);
michael@0:     }
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayPopShiftV(LArrayPopShiftV *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register elements = ToRegister(lir->temp0());
michael@0:     Register length = ToRegister(lir->temp1());
michael@0:     TypedOrValueRegister out(ToOutValue(lir));
michael@0:     return emitArrayPopShift(lir, lir->mir(), obj, elements, length, out);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayPopShiftT(LArrayPopShiftT *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register elements = ToRegister(lir->temp0());
michael@0:     Register length = ToRegister(lir->temp1());
michael@0:     TypedOrValueRegister out(lir->mir()->type(), ToAnyRegister(lir->output()));
michael@0:     return emitArrayPopShift(lir, lir->mir(), obj, elements, length, out);
michael@0: }
michael@0: 
michael@0: typedef bool (*ArrayPushDenseFn)(JSContext *, HandleObject, HandleValue, uint32_t *);
michael@0: static const VMFunction ArrayPushDenseInfo =
michael@0:     FunctionInfo<ArrayPushDenseFn>(jit::ArrayPushDense);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitArrayPush(LInstruction *lir, const MArrayPush *mir, Register obj,
michael@0:                              ConstantOrRegister value, Register elementsTemp, Register length)
michael@0: {
michael@0:     OutOfLineCode *ool = oolCallVM(ArrayPushDenseInfo, lir, (ArgList(), obj, value), StoreRegisterTo(length));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     // Load elements and length.
michael@0:     masm.loadPtr(Address(obj, JSObject::offsetOfElements()), elementsTemp);
michael@0:     masm.load32(Address(elementsTemp, ObjectElements::offsetOfLength()), length);
michael@0: 
michael@0:     Int32Key key = Int32Key(length);
michael@0:     Address initLength(elementsTemp, ObjectElements::offsetOfInitializedLength());
michael@0:     Address capacity(elementsTemp, ObjectElements::offsetOfCapacity());
michael@0: 
michael@0:     // Guard length == initializedLength.
michael@0:     masm.branchKey(Assembler::NotEqual, initLength, key, ool->entry());
michael@0: 
michael@0:     // Guard length < capacity.
michael@0:     masm.branchKey(Assembler::BelowOrEqual, capacity, key, ool->entry());
michael@0: 
michael@0:     masm.storeConstantOrRegister(value, BaseIndex(elementsTemp, length, TimesEight));
michael@0: 
michael@0:     masm.bumpKey(&key, 1);
michael@0:     masm.store32(length, Address(elementsTemp, ObjectElements::offsetOfLength()));
michael@0:     masm.store32(length, Address(elementsTemp, ObjectElements::offsetOfInitializedLength()));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayPushV(LArrayPushV *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register elementsTemp = ToRegister(lir->temp());
michael@0:     Register length = ToRegister(lir->output());
michael@0:     ConstantOrRegister value = TypedOrValueRegister(ToValue(lir, LArrayPushV::Value));
michael@0:     return emitArrayPush(lir, lir->mir(), obj, value, elementsTemp, length);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayPushT(LArrayPushT *lir)
michael@0: {
michael@0:     Register obj = ToRegister(lir->object());
michael@0:     Register elementsTemp = ToRegister(lir->temp());
michael@0:     Register length = ToRegister(lir->output());
michael@0:     ConstantOrRegister value;
michael@0:     if (lir->value()->isConstant())
michael@0:         value = ConstantOrRegister(*lir->value()->toConstant());
michael@0:     else
michael@0:         value = TypedOrValueRegister(lir->mir()->value()->type(), ToAnyRegister(lir->value()));
michael@0:     return emitArrayPush(lir, lir->mir(), obj, value, elementsTemp, length);
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*ArrayConcatDenseFn)(JSContext *, HandleObject, HandleObject, HandleObject);
michael@0: static const VMFunction ArrayConcatDenseInfo = FunctionInfo<ArrayConcatDenseFn>(ArrayConcatDense);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArrayConcat(LArrayConcat *lir)
michael@0: {
michael@0:     Register lhs = ToRegister(lir->lhs());
michael@0:     Register rhs = ToRegister(lir->rhs());
michael@0:     Register temp1 = ToRegister(lir->temp1());
michael@0:     Register temp2 = ToRegister(lir->temp2());
michael@0: 
michael@0:     // If 'length == initializedLength' for both arrays we try to allocate an object
michael@0:     // inline and pass it to the stub. Else, we just pass nullptr and the stub falls
michael@0:     // back to a slow path.
michael@0:     Label fail, call;
michael@0:     masm.loadPtr(Address(lhs, JSObject::offsetOfElements()), temp1);
michael@0:     masm.load32(Address(temp1, ObjectElements::offsetOfInitializedLength()), temp2);
michael@0:     masm.branch32(Assembler::NotEqual, Address(temp1, ObjectElements::offsetOfLength()), temp2, &fail);
michael@0: 
michael@0:     masm.loadPtr(Address(rhs, JSObject::offsetOfElements()), temp1);
michael@0:     masm.load32(Address(temp1, ObjectElements::offsetOfInitializedLength()), temp2);
michael@0:     masm.branch32(Assembler::NotEqual, Address(temp1, ObjectElements::offsetOfLength()), temp2, &fail);
michael@0: 
michael@0:     // Try to allocate an object.
michael@0:     JSObject *templateObj = lir->mir()->templateObj();
michael@0:     masm.newGCThing(temp1, temp2, templateObj, &fail, lir->mir()->initialHeap());
michael@0:     masm.initGCThing(temp1, temp2, templateObj);
michael@0:     masm.jump(&call);
michael@0:     {
michael@0:         masm.bind(&fail);
michael@0:         masm.movePtr(ImmPtr(nullptr), temp1);
michael@0:     }
michael@0:     masm.bind(&call);
michael@0: 
michael@0:     pushArg(temp1);
michael@0:     pushArg(ToRegister(lir->rhs()));
michael@0:     pushArg(ToRegister(lir->lhs()));
michael@0:     return callVM(ArrayConcatDenseInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*GetIteratorObjectFn)(JSContext *, HandleObject, uint32_t);
michael@0: static const VMFunction GetIteratorObjectInfo = FunctionInfo<GetIteratorObjectFn>(GetIteratorObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallIteratorStart(LCallIteratorStart *lir)
michael@0: {
michael@0:     pushArg(Imm32(lir->mir()->flags()));
michael@0:     pushArg(ToRegister(lir->object()));
michael@0:     return callVM(GetIteratorObjectInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIteratorStart(LIteratorStart *lir)
michael@0: {
michael@0:     const Register obj = ToRegister(lir->object());
michael@0:     const Register output = ToRegister(lir->output());
michael@0: 
michael@0:     uint32_t flags = lir->mir()->flags();
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(GetIteratorObjectInfo, lir,
michael@0:                                    (ArgList(), obj, Imm32(flags)), StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     const Register temp1 = ToRegister(lir->temp1());
michael@0:     const Register temp2 = ToRegister(lir->temp2());
michael@0:     const Register niTemp = ToRegister(lir->temp3()); // Holds the NativeIterator object.
michael@0: 
michael@0:     // Iterators other than for-in should use LCallIteratorStart.
michael@0:     JS_ASSERT(flags == JSITER_ENUMERATE);
michael@0: 
michael@0:     // Fetch the most recent iterator and ensure it's not nullptr.
michael@0:     masm.loadPtr(AbsoluteAddress(GetIonContext()->runtime->addressOfLastCachedNativeIterator()), output);
michael@0:     masm.branchTestPtr(Assembler::Zero, output, output, ool->entry());
michael@0: 
michael@0:     // Load NativeIterator.
michael@0:     masm.loadObjPrivate(output, JSObject::ITER_CLASS_NFIXED_SLOTS, niTemp);
michael@0: 
michael@0:     // Ensure the |active| and |unreusable| bits are not set.
michael@0:     masm.branchTest32(Assembler::NonZero, Address(niTemp, offsetof(NativeIterator, flags)),
michael@0:                       Imm32(JSITER_ACTIVE|JSITER_UNREUSABLE), ool->entry());
michael@0: 
michael@0:     // Load the iterator's shape array.
michael@0:     masm.loadPtr(Address(niTemp, offsetof(NativeIterator, shapes_array)), temp2);
michael@0: 
michael@0:     // Compare shape of object with the first shape.
michael@0:     masm.loadObjShape(obj, temp1);
michael@0:     masm.branchPtr(Assembler::NotEqual, Address(temp2, 0), temp1, ool->entry());
michael@0: 
michael@0:     // Compare shape of object's prototype with the second shape.
michael@0:     masm.loadObjProto(obj, temp1);
michael@0:     masm.loadObjShape(temp1, temp1);
michael@0:     masm.branchPtr(Assembler::NotEqual, Address(temp2, sizeof(Shape *)), temp1, ool->entry());
michael@0: 
michael@0:     // Ensure the object's prototype's prototype is nullptr. The last native
michael@0:     // iterator will always have a prototype chain length of one (i.e. it must
michael@0:     // be a plain ), so we do not need to generate a loop here.
michael@0:     masm.loadObjProto(obj, temp1);
michael@0:     masm.loadObjProto(temp1, temp1);
michael@0:     masm.branchTestPtr(Assembler::NonZero, temp1, temp1, ool->entry());
michael@0: 
michael@0:     // Ensure the object does not have any elements. The presence of dense
michael@0:     // elements is not captured by the shape tests above.
michael@0:     masm.branchPtr(Assembler::NotEqual,
michael@0:                    Address(obj, JSObject::offsetOfElements()),
michael@0:                    ImmPtr(js::emptyObjectElements),
michael@0:                    ool->entry());
michael@0: 
michael@0:     // Write barrier for stores to the iterator. We only need to take a write
michael@0:     // barrier if NativeIterator::obj is actually going to change.
michael@0:     {
michael@0: #ifdef JSGC_GENERATIONAL
michael@0:         // Bug 867815: When using a nursery, we unconditionally take this out-
michael@0:         // of-line so that we do not have to post-barrier the store to
michael@0:         // NativeIter::obj. This just needs JIT support for the Cell* buffer.
michael@0:         Address objAddr(niTemp, offsetof(NativeIterator, obj));
michael@0:         masm.branchPtr(Assembler::NotEqual, objAddr, obj, ool->entry());
michael@0: #else
michael@0:         Label noBarrier;
michael@0:         masm.branchTestNeedsBarrier(Assembler::Zero, temp1, &noBarrier);
michael@0: 
michael@0:         Address objAddr(niTemp, offsetof(NativeIterator, obj));
michael@0:         masm.branchPtr(Assembler::NotEqual, objAddr, obj, ool->entry());
michael@0: 
michael@0:         masm.bind(&noBarrier);
michael@0: #endif // !JSGC_GENERATIONAL
michael@0:     }
michael@0: 
michael@0:     // Mark iterator as active.
michael@0:     masm.storePtr(obj, Address(niTemp, offsetof(NativeIterator, obj)));
michael@0:     masm.or32(Imm32(JSITER_ACTIVE), Address(niTemp, offsetof(NativeIterator, flags)));
michael@0: 
michael@0:     // Chain onto the active iterator stack.
michael@0:     masm.loadPtr(AbsoluteAddress(gen->compartment->addressOfEnumerators()), temp1);
michael@0: 
michael@0:     // ni->next = list
michael@0:     masm.storePtr(temp1, Address(niTemp, NativeIterator::offsetOfNext()));
michael@0: 
michael@0:     // ni->prev = list->prev
michael@0:     masm.loadPtr(Address(temp1, NativeIterator::offsetOfPrev()), temp2);
michael@0:     masm.storePtr(temp2, Address(niTemp, NativeIterator::offsetOfPrev()));
michael@0: 
michael@0:     // list->prev->next = ni
michael@0:     masm.storePtr(niTemp, Address(temp2, NativeIterator::offsetOfNext()));
michael@0: 
michael@0:     // list->prev = ni
michael@0:     masm.storePtr(niTemp, Address(temp1, NativeIterator::offsetOfPrev()));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: static void
michael@0: LoadNativeIterator(MacroAssembler &masm, Register obj, Register dest, Label *failures)
michael@0: {
michael@0:     JS_ASSERT(obj != dest);
michael@0: 
michael@0:     // Test class.
michael@0:     masm.branchTestObjClass(Assembler::NotEqual, obj, dest, &PropertyIteratorObject::class_, failures);
michael@0: 
michael@0:     // Load NativeIterator object.
michael@0:     masm.loadObjPrivate(obj, JSObject::ITER_CLASS_NFIXED_SLOTS, dest);
michael@0: }
michael@0: 
michael@0: typedef bool (*IteratorNextFn)(JSContext *, HandleObject, MutableHandleValue);
michael@0: static const VMFunction IteratorNextInfo = FunctionInfo<IteratorNextFn>(js_IteratorNext);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIteratorNext(LIteratorNext *lir)
michael@0: {
michael@0:     const Register obj = ToRegister(lir->object());
michael@0:     const Register temp = ToRegister(lir->temp());
michael@0:     const ValueOperand output = ToOutValue(lir);
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(IteratorNextInfo, lir, (ArgList(), obj), StoreValueTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     LoadNativeIterator(masm, obj, temp, ool->entry());
michael@0: 
michael@0:     masm.branchTest32(Assembler::NonZero, Address(temp, offsetof(NativeIterator, flags)),
michael@0:                       Imm32(JSITER_FOREACH), ool->entry());
michael@0: 
michael@0:     // Get cursor, next string.
michael@0:     masm.loadPtr(Address(temp, offsetof(NativeIterator, props_cursor)), output.scratchReg());
michael@0:     masm.loadPtr(Address(output.scratchReg(), 0), output.scratchReg());
michael@0:     masm.tagValue(JSVAL_TYPE_STRING, output.scratchReg(), output);
michael@0: 
michael@0:     // Increase the cursor.
michael@0:     masm.addPtr(Imm32(sizeof(JSString *)), Address(temp, offsetof(NativeIterator, props_cursor)));
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*IteratorMoreFn)(JSContext *, HandleObject, bool *);
michael@0: static const VMFunction IteratorMoreInfo = FunctionInfo<IteratorMoreFn>(jit::IteratorMore);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIteratorMore(LIteratorMore *lir)
michael@0: {
michael@0:     const Register obj = ToRegister(lir->object());
michael@0:     const Register output = ToRegister(lir->output());
michael@0:     const Register temp = ToRegister(lir->temp());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(IteratorMoreInfo, lir,
michael@0:                                    (ArgList(), obj), StoreRegisterTo(output));
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     LoadNativeIterator(masm, obj, output, ool->entry());
michael@0: 
michael@0:     masm.branchTest32(Assembler::NonZero, Address(output, offsetof(NativeIterator, flags)),
michael@0:                       Imm32(JSITER_FOREACH), ool->entry());
michael@0: 
michael@0:     // Set output to true if props_cursor < props_end.
michael@0:     masm.loadPtr(Address(output, offsetof(NativeIterator, props_end)), temp);
michael@0:     masm.cmpPtrSet(Assembler::LessThan, Address(output, offsetof(NativeIterator, props_cursor)),
michael@0:                    temp, output);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*CloseIteratorFn)(JSContext *, HandleObject);
michael@0: static const VMFunction CloseIteratorInfo = FunctionInfo<CloseIteratorFn>(CloseIterator);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIteratorEnd(LIteratorEnd *lir)
michael@0: {
michael@0:     const Register obj = ToRegister(lir->object());
michael@0:     const Register temp1 = ToRegister(lir->temp1());
michael@0:     const Register temp2 = ToRegister(lir->temp2());
michael@0:     const Register temp3 = ToRegister(lir->temp3());
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(CloseIteratorInfo, lir, (ArgList(), obj), StoreNothing());
michael@0:     if (!ool)
michael@0:         return false;
michael@0: 
michael@0:     LoadNativeIterator(masm, obj, temp1, ool->entry());
michael@0: 
michael@0:     masm.branchTest32(Assembler::Zero, Address(temp1, offsetof(NativeIterator, flags)),
michael@0:                       Imm32(JSITER_ENUMERATE), ool->entry());
michael@0: 
michael@0:     // Clear active bit.
michael@0:     masm.and32(Imm32(~JSITER_ACTIVE), Address(temp1, offsetof(NativeIterator, flags)));
michael@0: 
michael@0:     // Reset property cursor.
michael@0:     masm.loadPtr(Address(temp1, offsetof(NativeIterator, props_array)), temp2);
michael@0:     masm.storePtr(temp2, Address(temp1, offsetof(NativeIterator, props_cursor)));
michael@0: 
michael@0:     // Unlink from the iterator list.
michael@0:     const Register next = temp2;
michael@0:     const Register prev = temp3;
michael@0:     masm.loadPtr(Address(temp1, NativeIterator::offsetOfNext()), next);
michael@0:     masm.loadPtr(Address(temp1, NativeIterator::offsetOfPrev()), prev);
michael@0:     masm.storePtr(prev, Address(next, NativeIterator::offsetOfPrev()));
michael@0:     masm.storePtr(next, Address(prev, NativeIterator::offsetOfNext()));
michael@0: #ifdef DEBUG
michael@0:     masm.storePtr(ImmPtr(nullptr), Address(temp1, NativeIterator::offsetOfNext()));
michael@0:     masm.storePtr(ImmPtr(nullptr), Address(temp1, NativeIterator::offsetOfPrev()));
michael@0: #endif
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitArgumentsLength(LArgumentsLength *lir)
michael@0: {
michael@0:     // read number of actual arguments from the JS frame.
michael@0:     Register argc = ToRegister(lir->output());
michael@0:     Address ptr(StackPointer, frameSize() + IonJSFrameLayout::offsetOfNumActualArgs());
michael@0: 
michael@0:     masm.loadPtr(ptr, argc);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetFrameArgument(LGetFrameArgument *lir)
michael@0: {
michael@0:     ValueOperand result = GetValueOutput(lir);
michael@0:     const LAllocation *index = lir->index();
michael@0:     size_t argvOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs();
michael@0: 
michael@0:     if (index->isConstant()) {
michael@0:         int32_t i = index->toConstant()->toInt32();
michael@0:         Address argPtr(StackPointer, sizeof(Value) * i + argvOffset);
michael@0:         masm.loadValue(argPtr, result);
michael@0:     } else {
michael@0:         Register i = ToRegister(index);
michael@0:         BaseIndex argPtr(StackPointer, i, ScaleFromElemWidth(sizeof(Value)), argvOffset);
michael@0:         masm.loadValue(argPtr, result);
michael@0:     }
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetFrameArgumentT(LSetFrameArgumentT *lir)
michael@0: {
michael@0:     size_t argOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs() +
michael@0:                        (sizeof(Value) * lir->mir()->argno());
michael@0: 
michael@0:     MIRType type = lir->mir()->value()->type();
michael@0: 
michael@0:     if (type == MIRType_Double) {
michael@0:         // Store doubles directly.
michael@0:         FloatRegister input = ToFloatRegister(lir->input());
michael@0:         masm.storeDouble(input, Address(StackPointer, argOffset));
michael@0: 
michael@0:     } else {
michael@0:         Register input = ToRegister(lir->input());
michael@0:         masm.storeValue(ValueTypeFromMIRType(type), input, Address(StackPointer, argOffset));
michael@0:     }
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator:: visitSetFrameArgumentC(LSetFrameArgumentC *lir)
michael@0: {
michael@0:     size_t argOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs() +
michael@0:                        (sizeof(Value) * lir->mir()->argno());
michael@0:     masm.storeValue(lir->val(), Address(StackPointer, argOffset));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator:: visitSetFrameArgumentV(LSetFrameArgumentV *lir)
michael@0: {
michael@0:     const ValueOperand val = ToValue(lir, LSetFrameArgumentV::Input);
michael@0:     size_t argOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs() +
michael@0:                        (sizeof(Value) * lir->mir()->argno());
michael@0:     masm.storeValue(val, Address(StackPointer, argOffset));
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*RunOnceScriptPrologueFn)(JSContext *, HandleScript);
michael@0: static const VMFunction RunOnceScriptPrologueInfo =
michael@0:     FunctionInfo<RunOnceScriptPrologueFn>(js::RunOnceScriptPrologue);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRunOncePrologue(LRunOncePrologue *lir)
michael@0: {
michael@0:     pushArg(ImmGCPtr(lir->mir()->block()->info().script()));
michael@0:     return callVM(RunOnceScriptPrologueInfo, lir);
michael@0: }
michael@0: 
michael@0: 
michael@0: typedef JSObject *(*InitRestParameterFn)(JSContext *, uint32_t, Value *, HandleObject,
michael@0:                                          HandleObject);
michael@0: typedef JSObject *(*InitRestParameterParFn)(ForkJoinContext *, uint32_t, Value *,
michael@0:                                             HandleObject, HandleObject);
michael@0: static const VMFunctionsModal InitRestParameterInfo = VMFunctionsModal(
michael@0:     FunctionInfo<InitRestParameterFn>(InitRestParameter),
michael@0:     FunctionInfo<InitRestParameterParFn>(InitRestParameterPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitRest(LInstruction *lir, Register array, Register numActuals,
michael@0:                         Register temp0, Register temp1, unsigned numFormals,
michael@0:                         JSObject *templateObject)
michael@0: {
michael@0:     // Compute actuals() + numFormals.
michael@0:     size_t actualsOffset = frameSize() + IonJSFrameLayout::offsetOfActualArgs();
michael@0:     masm.movePtr(StackPointer, temp1);
michael@0:     masm.addPtr(Imm32(sizeof(Value) * numFormals + actualsOffset), temp1);
michael@0: 
michael@0:     // Compute numActuals - numFormals.
michael@0:     Label emptyLength, joinLength;
michael@0:     masm.movePtr(numActuals, temp0);
michael@0:     masm.branch32(Assembler::LessThanOrEqual, temp0, Imm32(numFormals), &emptyLength);
michael@0:     masm.sub32(Imm32(numFormals), temp0);
michael@0:     masm.jump(&joinLength);
michael@0:     {
michael@0:         masm.bind(&emptyLength);
michael@0:         masm.move32(Imm32(0), temp0);
michael@0:     }
michael@0:     masm.bind(&joinLength);
michael@0: 
michael@0:     pushArg(array);
michael@0:     pushArg(ImmGCPtr(templateObject));
michael@0:     pushArg(temp1);
michael@0:     pushArg(temp0);
michael@0: 
michael@0:     return callVM(InitRestParameterInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRest(LRest *lir)
michael@0: {
michael@0:     Register numActuals = ToRegister(lir->numActuals());
michael@0:     Register temp0 = ToRegister(lir->getTemp(0));
michael@0:     Register temp1 = ToRegister(lir->getTemp(1));
michael@0:     Register temp2 = ToRegister(lir->getTemp(2));
michael@0:     unsigned numFormals = lir->mir()->numFormals();
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0: 
michael@0:     Label joinAlloc, failAlloc;
michael@0:     masm.newGCThing(temp2, temp0, templateObject, &failAlloc, gc::DefaultHeap);
michael@0:     masm.initGCThing(temp2, temp0, templateObject);
michael@0:     masm.jump(&joinAlloc);
michael@0:     {
michael@0:         masm.bind(&failAlloc);
michael@0:         masm.movePtr(ImmPtr(nullptr), temp2);
michael@0:     }
michael@0:     masm.bind(&joinAlloc);
michael@0: 
michael@0:     return emitRest(lir, temp2, numActuals, temp0, temp1, numFormals, templateObject);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRestPar(LRestPar *lir)
michael@0: {
michael@0:     Register numActuals = ToRegister(lir->numActuals());
michael@0:     Register cx = ToRegister(lir->forkJoinContext());
michael@0:     Register temp0 = ToRegister(lir->getTemp(0));
michael@0:     Register temp1 = ToRegister(lir->getTemp(1));
michael@0:     Register temp2 = ToRegister(lir->getTemp(2));
michael@0:     unsigned numFormals = lir->mir()->numFormals();
michael@0:     JSObject *templateObject = lir->mir()->templateObject();
michael@0: 
michael@0:     if (!emitAllocateGCThingPar(lir, temp2, cx, temp0, temp1, templateObject))
michael@0:         return false;
michael@0: 
michael@0:     return emitRest(lir, temp2, numActuals, temp0, temp1, numFormals, templateObject);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::generateAsmJS(Label *stackOverflowLabel)
michael@0: {
michael@0:     IonSpew(IonSpew_Codegen, "# Emitting asm.js code");
michael@0: 
michael@0:     // AsmJS doesn't do profiler instrumentation.
michael@0:     sps_.disable();
michael@0: 
michael@0:     // The caller (either another asm.js function or the external-entry
michael@0:     // trampoline) has placed all arguments in registers and on the stack
michael@0:     // according to the system ABI. The MAsmJSParameters which represent these
michael@0:     // parameters have been useFixed()ed to these ABI-specified positions.
michael@0:     // Thus, there is nothing special to do in the prologue except (possibly)
michael@0:     // bump the stack.
michael@0:     if (!generateAsmJSPrologue(stackOverflowLabel))
michael@0:         return false;
michael@0:     if (!generateBody())
michael@0:         return false;
michael@0:     if (!generateEpilogue())
michael@0:         return false;
michael@0: #if defined(JS_ION_PERF)
michael@0:     // Note the end of the inline code and start of the OOL code.
michael@0:     gen->perfSpewer().noteEndInlineCode(masm);
michael@0: #endif
michael@0:     if (!generateOutOfLineCode())
michael@0:         return false;
michael@0: 
michael@0:     // The only remaining work needed to compile this function is to patch the
michael@0:     // switch-statement jump tables (the entries of the table need the absolute
michael@0:     // address of the cases). These table entries are accmulated as CodeLabels
michael@0:     // in the MacroAssembler's codeLabels_ list and processed all at once at in
michael@0:     // the "static-link" phase of module compilation. It is critical that there
michael@0:     // is nothing else to do after this point since the LifoAlloc memory
michael@0:     // holding the MIR graph is about to be popped and reused. In particular,
michael@0:     // every step in CodeGenerator::link must be a nop, as asserted here:
michael@0:     JS_ASSERT(snapshots_.listSize() == 0);
michael@0:     JS_ASSERT(snapshots_.RVATableSize() == 0);
michael@0:     JS_ASSERT(recovers_.size() == 0);
michael@0:     JS_ASSERT(bailouts_.empty());
michael@0:     JS_ASSERT(graph.numConstants() == 0);
michael@0:     JS_ASSERT(safepointIndices_.empty());
michael@0:     JS_ASSERT(osiIndices_.empty());
michael@0:     JS_ASSERT(cacheList_.empty());
michael@0:     JS_ASSERT(safepoints_.size() == 0);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::generate()
michael@0: {
michael@0:     IonSpew(IonSpew_Codegen, "# Emitting code for script %s:%d",
michael@0:             gen->info().script()->filename(),
michael@0:             gen->info().script()->lineno());
michael@0: 
michael@0:     if (!snapshots_.init())
michael@0:         return false;
michael@0: 
michael@0:     if (!safepoints_.init(gen->alloc(), graph.totalSlotCount()))
michael@0:         return false;
michael@0: 
michael@0: #ifdef JS_TRACE_LOGGING
michael@0:     if (!gen->compilingAsmJS() && gen->info().executionMode() == SequentialExecution) {
michael@0:         if (!emitTracelogScriptStart())
michael@0:             return false;
michael@0:         if (!emitTracelogStartEvent(TraceLogger::IonMonkey))
michael@0:             return false;
michael@0:     }
michael@0: #endif
michael@0: 
michael@0:     // Before generating any code, we generate type checks for all parameters.
michael@0:     // This comes before deoptTable_, because we can't use deopt tables without
michael@0:     // creating the actual frame.
michael@0:     if (!generateArgumentsChecks())
michael@0:         return false;
michael@0: 
michael@0:     if (frameClass_ != FrameSizeClass::None()) {
michael@0:         deoptTable_ = gen->jitRuntime()->getBailoutTable(frameClass_);
michael@0:         if (!deoptTable_)
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0: #ifdef JS_TRACE_LOGGING
michael@0:     Label skip;
michael@0:     masm.jump(&skip);
michael@0: #endif
michael@0: 
michael@0:     // Remember the entry offset to skip the argument check.
michael@0:     masm.flushBuffer();
michael@0:     setSkipArgCheckEntryOffset(masm.size());
michael@0: 
michael@0: #ifdef JS_TRACE_LOGGING
michael@0:     if (!gen->compilingAsmJS() && gen->info().executionMode() == SequentialExecution) {
michael@0:         if (!emitTracelogScriptStart())
michael@0:             return false;
michael@0:         if (!emitTracelogStartEvent(TraceLogger::IonMonkey))
michael@0:             return false;
michael@0:     }
michael@0:     masm.bind(&skip);
michael@0: #endif
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     // Assert that the argument types are correct.
michael@0:     if (!generateArgumentsChecks(/* bailout = */ false))
michael@0:         return false;
michael@0: #endif
michael@0: 
michael@0:     if (!generatePrologue())
michael@0:         return false;
michael@0:     if (!generateBody())
michael@0:         return false;
michael@0:     if (!generateEpilogue())
michael@0:         return false;
michael@0:     if (!generateInvalidateEpilogue())
michael@0:         return false;
michael@0: #if defined(JS_ION_PERF)
michael@0:     // Note the end of the inline code and start of the OOL code.
michael@0:     perfSpewer_.noteEndInlineCode(masm);
michael@0: #endif
michael@0:     if (!generateOutOfLineCode())
michael@0:         return false;
michael@0: 
michael@0:     return !masm.oom();
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
michael@0: {
michael@0:     RootedScript script(cx, gen->info().script());
michael@0:     ExecutionMode executionMode = gen->info().executionMode();
michael@0:     OptimizationLevel optimizationLevel = gen->optimizationInfo().level();
michael@0: 
michael@0:     JS_ASSERT_IF(HasIonScript(script, executionMode), executionMode == SequentialExecution);
michael@0: 
michael@0:     // We finished the new IonScript. Invalidate the current active IonScript,
michael@0:     // so we can replace it with this new (probably higher optimized) version.
michael@0:     if (HasIonScript(script, executionMode)) {
michael@0:         JS_ASSERT(GetIonScript(script, executionMode)->isRecompiling());
michael@0:         // Do a normal invalidate, except don't cancel offThread compilations,
michael@0:         // since that will cancel this compilation too.
michael@0:         if (!Invalidate(cx, script, SequentialExecution,
michael@0:                         /* resetUses */ false, /* cancelOffThread*/ false))
michael@0:         {
michael@0:             return false;
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     // Check to make sure we didn't have a mid-build invalidation. If so, we
michael@0:     // will trickle to jit::Compile() and return Method_Skipped.
michael@0:     types::RecompileInfo recompileInfo;
michael@0:     if (!types::FinishCompilation(cx, script, executionMode, constraints, &recompileInfo))
michael@0:         return true;
michael@0: 
michael@0:     uint32_t scriptFrameSize = frameClass_ == FrameSizeClass::None()
michael@0:                            ? frameDepth_
michael@0:                            : FrameSizeClass::FromDepth(frameDepth_).frameSize();
michael@0: 
michael@0:     // We encode safepoints after the OSI-point offsets have been determined.
michael@0:     encodeSafepoints();
michael@0: 
michael@0:     // List of possible scripts that this graph may call. Currently this is
michael@0:     // only tracked when compiling for parallel execution.
michael@0:     CallTargetVector callTargets(alloc());
michael@0:     if (executionMode == ParallelExecution)
michael@0:         AddPossibleCallees(cx, graph.mir(), callTargets);
michael@0: 
michael@0:     IonScript *ionScript =
michael@0:       IonScript::New(cx, recompileInfo,
michael@0:                      graph.totalSlotCount(), scriptFrameSize,
michael@0:                      snapshots_.listSize(), snapshots_.RVATableSize(),
michael@0:                      recovers_.size(), bailouts_.length(), graph.numConstants(),
michael@0:                      safepointIndices_.length(), osiIndices_.length(),
michael@0:                      cacheList_.length(), runtimeData_.length(),
michael@0:                      safepoints_.size(), callTargets.length(),
michael@0:                      patchableBackedges_.length(), optimizationLevel);
michael@0:     if (!ionScript) {
michael@0:         recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
michael@0:         return false;
michael@0:     }
michael@0: 
michael@0:     // Lock the runtime against interrupt callbacks during the link.
michael@0:     // We don't want an interrupt request to protect the code for the script
michael@0:     // before it has been filled in, as we could segv before the runtime's
michael@0:     // patchable backedges have been fully updated.
michael@0:     JSRuntime::AutoLockForInterrupt lock(cx->runtime());
michael@0: 
michael@0:     // Make sure we don't segv while filling in the code, to avoid deadlocking
michael@0:     // inside the signal handler.
michael@0:     cx->runtime()->jitRuntime()->ensureIonCodeAccessible(cx->runtime());
michael@0: 
michael@0:     // Implicit interrupts are used only for sequential code. In parallel mode
michael@0:     // use the normal executable allocator so that we cannot segv during
michael@0:     // execution off the main thread.
michael@0:     Linker linker(masm);
michael@0:     AutoFlushICache afc("IonLink");
michael@0:     JitCode *code = (executionMode == SequentialExecution)
michael@0:                     ? linker.newCodeForIonScript(cx)
michael@0:                     : linker.newCode<CanGC>(cx, JSC::ION_CODE);
michael@0:     if (!code) {
michael@0:         // Use js_free instead of IonScript::Destroy: the cache list and
michael@0:         // backedge list are still uninitialized.
michael@0:         js_free(ionScript);
michael@0:         recompileInfo.compilerOutput(cx->zone()->types)->invalidate();
michael@0:         return false;
michael@0:     }
michael@0: 
michael@0:     ionScript->setMethod(code);
michael@0:     ionScript->setSkipArgCheckEntryOffset(getSkipArgCheckEntryOffset());
michael@0: 
michael@0:     // If SPS is enabled, mark IonScript as having been instrumented with SPS
michael@0:     if (sps_.enabled())
michael@0:         ionScript->setHasSPSInstrumentation();
michael@0: 
michael@0:     SetIonScript(script, executionMode, ionScript);
michael@0: 
michael@0:     if (cx->runtime()->spsProfiler.enabled()) {
michael@0:         const char *filename = script->filename();
michael@0:         if (filename == nullptr)
michael@0:             filename = "<unknown>";
michael@0:         unsigned len = strlen(filename) + 50;
michael@0:         char *buf = js_pod_malloc<char>(len);
michael@0:         if (!buf)
michael@0:             return false;
michael@0:         JS_snprintf(buf, len, "Ion compiled %s:%d", filename, (int) script->lineno());
michael@0:         cx->runtime()->spsProfiler.markEvent(buf);
michael@0:         js_free(buf);
michael@0:     }
michael@0: 
michael@0:     // In parallel execution mode, when we first compile a script, we
michael@0:     // don't know that its potential callees are compiled, so set a
michael@0:     // flag warning that the callees may not be fully compiled.
michael@0:     if (!callTargets.empty())
michael@0:         ionScript->setHasUncompiledCallTarget();
michael@0: 
michael@0:     invalidateEpilogueData_.fixup(&masm);
michael@0:     Assembler::patchDataWithValueCheck(CodeLocationLabel(code, invalidateEpilogueData_),
michael@0:                                        ImmPtr(ionScript),
michael@0:                                        ImmPtr((void*)-1));
michael@0: 
michael@0:     IonSpew(IonSpew_Codegen, "Created IonScript %p (raw %p)",
michael@0:             (void *) ionScript, (void *) code->raw());
michael@0: 
michael@0:     ionScript->setInvalidationEpilogueDataOffset(invalidateEpilogueData_.offset());
michael@0:     ionScript->setOsrPc(gen->info().osrPc());
michael@0:     ionScript->setOsrEntryOffset(getOsrEntryOffset());
michael@0:     ptrdiff_t real_invalidate = masm.actualOffset(invalidate_.offset());
michael@0:     ionScript->setInvalidationEpilogueOffset(real_invalidate);
michael@0: 
michael@0:     ionScript->setDeoptTable(deoptTable_);
michael@0: 
michael@0: #if defined(JS_ION_PERF)
michael@0:     if (PerfEnabled())
michael@0:         perfSpewer_.writeProfile(script, code, masm);
michael@0: #endif
michael@0: 
michael@0:     for (size_t i = 0; i < ionScriptLabels_.length(); i++) {
michael@0:         ionScriptLabels_[i].fixup(&masm);
michael@0:         Assembler::patchDataWithValueCheck(CodeLocationLabel(code, ionScriptLabels_[i]),
michael@0:                                            ImmPtr(ionScript),
michael@0:                                            ImmPtr((void*)-1));
michael@0:     }
michael@0: 
michael@0:     // for generating inline caches during the execution.
michael@0:     if (runtimeData_.length())
michael@0:         ionScript->copyRuntimeData(&runtimeData_[0]);
michael@0:     if (cacheList_.length())
michael@0:         ionScript->copyCacheEntries(&cacheList_[0], masm);
michael@0: 
michael@0:     // for marking during GC.
michael@0:     if (safepointIndices_.length())
michael@0:         ionScript->copySafepointIndices(&safepointIndices_[0], masm);
michael@0:     if (safepoints_.size())
michael@0:         ionScript->copySafepoints(&safepoints_);
michael@0: 
michael@0:     // for reconvering from an Ion Frame.
michael@0:     if (bailouts_.length())
michael@0:         ionScript->copyBailoutTable(&bailouts_[0]);
michael@0:     if (osiIndices_.length())
michael@0:         ionScript->copyOsiIndices(&osiIndices_[0], masm);
michael@0:     if (snapshots_.listSize())
michael@0:         ionScript->copySnapshots(&snapshots_);
michael@0:     MOZ_ASSERT_IF(snapshots_.listSize(), recovers_.size());
michael@0:     if (recovers_.size())
michael@0:         ionScript->copyRecovers(&recovers_);
michael@0:     if (graph.numConstants())
michael@0:         ionScript->copyConstants(graph.constantPool());
michael@0:     if (callTargets.length() > 0)
michael@0:         ionScript->copyCallTargetEntries(callTargets.begin());
michael@0:     if (patchableBackedges_.length() > 0)
michael@0:         ionScript->copyPatchableBackedges(cx, code, patchableBackedges_.begin());
michael@0: 
michael@0: #ifdef JS_TRACE_LOGGING
michael@0:     TraceLogger *logger = TraceLoggerForMainThread(cx->runtime());
michael@0:     for (uint32_t i = 0; i < patchableTraceLoggers_.length(); i++) {
michael@0:         patchableTraceLoggers_[i].fixup(&masm);
michael@0:         Assembler::patchDataWithValueCheck(CodeLocationLabel(code, patchableTraceLoggers_[i]),
michael@0:                                            ImmPtr(logger),
michael@0:                                            ImmPtr(nullptr));
michael@0:     }
michael@0:     uint32_t scriptId = TraceLogCreateTextId(logger, script);
michael@0:     for (uint32_t i = 0; i < patchableTLScripts_.length(); i++) {
michael@0:         patchableTLScripts_[i].fixup(&masm);
michael@0:         Assembler::patchDataWithValueCheck(CodeLocationLabel(code, patchableTLScripts_[i]),
michael@0:                                            ImmPtr((void *) uintptr_t(scriptId)),
michael@0:                                            ImmPtr((void *)0));
michael@0:     }
michael@0: #endif
michael@0: 
michael@0:     switch (executionMode) {
michael@0:       case SequentialExecution:
michael@0:         // The correct state for prebarriers is unknown until the end of compilation,
michael@0:         // since a GC can occur during code generation. All barriers are emitted
michael@0:         // off-by-default, and are toggled on here if necessary.
michael@0:         if (cx->zone()->needsBarrier())
michael@0:             ionScript->toggleBarriers(true);
michael@0:         break;
michael@0:       case ParallelExecution:
michael@0:         // We don't run incremental GC during parallel execution; no need to
michael@0:         // turn on barriers.
michael@0:         break;
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: // An out-of-line path to convert a boxed int32 to either a float or double.
michael@0: class OutOfLineUnboxFloatingPoint : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LUnboxFloatingPoint *unboxFloatingPoint_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineUnboxFloatingPoint(LUnboxFloatingPoint *unboxFloatingPoint)
michael@0:       : unboxFloatingPoint_(unboxFloatingPoint)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineUnboxFloatingPoint(this);
michael@0:     }
michael@0: 
michael@0:     LUnboxFloatingPoint *unboxFloatingPoint() const {
michael@0:         return unboxFloatingPoint_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitUnboxFloatingPoint(LUnboxFloatingPoint *lir)
michael@0: {
michael@0:     const ValueOperand box = ToValue(lir, LUnboxFloatingPoint::Input);
michael@0:     const LDefinition *result = lir->output();
michael@0: 
michael@0:     // Out-of-line path to convert int32 to double or bailout
michael@0:     // if this instruction is fallible.
michael@0:     OutOfLineUnboxFloatingPoint *ool = new(alloc()) OutOfLineUnboxFloatingPoint(lir);
michael@0:     if (!addOutOfLineCode(ool))
michael@0:         return false;
michael@0: 
michael@0:     FloatRegister resultReg = ToFloatRegister(result);
michael@0:     masm.branchTestDouble(Assembler::NotEqual, box, ool->entry());
michael@0:     masm.unboxDouble(box, resultReg);
michael@0:     if (lir->type() == MIRType_Float32)
michael@0:         masm.convertDoubleToFloat32(resultReg, resultReg);
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineUnboxFloatingPoint(OutOfLineUnboxFloatingPoint *ool)
michael@0: {
michael@0:     LUnboxFloatingPoint *ins = ool->unboxFloatingPoint();
michael@0:     const ValueOperand value = ToValue(ins, LUnboxFloatingPoint::Input);
michael@0: 
michael@0:     if (ins->mir()->fallible()) {
michael@0:         Label bail;
michael@0:         masm.branchTestInt32(Assembler::NotEqual, value, &bail);
michael@0:         if (!bailoutFrom(&bail, ins->snapshot()))
michael@0:             return false;
michael@0:     }
michael@0:     masm.int32ValueToFloatingPoint(value, ToFloatRegister(ins->output()), ins->type());
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*GetPropertyFn)(JSContext *, HandleValue, HandlePropertyName, MutableHandleValue);
michael@0: static const VMFunction GetPropertyInfo = FunctionInfo<GetPropertyFn>(GetProperty);
michael@0: static const VMFunction CallPropertyInfo = FunctionInfo<GetPropertyFn>(CallProperty);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallGetProperty(LCallGetProperty *lir)
michael@0: {
michael@0:     pushArg(ImmGCPtr(lir->mir()->name()));
michael@0:     pushArg(ToValue(lir, LCallGetProperty::Value));
michael@0: 
michael@0:     if (lir->mir()->callprop())
michael@0:         return callVM(CallPropertyInfo, lir);
michael@0:     return callVM(GetPropertyInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*GetOrCallElementFn)(JSContext *, MutableHandleValue, HandleValue, MutableHandleValue);
michael@0: static const VMFunction GetElementInfo = FunctionInfo<GetOrCallElementFn>(js::GetElement);
michael@0: static const VMFunction CallElementInfo = FunctionInfo<GetOrCallElementFn>(js::CallElement);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallGetElement(LCallGetElement *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LCallGetElement::RhsInput));
michael@0:     pushArg(ToValue(lir, LCallGetElement::LhsInput));
michael@0: 
michael@0:     JSOp op = JSOp(*lir->mir()->resumePoint()->pc());
michael@0: 
michael@0:     if (op == JSOP_GETELEM) {
michael@0:         return callVM(GetElementInfo, lir);
michael@0:     } else {
michael@0:         JS_ASSERT(op == JSOP_CALLELEM);
michael@0:         return callVM(CallElementInfo, lir);
michael@0:     }
michael@0: }
michael@0: 
michael@0: typedef bool (*SetObjectElementFn)(JSContext *, HandleObject, HandleValue, HandleValue,
michael@0:                                    bool strict);
michael@0: typedef bool (*SetElementParFn)(ForkJoinContext *, HandleObject, HandleValue, HandleValue, bool);
michael@0: static const VMFunctionsModal SetObjectElementInfo = VMFunctionsModal(
michael@0:     FunctionInfo<SetObjectElementFn>(SetObjectElement),
michael@0:     FunctionInfo<SetElementParFn>(SetElementPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallSetElement(LCallSetElement *lir)
michael@0: {
michael@0:     pushArg(Imm32(current->mir()->strict()));
michael@0:     pushArg(ToValue(lir, LCallSetElement::Value));
michael@0:     pushArg(ToValue(lir, LCallSetElement::Index));
michael@0:     pushArg(ToRegister(lir->getOperand(0)));
michael@0:     return callVM(SetObjectElementInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*InitElementArrayFn)(JSContext *, jsbytecode *, HandleObject, uint32_t, HandleValue);
michael@0: static const VMFunction InitElementArrayInfo = FunctionInfo<InitElementArrayFn>(js::InitElementArray);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallInitElementArray(LCallInitElementArray *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LCallInitElementArray::Value));
michael@0:     pushArg(Imm32(lir->mir()->index()));
michael@0:     pushArg(ToRegister(lir->getOperand(0)));
michael@0:     pushArg(ImmPtr(lir->mir()->resumePoint()->pc()));
michael@0:     return callVM(InitElementArrayInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadFixedSlotV(LLoadFixedSlotV *ins)
michael@0: {
michael@0:     const Register obj = ToRegister(ins->getOperand(0));
michael@0:     size_t slot = ins->mir()->slot();
michael@0:     ValueOperand result = GetValueOutput(ins);
michael@0: 
michael@0:     masm.loadValue(Address(obj, JSObject::getFixedSlotOffset(slot)), result);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadFixedSlotT(LLoadFixedSlotT *ins)
michael@0: {
michael@0:     const Register obj = ToRegister(ins->getOperand(0));
michael@0:     size_t slot = ins->mir()->slot();
michael@0:     AnyRegister result = ToAnyRegister(ins->getDef(0));
michael@0:     MIRType type = ins->mir()->type();
michael@0: 
michael@0:     masm.loadUnboxedValue(Address(obj, JSObject::getFixedSlotOffset(slot)), type, result);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreFixedSlotV(LStoreFixedSlotV *ins)
michael@0: {
michael@0:     const Register obj = ToRegister(ins->getOperand(0));
michael@0:     size_t slot = ins->mir()->slot();
michael@0: 
michael@0:     const ValueOperand value = ToValue(ins, LStoreFixedSlotV::Value);
michael@0: 
michael@0:     Address address(obj, JSObject::getFixedSlotOffset(slot));
michael@0:     if (ins->mir()->needsBarrier())
michael@0:         emitPreBarrier(address, MIRType_Value);
michael@0: 
michael@0:     masm.storeValue(value, address);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreFixedSlotT(LStoreFixedSlotT *ins)
michael@0: {
michael@0:     const Register obj = ToRegister(ins->getOperand(0));
michael@0:     size_t slot = ins->mir()->slot();
michael@0: 
michael@0:     const LAllocation *value = ins->value();
michael@0:     MIRType valueType = ins->mir()->value()->type();
michael@0: 
michael@0:     ConstantOrRegister nvalue = value->isConstant()
michael@0:                               ? ConstantOrRegister(*value->toConstant())
michael@0:                               : TypedOrValueRegister(valueType, ToAnyRegister(value));
michael@0: 
michael@0:     Address address(obj, JSObject::getFixedSlotOffset(slot));
michael@0:     if (ins->mir()->needsBarrier())
michael@0:         emitPreBarrier(address, MIRType_Value);
michael@0: 
michael@0:     masm.storeConstantOrRegister(nvalue, address);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallsiteCloneCache(LCallsiteCloneCache *ins)
michael@0: {
michael@0:     const MCallsiteCloneCache *mir = ins->mir();
michael@0:     Register callee = ToRegister(ins->callee());
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     CallsiteCloneIC cache(callee, mir->block()->info().script(), mir->callPc(), output);
michael@0:     return addCache(ins, allocateCache(cache));
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*CallsiteCloneICFn)(JSContext *, size_t, HandleObject);
michael@0: const VMFunction CallsiteCloneIC::UpdateInfo =
michael@0:     FunctionInfo<CallsiteCloneICFn>(CallsiteCloneIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallsiteCloneIC(OutOfLineUpdateCache *ool, DataPtr<CallsiteCloneIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->calleeReg());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(CallsiteCloneIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreRegisterTo(ic->outputReg()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreRegisterTo(ic->outputReg()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetNameCache(LGetNameCache *ins)
michael@0: {
michael@0:     RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:     Register scopeChain = ToRegister(ins->scopeObj());
michael@0:     TypedOrValueRegister output(GetValueOutput(ins));
michael@0:     bool isTypeOf = ins->mir()->accessKind() != MGetNameCache::NAME;
michael@0: 
michael@0:     NameIC cache(liveRegs, isTypeOf, scopeChain, ins->mir()->name(), output);
michael@0:     return addCache(ins, allocateCache(cache));
michael@0: }
michael@0: 
michael@0: typedef bool (*NameICFn)(JSContext *, size_t, HandleObject, MutableHandleValue);
michael@0: const VMFunction NameIC::UpdateInfo = FunctionInfo<NameICFn>(NameIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitNameIC(OutOfLineUpdateCache *ool, DataPtr<NameIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->scopeChainReg());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(NameIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreValueTo(ic->outputReg()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreValueTo(ic->outputReg()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::addGetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Register objReg,
michael@0:                                    PropertyName *name, TypedOrValueRegister output,
michael@0:                                    bool monitoredResult)
michael@0: {
michael@0:     switch (gen->info().executionMode()) {
michael@0:       case SequentialExecution: {
michael@0:         GetPropertyIC cache(liveRegs, objReg, name, output, monitoredResult);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       case ParallelExecution: {
michael@0:         GetPropertyParIC cache(objReg, name, output);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Bad execution mode");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::addSetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Register objReg,
michael@0:                                    PropertyName *name, ConstantOrRegister value, bool strict,
michael@0:                                    bool needsTypeBarrier)
michael@0: {
michael@0:     switch (gen->info().executionMode()) {
michael@0:       case SequentialExecution: {
michael@0:           SetPropertyIC cache(liveRegs, objReg, name, value, strict, needsTypeBarrier);
michael@0:           return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       case ParallelExecution: {
michael@0:           SetPropertyParIC cache(objReg, name, value, strict, needsTypeBarrier);
michael@0:           return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Bad execution mode");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::addSetElementCache(LInstruction *ins, Register obj, Register unboxIndex,
michael@0:                                   Register temp, FloatRegister tempFloat, ValueOperand index,
michael@0:                                   ConstantOrRegister value, bool strict, bool guardHoles)
michael@0: {
michael@0:     switch (gen->info().executionMode()) {
michael@0:       case SequentialExecution: {
michael@0:         SetElementIC cache(obj, unboxIndex, temp, tempFloat, index, value, strict,
michael@0:                            guardHoles);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       case ParallelExecution: {
michael@0:         SetElementParIC cache(obj, unboxIndex, temp, tempFloat, index, value, strict,
michael@0:                               guardHoles);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("Bad execution mode");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyCacheV(LGetPropertyCacheV *ins)
michael@0: {
michael@0:     RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:     Register objReg = ToRegister(ins->getOperand(0));
michael@0:     PropertyName *name = ins->mir()->name();
michael@0:     bool monitoredResult = ins->mir()->monitoredResult();
michael@0:     TypedOrValueRegister output = TypedOrValueRegister(GetValueOutput(ins));
michael@0: 
michael@0:     return addGetPropertyCache(ins, liveRegs, objReg, name, output, monitoredResult);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyCacheT(LGetPropertyCacheT *ins)
michael@0: {
michael@0:     RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:     Register objReg = ToRegister(ins->getOperand(0));
michael@0:     PropertyName *name = ins->mir()->name();
michael@0:     bool monitoredResult = ins->mir()->monitoredResult();
michael@0:     TypedOrValueRegister output(ins->mir()->type(), ToAnyRegister(ins->getDef(0)));
michael@0: 
michael@0:     return addGetPropertyCache(ins, liveRegs, objReg, name, output, monitoredResult);
michael@0: }
michael@0: 
michael@0: typedef bool (*GetPropertyICFn)(JSContext *, size_t, HandleObject, MutableHandleValue);
michael@0: const VMFunction GetPropertyIC::UpdateInfo =
michael@0:     FunctionInfo<GetPropertyICFn>(GetPropertyIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyIC(OutOfLineUpdateCache *ool, DataPtr<GetPropertyIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0: 
michael@0:     if (ic->idempotent()) {
michael@0:         size_t numLocs;
michael@0:         CacheLocationList &cacheLocs = lir->mirRaw()->toGetPropertyCache()->location();
michael@0:         size_t locationBase = addCacheLocations(cacheLocs, &numLocs);
michael@0:         ic->setLocationInfo(locationBase, numLocs);
michael@0:     }
michael@0: 
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(GetPropertyIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreValueTo(ic->output()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreValueTo(ic->output()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*GetPropertyParICFn)(ForkJoinContext *, size_t, HandleObject, MutableHandleValue);
michael@0: const VMFunction GetPropertyParIC::UpdateInfo =
michael@0:     FunctionInfo<GetPropertyParICFn>(GetPropertyParIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetPropertyParIC(OutOfLineUpdateCache *ool, DataPtr<GetPropertyParIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(GetPropertyParIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreValueTo(ic->output()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreValueTo(ic->output()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::addGetElementCache(LInstruction *ins, Register obj, ConstantOrRegister index,
michael@0:                                   TypedOrValueRegister output, bool monitoredResult,
michael@0:                                   bool allowDoubleResult)
michael@0: {
michael@0:     switch (gen->info().executionMode()) {
michael@0:       case SequentialExecution: {
michael@0:         RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:         GetElementIC cache(liveRegs, obj, index, output, monitoredResult, allowDoubleResult);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       case ParallelExecution: {
michael@0:         GetElementParIC cache(obj, index, output, monitoredResult, allowDoubleResult);
michael@0:         return addCache(ins, allocateCache(cache));
michael@0:       }
michael@0:       default:
michael@0:         MOZ_ASSUME_UNREACHABLE("No such execution mode");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetElementCacheV(LGetElementCacheV *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->object());
michael@0:     ConstantOrRegister index = TypedOrValueRegister(ToValue(ins, LGetElementCacheV::Index));
michael@0:     TypedOrValueRegister output = TypedOrValueRegister(GetValueOutput(ins));
michael@0:     const MGetElementCache *mir = ins->mir();
michael@0: 
michael@0:     return addGetElementCache(ins, obj, index, output, mir->monitoredResult(), mir->allowDoubleResult());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetElementCacheT(LGetElementCacheT *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->object());
michael@0:     ConstantOrRegister index = TypedOrValueRegister(MIRType_Int32, ToAnyRegister(ins->index()));
michael@0:     TypedOrValueRegister output(ins->mir()->type(), ToAnyRegister(ins->output()));
michael@0:     const MGetElementCache *mir = ins->mir();
michael@0: 
michael@0:     return addGetElementCache(ins, obj, index, output, mir->monitoredResult(), mir->allowDoubleResult());
michael@0: }
michael@0: 
michael@0: typedef bool (*GetElementICFn)(JSContext *, size_t, HandleObject, HandleValue, MutableHandleValue);
michael@0: const VMFunction GetElementIC::UpdateInfo =
michael@0:     FunctionInfo<GetElementICFn>(GetElementIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetElementIC(OutOfLineUpdateCache *ool, DataPtr<GetElementIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->index());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(GetElementIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreValueTo(ic->output()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreValueTo(ic->output()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetElementCacheV(LSetElementCacheV *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->object());
michael@0:     Register unboxIndex = ToTempUnboxRegister(ins->tempToUnboxIndex());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     FloatRegister tempFloat = ToFloatRegister(ins->tempFloat());
michael@0:     ValueOperand index = ToValue(ins, LSetElementCacheV::Index);
michael@0:     ConstantOrRegister value = TypedOrValueRegister(ToValue(ins, LSetElementCacheV::Value));
michael@0: 
michael@0:     return addSetElementCache(ins, obj, unboxIndex, temp, tempFloat, index, value,
michael@0:                               ins->mir()->strict(), ins->mir()->guardHoles());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetElementCacheT(LSetElementCacheT *ins)
michael@0: {
michael@0:     Register obj = ToRegister(ins->object());
michael@0:     Register unboxIndex = ToTempUnboxRegister(ins->tempToUnboxIndex());
michael@0:     Register temp = ToRegister(ins->temp());
michael@0:     FloatRegister tempFloat = ToFloatRegister(ins->tempFloat());
michael@0:     ValueOperand index = ToValue(ins, LSetElementCacheT::Index);
michael@0:     ConstantOrRegister value;
michael@0:     const LAllocation *tmp = ins->value();
michael@0:     if (tmp->isConstant())
michael@0:         value = *tmp->toConstant();
michael@0:     else
michael@0:         value = TypedOrValueRegister(ins->mir()->value()->type(), ToAnyRegister(tmp));
michael@0: 
michael@0:     return addSetElementCache(ins, obj, unboxIndex, temp, tempFloat, index, value,
michael@0:                               ins->mir()->strict(), ins->mir()->guardHoles());
michael@0: }
michael@0: 
michael@0: typedef bool (*SetElementICFn)(JSContext *, size_t, HandleObject, HandleValue, HandleValue);
michael@0: const VMFunction SetElementIC::UpdateInfo =
michael@0:     FunctionInfo<SetElementICFn>(SetElementIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetElementIC(OutOfLineUpdateCache *ool, DataPtr<SetElementIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->value());
michael@0:     pushArg(ic->index());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(SetElementIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     restoreLive(lir);
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*SetElementParICFn)(ForkJoinContext *, size_t, HandleObject, HandleValue, HandleValue);
michael@0: const VMFunction SetElementParIC::UpdateInfo =
michael@0:     FunctionInfo<SetElementParICFn>(SetElementParIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetElementParIC(OutOfLineUpdateCache *ool, DataPtr<SetElementParIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->value());
michael@0:     pushArg(ic->index());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(SetElementParIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     restoreLive(lir);
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*GetElementParICFn)(ForkJoinContext *, size_t, HandleObject, HandleValue,
michael@0:                                   MutableHandleValue);
michael@0: const VMFunction GetElementParIC::UpdateInfo =
michael@0:     FunctionInfo<GetElementParICFn>(GetElementParIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetElementParIC(OutOfLineUpdateCache *ool, DataPtr<GetElementParIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->index());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(GetElementParIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreValueTo(ic->output()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreValueTo(ic->output()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBindNameCache(LBindNameCache *ins)
michael@0: {
michael@0:     Register scopeChain = ToRegister(ins->scopeChain());
michael@0:     Register output = ToRegister(ins->output());
michael@0:     BindNameIC cache(scopeChain, ins->mir()->name(), output);
michael@0: 
michael@0:     return addCache(ins, allocateCache(cache));
michael@0: }
michael@0: 
michael@0: typedef JSObject *(*BindNameICFn)(JSContext *, size_t, HandleObject);
michael@0: const VMFunction BindNameIC::UpdateInfo =
michael@0:     FunctionInfo<BindNameICFn>(BindNameIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBindNameIC(OutOfLineUpdateCache *ool, DataPtr<BindNameIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->scopeChainReg());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(BindNameIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     StoreRegisterTo(ic->outputReg()).generate(this);
michael@0:     restoreLiveIgnore(lir, StoreRegisterTo(ic->outputReg()).clobbered());
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*SetPropertyFn)(JSContext *, HandleObject,
michael@0:                               HandlePropertyName, const HandleValue, bool, jsbytecode *);
michael@0: typedef bool (*SetPropertyParFn)(ForkJoinContext *, HandleObject,
michael@0:                                  HandlePropertyName, const HandleValue, bool, jsbytecode *);
michael@0: static const VMFunctionsModal SetPropertyInfo = VMFunctionsModal(
michael@0:     FunctionInfo<SetPropertyFn>(SetProperty),
michael@0:     FunctionInfo<SetPropertyParFn>(SetPropertyPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallSetProperty(LCallSetProperty *ins)
michael@0: {
michael@0:     ConstantOrRegister value = TypedOrValueRegister(ToValue(ins, LCallSetProperty::Value));
michael@0: 
michael@0:     const Register objReg = ToRegister(ins->getOperand(0));
michael@0: 
michael@0:     pushArg(ImmPtr(ins->mir()->resumePoint()->pc()));
michael@0:     pushArg(Imm32(ins->mir()->strict()));
michael@0: 
michael@0:     pushArg(value);
michael@0:     pushArg(ImmGCPtr(ins->mir()->name()));
michael@0:     pushArg(objReg);
michael@0: 
michael@0:     return callVM(SetPropertyInfo, ins);
michael@0: }
michael@0: 
michael@0: typedef bool (*DeletePropertyFn)(JSContext *, HandleValue, HandlePropertyName, bool *);
michael@0: static const VMFunction DeletePropertyStrictInfo =
michael@0:     FunctionInfo<DeletePropertyFn>(DeleteProperty<true>);
michael@0: static const VMFunction DeletePropertyNonStrictInfo =
michael@0:     FunctionInfo<DeletePropertyFn>(DeleteProperty<false>);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallDeleteProperty(LCallDeleteProperty *lir)
michael@0: {
michael@0:     pushArg(ImmGCPtr(lir->mir()->name()));
michael@0:     pushArg(ToValue(lir, LCallDeleteProperty::Value));
michael@0: 
michael@0:     if (lir->mir()->block()->info().script()->strict())
michael@0:         return callVM(DeletePropertyStrictInfo, lir);
michael@0: 
michael@0:     return callVM(DeletePropertyNonStrictInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*DeleteElementFn)(JSContext *, HandleValue, HandleValue, bool *);
michael@0: static const VMFunction DeleteElementStrictInfo =
michael@0:     FunctionInfo<DeleteElementFn>(DeleteElement<true>);
michael@0: static const VMFunction DeleteElementNonStrictInfo =
michael@0:     FunctionInfo<DeleteElementFn>(DeleteElement<false>);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallDeleteElement(LCallDeleteElement *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LCallDeleteElement::Index));
michael@0:     pushArg(ToValue(lir, LCallDeleteElement::Value));
michael@0: 
michael@0:     if (lir->mir()->block()->info().script()->strict())
michael@0:         return callVM(DeleteElementStrictInfo, lir);
michael@0: 
michael@0:     return callVM(DeleteElementNonStrictInfo, lir);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyCacheV(LSetPropertyCacheV *ins)
michael@0: {
michael@0:     RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:     Register objReg = ToRegister(ins->getOperand(0));
michael@0:     ConstantOrRegister value = TypedOrValueRegister(ToValue(ins, LSetPropertyCacheV::Value));
michael@0: 
michael@0:     return addSetPropertyCache(ins, liveRegs, objReg, ins->mir()->name(), value,
michael@0:                                ins->mir()->strict(), ins->mir()->needsTypeBarrier());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyCacheT(LSetPropertyCacheT *ins)
michael@0: {
michael@0:     RegisterSet liveRegs = ins->safepoint()->liveRegs();
michael@0:     Register objReg = ToRegister(ins->getOperand(0));
michael@0:     ConstantOrRegister value;
michael@0: 
michael@0:     if (ins->getOperand(1)->isConstant())
michael@0:         value = ConstantOrRegister(*ins->getOperand(1)->toConstant());
michael@0:     else
michael@0:         value = TypedOrValueRegister(ins->valueType(), ToAnyRegister(ins->getOperand(1)));
michael@0: 
michael@0:     return addSetPropertyCache(ins, liveRegs, objReg, ins->mir()->name(), value,
michael@0:                                ins->mir()->strict(), ins->mir()->needsTypeBarrier());
michael@0: }
michael@0: 
michael@0: typedef bool (*SetPropertyICFn)(JSContext *, size_t, HandleObject, HandleValue);
michael@0: const VMFunction SetPropertyIC::UpdateInfo =
michael@0:     FunctionInfo<SetPropertyICFn>(SetPropertyIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyIC(OutOfLineUpdateCache *ool, DataPtr<SetPropertyIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->value());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(SetPropertyIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     restoreLive(lir);
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*SetPropertyParICFn)(ForkJoinContext *, size_t, HandleObject, HandleValue);
michael@0: const VMFunction SetPropertyParIC::UpdateInfo =
michael@0:     FunctionInfo<SetPropertyParICFn>(SetPropertyParIC::update);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetPropertyParIC(OutOfLineUpdateCache *ool, DataPtr<SetPropertyParIC> &ic)
michael@0: {
michael@0:     LInstruction *lir = ool->lir();
michael@0:     saveLive(lir);
michael@0: 
michael@0:     pushArg(ic->value());
michael@0:     pushArg(ic->object());
michael@0:     pushArg(Imm32(ool->getCacheIndex()));
michael@0:     if (!callVM(SetPropertyParIC::UpdateInfo, lir))
michael@0:         return false;
michael@0:     restoreLive(lir);
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*ThrowFn)(JSContext *, HandleValue);
michael@0: static const VMFunction ThrowInfoCodeGen = FunctionInfo<ThrowFn>(js::Throw);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitThrow(LThrow *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LThrow::Value));
michael@0:     return callVM(ThrowInfoCodeGen, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*BitNotFn)(JSContext *, HandleValue, int *p);
michael@0: typedef bool (*BitNotParFn)(ForkJoinContext *, HandleValue, int32_t *);
michael@0: static const VMFunctionsModal BitNotInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitNotFn>(BitNot),
michael@0:     FunctionInfo<BitNotParFn>(BitNotPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBitNotV(LBitNotV *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LBitNotV::Input));
michael@0:     return callVM(BitNotInfo, lir);
michael@0: }
michael@0: 
michael@0: typedef bool (*BitopFn)(JSContext *, HandleValue, HandleValue, int *p);
michael@0: typedef bool (*BitopParFn)(ForkJoinContext *, HandleValue, HandleValue, int32_t *);
michael@0: static const VMFunctionsModal BitAndInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitopFn>(BitAnd),
michael@0:     FunctionInfo<BitopParFn>(BitAndPar));
michael@0: static const VMFunctionsModal BitOrInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitopFn>(BitOr),
michael@0:     FunctionInfo<BitopParFn>(BitOrPar));
michael@0: static const VMFunctionsModal BitXorInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitopFn>(BitXor),
michael@0:     FunctionInfo<BitopParFn>(BitXorPar));
michael@0: static const VMFunctionsModal BitLhsInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitopFn>(BitLsh),
michael@0:     FunctionInfo<BitopParFn>(BitLshPar));
michael@0: static const VMFunctionsModal BitRhsInfo = VMFunctionsModal(
michael@0:     FunctionInfo<BitopFn>(BitRsh),
michael@0:     FunctionInfo<BitopParFn>(BitRshPar));
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitBitOpV(LBitOpV *lir)
michael@0: {
michael@0:     pushArg(ToValue(lir, LBitOpV::RhsInput));
michael@0:     pushArg(ToValue(lir, LBitOpV::LhsInput));
michael@0: 
michael@0:     switch (lir->jsop()) {
michael@0:       case JSOP_BITAND:
michael@0:         return callVM(BitAndInfo, lir);
michael@0:       case JSOP_BITOR:
michael@0:         return callVM(BitOrInfo, lir);
michael@0:       case JSOP_BITXOR:
michael@0:         return callVM(BitXorInfo, lir);
michael@0:       case JSOP_LSH:
michael@0:         return callVM(BitLhsInfo, lir);
michael@0:       case JSOP_RSH:
michael@0:         return callVM(BitRhsInfo, lir);
michael@0:       default:
michael@0:         break;
michael@0:     }
michael@0:     MOZ_ASSUME_UNREACHABLE("unexpected bitop");
michael@0: }
michael@0: 
michael@0: class OutOfLineTypeOfV : public OutOfLineCodeBase<CodeGenerator>
michael@0: {
michael@0:     LTypeOfV *ins_;
michael@0: 
michael@0:   public:
michael@0:     OutOfLineTypeOfV(LTypeOfV *ins)
michael@0:       : ins_(ins)
michael@0:     { }
michael@0: 
michael@0:     bool accept(CodeGenerator *codegen) {
michael@0:         return codegen->visitOutOfLineTypeOfV(this);
michael@0:     }
michael@0:     LTypeOfV *ins() const {
michael@0:         return ins_;
michael@0:     }
michael@0: };
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitTypeOfV(LTypeOfV *lir)
michael@0: {
michael@0:     const ValueOperand value = ToValue(lir, LTypeOfV::Input);
michael@0:     Register output = ToRegister(lir->output());
michael@0:     Register tag = masm.splitTagForTest(value);
michael@0: 
michael@0:     const JSAtomState &names = GetIonContext()->runtime->names();
michael@0:     Label done;
michael@0: 
michael@0:     OutOfLineTypeOfV *ool = nullptr;
michael@0:     if (lir->mir()->inputMaybeCallableOrEmulatesUndefined()) {
michael@0:         // The input may be a callable object (result is "function") or may
michael@0:         // emulate undefined (result is "undefined"). Use an OOL path.
michael@0:         ool = new(alloc()) OutOfLineTypeOfV(lir);
michael@0:         if (!addOutOfLineCode(ool))
michael@0:             return false;
michael@0: 
michael@0:         masm.branchTestObject(Assembler::Equal, tag, ool->entry());
michael@0:     } else {
michael@0:         // Input is not callable and does not emulate undefined, so if
michael@0:         // it's an object the result is always "object".
michael@0:         Label notObject;
michael@0:         masm.branchTestObject(Assembler::NotEqual, tag, &notObject);
michael@0:         masm.movePtr(ImmGCPtr(names.object), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notObject);
michael@0:     }
michael@0: 
michael@0:     Label notNumber;
michael@0:     masm.branchTestNumber(Assembler::NotEqual, tag, &notNumber);
michael@0:     masm.movePtr(ImmGCPtr(names.number), output);
michael@0:     masm.jump(&done);
michael@0:     masm.bind(&notNumber);
michael@0: 
michael@0:     Label notUndefined;
michael@0:     masm.branchTestUndefined(Assembler::NotEqual, tag, &notUndefined);
michael@0:     masm.movePtr(ImmGCPtr(names.undefined), output);
michael@0:     masm.jump(&done);
michael@0:     masm.bind(&notUndefined);
michael@0: 
michael@0:     Label notNull;
michael@0:     masm.branchTestNull(Assembler::NotEqual, tag, &notNull);
michael@0:     masm.movePtr(ImmGCPtr(names.object), output);
michael@0:     masm.jump(&done);
michael@0:     masm.bind(&notNull);
michael@0: 
michael@0:     Label notBoolean;
michael@0:     masm.branchTestBoolean(Assembler::NotEqual, tag, &notBoolean);
michael@0:     masm.movePtr(ImmGCPtr(names.boolean), output);
michael@0:     masm.jump(&done);
michael@0:     masm.bind(&notBoolean);
michael@0: 
michael@0:     masm.movePtr(ImmGCPtr(names.string), output);
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     if (ool)
michael@0:         masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineTypeOfV(OutOfLineTypeOfV *ool)
michael@0: {
michael@0:     LTypeOfV *ins = ool->ins();
michael@0: 
michael@0:     ValueOperand input = ToValue(ins, LTypeOfV::Input);
michael@0:     Register temp = ToTempUnboxRegister(ins->tempToUnbox());
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     Register obj = masm.extractObject(input, temp);
michael@0: 
michael@0:     saveVolatile(output);
michael@0:     masm.setupUnalignedABICall(2, output);
michael@0:     masm.passABIArg(obj);
michael@0:     masm.movePtr(ImmPtr(GetIonContext()->runtime), output);
michael@0:     masm.passABIArg(output);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, js::TypeOfObjectOperation));
michael@0:     masm.storeCallResult(output);
michael@0:     restoreVolatile(output);
michael@0: 
michael@0:     masm.jump(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*ToIdFn)(JSContext *, HandleScript, jsbytecode *, HandleValue, HandleValue,
michael@0:                        MutableHandleValue);
michael@0: static const VMFunction ToIdInfo = FunctionInfo<ToIdFn>(ToIdOperation);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitToIdV(LToIdV *lir)
michael@0: {
michael@0:     Label notInt32;
michael@0:     FloatRegister temp = ToFloatRegister(lir->tempFloat());
michael@0:     const ValueOperand out = ToOutValue(lir);
michael@0:     ValueOperand index = ToValue(lir, LToIdV::Index);
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(ToIdInfo, lir,
michael@0:                                    (ArgList(),
michael@0:                                    ImmGCPtr(current->mir()->info().script()),
michael@0:                                    ImmPtr(lir->mir()->resumePoint()->pc()),
michael@0:                                    ToValue(lir, LToIdV::Object),
michael@0:                                    ToValue(lir, LToIdV::Index)),
michael@0:                                    StoreValueTo(out));
michael@0: 
michael@0:     Register tag = masm.splitTagForTest(index);
michael@0: 
michael@0:     masm.branchTestInt32(Assembler::NotEqual, tag, &notInt32);
michael@0:     masm.moveValue(index, out);
michael@0:     masm.jump(ool->rejoin());
michael@0: 
michael@0:     masm.bind(&notInt32);
michael@0:     masm.branchTestDouble(Assembler::NotEqual, tag, ool->entry());
michael@0:     masm.unboxDouble(index, temp);
michael@0:     masm.convertDoubleToInt32(temp, out.scratchReg(), ool->entry(), true);
michael@0:     masm.tagValue(JSVAL_TYPE_INT32, out.scratchReg(), out);
michael@0: 
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadElementV(LLoadElementV *load)
michael@0: {
michael@0:     Register elements = ToRegister(load->elements());
michael@0:     const ValueOperand out = ToOutValue(load);
michael@0: 
michael@0:     if (load->index()->isConstant())
michael@0:         masm.loadValue(Address(elements, ToInt32(load->index()) * sizeof(Value)), out);
michael@0:     else
michael@0:         masm.loadValue(BaseIndex(elements, ToRegister(load->index()), TimesEight), out);
michael@0: 
michael@0:     if (load->mir()->needsHoleCheck()) {
michael@0:         Label testMagic;
michael@0:         masm.branchTestMagic(Assembler::Equal, out, &testMagic);
michael@0:         if (!bailoutFrom(&testMagic, load->snapshot()))
michael@0:             return false;
michael@0:     }
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadElementHole(LLoadElementHole *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     Register initLength = ToRegister(lir->initLength());
michael@0:     const ValueOperand out = ToOutValue(lir);
michael@0: 
michael@0:     const MLoadElementHole *mir = lir->mir();
michael@0: 
michael@0:     // If the index is out of bounds, load |undefined|. Otherwise, load the
michael@0:     // value.
michael@0:     Label undefined, done;
michael@0:     if (lir->index()->isConstant()) {
michael@0:         masm.branch32(Assembler::BelowOrEqual, initLength, Imm32(ToInt32(lir->index())), &undefined);
michael@0:         masm.loadValue(Address(elements, ToInt32(lir->index()) * sizeof(Value)), out);
michael@0:     } else {
michael@0:         masm.branch32(Assembler::BelowOrEqual, initLength, ToRegister(lir->index()), &undefined);
michael@0:         masm.loadValue(BaseIndex(elements, ToRegister(lir->index()), TimesEight), out);
michael@0:     }
michael@0: 
michael@0:     // If a hole check is needed, and the value wasn't a hole, we're done.
michael@0:     // Otherwise, we'll load undefined.
michael@0:     if (lir->mir()->needsHoleCheck())
michael@0:         masm.branchTestMagic(Assembler::NotEqual, out, &done);
michael@0:     else
michael@0:         masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&undefined);
michael@0: 
michael@0:     if (mir->needsNegativeIntCheck()) {
michael@0:         if (lir->index()->isConstant()) {
michael@0:             if (ToInt32(lir->index()) < 0 && !bailout(lir->snapshot()))
michael@0:                 return false;
michael@0:         } else {
michael@0:             Label negative;
michael@0:             masm.branch32(Assembler::LessThan, ToRegister(lir->index()), Imm32(0), &negative);
michael@0:             if (!bailoutFrom(&negative, lir->snapshot()))
michael@0:                 return false;
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     masm.moveValue(UndefinedValue(), out);
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadTypedArrayElement(LLoadTypedArrayElement *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     Register temp = lir->temp()->isBogusTemp() ? InvalidReg : ToRegister(lir->temp());
michael@0:     AnyRegister out = ToAnyRegister(lir->output());
michael@0: 
michael@0:     int arrayType = lir->mir()->arrayType();
michael@0:     int width = TypedArrayObject::slotWidth(arrayType);
michael@0: 
michael@0:     Label fail;
michael@0:     if (lir->index()->isConstant()) {
michael@0:         Address source(elements, ToInt32(lir->index()) * width);
michael@0:         masm.loadFromTypedArray(arrayType, source, out, temp, &fail);
michael@0:     } else {
michael@0:         BaseIndex source(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
michael@0:         masm.loadFromTypedArray(arrayType, source, out, temp, &fail);
michael@0:     }
michael@0: 
michael@0:     if (fail.used() && !bailoutFrom(&fail, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitLoadTypedArrayElementHole(LLoadTypedArrayElementHole *lir)
michael@0: {
michael@0:     Register object = ToRegister(lir->object());
michael@0:     const ValueOperand out = ToOutValue(lir);
michael@0: 
michael@0:     // Load the length.
michael@0:     Register scratch = out.scratchReg();
michael@0:     Int32Key key = ToInt32Key(lir->index());
michael@0:     masm.unboxInt32(Address(object, TypedArrayObject::lengthOffset()), scratch);
michael@0: 
michael@0:     // Load undefined unless length > key.
michael@0:     Label inbounds, done;
michael@0:     masm.branchKey(Assembler::Above, scratch, key, &inbounds);
michael@0:     masm.moveValue(UndefinedValue(), out);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     // Load the elements vector.
michael@0:     masm.bind(&inbounds);
michael@0:     masm.loadPtr(Address(object, TypedArrayObject::dataOffset()), scratch);
michael@0: 
michael@0:     int arrayType = lir->mir()->arrayType();
michael@0:     int width = TypedArrayObject::slotWidth(arrayType);
michael@0: 
michael@0:     Label fail;
michael@0:     if (key.isConstant()) {
michael@0:         Address source(scratch, key.constant() * width);
michael@0:         masm.loadFromTypedArray(arrayType, source, out, lir->mir()->allowDouble(),
michael@0:                                 out.scratchReg(), &fail);
michael@0:     } else {
michael@0:         BaseIndex source(scratch, key.reg(), ScaleFromElemWidth(width));
michael@0:         masm.loadFromTypedArray(arrayType, source, out, lir->mir()->allowDouble(),
michael@0:                                 out.scratchReg(), &fail);
michael@0:     }
michael@0: 
michael@0:     if (fail.used() && !bailoutFrom(&fail, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: template <typename T>
michael@0: static inline void
michael@0: StoreToTypedArray(MacroAssembler &masm, int arrayType, const LAllocation *value, const T &dest)
michael@0: {
michael@0:     if (arrayType == ScalarTypeDescr::TYPE_FLOAT32 ||
michael@0:         arrayType == ScalarTypeDescr::TYPE_FLOAT64)
michael@0:     {
michael@0:         masm.storeToTypedFloatArray(arrayType, ToFloatRegister(value), dest);
michael@0:     } else {
michael@0:         if (value->isConstant())
michael@0:             masm.storeToTypedIntArray(arrayType, Imm32(ToInt32(value)), dest);
michael@0:         else
michael@0:             masm.storeToTypedIntArray(arrayType, ToRegister(value), dest);
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreTypedArrayElement(LStoreTypedArrayElement *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     const LAllocation *value = lir->value();
michael@0: 
michael@0:     int arrayType = lir->mir()->arrayType();
michael@0:     int width = TypedArrayObject::slotWidth(arrayType);
michael@0: 
michael@0:     if (lir->index()->isConstant()) {
michael@0:         Address dest(elements, ToInt32(lir->index()) * width);
michael@0:         StoreToTypedArray(masm, arrayType, value, dest);
michael@0:     } else {
michael@0:         BaseIndex dest(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
michael@0:         StoreToTypedArray(masm, arrayType, value, dest);
michael@0:     }
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitStoreTypedArrayElementHole(LStoreTypedArrayElementHole *lir)
michael@0: {
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     const LAllocation *value = lir->value();
michael@0: 
michael@0:     int arrayType = lir->mir()->arrayType();
michael@0:     int width = TypedArrayObject::slotWidth(arrayType);
michael@0: 
michael@0:     bool guardLength = true;
michael@0:     if (lir->index()->isConstant() && lir->length()->isConstant()) {
michael@0:         uint32_t idx = ToInt32(lir->index());
michael@0:         uint32_t len = ToInt32(lir->length());
michael@0:         if (idx >= len)
michael@0:             return true;
michael@0:         guardLength = false;
michael@0:     }
michael@0:     Label skip;
michael@0:     if (lir->index()->isConstant()) {
michael@0:         uint32_t idx = ToInt32(lir->index());
michael@0:         if (guardLength)
michael@0:             masm.branch32(Assembler::BelowOrEqual, ToOperand(lir->length()), Imm32(idx), &skip);
michael@0:         Address dest(elements, idx * width);
michael@0:         StoreToTypedArray(masm, arrayType, value, dest);
michael@0:     } else {
michael@0:         Register idxReg = ToRegister(lir->index());
michael@0:         JS_ASSERT(guardLength);
michael@0:         if (lir->length()->isConstant())
michael@0:             masm.branch32(Assembler::AboveOrEqual, idxReg, Imm32(ToInt32(lir->length())), &skip);
michael@0:         else
michael@0:             masm.branch32(Assembler::BelowOrEqual, ToOperand(lir->length()), idxReg, &skip);
michael@0:         BaseIndex dest(elements, ToRegister(lir->index()), ScaleFromElemWidth(width));
michael@0:         StoreToTypedArray(masm, arrayType, value, dest);
michael@0:     }
michael@0:     if (guardLength)
michael@0:         masm.bind(&skip);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitClampIToUint8(LClampIToUint8 *lir)
michael@0: {
michael@0:     Register output = ToRegister(lir->output());
michael@0:     JS_ASSERT(output == ToRegister(lir->input()));
michael@0:     masm.clampIntToUint8(output);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitClampDToUint8(LClampDToUint8 *lir)
michael@0: {
michael@0:     FloatRegister input = ToFloatRegister(lir->input());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     masm.clampDoubleToUint8(input, output);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitClampVToUint8(LClampVToUint8 *lir)
michael@0: {
michael@0:     ValueOperand operand = ToValue(lir, LClampVToUint8::Input);
michael@0:     FloatRegister tempFloat = ToFloatRegister(lir->tempFloat());
michael@0:     Register output = ToRegister(lir->output());
michael@0:     MDefinition *input = lir->mir()->input();
michael@0: 
michael@0:     Label *stringEntry, *stringRejoin;
michael@0:     if (input->mightBeType(MIRType_String)) {
michael@0:         OutOfLineCode *oolString = oolCallVM(StringToNumberInfo, lir, (ArgList(), output),
michael@0:                                              StoreFloatRegisterTo(tempFloat));
michael@0:         if (!oolString)
michael@0:             return false;
michael@0:         stringEntry = oolString->entry();
michael@0:         stringRejoin = oolString->rejoin();
michael@0:     } else {
michael@0:         stringEntry = nullptr;
michael@0:         stringRejoin = nullptr;
michael@0:     }
michael@0: 
michael@0:     Label fails;
michael@0:     masm.clampValueToUint8(operand, input,
michael@0:                            stringEntry, stringRejoin,
michael@0:                            output, tempFloat, output, &fails);
michael@0: 
michael@0:     if (!bailoutFrom(&fails, lir->snapshot()))
michael@0:         return false;
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*OperatorInFn)(JSContext *, HandleValue, HandleObject, bool *);
michael@0: static const VMFunction OperatorInInfo = FunctionInfo<OperatorInFn>(OperatorIn);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIn(LIn *ins)
michael@0: {
michael@0:     pushArg(ToRegister(ins->rhs()));
michael@0:     pushArg(ToValue(ins, LIn::LHS));
michael@0: 
michael@0:     return callVM(OperatorInInfo, ins);
michael@0: }
michael@0: 
michael@0: typedef bool (*OperatorInIFn)(JSContext *, uint32_t, HandleObject, bool *);
michael@0: static const VMFunction OperatorInIInfo = FunctionInfo<OperatorInIFn>(OperatorInI);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInArray(LInArray *lir)
michael@0: {
michael@0:     const MInArray *mir = lir->mir();
michael@0:     Register elements = ToRegister(lir->elements());
michael@0:     Register initLength = ToRegister(lir->initLength());
michael@0:     Register output = ToRegister(lir->output());
michael@0: 
michael@0:     // When the array is not packed we need to do a hole check in addition to the bounds check.
michael@0:     Label falseBranch, done, trueBranch;
michael@0: 
michael@0:     OutOfLineCode *ool = nullptr;
michael@0:     Label* failedInitLength = &falseBranch;
michael@0: 
michael@0:     if (lir->index()->isConstant()) {
michael@0:         int32_t index = ToInt32(lir->index());
michael@0: 
michael@0:         JS_ASSERT_IF(index < 0, mir->needsNegativeIntCheck());
michael@0:         if (mir->needsNegativeIntCheck()) {
michael@0:             ool = oolCallVM(OperatorInIInfo, lir,
michael@0:                             (ArgList(), Imm32(index), ToRegister(lir->object())),
michael@0:                             StoreRegisterTo(output));
michael@0:             failedInitLength = ool->entry();
michael@0:         }
michael@0: 
michael@0:         masm.branch32(Assembler::BelowOrEqual, initLength, Imm32(index), failedInitLength);
michael@0:         if (mir->needsHoleCheck()) {
michael@0:             Address address = Address(elements, index * sizeof(Value));
michael@0:             masm.branchTestMagic(Assembler::Equal, address, &falseBranch);
michael@0:         }
michael@0:     } else {
michael@0:         Label negativeIntCheck;
michael@0:         Register index = ToRegister(lir->index());
michael@0: 
michael@0:         if (mir->needsNegativeIntCheck())
michael@0:             failedInitLength = &negativeIntCheck;
michael@0: 
michael@0:         masm.branch32(Assembler::BelowOrEqual, initLength, index, failedInitLength);
michael@0:         if (mir->needsHoleCheck()) {
michael@0:             BaseIndex address = BaseIndex(elements, ToRegister(lir->index()), TimesEight);
michael@0:             masm.branchTestMagic(Assembler::Equal, address, &falseBranch);
michael@0:         }
michael@0:         masm.jump(&trueBranch);
michael@0: 
michael@0:         if (mir->needsNegativeIntCheck()) {
michael@0:             masm.bind(&negativeIntCheck);
michael@0:             ool = oolCallVM(OperatorInIInfo, lir,
michael@0:                             (ArgList(), index, ToRegister(lir->object())),
michael@0:                             StoreRegisterTo(output));
michael@0: 
michael@0:             masm.branch32(Assembler::LessThan, index, Imm32(0), ool->entry());
michael@0:             masm.jump(&falseBranch);
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     masm.bind(&trueBranch);
michael@0:     masm.move32(Imm32(1), output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&falseBranch);
michael@0:     masm.move32(Imm32(0), output);
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     if (ool)
michael@0:         masm.bind(ool->rejoin());
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInstanceOfO(LInstanceOfO *ins)
michael@0: {
michael@0:     return emitInstanceOf(ins, ins->mir()->prototypeObject());
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitInstanceOfV(LInstanceOfV *ins)
michael@0: {
michael@0:     return emitInstanceOf(ins, ins->mir()->prototypeObject());
michael@0: }
michael@0: 
michael@0: // Wrap IsDelegateOfObject, which takes a JSObject*, not a HandleObject
michael@0: static bool
michael@0: IsDelegateObject(JSContext *cx, HandleObject protoObj, HandleObject obj, bool *res)
michael@0: {
michael@0:     return IsDelegateOfObject(cx, protoObj, obj, res);
michael@0: }
michael@0: 
michael@0: typedef bool (*IsDelegateObjectFn)(JSContext *, HandleObject, HandleObject, bool *);
michael@0: static const VMFunction IsDelegateObjectInfo = FunctionInfo<IsDelegateObjectFn>(IsDelegateObject);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitInstanceOf(LInstruction *ins, JSObject *prototypeObject)
michael@0: {
michael@0:     // This path implements fun_hasInstance when the function's prototype is
michael@0:     // known to be prototypeObject.
michael@0: 
michael@0:     Label done;
michael@0:     Register output = ToRegister(ins->getDef(0));
michael@0: 
michael@0:     // If the lhs is a primitive, the result is false.
michael@0:     Register objReg;
michael@0:     if (ins->isInstanceOfV()) {
michael@0:         Label isObject;
michael@0:         ValueOperand lhsValue = ToValue(ins, LInstanceOfV::LHS);
michael@0:         masm.branchTestObject(Assembler::Equal, lhsValue, &isObject);
michael@0:         masm.mov(ImmWord(0), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&isObject);
michael@0:         objReg = masm.extractObject(lhsValue, output);
michael@0:     } else {
michael@0:         objReg = ToRegister(ins->toInstanceOfO()->lhs());
michael@0:     }
michael@0: 
michael@0:     // Crawl the lhs's prototype chain in a loop to search for prototypeObject.
michael@0:     // This follows the main loop of js::IsDelegate, though additionally breaks
michael@0:     // out of the loop on Proxy::LazyProto.
michael@0: 
michael@0:     // Load the lhs's prototype.
michael@0:     masm.loadObjProto(objReg, output);
michael@0: 
michael@0:     Label testLazy;
michael@0:     {
michael@0:         Label loopPrototypeChain;
michael@0:         masm.bind(&loopPrototypeChain);
michael@0: 
michael@0:         // Test for the target prototype object.
michael@0:         Label notPrototypeObject;
michael@0:         masm.branchPtr(Assembler::NotEqual, output, ImmGCPtr(prototypeObject), &notPrototypeObject);
michael@0:         masm.mov(ImmWord(1), output);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&notPrototypeObject);
michael@0: 
michael@0:         JS_ASSERT(uintptr_t(TaggedProto::LazyProto) == 1);
michael@0: 
michael@0:         // Test for nullptr or Proxy::LazyProto
michael@0:         masm.branchPtr(Assembler::BelowOrEqual, output, ImmWord(1), &testLazy);
michael@0: 
michael@0:         // Load the current object's prototype.
michael@0:         masm.loadObjProto(output, output);
michael@0: 
michael@0:         masm.jump(&loopPrototypeChain);
michael@0:     }
michael@0: 
michael@0:     // Make a VM call if an object with a lazy proto was found on the prototype
michael@0:     // chain. This currently occurs only for cross compartment wrappers, which
michael@0:     // we do not expect to be compared with non-wrapper functions from this
michael@0:     // compartment. Otherwise, we stopped on a nullptr prototype and the output
michael@0:     // register is already correct.
michael@0: 
michael@0:     OutOfLineCode *ool = oolCallVM(IsDelegateObjectInfo, ins,
michael@0:                                    (ArgList(), ImmGCPtr(prototypeObject), objReg),
michael@0:                                    StoreRegisterTo(output));
michael@0: 
michael@0:     // Regenerate the original lhs object for the VM call.
michael@0:     Label regenerate, *lazyEntry;
michael@0:     if (objReg != output) {
michael@0:         lazyEntry = ool->entry();
michael@0:     } else {
michael@0:         masm.bind(&regenerate);
michael@0:         lazyEntry = &regenerate;
michael@0:         if (ins->isInstanceOfV()) {
michael@0:             ValueOperand lhsValue = ToValue(ins, LInstanceOfV::LHS);
michael@0:             objReg = masm.extractObject(lhsValue, output);
michael@0:         } else {
michael@0:             objReg = ToRegister(ins->toInstanceOfO()->lhs());
michael@0:         }
michael@0:         JS_ASSERT(objReg == output);
michael@0:         masm.jump(ool->entry());
michael@0:     }
michael@0: 
michael@0:     masm.bind(&testLazy);
michael@0:     masm.branchPtr(Assembler::Equal, output, ImmWord(1), lazyEntry);
michael@0: 
michael@0:     masm.bind(&done);
michael@0:     masm.bind(ool->rejoin());
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*HasInstanceFn)(JSContext *, HandleObject, HandleValue, bool *);
michael@0: static const VMFunction HasInstanceInfo = FunctionInfo<HasInstanceFn>(js::HasInstance);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitCallInstanceOf(LCallInstanceOf *ins)
michael@0: {
michael@0:     ValueOperand lhs = ToValue(ins, LCallInstanceOf::LHS);
michael@0:     Register rhs = ToRegister(ins->rhs());
michael@0:     JS_ASSERT(ToRegister(ins->output()) == ReturnReg);
michael@0: 
michael@0:     pushArg(lhs);
michael@0:     pushArg(rhs);
michael@0:     return callVM(HasInstanceInfo, ins);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetDOMProperty(LGetDOMProperty *ins)
michael@0: {
michael@0:     const Register JSContextReg = ToRegister(ins->getJSContextReg());
michael@0:     const Register ObjectReg = ToRegister(ins->getObjectReg());
michael@0:     const Register PrivateReg = ToRegister(ins->getPrivReg());
michael@0:     const Register ValueReg = ToRegister(ins->getValueReg());
michael@0: 
michael@0:     DebugOnly<uint32_t> initialStack = masm.framePushed();
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // Make space for the outparam.  Pre-initialize it to UndefinedValue so we
michael@0:     // can trace it at GC time.
michael@0:     masm.Push(UndefinedValue());
michael@0:     // We pass the pointer to our out param as an instance of
michael@0:     // JSJitGetterCallArgs, since on the binary level it's the same thing.
michael@0:     JS_STATIC_ASSERT(sizeof(JSJitGetterCallArgs) == sizeof(Value*));
michael@0:     masm.movePtr(StackPointer, ValueReg);
michael@0: 
michael@0:     masm.Push(ObjectReg);
michael@0: 
michael@0:     // GetReservedSlot(obj, DOM_OBJECT_SLOT).toPrivate()
michael@0:     masm.loadPrivate(Address(ObjectReg, JSObject::getFixedSlotOffset(0)), PrivateReg);
michael@0: 
michael@0:     // Rooting will happen at GC time.
michael@0:     masm.movePtr(StackPointer, ObjectReg);
michael@0: 
michael@0:     uint32_t safepointOffset;
michael@0:     if (!masm.buildFakeExitFrame(JSContextReg, &safepointOffset))
michael@0:         return false;
michael@0:     masm.enterFakeExitFrame(ION_FRAME_DOMGETTER);
michael@0: 
michael@0:     if (!markSafepointAt(safepointOffset, ins))
michael@0:         return false;
michael@0: 
michael@0:     masm.setupUnalignedABICall(4, JSContextReg);
michael@0: 
michael@0:     masm.loadJSContext(JSContextReg);
michael@0: 
michael@0:     masm.passABIArg(JSContextReg);
michael@0:     masm.passABIArg(ObjectReg);
michael@0:     masm.passABIArg(PrivateReg);
michael@0:     masm.passABIArg(ValueReg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ins->mir()->fun()));
michael@0: 
michael@0:     if (ins->mir()->isInfallible()) {
michael@0:         masm.loadValue(Address(StackPointer, IonDOMExitFrameLayout::offsetOfResult()),
michael@0:                        JSReturnOperand);
michael@0:     } else {
michael@0:         masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
michael@0: 
michael@0:         masm.loadValue(Address(StackPointer, IonDOMExitFrameLayout::offsetOfResult()),
michael@0:                        JSReturnOperand);
michael@0:     }
michael@0:     masm.adjustStack(IonDOMExitFrameLayout::Size());
michael@0: 
michael@0:     JS_ASSERT(masm.framePushed() == initialStack);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitGetDOMMember(LGetDOMMember *ins)
michael@0: {
michael@0:     // It's simple to duplicate visitLoadFixedSlotV here than it is to try to
michael@0:     // use an LLoadFixedSlotV or some subclass of it for this case: that would
michael@0:     // require us to have MGetDOMMember inherit from MLoadFixedSlot, and then
michael@0:     // we'd have to duplicate a bunch of stuff we now get for free from
michael@0:     // MGetDOMProperty.
michael@0:     Register object = ToRegister(ins->object());
michael@0:     size_t slot = ins->mir()->domMemberSlotIndex();
michael@0:     ValueOperand result = GetValueOutput(ins);
michael@0: 
michael@0:     masm.loadValue(Address(object, JSObject::getFixedSlotOffset(slot)), result);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitSetDOMProperty(LSetDOMProperty *ins)
michael@0: {
michael@0:     const Register JSContextReg = ToRegister(ins->getJSContextReg());
michael@0:     const Register ObjectReg = ToRegister(ins->getObjectReg());
michael@0:     const Register PrivateReg = ToRegister(ins->getPrivReg());
michael@0:     const Register ValueReg = ToRegister(ins->getValueReg());
michael@0: 
michael@0:     DebugOnly<uint32_t> initialStack = masm.framePushed();
michael@0: 
michael@0:     masm.checkStackAlignment();
michael@0: 
michael@0:     // Push the argument. Rooting will happen at GC time.
michael@0:     ValueOperand argVal = ToValue(ins, LSetDOMProperty::Value);
michael@0:     masm.Push(argVal);
michael@0:     // We pass the pointer to our out param as an instance of
michael@0:     // JSJitGetterCallArgs, since on the binary level it's the same thing.
michael@0:     JS_STATIC_ASSERT(sizeof(JSJitSetterCallArgs) == sizeof(Value*));
michael@0:     masm.movePtr(StackPointer, ValueReg);
michael@0: 
michael@0:     masm.Push(ObjectReg);
michael@0: 
michael@0:     // GetReservedSlot(obj, DOM_OBJECT_SLOT).toPrivate()
michael@0:     masm.loadPrivate(Address(ObjectReg, JSObject::getFixedSlotOffset(0)), PrivateReg);
michael@0: 
michael@0:     // Rooting will happen at GC time.
michael@0:     masm.movePtr(StackPointer, ObjectReg);
michael@0: 
michael@0:     uint32_t safepointOffset;
michael@0:     if (!masm.buildFakeExitFrame(JSContextReg, &safepointOffset))
michael@0:         return false;
michael@0:     masm.enterFakeExitFrame(ION_FRAME_DOMSETTER);
michael@0: 
michael@0:     if (!markSafepointAt(safepointOffset, ins))
michael@0:         return false;
michael@0: 
michael@0:     masm.setupUnalignedABICall(4, JSContextReg);
michael@0: 
michael@0:     masm.loadJSContext(JSContextReg);
michael@0: 
michael@0:     masm.passABIArg(JSContextReg);
michael@0:     masm.passABIArg(ObjectReg);
michael@0:     masm.passABIArg(PrivateReg);
michael@0:     masm.passABIArg(ValueReg);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, ins->mir()->fun()));
michael@0: 
michael@0:     masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
michael@0: 
michael@0:     masm.adjustStack(IonDOMExitFrameLayout::Size());
michael@0: 
michael@0:     JS_ASSERT(masm.framePushed() == initialStack);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool(*SPSFn)(JSContext *, HandleScript);
michael@0: static const VMFunction SPSEnterInfo = FunctionInfo<SPSFn>(SPSEnter);
michael@0: static const VMFunction SPSExitInfo = FunctionInfo<SPSFn>(SPSExit);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitProfilerStackOp(LProfilerStackOp *lir)
michael@0: {
michael@0:     Register temp = ToRegister(lir->temp()->output());
michael@0:     bool inlinedFunction = lir->inlineLevel() > 0;
michael@0: 
michael@0:     switch (lir->type()) {
michael@0:         case MProfilerStackOp::InlineEnter:
michael@0:             // Multiple scripts can be inlined at one depth, but there is only
michael@0:             // one InlineExit node to signify this. To deal with this, if we
michael@0:             // reach the entry of another inline script on the same level, then
michael@0:             // just reset the sps metadata about the frame. We must balance
michael@0:             // calls to leave()/reenter(), so perform the balance without
michael@0:             // emitting any instrumentation. Technically the previous inline
michael@0:             // call at this same depth has reentered, but the instrumentation
michael@0:             // will be emitted at the common join point for all inlines at the
michael@0:             // same depth.
michael@0:             if (sps_.inliningDepth() == lir->inlineLevel()) {
michael@0:                 sps_.leaveInlineFrame();
michael@0:                 sps_.skipNextReenter();
michael@0:                 sps_.reenter(masm, temp);
michael@0:             }
michael@0: 
michael@0:             sps_.leave(masm, temp, /* inlinedFunction = */ true);
michael@0:             if (!sps_.enterInlineFrame())
michael@0:                 return false;
michael@0:             // fallthrough
michael@0: 
michael@0:         case MProfilerStackOp::Enter:
michael@0:             if (gen->options.spsSlowAssertionsEnabled()) {
michael@0:                 if (!inlinedFunction || js_JitOptions.profileInlineFrames) {
michael@0:                     saveLive(lir);
michael@0:                     pushArg(ImmGCPtr(lir->script()));
michael@0:                     if (!callVM(SPSEnterInfo, lir))
michael@0:                         return false;
michael@0:                     restoreLive(lir);
michael@0:                 }
michael@0:                 sps_.pushManual(lir->script(), masm, temp, /* inlinedFunction = */ inlinedFunction);
michael@0:                 return true;
michael@0:             }
michael@0: 
michael@0:             return sps_.push(lir->script(), masm, temp, /* inlinedFunction = */ inlinedFunction);
michael@0: 
michael@0:         case MProfilerStackOp::InlineExit:
michael@0:             // all inline returns were covered with ::Exit, so we just need to
michael@0:             // maintain the state of inline frames currently active and then
michael@0:             // reenter the caller
michael@0:             sps_.leaveInlineFrame();
michael@0:             sps_.reenter(masm, temp, /* inlinedFunction = */ true);
michael@0:             return true;
michael@0: 
michael@0:         case MProfilerStackOp::Exit:
michael@0:             if (gen->options.spsSlowAssertionsEnabled()) {
michael@0:                 if (!inlinedFunction || js_JitOptions.profileInlineFrames) {
michael@0:                     saveLive(lir);
michael@0:                     pushArg(ImmGCPtr(lir->script()));
michael@0:                     // Once we've exited, then we shouldn't emit instrumentation for
michael@0:                     // the corresponding reenter() because we no longer have a
michael@0:                     // frame.
michael@0:                     sps_.skipNextReenter();
michael@0:                     if (!callVM(SPSExitInfo, lir))
michael@0:                         return false;
michael@0:                     restoreLive(lir);
michael@0:                 }
michael@0:                 return true;
michael@0:             }
michael@0: 
michael@0:             sps_.pop(masm, temp, /* inlinedFunction = */ inlinedFunction);
michael@0:             return true;
michael@0: 
michael@0:         default:
michael@0:             MOZ_ASSUME_UNREACHABLE("invalid LProfilerStackOp type");
michael@0:     }
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLineAbortPar(OutOfLineAbortPar *ool)
michael@0: {
michael@0:     ParallelBailoutCause cause = ool->cause();
michael@0:     jsbytecode *bytecode = ool->bytecode();
michael@0: 
michael@0:     masm.move32(Imm32(cause), CallTempReg0);
michael@0:     loadOutermostJSScript(CallTempReg1);
michael@0:     loadJSScriptForBlock(ool->basicBlock(), CallTempReg2);
michael@0:     masm.movePtr(ImmPtr(bytecode), CallTempReg3);
michael@0: 
michael@0:     masm.setupUnalignedABICall(4, CallTempReg4);
michael@0:     masm.passABIArg(CallTempReg0);
michael@0:     masm.passABIArg(CallTempReg1);
michael@0:     masm.passABIArg(CallTempReg2);
michael@0:     masm.passABIArg(CallTempReg3);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, AbortPar));
michael@0: 
michael@0:     masm.moveValue(MagicValue(JS_ION_ERROR), JSReturnOperand);
michael@0:     masm.jump(&returnLabel_);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitIsCallable(LIsCallable *ins)
michael@0: {
michael@0:     Register object = ToRegister(ins->object());
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     masm.loadObjClass(object, output);
michael@0: 
michael@0:     // An object is callable iff (is<JSFunction>() || getClass()->call).
michael@0:     Label notFunction, done, notCall;
michael@0:     masm.branchPtr(Assembler::NotEqual, output, ImmPtr(&JSFunction::class_), &notFunction);
michael@0:     masm.move32(Imm32(1), output);
michael@0:     masm.jump(&done);
michael@0: 
michael@0:     masm.bind(&notFunction);
michael@0:     masm.cmpPtrSet(Assembler::NonZero, Address(output, offsetof(js::Class, call)), ImmPtr(nullptr), output);
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::loadOutermostJSScript(Register reg)
michael@0: {
michael@0:     // The "outermost" JSScript means the script that we are compiling
michael@0:     // basically; this is not always the script associated with the
michael@0:     // current basic block, which might be an inlined script.
michael@0: 
michael@0:     MIRGraph &graph = current->mir()->graph();
michael@0:     MBasicBlock *entryBlock = graph.entryBlock();
michael@0:     masm.movePtr(ImmGCPtr(entryBlock->info().script()), reg);
michael@0: }
michael@0: 
michael@0: void
michael@0: CodeGenerator::loadJSScriptForBlock(MBasicBlock *block, Register reg)
michael@0: {
michael@0:     // The current JSScript means the script for the current
michael@0:     // basic block. This may be an inlined script.
michael@0: 
michael@0:     JSScript *script = block->info().script();
michael@0:     masm.movePtr(ImmGCPtr(script), reg);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitOutOfLinePropagateAbortPar(OutOfLinePropagateAbortPar *ool)
michael@0: {
michael@0:     loadOutermostJSScript(CallTempReg0);
michael@0:     loadJSScriptForBlock(ool->lir()->mirRaw()->block(), CallTempReg1);
michael@0: 
michael@0:     masm.setupUnalignedABICall(2, CallTempReg2);
michael@0:     masm.passABIArg(CallTempReg0);
michael@0:     masm.passABIArg(CallTempReg1);
michael@0:     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, PropagateAbortPar));
michael@0: 
michael@0:     masm.moveValue(MagicValue(JS_ION_ERROR), JSReturnOperand);
michael@0:     masm.jump(&returnLabel_);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitHaveSameClass(LHaveSameClass *ins)
michael@0: {
michael@0:     Register lhs = ToRegister(ins->lhs());
michael@0:     Register rhs = ToRegister(ins->rhs());
michael@0:     Register temp = ToRegister(ins->getTemp(0));
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     masm.loadObjClass(lhs, temp);
michael@0:     masm.loadObjClass(rhs, output);
michael@0:     masm.cmpPtrSet(Assembler::Equal, temp, output, output);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitHasClass(LHasClass *ins)
michael@0: {
michael@0:     Register lhs = ToRegister(ins->lhs());
michael@0:     Register output = ToRegister(ins->output());
michael@0: 
michael@0:     masm.loadObjClass(lhs, output);
michael@0:     masm.cmpPtrSet(Assembler::Equal, output, ImmPtr(ins->mir()->getClass()), output);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAsmJSCall(LAsmJSCall *ins)
michael@0: {
michael@0:     MAsmJSCall *mir = ins->mir();
michael@0: 
michael@0: #if defined(JS_CODEGEN_ARM)
michael@0:     if (!useHardFpABI() && mir->callee().which() == MAsmJSCall::Callee::Builtin) {
michael@0:         for (unsigned i = 0, e = ins->numOperands(); i < e; i++) {
michael@0:             LAllocation *a = ins->getOperand(i);
michael@0:             if (a->isFloatReg()) {
michael@0:                 FloatRegister fr = ToFloatRegister(a);
michael@0:                 int srcId = fr.code() * 2;
michael@0:                 masm.ma_vxfer(fr, Register::FromCode(srcId), Register::FromCode(srcId+1));
michael@0:             }
michael@0:         }
michael@0:     }
michael@0: #endif
michael@0: 
michael@0:    if (mir->spIncrement())
michael@0:         masm.freeStack(mir->spIncrement());
michael@0: 
michael@0:    JS_ASSERT((AlignmentAtPrologue +  masm.framePushed()) % StackAlignment == 0);
michael@0: 
michael@0: #ifdef DEBUG
michael@0:     Label ok;
michael@0:     JS_ASSERT(IsPowerOfTwo(StackAlignment));
michael@0:     masm.branchTestPtr(Assembler::Zero, StackPointer, Imm32(StackAlignment - 1), &ok);
michael@0:     masm.assumeUnreachable("Stack should be aligned.");
michael@0:     masm.bind(&ok);
michael@0: #endif
michael@0: 
michael@0:     MAsmJSCall::Callee callee = mir->callee();
michael@0:     switch (callee.which()) {
michael@0:       case MAsmJSCall::Callee::Internal:
michael@0:         masm.call(mir->desc(), callee.internal());
michael@0:         break;
michael@0:       case MAsmJSCall::Callee::Dynamic:
michael@0:         masm.call(mir->desc(), ToRegister(ins->getOperand(mir->dynamicCalleeOperandIndex())));
michael@0:         break;
michael@0:       case MAsmJSCall::Callee::Builtin:
michael@0:         masm.call(mir->desc(), callee.builtin());
michael@0:         break;
michael@0:     }
michael@0: 
michael@0:     if (mir->spIncrement())
michael@0:         masm.reserveStack(mir->spIncrement());
michael@0: 
michael@0:     postAsmJSCall(ins);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAsmJSParameter(LAsmJSParameter *lir)
michael@0: {
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAsmJSReturn(LAsmJSReturn *lir)
michael@0: {
michael@0:     // Don't emit a jump to the return label if this is the last block.
michael@0:     if (current->mir() != *gen->graph().poBegin())
michael@0:         masm.jump(&returnLabel_);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAsmJSVoidReturn(LAsmJSVoidReturn *lir)
michael@0: {
michael@0:     // Don't emit a jump to the return label if this is the last block.
michael@0:     if (current->mir() != *gen->graph().poBegin())
michael@0:         masm.jump(&returnLabel_);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitAssertRangeI(const Range *r, Register input)
michael@0: {
michael@0:     // Check the lower bound.
michael@0:     if (r->hasInt32LowerBound() && r->lower() > INT32_MIN) {
michael@0:         Label success;
michael@0:         masm.branch32(Assembler::GreaterThanOrEqual, input, Imm32(r->lower()), &success);
michael@0:         masm.assumeUnreachable("Integer input should be equal or higher than Lowerbound.");
michael@0:         masm.bind(&success);
michael@0:     }
michael@0: 
michael@0:     // Check the upper bound.
michael@0:     if (r->hasInt32UpperBound() && r->upper() < INT32_MAX) {
michael@0:         Label success;
michael@0:         masm.branch32(Assembler::LessThanOrEqual, input, Imm32(r->upper()), &success);
michael@0:         masm.assumeUnreachable("Integer input should be lower or equal than Upperbound.");
michael@0:         masm.bind(&success);
michael@0:     }
michael@0: 
michael@0:     // For r->canHaveFractionalPart() and r->exponent(), there's nothing to check, because
michael@0:     // if we ended up in the integer range checking code, the value is already
michael@0:     // in an integer register in the integer range.
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::emitAssertRangeD(const Range *r, FloatRegister input, FloatRegister temp)
michael@0: {
michael@0:     // Check the lower bound.
michael@0:     if (r->hasInt32LowerBound()) {
michael@0:         Label success;
michael@0:         masm.loadConstantDouble(r->lower(), temp);
michael@0:         if (r->canBeNaN())
michael@0:             masm.branchDouble(Assembler::DoubleUnordered, input, input, &success);
michael@0:         masm.branchDouble(Assembler::DoubleGreaterThanOrEqual, input, temp, &success);
michael@0:         masm.assumeUnreachable("Double input should be equal or higher than Lowerbound.");
michael@0:         masm.bind(&success);
michael@0:     }
michael@0:     // Check the upper bound.
michael@0:     if (r->hasInt32UpperBound()) {
michael@0:         Label success;
michael@0:         masm.loadConstantDouble(r->upper(), temp);
michael@0:         if (r->canBeNaN())
michael@0:             masm.branchDouble(Assembler::DoubleUnordered, input, input, &success);
michael@0:         masm.branchDouble(Assembler::DoubleLessThanOrEqual, input, temp, &success);
michael@0:         masm.assumeUnreachable("Double input should be lower or equal than Upperbound.");
michael@0:         masm.bind(&success);
michael@0:     }
michael@0: 
michael@0:     // This code does not yet check r->canHaveFractionalPart(). This would require new
michael@0:     // assembler interfaces to make rounding instructions available.
michael@0: 
michael@0:     if (!r->hasInt32Bounds() && !r->canBeInfiniteOrNaN() &&
michael@0:         r->exponent() < FloatingPoint<double>::ExponentBias)
michael@0:     {
michael@0:         // Check the bounds implied by the maximum exponent.
michael@0:         Label exponentLoOk;
michael@0:         masm.loadConstantDouble(pow(2.0, r->exponent() + 1), temp);
michael@0:         masm.branchDouble(Assembler::DoubleUnordered, input, input, &exponentLoOk);
michael@0:         masm.branchDouble(Assembler::DoubleLessThanOrEqual, input, temp, &exponentLoOk);
michael@0:         masm.assumeUnreachable("Check for exponent failed.");
michael@0:         masm.bind(&exponentLoOk);
michael@0: 
michael@0:         Label exponentHiOk;
michael@0:         masm.loadConstantDouble(-pow(2.0, r->exponent() + 1), temp);
michael@0:         masm.branchDouble(Assembler::DoubleUnordered, input, input, &exponentHiOk);
michael@0:         masm.branchDouble(Assembler::DoubleGreaterThanOrEqual, input, temp, &exponentHiOk);
michael@0:         masm.assumeUnreachable("Check for exponent failed.");
michael@0:         masm.bind(&exponentHiOk);
michael@0:     } else if (!r->hasInt32Bounds() && !r->canBeNaN()) {
michael@0:         // If we think the value can't be NaN, check that it isn't.
michael@0:         Label notnan;
michael@0:         masm.branchDouble(Assembler::DoubleOrdered, input, input, &notnan);
michael@0:         masm.assumeUnreachable("Input shouldn't be NaN.");
michael@0:         masm.bind(&notnan);
michael@0: 
michael@0:         // If we think the value also can't be an infinity, check that it isn't.
michael@0:         if (!r->canBeInfiniteOrNaN()) {
michael@0:             Label notposinf;
michael@0:             masm.loadConstantDouble(PositiveInfinity<double>(), temp);
michael@0:             masm.branchDouble(Assembler::DoubleLessThan, input, temp, &notposinf);
michael@0:             masm.assumeUnreachable("Input shouldn't be +Inf.");
michael@0:             masm.bind(&notposinf);
michael@0: 
michael@0:             Label notneginf;
michael@0:             masm.loadConstantDouble(NegativeInfinity<double>(), temp);
michael@0:             masm.branchDouble(Assembler::DoubleGreaterThan, input, temp, &notneginf);
michael@0:             masm.assumeUnreachable("Input shouldn't be -Inf.");
michael@0:             masm.bind(&notneginf);
michael@0:         }
michael@0:     }
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAssertRangeI(LAssertRangeI *ins)
michael@0: {
michael@0:     Register input = ToRegister(ins->input());
michael@0:     const Range *r = ins->range();
michael@0: 
michael@0:     return emitAssertRangeI(r, input);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAssertRangeD(LAssertRangeD *ins)
michael@0: {
michael@0:     FloatRegister input = ToFloatRegister(ins->input());
michael@0:     FloatRegister temp = ToFloatRegister(ins->temp());
michael@0:     const Range *r = ins->range();
michael@0: 
michael@0:     return emitAssertRangeD(r, input, temp);
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAssertRangeF(LAssertRangeF *ins)
michael@0: {
michael@0:     FloatRegister input = ToFloatRegister(ins->input());
michael@0:     FloatRegister temp = ToFloatRegister(ins->temp());
michael@0:     const Range *r = ins->range();
michael@0: 
michael@0:     masm.convertFloat32ToDouble(input, input);
michael@0:     bool success = emitAssertRangeD(r, input, temp);
michael@0:     masm.convertDoubleToFloat32(input, input);
michael@0:     return success;
michael@0: }
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitAssertRangeV(LAssertRangeV *ins)
michael@0: {
michael@0:     const Range *r = ins->range();
michael@0:     const ValueOperand value = ToValue(ins, LAssertRangeV::Input);
michael@0:     Register tag = masm.splitTagForTest(value);
michael@0:     Label done;
michael@0: 
michael@0:     {
michael@0:         Label isNotInt32;
michael@0:         masm.branchTestInt32(Assembler::NotEqual, tag, &isNotInt32);
michael@0:         Register unboxInt32 = ToTempUnboxRegister(ins->temp());
michael@0:         Register input = masm.extractInt32(value, unboxInt32);
michael@0:         emitAssertRangeI(r, input);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&isNotInt32);
michael@0:     }
michael@0: 
michael@0:     {
michael@0:         Label isNotDouble;
michael@0:         masm.branchTestDouble(Assembler::NotEqual, tag, &isNotDouble);
michael@0:         FloatRegister input = ToFloatRegister(ins->floatTemp1());
michael@0:         FloatRegister temp = ToFloatRegister(ins->floatTemp2());
michael@0:         masm.unboxDouble(value, input);
michael@0:         emitAssertRangeD(r, input, temp);
michael@0:         masm.jump(&done);
michael@0:         masm.bind(&isNotDouble);
michael@0:     }
michael@0: 
michael@0:     masm.assumeUnreachable("Incorrect range for Value.");
michael@0:     masm.bind(&done);
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: typedef bool (*RecompileFn)(JSContext *);
michael@0: static const VMFunction RecompileFnInfo = FunctionInfo<RecompileFn>(Recompile);
michael@0: 
michael@0: bool
michael@0: CodeGenerator::visitRecompileCheck(LRecompileCheck *ins)
michael@0: {
michael@0:     Label done;
michael@0:     Register tmp = ToRegister(ins->scratch());
michael@0:     OutOfLineCode *ool = oolCallVM(RecompileFnInfo, ins, (ArgList()), StoreRegisterTo(tmp));
michael@0: 
michael@0:     // Check if usecount is high enough.
michael@0:     masm.movePtr(ImmPtr(ins->mir()->script()->addressOfUseCount()), tmp);
michael@0:     Address ptr(tmp, 0);
michael@0:     masm.add32(Imm32(1), tmp);
michael@0:     masm.branch32(Assembler::BelowOrEqual, ptr, Imm32(ins->mir()->useCount()), &done);
michael@0: 
michael@0:     // Check if not yet recompiling.
michael@0:     CodeOffsetLabel label = masm.movWithPatch(ImmWord(uintptr_t(-1)), tmp);
michael@0:     if (!ionScriptLabels_.append(label))
michael@0:         return false;
michael@0:     masm.branch32(Assembler::Equal,
michael@0:                   Address(tmp, IonScript::offsetOfRecompiling()),
michael@0:                   Imm32(0),
michael@0:                   ool->entry());
michael@0:     masm.bind(ool->rejoin());
michael@0:     masm.bind(&done);
michael@0: 
michael@0:     return true;
michael@0: }
michael@0: 
michael@0: } // namespace jit
michael@0: } // namespace js