Source/JavaScriptCore/dfg/DFGAbstractState.cpp

/*
 * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "DFGAbstractState.h"

#if ENABLE(DFG_JIT)

#include "CodeBlock.h"
#include "DFGBasicBlock.h"

namespace JSC { namespace DFG {

AbstractState::AbstractState(Graph& graph)
    : m_codeBlock(graph.m_codeBlock)
    , m_graph(graph)
    , m_variables(m_codeBlock->numParameters(), graph.m_localVars)
    , m_block(0)
{
    m_nodes.resize(graph.size());
}

AbstractState::~AbstractState() { }

void AbstractState::beginBasicBlock(BasicBlock* basicBlock)
{
    ASSERT(!m_block);
    
    ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->valuesAtHead.numberOfLocals());
    ASSERT(basicBlock->variablesAtTail.numberOfLocals() == basicBlock->valuesAtTail.numberOfLocals());
    ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->variablesAtTail.numberOfLocals());
    
    // This is usually a no-op, but it is possible that the graph has grown since the
    // abstract state was last used.
    m_nodes.resize(m_graph.size());
    
    for (size_t i = 0; i < basicBlock->size(); i++)
        m_nodes[basicBlock->at(i)].clear();

    m_variables = basicBlock->valuesAtHead;
    m_haveStructures = false;
    for (size_t i = 0; i < m_variables.numberOfArguments(); ++i) {
        if (m_variables.argument(i).m_structure.isNeitherClearNorTop()) {
            m_haveStructures = true;
            break;
        }
    }
    for (size_t i = 0; i < m_variables.numberOfLocals(); ++i) {
        if (m_variables.local(i).m_structure.isNeitherClearNorTop()) {
            m_haveStructures = true;
            break;
        }
    }
    
    basicBlock->cfaShouldRevisit = false;
    basicBlock->cfaHasVisited = true;
    m_block = basicBlock;
    m_isValid = true;
    m_foundConstants = false;
    m_branchDirection = InvalidBranchDirection;
}

void AbstractState::initialize(Graph& graph)
{
    BasicBlock* root = graph.m_blocks[0].get();
    root->cfaShouldRevisit = true;
    root->cfaHasVisited = false;
    root->cfaFoundConstants = false;
    for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
        Node& node = graph[root->variablesAtHead.argument(i)];
        ASSERT(node.op() == SetArgument);
        if (!node.shouldGenerate()) {
            // The argument is dead. We don't do any checks for such arguments, and so
            // for the purpose of the analysis, they contain no value.
            root->valuesAtHead.argument(i).clear();
            continue;
        }
        
        if (node.variableAccessData()->isCaptured()) {
            root->valuesAtHead.argument(i).makeTop();
            continue;
        }
        
        SpeculatedType prediction = node.variableAccessData()->prediction();
        if (isInt32Speculation(prediction))
            root->valuesAtHead.argument(i).set(SpecInt32);
        else if (isArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecArray);
        else if (isBooleanSpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecBoolean);
        else if (isInt8ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecInt8Array);
        else if (isInt16ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecInt16Array);
        else if (isInt32ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecInt32Array);
        else if (isUint8ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecUint8Array);
        else if (isUint8ClampedArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecUint8ClampedArray);
        else if (isUint16ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecUint16Array);
        else if (isUint32ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecUint32Array);
        else if (isFloat32ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecFloat32Array);
        else if (isFloat64ArraySpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecFloat64Array);
        else if (isCellSpeculation(prediction))
            root->valuesAtHead.argument(i).set(SpecCell);
        else
            root->valuesAtHead.argument(i).makeTop();
        
        root->valuesAtTail.argument(i).clear();
    }
    for (size_t i = 0; i < root->valuesAtHead.numberOfLocals(); ++i) {
        NodeIndex nodeIndex = root->variablesAtHead.local(i);
        if (nodeIndex != NoNode && graph[nodeIndex].variableAccessData()->isCaptured())
            root->valuesAtHead.local(i).makeTop();
        else
            root->valuesAtHead.local(i).clear();
        root->valuesAtTail.local(i).clear();
    }
    for (BlockIndex blockIndex = 1 ; blockIndex < graph.m_blocks.size(); ++blockIndex) {
        BasicBlock* block = graph.m_blocks[blockIndex].get();
        if (!block)
            continue;
        if (!block->isReachable)
            continue;
        block->cfaShouldRevisit = false;
        block->cfaHasVisited = false;
        block->cfaFoundConstants = false;
        for (size_t i = 0; i < block->valuesAtHead.numberOfArguments(); ++i) {
            block->valuesAtHead.argument(i).clear();
            block->valuesAtTail.argument(i).clear();
        }
        for (size_t i = 0; i < block->valuesAtHead.numberOfLocals(); ++i) {
            block->valuesAtHead.local(i).clear();
            block->valuesAtTail.local(i).clear();
        }
    }
}

bool AbstractState::endBasicBlock(MergeMode mergeMode, BranchDirection* branchDirectionPtr)
{
    ASSERT(m_block);
    
    BasicBlock* block = m_block; // Save the block for successor merging.
    
    block->cfaFoundConstants = m_foundConstants;
    block->cfaDidFinish = m_isValid;
    
    if (!m_isValid) {
        reset();
        return false;
    }
    
    bool changed = false;
    
    if (mergeMode != DontMerge || !ASSERT_DISABLED) {
        for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("        Merging state for argument %zu.\n", argument);
#endif
            AbstractValue& destination = block->valuesAtTail.argument(argument);
            changed |= mergeStateAtTail(destination, m_variables.argument(argument), block->variablesAtTail.argument(argument));
        }
        
        for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) {
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("        Merging state for local %zu.\n", local);
#endif
            AbstractValue& destination = block->valuesAtTail.local(local);
            changed |= mergeStateAtTail(destination, m_variables.local(local), block->variablesAtTail.local(local));
        }
    }
    
    ASSERT(mergeMode != DontMerge || !changed);
    
    BranchDirection branchDirection = m_branchDirection;
    if (branchDirectionPtr)
        *branchDirectionPtr = branchDirection;
    
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
    dataLog("        Branch direction = %s\n", branchDirectionToString(branchDirection));
#endif
    
    reset();
    
    if (mergeMode != MergeToSuccessors)
        return changed;
    
    return mergeToSuccessors(m_graph, block, branchDirection);
}

void AbstractState::reset()
{
    m_block = 0;
    m_isValid = false;
    m_branchDirection = InvalidBranchDirection;
}

bool AbstractState::execute(unsigned indexInBlock)
{
    ASSERT(m_block);
    ASSERT(m_isValid);
    
    m_didClobber = false;
    
    NodeIndex nodeIndex = m_block->at(indexInBlock);
    Node& node = m_graph[nodeIndex];
        
    if (!node.shouldGenerate())
        return true;
        
    switch (node.op()) {
    case JSConstant:
    case WeakJSConstant:
    case PhantomArguments: {
        forNode(nodeIndex).set(m_graph.valueOfJSConstant(nodeIndex));
        node.setCanExit(false);
        break;
    }
            
    case GetLocal: {
        VariableAccessData* variableAccessData = node.variableAccessData();
        if (variableAccessData->prediction() == SpecNone) {
            m_isValid = false;
            node.setCanExit(true);
            break;
        }
        bool canExit = false;
        AbstractValue value = m_variables.operand(variableAccessData->local());
        if (!variableAccessData->isCaptured()) {
            if (value.isClear())
                canExit |= true;
        }
        if (value.value())
            m_foundConstants = true;
        forNode(nodeIndex) = value;
        node.setCanExit(canExit);
        break;
    }
        
    case GetLocalUnlinked: {
        AbstractValue value = m_variables.operand(node.unlinkedLocal());
        if (value.value())
            m_foundConstants = true;
        forNode(nodeIndex) = value;
        node.setCanExit(false);
        break;
    }
        
    case SetLocal: {
        if (node.variableAccessData()->isCaptured()
            || m_graph.isCreatedThisArgument(node.local())) {
            m_variables.operand(node.local()) = forNode(node.child1());
            node.setCanExit(false);
            break;
        }
        
        if (node.variableAccessData()->shouldUseDoubleFormat()) {
            speculateNumberUnary(node);
            m_variables.operand(node.local()).set(SpecDouble);
            break;
        }
        
        SpeculatedType predictedType = node.variableAccessData()->argumentAwarePrediction();
        if (isInt32Speculation(predictedType))
            speculateInt32Unary(node);
        else if (isArraySpeculation(predictedType)) {
            node.setCanExit(!isArraySpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecArray);
        } else if (isCellSpeculation(predictedType)) {
            node.setCanExit(!isCellSpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecCell);
        } else if (isBooleanSpeculation(predictedType))
            speculateBooleanUnary(node);
        else
            node.setCanExit(false);
        
        m_variables.operand(node.local()) = forNode(node.child1());
        break;
    }
            
    case SetArgument:
        // Assert that the state of arguments has been set.
        ASSERT(!m_block->valuesAtHead.operand(node.local()).isClear());
        node.setCanExit(false);
        break;
            
    case BitAnd:
    case BitOr:
    case BitXor:
    case BitRShift:
    case BitLShift:
    case BitURShift: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isInt32() && right.isInt32()) {
            int32_t a = left.asInt32();
            int32_t b = right.asInt32();
            bool constantWasSet;
            switch (node.op()) {
            case BitAnd:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a & b));
                break;
            case BitOr:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a | b));
                break;
            case BitXor:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a ^ b));
                break;
            case BitRShift:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a >> static_cast<uint32_t>(b)));
                break;
            case BitLShift:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a << static_cast<uint32_t>(b)));
                break;
            case BitURShift:
                constantWasSet = trySetConstant(nodeIndex, JSValue(static_cast<uint32_t>(a) >> static_cast<uint32_t>(b)));
                break;
            default:
                ASSERT_NOT_REACHED();
                constantWasSet = false;
            }
            if (constantWasSet) {
                m_foundConstants = true;
                node.setCanExit(false);
                break;
            }
        }
        speculateInt32Binary(node);
        forNode(nodeIndex).set(SpecInt32);
        break;
    }
        
    case UInt32ToNumber: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()) {
            ASSERT(child.isInt32());
            if (trySetConstant(nodeIndex, JSValue(child.asUInt32()))) {
                m_foundConstants = true;
                node.setCanExit(false);
                break;
            }
        }
        if (!node.canSpeculateInteger()) {
            forNode(nodeIndex).set(SpecDouble);
            node.setCanExit(false);
        } else {
            forNode(nodeIndex).set(SpecInt32);
            node.setCanExit(true);
        }
        break;
    }
              
            
    case DoubleAsInt32: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()) {
            double asDouble = child.asNumber();
            int32_t asInt = JSC::toInt32(asDouble);
            if (bitwise_cast<int64_t>(static_cast<double>(asInt)) == bitwise_cast<int64_t>(asDouble)
                && trySetConstant(nodeIndex, JSValue(asInt))) {
                m_foundConstants = true;
                break;
            }
        }
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecNumber);
        forNode(nodeIndex).set(SpecInt32);
        break;
    }
            
    case ValueToInt32: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()) {
            bool constantWasSet;
            if (child.isInt32())
                constantWasSet = trySetConstant(nodeIndex, child);
            else
                constantWasSet = trySetConstant(nodeIndex, JSValue(JSC::toInt32(child.asDouble())));
            if (constantWasSet) {
                m_foundConstants = true;
                node.setCanExit(false);
                break;
            }
        }
        if (m_graph[node.child1()].shouldSpeculateInteger())
            speculateInt32Unary(node);
        else if (m_graph[node.child1()].shouldSpeculateNumber())
            speculateNumberUnary(node);
        else if (m_graph[node.child1()].shouldSpeculateBoolean())
            speculateBooleanUnary(node);
        else
            node.setCanExit(false);
        
        forNode(nodeIndex).set(SpecInt32);
        break;
    }
        
    case Int32ToDouble: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()
            && trySetConstant(nodeIndex, JSValue(JSValue::EncodeAsDouble, child.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        speculateNumberUnary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
        
    case CheckNumber:
        forNode(node.child1()).filter(SpecNumber);
        break;
            
    case ValueAdd:
    case ArithAdd: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isNumber() && right.isNumber()
            && trySetConstant(nodeIndex, JSValue(left.asNumber() + right.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        if (m_graph.addShouldSpeculateInteger(node)) {
            speculateInt32Binary(
                node, !nodeCanTruncateInteger(node.arithNodeFlags()));
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (Node::shouldSpeculateNumber(m_graph[node.child1()], m_graph[node.child2()])) {
            speculateNumberBinary(node);
            forNode(nodeIndex).set(SpecDouble);
            break;
        }
        if (node.op() == ValueAdd) {
            clobberWorld(node.codeOrigin, indexInBlock);
            forNode(nodeIndex).set(SpecString | SpecInt32 | SpecNumber);
            node.setCanExit(false);
            break;
        }
        // We don't handle this yet. :-(
        m_isValid = false;
        node.setCanExit(true);
        break;
    }
            
    case ArithSub: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isNumber() && right.isNumber()
            && trySetConstant(nodeIndex, JSValue(left.asNumber() - right.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        if (m_graph.addShouldSpeculateInteger(node)) {
            speculateInt32Binary(
                node, !nodeCanTruncateInteger(node.arithNodeFlags()));
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        speculateNumberBinary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
        
    case ArithNegate: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()
            && trySetConstant(nodeIndex, JSValue(-child.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        if (m_graph.negateShouldSpeculateInteger(node)) {
            speculateInt32Unary(
                node, !nodeCanTruncateInteger(node.arithNodeFlags()));
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        speculateNumberUnary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
        
    case ArithMul: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isNumber() && right.isNumber()
            && trySetConstant(nodeIndex, JSValue(left.asNumber() * right.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        if (m_graph.mulShouldSpeculateInteger(node)) {
            speculateInt32Binary(
                node,
                !nodeCanTruncateInteger(node.arithNodeFlags())
                || !nodeCanIgnoreNegativeZero(node.arithNodeFlags()));
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        speculateNumberBinary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
        
    case ArithDiv:
    case ArithMin:
    case ArithMax:
    case ArithMod: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isNumber() && right.isNumber()) {
            double a = left.asNumber();
            double b = right.asNumber();
            bool constantWasSet;
            switch (node.op()) {
            case ArithDiv:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a / b));
                break;
            case ArithMin:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a < b ? a : (b <= a ? b : a + b)));
                break;
            case ArithMax:
                constantWasSet = trySetConstant(nodeIndex, JSValue(a > b ? a : (b >= a ? b : a + b)));
                break;
            case ArithMod:
                constantWasSet = trySetConstant(nodeIndex, JSValue(fmod(a, b)));
                break;
            default:
                ASSERT_NOT_REACHED();
                constantWasSet = false;
                break;
            }
            if (constantWasSet) {
                m_foundConstants = true;
                node.setCanExit(false);
                break;
            }
        }
        if (Node::shouldSpeculateInteger(
                m_graph[node.child1()], m_graph[node.child2()])
            && node.canSpeculateInteger()) {
            speculateInt32Binary(node, true); // forcing can-exit, which is a bit on the conservative side.
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        speculateNumberBinary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
            
    case ArithAbs: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()
            && trySetConstant(nodeIndex, JSValue(fabs(child.asNumber())))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateInteger()
            && node.canSpeculateInteger()) {
            speculateInt32Unary(node, true);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        speculateNumberUnary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
            
    case ArithSqrt: {
        JSValue child = forNode(node.child1()).value();
        if (child && child.isNumber()
            && trySetConstant(nodeIndex, JSValue(sqrt(child.asNumber())))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        speculateNumberUnary(node);
        forNode(nodeIndex).set(SpecDouble);
        break;
    }
            
    case LogicalNot: {
        JSValue childConst = forNode(node.child1()).value();
        if (childConst && trySetConstant(nodeIndex, jsBoolean(!childConst.toBoolean()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        Node& child = m_graph[node.child1()];
        if (isBooleanSpeculation(child.prediction()))
            speculateBooleanUnary(node);
        else if (child.shouldSpeculateFinalObjectOrOther()) {
            node.setCanExit(
                !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecFinalObject | SpecOther);
        } else if (child.shouldSpeculateArrayOrOther()) {
            node.setCanExit(
                !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecArray | SpecOther);
        } else if (child.shouldSpeculateInteger())
            speculateInt32Unary(node);
        else if (child.shouldSpeculateNumber())
            speculateNumberUnary(node);
        else
            node.setCanExit(false);
        forNode(nodeIndex).set(SpecBoolean);
        break;
    }
        
    case IsUndefined:
    case IsBoolean:
    case IsNumber:
    case IsString:
    case IsObject:
    case IsFunction: {
        node.setCanExit(false);
        JSValue child = forNode(node.child1()).value();
        if (child) {
            bool constantWasSet;
            switch (node.op()) {
            case IsUndefined:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(
                    child.isCell()
                    ? child.asCell()->structure()->typeInfo().masqueradesAsUndefined()
                    : child.isUndefined()));
                break;
            case IsBoolean:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(child.isBoolean()));
                break;
            case IsNumber:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(child.isNumber()));
                break;
            case IsString:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(isJSString(child)));
                break;
            default:
                constantWasSet = false;
                break;
            }
            if (constantWasSet) {
                m_foundConstants = true;
                break;
            }
        }
        forNode(nodeIndex).set(SpecBoolean);
        break;
    }
            
    case CompareLess:
    case CompareLessEq:
    case CompareGreater:
    case CompareGreaterEq:
    case CompareEq: {
        JSValue leftConst = forNode(node.child1()).value();
        JSValue rightConst = forNode(node.child2()).value();
        if (leftConst && rightConst && leftConst.isNumber() && rightConst.isNumber()) {
            double a = leftConst.asNumber();
            double b = rightConst.asNumber();
            bool constantWasSet;
            switch (node.op()) {
            case CompareLess:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a < b));
                break;
            case CompareLessEq:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a <= b));
                break;
            case CompareGreater:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a > b));
                break;
            case CompareGreaterEq:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a >= b));
                break;
            case CompareEq:
                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a == b));
                break;
            default:
                ASSERT_NOT_REACHED();
                constantWasSet = false;
                break;
            }
            if (constantWasSet) {
                m_foundConstants = true;
                node.setCanExit(false);
                break;
            }
        }
        
        forNode(nodeIndex).set(SpecBoolean);
        
        Node& left = m_graph[node.child1()];
        Node& right = m_graph[node.child2()];
        SpeculatedType filter;
        SpeculatedTypeChecker checker;
        if (Node::shouldSpeculateInteger(left, right)) {
            filter = SpecInt32;
            checker = isInt32Speculation;
        } else if (Node::shouldSpeculateNumber(left, right)) {
            filter = SpecNumber;
            checker = isNumberSpeculation;
        } else if (node.op() == CompareEq) {
            if ((m_graph.isConstant(node.child1().index())
                 && m_graph.valueOfJSConstant(node.child1().index()).isNull())
                || (m_graph.isConstant(node.child2().index())
                    && m_graph.valueOfJSConstant(node.child2().index()).isNull())) {
                // We know that this won't clobber the world. But that's all we know.
                node.setCanExit(false);
                break;
            }
            
            if (Node::shouldSpeculateFinalObject(left, right)) {
                filter = SpecFinalObject;
                checker = isFinalObjectSpeculation;
            } else if (Node::shouldSpeculateArray(left, right)) {
                filter = SpecArray;
                checker = isArraySpeculation;
            } else if (left.shouldSpeculateFinalObject() && right.shouldSpeculateFinalObjectOrOther()) {
                node.setCanExit(
                    !isFinalObjectSpeculation(forNode(node.child1()).m_type)
                    || !isFinalObjectOrOtherSpeculation(forNode(node.child2()).m_type));
                forNode(node.child1()).filter(SpecFinalObject);
                forNode(node.child2()).filter(SpecFinalObject | SpecOther);
                break;
            } else if (right.shouldSpeculateFinalObject() && left.shouldSpeculateFinalObjectOrOther()) {
                node.setCanExit(
                    !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type)
                    || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
                forNode(node.child1()).filter(SpecFinalObject | SpecOther);
                forNode(node.child2()).filter(SpecFinalObject);
                break;
            } else if (left.shouldSpeculateArray() && right.shouldSpeculateArrayOrOther()) {
                node.setCanExit(
                    !isArraySpeculation(forNode(node.child1()).m_type)
                    || !isArrayOrOtherSpeculation(forNode(node.child2()).m_type));
                forNode(node.child1()).filter(SpecArray);
                forNode(node.child2()).filter(SpecArray | SpecOther);
                break;
            } else if (right.shouldSpeculateArray() && left.shouldSpeculateArrayOrOther()) {
                node.setCanExit(
                    !isArrayOrOtherSpeculation(forNode(node.child1()).m_type)
                    || !isArraySpeculation(forNode(node.child2()).m_type));
                forNode(node.child1()).filter(SpecArray | SpecOther);
                forNode(node.child2()).filter(SpecArray);
                break;
            } else {
                filter = SpecTop;
                checker = isAnySpeculation;
                clobberWorld(node.codeOrigin, indexInBlock);
            }
        } else {
            filter = SpecTop;
            checker = isAnySpeculation;
            clobberWorld(node.codeOrigin, indexInBlock);
        }
        node.setCanExit(
            !checker(forNode(node.child1()).m_type)
            || !checker(forNode(node.child2()).m_type));
        forNode(node.child1()).filter(filter);
        forNode(node.child2()).filter(filter);
        break;
    }
            
    case CompareStrictEq: {
        JSValue left = forNode(node.child1()).value();
        JSValue right = forNode(node.child2()).value();
        if (left && right && left.isNumber() && right.isNumber()
            && trySetConstant(nodeIndex, jsBoolean(left.asNumber() == right.asNumber()))) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        forNode(nodeIndex).set(SpecBoolean);
        if (m_graph.isJSConstant(node.child1().index())) {
            JSValue value = m_graph.valueOfJSConstant(node.child1().index());
            if (!value.isNumber() && !value.isString()) {
                node.setCanExit(false);
                break;
            }
        }
        if (m_graph.isJSConstant(node.child2().index())) {
            JSValue value = m_graph.valueOfJSConstant(node.child2().index());
            if (!value.isNumber() && !value.isString()) {
                node.setCanExit(false);
                break;
            }
        }
        if (Node::shouldSpeculateInteger(
                m_graph[node.child1()], m_graph[node.child2()])) {
            speculateInt32Binary(node);
            break;
        }
        if (Node::shouldSpeculateNumber(
                m_graph[node.child1()], m_graph[node.child2()])) {
            speculateNumberBinary(node);
            break;
        }
        if (Node::shouldSpeculateFinalObject(
                m_graph[node.child1()], m_graph[node.child2()])) {
            node.setCanExit(
                !isFinalObjectSpeculation(forNode(node.child1()).m_type)
                || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
            forNode(node.child1()).filter(SpecFinalObject);
            forNode(node.child2()).filter(SpecFinalObject);
            break;
        }
        if (Node::shouldSpeculateArray(
                m_graph[node.child1()], m_graph[node.child2()])) {
            node.setCanExit(
                !isArraySpeculation(forNode(node.child1()).m_type)
                || !isArraySpeculation(forNode(node.child2()).m_type));
            forNode(node.child1()).filter(SpecArray);
            forNode(node.child2()).filter(SpecArray);
            break;
        }
        node.setCanExit(false);
        break;
    }
        
    case StringCharCodeAt:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecString);
        forNode(node.child2()).filter(SpecInt32);
        forNode(nodeIndex).set(SpecInt32);
        break;
        
    case StringCharAt:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecString);
        forNode(node.child2()).filter(SpecInt32);
        forNode(nodeIndex).set(SpecString);
        break;
            
    case GetByVal: {
        node.setCanExit(true);
        if (!node.prediction() || !m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction()) {
            m_isValid = false;
            break;
        }
        if (!isActionableArraySpeculation(m_graph[node.child1()].prediction()) || !m_graph[node.child2()].shouldSpeculateInteger()) {
            clobberWorld(node.codeOrigin, indexInBlock);
            forNode(nodeIndex).makeTop();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateArguments()) {
            forNode(node.child1()).filter(SpecArguments);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).makeTop();
            break;
        }
        if (m_graph[node.child1()].prediction() == SpecString) {
            forNode(node.child1()).filter(SpecString);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecString);
            break;
        }
        
        if (m_graph[node.child1()].shouldSpeculateInt8Array()) {
            forNode(node.child1()).filter(SpecInt8Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateInt16Array()) {
            forNode(node.child1()).filter(SpecInt16Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateInt32Array()) {
            forNode(node.child1()).filter(SpecInt32Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint8Array()) {
            forNode(node.child1()).filter(SpecUint8Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint8ClampedArray()) {
            forNode(node.child1()).filter(SpecUint8ClampedArray);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint16Array()) {
            forNode(node.child1()).filter(SpecUint16Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint32Array()) {
            forNode(node.child1()).filter(SpecUint32Array);
            forNode(node.child2()).filter(SpecInt32);
            if (node.shouldSpeculateInteger())
                forNode(nodeIndex).set(SpecInt32);
            else
                forNode(nodeIndex).set(SpecDouble);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateFloat32Array()) {
            forNode(node.child1()).filter(SpecFloat32Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecDouble);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateFloat64Array()) {
            forNode(node.child1()).filter(SpecFloat64Array);
            forNode(node.child2()).filter(SpecInt32);
            forNode(nodeIndex).set(SpecDouble);
            break;
        }
        ASSERT(m_graph[node.child1()].shouldSpeculateArray());
        forNode(node.child1()).filter(SpecArray);
        forNode(node.child2()).filter(SpecInt32);
        forNode(nodeIndex).makeTop();
        break;
    }
            
    case PutByVal:
    case PutByValAlias: {
        node.setCanExit(true);

        Edge child1 = m_graph.varArgChild(node, 0);
        Edge child2 = m_graph.varArgChild(node, 1);
        Edge child3 = m_graph.varArgChild(node, 2);
            
        if (!m_graph[child1].prediction() || !m_graph[child2].prediction()) {
            m_isValid = false;
            break;
        }
        if (!m_graph[child2].shouldSpeculateInteger() || !isActionableMutableArraySpeculation(m_graph[child1].prediction())
#if USE(JSVALUE32_64)
            || m_graph[child1].shouldSpeculateArguments()
#endif
            ) {
            ASSERT(node.op() == PutByVal);
            clobberWorld(node.codeOrigin, indexInBlock);
            forNode(nodeIndex).makeTop();
            break;
        }
        
        if (m_graph[child1].shouldSpeculateArguments()) {
            forNode(child1).filter(SpecArguments);
            forNode(child2).filter(SpecInt32);
            break;
        }
        if (m_graph[child1].shouldSpeculateInt8Array()) {
            forNode(child1).filter(SpecInt8Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateInt16Array()) {
            forNode(child1).filter(SpecInt16Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateInt32Array()) {
            forNode(child1).filter(SpecInt32Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateUint8Array()) {
            forNode(child1).filter(SpecUint8Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateUint8ClampedArray()) {
            forNode(child1).filter(SpecUint8ClampedArray);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateUint16Array()) {
            forNode(child1).filter(SpecUint16Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateUint32Array()) {
            forNode(child1).filter(SpecUint32Array);
            forNode(child2).filter(SpecInt32);
            if (m_graph[child3].shouldSpeculateInteger())
                forNode(child3).filter(SpecInt32);
            else
                forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateFloat32Array()) {
            forNode(child1).filter(SpecFloat32Array);
            forNode(child2).filter(SpecInt32);
            forNode(child3).filter(SpecNumber);
            break;
        }
        if (m_graph[child1].shouldSpeculateFloat64Array()) {
            forNode(child1).filter(SpecFloat64Array);
            forNode(child2).filter(SpecInt32);
            forNode(child3).filter(SpecNumber);
            break;
        }
        ASSERT(m_graph[child1].shouldSpeculateArray());
        forNode(child1).filter(SpecArray);
        forNode(child2).filter(SpecInt32);
        if (node.op() == PutByVal)
            clobberWorld(node.codeOrigin, indexInBlock);
        break;
    }
            
    case ArrayPush:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecArray);
        forNode(nodeIndex).set(SpecNumber);
        break;
            
    case ArrayPop:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecArray);
        forNode(nodeIndex).makeTop();
        break;
            
    case RegExpExec:
    case RegExpTest:
        node.setCanExit(
            !isCellSpeculation(forNode(node.child1()).m_type)
            || !isCellSpeculation(forNode(node.child2()).m_type));
        forNode(node.child1()).filter(SpecCell);
        forNode(node.child2()).filter(SpecCell);
        forNode(nodeIndex).makeTop();
        break;
            
    case Jump:
        node.setCanExit(false);
        break;
            
    case Branch: {
        JSValue value = forNode(node.child1()).value();
        if (value) {
            bool booleanValue = value.toBoolean();
            if (booleanValue)
                m_branchDirection = TakeTrue;
            else
                m_branchDirection = TakeFalse;
            node.setCanExit(false);
            break;
        }
        // FIXME: The above handles the trivial cases of sparse conditional
        // constant propagation, but we can do better:
        // 1) If the abstract value does not have a concrete value but describes
        //    something that is known to evaluate true (or false) then we ought
        //    to sparse conditional that.
        // 2) We can specialize the source variable's value on each direction of
        //    the branch.
        Node& child = m_graph[node.child1()];
        if (child.shouldSpeculateBoolean())
            speculateBooleanUnary(node);
        else if (child.shouldSpeculateFinalObjectOrOther()) {
            node.setCanExit(
                !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecFinalObject | SpecOther);
        } else if (child.shouldSpeculateArrayOrOther()) {
            node.setCanExit(
                !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
            forNode(node.child1()).filter(SpecArray | SpecOther);
        } else if (child.shouldSpeculateInteger())
            speculateInt32Unary(node);
        else if (child.shouldSpeculateNumber())
            speculateNumberUnary(node);
        else
            node.setCanExit(false);
        m_branchDirection = TakeBoth;
        break;
    }
            
    case Return:
        m_isValid = false;
        node.setCanExit(false);
        break;
        
    case Throw:
    case ThrowReferenceError:
        m_isValid = false;
        node.setCanExit(true);
        break;
            
    case ToPrimitive: {
        JSValue childConst = forNode(node.child1()).value();
        if (childConst && childConst.isNumber() && trySetConstant(nodeIndex, childConst)) {
            m_foundConstants = true;
            node.setCanExit(false);
            break;
        }
        
        Node& child = m_graph[node.child1()];
        if (child.shouldSpeculateInteger()) {
            speculateInt32Unary(node);
            forNode(nodeIndex).set(SpecInt32);
            break;
        }

        AbstractValue& source = forNode(node.child1());
        AbstractValue& destination = forNode(nodeIndex);
            
        SpeculatedType type = source.m_type;
        if (type & ~(SpecNumber | SpecString | SpecBoolean)) {
            type &= (SpecNumber | SpecString | SpecBoolean);
            type |= SpecString;
        }
        destination.set(type);
        node.setCanExit(false);
        break;
    }
            
    case StrCat:
        node.setCanExit(false);
        forNode(nodeIndex).set(SpecString);
        break;
            
    case NewArray:
    case NewArrayBuffer:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->arrayStructure());
        m_haveStructures = true;
        break;
        
    case NewArrayWithSize:
        speculateInt32Unary(node);
        forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->arrayStructure());
        m_haveStructures = true;
        break;
            
    case NewRegexp:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_graph.globalObjectFor(node.codeOrigin)->regExpStructure());
        m_haveStructures = true;
        break;
            
    case ConvertThis: {
        Node& child = m_graph[node.child1()];
        AbstractValue& source = forNode(node.child1());
        AbstractValue& destination = forNode(nodeIndex);
            
        if (isObjectSpeculation(source.m_type)) {
            // This is the simple case. We already know that the source is an
            // object, so there's nothing to do. I don't think this case will
            // be hit, but then again, you never know.
            destination = source;
            node.setCanExit(false);
            break;
        }
        
        node.setCanExit(true);
        
        if (isOtherSpeculation(child.prediction())) {
            source.filter(SpecOther);
            destination.set(SpecObjectOther);
            break;
        }
        
        if (isObjectSpeculation(child.prediction())) {
            source.filter(SpecObjectMask);
            destination = source;
            break;
        }
            
        destination = source;
        destination.merge(SpecObjectOther);
        break;
    }

    case CreateThis: {
        AbstractValue& source = forNode(node.child1());
        AbstractValue& destination = forNode(nodeIndex);
        
        node.setCanExit(!isCellSpeculation(source.m_type));
            
        source.filter(SpecFunction);
        destination.set(SpecFinalObject);
        break;
    }

    case NewObject:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->emptyObjectStructure());
        m_haveStructures = true;
        break;
        
    case CreateActivation:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_graph.m_globalData.activationStructure.get());
        m_haveStructures = true;
        break;
        
    case CreateArguments:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->argumentsStructure());
        m_haveStructures = true;
        break;
        
    case TearOffActivation:
    case TearOffArguments:
        node.setCanExit(false);
        // Does nothing that is user-visible.
        break;

    case CheckArgumentsNotCreated:
        if (isEmptySpeculation(
                m_variables.operand(
                    m_graph.argumentsRegisterFor(node.codeOrigin)).m_type)) {
            node.setCanExit(false);
            m_foundConstants = true;
        } else
            node.setCanExit(true);
        break;
        
    case GetMyArgumentsLength:
        // We know that this executable does not escape its arguments, so we can optimize
        // the arguments a bit. Note that this is not sufficient to force constant folding
        // of GetMyArgumentsLength, because GetMyArgumentsLength is a clobbering operation.
        // We perform further optimizations on this later on.
        if (node.codeOrigin.inlineCallFrame)
            forNode(nodeIndex).set(jsNumber(node.codeOrigin.inlineCallFrame->arguments.size() - 1));
        else
            forNode(nodeIndex).set(SpecInt32);
        node.setCanExit(
            !isEmptySpeculation(
                m_variables.operand(
                    m_graph.argumentsRegisterFor(node.codeOrigin)).m_type));
        break;
        
    case GetMyArgumentsLengthSafe:
        node.setCanExit(false);
        // This potentially clobbers all structures if the arguments object had a getter
        // installed on the length property.
        clobberWorld(node.codeOrigin, indexInBlock);
        // We currently make no guarantee about what this returns because it does not
        // speculate that the length property is actually a length.
        forNode(nodeIndex).makeTop();
        break;
        
    case GetMyArgumentByVal:
        node.setCanExit(true);
        // We know that this executable does not escape its arguments, so we can optimize
        // the arguments a bit. Note that this ends up being further optimized by the
        // ArgumentsSimplificationPhase.
        forNode(node.child1()).filter(SpecInt32);
        forNode(nodeIndex).makeTop();
        break;
        
    case GetMyArgumentByValSafe:
        node.setCanExit(true);
        // This potentially clobbers all structures if the property we're accessing has
        // a getter. We don't speculate against this.
        clobberWorld(node.codeOrigin, indexInBlock);
        // But we do speculate that the index is an integer.
        forNode(node.child1()).filter(SpecInt32);
        // And the result is unknown.
        forNode(nodeIndex).makeTop();
        break;
        
    case NewFunction:
    case NewFunctionExpression:
    case NewFunctionNoCheck:
        node.setCanExit(false);
        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->functionStructure());
        break;
        
    case GetCallee:
        node.setCanExit(false);
        forNode(nodeIndex).set(SpecFunction);
        break;
            
    case GetScopeChain:
        node.setCanExit(false);
        forNode(nodeIndex).set(SpecCellOther);
        break;
            
    case GetScopedVar:
        node.setCanExit(false);
        forNode(nodeIndex).makeTop();
        break;
            
    case PutScopedVar:
        node.setCanExit(false);
        clobberStructures(indexInBlock);
        break;
            
    case GetById:
    case GetByIdFlush:
        node.setCanExit(true);
        if (!node.prediction()) {
            m_isValid = false;
            break;
        }
        if (isCellSpeculation(m_graph[node.child1()].prediction()))
            forNode(node.child1()).filter(SpecCell);
        clobberWorld(node.codeOrigin, indexInBlock);
        forNode(nodeIndex).makeTop();
        break;
            
    case GetArrayLength:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecArray);
        forNode(nodeIndex).set(SpecInt32);
        break;

    case GetArgumentsLength:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecArguments);
        forNode(nodeIndex).set(SpecInt32);
        break;

    case GetStringLength:
        node.setCanExit(!isStringSpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecString);
        forNode(nodeIndex).set(SpecInt32);
        break;
        
    case GetInt8ArrayLength:
        node.setCanExit(!isInt8ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecInt8Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetInt16ArrayLength:
        node.setCanExit(!isInt16ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecInt16Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetInt32ArrayLength:
        node.setCanExit(!isInt32ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecInt32Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetUint8ArrayLength:
        node.setCanExit(!isUint8ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecUint8Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetUint8ClampedArrayLength:
        node.setCanExit(!isUint8ClampedArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecUint8ClampedArray);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetUint16ArrayLength:
        node.setCanExit(!isUint16ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecUint16Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetUint32ArrayLength:
        node.setCanExit(!isUint32ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecUint32Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetFloat32ArrayLength:
        node.setCanExit(!isFloat32ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecFloat32Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
    case GetFloat64ArrayLength:
        node.setCanExit(!isFloat64ArraySpeculation(forNode(node.child1()).m_type));
        forNode(node.child1()).filter(SpecFloat64Array);
        forNode(nodeIndex).set(SpecInt32);
        break;
            
    case CheckStructure: {
        // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
        AbstractValue& value = forNode(node.child1());
        node.setCanExit(
            !value.m_structure.isSubsetOf(node.structureSet())
            || !isCellSpeculation(value.m_type));
        value.filter(node.structureSet());
        m_haveStructures = true;
        break;
    }
        
    case StructureTransitionWatchpoint: {
        // FIXME: Turn CheckStructure into StructureTransitionWatchpoint when possible!
        AbstractValue& value = forNode(node.child1());
        ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad.
        value.filter(node.structure());
        node.setCanExit(true);
        break;
    }
            
    case PutStructure:
    case PhantomPutStructure:
        node.setCanExit(false);
        clobberStructures(indexInBlock);
        forNode(node.child1()).set(node.structureTransitionData().newStructure);
        m_haveStructures = true;
        break;
    case GetPropertyStorage:
    case AllocatePropertyStorage:
    case ReallocatePropertyStorage:
        node.setCanExit(false);
        forNode(node.child1()).filter(SpecCell);
        forNode(nodeIndex).clear(); // The result is not a JS value.
        break;
    case GetIndexedPropertyStorage: {
        node.setCanExit(true); // Lies, but this is (almost) always followed by GetByVal, which does exit. So no point in trying to be more precise.
        SpeculatedType basePrediction = m_graph[node.child2()].prediction();
        if (!(basePrediction & SpecInt32) && basePrediction) {
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateArguments()) {
            ASSERT_NOT_REACHED();
            break;
        }
        if (m_graph[node.child1()].prediction() == SpecString) {
            forNode(node.child1()).filter(SpecString);
            forNode(nodeIndex).clear();
            break;
        }
        
        if (m_graph[node.child1()].shouldSpeculateInt8Array()) {
            forNode(node.child1()).filter(SpecInt8Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateInt16Array()) {
            forNode(node.child1()).filter(SpecInt16Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateInt32Array()) {
            forNode(node.child1()).filter(SpecInt32Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint8Array()) {
            forNode(node.child1()).filter(SpecUint8Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint8ClampedArray()) {
            forNode(node.child1()).filter(SpecUint8ClampedArray);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint16Array()) {
            forNode(node.child1()).filter(SpecUint16Array);
            forNode(nodeIndex).set(SpecOther);
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateUint32Array()) {
            forNode(node.child1()).filter(SpecUint32Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateFloat32Array()) {
            forNode(node.child1()).filter(SpecFloat32Array);
            forNode(nodeIndex).clear();
            break;
        }
        if (m_graph[node.child1()].shouldSpeculateFloat64Array()) {
            forNode(node.child1()).filter(SpecFloat64Array);
            forNode(nodeIndex).clear();
            break;
        }
        forNode(node.child1()).filter(SpecArray);
        forNode(nodeIndex).clear();
        break; 
    }
    case GetByOffset:
        node.setCanExit(false);
        forNode(node.child1()).filter(SpecCell);
        forNode(nodeIndex).makeTop();
        break;
            
    case PutByOffset:
        node.setCanExit(false);
        forNode(node.child1()).filter(SpecCell);
        break;
            
    case CheckFunction:
        node.setCanExit(true); // Lies! We can do better.
        forNode(node.child1()).filter(SpecFunction);
        // FIXME: Should be able to propagate the fact that we know what the function is.
        break;
        
    case PutById:
    case PutByIdDirect:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecCell);
        clobberWorld(node.codeOrigin, indexInBlock);
        break;
            
    case GetGlobalVar:
        node.setCanExit(false);
        forNode(nodeIndex).makeTop();
        break;
        
    case GlobalVarWatchpoint:
        node.setCanExit(true);
        break;
            
    case PutGlobalVar:
    case PutGlobalVarCheck:
        node.setCanExit(false);
        break;
            
    case CheckHasInstance:
        node.setCanExit(true);
        forNode(node.child1()).filter(SpecCell);
        // Sadly, we don't propagate the fact that we've done CheckHasInstance
        break;
            
    case InstanceOf:
        node.setCanExit(true);
        // Again, sadly, we don't propagate the fact that we've done InstanceOf
        if (!(m_graph[node.child1()].prediction() & ~SpecCell) && !(forNode(node.child1()).m_type & ~SpecCell))
            forNode(node.child1()).filter(SpecCell);
        forNode(node.child3()).filter(SpecCell);
        forNode(nodeIndex).set(SpecBoolean);
        break;
            
    case Phi:
    case Flush:
        node.setCanExit(false);
        break;
            
    case Breakpoint:
        node.setCanExit(false);
        break;
            
    case Call:
    case Construct:
    case Resolve:
    case ResolveBase:
    case ResolveBaseStrictPut:
    case ResolveGlobal:
        node.setCanExit(true);
        clobberWorld(node.codeOrigin, indexInBlock);
        forNode(nodeIndex).makeTop();
        break;
            
    case ForceOSRExit:
        node.setCanExit(true);
        m_isValid = false;
        break;
            
    case Phantom:
    case InlineStart:
    case Nop:
        node.setCanExit(false);
        break;
        
    case LastNodeType:
        ASSERT_NOT_REACHED();
        break;
    }
    
    return m_isValid;
}

inline void AbstractState::clobberWorld(const CodeOrigin& codeOrigin, unsigned indexInBlock)
{
    if (codeOrigin.inlineCallFrame) {
        const BitVector& capturedVars = codeOrigin.inlineCallFrame->capturedVars;
        for (size_t i = capturedVars.size(); i--;) {
            if (!capturedVars.quickGet(i))
                continue;
            m_variables.local(i).makeTop();
        }
    } else {
        for (size_t i = m_codeBlock->m_numCapturedVars; i--;)
            m_variables.local(i).makeTop();
    }
    if (m_codeBlock->argumentsAreCaptured()) {
        for (size_t i = m_variables.numberOfArguments(); i--;)
            m_variables.argument(i).makeTop();
    }
    clobberStructures(indexInBlock);
}

inline void AbstractState::clobberStructures(unsigned indexInBlock)
{
    if (!m_haveStructures)
        return;
    for (size_t i = indexInBlock + 1; i--;)
        forNode(m_block->at(i)).clobberStructures();
    for (size_t i = m_variables.numberOfArguments(); i--;)
        m_variables.argument(i).clobberStructures();
    for (size_t i = m_variables.numberOfLocals(); i--;)
        m_variables.local(i).clobberStructures();
    m_haveStructures = false;
    m_didClobber = true;
}

inline bool AbstractState::mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, NodeIndex nodeIndex)
{
    if (nodeIndex == NoNode)
        return false;
        
    AbstractValue source;
        
    Node& node = m_graph[nodeIndex];
    if (!node.refCount())
        return false;
    
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
    dataLog("          It's live, node @%u.\n", nodeIndex);
#endif
    
    if (node.variableAccessData()->isCaptured()) {
        source = inVariable;
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("          Transfering ");
        source.dump(WTF::dataFile());
        dataLog(" from last access due to captured variable.\n");
#endif
    } else {
        switch (node.op()) {
        case Phi:
        case SetArgument:
        case Flush:
            // The block transfers the value from head to tail.
            source = inVariable;
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("          Transfering ");
            source.dump(WTF::dataFile());
            dataLog(" from head to tail.\n");
#endif
            break;
            
        case GetLocal:
            // The block refines the value with additional speculations.
            source = forNode(nodeIndex);
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("          Refining to ");
            source.dump(WTF::dataFile());
            dataLog("\n");
#endif
            break;
            
        case SetLocal:
            // The block sets the variable, and potentially refines it, both
            // before and after setting it.
            if (node.variableAccessData()->shouldUseDoubleFormat()) {
                // FIXME: This unnecessarily loses precision.
                source.set(SpecDouble);
            } else
                source = forNode(node.child1());
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
            dataLog("          Setting to ");
            source.dump(WTF::dataFile());
            dataLog("\n");
#endif
            break;
        
        default:
            ASSERT_NOT_REACHED();
            break;
        }
    }
    
    if (destination == source) {
        // Abstract execution did not change the output value of the variable, for this
        // basic block, on this iteration.
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("          Not changed!\n");
#endif
        return false;
    }
    
    // Abstract execution reached a new conclusion about the speculations reached about
    // this variable after execution of this basic block. Update the state, and return
    // true to indicate that the fixpoint must go on!
    destination = source;
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
    dataLog("          Changed!\n");
#endif
    return true;
}

inline bool AbstractState::merge(BasicBlock* from, BasicBlock* to)
{
    ASSERT(from->variablesAtTail.numberOfArguments() == to->variablesAtHead.numberOfArguments());
    ASSERT(from->variablesAtTail.numberOfLocals() == to->variablesAtHead.numberOfLocals());
    
    bool changed = false;
    
    for (size_t argument = 0; argument < from->variablesAtTail.numberOfArguments(); ++argument) {
        AbstractValue& destination = to->valuesAtHead.argument(argument);
        changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.argument(argument), to->variablesAtHead.argument(argument), from->variablesAtTail.argument(argument));
    }
    
    for (size_t local = 0; local < from->variablesAtTail.numberOfLocals(); ++local) {
        AbstractValue& destination = to->valuesAtHead.local(local);
        changed |= mergeVariableBetweenBlocks(destination, from->valuesAtTail.local(local), to->variablesAtHead.local(local), from->variablesAtTail.local(local));
    }

    if (!to->cfaHasVisited)
        changed = true;
    
    to->cfaShouldRevisit |= changed;
    
    return changed;
}

inline bool AbstractState::mergeToSuccessors(
    Graph& graph, BasicBlock* basicBlock, BranchDirection branchDirection)
{
    Node& terminal = graph[basicBlock->last()];
    
    ASSERT(terminal.isTerminal());
    
    switch (terminal.op()) {
    case Jump: {
        ASSERT(branchDirection == InvalidBranchDirection);
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("        Merging to block #%u.\n", terminal.takenBlockIndex());
#endif
        return merge(basicBlock, graph.m_blocks[terminal.takenBlockIndex()].get());
    }
        
    case Branch: {
        ASSERT(branchDirection != InvalidBranchDirection);
        bool changed = false;
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("        Merging to block #%u.\n", terminal.takenBlockIndex());
#endif
        if (branchDirection != TakeFalse)
            changed |= merge(basicBlock, graph.m_blocks[terminal.takenBlockIndex()].get());
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
        dataLog("        Merging to block #%u.\n", terminal.notTakenBlockIndex());
#endif
        if (branchDirection != TakeTrue)
            changed |= merge(basicBlock, graph.m_blocks[terminal.notTakenBlockIndex()].get());
        return changed;
    }
        
    case Return:
    case Throw:
    case ThrowReferenceError:
        ASSERT(branchDirection == InvalidBranchDirection);
        return false;
        
    default:
        ASSERT_NOT_REACHED();
        return false;
    }
}

inline bool AbstractState::mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, NodeIndex destinationNodeIndex, NodeIndex sourceNodeIndex)
{
    if (destinationNodeIndex == NoNode)
        return false;
    
    ASSERT_UNUSED(sourceNodeIndex, sourceNodeIndex != NoNode);
    
    // FIXME: We could do some sparse conditional propagation here!
    
    return destination.merge(source);
}

void AbstractState::dump(FILE* out)
{
    bool first = true;
    for (size_t i = 0; i < m_block->size(); ++i) {
        NodeIndex index = m_block->at(i);
        AbstractValue& value = m_nodes[index];
        if (value.isClear())
            continue;
        if (first)
            first = false;
        else
            fprintf(out, " ");
        fprintf(out, "@%lu:", static_cast<unsigned long>(index));
        value.dump(out);
    }
}

} } // namespace JSC::DFG

#endif // ENABLE(DFG_JIT)