blob: 288858b38c16a65a8c8ebdb9d43701283472a50a [file] [log] [blame]
/*
* Copyright (C) 2011-2017 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "config.h"
#include "DFGPredictionPropagationPhase.h"
#if ENABLE(DFG_JIT)
#include "DFGGraph.h"
#include "DFGPhase.h"
#include "JSCInlines.h"
namespace JSC { namespace DFG {
namespace {
bool verboseFixPointLoops = false;
class PredictionPropagationPhase : public Phase {
public:
PredictionPropagationPhase(Graph& graph)
: Phase(graph, "prediction propagation")
{
}
bool run()
{
ASSERT(m_graph.m_form == ThreadedCPS);
ASSERT(m_graph.m_unificationState == GloballyUnified);
m_pass = PrimaryPass;
propagateThroughArgumentPositions();
processInvariants();
propagateToFixpoint();
m_pass = RareCasePass;
propagateToFixpoint();
m_pass = DoubleVotingPass;
unsigned counter = 0;
do {
if (verboseFixPointLoops)
++counter;
m_changed = false;
doRoundOfDoubleVoting();
if (!m_changed)
break;
m_changed = false;
propagateForward();
} while (m_changed);
if (verboseFixPointLoops)
dataLog("Iterated ", counter, " times in double voting fixpoint.\n");
return true;
}
private:
void propagateToFixpoint()
{
unsigned counter = 0;
do {
if (verboseFixPointLoops)
++counter;
m_changed = false;
// Forward propagation is near-optimal for both topologically-sorted and
// DFS-sorted code.
propagateForward();
if (!m_changed)
break;
// Backward propagation reduces the likelihood that pathological code will
// cause slowness. Loops (especially nested ones) resemble backward flow.
// This pass captures two cases: (1) it detects if the forward fixpoint
// found a sound solution and (2) short-circuits backward flow.
m_changed = false;
propagateBackward();
} while (m_changed);
if (verboseFixPointLoops)
dataLog("Iterated ", counter, " times in propagateToFixpoint.\n");
}
bool setPrediction(SpeculatedType prediction)
{
ASSERT(m_currentNode->hasResult());
// setPrediction() is used when we know that there is no way that we can change
// our minds about what the prediction is going to be. There is no semantic
// difference between setPrediction() and mergeSpeculation() other than the
// increased checking to validate this property.
ASSERT(m_currentNode->prediction() == SpecNone || m_currentNode->prediction() == prediction);
return m_currentNode->predict(prediction);
}
bool mergePrediction(SpeculatedType prediction)
{
ASSERT(m_currentNode->hasResult());
return m_currentNode->predict(prediction);
}
SpeculatedType speculatedDoubleTypeForPrediction(SpeculatedType value)
{
SpeculatedType result = SpecDoubleReal;
if (value & SpecDoubleImpureNaN)
result |= SpecDoubleImpureNaN;
if (value & SpecDoublePureNaN)
result |= SpecDoublePureNaN;
if (!isFullNumberOrBooleanSpeculation(value))
result |= SpecDoublePureNaN;
return result;
}
SpeculatedType speculatedDoubleTypeForPredictions(SpeculatedType left, SpeculatedType right)
{
return speculatedDoubleTypeForPrediction(mergeSpeculations(left, right));
}
void propagate(Node* node)
{
NodeType op = node->op();
bool changed = false;
switch (op) {
case GetLocal: {
VariableAccessData* variable = node->variableAccessData();
SpeculatedType prediction = variable->prediction();
if (!variable->couldRepresentInt52() && (prediction & SpecNonInt32AsInt52))
prediction = (prediction | SpecAnyIntAsDouble) & ~SpecNonInt32AsInt52;
if (prediction)
changed |= mergePrediction(prediction);
break;
}
case SetLocal: {
VariableAccessData* variableAccessData = node->variableAccessData();
changed |= variableAccessData->predict(node->child1()->prediction());
break;
}
case UInt32ToNumber: {
if (node->canSpeculateInt32(m_pass))
changed |= mergePrediction(SpecInt32Only);
else if (enableInt52())
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(SpecBytecodeNumber);
break;
}
case ValueBitRShift:
case ValueBitLShift: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (isBigIntSpeculation(left) && isBigIntSpeculation(right))
changed |= mergePrediction(SpecBigInt);
else if (isFullNumberOrBooleanSpeculationExpectingDefined(left) && isFullNumberOrBooleanSpeculationExpectingDefined(right))
changed |= mergePrediction(SpecInt32Only);
else
changed |= mergePrediction(node->getHeapPrediction());
}
break;
}
case ValueAdd: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.addShouldSpeculateInt52(node))
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
} else if (isStringOrStringObjectSpeculation(left) || isStringOrStringObjectSpeculation(right)) {
// left or right is definitely something other than a number.
changed |= mergePrediction(SpecString);
} else if (isBigIntSpeculation(left) && isBigIntSpeculation(right))
changed |= mergePrediction(SpecBigInt);
else {
changed |= mergePrediction(SpecInt32Only);
if (node->mayHaveDoubleResult())
changed |= mergePrediction(SpecBytecodeDouble);
if (node->mayHaveBigIntResult())
changed |= mergePrediction(SpecBigInt);
if (node->mayHaveNonNumericResult())
changed |= mergePrediction(SpecString);
}
}
break;
}
case ArithAdd: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.addShouldSpeculateInt52(node))
changed |= mergePrediction(SpecInt52Any);
else if (isFullNumberOrBooleanSpeculation(left) && isFullNumberOrBooleanSpeculation(right))
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
else if (node->mayHaveNonIntResult() || (left & SpecBytecodeDouble) || (right & SpecBytecodeDouble))
changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
else
changed |= mergePrediction(SpecInt32Only);
}
break;
}
case ArithSub: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.addShouldSpeculateInt52(node))
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
} else if (node->mayHaveNonIntResult() || (left & SpecBytecodeDouble) || (right & SpecBytecodeDouble))
changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
else
changed |= mergePrediction(SpecInt32Only);
}
break;
}
case ValueSub: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
if (m_graph.addSpeculationMode(node, m_pass) != DontSpeculateInt32)
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.addShouldSpeculateInt52(node))
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
} else if (isBigIntSpeculation(left) && isBigIntSpeculation(right))
changed |= mergePrediction(SpecBigInt);
else {
changed |= mergePrediction(SpecInt32Only);
if (node->mayHaveDoubleResult())
changed |= mergePrediction(SpecBytecodeDouble);
if (node->mayHaveBigIntResult())
changed |= mergePrediction(SpecBigInt);
}
}
break;
}
case Inc:
case Dec: {
SpeculatedType prediction = node->child1()->prediction();
if (prediction) {
if (isFullNumberOrBooleanSpeculationExpectingDefined(prediction)) {
if (m_graph.unaryArithShouldSpeculateInt32(node, m_pass))
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.unaryArithShouldSpeculateInt52(node, m_pass))
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(speculatedDoubleTypeForPrediction(prediction));
} else if (isBigIntSpeculation(prediction))
changed |= mergePrediction(SpecBigInt);
else {
changed |= mergePrediction(SpecInt32Only);
if (node->mayHaveDoubleResult())
changed |= mergePrediction(SpecBytecodeDouble);
if (node->mayHaveBigIntResult())
changed |= mergePrediction(SpecBigInt);
}
}
break;
}
case ValuePow: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (node->child1()->shouldSpeculateBigInt() && node->child2()->shouldSpeculateBigInt())
changed |= mergePrediction(SpecBigInt);
else if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right))
changed |= mergePrediction(SpecBytecodeDouble);
else
changed |= mergePrediction(SpecBytecodeDouble | SpecBigInt);
}
break;
}
case ValueNegate:
case ArithNegate: {
SpeculatedType prediction = node->child1()->prediction();
if (prediction) {
if (isInt32OrBooleanSpeculation(prediction) && node->canSpeculateInt32(m_pass))
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.unaryArithShouldSpeculateInt52(node, m_pass))
changed |= mergePrediction(SpecInt52Any);
else if (isBytecodeNumberSpeculation(prediction))
changed |= mergePrediction(speculatedDoubleTypeForPrediction(node->child1()->prediction()));
else {
changed |= mergePrediction(SpecInt32Only);
if (node->op() == ValueNegate && node->mayHaveBigIntResult())
changed |= mergePrediction(SpecBigInt);
if (node->mayHaveDoubleResult())
changed |= mergePrediction(SpecBytecodeDouble);
}
}
break;
}
case ArithMin:
case ArithMax: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (Node::shouldSpeculateInt32OrBooleanForArithmetic(node->child1().node(), node->child2().node())
&& node->canSpeculateInt32(m_pass))
changed |= mergePrediction(SpecInt32Only);
else
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
}
break;
}
case ValueMul:
case ArithMul: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
// FIXME: We're currently relying on prediction propagation and backwards propagation
// whenever we can, and only falling back on result flags if that fails. And the result
// flags logic doesn't know how to use backwards propagation. We should get rid of the
// prediction propagation logic and rely solely on the result type.
if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
if (m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
changed |= mergePrediction(SpecInt32Only);
else if (m_graph.binaryArithShouldSpeculateInt52(node, m_pass))
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(speculatedDoubleTypeForPredictions(left, right));
} else if (op == ValueMul && isBigIntSpeculation(left) && isBigIntSpeculation(right))
changed |= mergePrediction(SpecBigInt);
else {
changed |= mergePrediction(SpecInt32Only);
if (node->mayHaveDoubleResult()
|| (left & SpecBytecodeDouble)
|| (right & SpecBytecodeDouble))
changed |= mergePrediction(SpecBytecodeDouble);
if ((op == ValueMul && node->mayHaveBigIntResult())
|| (left & SpecBigInt)
|| (right & SpecBigInt))
changed |= mergePrediction(SpecBigInt);
}
}
break;
}
case ValueDiv:
case ValueMod:
case ArithDiv:
case ArithMod: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
if (left && right) {
if (isFullNumberOrBooleanSpeculationExpectingDefined(left)
&& isFullNumberOrBooleanSpeculationExpectingDefined(right)) {
if (m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
changed |= mergePrediction(SpecInt32Only);
else
changed |= mergePrediction(SpecBytecodeDouble);
} else if ((op == ValueDiv || op == ValueMod) && isBigIntSpeculation(left) && isBigIntSpeculation(right))
changed |= mergePrediction(SpecBigInt);
else {
changed |= mergePrediction(SpecInt32Only | SpecBytecodeDouble);
if ((op == ValueDiv || op == ValueMod) && (node->mayHaveBigIntResult()
|| (left & SpecBigInt)
|| (right & SpecBigInt)))
changed |= mergePrediction(SpecBigInt);
}
}
break;
}
case ArithAbs: {
SpeculatedType childPrediction = node->child1()->prediction();
if (isInt32OrBooleanSpeculation(childPrediction)
&& node->canSpeculateInt32(m_pass))
changed |= mergePrediction(SpecInt32Only);
else
changed |= mergePrediction(SpecBytecodeDouble);
break;
}
case GetByVal:
case AtomicsAdd:
case AtomicsAnd:
case AtomicsCompareExchange:
case AtomicsExchange:
case AtomicsLoad:
case AtomicsOr:
case AtomicsStore:
case AtomicsSub:
case AtomicsXor: {
Edge child1 = m_graph.child(node, 0);
if (!child1->prediction())
break;
Edge child2 = m_graph.child(node, 1);
ArrayMode arrayMode = node->arrayMode().refine(
m_graph, node,
child1->prediction(),
child2->prediction(),
SpecNone);
switch (arrayMode.type()) {
case Array::Int32:
if (arrayMode.isOutOfBounds())
changed |= mergePrediction(node->getHeapPrediction() | SpecInt32Only);
else
changed |= mergePrediction(SpecInt32Only);
break;
case Array::Double:
if (arrayMode.isOutOfBounds())
changed |= mergePrediction(node->getHeapPrediction() | SpecDoubleReal);
else if (node->getHeapPrediction() & SpecNonIntAsDouble)
changed |= mergePrediction(SpecDoubleReal);
else
changed |= mergePrediction(SpecAnyIntAsDouble);
break;
case Array::Float32Array:
case Array::Float64Array:
changed |= mergePrediction(SpecFullDouble);
break;
case Array::Uint32Array:
if (isInt32SpeculationForArithmetic(node->getHeapPrediction()) && node->op() == GetByVal)
changed |= mergePrediction(SpecInt32Only);
else if (enableInt52())
changed |= mergePrediction(SpecInt52Any);
else
changed |= mergePrediction(SpecInt32Only | SpecAnyIntAsDouble);
break;
case Array::Int8Array:
case Array::Uint8Array:
case Array::Int16Array:
case Array::Uint16Array:
case Array::Int32Array:
changed |= mergePrediction(SpecInt32Only);
break;
default:
changed |= mergePrediction(node->getHeapPrediction());
break;
}
break;
}
case ToThis: {
// ToThis in methods for primitive types should speculate primitive types in strict mode.
bool isStrictMode = m_graph.isStrictModeFor(node->origin.semantic);
if (isStrictMode) {
if (node->child1()->shouldSpeculateBoolean()) {
changed |= mergePrediction(SpecBoolean);
break;
}
if (node->child1()->shouldSpeculateInt32()) {
changed |= mergePrediction(SpecInt32Only);
break;
}
if (node->child1()->shouldSpeculateInt52()) {
changed |= mergePrediction(SpecInt52Any);
break;
}
if (node->child1()->shouldSpeculateNumber()) {
changed |= mergePrediction(SpecBytecodeNumber);
break;
}
if (node->child1()->shouldSpeculateSymbol()) {
changed |= mergePrediction(SpecSymbol);
break;
}
if (node->child1()->shouldSpeculateBigInt()) {
changed |= mergePrediction(SpecBigInt);
break;
}
if (node->child1()->shouldSpeculateStringIdent()) {
changed |= mergePrediction(SpecStringIdent);
break;
}
if (node->child1()->shouldSpeculateString()) {
changed |= mergePrediction(SpecString);
break;
}
} else {
if (node->child1()->shouldSpeculateString()) {
changed |= mergePrediction(SpecStringObject);
break;
}
}
SpeculatedType prediction = node->child1()->prediction();
if (isStrictMode)
changed |= mergePrediction(node->getHeapPrediction());
else if (prediction) {
if (prediction & ~SpecObject) {
// Wrapper objects are created only in sloppy mode.
prediction &= SpecObject;
prediction = mergeSpeculations(prediction, SpecObjectOther);
}
changed |= mergePrediction(prediction);
}
break;
}
case ToPrimitive: {
SpeculatedType child = node->child1()->prediction();
if (child)
changed |= mergePrediction(resultOfToPrimitive(child));
break;
}
case ToPropertyKey: {
SpeculatedType child = node->child1()->prediction();
if (child)
changed |= mergePrediction(resultOfToPropertyKey(child));
break;
}
case NormalizeMapKey: {
SpeculatedType prediction = node->child1()->prediction();
if (prediction)
changed |= mergePrediction(prediction);
break;
}
default:
break;
}
m_changed |= changed;
}
void propagateForward()
{
for (Node* node : m_dependentNodes) {
m_currentNode = node;
propagate(m_currentNode);
}
}
void propagateBackward()
{
for (unsigned i = m_dependentNodes.size(); i--;) {
m_currentNode = m_dependentNodes[i];
propagate(m_currentNode);
}
}
void doDoubleVoting(Node* node, float weight)
{
// Loop pre-headers created by OSR entrypoint creation may have NaN weight to indicate
// that we actually don't know they weight. Assume that they execute once. This turns
// out to be an OK assumption since the pre-header doesn't have any meaningful code.
if (weight != weight)
weight = 1;
switch (node->op()) {
case ValueAdd:
case ValueSub:
case ArithAdd:
case ArithSub: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
DoubleBallot ballot;
if (isFullNumberSpeculation(left)
&& isFullNumberSpeculation(right)
&& !m_graph.addShouldSpeculateInt32(node, m_pass)
&& !m_graph.addShouldSpeculateInt52(node))
ballot = VoteDouble;
else
ballot = VoteValue;
m_graph.voteNode(node->child1(), ballot, weight);
m_graph.voteNode(node->child2(), ballot, weight);
break;
}
case ValueMul:
case ArithMul: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
DoubleBallot ballot;
if (isFullNumberSpeculation(left)
&& isFullNumberSpeculation(right)
&& !m_graph.binaryArithShouldSpeculateInt32(node, m_pass)
&& !m_graph.binaryArithShouldSpeculateInt52(node, m_pass))
ballot = VoteDouble;
else
ballot = VoteValue;
m_graph.voteNode(node->child1(), ballot, weight);
m_graph.voteNode(node->child2(), ballot, weight);
break;
}
case ArithMin:
case ArithMax:
case ArithMod:
case ValueDiv:
case ValueMod:
case ArithDiv: {
SpeculatedType left = node->child1()->prediction();
SpeculatedType right = node->child2()->prediction();
DoubleBallot ballot;
if (isFullNumberSpeculation(left)
&& isFullNumberSpeculation(right)
&& !m_graph.binaryArithShouldSpeculateInt32(node, m_pass))
ballot = VoteDouble;
else
ballot = VoteValue;
m_graph.voteNode(node->child1(), ballot, weight);
m_graph.voteNode(node->child2(), ballot, weight);
break;
}
case ArithAbs:
DoubleBallot ballot;
if (node->child1()->shouldSpeculateNumber()
&& !m_graph.unaryArithShouldSpeculateInt32(node, m_pass))
ballot = VoteDouble;
else
ballot = VoteValue;
m_graph.voteNode(node->child1(), ballot, weight);
break;
case ArithSqrt:
case ArithUnary:
if (node->child1()->shouldSpeculateNumber())
m_graph.voteNode(node->child1(), VoteDouble, weight);
else
m_graph.voteNode(node->child1(), VoteValue, weight);
break;
case SetLocal: {
SpeculatedType prediction = node->child1()->prediction();
if (isDoubleSpeculation(prediction))
node->variableAccessData()->vote(VoteDouble, weight);
else if (!isFullNumberSpeculation(prediction) || isInt32OrInt52Speculation(prediction))
node->variableAccessData()->vote(VoteValue, weight);
break;
}
case PutByValDirect:
case PutByVal:
case PutByValAlias: {
Edge child1 = m_graph.varArgChild(node, 0);
Edge child2 = m_graph.varArgChild(node, 1);
Edge child3 = m_graph.varArgChild(node, 2);
m_graph.voteNode(child1, VoteValue, weight);
m_graph.voteNode(child2, VoteValue, weight);
switch (node->arrayMode().type()) {
case Array::Double:
m_graph.voteNode(child3, VoteDouble, weight);
break;
default:
m_graph.voteNode(child3, VoteValue, weight);
break;
}
break;
}
case DataViewSet: {
DataViewData data = node->dataViewData();
if (data.isFloatingPoint)
m_graph.voteNode(m_graph.varArgChild(node, 2), VoteValue, weight);
break;
}
case MovHint:
// Ignore these since they have no effect on in-DFG execution.
break;
default:
m_graph.voteChildren(node, VoteValue, weight);
break;
}
}
void doRoundOfDoubleVoting()
{
for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i)
m_graph.m_variableAccessData[i].find()->clearVotes();
for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
BasicBlock* block = m_graph.block(blockIndex);
if (!block)
continue;
ASSERT(block->isReachable);
for (unsigned i = 0; i < block->size(); ++i) {
m_currentNode = block->at(i);
doDoubleVoting(m_currentNode, block->executionCount);
}
}
for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
VariableAccessData* variableAccessData = &m_graph.m_variableAccessData[i];
if (!variableAccessData->isRoot())
continue;
m_changed |= variableAccessData->tallyVotesForShouldUseDoubleFormat();
}
propagateThroughArgumentPositions();
for (unsigned i = 0; i < m_graph.m_variableAccessData.size(); ++i) {
VariableAccessData* variableAccessData = &m_graph.m_variableAccessData[i];
if (!variableAccessData->isRoot())
continue;
m_changed |= variableAccessData->makePredictionForDoubleFormat();
}
}
void propagateThroughArgumentPositions()
{
for (unsigned i = 0; i < m_graph.m_argumentPositions.size(); ++i)
m_changed |= m_graph.m_argumentPositions[i].mergeArgumentPredictionAwareness();
}
// Sets any predictions that do not depends on other nodes.
void processInvariants()
{
for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
for (Node* node : *block) {
m_currentNode = node;
processInvariantsForNode();
}
}
}
void processInvariantsForNode()
{
switch (m_currentNode->op()) {
case JSConstant: {
SpeculatedType type = speculationFromValue(m_currentNode->asJSValue());
if (type == SpecAnyIntAsDouble && enableInt52())
type = int52AwareSpeculationFromValue(m_currentNode->asJSValue());
setPrediction(type);
break;
}
case DoubleConstant: {
SpeculatedType type = speculationFromValue(m_currentNode->asJSValue());
setPrediction(type);
break;
}
case ArithBitNot:
case ArithBitAnd:
case ArithBitOr:
case ArithBitXor:
case ArithBitRShift:
case ArithBitLShift:
case BitURShift:
case ArithIMul:
case ArithClz32: {
setPrediction(SpecInt32Only);
break;
}
case ArrayPop:
case ArrayPush:
case RegExpExec:
case RegExpExecNonGlobalOrSticky:
case RegExpTest:
case RegExpMatchFast:
case RegExpMatchFastGlobal:
case StringReplace:
case StringReplaceRegExp:
case GetById:
case GetByIdFlush:
case GetByIdWithThis:
case GetByIdDirect:
case GetByIdDirectFlush:
case TryGetById:
case GetByValWithThis:
case GetByOffset:
case MultiGetByOffset:
case GetDirectPname:
case Call:
case DirectCall:
case TailCallInlinedCaller:
case DirectTailCallInlinedCaller:
case Construct:
case DirectConstruct:
case CallVarargs:
case CallEval:
case TailCallVarargsInlinedCaller:
case ConstructVarargs:
case CallForwardVarargs:
case ConstructForwardVarargs:
case TailCallForwardVarargsInlinedCaller:
case GetGlobalVar:
case GetGlobalLexicalVariable:
case GetClosureVar:
case GetInternalField:
case GetFromArguments:
case LoadKeyFromMapBucket:
case LoadValueFromMapBucket:
case ToNumber:
case ToNumeric:
case ToObject:
case ValueBitAnd:
case ValueBitXor:
case ValueBitOr:
case ValueBitNot:
case CallObjectConstructor:
case GetArgument:
case CallDOMGetter:
case GetDynamicVar:
case GetPrototypeOf:
case ExtractValueFromWeakMapGet:
case DataViewGetInt:
case DataViewGetFloat:
case DateGetInt32OrNaN: {
setPrediction(m_currentNode->getHeapPrediction());
break;
}
case DateGetTime: {
setPrediction(SpecFullNumber);
break;
}
case WeakMapGet:
case ResolveScopeForHoistingFuncDeclInEval: {
setPrediction(SpecBytecodeTop);
break;
}
case GetGetterSetterByOffset:
case GetExecutable: {
setPrediction(SpecCellOther);
break;
}
case GetGetter:
case GetSetter:
case GetCallee:
case NewFunction:
case NewGeneratorFunction:
case NewAsyncGeneratorFunction:
case NewAsyncFunction: {
setPrediction(SpecFunction);
break;
}
case GetArgumentCountIncludingThis: {
setPrediction(SpecInt32Only);
break;
}
case SetCallee:
case SetArgumentCountIncludingThis:
break;
case MapHash:
setPrediction(SpecInt32Only);
break;
case GetMapBucket:
case GetMapBucketHead:
case GetMapBucketNext:
case SetAdd:
case MapSet:
setPrediction(SpecCellOther);
break;
case GetRestLength:
case ArrayIndexOf: {
setPrediction(SpecInt32Only);
break;
}
case GetTypedArrayByteOffset:
case GetArrayLength:
case GetVectorLength: {
setPrediction(SpecInt32Only);
break;
}
case StringCharCodeAt:
case StringCodePointAt: {
setPrediction(SpecInt32Only);
break;
}
case StringValueOf:
case StringSlice:
case ToLowerCase:
setPrediction(SpecString);
break;
case ArithPow:
case ArithSqrt:
case ArithFRound:
case ArithUnary: {
setPrediction(SpecBytecodeDouble);
break;
}
case ArithRound:
case ArithFloor:
case ArithCeil:
case ArithTrunc: {
if (isInt32OrBooleanSpeculation(m_currentNode->getHeapPrediction())
&& m_graph.roundShouldSpeculateInt32(m_currentNode, m_pass))
setPrediction(SpecInt32Only);
else
setPrediction(SpecBytecodeDouble);
break;
}
case ArithRandom: {
setPrediction(SpecDoubleReal);
break;
}
case DeleteByVal:
case DeleteById:
case LogicalNot:
case CompareLess:
case CompareLessEq:
case CompareGreater:
case CompareGreaterEq:
case CompareBelow:
case CompareBelowEq:
case CompareEq:
case CompareStrictEq:
case CompareEqPtr:
case SameValue:
case OverridesHasInstance:
case InstanceOf:
case InstanceOfCustom:
case IsEmpty:
case IsUndefined:
case IsUndefinedOrNull:
case IsBoolean:
case IsNumber:
case NumberIsInteger:
case IsObject:
case IsObjectOrNull:
case IsFunction:
case IsCellWithType:
case IsTypedArrayView:
case MatchStructure: {
setPrediction(SpecBoolean);
break;
}
case TypeOf: {
setPrediction(SpecStringIdent);
break;
}
case GetButterfly:
case GetIndexedPropertyStorage:
case AllocatePropertyStorage:
case ReallocatePropertyStorage: {
setPrediction(SpecOther);
break;
}
case CheckSubClass:
break;
case SkipScope:
case GetGlobalObject: {
setPrediction(SpecObjectOther);
break;
}
case GetGlobalThis:
setPrediction(SpecObject);
break;
case ResolveScope: {
setPrediction(SpecObjectOther);
break;
}
case ObjectCreate:
case CreateThis:
case NewObject: {
setPrediction(SpecFinalObject);
break;
}
case CreatePromise:
case NewPromise:
setPrediction(SpecPromiseObject);
break;
case CreateGenerator:
case NewGenerator:
case CreateAsyncGenerator:
case NewAsyncGenerator:
case NewArrayIterator:
setPrediction(SpecObjectOther);
break;
case ArraySlice:
case NewArrayWithSpread:
case NewArray:
case NewArrayWithSize:
case CreateRest:
case NewArrayBuffer:
case ObjectKeys: {
setPrediction(SpecArray);
break;
}
case Spread:
setPrediction(SpecCellOther);
break;
case NewTypedArray: {
setPrediction(speculationFromTypedArrayType(m_currentNode->typedArrayType()));
break;
}
case NewRegexp: {
setPrediction(SpecRegExpObject);
break;
}
case PushWithScope:
case CreateActivation: {
setPrediction(SpecObjectOther);
break;
}
case StringFromCharCode: {
setPrediction(SpecString);
m_currentNode->child1()->mergeFlags(NodeBytecodeUsesAsNumber | NodeBytecodeUsesAsInt);
break;
}
case StringCharAt:
case CallStringConstructor:
case ToString:
case NumberToStringWithRadix:
case NumberToStringWithValidRadixConstant:
case MakeRope:
case StrCat: {
setPrediction(SpecString);
break;
}
case NewStringObject: {
setPrediction(SpecStringObject);
break;
}
case NewSymbol: {
setPrediction(SpecSymbol);
break;
}
case CreateDirectArguments: {
setPrediction(SpecDirectArguments);
break;
}
case CreateScopedArguments: {
setPrediction(SpecScopedArguments);
break;
}
case CreateClonedArguments: {
setPrediction(SpecObjectOther);
break;
}
case CreateArgumentsButterfly: {
setPrediction(SpecCellOther);
break;
}
case FiatInt52: {
RELEASE_ASSERT(enableInt52());
setPrediction(SpecInt52Any);
break;
}
case GetScope:
setPrediction(SpecObjectOther);
break;
case InByVal:
case InById:
setPrediction(SpecBoolean);
break;
case HasOwnProperty:
setPrediction(SpecBoolean);
break;
case GetEnumerableLength: {
setPrediction(SpecInt32Only);
break;
}
case HasGenericProperty:
case HasStructureProperty:
case HasIndexedProperty: {
setPrediction(SpecBoolean);
break;
}
case GetPropertyEnumerator: {
setPrediction(SpecCell);
break;
}
case GetEnumeratorStructurePname: {
setPrediction(SpecCell | SpecOther);
break;
}
case GetEnumeratorGenericPname: {
setPrediction(SpecCell | SpecOther);
break;
}
case ToIndexString: {
setPrediction(SpecString);
break;
}
case ParseInt: {
// We expect this node to almost always produce an int32. However,
// it's possible it produces NaN or integers out of int32 range. We
// rely on the heap prediction since the parseInt() call profiled
// its result.
setPrediction(m_currentNode->getHeapPrediction());
break;
}
case IdentityWithProfile: {
setPrediction(m_currentNode->getForcedPrediction());
break;
}
case ExtractCatchLocal: {
setPrediction(m_currentNode->catchLocalPrediction());
break;
}
case GetLocal:
case SetLocal:
case UInt32ToNumber:
case ValueNegate:
case ValueAdd:
case ValueSub:
case ValueMul:
case ValueDiv:
case ValueMod:
case ValuePow:
case ValueBitLShift:
case ValueBitRShift:
case Inc:
case Dec:
case ArithAdd:
case ArithSub:
case ArithNegate:
case ArithMin:
case ArithMax:
case ArithMul:
case ArithDiv:
case ArithMod:
case ArithAbs:
case GetByVal:
case ToThis:
case ToPrimitive:
case ToPropertyKey:
case NormalizeMapKey:
case AtomicsAdd:
case AtomicsAnd:
case AtomicsCompareExchange:
case AtomicsExchange:
case AtomicsLoad:
case AtomicsOr:
case AtomicsStore:
case AtomicsSub:
case AtomicsXor: {
m_dependentNodes.append(m_currentNode);
break;
}
case AtomicsIsLockFree: {
setPrediction(SpecBoolean);
break;
}
case CPUIntrinsic: {
if (m_currentNode->intrinsic() == CPURdtscIntrinsic)
setPrediction(SpecInt32Only);
else
setPrediction(SpecOther);
break;
}
case PutByValAlias:
case DoubleAsInt32:
case CheckTypeInfoFlags:
case Arrayify:
case ArrayifyToStructure:
case CheckTierUpInLoop:
case CheckTierUpAtReturn:
case CheckTierUpAndOSREnter:
case CheckInBounds:
case ValueToInt32:
case DoubleRep:
case ValueRep:
case Int52Rep:
case Int52Constant:
case Identity:
case BooleanToNumber:
case PhantomNewObject:
case PhantomNewFunction:
case PhantomNewGeneratorFunction:
case PhantomNewAsyncGeneratorFunction:
case PhantomNewAsyncFunction:
case PhantomCreateActivation:
case PhantomDirectArguments:
case PhantomCreateRest:
case PhantomSpread:
case PhantomNewArrayWithSpread:
case PhantomNewArrayBuffer:
case PhantomNewArrayIterator:
case PhantomClonedArguments:
case PhantomNewRegexp:
case GetMyArgumentByVal:
case GetMyArgumentByValOutOfBounds:
case PutHint:
case CheckStructureImmediate:
case CheckStructureOrEmpty:
case CheckArrayOrEmpty:
case MaterializeNewObject:
case MaterializeCreateActivation:
case MaterializeNewInternalFieldObject:
case PutStack:
case KillStack:
case StoreBarrier:
case FencedStoreBarrier:
case GetStack:
case GetRegExpObjectLastIndex:
case SetRegExpObjectLastIndex:
case RecordRegExpCachedResult:
case LazyJSConstant:
case CallDOM: {
// This node should never be visible at this stage of compilation.
DFG_CRASH(m_graph, m_currentNode, "Unexpected node during prediction propagation");
break;
}
case Phi:
// Phis should not be visible here since we're iterating the all-but-Phi's
// part of basic blocks.
RELEASE_ASSERT_NOT_REACHED();
break;
case EntrySwitch:
case Upsilon:
// These don't get inserted until we go into SSA.
RELEASE_ASSERT_NOT_REACHED();
break;
#ifndef NDEBUG
// These get ignored because they don't return anything.
case PutByValDirect:
case PutByValWithThis:
case PutByIdWithThis:
case PutByVal:
case PutClosureVar:
case PutInternalField:
case PutToArguments:
case Return:
case Throw:
case ThrowStaticError:
case TailCall:
case DirectTailCall:
case TailCallVarargs:
case TailCallForwardVarargs:
case PutById:
case PutByIdFlush:
case PutByIdDirect:
case PutByOffset:
case MultiPutByOffset:
case PutGetterById:
case PutSetterById:
case PutGetterSetterById:
case PutGetterByVal:
case PutSetterByVal:
case DefineDataProperty:
case DefineAccessorProperty:
case DFG::Jump:
case Branch:
case Switch:
case ProfileType:
case ProfileControlFlow:
case ForceOSRExit:
case SetArgumentDefinitely:
case SetArgumentMaybe:
case SetFunctionName:
case CheckStructure:
case CheckCell:
case CheckNotEmpty:
case AssertNotEmpty:
case CheckIdent:
case CheckBadCell:
case PutStructure:
case Phantom:
case Check:
case CheckArray:
case CheckNeutered:
case CheckVarargs:
case PutGlobalVariable:
case CheckTraps:
case LogShadowChickenPrologue:
case LogShadowChickenTail:
case Unreachable:
case LoopHint:
case NotifyWrite:
case ConstantStoragePointer:
case MovHint:
case ZombieHint:
case ExitOK:
case VarargsLength:
case LoadVarargs:
case ForwardVarargs:
case PutDynamicVar:
case NukeStructureAndSetButterfly:
case InitializeEntrypointArguments:
case WeakSetAdd:
case WeakMapSet:
case FilterCallLinkStatus:
case FilterGetByStatus:
case FilterPutByIdStatus:
case FilterInByIdStatus:
case ClearCatchLocals:
case DataViewSet:
case InvalidationPoint:
break;
// This gets ignored because it only pretends to produce a value.
case BottomValue:
break;
// This gets ignored because it already has a prediction.
case ExtractOSREntryLocal:
break;
// These gets ignored because it doesn't do anything.
case CountExecution:
case SuperSamplerBegin:
case SuperSamplerEnd:
case PhantomLocal:
case Flush:
break;
case LastNodeType:
RELEASE_ASSERT_NOT_REACHED();
break;
#else
default:
break;
#endif
}
}
SpeculatedType resultOfToPrimitive(SpeculatedType type)
{
if (type & SpecObject) {
// We try to be optimistic here about StringObjects since it's unlikely that
// someone overrides the valueOf or toString methods.
if (type & SpecStringObject && m_graph.canOptimizeStringObjectAccess(m_currentNode->origin.semantic))
return mergeSpeculations(type & ~SpecObject, SpecString);
return mergeSpeculations(type & ~SpecObject, SpecPrimitive);
}
return type;
}
SpeculatedType resultOfToPropertyKey(SpeculatedType type)
{
// Propagate the prediction of the source directly if already proven to be a property key.
if (type && !(type & ~(SpecString | SpecSymbol)))
return type;
if (type & SpecStringObject && m_graph.canOptimizeStringObjectAccess(m_currentNode->origin.semantic))
return mergeSpeculations(type & SpecSymbol, SpecString);
return SpecString | SpecSymbol;
}
Vector<Node*> m_dependentNodes;
Node* m_currentNode;
bool m_changed { false };
PredictionPass m_pass { PrimaryPass }; // We use different logic for considering predictions depending on how far along we are in propagation.
};
} // Anonymous namespace.
bool performPredictionPropagation(Graph& graph)
{
return runPhase<PredictionPropagationPhase>(graph);
}
} } // namespace JSC::DFG
#endif // ENABLE(DFG_JIT)