src/hydrogen.cc

   1 // Copyright 2013 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/hydrogen.h"
   6
   7 #include <sstream>
   8
   9 #include "src/allocation-site-scopes.h"
  10 #include "src/ast-numbering.h"
  11 #include "src/full-codegen/full-codegen.h"
  12 #include "src/hydrogen-bce.h"
  13 #include "src/hydrogen-bch.h"
  14 #include "src/hydrogen-canonicalize.h"
  15 #include "src/hydrogen-check-elimination.h"
  16 #include "src/hydrogen-dce.h"
  17 #include "src/hydrogen-dehoist.h"
  18 #include "src/hydrogen-environment-liveness.h"
  19 #include "src/hydrogen-escape-analysis.h"
  20 #include "src/hydrogen-gvn.h"
  21 #include "src/hydrogen-infer-representation.h"
  22 #include "src/hydrogen-infer-types.h"
  23 #include "src/hydrogen-load-elimination.h"
  24 #include "src/hydrogen-mark-deoptimize.h"
  25 #include "src/hydrogen-mark-unreachable.h"
  26 #include "src/hydrogen-osr.h"
  27 #include "src/hydrogen-range-analysis.h"
  28 #include "src/hydrogen-redundant-phi.h"
  29 #include "src/hydrogen-removable-simulates.h"
  30 #include "src/hydrogen-representation-changes.h"
  31 #include "src/hydrogen-sce.h"
  32 #include "src/hydrogen-store-elimination.h"
  33 #include "src/hydrogen-uint32-analysis.h"
  34 #include "src/ic/call-optimization.h"
  35 #include "src/ic/ic.h"
  36 // GetRootConstructor
  37 #include "src/ic/ic-inl.h"
  38 #include "src/lithium-allocator.h"
  39 #include "src/parser.h"
  40 #include "src/runtime/runtime.h"
  41 #include "src/scopeinfo.h"
  42 #include "src/typing.h"
  43
  44 #if V8_TARGET_ARCH_IA32
  45 #include "src/ia32/lithium-codegen-ia32.h"  // NOLINT
  46 #elif V8_TARGET_ARCH_X64
  47 #include "src/x64/lithium-codegen-x64.h"  // NOLINT
  48 #elif V8_TARGET_ARCH_ARM64
  49 #include "src/arm64/lithium-codegen-arm64.h"  // NOLINT
  50 #elif V8_TARGET_ARCH_ARM
  51 #include "src/arm/lithium-codegen-arm.h"  // NOLINT
  52 #elif V8_TARGET_ARCH_PPC
  53 #include "src/ppc/lithium-codegen-ppc.h"  // NOLINT
  54 #elif V8_TARGET_ARCH_MIPS
  55 #include "src/mips/lithium-codegen-mips.h"  // NOLINT
  56 #elif V8_TARGET_ARCH_MIPS64
  57 #include "src/mips64/lithium-codegen-mips64.h"  // NOLINT
  58 #elif V8_TARGET_ARCH_X87
  59 #include "src/x87/lithium-codegen-x87.h"  // NOLINT
  60 #else
  61 #error Unsupported target architecture.
  62 #endif
  63
  64 namespace v8 {
  65 namespace internal {
  66
  67 HBasicBlock::HBasicBlock(HGraph* graph)
  68     : block_id_(graph->GetNextBlockID()),
  69       graph_(graph),
  70       phis_(4, graph->zone()),
  71       first_(NULL),
  72       last_(NULL),
  73       end_(NULL),
  74       loop_information_(NULL),
  75       predecessors_(2, graph->zone()),
  76       dominator_(NULL),
  77       dominated_blocks_(4, graph->zone()),
  78       last_environment_(NULL),
  79       argument_count_(-1),
  80       first_instruction_index_(-1),
  81       last_instruction_index_(-1),
  82       deleted_phis_(4, graph->zone()),
  83       parent_loop_header_(NULL),
  84       inlined_entry_block_(NULL),
  85       is_inline_return_target_(false),
  86       is_reachable_(true),
  87       dominates_loop_successors_(false),
  88       is_osr_entry_(false),
  89       is_ordered_(false) { }
  90
  91
  92 Isolate* HBasicBlock::isolate() const {
  93   return graph_->isolate();
  94 }
  95
  96
  97 void HBasicBlock::MarkUnreachable() {
  98   is_reachable_ = false;
  99 }
 100
 101
 102 void HBasicBlock::AttachLoopInformation() {
 103   DCHECK(!IsLoopHeader());
 104   loop_information_ = new(zone()) HLoopInformation(this, zone());
 105 }
 106
 107
 108 void HBasicBlock::DetachLoopInformation() {
 109   DCHECK(IsLoopHeader());
 110   loop_information_ = NULL;
 111 }
 112
 113
 114 void HBasicBlock::AddPhi(HPhi* phi) {
 115   DCHECK(!IsStartBlock());
 116   phis_.Add(phi, zone());
 117   phi->SetBlock(this);
 118 }
 119
 120
 121 void HBasicBlock::RemovePhi(HPhi* phi) {
 122   DCHECK(phi->block() == this);
 123   DCHECK(phis_.Contains(phi));
 124   phi->Kill();
 125   phis_.RemoveElement(phi);
 126   phi->SetBlock(NULL);
 127 }
 128
 129
 130 void HBasicBlock::AddInstruction(HInstruction* instr, SourcePosition position) {
 131   DCHECK(!IsStartBlock() || !IsFinished());
 132   DCHECK(!instr->IsLinked());
 133   DCHECK(!IsFinished());
 134
 135   if (!position.IsUnknown()) {
 136     instr->set_position(position);
 137   }
 138   if (first_ == NULL) {
 139     DCHECK(last_environment() != NULL);
 140     DCHECK(!last_environment()->ast_id().IsNone());
 141     HBlockEntry* entry = new(zone()) HBlockEntry();
 142     entry->InitializeAsFirst(this);
 143     if (!position.IsUnknown()) {
 144       entry->set_position(position);
 145     } else {
 146       DCHECK(!FLAG_hydrogen_track_positions ||
 147              !graph()->info()->IsOptimizing() || instr->IsAbnormalExit());
 148     }
 149     first_ = last_ = entry;
 150   }
 151   instr->InsertAfter(last_);
 152 }
 153
 154
 155 HPhi* HBasicBlock::AddNewPhi(int merged_index) {
 156   if (graph()->IsInsideNoSideEffectsScope()) {
 157     merged_index = HPhi::kInvalidMergedIndex;
 158   }
 159   HPhi* phi = new(zone()) HPhi(merged_index, zone());
 160   AddPhi(phi);
 161   return phi;
 162 }
 163
 164
 165 HSimulate* HBasicBlock::CreateSimulate(BailoutId ast_id,
 166                                        RemovableSimulate removable) {
 167   DCHECK(HasEnvironment());
 168   HEnvironment* environment = last_environment();
 169   DCHECK(ast_id.IsNone() ||
 170          ast_id == BailoutId::StubEntry() ||
 171          environment->closure()->shared()->VerifyBailoutId(ast_id));
 172
 173   int push_count = environment->push_count();
 174   int pop_count = environment->pop_count();
 175
 176   HSimulate* instr =
 177       new(zone()) HSimulate(ast_id, pop_count, zone(), removable);
 178 #ifdef DEBUG
 179   instr->set_closure(environment->closure());
 180 #endif
 181   // Order of pushed values: newest (top of stack) first. This allows
 182   // HSimulate::MergeWith() to easily append additional pushed values
 183   // that are older (from further down the stack).
 184   for (int i = 0; i < push_count; ++i) {
 185     instr->AddPushedValue(environment->ExpressionStackAt(i));
 186   }
 187   for (GrowableBitVector::Iterator it(environment->assigned_variables(),
 188                                       zone());
 189        !it.Done();
 190        it.Advance()) {
 191     int index = it.Current();
 192     instr->AddAssignedValue(index, environment->Lookup(index));
 193   }
 194   environment->ClearHistory();
 195   return instr;
 196 }
 197
 198
 199 void HBasicBlock::Finish(HControlInstruction* end, SourcePosition position) {
 200   DCHECK(!IsFinished());
 201   AddInstruction(end, position);
 202   end_ = end;
 203   for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 204     it.Current()->RegisterPredecessor(this);
 205   }
 206 }
 207
 208
 209 void HBasicBlock::Goto(HBasicBlock* block, SourcePosition position,
 210                        FunctionState* state, bool add_simulate) {
 211   bool drop_extra = state != NULL &&
 212       state->inlining_kind() == NORMAL_RETURN;
 213
 214   if (block->IsInlineReturnTarget()) {
 215     HEnvironment* env = last_environment();
 216     int argument_count = env->arguments_environment()->parameter_count();
 217     AddInstruction(new(zone())
 218                    HLeaveInlined(state->entry(), argument_count),
 219                    position);
 220     UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 221   }
 222
 223   if (add_simulate) AddNewSimulate(BailoutId::None(), position);
 224   HGoto* instr = new(zone()) HGoto(block);
 225   Finish(instr, position);
 226 }
 227
 228
 229 void HBasicBlock::AddLeaveInlined(HValue* return_value, FunctionState* state,
 230                                   SourcePosition position) {
 231   HBasicBlock* target = state->function_return();
 232   bool drop_extra = state->inlining_kind() == NORMAL_RETURN;
 233
 234   DCHECK(target->IsInlineReturnTarget());
 235   DCHECK(return_value != NULL);
 236   HEnvironment* env = last_environment();
 237   int argument_count = env->arguments_environment()->parameter_count();
 238   AddInstruction(new(zone()) HLeaveInlined(state->entry(), argument_count),
 239                  position);
 240   UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 241   last_environment()->Push(return_value);
 242   AddNewSimulate(BailoutId::None(), position);
 243   HGoto* instr = new(zone()) HGoto(target);
 244   Finish(instr, position);
 245 }
 246
 247
 248 void HBasicBlock::SetInitialEnvironment(HEnvironment* env) {
 249   DCHECK(!HasEnvironment());
 250   DCHECK(first() == NULL);
 251   UpdateEnvironment(env);
 252 }
 253
 254
 255 void HBasicBlock::UpdateEnvironment(HEnvironment* env) {
 256   last_environment_ = env;
 257   graph()->update_maximum_environment_size(env->first_expression_index());
 258 }
 259
 260
 261 void HBasicBlock::SetJoinId(BailoutId ast_id) {
 262   int length = predecessors_.length();
 263   DCHECK(length > 0);
 264   for (int i = 0; i < length; i++) {
 265     HBasicBlock* predecessor = predecessors_[i];
 266     DCHECK(predecessor->end()->IsGoto());
 267     HSimulate* simulate = HSimulate::cast(predecessor->end()->previous());
 268     DCHECK(i != 0 ||
 269            (predecessor->last_environment()->closure().is_null() ||
 270             predecessor->last_environment()->closure()->shared()
 271               ->VerifyBailoutId(ast_id)));
 272     simulate->set_ast_id(ast_id);
 273     predecessor->last_environment()->set_ast_id(ast_id);
 274   }
 275 }
 276
 277
 278 bool HBasicBlock::Dominates(HBasicBlock* other) const {
 279   HBasicBlock* current = other->dominator();
 280   while (current != NULL) {
 281     if (current == this) return true;
 282     current = current->dominator();
 283   }
 284   return false;
 285 }
 286
 287
 288 bool HBasicBlock::EqualToOrDominates(HBasicBlock* other) const {
 289   if (this == other) return true;
 290   return Dominates(other);
 291 }
 292
 293
 294 int HBasicBlock::LoopNestingDepth() const {
 295   const HBasicBlock* current = this;
 296   int result  = (current->IsLoopHeader()) ? 1 : 0;
 297   while (current->parent_loop_header() != NULL) {
 298     current = current->parent_loop_header();
 299     result++;
 300   }
 301   return result;
 302 }
 303
 304
 305 void HBasicBlock::PostProcessLoopHeader(IterationStatement* stmt) {
 306   DCHECK(IsLoopHeader());
 307
 308   SetJoinId(stmt->EntryId());
 309   if (predecessors()->length() == 1) {
 310     // This is a degenerated loop.
 311     DetachLoopInformation();
 312     return;
 313   }
 314
 315   // Only the first entry into the loop is from outside the loop. All other
 316   // entries must be back edges.
 317   for (int i = 1; i < predecessors()->length(); ++i) {
 318     loop_information()->RegisterBackEdge(predecessors()->at(i));
 319   }
 320 }
 321
 322
 323 void HBasicBlock::MarkSuccEdgeUnreachable(int succ) {
 324   DCHECK(IsFinished());
 325   HBasicBlock* succ_block = end()->SuccessorAt(succ);
 326
 327   DCHECK(succ_block->predecessors()->length() == 1);
 328   succ_block->MarkUnreachable();
 329 }
 330
 331
 332 void HBasicBlock::RegisterPredecessor(HBasicBlock* pred) {
 333   if (HasPredecessor()) {
 334     // Only loop header blocks can have a predecessor added after
 335     // instructions have been added to the block (they have phis for all
 336     // values in the environment, these phis may be eliminated later).
 337     DCHECK(IsLoopHeader() || first_ == NULL);
 338     HEnvironment* incoming_env = pred->last_environment();
 339     if (IsLoopHeader()) {
 340       DCHECK_EQ(phis()->length(), incoming_env->length());
 341       for (int i = 0; i < phis_.length(); ++i) {
 342         phis_[i]->AddInput(incoming_env->values()->at(i));
 343       }
 344     } else {
 345       last_environment()->AddIncomingEdge(this, pred->last_environment());
 346     }
 347   } else if (!HasEnvironment() && !IsFinished()) {
 348     DCHECK(!IsLoopHeader());
 349     SetInitialEnvironment(pred->last_environment()->Copy());
 350   }
 351
 352   predecessors_.Add(pred, zone());
 353 }
 354
 355
 356 void HBasicBlock::AddDominatedBlock(HBasicBlock* block) {
 357   DCHECK(!dominated_blocks_.Contains(block));
 358   // Keep the list of dominated blocks sorted such that if there is two
 359   // succeeding block in this list, the predecessor is before the successor.
 360   int index = 0;
 361   while (index < dominated_blocks_.length() &&
 362          dominated_blocks_[index]->block_id() < block->block_id()) {
 363     ++index;
 364   }
 365   dominated_blocks_.InsertAt(index, block, zone());
 366 }
 367
 368
 369 void HBasicBlock::AssignCommonDominator(HBasicBlock* other) {
 370   if (dominator_ == NULL) {
 371     dominator_ = other;
 372     other->AddDominatedBlock(this);
 373   } else if (other->dominator() != NULL) {
 374     HBasicBlock* first = dominator_;
 375     HBasicBlock* second = other;
 376
 377     while (first != second) {
 378       if (first->block_id() > second->block_id()) {
 379         first = first->dominator();
 380       } else {
 381         second = second->dominator();
 382       }
 383       DCHECK(first != NULL && second != NULL);
 384     }
 385
 386     if (dominator_ != first) {
 387       DCHECK(dominator_->dominated_blocks_.Contains(this));
 388       dominator_->dominated_blocks_.RemoveElement(this);
 389       dominator_ = first;
 390       first->AddDominatedBlock(this);
 391     }
 392   }
 393 }
 394
 395
 396 void HBasicBlock::AssignLoopSuccessorDominators() {
 397   // Mark blocks that dominate all subsequent reachable blocks inside their
 398   // loop. Exploit the fact that blocks are sorted in reverse post order. When
 399   // the loop is visited in increasing block id order, if the number of
 400   // non-loop-exiting successor edges at the dominator_candidate block doesn't
 401   // exceed the number of previously encountered predecessor edges, there is no
 402   // path from the loop header to any block with higher id that doesn't go
 403   // through the dominator_candidate block. In this case, the
 404   // dominator_candidate block is guaranteed to dominate all blocks reachable
 405   // from it with higher ids.
 406   HBasicBlock* last = loop_information()->GetLastBackEdge();
 407   int outstanding_successors = 1;  // one edge from the pre-header
 408   // Header always dominates everything.
 409   MarkAsLoopSuccessorDominator();
 410   for (int j = block_id(); j <= last->block_id(); ++j) {
 411     HBasicBlock* dominator_candidate = graph_->blocks()->at(j);
 412     for (HPredecessorIterator it(dominator_candidate); !it.Done();
 413          it.Advance()) {
 414       HBasicBlock* predecessor = it.Current();
 415       // Don't count back edges.
 416       if (predecessor->block_id() < dominator_candidate->block_id()) {
 417         outstanding_successors--;
 418       }
 419     }
 420
 421     // If more successors than predecessors have been seen in the loop up to
 422     // now, it's not possible to guarantee that the current block dominates
 423     // all of the blocks with higher IDs. In this case, assume conservatively
 424     // that those paths through loop that don't go through the current block
 425     // contain all of the loop's dependencies. Also be careful to record
 426     // dominator information about the current loop that's being processed,
 427     // and not nested loops, which will be processed when
 428     // AssignLoopSuccessorDominators gets called on their header.
 429     DCHECK(outstanding_successors >= 0);
 430     HBasicBlock* parent_loop_header = dominator_candidate->parent_loop_header();
 431     if (outstanding_successors == 0 &&
 432         (parent_loop_header == this && !dominator_candidate->IsLoopHeader())) {
 433       dominator_candidate->MarkAsLoopSuccessorDominator();
 434     }
 435     HControlInstruction* end = dominator_candidate->end();
 436     for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 437       HBasicBlock* successor = it.Current();
 438       // Only count successors that remain inside the loop and don't loop back
 439       // to a loop header.
 440       if (successor->block_id() > dominator_candidate->block_id() &&
 441           successor->block_id() <= last->block_id()) {
 442         // Backwards edges must land on loop headers.
 443         DCHECK(successor->block_id() > dominator_candidate->block_id() ||
 444                successor->IsLoopHeader());
 445         outstanding_successors++;
 446       }
 447     }
 448   }
 449 }
 450
 451
 452 int HBasicBlock::PredecessorIndexOf(HBasicBlock* predecessor) const {
 453   for (int i = 0; i < predecessors_.length(); ++i) {
 454     if (predecessors_[i] == predecessor) return i;
 455   }
 456   UNREACHABLE();
 457   return -1;
 458 }
 459
 460
 461 #ifdef DEBUG
 462 void HBasicBlock::Verify() {
 463   // Check that every block is finished.
 464   DCHECK(IsFinished());
 465   DCHECK(block_id() >= 0);
 466
 467   // Check that the incoming edges are in edge split form.
 468   if (predecessors_.length() > 1) {
 469     for (int i = 0; i < predecessors_.length(); ++i) {
 470       DCHECK(predecessors_[i]->end()->SecondSuccessor() == NULL);
 471     }
 472   }
 473 }
 474 #endif
 475
 476
 477 void HLoopInformation::RegisterBackEdge(HBasicBlock* block) {
 478   this->back_edges_.Add(block, block->zone());
 479   AddBlock(block);
 480 }
 481
 482
 483 HBasicBlock* HLoopInformation::GetLastBackEdge() const {
 484   int max_id = -1;
 485   HBasicBlock* result = NULL;
 486   for (int i = 0; i < back_edges_.length(); ++i) {
 487     HBasicBlock* cur = back_edges_[i];
 488     if (cur->block_id() > max_id) {
 489       max_id = cur->block_id();
 490       result = cur;
 491     }
 492   }
 493   return result;
 494 }
 495
 496
 497 void HLoopInformation::AddBlock(HBasicBlock* block) {
 498   if (block == loop_header()) return;
 499   if (block->parent_loop_header() == loop_header()) return;
 500   if (block->parent_loop_header() != NULL) {
 501     AddBlock(block->parent_loop_header());
 502   } else {
 503     block->set_parent_loop_header(loop_header());
 504     blocks_.Add(block, block->zone());
 505     for (int i = 0; i < block->predecessors()->length(); ++i) {
 506       AddBlock(block->predecessors()->at(i));
 507     }
 508   }
 509 }
 510
 511
 512 #ifdef DEBUG
 513
 514 // Checks reachability of the blocks in this graph and stores a bit in
 515 // the BitVector "reachable()" for every block that can be reached
 516 // from the start block of the graph. If "dont_visit" is non-null, the given
 517 // block is treated as if it would not be part of the graph. "visited_count()"
 518 // returns the number of reachable blocks.
 519 class ReachabilityAnalyzer BASE_EMBEDDED {
 520  public:
 521   ReachabilityAnalyzer(HBasicBlock* entry_block,
 522                        int block_count,
 523                        HBasicBlock* dont_visit)
 524       : visited_count_(0),
 525         stack_(16, entry_block->zone()),
 526         reachable_(block_count, entry_block->zone()),
 527         dont_visit_(dont_visit) {
 528     PushBlock(entry_block);
 529     Analyze();
 530   }
 531
 532   int visited_count() const { return visited_count_; }
 533   const BitVector* reachable() const { return &reachable_; }
 534
 535  private:
 536   void PushBlock(HBasicBlock* block) {
 537     if (block != NULL && block != dont_visit_ &&
 538         !reachable_.Contains(block->block_id())) {
 539       reachable_.Add(block->block_id());
 540       stack_.Add(block, block->zone());
 541       visited_count_++;
 542     }
 543   }
 544
 545   void Analyze() {
 546     while (!stack_.is_empty()) {
 547       HControlInstruction* end = stack_.RemoveLast()->end();
 548       for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 549         PushBlock(it.Current());
 550       }
 551     }
 552   }
 553
 554   int visited_count_;
 555   ZoneList<HBasicBlock*> stack_;
 556   BitVector reachable_;
 557   HBasicBlock* dont_visit_;
 558 };
 559
 560
 561 void HGraph::Verify(bool do_full_verify) const {
 562   Heap::RelocationLock relocation_lock(isolate()->heap());
 563   AllowHandleDereference allow_deref;
 564   AllowDeferredHandleDereference allow_deferred_deref;
 565   for (int i = 0; i < blocks_.length(); i++) {
 566     HBasicBlock* block = blocks_.at(i);
 567
 568     block->Verify();
 569
 570     // Check that every block contains at least one node and that only the last
 571     // node is a control instruction.
 572     HInstruction* current = block->first();
 573     DCHECK(current != NULL && current->IsBlockEntry());
 574     while (current != NULL) {
 575       DCHECK((current->next() == NULL) == current->IsControlInstruction());
 576       DCHECK(current->block() == block);
 577       current->Verify();
 578       current = current->next();
 579     }
 580
 581     // Check that successors are correctly set.
 582     HBasicBlock* first = block->end()->FirstSuccessor();
 583     HBasicBlock* second = block->end()->SecondSuccessor();
 584     DCHECK(second == NULL || first != NULL);
 585
 586     // Check that the predecessor array is correct.
 587     if (first != NULL) {
 588       DCHECK(first->predecessors()->Contains(block));
 589       if (second != NULL) {
 590         DCHECK(second->predecessors()->Contains(block));
 591       }
 592     }
 593
 594     // Check that phis have correct arguments.
 595     for (int j = 0; j < block->phis()->length(); j++) {
 596       HPhi* phi = block->phis()->at(j);
 597       phi->Verify();
 598     }
 599
 600     // Check that all join blocks have predecessors that end with an
 601     // unconditional goto and agree on their environment node id.
 602     if (block->predecessors()->length() >= 2) {
 603       BailoutId id =
 604           block->predecessors()->first()->last_environment()->ast_id();
 605       for (int k = 0; k < block->predecessors()->length(); k++) {
 606         HBasicBlock* predecessor = block->predecessors()->at(k);
 607         DCHECK(predecessor->end()->IsGoto() ||
 608                predecessor->end()->IsDeoptimize());
 609         DCHECK(predecessor->last_environment()->ast_id() == id);
 610       }
 611     }
 612   }
 613
 614   // Check special property of first block to have no predecessors.
 615   DCHECK(blocks_.at(0)->predecessors()->is_empty());
 616
 617   if (do_full_verify) {
 618     // Check that the graph is fully connected.
 619     ReachabilityAnalyzer analyzer(entry_block_, blocks_.length(), NULL);
 620     DCHECK(analyzer.visited_count() == blocks_.length());
 621
 622     // Check that entry block dominator is NULL.
 623     DCHECK(entry_block_->dominator() == NULL);
 624
 625     // Check dominators.
 626     for (int i = 0; i < blocks_.length(); ++i) {
 627       HBasicBlock* block = blocks_.at(i);
 628       if (block->dominator() == NULL) {
 629         // Only start block may have no dominator assigned to.
 630         DCHECK(i == 0);
 631       } else {
 632         // Assert that block is unreachable if dominator must not be visited.
 633         ReachabilityAnalyzer dominator_analyzer(entry_block_,
 634                                                 blocks_.length(),
 635                                                 block->dominator());
 636         DCHECK(!dominator_analyzer.reachable()->Contains(block->block_id()));
 637       }
 638     }
 639   }
 640 }
 641
 642 #endif
 643
 644
 645 HConstant* HGraph::GetConstant(SetOncePointer<HConstant>* pointer,
 646                                int32_t value) {
 647   if (!pointer->is_set()) {
 648     // Can't pass GetInvalidContext() to HConstant::New, because that will
 649     // recursively call GetConstant
 650     HConstant* constant = HConstant::New(isolate(), zone(), NULL, value);
 651     constant->InsertAfter(entry_block()->first());
 652     pointer->set(constant);
 653     return constant;
 654   }
 655   return ReinsertConstantIfNecessary(pointer->get());
 656 }
 657
 658
 659 HConstant* HGraph::ReinsertConstantIfNecessary(HConstant* constant) {
 660   if (!constant->IsLinked()) {
 661     // The constant was removed from the graph. Reinsert.
 662     constant->ClearFlag(HValue::kIsDead);
 663     constant->InsertAfter(entry_block()->first());
 664   }
 665   return constant;
 666 }
 667
 668
 669 HConstant* HGraph::GetConstant0() {
 670   return GetConstant(&constant_0_, 0);
 671 }
 672
 673
 674 HConstant* HGraph::GetConstant1() {
 675   return GetConstant(&constant_1_, 1);
 676 }
 677
 678
 679 HConstant* HGraph::GetConstantMinus1() {
 680   return GetConstant(&constant_minus1_, -1);
 681 }
 682
 683
 684 HConstant* HGraph::GetConstantBool(bool value) {
 685   return value ? GetConstantTrue() : GetConstantFalse();
 686 }
 687
 688
 689 #define DEFINE_GET_CONSTANT(Name, name, type, htype, boolean_value)            \
 690 HConstant* HGraph::GetConstant##Name() {                                       \
 691   if (!constant_##name##_.is_set()) {                                          \
 692     HConstant* constant = new(zone()) HConstant(                               \
 693         Unique<Object>::CreateImmovable(isolate()->factory()->name##_value()), \
 694         Unique<Map>::CreateImmovable(isolate()->factory()->type##_map()),      \
 695         false,                                                                 \
 696         Representation::Tagged(),                                              \
 697         htype,                                                                 \
 698         true,                                                                  \
 699         boolean_value,                                                         \
 700         false,                                                                 \
 701         ODDBALL_TYPE);                                                         \
 702     constant->InsertAfter(entry_block()->first());                             \
 703     constant_##name##_.set(constant);                                          \
 704   }                                                                            \
 705   return ReinsertConstantIfNecessary(constant_##name##_.get());                \
 706 }
 707
 708
 709 DEFINE_GET_CONSTANT(Undefined, undefined, undefined, HType::Undefined(), false)
 710 DEFINE_GET_CONSTANT(True, true, boolean, HType::Boolean(), true)
 711 DEFINE_GET_CONSTANT(False, false, boolean, HType::Boolean(), false)
 712 DEFINE_GET_CONSTANT(Hole, the_hole, the_hole, HType::None(), false)
 713 DEFINE_GET_CONSTANT(Null, null, null, HType::Null(), false)
 714
 715
 716 #undef DEFINE_GET_CONSTANT
 717
 718 #define DEFINE_IS_CONSTANT(Name, name)                                         \
 719 bool HGraph::IsConstant##Name(HConstant* constant) {                           \
 720   return constant_##name##_.is_set() && constant == constant_##name##_.get();  \
 721 }
 722 DEFINE_IS_CONSTANT(Undefined, undefined)
 723 DEFINE_IS_CONSTANT(0, 0)
 724 DEFINE_IS_CONSTANT(1, 1)
 725 DEFINE_IS_CONSTANT(Minus1, minus1)
 726 DEFINE_IS_CONSTANT(True, true)
 727 DEFINE_IS_CONSTANT(False, false)
 728 DEFINE_IS_CONSTANT(Hole, the_hole)
 729 DEFINE_IS_CONSTANT(Null, null)
 730
 731 #undef DEFINE_IS_CONSTANT
 732
 733
 734 HConstant* HGraph::GetInvalidContext() {
 735   return GetConstant(&constant_invalid_context_, 0xFFFFC0C7);
 736 }
 737
 738
 739 bool HGraph::IsStandardConstant(HConstant* constant) {
 740   if (IsConstantUndefined(constant)) return true;
 741   if (IsConstant0(constant)) return true;
 742   if (IsConstant1(constant)) return true;
 743   if (IsConstantMinus1(constant)) return true;
 744   if (IsConstantTrue(constant)) return true;
 745   if (IsConstantFalse(constant)) return true;
 746   if (IsConstantHole(constant)) return true;
 747   if (IsConstantNull(constant)) return true;
 748   return false;
 749 }
 750
 751
 752 HGraphBuilder::IfBuilder::IfBuilder() : builder_(NULL), needs_compare_(true) {}
 753
 754
 755 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder)
 756     : needs_compare_(true) {
 757   Initialize(builder);
 758 }
 759
 760
 761 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder,
 762                                     HIfContinuation* continuation)
 763     : needs_compare_(false), first_true_block_(NULL), first_false_block_(NULL) {
 764   InitializeDontCreateBlocks(builder);
 765   continuation->Continue(&first_true_block_, &first_false_block_);
 766 }
 767
 768
 769 void HGraphBuilder::IfBuilder::InitializeDontCreateBlocks(
 770     HGraphBuilder* builder) {
 771   builder_ = builder;
 772   finished_ = false;
 773   did_then_ = false;
 774   did_else_ = false;
 775   did_else_if_ = false;
 776   did_and_ = false;
 777   did_or_ = false;
 778   captured_ = false;
 779   pending_merge_block_ = false;
 780   split_edge_merge_block_ = NULL;
 781   merge_at_join_blocks_ = NULL;
 782   normal_merge_at_join_block_count_ = 0;
 783   deopt_merge_at_join_block_count_ = 0;
 784 }
 785
 786
 787 void HGraphBuilder::IfBuilder::Initialize(HGraphBuilder* builder) {
 788   InitializeDontCreateBlocks(builder);
 789   HEnvironment* env = builder->environment();
 790   first_true_block_ = builder->CreateBasicBlock(env->Copy());
 791   first_false_block_ = builder->CreateBasicBlock(env->Copy());
 792 }
 793
 794
 795 HControlInstruction* HGraphBuilder::IfBuilder::AddCompare(
 796     HControlInstruction* compare) {
 797   DCHECK(did_then_ == did_else_);
 798   if (did_else_) {
 799     // Handle if-then-elseif
 800     did_else_if_ = true;
 801     did_else_ = false;
 802     did_then_ = false;
 803     did_and_ = false;
 804     did_or_ = false;
 805     pending_merge_block_ = false;
 806     split_edge_merge_block_ = NULL;
 807     HEnvironment* env = builder()->environment();
 808     first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 809     first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 810   }
 811   if (split_edge_merge_block_ != NULL) {
 812     HEnvironment* env = first_false_block_->last_environment();
 813     HBasicBlock* split_edge = builder()->CreateBasicBlock(env->Copy());
 814     if (did_or_) {
 815       compare->SetSuccessorAt(0, split_edge);
 816       compare->SetSuccessorAt(1, first_false_block_);
 817     } else {
 818       compare->SetSuccessorAt(0, first_true_block_);
 819       compare->SetSuccessorAt(1, split_edge);
 820     }
 821     builder()->GotoNoSimulate(split_edge, split_edge_merge_block_);
 822   } else {
 823     compare->SetSuccessorAt(0, first_true_block_);
 824     compare->SetSuccessorAt(1, first_false_block_);
 825   }
 826   builder()->FinishCurrentBlock(compare);
 827   needs_compare_ = false;
 828   return compare;
 829 }
 830
 831
 832 void HGraphBuilder::IfBuilder::Or() {
 833   DCHECK(!needs_compare_);
 834   DCHECK(!did_and_);
 835   did_or_ = true;
 836   HEnvironment* env = first_false_block_->last_environment();
 837   if (split_edge_merge_block_ == NULL) {
 838     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 839     builder()->GotoNoSimulate(first_true_block_, split_edge_merge_block_);
 840     first_true_block_ = split_edge_merge_block_;
 841   }
 842   builder()->set_current_block(first_false_block_);
 843   first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 844 }
 845
 846
 847 void HGraphBuilder::IfBuilder::And() {
 848   DCHECK(!needs_compare_);
 849   DCHECK(!did_or_);
 850   did_and_ = true;
 851   HEnvironment* env = first_false_block_->last_environment();
 852   if (split_edge_merge_block_ == NULL) {
 853     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 854     builder()->GotoNoSimulate(first_false_block_, split_edge_merge_block_);
 855     first_false_block_ = split_edge_merge_block_;
 856   }
 857   builder()->set_current_block(first_true_block_);
 858   first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 859 }
 860
 861
 862 void HGraphBuilder::IfBuilder::CaptureContinuation(
 863     HIfContinuation* continuation) {
 864   DCHECK(!did_else_if_);
 865   DCHECK(!finished_);
 866   DCHECK(!captured_);
 867
 868   HBasicBlock* true_block = NULL;
 869   HBasicBlock* false_block = NULL;
 870   Finish(&true_block, &false_block);
 871   DCHECK(true_block != NULL);
 872   DCHECK(false_block != NULL);
 873   continuation->Capture(true_block, false_block);
 874   captured_ = true;
 875   builder()->set_current_block(NULL);
 876   End();
 877 }
 878
 879
 880 void HGraphBuilder::IfBuilder::JoinContinuation(HIfContinuation* continuation) {
 881   DCHECK(!did_else_if_);
 882   DCHECK(!finished_);
 883   DCHECK(!captured_);
 884   HBasicBlock* true_block = NULL;
 885   HBasicBlock* false_block = NULL;
 886   Finish(&true_block, &false_block);
 887   merge_at_join_blocks_ = NULL;
 888   if (true_block != NULL && !true_block->IsFinished()) {
 889     DCHECK(continuation->IsTrueReachable());
 890     builder()->GotoNoSimulate(true_block, continuation->true_branch());
 891   }
 892   if (false_block != NULL && !false_block->IsFinished()) {
 893     DCHECK(continuation->IsFalseReachable());
 894     builder()->GotoNoSimulate(false_block, continuation->false_branch());
 895   }
 896   captured_ = true;
 897   End();
 898 }
 899
 900
 901 void HGraphBuilder::IfBuilder::Then() {
 902   DCHECK(!captured_);
 903   DCHECK(!finished_);
 904   did_then_ = true;
 905   if (needs_compare_) {
 906     // Handle if's without any expressions, they jump directly to the "else"
 907     // branch. However, we must pretend that the "then" branch is reachable,
 908     // so that the graph builder visits it and sees any live range extending
 909     // constructs within it.
 910     HConstant* constant_false = builder()->graph()->GetConstantFalse();
 911     ToBooleanStub::Types boolean_type = ToBooleanStub::Types();
 912     boolean_type.Add(ToBooleanStub::BOOLEAN);
 913     HBranch* branch = builder()->New<HBranch>(
 914         constant_false, boolean_type, first_true_block_, first_false_block_);
 915     builder()->FinishCurrentBlock(branch);
 916   }
 917   builder()->set_current_block(first_true_block_);
 918   pending_merge_block_ = true;
 919 }
 920
 921
 922 void HGraphBuilder::IfBuilder::Else() {
 923   DCHECK(did_then_);
 924   DCHECK(!captured_);
 925   DCHECK(!finished_);
 926   AddMergeAtJoinBlock(false);
 927   builder()->set_current_block(first_false_block_);
 928   pending_merge_block_ = true;
 929   did_else_ = true;
 930 }
 931
 932
 933 void HGraphBuilder::IfBuilder::Deopt(Deoptimizer::DeoptReason reason) {
 934   DCHECK(did_then_);
 935   builder()->Add<HDeoptimize>(reason, Deoptimizer::EAGER);
 936   AddMergeAtJoinBlock(true);
 937 }
 938
 939
 940 void HGraphBuilder::IfBuilder::Return(HValue* value) {
 941   HValue* parameter_count = builder()->graph()->GetConstantMinus1();
 942   builder()->FinishExitCurrentBlock(
 943       builder()->New<HReturn>(value, parameter_count));
 944   AddMergeAtJoinBlock(false);
 945 }
 946
 947
 948 void HGraphBuilder::IfBuilder::AddMergeAtJoinBlock(bool deopt) {
 949   if (!pending_merge_block_) return;
 950   HBasicBlock* block = builder()->current_block();
 951   DCHECK(block == NULL || !block->IsFinished());
 952   MergeAtJoinBlock* record = new (builder()->zone())
 953       MergeAtJoinBlock(block, deopt, merge_at_join_blocks_);
 954   merge_at_join_blocks_ = record;
 955   if (block != NULL) {
 956     DCHECK(block->end() == NULL);
 957     if (deopt) {
 958       normal_merge_at_join_block_count_++;
 959     } else {
 960       deopt_merge_at_join_block_count_++;
 961     }
 962   }
 963   builder()->set_current_block(NULL);
 964   pending_merge_block_ = false;
 965 }
 966
 967
 968 void HGraphBuilder::IfBuilder::Finish() {
 969   DCHECK(!finished_);
 970   if (!did_then_) {
 971     Then();
 972   }
 973   AddMergeAtJoinBlock(false);
 974   if (!did_else_) {
 975     Else();
 976     AddMergeAtJoinBlock(false);
 977   }
 978   finished_ = true;
 979 }
 980
 981
 982 void HGraphBuilder::IfBuilder::Finish(HBasicBlock** then_continuation,
 983                                       HBasicBlock** else_continuation) {
 984   Finish();
 985
 986   MergeAtJoinBlock* else_record = merge_at_join_blocks_;
 987   if (else_continuation != NULL) {
 988     *else_continuation = else_record->block_;
 989   }
 990   MergeAtJoinBlock* then_record = else_record->next_;
 991   if (then_continuation != NULL) {
 992     *then_continuation = then_record->block_;
 993   }
 994   DCHECK(then_record->next_ == NULL);
 995 }
 996
 997
 998 void HGraphBuilder::IfBuilder::EndUnreachable() {
 999   if (captured_) return;
1000   Finish();
1001   builder()->set_current_block(nullptr);
1002 }
1003
1004
1005 void HGraphBuilder::IfBuilder::End() {
1006   if (captured_) return;
1007   Finish();
1008
1009   int total_merged_blocks = normal_merge_at_join_block_count_ +
1010     deopt_merge_at_join_block_count_;
1011   DCHECK(total_merged_blocks >= 1);
1012   HBasicBlock* merge_block =
1013       total_merged_blocks == 1 ? NULL : builder()->graph()->CreateBasicBlock();
1014
1015   // Merge non-deopt blocks first to ensure environment has right size for
1016   // padding.
1017   MergeAtJoinBlock* current = merge_at_join_blocks_;
1018   while (current != NULL) {
1019     if (!current->deopt_ && current->block_ != NULL) {
1020       // If there is only one block that makes it through to the end of the
1021       // if, then just set it as the current block and continue rather then
1022       // creating an unnecessary merge block.
1023       if (total_merged_blocks == 1) {
1024         builder()->set_current_block(current->block_);
1025         return;
1026       }
1027       builder()->GotoNoSimulate(current->block_, merge_block);
1028     }
1029     current = current->next_;
1030   }
1031
1032   // Merge deopt blocks, padding when necessary.
1033   current = merge_at_join_blocks_;
1034   while (current != NULL) {
1035     if (current->deopt_ && current->block_ != NULL) {
1036       current->block_->FinishExit(
1037           HAbnormalExit::New(builder()->isolate(), builder()->zone(), NULL),
1038           SourcePosition::Unknown());
1039     }
1040     current = current->next_;
1041   }
1042   builder()->set_current_block(merge_block);
1043 }
1044
1045
1046 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder) {
1047   Initialize(builder, NULL, kWhileTrue, NULL);
1048 }
1049
1050
1051 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1052                                         LoopBuilder::Direction direction) {
1053   Initialize(builder, context, direction, builder->graph()->GetConstant1());
1054 }
1055
1056
1057 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1058                                         LoopBuilder::Direction direction,
1059                                         HValue* increment_amount) {
1060   Initialize(builder, context, direction, increment_amount);
1061   increment_amount_ = increment_amount;
1062 }
1063
1064
1065 void HGraphBuilder::LoopBuilder::Initialize(HGraphBuilder* builder,
1066                                             HValue* context,
1067                                             Direction direction,
1068                                             HValue* increment_amount) {
1069   builder_ = builder;
1070   context_ = context;
1071   direction_ = direction;
1072   increment_amount_ = increment_amount;
1073
1074   finished_ = false;
1075   header_block_ = builder->CreateLoopHeaderBlock();
1076   body_block_ = NULL;
1077   exit_block_ = NULL;
1078   exit_trampoline_block_ = NULL;
1079 }
1080
1081
1082 HValue* HGraphBuilder::LoopBuilder::BeginBody(
1083     HValue* initial,
1084     HValue* terminating,
1085     Token::Value token) {
1086   DCHECK(direction_ != kWhileTrue);
1087   HEnvironment* env = builder_->environment();
1088   phi_ = header_block_->AddNewPhi(env->values()->length());
1089   phi_->AddInput(initial);
1090   env->Push(initial);
1091   builder_->GotoNoSimulate(header_block_);
1092
1093   HEnvironment* body_env = env->Copy();
1094   HEnvironment* exit_env = env->Copy();
1095   // Remove the phi from the expression stack
1096   body_env->Pop();
1097   exit_env->Pop();
1098   body_block_ = builder_->CreateBasicBlock(body_env);
1099   exit_block_ = builder_->CreateBasicBlock(exit_env);
1100
1101   builder_->set_current_block(header_block_);
1102   env->Pop();
1103   builder_->FinishCurrentBlock(builder_->New<HCompareNumericAndBranch>(
1104           phi_, terminating, token, body_block_, exit_block_));
1105
1106   builder_->set_current_block(body_block_);
1107   if (direction_ == kPreIncrement || direction_ == kPreDecrement) {
1108     Isolate* isolate = builder_->isolate();
1109     HValue* one = builder_->graph()->GetConstant1();
1110     if (direction_ == kPreIncrement) {
1111       increment_ = HAdd::New(isolate, zone(), context_, phi_, one);
1112     } else {
1113       increment_ = HSub::New(isolate, zone(), context_, phi_, one);
1114     }
1115     increment_->ClearFlag(HValue::kCanOverflow);
1116     builder_->AddInstruction(increment_);
1117     return increment_;
1118   } else {
1119     return phi_;
1120   }
1121 }
1122
1123
1124 void HGraphBuilder::LoopBuilder::BeginBody(int drop_count) {
1125   DCHECK(direction_ == kWhileTrue);
1126   HEnvironment* env = builder_->environment();
1127   builder_->GotoNoSimulate(header_block_);
1128   builder_->set_current_block(header_block_);
1129   env->Drop(drop_count);
1130 }
1131
1132
1133 void HGraphBuilder::LoopBuilder::Break() {
1134   if (exit_trampoline_block_ == NULL) {
1135     // Its the first time we saw a break.
1136     if (direction_ == kWhileTrue) {
1137       HEnvironment* env = builder_->environment()->Copy();
1138       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1139     } else {
1140       HEnvironment* env = exit_block_->last_environment()->Copy();
1141       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1142       builder_->GotoNoSimulate(exit_block_, exit_trampoline_block_);
1143     }
1144   }
1145
1146   builder_->GotoNoSimulate(exit_trampoline_block_);
1147   builder_->set_current_block(NULL);
1148 }
1149
1150
1151 void HGraphBuilder::LoopBuilder::EndBody() {
1152   DCHECK(!finished_);
1153
1154   if (direction_ == kPostIncrement || direction_ == kPostDecrement) {
1155     Isolate* isolate = builder_->isolate();
1156     if (direction_ == kPostIncrement) {
1157       increment_ =
1158           HAdd::New(isolate, zone(), context_, phi_, increment_amount_);
1159     } else {
1160       increment_ =
1161           HSub::New(isolate, zone(), context_, phi_, increment_amount_);
1162     }
1163     increment_->ClearFlag(HValue::kCanOverflow);
1164     builder_->AddInstruction(increment_);
1165   }
1166
1167   if (direction_ != kWhileTrue) {
1168     // Push the new increment value on the expression stack to merge into
1169     // the phi.
1170     builder_->environment()->Push(increment_);
1171   }
1172   HBasicBlock* last_block = builder_->current_block();
1173   builder_->GotoNoSimulate(last_block, header_block_);
1174   header_block_->loop_information()->RegisterBackEdge(last_block);
1175
1176   if (exit_trampoline_block_ != NULL) {
1177     builder_->set_current_block(exit_trampoline_block_);
1178   } else {
1179     builder_->set_current_block(exit_block_);
1180   }
1181   finished_ = true;
1182 }
1183
1184
1185 HGraph* HGraphBuilder::CreateGraph() {
1186   graph_ = new(zone()) HGraph(info_);
1187   if (FLAG_hydrogen_stats) isolate()->GetHStatistics()->Initialize(info_);
1188   CompilationPhase phase("H_Block building", info_);
1189   set_current_block(graph()->entry_block());
1190   if (!BuildGraph()) return NULL;
1191   graph()->FinalizeUniqueness();
1192   return graph_;
1193 }
1194
1195
1196 HInstruction* HGraphBuilder::AddInstruction(HInstruction* instr) {
1197   DCHECK(current_block() != NULL);
1198   DCHECK(!FLAG_hydrogen_track_positions ||
1199          !position_.IsUnknown() ||
1200          !info_->IsOptimizing());
1201   current_block()->AddInstruction(instr, source_position());
1202   if (graph()->IsInsideNoSideEffectsScope()) {
1203     instr->SetFlag(HValue::kHasNoObservableSideEffects);
1204   }
1205   return instr;
1206 }
1207
1208
1209 void HGraphBuilder::FinishCurrentBlock(HControlInstruction* last) {
1210   DCHECK(!FLAG_hydrogen_track_positions ||
1211          !info_->IsOptimizing() ||
1212          !position_.IsUnknown());
1213   current_block()->Finish(last, source_position());
1214   if (last->IsReturn() || last->IsAbnormalExit()) {
1215     set_current_block(NULL);
1216   }
1217 }
1218
1219
1220 void HGraphBuilder::FinishExitCurrentBlock(HControlInstruction* instruction) {
1221   DCHECK(!FLAG_hydrogen_track_positions || !info_->IsOptimizing() ||
1222          !position_.IsUnknown());
1223   current_block()->FinishExit(instruction, source_position());
1224   if (instruction->IsReturn() || instruction->IsAbnormalExit()) {
1225     set_current_block(NULL);
1226   }
1227 }
1228
1229
1230 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
1231   if (FLAG_native_code_counters && counter->Enabled()) {
1232     HValue* reference = Add<HConstant>(ExternalReference(counter));
1233     HValue* old_value =
1234         Add<HLoadNamedField>(reference, nullptr, HObjectAccess::ForCounter());
1235     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
1236     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
1237     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
1238                           new_value, STORE_TO_INITIALIZED_ENTRY);
1239   }
1240 }
1241
1242
1243 void HGraphBuilder::AddSimulate(BailoutId id,
1244                                 RemovableSimulate removable) {
1245   DCHECK(current_block() != NULL);
1246   DCHECK(!graph()->IsInsideNoSideEffectsScope());
1247   current_block()->AddNewSimulate(id, source_position(), removable);
1248 }
1249
1250
1251 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
1252   HBasicBlock* b = graph()->CreateBasicBlock();
1253   b->SetInitialEnvironment(env);
1254   return b;
1255 }
1256
1257
1258 HBasicBlock* HGraphBuilder::CreateLoopHeaderBlock() {
1259   HBasicBlock* header = graph()->CreateBasicBlock();
1260   HEnvironment* entry_env = environment()->CopyAsLoopHeader(header);
1261   header->SetInitialEnvironment(entry_env);
1262   header->AttachLoopInformation();
1263   return header;
1264 }
1265
1266
1267 HValue* HGraphBuilder::BuildGetElementsKind(HValue* object) {
1268   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
1269
1270   HValue* bit_field2 =
1271       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
1272   return BuildDecodeField<Map::ElementsKindBits>(bit_field2);
1273 }
1274
1275
1276 HValue* HGraphBuilder::BuildCheckHeapObject(HValue* obj) {
1277   if (obj->type().IsHeapObject()) return obj;
1278   return Add<HCheckHeapObject>(obj);
1279 }
1280
1281
1282 void HGraphBuilder::FinishExitWithHardDeoptimization(
1283     Deoptimizer::DeoptReason reason) {
1284   Add<HDeoptimize>(reason, Deoptimizer::EAGER);
1285   FinishExitCurrentBlock(New<HAbnormalExit>());
1286 }
1287
1288
1289 HValue* HGraphBuilder::BuildCheckString(HValue* string) {
1290   if (!string->type().IsString()) {
1291     DCHECK(!string->IsConstant() ||
1292            !HConstant::cast(string)->HasStringValue());
1293     BuildCheckHeapObject(string);
1294     return Add<HCheckInstanceType>(string, HCheckInstanceType::IS_STRING);
1295   }
1296   return string;
1297 }
1298
1299
1300 HValue* HGraphBuilder::BuildWrapReceiver(HValue* object, HValue* function) {
1301   if (object->type().IsJSObject()) return object;
1302   if (function->IsConstant() &&
1303       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
1304     Handle<JSFunction> f = Handle<JSFunction>::cast(
1305         HConstant::cast(function)->handle(isolate()));
1306     SharedFunctionInfo* shared = f->shared();
1307     if (is_strict(shared->language_mode()) || shared->native()) return object;
1308   }
1309   return Add<HWrapReceiver>(object, function);
1310 }
1311
1312
1313 HValue* HGraphBuilder::BuildCheckAndGrowElementsCapacity(
1314     HValue* object, HValue* elements, ElementsKind kind, HValue* length,
1315     HValue* capacity, HValue* key) {
1316   HValue* max_gap = Add<HConstant>(static_cast<int32_t>(JSObject::kMaxGap));
1317   HValue* max_capacity = AddUncasted<HAdd>(capacity, max_gap);
1318   Add<HBoundsCheck>(key, max_capacity);
1319
1320   HValue* new_capacity = BuildNewElementsCapacity(key);
1321   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind, kind,
1322                                                    length, new_capacity);
1323   return new_elements;
1324 }
1325
1326
1327 HValue* HGraphBuilder::BuildCheckForCapacityGrow(
1328     HValue* object,
1329     HValue* elements,
1330     ElementsKind kind,
1331     HValue* length,
1332     HValue* key,
1333     bool is_js_array,
1334     PropertyAccessType access_type) {
1335   IfBuilder length_checker(this);
1336
1337   Token::Value token = IsHoleyElementsKind(kind) ? Token::GTE : Token::EQ;
1338   length_checker.If<HCompareNumericAndBranch>(key, length, token);
1339
1340   length_checker.Then();
1341
1342   HValue* current_capacity = AddLoadFixedArrayLength(elements);
1343
1344   if (top_info()->IsStub()) {
1345     IfBuilder capacity_checker(this);
1346     capacity_checker.If<HCompareNumericAndBranch>(key, current_capacity,
1347                                                   Token::GTE);
1348     capacity_checker.Then();
1349     HValue* new_elements = BuildCheckAndGrowElementsCapacity(
1350         object, elements, kind, length, current_capacity, key);
1351     environment()->Push(new_elements);
1352     capacity_checker.Else();
1353     environment()->Push(elements);
1354     capacity_checker.End();
1355   } else {
1356     HValue* result = Add<HMaybeGrowElements>(
1357         object, elements, key, current_capacity, is_js_array, kind);
1358     environment()->Push(result);
1359   }
1360
1361   if (is_js_array) {
1362     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
1363     new_length->ClearFlag(HValue::kCanOverflow);
1364
1365     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
1366                           new_length);
1367   }
1368
1369   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
1370     HValue* checked_elements = environment()->Top();
1371
1372     // Write zero to ensure that the new element is initialized with some smi.
1373     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
1374   }
1375
1376   length_checker.Else();
1377   Add<HBoundsCheck>(key, length);
1378
1379   environment()->Push(elements);
1380   length_checker.End();
1381
1382   return environment()->Pop();
1383 }
1384
1385
1386 HValue* HGraphBuilder::BuildCopyElementsOnWrite(HValue* object,
1387                                                 HValue* elements,
1388                                                 ElementsKind kind,
1389                                                 HValue* length) {
1390   Factory* factory = isolate()->factory();
1391
1392   IfBuilder cow_checker(this);
1393
1394   cow_checker.If<HCompareMap>(elements, factory->fixed_cow_array_map());
1395   cow_checker.Then();
1396
1397   HValue* capacity = AddLoadFixedArrayLength(elements);
1398
1399   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
1400                                                    kind, length, capacity);
1401
1402   environment()->Push(new_elements);
1403
1404   cow_checker.Else();
1405
1406   environment()->Push(elements);
1407
1408   cow_checker.End();
1409
1410   return environment()->Pop();
1411 }
1412
1413
1414 void HGraphBuilder::BuildTransitionElementsKind(HValue* object,
1415                                                 HValue* map,
1416                                                 ElementsKind from_kind,
1417                                                 ElementsKind to_kind,
1418                                                 bool is_jsarray) {
1419   DCHECK(!IsFastHoleyElementsKind(from_kind) ||
1420          IsFastHoleyElementsKind(to_kind));
1421
1422   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
1423     Add<HTrapAllocationMemento>(object);
1424   }
1425
1426   if (!IsSimpleMapChangeTransition(from_kind, to_kind)) {
1427     HInstruction* elements = AddLoadElements(object);
1428
1429     HInstruction* empty_fixed_array = Add<HConstant>(
1430         isolate()->factory()->empty_fixed_array());
1431
1432     IfBuilder if_builder(this);
1433
1434     if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
1435
1436     if_builder.Then();
1437
1438     HInstruction* elements_length = AddLoadFixedArrayLength(elements);
1439
1440     HInstruction* array_length =
1441         is_jsarray
1442             ? Add<HLoadNamedField>(object, nullptr,
1443                                    HObjectAccess::ForArrayLength(from_kind))
1444             : elements_length;
1445
1446     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
1447                               array_length, elements_length);
1448
1449     if_builder.End();
1450   }
1451
1452   Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
1453 }
1454
1455
1456 void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
1457                                        int bit_field_mask) {
1458   // Check that the object isn't a smi.
1459   Add<HCheckHeapObject>(receiver);
1460
1461   // Get the map of the receiver.
1462   HValue* map =
1463       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1464
1465   // Check the instance type and if an access check is needed, this can be
1466   // done with a single load, since both bytes are adjacent in the map.
1467   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
1468   HValue* instance_type_and_bit_field =
1469       Add<HLoadNamedField>(map, nullptr, access);
1470
1471   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
1472   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
1473                                              instance_type_and_bit_field,
1474                                              mask);
1475   HValue* sub_result = AddUncasted<HSub>(and_result,
1476                                          Add<HConstant>(JS_OBJECT_TYPE));
1477   Add<HBoundsCheck>(sub_result,
1478                     Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
1479 }
1480
1481
1482 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
1483                                          HIfContinuation* join_continuation) {
1484   // The sometimes unintuitively backward ordering of the ifs below is
1485   // convoluted, but necessary.  All of the paths must guarantee that the
1486   // if-true of the continuation returns a smi element index and the if-false of
1487   // the continuation returns either a symbol or a unique string key. All other
1488   // object types cause a deopt to fall back to the runtime.
1489
1490   IfBuilder key_smi_if(this);
1491   key_smi_if.If<HIsSmiAndBranch>(key);
1492   key_smi_if.Then();
1493   {
1494     Push(key);  // Nothing to do, just continue to true of continuation.
1495   }
1496   key_smi_if.Else();
1497   {
1498     HValue* map = Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForMap());
1499     HValue* instance_type =
1500         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1501
1502     // Non-unique string, check for a string with a hash code that is actually
1503     // an index.
1504     STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
1505     IfBuilder not_string_or_name_if(this);
1506     not_string_or_name_if.If<HCompareNumericAndBranch>(
1507         instance_type,
1508         Add<HConstant>(LAST_UNIQUE_NAME_TYPE),
1509         Token::GT);
1510
1511     not_string_or_name_if.Then();
1512     {
1513       // Non-smi, non-Name, non-String: Try to convert to smi in case of
1514       // HeapNumber.
1515       // TODO(danno): This could call some variant of ToString
1516       Push(AddUncasted<HForceRepresentation>(key, Representation::Smi()));
1517     }
1518     not_string_or_name_if.Else();
1519     {
1520       // String or Name: check explicitly for Name, they can short-circuit
1521       // directly to unique non-index key path.
1522       IfBuilder not_symbol_if(this);
1523       not_symbol_if.If<HCompareNumericAndBranch>(
1524           instance_type,
1525           Add<HConstant>(SYMBOL_TYPE),
1526           Token::NE);
1527
1528       not_symbol_if.Then();
1529       {
1530         // String: check whether the String is a String of an index. If it is,
1531         // extract the index value from the hash.
1532         HValue* hash = Add<HLoadNamedField>(key, nullptr,
1533                                             HObjectAccess::ForNameHashField());
1534         HValue* not_index_mask = Add<HConstant>(static_cast<int>(
1535             String::kContainsCachedArrayIndexMask));
1536
1537         HValue* not_index_test = AddUncasted<HBitwise>(
1538             Token::BIT_AND, hash, not_index_mask);
1539
1540         IfBuilder string_index_if(this);
1541         string_index_if.If<HCompareNumericAndBranch>(not_index_test,
1542                                                      graph()->GetConstant0(),
1543                                                      Token::EQ);
1544         string_index_if.Then();
1545         {
1546           // String with index in hash: extract string and merge to index path.
1547           Push(BuildDecodeField<String::ArrayIndexValueBits>(hash));
1548         }
1549         string_index_if.Else();
1550         {
1551           // Key is a non-index String, check for uniqueness/internalization.
1552           // If it's not internalized yet, internalize it now.
1553           HValue* not_internalized_bit = AddUncasted<HBitwise>(
1554               Token::BIT_AND,
1555               instance_type,
1556               Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1557
1558           IfBuilder internalized(this);
1559           internalized.If<HCompareNumericAndBranch>(not_internalized_bit,
1560                                                     graph()->GetConstant0(),
1561                                                     Token::EQ);
1562           internalized.Then();
1563           Push(key);
1564
1565           internalized.Else();
1566           Add<HPushArguments>(key);
1567           HValue* intern_key = Add<HCallRuntime>(
1568               Runtime::FunctionForId(Runtime::kInternalizeString), 1);
1569           Push(intern_key);
1570
1571           internalized.End();
1572           // Key guaranteed to be a unique string
1573         }
1574         string_index_if.JoinContinuation(join_continuation);
1575       }
1576       not_symbol_if.Else();
1577       {
1578         Push(key);  // Key is symbol
1579       }
1580       not_symbol_if.JoinContinuation(join_continuation);
1581     }
1582     not_string_or_name_if.JoinContinuation(join_continuation);
1583   }
1584   key_smi_if.JoinContinuation(join_continuation);
1585 }
1586
1587
1588 void HGraphBuilder::BuildNonGlobalObjectCheck(HValue* receiver) {
1589   // Get the the instance type of the receiver, and make sure that it is
1590   // not one of the global object types.
1591   HValue* map =
1592       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1593   HValue* instance_type =
1594       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1595   STATIC_ASSERT(JS_BUILTINS_OBJECT_TYPE == JS_GLOBAL_OBJECT_TYPE + 1);
1596   HValue* min_global_type = Add<HConstant>(JS_GLOBAL_OBJECT_TYPE);
1597   HValue* max_global_type = Add<HConstant>(JS_BUILTINS_OBJECT_TYPE);
1598
1599   IfBuilder if_global_object(this);
1600   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1601                                                 max_global_type,
1602                                                 Token::LTE);
1603   if_global_object.And();
1604   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1605                                                 min_global_type,
1606                                                 Token::GTE);
1607   if_global_object.ThenDeopt(Deoptimizer::kReceiverWasAGlobalObject);
1608   if_global_object.End();
1609 }
1610
1611
1612 void HGraphBuilder::BuildTestForDictionaryProperties(
1613     HValue* object,
1614     HIfContinuation* continuation) {
1615   HValue* properties = Add<HLoadNamedField>(
1616       object, nullptr, HObjectAccess::ForPropertiesPointer());
1617   HValue* properties_map =
1618       Add<HLoadNamedField>(properties, nullptr, HObjectAccess::ForMap());
1619   HValue* hash_map = Add<HLoadRoot>(Heap::kHashTableMapRootIndex);
1620   IfBuilder builder(this);
1621   builder.If<HCompareObjectEqAndBranch>(properties_map, hash_map);
1622   builder.CaptureContinuation(continuation);
1623 }
1624
1625
1626 HValue* HGraphBuilder::BuildKeyedLookupCacheHash(HValue* object,
1627                                                  HValue* key) {
1628   // Load the map of the receiver, compute the keyed lookup cache hash
1629   // based on 32 bits of the map pointer and the string hash.
1630   HValue* object_map =
1631       Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMapAsInteger32());
1632   HValue* shifted_map = AddUncasted<HShr>(
1633       object_map, Add<HConstant>(KeyedLookupCache::kMapHashShift));
1634   HValue* string_hash =
1635       Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForStringHashField());
1636   HValue* shifted_hash = AddUncasted<HShr>(
1637       string_hash, Add<HConstant>(String::kHashShift));
1638   HValue* xor_result = AddUncasted<HBitwise>(Token::BIT_XOR, shifted_map,
1639                                              shifted_hash);
1640   int mask = (KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask);
1641   return AddUncasted<HBitwise>(Token::BIT_AND, xor_result,
1642                                Add<HConstant>(mask));
1643 }
1644
1645
1646 HValue* HGraphBuilder::BuildElementIndexHash(HValue* index) {
1647   int32_t seed_value = static_cast<uint32_t>(isolate()->heap()->HashSeed());
1648   HValue* seed = Add<HConstant>(seed_value);
1649   HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, index, seed);
1650
1651   // hash = ~hash + (hash << 15);
1652   HValue* shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(15));
1653   HValue* not_hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash,
1654                                            graph()->GetConstantMinus1());
1655   hash = AddUncasted<HAdd>(shifted_hash, not_hash);
1656
1657   // hash = hash ^ (hash >> 12);
1658   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(12));
1659   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1660
1661   // hash = hash + (hash << 2);
1662   shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(2));
1663   hash = AddUncasted<HAdd>(hash, shifted_hash);
1664
1665   // hash = hash ^ (hash >> 4);
1666   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(4));
1667   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1668
1669   // hash = hash * 2057;
1670   hash = AddUncasted<HMul>(hash, Add<HConstant>(2057));
1671   hash->ClearFlag(HValue::kCanOverflow);
1672
1673   // hash = hash ^ (hash >> 16);
1674   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
1675   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1676 }
1677
1678
1679 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(
1680     HValue* receiver, HValue* elements, HValue* key, HValue* hash,
1681     LanguageMode language_mode) {
1682   HValue* capacity =
1683       Add<HLoadKeyed>(elements, Add<HConstant>(NameDictionary::kCapacityIndex),
1684                       nullptr, FAST_ELEMENTS);
1685
1686   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
1687   mask->ChangeRepresentation(Representation::Integer32());
1688   mask->ClearFlag(HValue::kCanOverflow);
1689
1690   HValue* entry = hash;
1691   HValue* count = graph()->GetConstant1();
1692   Push(entry);
1693   Push(count);
1694
1695   HIfContinuation return_or_loop_continuation(graph()->CreateBasicBlock(),
1696                                               graph()->CreateBasicBlock());
1697   HIfContinuation found_key_match_continuation(graph()->CreateBasicBlock(),
1698                                                graph()->CreateBasicBlock());
1699   LoopBuilder probe_loop(this);
1700   probe_loop.BeginBody(2);  // Drop entry, count from last environment to
1701                             // appease live range building without simulates.
1702
1703   count = Pop();
1704   entry = Pop();
1705   entry = AddUncasted<HBitwise>(Token::BIT_AND, entry, mask);
1706   int entry_size = SeededNumberDictionary::kEntrySize;
1707   HValue* base_index = AddUncasted<HMul>(entry, Add<HConstant>(entry_size));
1708   base_index->ClearFlag(HValue::kCanOverflow);
1709   int start_offset = SeededNumberDictionary::kElementsStartIndex;
1710   HValue* key_index =
1711       AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset));
1712   key_index->ClearFlag(HValue::kCanOverflow);
1713
1714   HValue* candidate_key =
1715       Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
1716   IfBuilder if_undefined(this);
1717   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
1718                                              graph()->GetConstantUndefined());
1719   if_undefined.Then();
1720   {
1721     // element == undefined means "not found". Call the runtime.
1722     // TODO(jkummerow): walk the prototype chain instead.
1723     Add<HPushArguments>(receiver, key);
1724     Push(Add<HCallRuntime>(
1725         Runtime::FunctionForId(is_strong(language_mode)
1726                                    ? Runtime::kKeyedGetPropertyStrong
1727                                    : Runtime::kKeyedGetProperty),
1728         2));
1729   }
1730   if_undefined.Else();
1731   {
1732     IfBuilder if_match(this);
1733     if_match.If<HCompareObjectEqAndBranch>(candidate_key, key);
1734     if_match.Then();
1735     if_match.Else();
1736
1737     // Update non-internalized string in the dictionary with internalized key?
1738     IfBuilder if_update_with_internalized(this);
1739     HValue* smi_check =
1740         if_update_with_internalized.IfNot<HIsSmiAndBranch>(candidate_key);
1741     if_update_with_internalized.And();
1742     HValue* map = AddLoadMap(candidate_key, smi_check);
1743     HValue* instance_type =
1744         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1745     HValue* not_internalized_bit = AddUncasted<HBitwise>(
1746         Token::BIT_AND, instance_type,
1747         Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1748     if_update_with_internalized.If<HCompareNumericAndBranch>(
1749         not_internalized_bit, graph()->GetConstant0(), Token::NE);
1750     if_update_with_internalized.And();
1751     if_update_with_internalized.IfNot<HCompareObjectEqAndBranch>(
1752         candidate_key, graph()->GetConstantHole());
1753     if_update_with_internalized.AndIf<HStringCompareAndBranch>(candidate_key,
1754                                                                key, Token::EQ);
1755     if_update_with_internalized.Then();
1756     // Replace a key that is a non-internalized string by the equivalent
1757     // internalized string for faster further lookups.
1758     Add<HStoreKeyed>(elements, key_index, key, FAST_ELEMENTS);
1759     if_update_with_internalized.Else();
1760
1761     if_update_with_internalized.JoinContinuation(&found_key_match_continuation);
1762     if_match.JoinContinuation(&found_key_match_continuation);
1763
1764     IfBuilder found_key_match(this, &found_key_match_continuation);
1765     found_key_match.Then();
1766     // Key at current probe matches. Relevant bits in the |details| field must
1767     // be zero, otherwise the dictionary element requires special handling.
1768     HValue* details_index =
1769         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 2));
1770     details_index->ClearFlag(HValue::kCanOverflow);
1771     HValue* details =
1772         Add<HLoadKeyed>(elements, details_index, nullptr, FAST_ELEMENTS);
1773     int details_mask = PropertyDetails::TypeField::kMask;
1774     details = AddUncasted<HBitwise>(Token::BIT_AND, details,
1775                                     Add<HConstant>(details_mask));
1776     IfBuilder details_compare(this);
1777     details_compare.If<HCompareNumericAndBranch>(
1778         details, graph()->GetConstant0(), Token::EQ);
1779     details_compare.Then();
1780     HValue* result_index =
1781         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
1782     result_index->ClearFlag(HValue::kCanOverflow);
1783     Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
1784     details_compare.Else();
1785     Add<HPushArguments>(receiver, key);
1786     Push(Add<HCallRuntime>(
1787         Runtime::FunctionForId(is_strong(language_mode)
1788                                    ? Runtime::kKeyedGetPropertyStrong
1789                                    : Runtime::kKeyedGetProperty),
1790         2));
1791     details_compare.End();
1792
1793     found_key_match.Else();
1794     found_key_match.JoinContinuation(&return_or_loop_continuation);
1795   }
1796   if_undefined.JoinContinuation(&return_or_loop_continuation);
1797
1798   IfBuilder return_or_loop(this, &return_or_loop_continuation);
1799   return_or_loop.Then();
1800   probe_loop.Break();
1801
1802   return_or_loop.Else();
1803   entry = AddUncasted<HAdd>(entry, count);
1804   entry->ClearFlag(HValue::kCanOverflow);
1805   count = AddUncasted<HAdd>(count, graph()->GetConstant1());
1806   count->ClearFlag(HValue::kCanOverflow);
1807   Push(entry);
1808   Push(count);
1809
1810   probe_loop.EndBody();
1811
1812   return_or_loop.End();
1813
1814   return Pop();
1815 }
1816
1817
1818 HValue* HGraphBuilder::BuildRegExpConstructResult(HValue* length,
1819                                                   HValue* index,
1820                                                   HValue* input) {
1821   NoObservableSideEffectsScope scope(this);
1822   HConstant* max_length = Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1823   Add<HBoundsCheck>(length, max_length);
1824
1825   // Generate size calculation code here in order to make it dominate
1826   // the JSRegExpResult allocation.
1827   ElementsKind elements_kind = FAST_ELEMENTS;
1828   HValue* size = BuildCalculateElementsSize(elements_kind, length);
1829
1830   // Allocate the JSRegExpResult and the FixedArray in one step.
1831   HValue* result = Add<HAllocate>(
1832       Add<HConstant>(JSRegExpResult::kSize), HType::JSArray(),
1833       NOT_TENURED, JS_ARRAY_TYPE);
1834
1835   // Initialize the JSRegExpResult header.
1836   HValue* global_object = Add<HLoadNamedField>(
1837       context(), nullptr,
1838       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1839   HValue* native_context = Add<HLoadNamedField>(
1840       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
1841   Add<HStoreNamedField>(
1842       result, HObjectAccess::ForMap(),
1843       Add<HLoadNamedField>(
1844           native_context, nullptr,
1845           HObjectAccess::ForContextSlot(Context::REGEXP_RESULT_MAP_INDEX)));
1846   HConstant* empty_fixed_array =
1847       Add<HConstant>(isolate()->factory()->empty_fixed_array());
1848   Add<HStoreNamedField>(
1849       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
1850       empty_fixed_array);
1851   Add<HStoreNamedField>(
1852       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1853       empty_fixed_array);
1854   Add<HStoreNamedField>(
1855       result, HObjectAccess::ForJSArrayOffset(JSArray::kLengthOffset), length);
1856
1857   // Initialize the additional fields.
1858   Add<HStoreNamedField>(
1859       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kIndexOffset),
1860       index);
1861   Add<HStoreNamedField>(
1862       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kInputOffset),
1863       input);
1864
1865   // Allocate and initialize the elements header.
1866   HAllocate* elements = BuildAllocateElements(elements_kind, size);
1867   BuildInitializeElementsHeader(elements, elements_kind, length);
1868
1869   if (!elements->has_size_upper_bound()) {
1870     HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
1871         elements_kind, max_length->Integer32Value());
1872     elements->set_size_upper_bound(size_in_bytes_upper_bound);
1873   }
1874
1875   Add<HStoreNamedField>(
1876       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1877       elements);
1878
1879   // Initialize the elements contents with undefined.
1880   BuildFillElementsWithValue(
1881       elements, elements_kind, graph()->GetConstant0(), length,
1882       graph()->GetConstantUndefined());
1883
1884   return result;
1885 }
1886
1887
1888 HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
1889   NoObservableSideEffectsScope scope(this);
1890
1891   // Convert constant numbers at compile time.
1892   if (object->IsConstant() && HConstant::cast(object)->HasNumberValue()) {
1893     Handle<Object> number = HConstant::cast(object)->handle(isolate());
1894     Handle<String> result = isolate()->factory()->NumberToString(number);
1895     return Add<HConstant>(result);
1896   }
1897
1898   // Create a joinable continuation.
1899   HIfContinuation found(graph()->CreateBasicBlock(),
1900                         graph()->CreateBasicBlock());
1901
1902   // Load the number string cache.
1903   HValue* number_string_cache =
1904       Add<HLoadRoot>(Heap::kNumberStringCacheRootIndex);
1905
1906   // Make the hash mask from the length of the number string cache. It
1907   // contains two elements (number and string) for each cache entry.
1908   HValue* mask = AddLoadFixedArrayLength(number_string_cache);
1909   mask->set_type(HType::Smi());
1910   mask = AddUncasted<HSar>(mask, graph()->GetConstant1());
1911   mask = AddUncasted<HSub>(mask, graph()->GetConstant1());
1912
1913   // Check whether object is a smi.
1914   IfBuilder if_objectissmi(this);
1915   if_objectissmi.If<HIsSmiAndBranch>(object);
1916   if_objectissmi.Then();
1917   {
1918     // Compute hash for smi similar to smi_get_hash().
1919     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
1920
1921     // Load the key.
1922     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1923     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1924                                   FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1925
1926     // Check if object == key.
1927     IfBuilder if_objectiskey(this);
1928     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
1929     if_objectiskey.Then();
1930     {
1931       // Make the key_index available.
1932       Push(key_index);
1933     }
1934     if_objectiskey.JoinContinuation(&found);
1935   }
1936   if_objectissmi.Else();
1937   {
1938     if (type->Is(Type::SignedSmall())) {
1939       if_objectissmi.Deopt(Deoptimizer::kExpectedSmi);
1940     } else {
1941       // Check if the object is a heap number.
1942       IfBuilder if_objectisnumber(this);
1943       HValue* objectisnumber = if_objectisnumber.If<HCompareMap>(
1944           object, isolate()->factory()->heap_number_map());
1945       if_objectisnumber.Then();
1946       {
1947         // Compute hash for heap number similar to double_get_hash().
1948         HValue* low = Add<HLoadNamedField>(
1949             object, objectisnumber,
1950             HObjectAccess::ForHeapNumberValueLowestBits());
1951         HValue* high = Add<HLoadNamedField>(
1952             object, objectisnumber,
1953             HObjectAccess::ForHeapNumberValueHighestBits());
1954         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
1955         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
1956
1957         // Load the key.
1958         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1959         HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1960                                       FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1961
1962         // Check if the key is a heap number and compare it with the object.
1963         IfBuilder if_keyisnotsmi(this);
1964         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
1965         if_keyisnotsmi.Then();
1966         {
1967           IfBuilder if_keyisheapnumber(this);
1968           if_keyisheapnumber.If<HCompareMap>(
1969               key, isolate()->factory()->heap_number_map());
1970           if_keyisheapnumber.Then();
1971           {
1972             // Check if values of key and object match.
1973             IfBuilder if_keyeqobject(this);
1974             if_keyeqobject.If<HCompareNumericAndBranch>(
1975                 Add<HLoadNamedField>(key, keyisnotsmi,
1976                                      HObjectAccess::ForHeapNumberValue()),
1977                 Add<HLoadNamedField>(object, objectisnumber,
1978                                      HObjectAccess::ForHeapNumberValue()),
1979                 Token::EQ);
1980             if_keyeqobject.Then();
1981             {
1982               // Make the key_index available.
1983               Push(key_index);
1984             }
1985             if_keyeqobject.JoinContinuation(&found);
1986           }
1987           if_keyisheapnumber.JoinContinuation(&found);
1988         }
1989         if_keyisnotsmi.JoinContinuation(&found);
1990       }
1991       if_objectisnumber.Else();
1992       {
1993         if (type->Is(Type::Number())) {
1994           if_objectisnumber.Deopt(Deoptimizer::kExpectedHeapNumber);
1995         }
1996       }
1997       if_objectisnumber.JoinContinuation(&found);
1998     }
1999   }
2000   if_objectissmi.JoinContinuation(&found);
2001
2002   // Check for cache hit.
2003   IfBuilder if_found(this, &found);
2004   if_found.Then();
2005   {
2006     // Count number to string operation in native code.
2007     AddIncrementCounter(isolate()->counters()->number_to_string_native());
2008
2009     // Load the value in case of cache hit.
2010     HValue* key_index = Pop();
2011     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
2012     Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
2013                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
2014   }
2015   if_found.Else();
2016   {
2017     // Cache miss, fallback to runtime.
2018     Add<HPushArguments>(object);
2019     Push(Add<HCallRuntime>(
2020             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
2021             1));
2022   }
2023   if_found.End();
2024
2025   return Pop();
2026 }
2027
2028
2029 HValue* HGraphBuilder::BuildToObject(HValue* receiver) {
2030   NoObservableSideEffectsScope scope(this);
2031
2032   // Create a joinable continuation.
2033   HIfContinuation wrap(graph()->CreateBasicBlock(),
2034                        graph()->CreateBasicBlock());
2035
2036   // Determine the proper global constructor function required to wrap
2037   // {receiver} into a JSValue, unless {receiver} is already a {JSReceiver}, in
2038   // which case we just return it.  Deopts to Runtime::kToObject if {receiver}
2039   // is undefined or null.
2040   IfBuilder receiver_is_smi(this);
2041   receiver_is_smi.If<HIsSmiAndBranch>(receiver);
2042   receiver_is_smi.Then();
2043   {
2044     // Use global Number function.
2045     Push(Add<HConstant>(Context::NUMBER_FUNCTION_INDEX));
2046   }
2047   receiver_is_smi.Else();
2048   {
2049     // Determine {receiver} map and instance type.
2050     HValue* receiver_map =
2051         Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
2052     HValue* receiver_instance_type = Add<HLoadNamedField>(
2053         receiver_map, nullptr, HObjectAccess::ForMapInstanceType());
2054
2055     // First check whether {receiver} is already a spec object (fast case).
2056     IfBuilder receiver_is_not_spec_object(this);
2057     receiver_is_not_spec_object.If<HCompareNumericAndBranch>(
2058         receiver_instance_type, Add<HConstant>(FIRST_SPEC_OBJECT_TYPE),
2059         Token::LT);
2060     receiver_is_not_spec_object.Then();
2061     {
2062       // Load the constructor function index from the {receiver} map.
2063       HValue* constructor_function_index = Add<HLoadNamedField>(
2064           receiver_map, nullptr,
2065           HObjectAccess::ForMapInObjectPropertiesOrConstructorFunctionIndex());
2066
2067       // Check if {receiver} has a constructor (null and undefined have no
2068       // constructors, so we deoptimize to the runtime to throw an exception).
2069       IfBuilder constructor_function_index_is_invalid(this);
2070       constructor_function_index_is_invalid.If<HCompareNumericAndBranch>(
2071           constructor_function_index,
2072           Add<HConstant>(Map::kNoConstructorFunctionIndex), Token::EQ);
2073       constructor_function_index_is_invalid.ThenDeopt(
2074           Deoptimizer::kUndefinedOrNullInToObject);
2075       constructor_function_index_is_invalid.End();
2076
2077       // Use the global constructor function.
2078       Push(constructor_function_index);
2079     }
2080     receiver_is_not_spec_object.JoinContinuation(&wrap);
2081   }
2082   receiver_is_smi.JoinContinuation(&wrap);
2083
2084   // Wrap the receiver if necessary.
2085   IfBuilder if_wrap(this, &wrap);
2086   if_wrap.Then();
2087   {
2088     // Grab the constructor function index.
2089     HValue* constructor_index = Pop();
2090
2091     // Load native context.
2092     HValue* native_context = BuildGetNativeContext();
2093
2094     // Determine the initial map for the global constructor.
2095     HValue* constructor = Add<HLoadKeyed>(native_context, constructor_index,
2096                                           nullptr, FAST_ELEMENTS);
2097     HValue* constructor_initial_map = Add<HLoadNamedField>(
2098         constructor, nullptr, HObjectAccess::ForPrototypeOrInitialMap());
2099     // Allocate and initialize a JSValue wrapper.
2100     HValue* value =
2101         BuildAllocate(Add<HConstant>(JSValue::kSize), HType::JSObject(),
2102                       JS_VALUE_TYPE, HAllocationMode());
2103     Add<HStoreNamedField>(value, HObjectAccess::ForMap(),
2104                           constructor_initial_map);
2105     HValue* empty_fixed_array = Add<HLoadRoot>(Heap::kEmptyFixedArrayRootIndex);
2106     Add<HStoreNamedField>(value, HObjectAccess::ForPropertiesPointer(),
2107                           empty_fixed_array);
2108     Add<HStoreNamedField>(value, HObjectAccess::ForElementsPointer(),
2109                           empty_fixed_array);
2110     Add<HStoreNamedField>(value, HObjectAccess::ForObservableJSObjectOffset(
2111                                      JSValue::kValueOffset),
2112                           receiver);
2113     Push(value);
2114   }
2115   if_wrap.Else();
2116   { Push(receiver); }
2117   if_wrap.End();
2118   return Pop();
2119 }
2120
2121
2122 HAllocate* HGraphBuilder::BuildAllocate(
2123     HValue* object_size,
2124     HType type,
2125     InstanceType instance_type,
2126     HAllocationMode allocation_mode) {
2127   // Compute the effective allocation size.
2128   HValue* size = object_size;
2129   if (allocation_mode.CreateAllocationMementos()) {
2130     size = AddUncasted<HAdd>(size, Add<HConstant>(AllocationMemento::kSize));
2131     size->ClearFlag(HValue::kCanOverflow);
2132   }
2133
2134   // Perform the actual allocation.
2135   HAllocate* object = Add<HAllocate>(
2136       size, type, allocation_mode.GetPretenureMode(),
2137       instance_type, allocation_mode.feedback_site());
2138
2139   // Setup the allocation memento.
2140   if (allocation_mode.CreateAllocationMementos()) {
2141     BuildCreateAllocationMemento(
2142         object, object_size, allocation_mode.current_site());
2143   }
2144
2145   return object;
2146 }
2147
2148
2149 HValue* HGraphBuilder::BuildAddStringLengths(HValue* left_length,
2150                                              HValue* right_length) {
2151   // Compute the combined string length and check against max string length.
2152   HValue* length = AddUncasted<HAdd>(left_length, right_length);
2153   // Check that length <= kMaxLength <=> length < MaxLength + 1.
2154   HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
2155   Add<HBoundsCheck>(length, max_length);
2156   return length;
2157 }
2158
2159
2160 HValue* HGraphBuilder::BuildCreateConsString(
2161     HValue* length,
2162     HValue* left,
2163     HValue* right,
2164     HAllocationMode allocation_mode) {
2165   // Determine the string instance types.
2166   HInstruction* left_instance_type = AddLoadStringInstanceType(left);
2167   HInstruction* right_instance_type = AddLoadStringInstanceType(right);
2168
2169   // Allocate the cons string object. HAllocate does not care whether we
2170   // pass CONS_STRING_TYPE or CONS_ONE_BYTE_STRING_TYPE here, so we just use
2171   // CONS_STRING_TYPE here. Below we decide whether the cons string is
2172   // one-byte or two-byte and set the appropriate map.
2173   DCHECK(HAllocate::CompatibleInstanceTypes(CONS_STRING_TYPE,
2174                                             CONS_ONE_BYTE_STRING_TYPE));
2175   HAllocate* result = BuildAllocate(Add<HConstant>(ConsString::kSize),
2176                                     HType::String(), CONS_STRING_TYPE,
2177                                     allocation_mode);
2178
2179   // Compute intersection and difference of instance types.
2180   HValue* anded_instance_types = AddUncasted<HBitwise>(
2181       Token::BIT_AND, left_instance_type, right_instance_type);
2182   HValue* xored_instance_types = AddUncasted<HBitwise>(
2183       Token::BIT_XOR, left_instance_type, right_instance_type);
2184
2185   // We create a one-byte cons string if
2186   // 1. both strings are one-byte, or
2187   // 2. at least one of the strings is two-byte, but happens to contain only
2188   //    one-byte characters.
2189   // To do this, we check
2190   // 1. if both strings are one-byte, or if the one-byte data hint is set in
2191   //    both strings, or
2192   // 2. if one of the strings has the one-byte data hint set and the other
2193   //    string is one-byte.
2194   IfBuilder if_onebyte(this);
2195   STATIC_ASSERT(kOneByteStringTag != 0);
2196   STATIC_ASSERT(kOneByteDataHintMask != 0);
2197   if_onebyte.If<HCompareNumericAndBranch>(
2198       AddUncasted<HBitwise>(
2199           Token::BIT_AND, anded_instance_types,
2200           Add<HConstant>(static_cast<int32_t>(
2201                   kStringEncodingMask | kOneByteDataHintMask))),
2202       graph()->GetConstant0(), Token::NE);
2203   if_onebyte.Or();
2204   STATIC_ASSERT(kOneByteStringTag != 0 &&
2205                 kOneByteDataHintTag != 0 &&
2206                 kOneByteDataHintTag != kOneByteStringTag);
2207   if_onebyte.If<HCompareNumericAndBranch>(
2208       AddUncasted<HBitwise>(
2209           Token::BIT_AND, xored_instance_types,
2210           Add<HConstant>(static_cast<int32_t>(
2211                   kOneByteStringTag | kOneByteDataHintTag))),
2212       Add<HConstant>(static_cast<int32_t>(
2213               kOneByteStringTag | kOneByteDataHintTag)), Token::EQ);
2214   if_onebyte.Then();
2215   {
2216     // We can safely skip the write barrier for storing the map here.
2217     Add<HStoreNamedField>(
2218         result, HObjectAccess::ForMap(),
2219         Add<HConstant>(isolate()->factory()->cons_one_byte_string_map()));
2220   }
2221   if_onebyte.Else();
2222   {
2223     // We can safely skip the write barrier for storing the map here.
2224     Add<HStoreNamedField>(
2225         result, HObjectAccess::ForMap(),
2226         Add<HConstant>(isolate()->factory()->cons_string_map()));
2227   }
2228   if_onebyte.End();
2229
2230   // Initialize the cons string fields.
2231   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2232                         Add<HConstant>(String::kEmptyHashField));
2233   Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2234   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
2235   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
2236
2237   // Count the native string addition.
2238   AddIncrementCounter(isolate()->counters()->string_add_native());
2239
2240   return result;
2241 }
2242
2243
2244 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
2245                                             HValue* src_offset,
2246                                             String::Encoding src_encoding,
2247                                             HValue* dst,
2248                                             HValue* dst_offset,
2249                                             String::Encoding dst_encoding,
2250                                             HValue* length) {
2251   DCHECK(dst_encoding != String::ONE_BYTE_ENCODING ||
2252          src_encoding == String::ONE_BYTE_ENCODING);
2253   LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
2254   HValue* index = loop.BeginBody(graph()->GetConstant0(), length, Token::LT);
2255   {
2256     HValue* src_index = AddUncasted<HAdd>(src_offset, index);
2257     HValue* value =
2258         AddUncasted<HSeqStringGetChar>(src_encoding, src, src_index);
2259     HValue* dst_index = AddUncasted<HAdd>(dst_offset, index);
2260     Add<HSeqStringSetChar>(dst_encoding, dst, dst_index, value);
2261   }
2262   loop.EndBody();
2263 }
2264
2265
2266 HValue* HGraphBuilder::BuildObjectSizeAlignment(
2267     HValue* unaligned_size, int header_size) {
2268   DCHECK((header_size & kObjectAlignmentMask) == 0);
2269   HValue* size = AddUncasted<HAdd>(
2270       unaligned_size, Add<HConstant>(static_cast<int32_t>(
2271           header_size + kObjectAlignmentMask)));
2272   size->ClearFlag(HValue::kCanOverflow);
2273   return AddUncasted<HBitwise>(
2274       Token::BIT_AND, size, Add<HConstant>(static_cast<int32_t>(
2275           ~kObjectAlignmentMask)));
2276 }
2277
2278
2279 HValue* HGraphBuilder::BuildUncheckedStringAdd(
2280     HValue* left,
2281     HValue* right,
2282     HAllocationMode allocation_mode) {
2283   // Determine the string lengths.
2284   HValue* left_length = AddLoadStringLength(left);
2285   HValue* right_length = AddLoadStringLength(right);
2286
2287   // Compute the combined string length.
2288   HValue* length = BuildAddStringLengths(left_length, right_length);
2289
2290   // Do some manual constant folding here.
2291   if (left_length->IsConstant()) {
2292     HConstant* c_left_length = HConstant::cast(left_length);
2293     DCHECK_NE(0, c_left_length->Integer32Value());
2294     if (c_left_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2295       // The right string contains at least one character.
2296       return BuildCreateConsString(length, left, right, allocation_mode);
2297     }
2298   } else if (right_length->IsConstant()) {
2299     HConstant* c_right_length = HConstant::cast(right_length);
2300     DCHECK_NE(0, c_right_length->Integer32Value());
2301     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2302       // The left string contains at least one character.
2303       return BuildCreateConsString(length, left, right, allocation_mode);
2304     }
2305   }
2306
2307   // Check if we should create a cons string.
2308   IfBuilder if_createcons(this);
2309   if_createcons.If<HCompareNumericAndBranch>(
2310       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
2311   if_createcons.Then();
2312   {
2313     // Create a cons string.
2314     Push(BuildCreateConsString(length, left, right, allocation_mode));
2315   }
2316   if_createcons.Else();
2317   {
2318     // Determine the string instance types.
2319     HValue* left_instance_type = AddLoadStringInstanceType(left);
2320     HValue* right_instance_type = AddLoadStringInstanceType(right);
2321
2322     // Compute union and difference of instance types.
2323     HValue* ored_instance_types = AddUncasted<HBitwise>(
2324         Token::BIT_OR, left_instance_type, right_instance_type);
2325     HValue* xored_instance_types = AddUncasted<HBitwise>(
2326         Token::BIT_XOR, left_instance_type, right_instance_type);
2327
2328     // Check if both strings have the same encoding and both are
2329     // sequential.
2330     IfBuilder if_sameencodingandsequential(this);
2331     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2332         AddUncasted<HBitwise>(
2333             Token::BIT_AND, xored_instance_types,
2334             Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2335         graph()->GetConstant0(), Token::EQ);
2336     if_sameencodingandsequential.And();
2337     STATIC_ASSERT(kSeqStringTag == 0);
2338     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2339         AddUncasted<HBitwise>(
2340             Token::BIT_AND, ored_instance_types,
2341             Add<HConstant>(static_cast<int32_t>(kStringRepresentationMask))),
2342         graph()->GetConstant0(), Token::EQ);
2343     if_sameencodingandsequential.Then();
2344     {
2345       HConstant* string_map =
2346           Add<HConstant>(isolate()->factory()->string_map());
2347       HConstant* one_byte_string_map =
2348           Add<HConstant>(isolate()->factory()->one_byte_string_map());
2349
2350       // Determine map and size depending on whether result is one-byte string.
2351       IfBuilder if_onebyte(this);
2352       STATIC_ASSERT(kOneByteStringTag != 0);
2353       if_onebyte.If<HCompareNumericAndBranch>(
2354           AddUncasted<HBitwise>(
2355               Token::BIT_AND, ored_instance_types,
2356               Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2357           graph()->GetConstant0(), Token::NE);
2358       if_onebyte.Then();
2359       {
2360         // Allocate sequential one-byte string object.
2361         Push(length);
2362         Push(one_byte_string_map);
2363       }
2364       if_onebyte.Else();
2365       {
2366         // Allocate sequential two-byte string object.
2367         HValue* size = AddUncasted<HShl>(length, graph()->GetConstant1());
2368         size->ClearFlag(HValue::kCanOverflow);
2369         size->SetFlag(HValue::kUint32);
2370         Push(size);
2371         Push(string_map);
2372       }
2373       if_onebyte.End();
2374       HValue* map = Pop();
2375
2376       // Calculate the number of bytes needed for the characters in the
2377       // string while observing object alignment.
2378       STATIC_ASSERT((SeqString::kHeaderSize & kObjectAlignmentMask) == 0);
2379       HValue* size = BuildObjectSizeAlignment(Pop(), SeqString::kHeaderSize);
2380
2381       // Allocate the string object. HAllocate does not care whether we pass
2382       // STRING_TYPE or ONE_BYTE_STRING_TYPE here, so we just use STRING_TYPE.
2383       HAllocate* result = BuildAllocate(
2384           size, HType::String(), STRING_TYPE, allocation_mode);
2385       Add<HStoreNamedField>(result, HObjectAccess::ForMap(), map);
2386
2387       // Initialize the string fields.
2388       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2389                             Add<HConstant>(String::kEmptyHashField));
2390       Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2391
2392       // Copy characters to the result string.
2393       IfBuilder if_twobyte(this);
2394       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
2395       if_twobyte.Then();
2396       {
2397         // Copy characters from the left string.
2398         BuildCopySeqStringChars(
2399             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2400             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2401             left_length);
2402
2403         // Copy characters from the right string.
2404         BuildCopySeqStringChars(
2405             right, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2406             result, left_length, String::TWO_BYTE_ENCODING,
2407             right_length);
2408       }
2409       if_twobyte.Else();
2410       {
2411         // Copy characters from the left string.
2412         BuildCopySeqStringChars(
2413             left, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2414             result, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2415             left_length);
2416
2417         // Copy characters from the right string.
2418         BuildCopySeqStringChars(
2419             right, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2420             result, left_length, String::ONE_BYTE_ENCODING,
2421             right_length);
2422       }
2423       if_twobyte.End();
2424
2425       // Count the native string addition.
2426       AddIncrementCounter(isolate()->counters()->string_add_native());
2427
2428       // Return the sequential string.
2429       Push(result);
2430     }
2431     if_sameencodingandsequential.Else();
2432     {
2433       // Fallback to the runtime to add the two strings.
2434       Add<HPushArguments>(left, right);
2435       Push(Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kStringAdd), 2));
2436     }
2437     if_sameencodingandsequential.End();
2438   }
2439   if_createcons.End();
2440
2441   return Pop();
2442 }
2443
2444
2445 HValue* HGraphBuilder::BuildStringAdd(
2446     HValue* left,
2447     HValue* right,
2448     HAllocationMode allocation_mode) {
2449   NoObservableSideEffectsScope no_effects(this);
2450
2451   // Determine string lengths.
2452   HValue* left_length = AddLoadStringLength(left);
2453   HValue* right_length = AddLoadStringLength(right);
2454
2455   // Check if left string is empty.
2456   IfBuilder if_leftempty(this);
2457   if_leftempty.If<HCompareNumericAndBranch>(
2458       left_length, graph()->GetConstant0(), Token::EQ);
2459   if_leftempty.Then();
2460   {
2461     // Count the native string addition.
2462     AddIncrementCounter(isolate()->counters()->string_add_native());
2463
2464     // Just return the right string.
2465     Push(right);
2466   }
2467   if_leftempty.Else();
2468   {
2469     // Check if right string is empty.
2470     IfBuilder if_rightempty(this);
2471     if_rightempty.If<HCompareNumericAndBranch>(
2472         right_length, graph()->GetConstant0(), Token::EQ);
2473     if_rightempty.Then();
2474     {
2475       // Count the native string addition.
2476       AddIncrementCounter(isolate()->counters()->string_add_native());
2477
2478       // Just return the left string.
2479       Push(left);
2480     }
2481     if_rightempty.Else();
2482     {
2483       // Add the two non-empty strings.
2484       Push(BuildUncheckedStringAdd(left, right, allocation_mode));
2485     }
2486     if_rightempty.End();
2487   }
2488   if_leftempty.End();
2489
2490   return Pop();
2491 }
2492
2493
2494 HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
2495     HValue* checked_object,
2496     HValue* key,
2497     HValue* val,
2498     bool is_js_array,
2499     ElementsKind elements_kind,
2500     PropertyAccessType access_type,
2501     LoadKeyedHoleMode load_mode,
2502     KeyedAccessStoreMode store_mode) {
2503   DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
2504          checked_object->IsCheckMaps());
2505   DCHECK(!IsFixedTypedArrayElementsKind(elements_kind) || !is_js_array);
2506   // No GVNFlag is necessary for ElementsKind if there is an explicit dependency
2507   // on a HElementsTransition instruction. The flag can also be removed if the
2508   // map to check has FAST_HOLEY_ELEMENTS, since there can be no further
2509   // ElementsKind transitions. Finally, the dependency can be removed for stores
2510   // for FAST_ELEMENTS, since a transition to HOLEY elements won't change the
2511   // generated store code.
2512   if ((elements_kind == FAST_HOLEY_ELEMENTS) ||
2513       (elements_kind == FAST_ELEMENTS && access_type == STORE)) {
2514     checked_object->ClearDependsOnFlag(kElementsKind);
2515   }
2516
2517   bool fast_smi_only_elements = IsFastSmiElementsKind(elements_kind);
2518   bool fast_elements = IsFastObjectElementsKind(elements_kind);
2519   HValue* elements = AddLoadElements(checked_object);
2520   if (access_type == STORE && (fast_elements || fast_smi_only_elements) &&
2521       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
2522     HCheckMaps* check_cow_map = Add<HCheckMaps>(
2523         elements, isolate()->factory()->fixed_array_map());
2524     check_cow_map->ClearDependsOnFlag(kElementsKind);
2525   }
2526   HInstruction* length = NULL;
2527   if (is_js_array) {
2528     length = Add<HLoadNamedField>(
2529         checked_object->ActualValue(), checked_object,
2530         HObjectAccess::ForArrayLength(elements_kind));
2531   } else {
2532     length = AddLoadFixedArrayLength(elements);
2533   }
2534   length->set_type(HType::Smi());
2535   HValue* checked_key = NULL;
2536   if (IsFixedTypedArrayElementsKind(elements_kind)) {
2537     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
2538
2539     HValue* external_pointer = Add<HLoadNamedField>(
2540         elements, nullptr,
2541         HObjectAccess::ForFixedTypedArrayBaseExternalPointer());
2542     HValue* base_pointer = Add<HLoadNamedField>(
2543         elements, nullptr, HObjectAccess::ForFixedTypedArrayBaseBasePointer());
2544     HValue* backing_store = AddUncasted<HAdd>(
2545         external_pointer, base_pointer, Strength::WEAK, AddOfExternalAndTagged);
2546
2547     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
2548       NoObservableSideEffectsScope no_effects(this);
2549       IfBuilder length_checker(this);
2550       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
2551       length_checker.Then();
2552       IfBuilder negative_checker(this);
2553       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
2554           key, graph()->GetConstant0(), Token::GTE);
2555       negative_checker.Then();
2556       HInstruction* result = AddElementAccess(
2557           backing_store, key, val, bounds_check, elements_kind, access_type);
2558       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
2559       negative_checker.End();
2560       length_checker.End();
2561       return result;
2562     } else {
2563       DCHECK(store_mode == STANDARD_STORE);
2564       checked_key = Add<HBoundsCheck>(key, length);
2565       return AddElementAccess(
2566           backing_store, checked_key, val,
2567           checked_object, elements_kind, access_type);
2568     }
2569   }
2570   DCHECK(fast_smi_only_elements ||
2571          fast_elements ||
2572          IsFastDoubleElementsKind(elements_kind));
2573
2574   // In case val is stored into a fast smi array, assure that the value is a smi
2575   // before manipulating the backing store. Otherwise the actual store may
2576   // deopt, leaving the backing store in an invalid state.
2577   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
2578       !val->type().IsSmi()) {
2579     val = AddUncasted<HForceRepresentation>(val, Representation::Smi());
2580   }
2581
2582   if (IsGrowStoreMode(store_mode)) {
2583     NoObservableSideEffectsScope no_effects(this);
2584     Representation representation = HStoreKeyed::RequiredValueRepresentation(
2585         elements_kind, STORE_TO_INITIALIZED_ENTRY);
2586     val = AddUncasted<HForceRepresentation>(val, representation);
2587     elements = BuildCheckForCapacityGrow(checked_object, elements,
2588                                          elements_kind, length, key,
2589                                          is_js_array, access_type);
2590     checked_key = key;
2591   } else {
2592     checked_key = Add<HBoundsCheck>(key, length);
2593
2594     if (access_type == STORE && (fast_elements || fast_smi_only_elements)) {
2595       if (store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
2596         NoObservableSideEffectsScope no_effects(this);
2597         elements = BuildCopyElementsOnWrite(checked_object, elements,
2598                                             elements_kind, length);
2599       } else {
2600         HCheckMaps* check_cow_map = Add<HCheckMaps>(
2601             elements, isolate()->factory()->fixed_array_map());
2602         check_cow_map->ClearDependsOnFlag(kElementsKind);
2603       }
2604     }
2605   }
2606   return AddElementAccess(elements, checked_key, val, checked_object,
2607                           elements_kind, access_type, load_mode);
2608 }
2609
2610
2611 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
2612     JSArrayBuilder* array_builder,
2613     HValue* length_argument) {
2614   if (length_argument->IsConstant() &&
2615       HConstant::cast(length_argument)->HasSmiValue()) {
2616     int array_length = HConstant::cast(length_argument)->Integer32Value();
2617     if (array_length == 0) {
2618       return array_builder->AllocateEmptyArray();
2619     } else {
2620       return array_builder->AllocateArray(length_argument,
2621                                           array_length,
2622                                           length_argument);
2623     }
2624   }
2625
2626   HValue* constant_zero = graph()->GetConstant0();
2627   HConstant* max_alloc_length =
2628       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
2629   HInstruction* checked_length = Add<HBoundsCheck>(length_argument,
2630                                                    max_alloc_length);
2631   IfBuilder if_builder(this);
2632   if_builder.If<HCompareNumericAndBranch>(checked_length, constant_zero,
2633                                           Token::EQ);
2634   if_builder.Then();
2635   const int initial_capacity = JSArray::kPreallocatedArrayElements;
2636   HConstant* initial_capacity_node = Add<HConstant>(initial_capacity);
2637   Push(initial_capacity_node);  // capacity
2638   Push(constant_zero);          // length
2639   if_builder.Else();
2640   if (!(top_info()->IsStub()) &&
2641       IsFastPackedElementsKind(array_builder->kind())) {
2642     // We'll come back later with better (holey) feedback.
2643     if_builder.Deopt(
2644         Deoptimizer::kHoleyArrayDespitePackedElements_kindFeedback);
2645   } else {
2646     Push(checked_length);         // capacity
2647     Push(checked_length);         // length
2648   }
2649   if_builder.End();
2650
2651   // Figure out total size
2652   HValue* length = Pop();
2653   HValue* capacity = Pop();
2654   return array_builder->AllocateArray(capacity, max_alloc_length, length);
2655 }
2656
2657
2658 HValue* HGraphBuilder::BuildCalculateElementsSize(ElementsKind kind,
2659                                                   HValue* capacity) {
2660   int elements_size = IsFastDoubleElementsKind(kind)
2661       ? kDoubleSize
2662       : kPointerSize;
2663
2664   HConstant* elements_size_value = Add<HConstant>(elements_size);
2665   HInstruction* mul =
2666       HMul::NewImul(isolate(), zone(), context(), capacity->ActualValue(),
2667                     elements_size_value);
2668   AddInstruction(mul);
2669   mul->ClearFlag(HValue::kCanOverflow);
2670
2671   STATIC_ASSERT(FixedDoubleArray::kHeaderSize == FixedArray::kHeaderSize);
2672
2673   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
2674   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
2675   total_size->ClearFlag(HValue::kCanOverflow);
2676   return total_size;
2677 }
2678
2679
2680 HAllocate* HGraphBuilder::AllocateJSArrayObject(AllocationSiteMode mode) {
2681   int base_size = JSArray::kSize;
2682   if (mode == TRACK_ALLOCATION_SITE) {
2683     base_size += AllocationMemento::kSize;
2684   }
2685   HConstant* size_in_bytes = Add<HConstant>(base_size);
2686   return Add<HAllocate>(
2687       size_in_bytes, HType::JSArray(), NOT_TENURED, JS_OBJECT_TYPE);
2688 }
2689
2690
2691 HConstant* HGraphBuilder::EstablishElementsAllocationSize(
2692     ElementsKind kind,
2693     int capacity) {
2694   int base_size = IsFastDoubleElementsKind(kind)
2695       ? FixedDoubleArray::SizeFor(capacity)
2696       : FixedArray::SizeFor(capacity);
2697
2698   return Add<HConstant>(base_size);
2699 }
2700
2701
2702 HAllocate* HGraphBuilder::BuildAllocateElements(ElementsKind kind,
2703                                                 HValue* size_in_bytes) {
2704   InstanceType instance_type = IsFastDoubleElementsKind(kind)
2705       ? FIXED_DOUBLE_ARRAY_TYPE
2706       : FIXED_ARRAY_TYPE;
2707
2708   return Add<HAllocate>(size_in_bytes, HType::HeapObject(), NOT_TENURED,
2709                         instance_type);
2710 }
2711
2712
2713 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
2714                                                   ElementsKind kind,
2715                                                   HValue* capacity) {
2716   Factory* factory = isolate()->factory();
2717   Handle<Map> map = IsFastDoubleElementsKind(kind)
2718       ? factory->fixed_double_array_map()
2719       : factory->fixed_array_map();
2720
2721   Add<HStoreNamedField>(elements, HObjectAccess::ForMap(), Add<HConstant>(map));
2722   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
2723                         capacity);
2724 }
2725
2726
2727 HValue* HGraphBuilder::BuildAllocateAndInitializeArray(ElementsKind kind,
2728                                                        HValue* capacity) {
2729   // The HForceRepresentation is to prevent possible deopt on int-smi
2730   // conversion after allocation but before the new object fields are set.
2731   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
2732   HValue* size_in_bytes = BuildCalculateElementsSize(kind, capacity);
2733   HValue* new_array = BuildAllocateElements(kind, size_in_bytes);
2734   BuildInitializeElementsHeader(new_array, kind, capacity);
2735   return new_array;
2736 }
2737
2738
2739 void HGraphBuilder::BuildJSArrayHeader(HValue* array,
2740                                        HValue* array_map,
2741                                        HValue* elements,
2742                                        AllocationSiteMode mode,
2743                                        ElementsKind elements_kind,
2744                                        HValue* allocation_site_payload,
2745                                        HValue* length_field) {
2746   Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
2747
2748   HConstant* empty_fixed_array =
2749     Add<HConstant>(isolate()->factory()->empty_fixed_array());
2750
2751   Add<HStoreNamedField>(
2752       array, HObjectAccess::ForPropertiesPointer(), empty_fixed_array);
2753
2754   Add<HStoreNamedField>(
2755       array, HObjectAccess::ForElementsPointer(),
2756       elements != NULL ? elements : empty_fixed_array);
2757
2758   Add<HStoreNamedField>(
2759       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
2760
2761   if (mode == TRACK_ALLOCATION_SITE) {
2762     BuildCreateAllocationMemento(
2763         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
2764   }
2765 }
2766
2767
2768 HInstruction* HGraphBuilder::AddElementAccess(
2769     HValue* elements,
2770     HValue* checked_key,
2771     HValue* val,
2772     HValue* dependency,
2773     ElementsKind elements_kind,
2774     PropertyAccessType access_type,
2775     LoadKeyedHoleMode load_mode) {
2776   if (access_type == STORE) {
2777     DCHECK(val != NULL);
2778     if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
2779       val = Add<HClampToUint8>(val);
2780     }
2781     return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
2782                             STORE_TO_INITIALIZED_ENTRY);
2783   }
2784
2785   DCHECK(access_type == LOAD);
2786   DCHECK(val == NULL);
2787   HLoadKeyed* load = Add<HLoadKeyed>(
2788       elements, checked_key, dependency, elements_kind, load_mode);
2789   if (elements_kind == UINT32_ELEMENTS) {
2790     graph()->RecordUint32Instruction(load);
2791   }
2792   return load;
2793 }
2794
2795
2796 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
2797                                            HValue* dependency) {
2798   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
2799 }
2800
2801
2802 HLoadNamedField* HGraphBuilder::AddLoadElements(HValue* object,
2803                                                 HValue* dependency) {
2804   return Add<HLoadNamedField>(
2805       object, dependency, HObjectAccess::ForElementsPointer());
2806 }
2807
2808
2809 HLoadNamedField* HGraphBuilder::AddLoadFixedArrayLength(
2810     HValue* array,
2811     HValue* dependency) {
2812   return Add<HLoadNamedField>(
2813       array, dependency, HObjectAccess::ForFixedArrayLength());
2814 }
2815
2816
2817 HLoadNamedField* HGraphBuilder::AddLoadArrayLength(HValue* array,
2818                                                    ElementsKind kind,
2819                                                    HValue* dependency) {
2820   return Add<HLoadNamedField>(
2821       array, dependency, HObjectAccess::ForArrayLength(kind));
2822 }
2823
2824
2825 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* old_capacity) {
2826   HValue* half_old_capacity = AddUncasted<HShr>(old_capacity,
2827                                                 graph_->GetConstant1());
2828
2829   HValue* new_capacity = AddUncasted<HAdd>(half_old_capacity, old_capacity);
2830   new_capacity->ClearFlag(HValue::kCanOverflow);
2831
2832   HValue* min_growth = Add<HConstant>(16);
2833
2834   new_capacity = AddUncasted<HAdd>(new_capacity, min_growth);
2835   new_capacity->ClearFlag(HValue::kCanOverflow);
2836
2837   return new_capacity;
2838 }
2839
2840
2841 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
2842                                                  HValue* elements,
2843                                                  ElementsKind kind,
2844                                                  ElementsKind new_kind,
2845                                                  HValue* length,
2846                                                  HValue* new_capacity) {
2847   Add<HBoundsCheck>(new_capacity, Add<HConstant>(
2848           (Page::kMaxRegularHeapObjectSize - FixedArray::kHeaderSize) >>
2849           ElementsKindToShiftSize(new_kind)));
2850
2851   HValue* new_elements =
2852       BuildAllocateAndInitializeArray(new_kind, new_capacity);
2853
2854   BuildCopyElements(elements, kind, new_elements,
2855                     new_kind, length, new_capacity);
2856
2857   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
2858                         new_elements);
2859
2860   return new_elements;
2861 }
2862
2863
2864 void HGraphBuilder::BuildFillElementsWithValue(HValue* elements,
2865                                                ElementsKind elements_kind,
2866                                                HValue* from,
2867                                                HValue* to,
2868                                                HValue* value) {
2869   if (to == NULL) {
2870     to = AddLoadFixedArrayLength(elements);
2871   }
2872
2873   // Special loop unfolding case
2874   STATIC_ASSERT(JSArray::kPreallocatedArrayElements <=
2875                 kElementLoopUnrollThreshold);
2876   int initial_capacity = -1;
2877   if (from->IsInteger32Constant() && to->IsInteger32Constant()) {
2878     int constant_from = from->GetInteger32Constant();
2879     int constant_to = to->GetInteger32Constant();
2880
2881     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
2882       initial_capacity = constant_to;
2883     }
2884   }
2885
2886   if (initial_capacity >= 0) {
2887     for (int i = 0; i < initial_capacity; i++) {
2888       HInstruction* key = Add<HConstant>(i);
2889       Add<HStoreKeyed>(elements, key, value, elements_kind);
2890     }
2891   } else {
2892     // Carefully loop backwards so that the "from" remains live through the loop
2893     // rather than the to. This often corresponds to keeping length live rather
2894     // then capacity, which helps register allocation, since length is used more
2895     // other than capacity after filling with holes.
2896     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2897
2898     HValue* key = builder.BeginBody(to, from, Token::GT);
2899
2900     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
2901     adjusted_key->ClearFlag(HValue::kCanOverflow);
2902
2903     Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
2904
2905     builder.EndBody();
2906   }
2907 }
2908
2909
2910 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
2911                                               ElementsKind elements_kind,
2912                                               HValue* from,
2913                                               HValue* to) {
2914   // Fast elements kinds need to be initialized in case statements below cause a
2915   // garbage collection.
2916
2917   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
2918                      ? graph()->GetConstantHole()
2919                      : Add<HConstant>(HConstant::kHoleNaN);
2920
2921   // Since we're about to store a hole value, the store instruction below must
2922   // assume an elements kind that supports heap object values.
2923   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
2924     elements_kind = FAST_HOLEY_ELEMENTS;
2925   }
2926
2927   BuildFillElementsWithValue(elements, elements_kind, from, to, hole);
2928 }
2929
2930
2931 void HGraphBuilder::BuildCopyProperties(HValue* from_properties,
2932                                         HValue* to_properties, HValue* length,
2933                                         HValue* capacity) {
2934   ElementsKind kind = FAST_ELEMENTS;
2935
2936   BuildFillElementsWithValue(to_properties, kind, length, capacity,
2937                              graph()->GetConstantUndefined());
2938
2939   LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2940
2941   HValue* key = builder.BeginBody(length, graph()->GetConstant0(), Token::GT);
2942
2943   key = AddUncasted<HSub>(key, graph()->GetConstant1());
2944   key->ClearFlag(HValue::kCanOverflow);
2945
2946   HValue* element = Add<HLoadKeyed>(from_properties, key, nullptr, kind);
2947
2948   Add<HStoreKeyed>(to_properties, key, element, kind);
2949
2950   builder.EndBody();
2951 }
2952
2953
2954 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
2955                                       ElementsKind from_elements_kind,
2956                                       HValue* to_elements,
2957                                       ElementsKind to_elements_kind,
2958                                       HValue* length,
2959                                       HValue* capacity) {
2960   int constant_capacity = -1;
2961   if (capacity != NULL &&
2962       capacity->IsConstant() &&
2963       HConstant::cast(capacity)->HasInteger32Value()) {
2964     int constant_candidate = HConstant::cast(capacity)->Integer32Value();
2965     if (constant_candidate <= kElementLoopUnrollThreshold) {
2966       constant_capacity = constant_candidate;
2967     }
2968   }
2969
2970   bool pre_fill_with_holes =
2971     IsFastDoubleElementsKind(from_elements_kind) &&
2972     IsFastObjectElementsKind(to_elements_kind);
2973   if (pre_fill_with_holes) {
2974     // If the copy might trigger a GC, make sure that the FixedArray is
2975     // pre-initialized with holes to make sure that it's always in a
2976     // consistent state.
2977     BuildFillElementsWithHole(to_elements, to_elements_kind,
2978                               graph()->GetConstant0(), NULL);
2979   }
2980
2981   if (constant_capacity != -1) {
2982     // Unroll the loop for small elements kinds.
2983     for (int i = 0; i < constant_capacity; i++) {
2984       HValue* key_constant = Add<HConstant>(i);
2985       HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
2986                                             nullptr, from_elements_kind);
2987       Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
2988     }
2989   } else {
2990     if (!pre_fill_with_holes &&
2991         (capacity == NULL || !length->Equals(capacity))) {
2992       BuildFillElementsWithHole(to_elements, to_elements_kind,
2993                                 length, NULL);
2994     }
2995
2996     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2997
2998     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
2999                                     Token::GT);
3000
3001     key = AddUncasted<HSub>(key, graph()->GetConstant1());
3002     key->ClearFlag(HValue::kCanOverflow);
3003
3004     HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr,
3005                                       from_elements_kind, ALLOW_RETURN_HOLE);
3006
3007     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
3008                          IsFastSmiElementsKind(to_elements_kind))
3009       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
3010
3011     if (IsHoleyElementsKind(from_elements_kind) &&
3012         from_elements_kind != to_elements_kind) {
3013       IfBuilder if_hole(this);
3014       if_hole.If<HCompareHoleAndBranch>(element);
3015       if_hole.Then();
3016       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
3017                                      ? Add<HConstant>(HConstant::kHoleNaN)
3018                                      : graph()->GetConstantHole();
3019       Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
3020       if_hole.Else();
3021       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3022       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3023       if_hole.End();
3024     } else {
3025       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3026       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3027     }
3028
3029     builder.EndBody();
3030   }
3031
3032   Counters* counters = isolate()->counters();
3033   AddIncrementCounter(counters->inlined_copied_elements());
3034 }
3035
3036
3037 HValue* HGraphBuilder::BuildCloneShallowArrayCow(HValue* boilerplate,
3038                                                  HValue* allocation_site,
3039                                                  AllocationSiteMode mode,
3040                                                  ElementsKind kind) {
3041   HAllocate* array = AllocateJSArrayObject(mode);
3042
3043   HValue* map = AddLoadMap(boilerplate);
3044   HValue* elements = AddLoadElements(boilerplate);
3045   HValue* length = AddLoadArrayLength(boilerplate, kind);
3046
3047   BuildJSArrayHeader(array,
3048                      map,
3049                      elements,
3050                      mode,
3051                      FAST_ELEMENTS,
3052                      allocation_site,
3053                      length);
3054   return array;
3055 }
3056
3057
3058 HValue* HGraphBuilder::BuildCloneShallowArrayEmpty(HValue* boilerplate,
3059                                                    HValue* allocation_site,
3060                                                    AllocationSiteMode mode) {
3061   HAllocate* array = AllocateJSArrayObject(mode);
3062
3063   HValue* map = AddLoadMap(boilerplate);
3064
3065   BuildJSArrayHeader(array,
3066                      map,
3067                      NULL,  // set elements to empty fixed array
3068                      mode,
3069                      FAST_ELEMENTS,
3070                      allocation_site,
3071                      graph()->GetConstant0());
3072   return array;
3073 }
3074
3075
3076 HValue* HGraphBuilder::BuildCloneShallowArrayNonEmpty(HValue* boilerplate,
3077                                                       HValue* allocation_site,
3078                                                       AllocationSiteMode mode,
3079                                                       ElementsKind kind) {
3080   HValue* boilerplate_elements = AddLoadElements(boilerplate);
3081   HValue* capacity = AddLoadFixedArrayLength(boilerplate_elements);
3082
3083   // Generate size calculation code here in order to make it dominate
3084   // the JSArray allocation.
3085   HValue* elements_size = BuildCalculateElementsSize(kind, capacity);
3086
3087   // Create empty JSArray object for now, store elimination should remove
3088   // redundant initialization of elements and length fields and at the same
3089   // time the object will be fully prepared for GC if it happens during
3090   // elements allocation.
3091   HValue* result = BuildCloneShallowArrayEmpty(
3092       boilerplate, allocation_site, mode);
3093
3094   HAllocate* elements = BuildAllocateElements(kind, elements_size);
3095
3096   // This function implicitly relies on the fact that the
3097   // FastCloneShallowArrayStub is called only for literals shorter than
3098   // JSObject::kInitialMaxFastElementArray.
3099   // Can't add HBoundsCheck here because otherwise the stub will eager a frame.
3100   HConstant* size_upper_bound = EstablishElementsAllocationSize(
3101       kind, JSObject::kInitialMaxFastElementArray);
3102   elements->set_size_upper_bound(size_upper_bound);
3103
3104   Add<HStoreNamedField>(result, HObjectAccess::ForElementsPointer(), elements);
3105
3106   // The allocation for the cloned array above causes register pressure on
3107   // machines with low register counts. Force a reload of the boilerplate
3108   // elements here to free up a register for the allocation to avoid unnecessary
3109   // spillage.
3110   boilerplate_elements = AddLoadElements(boilerplate);
3111   boilerplate_elements->SetFlag(HValue::kCantBeReplaced);
3112
3113   // Copy the elements array header.
3114   for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
3115     HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
3116     Add<HStoreNamedField>(
3117         elements, access,
3118         Add<HLoadNamedField>(boilerplate_elements, nullptr, access));
3119   }
3120
3121   // And the result of the length
3122   HValue* length = AddLoadArrayLength(boilerplate, kind);
3123   Add<HStoreNamedField>(result, HObjectAccess::ForArrayLength(kind), length);
3124
3125   BuildCopyElements(boilerplate_elements, kind, elements,
3126                     kind, length, NULL);
3127   return result;
3128 }
3129
3130
3131 void HGraphBuilder::BuildCompareNil(HValue* value, Type* type,
3132                                     HIfContinuation* continuation,
3133                                     MapEmbedding map_embedding) {
3134   IfBuilder if_nil(this);
3135   bool some_case_handled = false;
3136   bool some_case_missing = false;
3137
3138   if (type->Maybe(Type::Null())) {
3139     if (some_case_handled) if_nil.Or();
3140     if_nil.If<HCompareObjectEqAndBranch>(value, graph()->GetConstantNull());
3141     some_case_handled = true;
3142   } else {
3143     some_case_missing = true;
3144   }
3145
3146   if (type->Maybe(Type::Undefined())) {
3147     if (some_case_handled) if_nil.Or();
3148     if_nil.If<HCompareObjectEqAndBranch>(value,
3149                                          graph()->GetConstantUndefined());
3150     some_case_handled = true;
3151   } else {
3152     some_case_missing = true;
3153   }
3154
3155   if (type->Maybe(Type::Undetectable())) {
3156     if (some_case_handled) if_nil.Or();
3157     if_nil.If<HIsUndetectableAndBranch>(value);
3158     some_case_handled = true;
3159   } else {
3160     some_case_missing = true;
3161   }
3162
3163   if (some_case_missing) {
3164     if_nil.Then();
3165     if_nil.Else();
3166     if (type->NumClasses() == 1) {
3167       BuildCheckHeapObject(value);
3168       // For ICs, the map checked below is a sentinel map that gets replaced by
3169       // the monomorphic map when the code is used as a template to generate a
3170       // new IC. For optimized functions, there is no sentinel map, the map
3171       // emitted below is the actual monomorphic map.
3172       if (map_embedding == kEmbedMapsViaWeakCells) {
3173         HValue* cell =
3174             Add<HConstant>(Map::WeakCellForMap(type->Classes().Current()));
3175         HValue* expected_map = Add<HLoadNamedField>(
3176             cell, nullptr, HObjectAccess::ForWeakCellValue());
3177         HValue* map =
3178             Add<HLoadNamedField>(value, nullptr, HObjectAccess::ForMap());
3179         IfBuilder map_check(this);
3180         map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
3181         map_check.ThenDeopt(Deoptimizer::kUnknownMap);
3182         map_check.End();
3183       } else {
3184         DCHECK(map_embedding == kEmbedMapsDirectly);
3185         Add<HCheckMaps>(value, type->Classes().Current());
3186       }
3187     } else {
3188       if_nil.Deopt(Deoptimizer::kTooManyUndetectableTypes);
3189     }
3190   }
3191
3192   if_nil.CaptureContinuation(continuation);
3193 }
3194
3195
3196 void HGraphBuilder::BuildCreateAllocationMemento(
3197     HValue* previous_object,
3198     HValue* previous_object_size,
3199     HValue* allocation_site) {
3200   DCHECK(allocation_site != NULL);
3201   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
3202       previous_object, previous_object_size, HType::HeapObject());
3203   AddStoreMapConstant(
3204       allocation_memento, isolate()->factory()->allocation_memento_map());
3205   Add<HStoreNamedField>(
3206       allocation_memento,
3207       HObjectAccess::ForAllocationMementoSite(),
3208       allocation_site);
3209   if (FLAG_allocation_site_pretenuring) {
3210     HValue* memento_create_count =
3211         Add<HLoadNamedField>(allocation_site, nullptr,
3212                              HObjectAccess::ForAllocationSiteOffset(
3213                                  AllocationSite::kPretenureCreateCountOffset));
3214     memento_create_count = AddUncasted<HAdd>(
3215         memento_create_count, graph()->GetConstant1());
3216     // This smi value is reset to zero after every gc, overflow isn't a problem
3217     // since the counter is bounded by the new space size.
3218     memento_create_count->ClearFlag(HValue::kCanOverflow);
3219     Add<HStoreNamedField>(
3220         allocation_site, HObjectAccess::ForAllocationSiteOffset(
3221             AllocationSite::kPretenureCreateCountOffset), memento_create_count);
3222   }
3223 }
3224
3225
3226 HInstruction* HGraphBuilder::BuildGetNativeContext() {
3227   // Get the global object, then the native context
3228   HValue* global_object = Add<HLoadNamedField>(
3229       context(), nullptr,
3230       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3231   return Add<HLoadNamedField>(global_object, nullptr,
3232                               HObjectAccess::ForObservableJSObjectOffset(
3233                                   GlobalObject::kNativeContextOffset));
3234 }
3235
3236
3237 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
3238   // Get the global object, then the native context
3239   HInstruction* context = Add<HLoadNamedField>(
3240       closure, nullptr, HObjectAccess::ForFunctionContextPointer());
3241   HInstruction* global_object = Add<HLoadNamedField>(
3242       context, nullptr,
3243       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3244   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3245       GlobalObject::kNativeContextOffset);
3246   return Add<HLoadNamedField>(global_object, nullptr, access);
3247 }
3248
3249
3250 HInstruction* HGraphBuilder::BuildGetScriptContext(int context_index) {
3251   HValue* native_context = BuildGetNativeContext();
3252   HValue* script_context_table = Add<HLoadNamedField>(
3253       native_context, nullptr,
3254       HObjectAccess::ForContextSlot(Context::SCRIPT_CONTEXT_TABLE_INDEX));
3255   return Add<HLoadNamedField>(script_context_table, nullptr,
3256                               HObjectAccess::ForScriptContext(context_index));
3257 }
3258
3259
3260 HValue* HGraphBuilder::BuildGetParentContext(HValue* depth, int depth_value) {
3261   HValue* script_context = context();
3262   if (depth != NULL) {
3263     HValue* zero = graph()->GetConstant0();
3264
3265     Push(script_context);
3266     Push(depth);
3267
3268     LoopBuilder loop(this);
3269     loop.BeginBody(2);  // Drop script_context and depth from last environment
3270                         // to appease live range building without simulates.
3271     depth = Pop();
3272     script_context = Pop();
3273
3274     script_context = Add<HLoadNamedField>(
3275         script_context, nullptr,
3276         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3277     depth = AddUncasted<HSub>(depth, graph()->GetConstant1());
3278     depth->ClearFlag(HValue::kCanOverflow);
3279
3280     IfBuilder if_break(this);
3281     if_break.If<HCompareNumericAndBranch, HValue*>(depth, zero, Token::EQ);
3282     if_break.Then();
3283     {
3284       Push(script_context);  // The result.
3285       loop.Break();
3286     }
3287     if_break.Else();
3288     {
3289       Push(script_context);
3290       Push(depth);
3291     }
3292     loop.EndBody();
3293     if_break.End();
3294
3295     script_context = Pop();
3296   } else if (depth_value > 0) {
3297     // Unroll the above loop.
3298     for (int i = 0; i < depth_value; i++) {
3299       script_context = Add<HLoadNamedField>(
3300           script_context, nullptr,
3301           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3302     }
3303   }
3304   return script_context;
3305 }
3306
3307
3308 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
3309   HInstruction* native_context = BuildGetNativeContext();
3310   HInstruction* index =
3311       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
3312   return Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3313 }
3314
3315
3316 HValue* HGraphBuilder::BuildArrayBufferViewFieldAccessor(HValue* object,
3317                                                          HValue* checked_object,
3318                                                          FieldIndex index) {
3319   NoObservableSideEffectsScope scope(this);
3320   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3321       index.offset(), Representation::Tagged());
3322   HInstruction* buffer = Add<HLoadNamedField>(
3323       object, checked_object, HObjectAccess::ForJSArrayBufferViewBuffer());
3324   HInstruction* field = Add<HLoadNamedField>(object, checked_object, access);
3325
3326   HInstruction* flags = Add<HLoadNamedField>(
3327       buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
3328   HValue* was_neutered_mask =
3329       Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
3330   HValue* was_neutered_test =
3331       AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
3332
3333   IfBuilder if_was_neutered(this);
3334   if_was_neutered.If<HCompareNumericAndBranch>(
3335       was_neutered_test, graph()->GetConstant0(), Token::NE);
3336   if_was_neutered.Then();
3337   Push(graph()->GetConstant0());
3338   if_was_neutered.Else();
3339   Push(field);
3340   if_was_neutered.End();
3341
3342   return Pop();
3343 }
3344
3345
3346 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3347     ElementsKind kind,
3348     HValue* allocation_site_payload,
3349     HValue* constructor_function,
3350     AllocationSiteOverrideMode override_mode) :
3351         builder_(builder),
3352         kind_(kind),
3353         allocation_site_payload_(allocation_site_payload),
3354         constructor_function_(constructor_function) {
3355   DCHECK(!allocation_site_payload->IsConstant() ||
3356          HConstant::cast(allocation_site_payload)->handle(
3357              builder_->isolate())->IsAllocationSite());
3358   mode_ = override_mode == DISABLE_ALLOCATION_SITES
3359       ? DONT_TRACK_ALLOCATION_SITE
3360       : AllocationSite::GetMode(kind);
3361 }
3362
3363
3364 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3365                                               ElementsKind kind,
3366                                               HValue* constructor_function) :
3367     builder_(builder),
3368     kind_(kind),
3369     mode_(DONT_TRACK_ALLOCATION_SITE),
3370     allocation_site_payload_(NULL),
3371     constructor_function_(constructor_function) {
3372 }
3373
3374
3375 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode() {
3376   if (!builder()->top_info()->IsStub()) {
3377     // A constant map is fine.
3378     Handle<Map> map(builder()->isolate()->get_initial_js_array_map(kind_),
3379                     builder()->isolate());
3380     return builder()->Add<HConstant>(map);
3381   }
3382
3383   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
3384     // No need for a context lookup if the kind_ matches the initial
3385     // map, because we can just load the map in that case.
3386     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3387     return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3388                                            access);
3389   }
3390
3391   // TODO(mvstanton): we should always have a constructor function if we
3392   // are creating a stub.
3393   HInstruction* native_context = constructor_function_ != NULL
3394       ? builder()->BuildGetNativeContext(constructor_function_)
3395       : builder()->BuildGetNativeContext();
3396
3397   HInstruction* index = builder()->Add<HConstant>(
3398       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
3399
3400   HInstruction* map_array =
3401       builder()->Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3402
3403   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
3404
3405   return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr,
3406                                     FAST_ELEMENTS);
3407 }
3408
3409
3410 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
3411   // Find the map near the constructor function
3412   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3413   return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3414                                          access);
3415 }
3416
3417
3418 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
3419   HConstant* capacity = builder()->Add<HConstant>(initial_capacity());
3420   return AllocateArray(capacity,
3421                        capacity,
3422                        builder()->graph()->GetConstant0());
3423 }
3424
3425
3426 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3427     HValue* capacity,
3428     HConstant* capacity_upper_bound,
3429     HValue* length_field,
3430     FillMode fill_mode) {
3431   return AllocateArray(capacity,
3432                        capacity_upper_bound->GetInteger32Constant(),
3433                        length_field,
3434                        fill_mode);
3435 }
3436
3437
3438 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3439     HValue* capacity,
3440     int capacity_upper_bound,
3441     HValue* length_field,
3442     FillMode fill_mode) {
3443   HConstant* elememts_size_upper_bound = capacity->IsInteger32Constant()
3444       ? HConstant::cast(capacity)
3445       : builder()->EstablishElementsAllocationSize(kind_, capacity_upper_bound);
3446
3447   HAllocate* array = AllocateArray(capacity, length_field, fill_mode);
3448   if (!elements_location_->has_size_upper_bound()) {
3449     elements_location_->set_size_upper_bound(elememts_size_upper_bound);
3450   }
3451   return array;
3452 }
3453
3454
3455 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3456     HValue* capacity,
3457     HValue* length_field,
3458     FillMode fill_mode) {
3459   // These HForceRepresentations are because we store these as fields in the
3460   // objects we construct, and an int32-to-smi HChange could deopt. Accept
3461   // the deopt possibility now, before allocation occurs.
3462   capacity =
3463       builder()->AddUncasted<HForceRepresentation>(capacity,
3464                                                    Representation::Smi());
3465   length_field =
3466       builder()->AddUncasted<HForceRepresentation>(length_field,
3467                                                    Representation::Smi());
3468
3469   // Generate size calculation code here in order to make it dominate
3470   // the JSArray allocation.
3471   HValue* elements_size =
3472       builder()->BuildCalculateElementsSize(kind_, capacity);
3473
3474   // Allocate (dealing with failure appropriately)
3475   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
3476
3477   // Fill in the fields: map, properties, length
3478   HValue* map;
3479   if (allocation_site_payload_ == NULL) {
3480     map = EmitInternalMapCode();
3481   } else {
3482     map = EmitMapCode();
3483   }
3484
3485   builder()->BuildJSArrayHeader(array_object,
3486                                 map,
3487                                 NULL,  // set elements to empty fixed array
3488                                 mode_,
3489                                 kind_,
3490                                 allocation_site_payload_,
3491                                 length_field);
3492
3493   // Allocate and initialize the elements
3494   elements_location_ = builder()->BuildAllocateElements(kind_, elements_size);
3495
3496   builder()->BuildInitializeElementsHeader(elements_location_, kind_, capacity);
3497
3498   // Set the elements
3499   builder()->Add<HStoreNamedField>(
3500       array_object, HObjectAccess::ForElementsPointer(), elements_location_);
3501
3502   if (fill_mode == FILL_WITH_HOLE) {
3503     builder()->BuildFillElementsWithHole(elements_location_, kind_,
3504                                          graph()->GetConstant0(), capacity);
3505   }
3506
3507   return array_object;
3508 }
3509
3510
3511 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
3512   HValue* global_object = Add<HLoadNamedField>(
3513       context(), nullptr,
3514       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3515   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3516       GlobalObject::kBuiltinsOffset);
3517   HValue* builtins = Add<HLoadNamedField>(global_object, nullptr, access);
3518   HObjectAccess function_access = HObjectAccess::ForObservableJSObjectOffset(
3519           JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
3520   return Add<HLoadNamedField>(builtins, nullptr, function_access);
3521 }
3522
3523
3524 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
3525     : HGraphBuilder(info),
3526       function_state_(NULL),
3527       initial_function_state_(this, info, NORMAL_RETURN, 0),
3528       ast_context_(NULL),
3529       break_scope_(NULL),
3530       inlined_count_(0),
3531       globals_(10, info->zone()),
3532       osr_(new(info->zone()) HOsrBuilder(this)) {
3533   // This is not initialized in the initializer list because the
3534   // constructor for the initial state relies on function_state_ == NULL
3535   // to know it's the initial state.
3536   function_state_ = &initial_function_state_;
3537   InitializeAstVisitor(info->isolate(), info->zone());
3538   if (top_info()->is_tracking_positions()) {
3539     SetSourcePosition(info->shared_info()->start_position());
3540   }
3541 }
3542
3543
3544 HBasicBlock* HOptimizedGraphBuilder::CreateJoin(HBasicBlock* first,
3545                                                 HBasicBlock* second,
3546                                                 BailoutId join_id) {
3547   if (first == NULL) {
3548     return second;
3549   } else if (second == NULL) {
3550     return first;
3551   } else {
3552     HBasicBlock* join_block = graph()->CreateBasicBlock();
3553     Goto(first, join_block);
3554     Goto(second, join_block);
3555     join_block->SetJoinId(join_id);
3556     return join_block;
3557   }
3558 }
3559
3560
3561 HBasicBlock* HOptimizedGraphBuilder::JoinContinue(IterationStatement* statement,
3562                                                   HBasicBlock* exit_block,
3563                                                   HBasicBlock* continue_block) {
3564   if (continue_block != NULL) {
3565     if (exit_block != NULL) Goto(exit_block, continue_block);
3566     continue_block->SetJoinId(statement->ContinueId());
3567     return continue_block;
3568   }
3569   return exit_block;
3570 }
3571
3572
3573 HBasicBlock* HOptimizedGraphBuilder::CreateLoop(IterationStatement* statement,
3574                                                 HBasicBlock* loop_entry,
3575                                                 HBasicBlock* body_exit,
3576                                                 HBasicBlock* loop_successor,
3577                                                 HBasicBlock* break_block) {
3578   if (body_exit != NULL) Goto(body_exit, loop_entry);
3579   loop_entry->PostProcessLoopHeader(statement);
3580   if (break_block != NULL) {
3581     if (loop_successor != NULL) Goto(loop_successor, break_block);
3582     break_block->SetJoinId(statement->ExitId());
3583     return break_block;
3584   }
3585   return loop_successor;
3586 }
3587
3588
3589 // Build a new loop header block and set it as the current block.
3590 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry() {
3591   HBasicBlock* loop_entry = CreateLoopHeaderBlock();
3592   Goto(loop_entry);
3593   set_current_block(loop_entry);
3594   return loop_entry;
3595 }
3596
3597
3598 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry(
3599     IterationStatement* statement) {
3600   HBasicBlock* loop_entry = osr()->HasOsrEntryAt(statement)
3601       ? osr()->BuildOsrLoopEntry(statement)
3602       : BuildLoopEntry();
3603   return loop_entry;
3604 }
3605
3606
3607 void HBasicBlock::FinishExit(HControlInstruction* instruction,
3608                              SourcePosition position) {
3609   Finish(instruction, position);
3610   ClearEnvironment();
3611 }
3612
3613
3614 std::ostream& operator<<(std::ostream& os, const HBasicBlock& b) {
3615   return os << "B" << b.block_id();
3616 }
3617
3618
3619 HGraph::HGraph(CompilationInfo* info)
3620     : isolate_(info->isolate()),
3621       next_block_id_(0),
3622       entry_block_(NULL),
3623       blocks_(8, info->zone()),
3624       values_(16, info->zone()),
3625       phi_list_(NULL),
3626       uint32_instructions_(NULL),
3627       osr_(NULL),
3628       info_(info),
3629       zone_(info->zone()),
3630       is_recursive_(false),
3631       use_optimistic_licm_(false),
3632       depends_on_empty_array_proto_elements_(false),
3633       type_change_checksum_(0),
3634       maximum_environment_size_(0),
3635       no_side_effects_scope_count_(0),
3636       disallow_adding_new_values_(false) {
3637   if (info->IsStub()) {
3638     CallInterfaceDescriptor descriptor =
3639         info->code_stub()->GetCallInterfaceDescriptor();
3640     start_environment_ =
3641         new (zone_) HEnvironment(zone_, descriptor.GetRegisterParameterCount());
3642   } else {
3643     if (info->is_tracking_positions()) {
3644       info->TraceInlinedFunction(info->shared_info(), SourcePosition::Unknown(),
3645                                  InlinedFunctionInfo::kNoParentId);
3646     }
3647     start_environment_ =
3648         new(zone_) HEnvironment(NULL, info->scope(), info->closure(), zone_);
3649   }
3650   start_environment_->set_ast_id(BailoutId::FunctionEntry());
3651   entry_block_ = CreateBasicBlock();
3652   entry_block_->SetInitialEnvironment(start_environment_);
3653 }
3654
3655
3656 HBasicBlock* HGraph::CreateBasicBlock() {
3657   HBasicBlock* result = new(zone()) HBasicBlock(this);
3658   blocks_.Add(result, zone());
3659   return result;
3660 }
3661
3662
3663 void HGraph::FinalizeUniqueness() {
3664   DisallowHeapAllocation no_gc;
3665   for (int i = 0; i < blocks()->length(); ++i) {
3666     for (HInstructionIterator it(blocks()->at(i)); !it.Done(); it.Advance()) {
3667       it.Current()->FinalizeUniqueness();
3668     }
3669   }
3670 }
3671
3672
3673 int HGraph::SourcePositionToScriptPosition(SourcePosition pos) {
3674   return (FLAG_hydrogen_track_positions && !pos.IsUnknown())
3675              ? info()->start_position_for(pos.inlining_id()) + pos.position()
3676              : pos.raw();
3677 }
3678
3679
3680 // Block ordering was implemented with two mutually recursive methods,
3681 // HGraph::Postorder and HGraph::PostorderLoopBlocks.
3682 // The recursion could lead to stack overflow so the algorithm has been
3683 // implemented iteratively.
3684 // At a high level the algorithm looks like this:
3685 //
3686 // Postorder(block, loop_header) : {
3687 //   if (block has already been visited or is of another loop) return;
3688 //   mark block as visited;
3689 //   if (block is a loop header) {
3690 //     VisitLoopMembers(block, loop_header);
3691 //     VisitSuccessorsOfLoopHeader(block);
3692 //   } else {
3693 //     VisitSuccessors(block)
3694 //   }
3695 //   put block in result list;
3696 // }
3697 //
3698 // VisitLoopMembers(block, outer_loop_header) {
3699 //   foreach (block b in block loop members) {
3700 //     VisitSuccessorsOfLoopMember(b, outer_loop_header);
3701 //     if (b is loop header) VisitLoopMembers(b);
3702 //   }
3703 // }
3704 //
3705 // VisitSuccessorsOfLoopMember(block, outer_loop_header) {
3706 //   foreach (block b in block successors) Postorder(b, outer_loop_header)
3707 // }
3708 //
3709 // VisitSuccessorsOfLoopHeader(block) {
3710 //   foreach (block b in block successors) Postorder(b, block)
3711 // }
3712 //
3713 // VisitSuccessors(block, loop_header) {
3714 //   foreach (block b in block successors) Postorder(b, loop_header)
3715 // }
3716 //
3717 // The ordering is started calling Postorder(entry, NULL).
3718 //
3719 // Each instance of PostorderProcessor represents the "stack frame" of the
3720 // recursion, and particularly keeps the state of the loop (iteration) of the
3721 // "Visit..." function it represents.
3722 // To recycle memory we keep all the frames in a double linked list but
3723 // this means that we cannot use constructors to initialize the frames.
3724 //
3725 class PostorderProcessor : public ZoneObject {
3726  public:
3727   // Back link (towards the stack bottom).
3728   PostorderProcessor* parent() {return father_; }
3729   // Forward link (towards the stack top).
3730   PostorderProcessor* child() {return child_; }
3731   HBasicBlock* block() { return block_; }
3732   HLoopInformation* loop() { return loop_; }
3733   HBasicBlock* loop_header() { return loop_header_; }
3734
3735   static PostorderProcessor* CreateEntryProcessor(Zone* zone,
3736                                                   HBasicBlock* block) {
3737     PostorderProcessor* result = new(zone) PostorderProcessor(NULL);
3738     return result->SetupSuccessors(zone, block, NULL);
3739   }
3740
3741   PostorderProcessor* PerformStep(Zone* zone,
3742                                   ZoneList<HBasicBlock*>* order) {
3743     PostorderProcessor* next =
3744         PerformNonBacktrackingStep(zone, order);
3745     if (next != NULL) {
3746       return next;
3747     } else {
3748       return Backtrack(zone, order);
3749     }
3750   }
3751
3752  private:
3753   explicit PostorderProcessor(PostorderProcessor* father)
3754       : father_(father), child_(NULL), successor_iterator(NULL) { }
3755
3756   // Each enum value states the cycle whose state is kept by this instance.
3757   enum LoopKind {
3758     NONE,
3759     SUCCESSORS,
3760     SUCCESSORS_OF_LOOP_HEADER,
3761     LOOP_MEMBERS,
3762     SUCCESSORS_OF_LOOP_MEMBER
3763   };
3764
3765   // Each "Setup..." method is like a constructor for a cycle state.
3766   PostorderProcessor* SetupSuccessors(Zone* zone,
3767                                       HBasicBlock* block,
3768                                       HBasicBlock* loop_header) {
3769     if (block == NULL || block->IsOrdered() ||
3770         block->parent_loop_header() != loop_header) {
3771       kind_ = NONE;
3772       block_ = NULL;
3773       loop_ = NULL;
3774       loop_header_ = NULL;
3775       return this;
3776     } else {
3777       block_ = block;
3778       loop_ = NULL;
3779       block->MarkAsOrdered();
3780
3781       if (block->IsLoopHeader()) {
3782         kind_ = SUCCESSORS_OF_LOOP_HEADER;
3783         loop_header_ = block;
3784         InitializeSuccessors();
3785         PostorderProcessor* result = Push(zone);
3786         return result->SetupLoopMembers(zone, block, block->loop_information(),
3787                                         loop_header);
3788       } else {
3789         DCHECK(block->IsFinished());
3790         kind_ = SUCCESSORS;
3791         loop_header_ = loop_header;
3792         InitializeSuccessors();
3793         return this;
3794       }
3795     }
3796   }
3797
3798   PostorderProcessor* SetupLoopMembers(Zone* zone,
3799                                        HBasicBlock* block,
3800                                        HLoopInformation* loop,
3801                                        HBasicBlock* loop_header) {
3802     kind_ = LOOP_MEMBERS;
3803     block_ = block;
3804     loop_ = loop;
3805     loop_header_ = loop_header;
3806     InitializeLoopMembers();
3807     return this;
3808   }
3809
3810   PostorderProcessor* SetupSuccessorsOfLoopMember(
3811       HBasicBlock* block,
3812       HLoopInformation* loop,
3813       HBasicBlock* loop_header) {
3814     kind_ = SUCCESSORS_OF_LOOP_MEMBER;
3815     block_ = block;
3816     loop_ = loop;
3817     loop_header_ = loop_header;
3818     InitializeSuccessors();
3819     return this;
3820   }
3821
3822   // This method "allocates" a new stack frame.
3823   PostorderProcessor* Push(Zone* zone) {
3824     if (child_ == NULL) {
3825       child_ = new(zone) PostorderProcessor(this);
3826     }
3827     return child_;
3828   }
3829
3830   void ClosePostorder(ZoneList<HBasicBlock*>* order, Zone* zone) {
3831     DCHECK(block_->end()->FirstSuccessor() == NULL ||
3832            order->Contains(block_->end()->FirstSuccessor()) ||
3833            block_->end()->FirstSuccessor()->IsLoopHeader());
3834     DCHECK(block_->end()->SecondSuccessor() == NULL ||
3835            order->Contains(block_->end()->SecondSuccessor()) ||
3836            block_->end()->SecondSuccessor()->IsLoopHeader());
3837     order->Add(block_, zone);
3838   }
3839
3840   // This method is the basic block to walk up the stack.
3841   PostorderProcessor* Pop(Zone* zone,
3842                           ZoneList<HBasicBlock*>* order) {
3843     switch (kind_) {
3844       case SUCCESSORS:
3845       case SUCCESSORS_OF_LOOP_HEADER:
3846         ClosePostorder(order, zone);
3847         return father_;
3848       case LOOP_MEMBERS:
3849         return father_;
3850       case SUCCESSORS_OF_LOOP_MEMBER:
3851         if (block()->IsLoopHeader() && block() != loop_->loop_header()) {
3852           // In this case we need to perform a LOOP_MEMBERS cycle so we
3853           // initialize it and return this instead of father.
3854           return SetupLoopMembers(zone, block(),
3855                                   block()->loop_information(), loop_header_);
3856         } else {
3857           return father_;
3858         }
3859       case NONE:
3860         return father_;
3861     }
3862     UNREACHABLE();
3863     return NULL;
3864   }
3865
3866   // Walks up the stack.
3867   PostorderProcessor* Backtrack(Zone* zone,
3868                                 ZoneList<HBasicBlock*>* order) {
3869     PostorderProcessor* parent = Pop(zone, order);
3870     while (parent != NULL) {
3871       PostorderProcessor* next =
3872           parent->PerformNonBacktrackingStep(zone, order);
3873       if (next != NULL) {
3874         return next;
3875       } else {
3876         parent = parent->Pop(zone, order);
3877       }
3878     }
3879     return NULL;
3880   }
3881
3882   PostorderProcessor* PerformNonBacktrackingStep(
3883       Zone* zone,
3884       ZoneList<HBasicBlock*>* order) {
3885     HBasicBlock* next_block;
3886     switch (kind_) {
3887       case SUCCESSORS:
3888         next_block = AdvanceSuccessors();
3889         if (next_block != NULL) {
3890           PostorderProcessor* result = Push(zone);
3891           return result->SetupSuccessors(zone, next_block, loop_header_);
3892         }
3893         break;
3894       case SUCCESSORS_OF_LOOP_HEADER:
3895         next_block = AdvanceSuccessors();
3896         if (next_block != NULL) {
3897           PostorderProcessor* result = Push(zone);
3898           return result->SetupSuccessors(zone, next_block, block());
3899         }
3900         break;
3901       case LOOP_MEMBERS:
3902         next_block = AdvanceLoopMembers();
3903         if (next_block != NULL) {
3904           PostorderProcessor* result = Push(zone);
3905           return result->SetupSuccessorsOfLoopMember(next_block,
3906                                                      loop_, loop_header_);
3907         }
3908         break;
3909       case SUCCESSORS_OF_LOOP_MEMBER:
3910         next_block = AdvanceSuccessors();
3911         if (next_block != NULL) {
3912           PostorderProcessor* result = Push(zone);
3913           return result->SetupSuccessors(zone, next_block, loop_header_);
3914         }
3915         break;
3916       case NONE:
3917         return NULL;
3918     }
3919     return NULL;
3920   }
3921
3922   // The following two methods implement a "foreach b in successors" cycle.
3923   void InitializeSuccessors() {
3924     loop_index = 0;
3925     loop_length = 0;
3926     successor_iterator = HSuccessorIterator(block_->end());
3927   }
3928
3929   HBasicBlock* AdvanceSuccessors() {
3930     if (!successor_iterator.Done()) {
3931       HBasicBlock* result = successor_iterator.Current();
3932       successor_iterator.Advance();
3933       return result;
3934     }
3935     return NULL;
3936   }
3937
3938   // The following two methods implement a "foreach b in loop members" cycle.
3939   void InitializeLoopMembers() {
3940     loop_index = 0;
3941     loop_length = loop_->blocks()->length();
3942   }
3943
3944   HBasicBlock* AdvanceLoopMembers() {
3945     if (loop_index < loop_length) {
3946       HBasicBlock* result = loop_->blocks()->at(loop_index);
3947       loop_index++;
3948       return result;
3949     } else {
3950       return NULL;
3951     }
3952   }
3953
3954   LoopKind kind_;
3955   PostorderProcessor* father_;
3956   PostorderProcessor* child_;
3957   HLoopInformation* loop_;
3958   HBasicBlock* block_;
3959   HBasicBlock* loop_header_;
3960   int loop_index;
3961   int loop_length;
3962   HSuccessorIterator successor_iterator;
3963 };
3964
3965
3966 void HGraph::OrderBlocks() {
3967   CompilationPhase phase("H_Block ordering", info());
3968
3969 #ifdef DEBUG
3970   // Initially the blocks must not be ordered.
3971   for (int i = 0; i < blocks_.length(); ++i) {
3972     DCHECK(!blocks_[i]->IsOrdered());
3973   }
3974 #endif
3975
3976   PostorderProcessor* postorder =
3977       PostorderProcessor::CreateEntryProcessor(zone(), blocks_[0]);
3978   blocks_.Rewind(0);
3979   while (postorder) {
3980     postorder = postorder->PerformStep(zone(), &blocks_);
3981   }
3982
3983 #ifdef DEBUG
3984   // Now all blocks must be marked as ordered.
3985   for (int i = 0; i < blocks_.length(); ++i) {
3986     DCHECK(blocks_[i]->IsOrdered());
3987   }
3988 #endif
3989
3990   // Reverse block list and assign block IDs.
3991   for (int i = 0, j = blocks_.length(); --j >= i; ++i) {
3992     HBasicBlock* bi = blocks_[i];
3993     HBasicBlock* bj = blocks_[j];
3994     bi->set_block_id(j);
3995     bj->set_block_id(i);
3996     blocks_[i] = bj;
3997     blocks_[j] = bi;
3998   }
3999 }
4000
4001
4002 void HGraph::AssignDominators() {
4003   HPhase phase("H_Assign dominators", this);
4004   for (int i = 0; i < blocks_.length(); ++i) {
4005     HBasicBlock* block = blocks_[i];
4006     if (block->IsLoopHeader()) {
4007       // Only the first predecessor of a loop header is from outside the loop.
4008       // All others are back edges, and thus cannot dominate the loop header.
4009       block->AssignCommonDominator(block->predecessors()->first());
4010       block->AssignLoopSuccessorDominators();
4011     } else {
4012       for (int j = blocks_[i]->predecessors()->length() - 1; j >= 0; --j) {
4013         blocks_[i]->AssignCommonDominator(blocks_[i]->predecessors()->at(j));
4014       }
4015     }
4016   }
4017 }
4018
4019
4020 bool HGraph::CheckArgumentsPhiUses() {
4021   int block_count = blocks_.length();
4022   for (int i = 0; i < block_count; ++i) {
4023     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4024       HPhi* phi = blocks_[i]->phis()->at(j);
4025       // We don't support phi uses of arguments for now.
4026       if (phi->CheckFlag(HValue::kIsArguments)) return false;
4027     }
4028   }
4029   return true;
4030 }
4031
4032
4033 bool HGraph::CheckConstPhiUses() {
4034   int block_count = blocks_.length();
4035   for (int i = 0; i < block_count; ++i) {
4036     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4037       HPhi* phi = blocks_[i]->phis()->at(j);
4038       // Check for the hole value (from an uninitialized const).
4039       for (int k = 0; k < phi->OperandCount(); k++) {
4040         if (phi->OperandAt(k) == GetConstantHole()) return false;
4041       }
4042     }
4043   }
4044   return true;
4045 }
4046
4047
4048 void HGraph::CollectPhis() {
4049   int block_count = blocks_.length();
4050   phi_list_ = new(zone()) ZoneList<HPhi*>(block_count, zone());
4051   for (int i = 0; i < block_count; ++i) {
4052     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4053       HPhi* phi = blocks_[i]->phis()->at(j);
4054       phi_list_->Add(phi, zone());
4055     }
4056   }
4057 }
4058
4059
4060 // Implementation of utility class to encapsulate the translation state for
4061 // a (possibly inlined) function.
4062 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
4063                              CompilationInfo* info, InliningKind inlining_kind,
4064                              int inlining_id)
4065     : owner_(owner),
4066       compilation_info_(info),
4067       call_context_(NULL),
4068       inlining_kind_(inlining_kind),
4069       function_return_(NULL),
4070       test_context_(NULL),
4071       entry_(NULL),
4072       arguments_object_(NULL),
4073       arguments_elements_(NULL),
4074       inlining_id_(inlining_id),
4075       outer_source_position_(SourcePosition::Unknown()),
4076       outer_(owner->function_state()) {
4077   if (outer_ != NULL) {
4078     // State for an inline function.
4079     if (owner->ast_context()->IsTest()) {
4080       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
4081       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
4082       if_true->MarkAsInlineReturnTarget(owner->current_block());
4083       if_false->MarkAsInlineReturnTarget(owner->current_block());
4084       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
4085       Expression* cond = outer_test_context->condition();
4086       // The AstContext constructor pushed on the context stack.  This newed
4087       // instance is the reason that AstContext can't be BASE_EMBEDDED.
4088       test_context_ = new TestContext(owner, cond, if_true, if_false);
4089     } else {
4090       function_return_ = owner->graph()->CreateBasicBlock();
4091       function_return()->MarkAsInlineReturnTarget(owner->current_block());
4092     }
4093     // Set this after possibly allocating a new TestContext above.
4094     call_context_ = owner->ast_context();
4095   }
4096
4097   // Push on the state stack.
4098   owner->set_function_state(this);
4099
4100   if (compilation_info_->is_tracking_positions()) {
4101     outer_source_position_ = owner->source_position();
4102     owner->EnterInlinedSource(
4103       info->shared_info()->start_position(),
4104       inlining_id);
4105     owner->SetSourcePosition(info->shared_info()->start_position());
4106   }
4107 }
4108
4109
4110 FunctionState::~FunctionState() {
4111   delete test_context_;
4112   owner_->set_function_state(outer_);
4113
4114   if (compilation_info_->is_tracking_positions()) {
4115     owner_->set_source_position(outer_source_position_);
4116     owner_->EnterInlinedSource(
4117       outer_->compilation_info()->shared_info()->start_position(),
4118       outer_->inlining_id());
4119   }
4120 }
4121
4122
4123 // Implementation of utility classes to represent an expression's context in
4124 // the AST.
4125 AstContext::AstContext(HOptimizedGraphBuilder* owner, Expression::Context kind)
4126     : owner_(owner),
4127       kind_(kind),
4128       outer_(owner->ast_context()),
4129       typeof_mode_(NOT_INSIDE_TYPEOF) {
4130   owner->set_ast_context(this);  // Push.
4131 #ifdef DEBUG
4132   DCHECK(owner->environment()->frame_type() == JS_FUNCTION);
4133   original_length_ = owner->environment()->length();
4134 #endif
4135 }
4136
4137
4138 AstContext::~AstContext() {
4139   owner_->set_ast_context(outer_);  // Pop.
4140 }
4141
4142
4143 EffectContext::~EffectContext() {
4144   DCHECK(owner()->HasStackOverflow() ||
4145          owner()->current_block() == NULL ||
4146          (owner()->environment()->length() == original_length_ &&
4147           owner()->environment()->frame_type() == JS_FUNCTION));
4148 }
4149
4150
4151 ValueContext::~ValueContext() {
4152   DCHECK(owner()->HasStackOverflow() ||
4153          owner()->current_block() == NULL ||
4154          (owner()->environment()->length() == original_length_ + 1 &&
4155           owner()->environment()->frame_type() == JS_FUNCTION));
4156 }
4157
4158
4159 void EffectContext::ReturnValue(HValue* value) {
4160   // The value is simply ignored.
4161 }
4162
4163
4164 void ValueContext::ReturnValue(HValue* value) {
4165   // The value is tracked in the bailout environment, and communicated
4166   // through the environment as the result of the expression.
4167   if (value->CheckFlag(HValue::kIsArguments)) {
4168     if (flag_ == ARGUMENTS_FAKED) {
4169       value = owner()->graph()->GetConstantUndefined();
4170     } else if (!arguments_allowed()) {
4171       owner()->Bailout(kBadValueContextForArgumentsValue);
4172     }
4173   }
4174   owner()->Push(value);
4175 }
4176
4177
4178 void TestContext::ReturnValue(HValue* value) {
4179   BuildBranch(value);
4180 }
4181
4182
4183 void EffectContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4184   DCHECK(!instr->IsControlInstruction());
4185   owner()->AddInstruction(instr);
4186   if (instr->HasObservableSideEffects()) {
4187     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4188   }
4189 }
4190
4191
4192 void EffectContext::ReturnControl(HControlInstruction* instr,
4193                                   BailoutId ast_id) {
4194   DCHECK(!instr->HasObservableSideEffects());
4195   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4196   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4197   instr->SetSuccessorAt(0, empty_true);
4198   instr->SetSuccessorAt(1, empty_false);
4199   owner()->FinishCurrentBlock(instr);
4200   HBasicBlock* join = owner()->CreateJoin(empty_true, empty_false, ast_id);
4201   owner()->set_current_block(join);
4202 }
4203
4204
4205 void EffectContext::ReturnContinuation(HIfContinuation* continuation,
4206                                        BailoutId ast_id) {
4207   HBasicBlock* true_branch = NULL;
4208   HBasicBlock* false_branch = NULL;
4209   continuation->Continue(&true_branch, &false_branch);
4210   if (!continuation->IsTrueReachable()) {
4211     owner()->set_current_block(false_branch);
4212   } else if (!continuation->IsFalseReachable()) {
4213     owner()->set_current_block(true_branch);
4214   } else {
4215     HBasicBlock* join = owner()->CreateJoin(true_branch, false_branch, ast_id);
4216     owner()->set_current_block(join);
4217   }
4218 }
4219
4220
4221 void ValueContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4222   DCHECK(!instr->IsControlInstruction());
4223   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4224     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4225   }
4226   owner()->AddInstruction(instr);
4227   owner()->Push(instr);
4228   if (instr->HasObservableSideEffects()) {
4229     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4230   }
4231 }
4232
4233
4234 void ValueContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4235   DCHECK(!instr->HasObservableSideEffects());
4236   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4237     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4238   }
4239   HBasicBlock* materialize_false = owner()->graph()->CreateBasicBlock();
4240   HBasicBlock* materialize_true = owner()->graph()->CreateBasicBlock();
4241   instr->SetSuccessorAt(0, materialize_true);
4242   instr->SetSuccessorAt(1, materialize_false);
4243   owner()->FinishCurrentBlock(instr);
4244   owner()->set_current_block(materialize_true);
4245   owner()->Push(owner()->graph()->GetConstantTrue());
4246   owner()->set_current_block(materialize_false);
4247   owner()->Push(owner()->graph()->GetConstantFalse());
4248   HBasicBlock* join =
4249     owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4250   owner()->set_current_block(join);
4251 }
4252
4253
4254 void ValueContext::ReturnContinuation(HIfContinuation* continuation,
4255                                       BailoutId ast_id) {
4256   HBasicBlock* materialize_true = NULL;
4257   HBasicBlock* materialize_false = NULL;
4258   continuation->Continue(&materialize_true, &materialize_false);
4259   if (continuation->IsTrueReachable()) {
4260     owner()->set_current_block(materialize_true);
4261     owner()->Push(owner()->graph()->GetConstantTrue());
4262     owner()->set_current_block(materialize_true);
4263   }
4264   if (continuation->IsFalseReachable()) {
4265     owner()->set_current_block(materialize_false);
4266     owner()->Push(owner()->graph()->GetConstantFalse());
4267     owner()->set_current_block(materialize_false);
4268   }
4269   if (continuation->TrueAndFalseReachable()) {
4270     HBasicBlock* join =
4271         owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4272     owner()->set_current_block(join);
4273   }
4274 }
4275
4276
4277 void TestContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4278   DCHECK(!instr->IsControlInstruction());
4279   HOptimizedGraphBuilder* builder = owner();
4280   builder->AddInstruction(instr);
4281   // We expect a simulate after every expression with side effects, though
4282   // this one isn't actually needed (and wouldn't work if it were targeted).
4283   if (instr->HasObservableSideEffects()) {
4284     builder->Push(instr);
4285     builder->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4286     builder->Pop();
4287   }
4288   BuildBranch(instr);
4289 }
4290
4291
4292 void TestContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4293   DCHECK(!instr->HasObservableSideEffects());
4294   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4295   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4296   instr->SetSuccessorAt(0, empty_true);
4297   instr->SetSuccessorAt(1, empty_false);
4298   owner()->FinishCurrentBlock(instr);
4299   owner()->Goto(empty_true, if_true(), owner()->function_state());
4300   owner()->Goto(empty_false, if_false(), owner()->function_state());
4301   owner()->set_current_block(NULL);
4302 }
4303
4304
4305 void TestContext::ReturnContinuation(HIfContinuation* continuation,
4306                                      BailoutId ast_id) {
4307   HBasicBlock* true_branch = NULL;
4308   HBasicBlock* false_branch = NULL;
4309   continuation->Continue(&true_branch, &false_branch);
4310   if (continuation->IsTrueReachable()) {
4311     owner()->Goto(true_branch, if_true(), owner()->function_state());
4312   }
4313   if (continuation->IsFalseReachable()) {
4314     owner()->Goto(false_branch, if_false(), owner()->function_state());
4315   }
4316   owner()->set_current_block(NULL);
4317 }
4318
4319
4320 void TestContext::BuildBranch(HValue* value) {
4321   // We expect the graph to be in edge-split form: there is no edge that
4322   // connects a branch node to a join node.  We conservatively ensure that
4323   // property by always adding an empty block on the outgoing edges of this
4324   // branch.
4325   HOptimizedGraphBuilder* builder = owner();
4326   if (value != NULL && value->CheckFlag(HValue::kIsArguments)) {
4327     builder->Bailout(kArgumentsObjectValueInATestContext);
4328   }
4329   ToBooleanStub::Types expected(condition()->to_boolean_types());
4330   ReturnControl(owner()->New<HBranch>(value, expected), BailoutId::None());
4331 }
4332
4333
4334 // HOptimizedGraphBuilder infrastructure for bailing out and checking bailouts.
4335 #define CHECK_BAILOUT(call)                     \
4336   do {                                          \
4337     call;                                       \
4338     if (HasStackOverflow()) return;             \
4339   } while (false)
4340
4341
4342 #define CHECK_ALIVE(call)                                       \
4343   do {                                                          \
4344     call;                                                       \
4345     if (HasStackOverflow() || current_block() == NULL) return;  \
4346   } while (false)
4347
4348
4349 #define CHECK_ALIVE_OR_RETURN(call, value)                            \
4350   do {                                                                \
4351     call;                                                             \
4352     if (HasStackOverflow() || current_block() == NULL) return value;  \
4353   } while (false)
4354
4355
4356 void HOptimizedGraphBuilder::Bailout(BailoutReason reason) {
4357   current_info()->AbortOptimization(reason);
4358   SetStackOverflow();
4359 }
4360
4361
4362 void HOptimizedGraphBuilder::VisitForEffect(Expression* expr) {
4363   EffectContext for_effect(this);
4364   Visit(expr);
4365 }
4366
4367
4368 void HOptimizedGraphBuilder::VisitForValue(Expression* expr,
4369                                            ArgumentsAllowedFlag flag) {
4370   ValueContext for_value(this, flag);
4371   Visit(expr);
4372 }
4373
4374
4375 void HOptimizedGraphBuilder::VisitForTypeOf(Expression* expr) {
4376   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
4377   for_value.set_typeof_mode(INSIDE_TYPEOF);
4378   Visit(expr);
4379 }
4380
4381
4382 void HOptimizedGraphBuilder::VisitForControl(Expression* expr,
4383                                              HBasicBlock* true_block,
4384                                              HBasicBlock* false_block) {
4385   TestContext for_test(this, expr, true_block, false_block);
4386   Visit(expr);
4387 }
4388
4389
4390 void HOptimizedGraphBuilder::VisitExpressions(
4391     ZoneList<Expression*>* exprs) {
4392   for (int i = 0; i < exprs->length(); ++i) {
4393     CHECK_ALIVE(VisitForValue(exprs->at(i)));
4394   }
4395 }
4396
4397
4398 void HOptimizedGraphBuilder::VisitExpressions(ZoneList<Expression*>* exprs,
4399                                               ArgumentsAllowedFlag flag) {
4400   for (int i = 0; i < exprs->length(); ++i) {
4401     CHECK_ALIVE(VisitForValue(exprs->at(i), flag));
4402   }
4403 }
4404
4405
4406 bool HOptimizedGraphBuilder::BuildGraph() {
4407   if (IsSubclassConstructor(current_info()->literal()->kind())) {
4408     Bailout(kSuperReference);
4409     return false;
4410   }
4411
4412   int slots = current_info()->num_heap_slots() - Context::MIN_CONTEXT_SLOTS;
4413   if (current_info()->scope()->is_script_scope() && slots > 0) {
4414     Bailout(kScriptContext);
4415     return false;
4416   }
4417
4418   Scope* scope = current_info()->scope();
4419   SetUpScope(scope);
4420
4421   // Add an edge to the body entry.  This is warty: the graph's start
4422   // environment will be used by the Lithium translation as the initial
4423   // environment on graph entry, but it has now been mutated by the
4424   // Hydrogen translation of the instructions in the start block.  This
4425   // environment uses values which have not been defined yet.  These
4426   // Hydrogen instructions will then be replayed by the Lithium
4427   // translation, so they cannot have an environment effect.  The edge to
4428   // the body's entry block (along with some special logic for the start
4429   // block in HInstruction::InsertAfter) seals the start block from
4430   // getting unwanted instructions inserted.
4431   //
4432   // TODO(kmillikin): Fix this.  Stop mutating the initial environment.
4433   // Make the Hydrogen instructions in the initial block into Hydrogen
4434   // values (but not instructions), present in the initial environment and
4435   // not replayed by the Lithium translation.
4436   HEnvironment* initial_env = environment()->CopyWithoutHistory();
4437   HBasicBlock* body_entry = CreateBasicBlock(initial_env);
4438   Goto(body_entry);
4439   body_entry->SetJoinId(BailoutId::FunctionEntry());
4440   set_current_block(body_entry);
4441
4442   VisitDeclarations(scope->declarations());
4443   Add<HSimulate>(BailoutId::Declarations());
4444
4445   Add<HStackCheck>(HStackCheck::kFunctionEntry);
4446
4447   VisitStatements(current_info()->literal()->body());
4448   if (HasStackOverflow()) return false;
4449
4450   if (current_block() != NULL) {
4451     Add<HReturn>(graph()->GetConstantUndefined());
4452     set_current_block(NULL);
4453   }
4454
4455   // If the checksum of the number of type info changes is the same as the
4456   // last time this function was compiled, then this recompile is likely not
4457   // due to missing/inadequate type feedback, but rather too aggressive
4458   // optimization. Disable optimistic LICM in that case.
4459   Handle<Code> unoptimized_code(current_info()->shared_info()->code());
4460   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
4461   Handle<TypeFeedbackInfo> type_info(
4462       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
4463   int checksum = type_info->own_type_change_checksum();
4464   int composite_checksum = graph()->update_type_change_checksum(checksum);
4465   graph()->set_use_optimistic_licm(
4466       !type_info->matches_inlined_type_change_checksum(composite_checksum));
4467   type_info->set_inlined_type_change_checksum(composite_checksum);
4468
4469   // Perform any necessary OSR-specific cleanups or changes to the graph.
4470   osr()->FinishGraph();
4471
4472   return true;
4473 }
4474
4475
4476 bool HGraph::Optimize(BailoutReason* bailout_reason) {
4477   OrderBlocks();
4478   AssignDominators();
4479
4480   // We need to create a HConstant "zero" now so that GVN will fold every
4481   // zero-valued constant in the graph together.
4482   // The constant is needed to make idef-based bounds check work: the pass
4483   // evaluates relations with "zero" and that zero cannot be created after GVN.
4484   GetConstant0();
4485
4486 #ifdef DEBUG
4487   // Do a full verify after building the graph and computing dominators.
4488   Verify(true);
4489 #endif
4490
4491   if (FLAG_analyze_environment_liveness && maximum_environment_size() != 0) {
4492     Run<HEnvironmentLivenessAnalysisPhase>();
4493   }
4494
4495   if (!CheckConstPhiUses()) {
4496     *bailout_reason = kUnsupportedPhiUseOfConstVariable;
4497     return false;
4498   }
4499   Run<HRedundantPhiEliminationPhase>();
4500   if (!CheckArgumentsPhiUses()) {
4501     *bailout_reason = kUnsupportedPhiUseOfArguments;
4502     return false;
4503   }
4504
4505   // Find and mark unreachable code to simplify optimizations, especially gvn,
4506   // where unreachable code could unnecessarily defeat LICM.
4507   Run<HMarkUnreachableBlocksPhase>();
4508
4509   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4510   if (FLAG_use_escape_analysis) Run<HEscapeAnalysisPhase>();
4511
4512   if (FLAG_load_elimination) Run<HLoadEliminationPhase>();
4513
4514   CollectPhis();
4515
4516   if (has_osr()) osr()->FinishOsrValues();
4517
4518   Run<HInferRepresentationPhase>();
4519
4520   // Remove HSimulate instructions that have turned out not to be needed
4521   // after all by folding them into the following HSimulate.
4522   // This must happen after inferring representations.
4523   Run<HMergeRemovableSimulatesPhase>();
4524
4525   Run<HMarkDeoptimizeOnUndefinedPhase>();
4526   Run<HRepresentationChangesPhase>();
4527
4528   Run<HInferTypesPhase>();
4529
4530   // Must be performed before canonicalization to ensure that Canonicalize
4531   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
4532   // zero.
4533   Run<HUint32AnalysisPhase>();
4534
4535   if (FLAG_use_canonicalizing) Run<HCanonicalizePhase>();
4536
4537   if (FLAG_use_gvn) Run<HGlobalValueNumberingPhase>();
4538
4539   if (FLAG_check_elimination) Run<HCheckEliminationPhase>();
4540
4541   if (FLAG_store_elimination) Run<HStoreEliminationPhase>();
4542
4543   Run<HRangeAnalysisPhase>();
4544
4545   Run<HComputeChangeUndefinedToNaN>();
4546
4547   // Eliminate redundant stack checks on backwards branches.
4548   Run<HStackCheckEliminationPhase>();
4549
4550   if (FLAG_array_bounds_checks_elimination) Run<HBoundsCheckEliminationPhase>();
4551   if (FLAG_array_bounds_checks_hoisting) Run<HBoundsCheckHoistingPhase>();
4552   if (FLAG_array_index_dehoisting) Run<HDehoistIndexComputationsPhase>();
4553   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4554
4555   RestoreActualValues();
4556
4557   // Find unreachable code a second time, GVN and other optimizations may have
4558   // made blocks unreachable that were previously reachable.
4559   Run<HMarkUnreachableBlocksPhase>();
4560
4561   return true;
4562 }
4563
4564
4565 void HGraph::RestoreActualValues() {
4566   HPhase phase("H_Restore actual values", this);
4567
4568   for (int block_index = 0; block_index < blocks()->length(); block_index++) {
4569     HBasicBlock* block = blocks()->at(block_index);
4570
4571 #ifdef DEBUG
4572     for (int i = 0; i < block->phis()->length(); i++) {
4573       HPhi* phi = block->phis()->at(i);
4574       DCHECK(phi->ActualValue() == phi);
4575     }
4576 #endif
4577
4578     for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
4579       HInstruction* instruction = it.Current();
4580       if (instruction->ActualValue() == instruction) continue;
4581       if (instruction->CheckFlag(HValue::kIsDead)) {
4582         // The instruction was marked as deleted but left in the graph
4583         // as a control flow dependency point for subsequent
4584         // instructions.
4585         instruction->DeleteAndReplaceWith(instruction->ActualValue());
4586       } else {
4587         DCHECK(instruction->IsInformativeDefinition());
4588         if (instruction->IsPurelyInformativeDefinition()) {
4589           instruction->DeleteAndReplaceWith(instruction->RedefinedOperand());
4590         } else {
4591           instruction->ReplaceAllUsesWith(instruction->ActualValue());
4592         }
4593       }
4594     }
4595   }
4596 }
4597
4598
4599 void HOptimizedGraphBuilder::PushArgumentsFromEnvironment(int count) {
4600   ZoneList<HValue*> arguments(count, zone());
4601   for (int i = 0; i < count; ++i) {
4602     arguments.Add(Pop(), zone());
4603   }
4604
4605   HPushArguments* push_args = New<HPushArguments>();
4606   while (!arguments.is_empty()) {
4607     push_args->AddInput(arguments.RemoveLast());
4608   }
4609   AddInstruction(push_args);
4610 }
4611
4612
4613 template <class Instruction>
4614 HInstruction* HOptimizedGraphBuilder::PreProcessCall(Instruction* call) {
4615   PushArgumentsFromEnvironment(call->argument_count());
4616   return call;
4617 }
4618
4619
4620 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
4621   // First special is HContext.
4622   HInstruction* context = Add<HContext>();
4623   environment()->BindContext(context);
4624
4625   // Create an arguments object containing the initial parameters.  Set the
4626   // initial values of parameters including "this" having parameter index 0.
4627   DCHECK_EQ(scope->num_parameters() + 1, environment()->parameter_count());
4628   HArgumentsObject* arguments_object =
4629       New<HArgumentsObject>(environment()->parameter_count());
4630   for (int i = 0; i < environment()->parameter_count(); ++i) {
4631     HInstruction* parameter = Add<HParameter>(i);
4632     arguments_object->AddArgument(parameter, zone());
4633     environment()->Bind(i, parameter);
4634   }
4635   AddInstruction(arguments_object);
4636   graph()->SetArgumentsObject(arguments_object);
4637
4638   HConstant* undefined_constant = graph()->GetConstantUndefined();
4639   // Initialize specials and locals to undefined.
4640   for (int i = environment()->parameter_count() + 1;
4641        i < environment()->length();
4642        ++i) {
4643     environment()->Bind(i, undefined_constant);
4644   }
4645
4646   // Handle the arguments and arguments shadow variables specially (they do
4647   // not have declarations).
4648   if (scope->arguments() != NULL) {
4649     environment()->Bind(scope->arguments(),
4650                         graph()->GetArgumentsObject());
4651   }
4652
4653   int rest_index;
4654   Variable* rest = scope->rest_parameter(&rest_index);
4655   if (rest) {
4656     return Bailout(kRestParameter);
4657   }
4658
4659   if (scope->this_function_var() != nullptr ||
4660       scope->new_target_var() != nullptr) {
4661     return Bailout(kSuperReference);
4662   }
4663 }
4664
4665
4666 void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>* statements) {
4667   for (int i = 0; i < statements->length(); i++) {
4668     Statement* stmt = statements->at(i);
4669     CHECK_ALIVE(Visit(stmt));
4670     if (stmt->IsJump()) break;
4671   }
4672 }
4673
4674
4675 void HOptimizedGraphBuilder::VisitBlock(Block* stmt) {
4676   DCHECK(!HasStackOverflow());
4677   DCHECK(current_block() != NULL);
4678   DCHECK(current_block()->HasPredecessor());
4679
4680   Scope* outer_scope = scope();
4681   Scope* scope = stmt->scope();
4682   BreakAndContinueInfo break_info(stmt, outer_scope);
4683
4684   { BreakAndContinueScope push(&break_info, this);
4685     if (scope != NULL) {
4686       if (scope->NeedsContext()) {
4687         // Load the function object.
4688         Scope* declaration_scope = scope->DeclarationScope();
4689         HInstruction* function;
4690         HValue* outer_context = environment()->context();
4691         if (declaration_scope->is_script_scope() ||
4692             declaration_scope->is_eval_scope()) {
4693           function = new (zone())
4694               HLoadContextSlot(outer_context, Context::CLOSURE_INDEX,
4695                                HLoadContextSlot::kNoCheck);
4696         } else {
4697           function = New<HThisFunction>();
4698         }
4699         AddInstruction(function);
4700         // Allocate a block context and store it to the stack frame.
4701         HInstruction* inner_context = Add<HAllocateBlockContext>(
4702             outer_context, function, scope->GetScopeInfo(isolate()));
4703         HInstruction* instr = Add<HStoreFrameContext>(inner_context);
4704         set_scope(scope);
4705         environment()->BindContext(inner_context);
4706         if (instr->HasObservableSideEffects()) {
4707           AddSimulate(stmt->EntryId(), REMOVABLE_SIMULATE);
4708         }
4709       }
4710       VisitDeclarations(scope->declarations());
4711       AddSimulate(stmt->DeclsId(), REMOVABLE_SIMULATE);
4712     }
4713     CHECK_BAILOUT(VisitStatements(stmt->statements()));
4714   }
4715   set_scope(outer_scope);
4716   if (scope != NULL && current_block() != NULL &&
4717       scope->ContextLocalCount() > 0) {
4718     HValue* inner_context = environment()->context();
4719     HValue* outer_context = Add<HLoadNamedField>(
4720         inner_context, nullptr,
4721         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4722
4723     HInstruction* instr = Add<HStoreFrameContext>(outer_context);
4724     environment()->BindContext(outer_context);
4725     if (instr->HasObservableSideEffects()) {
4726       AddSimulate(stmt->ExitId(), REMOVABLE_SIMULATE);
4727     }
4728   }
4729   HBasicBlock* break_block = break_info.break_block();
4730   if (break_block != NULL) {
4731     if (current_block() != NULL) Goto(break_block);
4732     break_block->SetJoinId(stmt->ExitId());
4733     set_current_block(break_block);
4734   }
4735 }
4736
4737
4738 void HOptimizedGraphBuilder::VisitExpressionStatement(
4739     ExpressionStatement* stmt) {
4740   DCHECK(!HasStackOverflow());
4741   DCHECK(current_block() != NULL);
4742   DCHECK(current_block()->HasPredecessor());
4743   VisitForEffect(stmt->expression());
4744 }
4745
4746
4747 void HOptimizedGraphBuilder::VisitEmptyStatement(EmptyStatement* stmt) {
4748   DCHECK(!HasStackOverflow());
4749   DCHECK(current_block() != NULL);
4750   DCHECK(current_block()->HasPredecessor());
4751 }
4752
4753
4754 void HOptimizedGraphBuilder::VisitIfStatement(IfStatement* stmt) {
4755   DCHECK(!HasStackOverflow());
4756   DCHECK(current_block() != NULL);
4757   DCHECK(current_block()->HasPredecessor());
4758   if (stmt->condition()->ToBooleanIsTrue()) {
4759     Add<HSimulate>(stmt->ThenId());
4760     Visit(stmt->then_statement());
4761   } else if (stmt->condition()->ToBooleanIsFalse()) {
4762     Add<HSimulate>(stmt->ElseId());
4763     Visit(stmt->else_statement());
4764   } else {
4765     HBasicBlock* cond_true = graph()->CreateBasicBlock();
4766     HBasicBlock* cond_false = graph()->CreateBasicBlock();
4767     CHECK_BAILOUT(VisitForControl(stmt->condition(), cond_true, cond_false));
4768
4769     if (cond_true->HasPredecessor()) {
4770       cond_true->SetJoinId(stmt->ThenId());
4771       set_current_block(cond_true);
4772       CHECK_BAILOUT(Visit(stmt->then_statement()));
4773       cond_true = current_block();
4774     } else {
4775       cond_true = NULL;
4776     }
4777
4778     if (cond_false->HasPredecessor()) {
4779       cond_false->SetJoinId(stmt->ElseId());
4780       set_current_block(cond_false);
4781       CHECK_BAILOUT(Visit(stmt->else_statement()));
4782       cond_false = current_block();
4783     } else {
4784       cond_false = NULL;
4785     }
4786
4787     HBasicBlock* join = CreateJoin(cond_true, cond_false, stmt->IfId());
4788     set_current_block(join);
4789   }
4790 }
4791
4792
4793 HBasicBlock* HOptimizedGraphBuilder::BreakAndContinueScope::Get(
4794     BreakableStatement* stmt,
4795     BreakType type,
4796     Scope** scope,
4797     int* drop_extra) {
4798   *drop_extra = 0;
4799   BreakAndContinueScope* current = this;
4800   while (current != NULL && current->info()->target() != stmt) {
4801     *drop_extra += current->info()->drop_extra();
4802     current = current->next();
4803   }
4804   DCHECK(current != NULL);  // Always found (unless stack is malformed).
4805   *scope = current->info()->scope();
4806
4807   if (type == BREAK) {
4808     *drop_extra += current->info()->drop_extra();
4809   }
4810
4811   HBasicBlock* block = NULL;
4812   switch (type) {
4813     case BREAK:
4814       block = current->info()->break_block();
4815       if (block == NULL) {
4816         block = current->owner()->graph()->CreateBasicBlock();
4817         current->info()->set_break_block(block);
4818       }
4819       break;
4820
4821     case CONTINUE:
4822       block = current->info()->continue_block();
4823       if (block == NULL) {
4824         block = current->owner()->graph()->CreateBasicBlock();
4825         current->info()->set_continue_block(block);
4826       }
4827       break;
4828   }
4829
4830   return block;
4831 }
4832
4833
4834 void HOptimizedGraphBuilder::VisitContinueStatement(
4835     ContinueStatement* stmt) {
4836   DCHECK(!HasStackOverflow());
4837   DCHECK(current_block() != NULL);
4838   DCHECK(current_block()->HasPredecessor());
4839   Scope* outer_scope = NULL;
4840   Scope* inner_scope = scope();
4841   int drop_extra = 0;
4842   HBasicBlock* continue_block = break_scope()->Get(
4843       stmt->target(), BreakAndContinueScope::CONTINUE,
4844       &outer_scope, &drop_extra);
4845   HValue* context = environment()->context();
4846   Drop(drop_extra);
4847   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4848   if (context_pop_count > 0) {
4849     while (context_pop_count-- > 0) {
4850       HInstruction* context_instruction = Add<HLoadNamedField>(
4851           context, nullptr,
4852           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4853       context = context_instruction;
4854     }
4855     HInstruction* instr = Add<HStoreFrameContext>(context);
4856     if (instr->HasObservableSideEffects()) {
4857       AddSimulate(stmt->target()->EntryId(), REMOVABLE_SIMULATE);
4858     }
4859     environment()->BindContext(context);
4860   }
4861
4862   Goto(continue_block);
4863   set_current_block(NULL);
4864 }
4865
4866
4867 void HOptimizedGraphBuilder::VisitBreakStatement(BreakStatement* stmt) {
4868   DCHECK(!HasStackOverflow());
4869   DCHECK(current_block() != NULL);
4870   DCHECK(current_block()->HasPredecessor());
4871   Scope* outer_scope = NULL;
4872   Scope* inner_scope = scope();
4873   int drop_extra = 0;
4874   HBasicBlock* break_block = break_scope()->Get(
4875       stmt->target(), BreakAndContinueScope::BREAK,
4876       &outer_scope, &drop_extra);
4877   HValue* context = environment()->context();
4878   Drop(drop_extra);
4879   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4880   if (context_pop_count > 0) {
4881     while (context_pop_count-- > 0) {
4882       HInstruction* context_instruction = Add<HLoadNamedField>(
4883           context, nullptr,
4884           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4885       context = context_instruction;
4886     }
4887     HInstruction* instr = Add<HStoreFrameContext>(context);
4888     if (instr->HasObservableSideEffects()) {
4889       AddSimulate(stmt->target()->ExitId(), REMOVABLE_SIMULATE);
4890     }
4891     environment()->BindContext(context);
4892   }
4893   Goto(break_block);
4894   set_current_block(NULL);
4895 }
4896
4897
4898 void HOptimizedGraphBuilder::VisitReturnStatement(ReturnStatement* stmt) {
4899   DCHECK(!HasStackOverflow());
4900   DCHECK(current_block() != NULL);
4901   DCHECK(current_block()->HasPredecessor());
4902   FunctionState* state = function_state();
4903   AstContext* context = call_context();
4904   if (context == NULL) {
4905     // Not an inlined return, so an actual one.
4906     CHECK_ALIVE(VisitForValue(stmt->expression()));
4907     HValue* result = environment()->Pop();
4908     Add<HReturn>(result);
4909   } else if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
4910     // Return from an inlined construct call. In a test context the return value
4911     // will always evaluate to true, in a value context the return value needs
4912     // to be a JSObject.
4913     if (context->IsTest()) {
4914       TestContext* test = TestContext::cast(context);
4915       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4916       Goto(test->if_true(), state);
4917     } else if (context->IsEffect()) {
4918       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4919       Goto(function_return(), state);
4920     } else {
4921       DCHECK(context->IsValue());
4922       CHECK_ALIVE(VisitForValue(stmt->expression()));
4923       HValue* return_value = Pop();
4924       HValue* receiver = environment()->arguments_environment()->Lookup(0);
4925       HHasInstanceTypeAndBranch* typecheck =
4926           New<HHasInstanceTypeAndBranch>(return_value,
4927                                          FIRST_SPEC_OBJECT_TYPE,
4928                                          LAST_SPEC_OBJECT_TYPE);
4929       HBasicBlock* if_spec_object = graph()->CreateBasicBlock();
4930       HBasicBlock* not_spec_object = graph()->CreateBasicBlock();
4931       typecheck->SetSuccessorAt(0, if_spec_object);
4932       typecheck->SetSuccessorAt(1, not_spec_object);
4933       FinishCurrentBlock(typecheck);
4934       AddLeaveInlined(if_spec_object, return_value, state);
4935       AddLeaveInlined(not_spec_object, receiver, state);
4936     }
4937   } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
4938     // Return from an inlined setter call. The returned value is never used, the
4939     // value of an assignment is always the value of the RHS of the assignment.
4940     CHECK_ALIVE(VisitForEffect(stmt->expression()));
4941     if (context->IsTest()) {
4942       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4943       context->ReturnValue(rhs);
4944     } else if (context->IsEffect()) {
4945       Goto(function_return(), state);
4946     } else {
4947       DCHECK(context->IsValue());
4948       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4949       AddLeaveInlined(rhs, state);
4950     }
4951   } else {
4952     // Return from a normal inlined function. Visit the subexpression in the
4953     // expression context of the call.
4954     if (context->IsTest()) {
4955       TestContext* test = TestContext::cast(context);
4956       VisitForControl(stmt->expression(), test->if_true(), test->if_false());
4957     } else if (context->IsEffect()) {
4958       // Visit in value context and ignore the result. This is needed to keep
4959       // environment in sync with full-codegen since some visitors (e.g.
4960       // VisitCountOperation) use the operand stack differently depending on
4961       // context.
4962       CHECK_ALIVE(VisitForValue(stmt->expression()));
4963       Pop();
4964       Goto(function_return(), state);
4965     } else {
4966       DCHECK(context->IsValue());
4967       CHECK_ALIVE(VisitForValue(stmt->expression()));
4968       AddLeaveInlined(Pop(), state);
4969     }
4970   }
4971   set_current_block(NULL);
4972 }
4973
4974
4975 void HOptimizedGraphBuilder::VisitWithStatement(WithStatement* stmt) {
4976   DCHECK(!HasStackOverflow());
4977   DCHECK(current_block() != NULL);
4978   DCHECK(current_block()->HasPredecessor());
4979   return Bailout(kWithStatement);
4980 }
4981
4982
4983 void HOptimizedGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
4984   DCHECK(!HasStackOverflow());
4985   DCHECK(current_block() != NULL);
4986   DCHECK(current_block()->HasPredecessor());
4987
4988   ZoneList<CaseClause*>* clauses = stmt->cases();
4989   int clause_count = clauses->length();
4990   ZoneList<HBasicBlock*> body_blocks(clause_count, zone());
4991
4992   CHECK_ALIVE(VisitForValue(stmt->tag()));
4993   Add<HSimulate>(stmt->EntryId());
4994   HValue* tag_value = Top();
4995   Type* tag_type = stmt->tag()->bounds().lower;
4996
4997   // 1. Build all the tests, with dangling true branches
4998   BailoutId default_id = BailoutId::None();
4999   for (int i = 0; i < clause_count; ++i) {
5000     CaseClause* clause = clauses->at(i);
5001     if (clause->is_default()) {
5002       body_blocks.Add(NULL, zone());
5003       if (default_id.IsNone()) default_id = clause->EntryId();
5004       continue;
5005     }
5006
5007     // Generate a compare and branch.
5008     CHECK_ALIVE(VisitForValue(clause->label()));
5009     HValue* label_value = Pop();
5010
5011     Type* label_type = clause->label()->bounds().lower;
5012     Type* combined_type = clause->compare_type();
5013     HControlInstruction* compare = BuildCompareInstruction(
5014         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
5015         combined_type,
5016         ScriptPositionToSourcePosition(stmt->tag()->position()),
5017         ScriptPositionToSourcePosition(clause->label()->position()),
5018         PUSH_BEFORE_SIMULATE, clause->id());
5019
5020     HBasicBlock* next_test_block = graph()->CreateBasicBlock();
5021     HBasicBlock* body_block = graph()->CreateBasicBlock();
5022     body_blocks.Add(body_block, zone());
5023     compare->SetSuccessorAt(0, body_block);
5024     compare->SetSuccessorAt(1, next_test_block);
5025     FinishCurrentBlock(compare);
5026
5027     set_current_block(body_block);
5028     Drop(1);  // tag_value
5029
5030     set_current_block(next_test_block);
5031   }
5032
5033   // Save the current block to use for the default or to join with the
5034   // exit.
5035   HBasicBlock* last_block = current_block();
5036   Drop(1);  // tag_value
5037
5038   // 2. Loop over the clauses and the linked list of tests in lockstep,
5039   // translating the clause bodies.
5040   HBasicBlock* fall_through_block = NULL;
5041
5042   BreakAndContinueInfo break_info(stmt, scope());
5043   { BreakAndContinueScope push(&break_info, this);
5044     for (int i = 0; i < clause_count; ++i) {
5045       CaseClause* clause = clauses->at(i);
5046
5047       // Identify the block where normal (non-fall-through) control flow
5048       // goes to.
5049       HBasicBlock* normal_block = NULL;
5050       if (clause->is_default()) {
5051         if (last_block == NULL) continue;
5052         normal_block = last_block;
5053         last_block = NULL;  // Cleared to indicate we've handled it.
5054       } else {
5055         normal_block = body_blocks[i];
5056       }
5057
5058       if (fall_through_block == NULL) {
5059         set_current_block(normal_block);
5060       } else {
5061         HBasicBlock* join = CreateJoin(fall_through_block,
5062                                        normal_block,
5063                                        clause->EntryId());
5064         set_current_block(join);
5065       }
5066
5067       CHECK_BAILOUT(VisitStatements(clause->statements()));
5068       fall_through_block = current_block();
5069     }
5070   }
5071
5072   // Create an up-to-3-way join.  Use the break block if it exists since
5073   // it's already a join block.
5074   HBasicBlock* break_block = break_info.break_block();
5075   if (break_block == NULL) {
5076     set_current_block(CreateJoin(fall_through_block,
5077                                  last_block,
5078                                  stmt->ExitId()));
5079   } else {
5080     if (fall_through_block != NULL) Goto(fall_through_block, break_block);
5081     if (last_block != NULL) Goto(last_block, break_block);
5082     break_block->SetJoinId(stmt->ExitId());
5083     set_current_block(break_block);
5084   }
5085 }
5086
5087
5088 void HOptimizedGraphBuilder::VisitLoopBody(IterationStatement* stmt,
5089                                            HBasicBlock* loop_entry) {
5090   Add<HSimulate>(stmt->StackCheckId());
5091   HStackCheck* stack_check =
5092       HStackCheck::cast(Add<HStackCheck>(HStackCheck::kBackwardsBranch));
5093   DCHECK(loop_entry->IsLoopHeader());
5094   loop_entry->loop_information()->set_stack_check(stack_check);
5095   CHECK_BAILOUT(Visit(stmt->body()));
5096 }
5097
5098
5099 void HOptimizedGraphBuilder::VisitDoWhileStatement(DoWhileStatement* stmt) {
5100   DCHECK(!HasStackOverflow());
5101   DCHECK(current_block() != NULL);
5102   DCHECK(current_block()->HasPredecessor());
5103   DCHECK(current_block() != NULL);
5104   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5105
5106   BreakAndContinueInfo break_info(stmt, scope());
5107   {
5108     BreakAndContinueScope push(&break_info, this);
5109     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5110   }
5111   HBasicBlock* body_exit =
5112       JoinContinue(stmt, current_block(), break_info.continue_block());
5113   HBasicBlock* loop_successor = NULL;
5114   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
5115     set_current_block(body_exit);
5116     loop_successor = graph()->CreateBasicBlock();
5117     if (stmt->cond()->ToBooleanIsFalse()) {
5118       loop_entry->loop_information()->stack_check()->Eliminate();
5119       Goto(loop_successor);
5120       body_exit = NULL;
5121     } else {
5122       // The block for a true condition, the actual predecessor block of the
5123       // back edge.
5124       body_exit = graph()->CreateBasicBlock();
5125       CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
5126     }
5127     if (body_exit != NULL && body_exit->HasPredecessor()) {
5128       body_exit->SetJoinId(stmt->BackEdgeId());
5129     } else {
5130       body_exit = NULL;
5131     }
5132     if (loop_successor->HasPredecessor()) {
5133       loop_successor->SetJoinId(stmt->ExitId());
5134     } else {
5135       loop_successor = NULL;
5136     }
5137   }
5138   HBasicBlock* loop_exit = CreateLoop(stmt,
5139                                       loop_entry,
5140                                       body_exit,
5141                                       loop_successor,
5142                                       break_info.break_block());
5143   set_current_block(loop_exit);
5144 }
5145
5146
5147 void HOptimizedGraphBuilder::VisitWhileStatement(WhileStatement* stmt) {
5148   DCHECK(!HasStackOverflow());
5149   DCHECK(current_block() != NULL);
5150   DCHECK(current_block()->HasPredecessor());
5151   DCHECK(current_block() != NULL);
5152   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5153
5154   // If the condition is constant true, do not generate a branch.
5155   HBasicBlock* loop_successor = NULL;
5156   if (!stmt->cond()->ToBooleanIsTrue()) {
5157     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5158     loop_successor = graph()->CreateBasicBlock();
5159     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5160     if (body_entry->HasPredecessor()) {
5161       body_entry->SetJoinId(stmt->BodyId());
5162       set_current_block(body_entry);
5163     }
5164     if (loop_successor->HasPredecessor()) {
5165       loop_successor->SetJoinId(stmt->ExitId());
5166     } else {
5167       loop_successor = NULL;
5168     }
5169   }
5170
5171   BreakAndContinueInfo break_info(stmt, scope());
5172   if (current_block() != NULL) {
5173     BreakAndContinueScope push(&break_info, this);
5174     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5175   }
5176   HBasicBlock* body_exit =
5177       JoinContinue(stmt, current_block(), break_info.continue_block());
5178   HBasicBlock* loop_exit = CreateLoop(stmt,
5179                                       loop_entry,
5180                                       body_exit,
5181                                       loop_successor,
5182                                       break_info.break_block());
5183   set_current_block(loop_exit);
5184 }
5185
5186
5187 void HOptimizedGraphBuilder::VisitForStatement(ForStatement* stmt) {
5188   DCHECK(!HasStackOverflow());
5189   DCHECK(current_block() != NULL);
5190   DCHECK(current_block()->HasPredecessor());
5191   if (stmt->init() != NULL) {
5192     CHECK_ALIVE(Visit(stmt->init()));
5193   }
5194   DCHECK(current_block() != NULL);
5195   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5196
5197   HBasicBlock* loop_successor = NULL;
5198   if (stmt->cond() != NULL) {
5199     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5200     loop_successor = graph()->CreateBasicBlock();
5201     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5202     if (body_entry->HasPredecessor()) {
5203       body_entry->SetJoinId(stmt->BodyId());
5204       set_current_block(body_entry);
5205     }
5206     if (loop_successor->HasPredecessor()) {
5207       loop_successor->SetJoinId(stmt->ExitId());
5208     } else {
5209       loop_successor = NULL;
5210     }
5211   }
5212
5213   BreakAndContinueInfo break_info(stmt, scope());
5214   if (current_block() != NULL) {
5215     BreakAndContinueScope push(&break_info, this);
5216     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5217   }
5218   HBasicBlock* body_exit =
5219       JoinContinue(stmt, current_block(), break_info.continue_block());
5220
5221   if (stmt->next() != NULL && body_exit != NULL) {
5222     set_current_block(body_exit);
5223     CHECK_BAILOUT(Visit(stmt->next()));
5224     body_exit = current_block();
5225   }
5226
5227   HBasicBlock* loop_exit = CreateLoop(stmt,
5228                                       loop_entry,
5229                                       body_exit,
5230                                       loop_successor,
5231                                       break_info.break_block());
5232   set_current_block(loop_exit);
5233 }
5234
5235
5236 void HOptimizedGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
5237   DCHECK(!HasStackOverflow());
5238   DCHECK(current_block() != NULL);
5239   DCHECK(current_block()->HasPredecessor());
5240
5241   if (!FLAG_optimize_for_in) {
5242     return Bailout(kForInStatementOptimizationIsDisabled);
5243   }
5244
5245   if (!stmt->each()->IsVariableProxy() ||
5246       !stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
5247     return Bailout(kForInStatementWithNonLocalEachVariable);
5248   }
5249
5250   Variable* each_var = stmt->each()->AsVariableProxy()->var();
5251
5252   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
5253   HValue* enumerable = Top();  // Leave enumerable at the top.
5254
5255   IfBuilder if_undefined_or_null(this);
5256   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5257       enumerable, graph()->GetConstantUndefined());
5258   if_undefined_or_null.Or();
5259   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5260       enumerable, graph()->GetConstantNull());
5261   if_undefined_or_null.ThenDeopt(Deoptimizer::kUndefinedOrNullInForIn);
5262   if_undefined_or_null.End();
5263   BuildForInBody(stmt, each_var, enumerable);
5264 }
5265
5266
5267 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
5268                                             Variable* each_var,
5269                                             HValue* enumerable) {
5270   HInstruction* map;
5271   HInstruction* array;
5272   HInstruction* enum_length;
5273   bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
5274   if (fast) {
5275     map = Add<HForInPrepareMap>(enumerable);
5276     Add<HSimulate>(stmt->PrepareId());
5277
5278     array = Add<HForInCacheArray>(enumerable, map,
5279                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
5280     enum_length = Add<HMapEnumLength>(map);
5281
5282     HInstruction* index_cache = Add<HForInCacheArray>(
5283         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
5284     HForInCacheArray::cast(array)
5285         ->set_index_cache(HForInCacheArray::cast(index_cache));
5286   } else {
5287     Add<HSimulate>(stmt->PrepareId());
5288     {
5289       NoObservableSideEffectsScope no_effects(this);
5290       BuildJSObjectCheck(enumerable, 0);
5291     }
5292     Add<HSimulate>(stmt->ToObjectId());
5293
5294     map = graph()->GetConstant1();
5295     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
5296     Add<HPushArguments>(enumerable);
5297     array = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 1);
5298     Push(array);
5299     Add<HSimulate>(stmt->EnumId());
5300     Drop(1);
5301     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
5302     HValue* check = Add<HCheckMaps>(array, array_map);
5303     enum_length = AddLoadFixedArrayLength(array, check);
5304   }
5305
5306   HInstruction* start_index = Add<HConstant>(0);
5307
5308   Push(map);
5309   Push(array);
5310   Push(enum_length);
5311   Push(start_index);
5312
5313   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5314
5315   // Reload the values to ensure we have up-to-date values inside of the loop.
5316   // This is relevant especially for OSR where the values don't come from the
5317   // computation above, but from the OSR entry block.
5318   enumerable = environment()->ExpressionStackAt(4);
5319   HValue* index = environment()->ExpressionStackAt(0);
5320   HValue* limit = environment()->ExpressionStackAt(1);
5321
5322   // Check that we still have more keys.
5323   HCompareNumericAndBranch* compare_index =
5324       New<HCompareNumericAndBranch>(index, limit, Token::LT);
5325   compare_index->set_observed_input_representation(
5326       Representation::Smi(), Representation::Smi());
5327
5328   HBasicBlock* loop_body = graph()->CreateBasicBlock();
5329   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
5330
5331   compare_index->SetSuccessorAt(0, loop_body);
5332   compare_index->SetSuccessorAt(1, loop_successor);
5333   FinishCurrentBlock(compare_index);
5334
5335   set_current_block(loop_successor);
5336   Drop(5);
5337
5338   set_current_block(loop_body);
5339
5340   HValue* key =
5341       Add<HLoadKeyed>(environment()->ExpressionStackAt(2),  // Enum cache.
5342                       index, index, FAST_ELEMENTS);
5343
5344   if (fast) {
5345     // Check if the expected map still matches that of the enumerable.
5346     // If not just deoptimize.
5347     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
5348     Bind(each_var, key);
5349   } else {
5350     Add<HPushArguments>(enumerable, key);
5351     Runtime::FunctionId function_id = Runtime::kForInFilter;
5352     key = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 2);
5353     Push(key);
5354     Add<HSimulate>(stmt->FilterId());
5355     key = Pop();
5356     Bind(each_var, key);
5357     IfBuilder if_undefined(this);
5358     if_undefined.If<HCompareObjectEqAndBranch>(key,
5359                                                graph()->GetConstantUndefined());
5360     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
5361     if_undefined.End();
5362     Add<HSimulate>(stmt->AssignmentId());
5363   }
5364
5365   BreakAndContinueInfo break_info(stmt, scope(), 5);
5366   {
5367     BreakAndContinueScope push(&break_info, this);
5368     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5369   }
5370
5371   HBasicBlock* body_exit =
5372       JoinContinue(stmt, current_block(), break_info.continue_block());
5373
5374   if (body_exit != NULL) {
5375     set_current_block(body_exit);
5376
5377     HValue* current_index = Pop();
5378     Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
5379     body_exit = current_block();
5380   }
5381
5382   HBasicBlock* loop_exit = CreateLoop(stmt,
5383                                       loop_entry,
5384                                       body_exit,
5385                                       loop_successor,
5386                                       break_info.break_block());
5387
5388   set_current_block(loop_exit);
5389 }
5390
5391
5392 void HOptimizedGraphBuilder::VisitForOfStatement(ForOfStatement* stmt) {
5393   DCHECK(!HasStackOverflow());
5394   DCHECK(current_block() != NULL);
5395   DCHECK(current_block()->HasPredecessor());
5396   return Bailout(kForOfStatement);
5397 }
5398
5399
5400 void HOptimizedGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
5401   DCHECK(!HasStackOverflow());
5402   DCHECK(current_block() != NULL);
5403   DCHECK(current_block()->HasPredecessor());
5404   return Bailout(kTryCatchStatement);
5405 }
5406
5407
5408 void HOptimizedGraphBuilder::VisitTryFinallyStatement(
5409     TryFinallyStatement* stmt) {
5410   DCHECK(!HasStackOverflow());
5411   DCHECK(current_block() != NULL);
5412   DCHECK(current_block()->HasPredecessor());
5413   return Bailout(kTryFinallyStatement);
5414 }
5415
5416
5417 void HOptimizedGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
5418   DCHECK(!HasStackOverflow());
5419   DCHECK(current_block() != NULL);
5420   DCHECK(current_block()->HasPredecessor());
5421   return Bailout(kDebuggerStatement);
5422 }
5423
5424
5425 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
5426   UNREACHABLE();
5427 }
5428
5429
5430 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
5431   DCHECK(!HasStackOverflow());
5432   DCHECK(current_block() != NULL);
5433   DCHECK(current_block()->HasPredecessor());
5434   Handle<SharedFunctionInfo> shared_info = Compiler::GetSharedFunctionInfo(
5435       expr, current_info()->script(), top_info());
5436   // We also have a stack overflow if the recursive compilation did.
5437   if (HasStackOverflow()) return;
5438   HFunctionLiteral* instr =
5439       New<HFunctionLiteral>(shared_info, expr->pretenure());
5440   return ast_context()->ReturnInstruction(instr, expr->id());
5441 }
5442
5443
5444 void HOptimizedGraphBuilder::VisitClassLiteral(ClassLiteral* lit) {
5445   DCHECK(!HasStackOverflow());
5446   DCHECK(current_block() != NULL);
5447   DCHECK(current_block()->HasPredecessor());
5448   return Bailout(kClassLiteral);
5449 }
5450
5451
5452 void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
5453     NativeFunctionLiteral* expr) {
5454   DCHECK(!HasStackOverflow());
5455   DCHECK(current_block() != NULL);
5456   DCHECK(current_block()->HasPredecessor());
5457   return Bailout(kNativeFunctionLiteral);
5458 }
5459
5460
5461 void HOptimizedGraphBuilder::VisitConditional(Conditional* expr) {
5462   DCHECK(!HasStackOverflow());
5463   DCHECK(current_block() != NULL);
5464   DCHECK(current_block()->HasPredecessor());
5465   HBasicBlock* cond_true = graph()->CreateBasicBlock();
5466   HBasicBlock* cond_false = graph()->CreateBasicBlock();
5467   CHECK_BAILOUT(VisitForControl(expr->condition(), cond_true, cond_false));
5468
5469   // Visit the true and false subexpressions in the same AST context as the
5470   // whole expression.
5471   if (cond_true->HasPredecessor()) {
5472     cond_true->SetJoinId(expr->ThenId());
5473     set_current_block(cond_true);
5474     CHECK_BAILOUT(Visit(expr->then_expression()));
5475     cond_true = current_block();
5476   } else {
5477     cond_true = NULL;
5478   }
5479
5480   if (cond_false->HasPredecessor()) {
5481     cond_false->SetJoinId(expr->ElseId());
5482     set_current_block(cond_false);
5483     CHECK_BAILOUT(Visit(expr->else_expression()));
5484     cond_false = current_block();
5485   } else {
5486     cond_false = NULL;
5487   }
5488
5489   if (!ast_context()->IsTest()) {
5490     HBasicBlock* join = CreateJoin(cond_true, cond_false, expr->id());
5491     set_current_block(join);
5492     if (join != NULL && !ast_context()->IsEffect()) {
5493       return ast_context()->ReturnValue(Pop());
5494     }
5495   }
5496 }
5497
5498
5499 HOptimizedGraphBuilder::GlobalPropertyAccess
5500 HOptimizedGraphBuilder::LookupGlobalProperty(Variable* var, LookupIterator* it,
5501                                              PropertyAccessType access_type) {
5502   if (var->is_this() || !current_info()->has_global_object()) {
5503     return kUseGeneric;
5504   }
5505
5506   switch (it->state()) {
5507     case LookupIterator::ACCESSOR:
5508     case LookupIterator::ACCESS_CHECK:
5509     case LookupIterator::INTERCEPTOR:
5510     case LookupIterator::INTEGER_INDEXED_EXOTIC:
5511     case LookupIterator::NOT_FOUND:
5512       return kUseGeneric;
5513     case LookupIterator::DATA:
5514       if (access_type == STORE && it->IsReadOnly()) return kUseGeneric;
5515       return kUseCell;
5516     case LookupIterator::JSPROXY:
5517     case LookupIterator::TRANSITION:
5518       UNREACHABLE();
5519   }
5520   UNREACHABLE();
5521   return kUseGeneric;
5522 }
5523
5524
5525 HValue* HOptimizedGraphBuilder::BuildContextChainWalk(Variable* var) {
5526   DCHECK(var->IsContextSlot());
5527   HValue* context = environment()->context();
5528   int length = scope()->ContextChainLength(var->scope());
5529   while (length-- > 0) {
5530     context = Add<HLoadNamedField>(
5531         context, nullptr,
5532         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
5533   }
5534   return context;
5535 }
5536
5537
5538 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
5539   DCHECK(!HasStackOverflow());
5540   DCHECK(current_block() != NULL);
5541   DCHECK(current_block()->HasPredecessor());
5542   Variable* variable = expr->var();
5543   switch (variable->location()) {
5544     case VariableLocation::GLOBAL:
5545     case VariableLocation::UNALLOCATED: {
5546       if (IsLexicalVariableMode(variable->mode())) {
5547         // TODO(rossberg): should this be an DCHECK?
5548         return Bailout(kReferenceToGlobalLexicalVariable);
5549       }
5550       // Handle known global constants like 'undefined' specially to avoid a
5551       // load from a global cell for them.
5552       Handle<Object> constant_value =
5553           isolate()->factory()->GlobalConstantFor(variable->name());
5554       if (!constant_value.is_null()) {
5555         HConstant* instr = New<HConstant>(constant_value);
5556         return ast_context()->ReturnInstruction(instr, expr->id());
5557       }
5558
5559       Handle<GlobalObject> global(current_info()->global_object());
5560
5561       // Lookup in script contexts.
5562       {
5563         Handle<ScriptContextTable> script_contexts(
5564             global->native_context()->script_context_table());
5565         ScriptContextTable::LookupResult lookup;
5566         if (ScriptContextTable::Lookup(script_contexts, variable->name(),
5567                                        &lookup)) {
5568           Handle<Context> script_context = ScriptContextTable::GetContext(
5569               script_contexts, lookup.context_index);
5570           Handle<Object> current_value =
5571               FixedArray::get(script_context, lookup.slot_index);
5572
5573           // If the values is not the hole, it will stay initialized,
5574           // so no need to generate a check.
5575           if (*current_value == *isolate()->factory()->the_hole_value()) {
5576             return Bailout(kReferenceToUninitializedVariable);
5577           }
5578           HInstruction* result = New<HLoadNamedField>(
5579               Add<HConstant>(script_context), nullptr,
5580               HObjectAccess::ForContextSlot(lookup.slot_index));
5581           return ast_context()->ReturnInstruction(result, expr->id());
5582         }
5583       }
5584
5585       LookupIterator it(global, variable->name(), LookupIterator::OWN);
5586       GlobalPropertyAccess type = LookupGlobalProperty(variable, &it, LOAD);
5587
5588       if (type == kUseCell) {
5589         Handle<PropertyCell> cell = it.GetPropertyCell();
5590         top_info()->dependencies()->AssumePropertyCell(cell);
5591         auto cell_type = it.property_details().cell_type();
5592         if (cell_type == PropertyCellType::kConstant ||
5593             cell_type == PropertyCellType::kUndefined) {
5594           Handle<Object> constant_object(cell->value(), isolate());
5595           if (constant_object->IsConsString()) {
5596             constant_object =
5597                 String::Flatten(Handle<String>::cast(constant_object));
5598           }
5599           HConstant* constant = New<HConstant>(constant_object);
5600           return ast_context()->ReturnInstruction(constant, expr->id());
5601         } else {
5602           auto access = HObjectAccess::ForPropertyCellValue();
5603           UniqueSet<Map>* field_maps = nullptr;
5604           if (cell_type == PropertyCellType::kConstantType) {
5605             switch (cell->GetConstantType()) {
5606               case PropertyCellConstantType::kSmi:
5607                 access = access.WithRepresentation(Representation::Smi());
5608                 break;
5609               case PropertyCellConstantType::kStableMap: {
5610                 // Check that the map really is stable. The heap object could
5611                 // have mutated without the cell updating state. In that case,
5612                 // make no promises about the loaded value except that it's a
5613                 // heap object.
5614                 access =
5615                     access.WithRepresentation(Representation::HeapObject());
5616                 Handle<Map> map(HeapObject::cast(cell->value())->map());
5617                 if (map->is_stable()) {
5618                   field_maps = new (zone())
5619                       UniqueSet<Map>(Unique<Map>::CreateImmovable(map), zone());
5620                 }
5621                 break;
5622               }
5623             }
5624           }
5625           HConstant* cell_constant = Add<HConstant>(cell);
5626           HLoadNamedField* instr;
5627           if (field_maps == nullptr) {
5628             instr = New<HLoadNamedField>(cell_constant, nullptr, access);
5629           } else {
5630             instr = New<HLoadNamedField>(cell_constant, nullptr, access,
5631                                          field_maps, HType::HeapObject());
5632           }
5633           instr->ClearDependsOnFlag(kInobjectFields);
5634           instr->SetDependsOnFlag(kGlobalVars);
5635           return ast_context()->ReturnInstruction(instr, expr->id());
5636         }
5637       } else if (variable->IsGlobalSlot()) {
5638         DCHECK(variable->index() > 0);
5639         DCHECK(variable->IsStaticGlobalObjectProperty());
5640         int slot_index = variable->index();
5641         int depth = scope()->ContextChainLength(variable->scope());
5642
5643         HLoadGlobalViaContext* instr =
5644             New<HLoadGlobalViaContext>(depth, slot_index);
5645         return ast_context()->ReturnInstruction(instr, expr->id());
5646
5647       } else {
5648         HValue* global_object = Add<HLoadNamedField>(
5649             context(), nullptr,
5650             HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
5651         HLoadGlobalGeneric* instr = New<HLoadGlobalGeneric>(
5652             global_object, variable->name(), ast_context()->typeof_mode());
5653         instr->SetVectorAndSlot(handle(current_feedback_vector(), isolate()),
5654                                 expr->VariableFeedbackSlot());
5655         return ast_context()->ReturnInstruction(instr, expr->id());
5656       }
5657     }
5658
5659     case VariableLocation::PARAMETER:
5660     case VariableLocation::LOCAL: {
5661       HValue* value = LookupAndMakeLive(variable);
5662       if (value == graph()->GetConstantHole()) {
5663         DCHECK(IsDeclaredVariableMode(variable->mode()) &&
5664                variable->mode() != VAR);
5665         return Bailout(kReferenceToUninitializedVariable);
5666       }
5667       return ast_context()->ReturnValue(value);
5668     }
5669
5670     case VariableLocation::CONTEXT: {
5671       HValue* context = BuildContextChainWalk(variable);
5672       HLoadContextSlot::Mode mode;
5673       switch (variable->mode()) {
5674         case LET:
5675         case CONST:
5676           mode = HLoadContextSlot::kCheckDeoptimize;
5677           break;
5678         case CONST_LEGACY:
5679           mode = HLoadContextSlot::kCheckReturnUndefined;
5680           break;
5681         default:
5682           mode = HLoadContextSlot::kNoCheck;
5683           break;
5684       }
5685       HLoadContextSlot* instr =
5686           new(zone()) HLoadContextSlot(context, variable->index(), mode);
5687       return ast_context()->ReturnInstruction(instr, expr->id());
5688     }
5689
5690     case VariableLocation::LOOKUP:
5691       return Bailout(kReferenceToAVariableWhichRequiresDynamicLookup);
5692   }
5693 }
5694
5695
5696 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
5697   DCHECK(!HasStackOverflow());
5698   DCHECK(current_block() != NULL);
5699   DCHECK(current_block()->HasPredecessor());
5700   HConstant* instr = New<HConstant>(expr->value());
5701   return ast_context()->ReturnInstruction(instr, expr->id());
5702 }
5703
5704
5705 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
5706   DCHECK(!HasStackOverflow());
5707   DCHECK(current_block() != NULL);
5708   DCHECK(current_block()->HasPredecessor());
5709   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5710   Handle<FixedArray> literals(closure->literals());
5711   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
5712                                               expr->pattern(),
5713                                               expr->flags(),
5714                                               expr->literal_index());
5715   return ast_context()->ReturnInstruction(instr, expr->id());
5716 }
5717
5718
5719 static bool CanInlinePropertyAccess(Handle<Map> map) {
5720   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
5721   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
5722   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
5723          !map->has_named_interceptor() &&
5724          // TODO(verwaest): Whitelist contexts to which we have access.
5725          !map->is_access_check_needed();
5726 }
5727
5728
5729 // Determines whether the given array or object literal boilerplate satisfies
5730 // all limits to be considered for fast deep-copying and computes the total
5731 // size of all objects that are part of the graph.
5732 static bool IsFastLiteral(Handle<JSObject> boilerplate,
5733                           int max_depth,
5734                           int* max_properties) {
5735   if (boilerplate->map()->is_deprecated() &&
5736       !JSObject::TryMigrateInstance(boilerplate)) {
5737     return false;
5738   }
5739
5740   DCHECK(max_depth >= 0 && *max_properties >= 0);
5741   if (max_depth == 0) return false;
5742
5743   Isolate* isolate = boilerplate->GetIsolate();
5744   Handle<FixedArrayBase> elements(boilerplate->elements());
5745   if (elements->length() > 0 &&
5746       elements->map() != isolate->heap()->fixed_cow_array_map()) {
5747     if (boilerplate->HasFastSmiOrObjectElements()) {
5748       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
5749       int length = elements->length();
5750       for (int i = 0; i < length; i++) {
5751         if ((*max_properties)-- == 0) return false;
5752         Handle<Object> value(fast_elements->get(i), isolate);
5753         if (value->IsJSObject()) {
5754           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5755           if (!IsFastLiteral(value_object,
5756                              max_depth - 1,
5757                              max_properties)) {
5758             return false;
5759           }
5760         }
5761       }
5762     } else if (!boilerplate->HasFastDoubleElements()) {
5763       return false;
5764     }
5765   }
5766
5767   Handle<FixedArray> properties(boilerplate->properties());
5768   if (properties->length() > 0) {
5769     return false;
5770   } else {
5771     Handle<DescriptorArray> descriptors(
5772         boilerplate->map()->instance_descriptors());
5773     int limit = boilerplate->map()->NumberOfOwnDescriptors();
5774     for (int i = 0; i < limit; i++) {
5775       PropertyDetails details = descriptors->GetDetails(i);
5776       if (details.type() != DATA) continue;
5777       if ((*max_properties)-- == 0) return false;
5778       FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
5779       if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
5780       Handle<Object> value(boilerplate->RawFastPropertyAt(field_index),
5781                            isolate);
5782       if (value->IsJSObject()) {
5783         Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5784         if (!IsFastLiteral(value_object,
5785                            max_depth - 1,
5786                            max_properties)) {
5787           return false;
5788         }
5789       }
5790     }
5791   }
5792   return true;
5793 }
5794
5795
5796 void HOptimizedGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
5797   DCHECK(!HasStackOverflow());
5798   DCHECK(current_block() != NULL);
5799   DCHECK(current_block()->HasPredecessor());
5800
5801   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5802   HInstruction* literal;
5803
5804   // Check whether to use fast or slow deep-copying for boilerplate.
5805   int max_properties = kMaxFastLiteralProperties;
5806   Handle<Object> literals_cell(closure->literals()->get(expr->literal_index()),
5807                                isolate());
5808   Handle<AllocationSite> site;
5809   Handle<JSObject> boilerplate;
5810   if (!literals_cell->IsUndefined()) {
5811     // Retrieve the boilerplate
5812     site = Handle<AllocationSite>::cast(literals_cell);
5813     boilerplate = Handle<JSObject>(JSObject::cast(site->transition_info()),
5814                                    isolate());
5815   }
5816
5817   if (!boilerplate.is_null() &&
5818       IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
5819     AllocationSiteUsageContext site_context(isolate(), site, false);
5820     site_context.EnterNewScope();
5821     literal = BuildFastLiteral(boilerplate, &site_context);
5822     site_context.ExitScope(site, boilerplate);
5823   } else {
5824     NoObservableSideEffectsScope no_effects(this);
5825     Handle<FixedArray> closure_literals(closure->literals(), isolate());
5826     Handle<FixedArray> constant_properties = expr->constant_properties();
5827     int literal_index = expr->literal_index();
5828     int flags = expr->ComputeFlags(true);
5829
5830     Add<HPushArguments>(Add<HConstant>(closure_literals),
5831                         Add<HConstant>(literal_index),
5832                         Add<HConstant>(constant_properties),
5833                         Add<HConstant>(flags));
5834
5835     Runtime::FunctionId function_id = Runtime::kCreateObjectLiteral;
5836     literal = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 4);
5837   }
5838
5839   // The object is expected in the bailout environment during computation
5840   // of the property values and is the value of the entire expression.
5841   Push(literal);
5842   int store_slot_index = 0;
5843   for (int i = 0; i < expr->properties()->length(); i++) {
5844     ObjectLiteral::Property* property = expr->properties()->at(i);
5845     if (property->is_computed_name()) return Bailout(kComputedPropertyName);
5846     if (property->IsCompileTimeValue()) continue;
5847
5848     Literal* key = property->key()->AsLiteral();
5849     Expression* value = property->value();
5850
5851     switch (property->kind()) {
5852       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
5853         DCHECK(!CompileTimeValue::IsCompileTimeValue(value));
5854         // Fall through.
5855       case ObjectLiteral::Property::COMPUTED:
5856         // It is safe to use [[Put]] here because the boilerplate already
5857         // contains computed properties with an uninitialized value.
5858         if (key->value()->IsInternalizedString()) {
5859           if (property->emit_store()) {
5860             CHECK_ALIVE(VisitForValue(value));
5861             HValue* value = Pop();
5862
5863             Handle<Map> map = property->GetReceiverType();
5864             Handle<String> name = key->AsPropertyName();
5865             HValue* store;
5866             FeedbackVectorICSlot slot = expr->GetNthSlot(store_slot_index++);
5867             if (map.is_null()) {
5868               // If we don't know the monomorphic type, do a generic store.
5869               CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot, literal,
5870                                                     name, value));
5871             } else {
5872               PropertyAccessInfo info(this, STORE, map, name);
5873               if (info.CanAccessMonomorphic()) {
5874                 HValue* checked_literal = Add<HCheckMaps>(literal, map);
5875                 DCHECK(!info.IsAccessorConstant());
5876                 store = BuildMonomorphicAccess(
5877                     &info, literal, checked_literal, value,
5878                     BailoutId::None(), BailoutId::None());
5879               } else {
5880                 CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot,
5881                                                       literal, name, value));
5882               }
5883             }
5884             if (store->IsInstruction()) {
5885               AddInstruction(HInstruction::cast(store));
5886             }
5887             DCHECK(store->HasObservableSideEffects());
5888             Add<HSimulate>(key->id(), REMOVABLE_SIMULATE);
5889
5890             // Add [[HomeObject]] to function literals.
5891             if (FunctionLiteral::NeedsHomeObject(property->value())) {
5892               Handle<Symbol> sym = isolate()->factory()->home_object_symbol();
5893               HInstruction* store_home = BuildNamedGeneric(
5894                   STORE, NULL, expr->GetNthSlot(store_slot_index++), value, sym,
5895                   literal);
5896               AddInstruction(store_home);
5897               DCHECK(store_home->HasObservableSideEffects());
5898               Add<HSimulate>(property->value()->id(), REMOVABLE_SIMULATE);
5899             }
5900           } else {
5901             CHECK_ALIVE(VisitForEffect(value));
5902           }
5903           break;
5904         }
5905         // Fall through.
5906       case ObjectLiteral::Property::PROTOTYPE:
5907       case ObjectLiteral::Property::SETTER:
5908       case ObjectLiteral::Property::GETTER:
5909         return Bailout(kObjectLiteralWithComplexProperty);
5910       default: UNREACHABLE();
5911     }
5912   }
5913
5914   // Crankshaft may not consume all the slots because it doesn't emit accessors.
5915   DCHECK(!FLAG_vector_stores || store_slot_index <= expr->slot_count());
5916
5917   if (expr->has_function()) {
5918     // Return the result of the transformation to fast properties
5919     // instead of the original since this operation changes the map
5920     // of the object. This makes sure that the original object won't
5921     // be used by other optimized code before it is transformed
5922     // (e.g. because of code motion).
5923     HToFastProperties* result = Add<HToFastProperties>(Pop());
5924     return ast_context()->ReturnValue(result);
5925   } else {
5926     return ast_context()->ReturnValue(Pop());
5927   }
5928 }
5929
5930
5931 void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
5932   DCHECK(!HasStackOverflow());
5933   DCHECK(current_block() != NULL);
5934   DCHECK(current_block()->HasPredecessor());
5935   expr->BuildConstantElements(isolate());
5936   ZoneList<Expression*>* subexprs = expr->values();
5937   int length = subexprs->length();
5938   HInstruction* literal;
5939
5940   Handle<AllocationSite> site;
5941   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
5942   bool uninitialized = false;
5943   Handle<Object> literals_cell(literals->get(expr->literal_index()),
5944                                isolate());
5945   Handle<JSObject> boilerplate_object;
5946   if (literals_cell->IsUndefined()) {
5947     uninitialized = true;
5948     Handle<Object> raw_boilerplate;
5949     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
5950         isolate(), raw_boilerplate,
5951         Runtime::CreateArrayLiteralBoilerplate(
5952             isolate(), literals, expr->constant_elements(),
5953             is_strong(function_language_mode())),
5954         Bailout(kArrayBoilerplateCreationFailed));
5955
5956     boilerplate_object = Handle<JSObject>::cast(raw_boilerplate);
5957     AllocationSiteCreationContext creation_context(isolate());
5958     site = creation_context.EnterNewScope();
5959     if (JSObject::DeepWalk(boilerplate_object, &creation_context).is_null()) {
5960       return Bailout(kArrayBoilerplateCreationFailed);
5961     }
5962     creation_context.ExitScope(site, boilerplate_object);
5963     literals->set(expr->literal_index(), *site);
5964
5965     if (boilerplate_object->elements()->map() ==
5966         isolate()->heap()->fixed_cow_array_map()) {
5967       isolate()->counters()->cow_arrays_created_runtime()->Increment();
5968     }
5969   } else {
5970     DCHECK(literals_cell->IsAllocationSite());
5971     site = Handle<AllocationSite>::cast(literals_cell);
5972     boilerplate_object = Handle<JSObject>(
5973         JSObject::cast(site->transition_info()), isolate());
5974   }
5975
5976   DCHECK(!boilerplate_object.is_null());
5977   DCHECK(site->SitePointsToLiteral());
5978
5979   ElementsKind boilerplate_elements_kind =
5980       boilerplate_object->GetElementsKind();
5981
5982   // Check whether to use fast or slow deep-copying for boilerplate.
5983   int max_properties = kMaxFastLiteralProperties;
5984   if (IsFastLiteral(boilerplate_object,
5985                     kMaxFastLiteralDepth,
5986                     &max_properties)) {
5987     AllocationSiteUsageContext site_context(isolate(), site, false);
5988     site_context.EnterNewScope();
5989     literal = BuildFastLiteral(boilerplate_object, &site_context);
5990     site_context.ExitScope(site, boilerplate_object);
5991   } else {
5992     NoObservableSideEffectsScope no_effects(this);
5993     // Boilerplate already exists and constant elements are never accessed,
5994     // pass an empty fixed array to the runtime function instead.
5995     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
5996     int literal_index = expr->literal_index();
5997     int flags = expr->ComputeFlags(true);
5998
5999     Add<HPushArguments>(Add<HConstant>(literals),
6000                         Add<HConstant>(literal_index),
6001                         Add<HConstant>(constants),
6002                         Add<HConstant>(flags));
6003
6004     Runtime::FunctionId function_id = Runtime::kCreateArrayLiteral;
6005     literal = Add<HCallRuntime>(Runtime::FunctionForId(function_id), 4);
6006
6007     // Register to deopt if the boilerplate ElementsKind changes.
6008     top_info()->dependencies()->AssumeTransitionStable(site);
6009   }
6010
6011   // The array is expected in the bailout environment during computation
6012   // of the property values and is the value of the entire expression.
6013   Push(literal);
6014   // The literal index is on the stack, too.
6015   Push(Add<HConstant>(expr->literal_index()));
6016
6017   HInstruction* elements = NULL;
6018
6019   for (int i = 0; i < length; i++) {
6020     Expression* subexpr = subexprs->at(i);
6021     if (subexpr->IsSpread()) {
6022       return Bailout(kSpread);
6023     }
6024
6025     // If the subexpression is a literal or a simple materialized literal it
6026     // is already set in the cloned array.
6027     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
6028
6029     CHECK_ALIVE(VisitForValue(subexpr));
6030     HValue* value = Pop();
6031     if (!Smi::IsValid(i)) return Bailout(kNonSmiKeyInArrayLiteral);
6032
6033     elements = AddLoadElements(literal);
6034
6035     HValue* key = Add<HConstant>(i);
6036
6037     switch (boilerplate_elements_kind) {
6038       case FAST_SMI_ELEMENTS:
6039       case FAST_HOLEY_SMI_ELEMENTS:
6040       case FAST_ELEMENTS:
6041       case FAST_HOLEY_ELEMENTS:
6042       case FAST_DOUBLE_ELEMENTS:
6043       case FAST_HOLEY_DOUBLE_ELEMENTS: {
6044         HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
6045                                               boilerplate_elements_kind);
6046         instr->SetUninitialized(uninitialized);
6047         break;
6048       }
6049       default:
6050         UNREACHABLE();
6051         break;
6052     }
6053
6054     Add<HSimulate>(expr->GetIdForElement(i));
6055   }
6056
6057   Drop(1);  // array literal index
6058   return ast_context()->ReturnValue(Pop());
6059 }
6060
6061
6062 HCheckMaps* HOptimizedGraphBuilder::AddCheckMap(HValue* object,
6063                                                 Handle<Map> map) {
6064   BuildCheckHeapObject(object);
6065   return Add<HCheckMaps>(object, map);
6066 }
6067
6068
6069 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
6070     PropertyAccessInfo* info,
6071     HValue* checked_object) {
6072   // See if this is a load for an immutable property
6073   if (checked_object->ActualValue()->IsConstant()) {
6074     Handle<Object> object(
6075         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
6076
6077     if (object->IsJSObject()) {
6078       LookupIterator it(object, info->name(),
6079                         LookupIterator::OWN_SKIP_INTERCEPTOR);
6080       Handle<Object> value = JSReceiver::GetDataProperty(&it);
6081       if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
6082         return New<HConstant>(value);
6083       }
6084     }
6085   }
6086
6087   HObjectAccess access = info->access();
6088   if (access.representation().IsDouble() &&
6089       (!FLAG_unbox_double_fields || !access.IsInobject())) {
6090     // Load the heap number.
6091     checked_object = Add<HLoadNamedField>(
6092         checked_object, nullptr,
6093         access.WithRepresentation(Representation::Tagged()));
6094     // Load the double value from it.
6095     access = HObjectAccess::ForHeapNumberValue();
6096   }
6097
6098   SmallMapList* map_list = info->field_maps();
6099   if (map_list->length() == 0) {
6100     return New<HLoadNamedField>(checked_object, checked_object, access);
6101   }
6102
6103   UniqueSet<Map>* maps = new(zone()) UniqueSet<Map>(map_list->length(), zone());
6104   for (int i = 0; i < map_list->length(); ++i) {
6105     maps->Add(Unique<Map>::CreateImmovable(map_list->at(i)), zone());
6106   }
6107   return New<HLoadNamedField>(
6108       checked_object, checked_object, access, maps, info->field_type());
6109 }
6110
6111
6112 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
6113     PropertyAccessInfo* info,
6114     HValue* checked_object,
6115     HValue* value) {
6116   bool transition_to_field = info->IsTransition();
6117   // TODO(verwaest): Move this logic into PropertyAccessInfo.
6118   HObjectAccess field_access = info->access();
6119
6120   HStoreNamedField *instr;
6121   if (field_access.representation().IsDouble() &&
6122       (!FLAG_unbox_double_fields || !field_access.IsInobject())) {
6123     HObjectAccess heap_number_access =
6124         field_access.WithRepresentation(Representation::Tagged());
6125     if (transition_to_field) {
6126       // The store requires a mutable HeapNumber to be allocated.
6127       NoObservableSideEffectsScope no_side_effects(this);
6128       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
6129
6130       // TODO(hpayer): Allocation site pretenuring support.
6131       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
6132           HType::HeapObject(),
6133           NOT_TENURED,
6134           MUTABLE_HEAP_NUMBER_TYPE);
6135       AddStoreMapConstant(
6136           heap_number, isolate()->factory()->mutable_heap_number_map());
6137       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
6138                             value);
6139       instr = New<HStoreNamedField>(checked_object->ActualValue(),
6140                                     heap_number_access,
6141                                     heap_number);
6142     } else {
6143       // Already holds a HeapNumber; load the box and write its value field.
6144       HInstruction* heap_number =
6145           Add<HLoadNamedField>(checked_object, nullptr, heap_number_access);
6146       instr = New<HStoreNamedField>(heap_number,
6147                                     HObjectAccess::ForHeapNumberValue(),
6148                                     value, STORE_TO_INITIALIZED_ENTRY);
6149     }
6150   } else {
6151     if (field_access.representation().IsHeapObject()) {
6152       BuildCheckHeapObject(value);
6153     }
6154
6155     if (!info->field_maps()->is_empty()) {
6156       DCHECK(field_access.representation().IsHeapObject());
6157       value = Add<HCheckMaps>(value, info->field_maps());
6158     }
6159
6160     // This is a normal store.
6161     instr = New<HStoreNamedField>(
6162         checked_object->ActualValue(), field_access, value,
6163         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
6164   }
6165
6166   if (transition_to_field) {
6167     Handle<Map> transition(info->transition());
6168     DCHECK(!transition->is_deprecated());
6169     instr->SetTransition(Add<HConstant>(transition));
6170   }
6171   return instr;
6172 }
6173
6174
6175 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
6176     PropertyAccessInfo* info) {
6177   if (!CanInlinePropertyAccess(map_)) return false;
6178
6179   // Currently only handle Type::Number as a polymorphic case.
6180   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6181   // instruction.
6182   if (IsNumberType()) return false;
6183
6184   // Values are only compatible for monomorphic load if they all behave the same
6185   // regarding value wrappers.
6186   if (IsValueWrapped() != info->IsValueWrapped()) return false;
6187
6188   if (!LookupDescriptor()) return false;
6189
6190   if (!IsFound()) {
6191     return (!info->IsFound() || info->has_holder()) &&
6192            map()->prototype() == info->map()->prototype();
6193   }
6194
6195   // Mismatch if the other access info found the property in the prototype
6196   // chain.
6197   if (info->has_holder()) return false;
6198
6199   if (IsAccessorConstant()) {
6200     return accessor_.is_identical_to(info->accessor_) &&
6201         api_holder_.is_identical_to(info->api_holder_);
6202   }
6203
6204   if (IsDataConstant()) {
6205     return constant_.is_identical_to(info->constant_);
6206   }
6207
6208   DCHECK(IsData());
6209   if (!info->IsData()) return false;
6210
6211   Representation r = access_.representation();
6212   if (IsLoad()) {
6213     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
6214   } else {
6215     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
6216   }
6217   if (info->access_.offset() != access_.offset()) return false;
6218   if (info->access_.IsInobject() != access_.IsInobject()) return false;
6219   if (IsLoad()) {
6220     if (field_maps_.is_empty()) {
6221       info->field_maps_.Clear();
6222     } else if (!info->field_maps_.is_empty()) {
6223       for (int i = 0; i < field_maps_.length(); ++i) {
6224         info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
6225       }
6226       info->field_maps_.Sort();
6227     }
6228   } else {
6229     // We can only merge stores that agree on their field maps. The comparison
6230     // below is safe, since we keep the field maps sorted.
6231     if (field_maps_.length() != info->field_maps_.length()) return false;
6232     for (int i = 0; i < field_maps_.length(); ++i) {
6233       if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
6234         return false;
6235       }
6236     }
6237   }
6238   info->GeneralizeRepresentation(r);
6239   info->field_type_ = info->field_type_.Combine(field_type_);
6240   return true;
6241 }
6242
6243
6244 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
6245   if (!map_->IsJSObjectMap()) return true;
6246   LookupDescriptor(*map_, *name_);
6247   return LoadResult(map_);
6248 }
6249
6250
6251 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
6252   if (!IsLoad() && IsProperty() && IsReadOnly()) {
6253     return false;
6254   }
6255
6256   if (IsData()) {
6257     // Construct the object field access.
6258     int index = GetLocalFieldIndexFromMap(map);
6259     access_ = HObjectAccess::ForField(map, index, representation(), name_);
6260
6261     // Load field map for heap objects.
6262     return LoadFieldMaps(map);
6263   } else if (IsAccessorConstant()) {
6264     Handle<Object> accessors = GetAccessorsFromMap(map);
6265     if (!accessors->IsAccessorPair()) return false;
6266     Object* raw_accessor =
6267         IsLoad() ? Handle<AccessorPair>::cast(accessors)->getter()
6268                  : Handle<AccessorPair>::cast(accessors)->setter();
6269     if (!raw_accessor->IsJSFunction()) return false;
6270     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
6271     if (accessor->shared()->IsApiFunction()) {
6272       CallOptimization call_optimization(accessor);
6273       if (call_optimization.is_simple_api_call()) {
6274         CallOptimization::HolderLookup holder_lookup;
6275         api_holder_ =
6276             call_optimization.LookupHolderOfExpectedType(map_, &holder_lookup);
6277       }
6278     }
6279     accessor_ = accessor;
6280   } else if (IsDataConstant()) {
6281     constant_ = GetConstantFromMap(map);
6282   }
6283
6284   return true;
6285 }
6286
6287
6288 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
6289     Handle<Map> map) {
6290   // Clear any previously collected field maps/type.
6291   field_maps_.Clear();
6292   field_type_ = HType::Tagged();
6293
6294   // Figure out the field type from the accessor map.
6295   Handle<HeapType> field_type = GetFieldTypeFromMap(map);
6296
6297   // Collect the (stable) maps from the field type.
6298   int num_field_maps = field_type->NumClasses();
6299   if (num_field_maps > 0) {
6300     DCHECK(access_.representation().IsHeapObject());
6301     field_maps_.Reserve(num_field_maps, zone());
6302     HeapType::Iterator<Map> it = field_type->Classes();
6303     while (!it.Done()) {
6304       Handle<Map> field_map = it.Current();
6305       if (!field_map->is_stable()) {
6306         field_maps_.Clear();
6307         break;
6308       }
6309       field_maps_.Add(field_map, zone());
6310       it.Advance();
6311     }
6312   }
6313
6314   if (field_maps_.is_empty()) {
6315     // Store is not safe if the field map was cleared.
6316     return IsLoad() || !field_type->Is(HeapType::None());
6317   }
6318
6319   field_maps_.Sort();
6320   DCHECK_EQ(num_field_maps, field_maps_.length());
6321
6322   // Determine field HType from field HeapType.
6323   field_type_ = HType::FromType<HeapType>(field_type);
6324   DCHECK(field_type_.IsHeapObject());
6325
6326   // Add dependency on the map that introduced the field.
6327   top_info()->dependencies()->AssumeFieldType(GetFieldOwnerFromMap(map));
6328   return true;
6329 }
6330
6331
6332 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
6333   Handle<Map> map = this->map();
6334
6335   while (map->prototype()->IsJSObject()) {
6336     holder_ = handle(JSObject::cast(map->prototype()));
6337     if (holder_->map()->is_deprecated()) {
6338       JSObject::TryMigrateInstance(holder_);
6339     }
6340     map = Handle<Map>(holder_->map());
6341     if (!CanInlinePropertyAccess(map)) {
6342       NotFound();
6343       return false;
6344     }
6345     LookupDescriptor(*map, *name_);
6346     if (IsFound()) return LoadResult(map);
6347   }
6348
6349   NotFound();
6350   return !map->prototype()->IsJSReceiver();
6351 }
6352
6353
6354 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsIntegerIndexedExotic() {
6355   InstanceType instance_type = map_->instance_type();
6356   return instance_type == JS_TYPED_ARRAY_TYPE &&
6357          IsSpecialIndex(isolate()->unicode_cache(), *name_);
6358 }
6359
6360
6361 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
6362   if (!CanInlinePropertyAccess(map_)) return false;
6363   if (IsJSObjectFieldAccessor()) return IsLoad();
6364   if (IsJSArrayBufferViewFieldAccessor()) return IsLoad();
6365   if (map_->function_with_prototype() && !map_->has_non_instance_prototype() &&
6366       name_.is_identical_to(isolate()->factory()->prototype_string())) {
6367     return IsLoad();
6368   }
6369   if (!LookupDescriptor()) return false;
6370   if (IsFound()) return IsLoad() || !IsReadOnly();
6371   if (IsIntegerIndexedExotic()) return false;
6372   if (!LookupInPrototypes()) return false;
6373   if (IsLoad()) return true;
6374
6375   if (IsAccessorConstant()) return true;
6376   LookupTransition(*map_, *name_, NONE);
6377   if (IsTransitionToData() && map_->unused_property_fields() > 0) {
6378     // Construct the object field access.
6379     int descriptor = transition()->LastAdded();
6380     int index =
6381         transition()->instance_descriptors()->GetFieldIndex(descriptor) -
6382         map_->GetInObjectProperties();
6383     PropertyDetails details =
6384         transition()->instance_descriptors()->GetDetails(descriptor);
6385     Representation representation = details.representation();
6386     access_ = HObjectAccess::ForField(map_, index, representation, name_);
6387
6388     // Load field map for heap objects.
6389     return LoadFieldMaps(transition());
6390   }
6391   return false;
6392 }
6393
6394
6395 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
6396     SmallMapList* maps) {
6397   DCHECK(map_.is_identical_to(maps->first()));
6398   if (!CanAccessMonomorphic()) return false;
6399   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6400   if (maps->length() > kMaxLoadPolymorphism) return false;
6401   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6402   if (GetJSObjectFieldAccess(&access)) {
6403     for (int i = 1; i < maps->length(); ++i) {
6404       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6405       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6406       if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
6407       if (!access.Equals(test_access)) return false;
6408     }
6409     return true;
6410   }
6411   if (GetJSArrayBufferViewFieldAccess(&access)) {
6412     for (int i = 1; i < maps->length(); ++i) {
6413       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6414       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6415       if (!test_info.GetJSArrayBufferViewFieldAccess(&test_access)) {
6416         return false;
6417       }
6418       if (!access.Equals(test_access)) return false;
6419     }
6420     return true;
6421   }
6422
6423   // Currently only handle numbers as a polymorphic case.
6424   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6425   // instruction.
6426   if (IsNumberType()) return false;
6427
6428   // Multiple maps cannot transition to the same target map.
6429   DCHECK(!IsLoad() || !IsTransition());
6430   if (IsTransition() && maps->length() > 1) return false;
6431
6432   for (int i = 1; i < maps->length(); ++i) {
6433     PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6434     if (!test_info.IsCompatible(this)) return false;
6435   }
6436
6437   return true;
6438 }
6439
6440
6441 Handle<Map> HOptimizedGraphBuilder::PropertyAccessInfo::map() {
6442   JSFunction* ctor = IC::GetRootConstructor(
6443       *map_, current_info()->closure()->context()->native_context());
6444   if (ctor != NULL) return handle(ctor->initial_map());
6445   return map_;
6446 }
6447
6448
6449 static bool NeedsWrapping(Handle<Map> map, Handle<JSFunction> target) {
6450   return !map->IsJSObjectMap() &&
6451          is_sloppy(target->shared()->language_mode()) &&
6452          !target->shared()->native();
6453 }
6454
6455
6456 bool HOptimizedGraphBuilder::PropertyAccessInfo::NeedsWrappingFor(
6457     Handle<JSFunction> target) const {
6458   return NeedsWrapping(map_, target);
6459 }
6460
6461
6462 HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
6463     PropertyAccessInfo* info, HValue* object, HValue* checked_object,
6464     HValue* value, BailoutId ast_id, BailoutId return_id,
6465     bool can_inline_accessor) {
6466   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6467   if (info->GetJSObjectFieldAccess(&access)) {
6468     DCHECK(info->IsLoad());
6469     return New<HLoadNamedField>(object, checked_object, access);
6470   }
6471
6472   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
6473     DCHECK(info->IsLoad());
6474     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
6475     return New<HLoadNamedField>(object, checked_object, access);
6476   }
6477
6478   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
6479       info->map()->function_with_prototype()) {
6480     DCHECK(!info->map()->has_non_instance_prototype());
6481     return New<HLoadFunctionPrototype>(checked_object);
6482   }
6483
6484   HValue* checked_holder = checked_object;
6485   if (info->has_holder()) {
6486     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
6487     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
6488   }
6489
6490   if (!info->IsFound()) {
6491     DCHECK(info->IsLoad());
6492     if (is_strong(function_language_mode())) {
6493       return New<HCallRuntime>(
6494           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
6495           0);
6496     } else {
6497       return graph()->GetConstantUndefined();
6498     }
6499   }
6500
6501   if (info->IsData()) {
6502     if (info->IsLoad()) {
6503       return BuildLoadNamedField(info, checked_holder);
6504     } else {
6505       return BuildStoreNamedField(info, checked_object, value);
6506     }
6507   }
6508
6509   if (info->IsTransition()) {
6510     DCHECK(!info->IsLoad());
6511     return BuildStoreNamedField(info, checked_object, value);
6512   }
6513
6514   if (info->IsAccessorConstant()) {
6515     Push(checked_object);
6516     int argument_count = 1;
6517     if (!info->IsLoad()) {
6518       argument_count = 2;
6519       Push(value);
6520     }
6521
6522     if (info->NeedsWrappingFor(info->accessor())) {
6523       HValue* function = Add<HConstant>(info->accessor());
6524       PushArgumentsFromEnvironment(argument_count);
6525       return New<HCallFunction>(function, argument_count, WRAP_AND_CALL);
6526     } else if (FLAG_inline_accessors && can_inline_accessor) {
6527       bool success = info->IsLoad()
6528           ? TryInlineGetter(info->accessor(), info->map(), ast_id, return_id)
6529           : TryInlineSetter(
6530               info->accessor(), info->map(), ast_id, return_id, value);
6531       if (success || HasStackOverflow()) return NULL;
6532     }
6533
6534     PushArgumentsFromEnvironment(argument_count);
6535     return BuildCallConstantFunction(info->accessor(), argument_count);
6536   }
6537
6538   DCHECK(info->IsDataConstant());
6539   if (info->IsLoad()) {
6540     return New<HConstant>(info->constant());
6541   } else {
6542     return New<HCheckValue>(value, Handle<JSFunction>::cast(info->constant()));
6543   }
6544 }
6545
6546
6547 void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
6548     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
6549     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* value,
6550     SmallMapList* maps, Handle<String> name) {
6551   // Something did not match; must use a polymorphic load.
6552   int count = 0;
6553   HBasicBlock* join = NULL;
6554   HBasicBlock* number_block = NULL;
6555   bool handled_string = false;
6556
6557   bool handle_smi = false;
6558   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6559   int i;
6560   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6561     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6562     if (info.IsStringType()) {
6563       if (handled_string) continue;
6564       handled_string = true;
6565     }
6566     if (info.CanAccessMonomorphic()) {
6567       count++;
6568       if (info.IsNumberType()) {
6569         handle_smi = true;
6570         break;
6571       }
6572     }
6573   }
6574
6575   if (i < maps->length()) {
6576     count = -1;
6577     maps->Clear();
6578   } else {
6579     count = 0;
6580   }
6581   HControlInstruction* smi_check = NULL;
6582   handled_string = false;
6583
6584   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6585     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6586     if (info.IsStringType()) {
6587       if (handled_string) continue;
6588       handled_string = true;
6589     }
6590     if (!info.CanAccessMonomorphic()) continue;
6591
6592     if (count == 0) {
6593       join = graph()->CreateBasicBlock();
6594       if (handle_smi) {
6595         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
6596         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
6597         number_block = graph()->CreateBasicBlock();
6598         smi_check = New<HIsSmiAndBranch>(
6599             object, empty_smi_block, not_smi_block);
6600         FinishCurrentBlock(smi_check);
6601         GotoNoSimulate(empty_smi_block, number_block);
6602         set_current_block(not_smi_block);
6603       } else {
6604         BuildCheckHeapObject(object);
6605       }
6606     }
6607     ++count;
6608     HBasicBlock* if_true = graph()->CreateBasicBlock();
6609     HBasicBlock* if_false = graph()->CreateBasicBlock();
6610     HUnaryControlInstruction* compare;
6611
6612     HValue* dependency;
6613     if (info.IsNumberType()) {
6614       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
6615       compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
6616       dependency = smi_check;
6617     } else if (info.IsStringType()) {
6618       compare = New<HIsStringAndBranch>(object, if_true, if_false);
6619       dependency = compare;
6620     } else {
6621       compare = New<HCompareMap>(object, info.map(), if_true, if_false);
6622       dependency = compare;
6623     }
6624     FinishCurrentBlock(compare);
6625
6626     if (info.IsNumberType()) {
6627       GotoNoSimulate(if_true, number_block);
6628       if_true = number_block;
6629     }
6630
6631     set_current_block(if_true);
6632
6633     HValue* access =
6634         BuildMonomorphicAccess(&info, object, dependency, value, ast_id,
6635                                return_id, FLAG_polymorphic_inlining);
6636
6637     HValue* result = NULL;
6638     switch (access_type) {
6639       case LOAD:
6640         result = access;
6641         break;
6642       case STORE:
6643         result = value;
6644         break;
6645     }
6646
6647     if (access == NULL) {
6648       if (HasStackOverflow()) return;
6649     } else {
6650       if (access->IsInstruction()) {
6651         HInstruction* instr = HInstruction::cast(access);
6652         if (!instr->IsLinked()) AddInstruction(instr);
6653       }
6654       if (!ast_context()->IsEffect()) Push(result);
6655     }
6656
6657     if (current_block() != NULL) Goto(join);
6658     set_current_block(if_false);
6659   }
6660
6661   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
6662   // know about and do not want to handle ones we've never seen.  Otherwise
6663   // use a generic IC.
6664   if (count == maps->length() && FLAG_deoptimize_uncommon_cases) {
6665     FinishExitWithHardDeoptimization(
6666         Deoptimizer::kUnknownMapInPolymorphicAccess);
6667   } else {
6668     HInstruction* instr =
6669         BuildNamedGeneric(access_type, expr, slot, object, name, value);
6670     AddInstruction(instr);
6671     if (!ast_context()->IsEffect()) Push(access_type == LOAD ? instr : value);
6672
6673     if (join != NULL) {
6674       Goto(join);
6675     } else {
6676       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6677       if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6678       return;
6679     }
6680   }
6681
6682   DCHECK(join != NULL);
6683   if (join->HasPredecessor()) {
6684     join->SetJoinId(ast_id);
6685     set_current_block(join);
6686     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6687   } else {
6688     set_current_block(NULL);
6689   }
6690 }
6691
6692
6693 static bool ComputeReceiverTypes(Expression* expr,
6694                                  HValue* receiver,
6695                                  SmallMapList** t,
6696                                  Zone* zone) {
6697   SmallMapList* maps = expr->GetReceiverTypes();
6698   *t = maps;
6699   bool monomorphic = expr->IsMonomorphic();
6700   if (maps != NULL && receiver->HasMonomorphicJSObjectType()) {
6701     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
6702     maps->FilterForPossibleTransitions(root_map);
6703     monomorphic = maps->length() == 1;
6704   }
6705   return monomorphic && CanInlinePropertyAccess(maps->first());
6706 }
6707
6708
6709 static bool AreStringTypes(SmallMapList* maps) {
6710   for (int i = 0; i < maps->length(); i++) {
6711     if (maps->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
6712   }
6713   return true;
6714 }
6715
6716
6717 void HOptimizedGraphBuilder::BuildStore(Expression* expr, Property* prop,
6718                                         FeedbackVectorICSlot slot,
6719                                         BailoutId ast_id, BailoutId return_id,
6720                                         bool is_uninitialized) {
6721   if (!prop->key()->IsPropertyName()) {
6722     // Keyed store.
6723     HValue* value = Pop();
6724     HValue* key = Pop();
6725     HValue* object = Pop();
6726     bool has_side_effects = false;
6727     HValue* result =
6728         HandleKeyedElementAccess(object, key, value, expr, slot, ast_id,
6729                                  return_id, STORE, &has_side_effects);
6730     if (has_side_effects) {
6731       if (!ast_context()->IsEffect()) Push(value);
6732       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6733       if (!ast_context()->IsEffect()) Drop(1);
6734     }
6735     if (result == NULL) return;
6736     return ast_context()->ReturnValue(value);
6737   }
6738
6739   // Named store.
6740   HValue* value = Pop();
6741   HValue* object = Pop();
6742
6743   Literal* key = prop->key()->AsLiteral();
6744   Handle<String> name = Handle<String>::cast(key->value());
6745   DCHECK(!name.is_null());
6746
6747   HValue* access = BuildNamedAccess(STORE, ast_id, return_id, expr, slot,
6748                                     object, name, value, is_uninitialized);
6749   if (access == NULL) return;
6750
6751   if (!ast_context()->IsEffect()) Push(value);
6752   if (access->IsInstruction()) AddInstruction(HInstruction::cast(access));
6753   if (access->HasObservableSideEffects()) {
6754     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6755   }
6756   if (!ast_context()->IsEffect()) Drop(1);
6757   return ast_context()->ReturnValue(value);
6758 }
6759
6760
6761 void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
6762   Property* prop = expr->target()->AsProperty();
6763   DCHECK(prop != NULL);
6764   CHECK_ALIVE(VisitForValue(prop->obj()));
6765   if (!prop->key()->IsPropertyName()) {
6766     CHECK_ALIVE(VisitForValue(prop->key()));
6767   }
6768   CHECK_ALIVE(VisitForValue(expr->value()));
6769   BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
6770              expr->AssignmentId(), expr->IsUninitialized());
6771 }
6772
6773
6774 // Because not every expression has a position and there is not common
6775 // superclass of Assignment and CountOperation, we cannot just pass the
6776 // owning expression instead of position and ast_id separately.
6777 void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
6778     Variable* var, HValue* value, FeedbackVectorICSlot ic_slot,
6779     BailoutId ast_id) {
6780   Handle<GlobalObject> global(current_info()->global_object());
6781
6782   // Lookup in script contexts.
6783   {
6784     Handle<ScriptContextTable> script_contexts(
6785         global->native_context()->script_context_table());
6786     ScriptContextTable::LookupResult lookup;
6787     if (ScriptContextTable::Lookup(script_contexts, var->name(), &lookup)) {
6788       if (lookup.mode == CONST) {
6789         return Bailout(kNonInitializerAssignmentToConst);
6790       }
6791       Handle<Context> script_context =
6792           ScriptContextTable::GetContext(script_contexts, lookup.context_index);
6793
6794       Handle<Object> current_value =
6795           FixedArray::get(script_context, lookup.slot_index);
6796
6797       // If the values is not the hole, it will stay initialized,
6798       // so no need to generate a check.
6799       if (*current_value == *isolate()->factory()->the_hole_value()) {
6800         return Bailout(kReferenceToUninitializedVariable);
6801       }
6802
6803       HStoreNamedField* instr = Add<HStoreNamedField>(
6804           Add<HConstant>(script_context),
6805           HObjectAccess::ForContextSlot(lookup.slot_index), value);
6806       USE(instr);
6807       DCHECK(instr->HasObservableSideEffects());
6808       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6809       return;
6810     }
6811   }
6812
6813   LookupIterator it(global, var->name(), LookupIterator::OWN);
6814   GlobalPropertyAccess type = LookupGlobalProperty(var, &it, STORE);
6815   if (type == kUseCell) {
6816     Handle<PropertyCell> cell = it.GetPropertyCell();
6817     top_info()->dependencies()->AssumePropertyCell(cell);
6818     auto cell_type = it.property_details().cell_type();
6819     if (cell_type == PropertyCellType::kConstant ||
6820         cell_type == PropertyCellType::kUndefined) {
6821       Handle<Object> constant(cell->value(), isolate());
6822       if (value->IsConstant()) {
6823         HConstant* c_value = HConstant::cast(value);
6824         if (!constant.is_identical_to(c_value->handle(isolate()))) {
6825           Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6826                            Deoptimizer::EAGER);
6827         }
6828       } else {
6829         HValue* c_constant = Add<HConstant>(constant);
6830         IfBuilder builder(this);
6831         if (constant->IsNumber()) {
6832           builder.If<HCompareNumericAndBranch>(value, c_constant, Token::EQ);
6833         } else {
6834           builder.If<HCompareObjectEqAndBranch>(value, c_constant);
6835         }
6836         builder.Then();
6837         builder.Else();
6838         Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6839                          Deoptimizer::EAGER);
6840         builder.End();
6841       }
6842     }
6843     HConstant* cell_constant = Add<HConstant>(cell);
6844     auto access = HObjectAccess::ForPropertyCellValue();
6845     if (cell_type == PropertyCellType::kConstantType) {
6846       switch (cell->GetConstantType()) {
6847         case PropertyCellConstantType::kSmi:
6848           access = access.WithRepresentation(Representation::Smi());
6849           break;
6850         case PropertyCellConstantType::kStableMap: {
6851           // The map may no longer be stable, deopt if it's ever different from
6852           // what is currently there, which will allow for restablization.
6853           Handle<Map> map(HeapObject::cast(cell->value())->map());
6854           Add<HCheckHeapObject>(value);
6855           value = Add<HCheckMaps>(value, map);
6856           access = access.WithRepresentation(Representation::HeapObject());
6857           break;
6858         }
6859       }
6860     }
6861     HInstruction* instr = Add<HStoreNamedField>(cell_constant, access, value);
6862     instr->ClearChangesFlag(kInobjectFields);
6863     instr->SetChangesFlag(kGlobalVars);
6864     if (instr->HasObservableSideEffects()) {
6865       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6866     }
6867   } else if (var->IsGlobalSlot()) {
6868     DCHECK(var->index() > 0);
6869     DCHECK(var->IsStaticGlobalObjectProperty());
6870     int slot_index = var->index();
6871     int depth = scope()->ContextChainLength(var->scope());
6872
6873     HStoreGlobalViaContext* instr = Add<HStoreGlobalViaContext>(
6874         value, depth, slot_index, function_language_mode());
6875     USE(instr);
6876     DCHECK(instr->HasObservableSideEffects());
6877     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6878
6879   } else {
6880     HValue* global_object = Add<HLoadNamedField>(
6881         context(), nullptr,
6882         HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
6883     HStoreNamedGeneric* instr =
6884         Add<HStoreNamedGeneric>(global_object, var->name(), value,
6885                                 function_language_mode(), PREMONOMORPHIC);
6886     if (FLAG_vector_stores) {
6887       Handle<TypeFeedbackVector> vector =
6888           handle(current_feedback_vector(), isolate());
6889       instr->SetVectorAndSlot(vector, ic_slot);
6890     }
6891     USE(instr);
6892     DCHECK(instr->HasObservableSideEffects());
6893     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6894   }
6895 }
6896
6897
6898 void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
6899   Expression* target = expr->target();
6900   VariableProxy* proxy = target->AsVariableProxy();
6901   Property* prop = target->AsProperty();
6902   DCHECK(proxy == NULL || prop == NULL);
6903
6904   // We have a second position recorded in the FullCodeGenerator to have
6905   // type feedback for the binary operation.
6906   BinaryOperation* operation = expr->binary_operation();
6907
6908   if (proxy != NULL) {
6909     Variable* var = proxy->var();
6910     if (var->mode() == LET)  {
6911       return Bailout(kUnsupportedLetCompoundAssignment);
6912     }
6913
6914     CHECK_ALIVE(VisitForValue(operation));
6915
6916     switch (var->location()) {
6917       case VariableLocation::GLOBAL:
6918       case VariableLocation::UNALLOCATED:
6919         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
6920                                        expr->AssignmentId());
6921         break;
6922
6923       case VariableLocation::PARAMETER:
6924       case VariableLocation::LOCAL:
6925         if (var->mode() == CONST_LEGACY)  {
6926           return Bailout(kUnsupportedConstCompoundAssignment);
6927         }
6928         if (var->mode() == CONST) {
6929           return Bailout(kNonInitializerAssignmentToConst);
6930         }
6931         BindIfLive(var, Top());
6932         break;
6933
6934       case VariableLocation::CONTEXT: {
6935         // Bail out if we try to mutate a parameter value in a function
6936         // using the arguments object.  We do not (yet) correctly handle the
6937         // arguments property of the function.
6938         if (current_info()->scope()->arguments() != NULL) {
6939           // Parameters will be allocated to context slots.  We have no
6940           // direct way to detect that the variable is a parameter so we do
6941           // a linear search of the parameter variables.
6942           int count = current_info()->scope()->num_parameters();
6943           for (int i = 0; i < count; ++i) {
6944             if (var == current_info()->scope()->parameter(i)) {
6945               Bailout(kAssignmentToParameterFunctionUsesArgumentsObject);
6946             }
6947           }
6948         }
6949
6950         HStoreContextSlot::Mode mode;
6951
6952         switch (var->mode()) {
6953           case LET:
6954             mode = HStoreContextSlot::kCheckDeoptimize;
6955             break;
6956           case CONST:
6957             return Bailout(kNonInitializerAssignmentToConst);
6958           case CONST_LEGACY:
6959             return ast_context()->ReturnValue(Pop());
6960           default:
6961             mode = HStoreContextSlot::kNoCheck;
6962         }
6963
6964         HValue* context = BuildContextChainWalk(var);
6965         HStoreContextSlot* instr = Add<HStoreContextSlot>(
6966             context, var->index(), mode, Top());
6967         if (instr->HasObservableSideEffects()) {
6968           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
6969         }
6970         break;
6971       }
6972
6973       case VariableLocation::LOOKUP:
6974         return Bailout(kCompoundAssignmentToLookupSlot);
6975     }
6976     return ast_context()->ReturnValue(Pop());
6977
6978   } else if (prop != NULL) {
6979     CHECK_ALIVE(VisitForValue(prop->obj()));
6980     HValue* object = Top();
6981     HValue* key = NULL;
6982     if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
6983       CHECK_ALIVE(VisitForValue(prop->key()));
6984       key = Top();
6985     }
6986
6987     CHECK_ALIVE(PushLoad(prop, object, key));
6988
6989     CHECK_ALIVE(VisitForValue(expr->value()));
6990     HValue* right = Pop();
6991     HValue* left = Pop();
6992
6993     Push(BuildBinaryOperation(operation, left, right, PUSH_BEFORE_SIMULATE));
6994
6995     BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
6996                expr->AssignmentId(), expr->IsUninitialized());
6997   } else {
6998     return Bailout(kInvalidLhsInCompoundAssignment);
6999   }
7000 }
7001
7002
7003 void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
7004   DCHECK(!HasStackOverflow());
7005   DCHECK(current_block() != NULL);
7006   DCHECK(current_block()->HasPredecessor());
7007   VariableProxy* proxy = expr->target()->AsVariableProxy();
7008   Property* prop = expr->target()->AsProperty();
7009   DCHECK(proxy == NULL || prop == NULL);
7010
7011   if (expr->is_compound()) {
7012     HandleCompoundAssignment(expr);
7013     return;
7014   }
7015
7016   if (prop != NULL) {
7017     HandlePropertyAssignment(expr);
7018   } else if (proxy != NULL) {
7019     Variable* var = proxy->var();
7020
7021     if (var->mode() == CONST) {
7022       if (expr->op() != Token::INIT_CONST) {
7023         return Bailout(kNonInitializerAssignmentToConst);
7024       }
7025     } else if (var->mode() == CONST_LEGACY) {
7026       if (expr->op() != Token::INIT_CONST_LEGACY) {
7027         CHECK_ALIVE(VisitForValue(expr->value()));
7028         return ast_context()->ReturnValue(Pop());
7029       }
7030
7031       if (var->IsStackAllocated()) {
7032         // We insert a use of the old value to detect unsupported uses of const
7033         // variables (e.g. initialization inside a loop).
7034         HValue* old_value = environment()->Lookup(var);
7035         Add<HUseConst>(old_value);
7036       }
7037     }
7038
7039     if (proxy->IsArguments()) return Bailout(kAssignmentToArguments);
7040
7041     // Handle the assignment.
7042     switch (var->location()) {
7043       case VariableLocation::GLOBAL:
7044       case VariableLocation::UNALLOCATED:
7045         CHECK_ALIVE(VisitForValue(expr->value()));
7046         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
7047                                        expr->AssignmentId());
7048         return ast_context()->ReturnValue(Pop());
7049
7050       case VariableLocation::PARAMETER:
7051       case VariableLocation::LOCAL: {
7052         // Perform an initialization check for let declared variables
7053         // or parameters.
7054         if (var->mode() == LET && expr->op() == Token::ASSIGN) {
7055           HValue* env_value = environment()->Lookup(var);
7056           if (env_value == graph()->GetConstantHole()) {
7057             return Bailout(kAssignmentToLetVariableBeforeInitialization);
7058           }
7059         }
7060         // We do not allow the arguments object to occur in a context where it
7061         // may escape, but assignments to stack-allocated locals are
7062         // permitted.
7063         CHECK_ALIVE(VisitForValue(expr->value(), ARGUMENTS_ALLOWED));
7064         HValue* value = Pop();
7065         BindIfLive(var, value);
7066         return ast_context()->ReturnValue(value);
7067       }
7068
7069       case VariableLocation::CONTEXT: {
7070         // Bail out if we try to mutate a parameter value in a function using
7071         // the arguments object.  We do not (yet) correctly handle the
7072         // arguments property of the function.
7073         if (current_info()->scope()->arguments() != NULL) {
7074           // Parameters will rewrite to context slots.  We have no direct way
7075           // to detect that the variable is a parameter.
7076           int count = current_info()->scope()->num_parameters();
7077           for (int i = 0; i < count; ++i) {
7078             if (var == current_info()->scope()->parameter(i)) {
7079               return Bailout(kAssignmentToParameterInArgumentsObject);
7080             }
7081           }
7082         }
7083
7084         CHECK_ALIVE(VisitForValue(expr->value()));
7085         HStoreContextSlot::Mode mode;
7086         if (expr->op() == Token::ASSIGN) {
7087           switch (var->mode()) {
7088             case LET:
7089               mode = HStoreContextSlot::kCheckDeoptimize;
7090               break;
7091             case CONST:
7092               // This case is checked statically so no need to
7093               // perform checks here
7094               UNREACHABLE();
7095             case CONST_LEGACY:
7096               return ast_context()->ReturnValue(Pop());
7097             default:
7098               mode = HStoreContextSlot::kNoCheck;
7099           }
7100         } else if (expr->op() == Token::INIT_VAR ||
7101                    expr->op() == Token::INIT_LET ||
7102                    expr->op() == Token::INIT_CONST) {
7103           mode = HStoreContextSlot::kNoCheck;
7104         } else {
7105           DCHECK(expr->op() == Token::INIT_CONST_LEGACY);
7106
7107           mode = HStoreContextSlot::kCheckIgnoreAssignment;
7108         }
7109
7110         HValue* context = BuildContextChainWalk(var);
7111         HStoreContextSlot* instr = Add<HStoreContextSlot>(
7112             context, var->index(), mode, Top());
7113         if (instr->HasObservableSideEffects()) {
7114           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
7115         }
7116         return ast_context()->ReturnValue(Pop());
7117       }
7118
7119       case VariableLocation::LOOKUP:
7120         return Bailout(kAssignmentToLOOKUPVariable);
7121     }
7122   } else {
7123     return Bailout(kInvalidLeftHandSideInAssignment);
7124   }
7125 }
7126
7127
7128 void HOptimizedGraphBuilder::VisitYield(Yield* expr) {
7129   // Generators are not optimized, so we should never get here.
7130   UNREACHABLE();
7131 }
7132
7133
7134 void HOptimizedGraphBuilder::VisitThrow(Throw* expr) {
7135   DCHECK(!HasStackOverflow());
7136   DCHECK(current_block() != NULL);
7137   DCHECK(current_block()->HasPredecessor());
7138   if (!ast_context()->IsEffect()) {
7139     // The parser turns invalid left-hand sides in assignments into throw
7140     // statements, which may not be in effect contexts. We might still try
7141     // to optimize such functions; bail out now if we do.
7142     return Bailout(kInvalidLeftHandSideInAssignment);
7143   }
7144   CHECK_ALIVE(VisitForValue(expr->exception()));
7145
7146   HValue* value = environment()->Pop();
7147   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
7148   Add<HPushArguments>(value);
7149   Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kThrow), 1);
7150   Add<HSimulate>(expr->id());
7151
7152   // If the throw definitely exits the function, we can finish with a dummy
7153   // control flow at this point.  This is not the case if the throw is inside
7154   // an inlined function which may be replaced.
7155   if (call_context() == NULL) {
7156     FinishExitCurrentBlock(New<HAbnormalExit>());
7157   }
7158 }
7159
7160
7161 HInstruction* HGraphBuilder::AddLoadStringInstanceType(HValue* string) {
7162   if (string->IsConstant()) {
7163     HConstant* c_string = HConstant::cast(string);
7164     if (c_string->HasStringValue()) {
7165       return Add<HConstant>(c_string->StringValue()->map()->instance_type());
7166     }
7167   }
7168   return Add<HLoadNamedField>(
7169       Add<HLoadNamedField>(string, nullptr, HObjectAccess::ForMap()), nullptr,
7170       HObjectAccess::ForMapInstanceType());
7171 }
7172
7173
7174 HInstruction* HGraphBuilder::AddLoadStringLength(HValue* string) {
7175   return AddInstruction(BuildLoadStringLength(string));
7176 }
7177
7178
7179 HInstruction* HGraphBuilder::BuildLoadStringLength(HValue* string) {
7180   if (string->IsConstant()) {
7181     HConstant* c_string = HConstant::cast(string);
7182     if (c_string->HasStringValue()) {
7183       return New<HConstant>(c_string->StringValue()->length());
7184     }
7185   }
7186   return New<HLoadNamedField>(string, nullptr,
7187                               HObjectAccess::ForStringLength());
7188 }
7189
7190
7191 HInstruction* HOptimizedGraphBuilder::BuildNamedGeneric(
7192     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7193     HValue* object, Handle<Name> name, HValue* value, bool is_uninitialized) {
7194   if (is_uninitialized) {
7195     Add<HDeoptimize>(
7196         Deoptimizer::kInsufficientTypeFeedbackForGenericNamedAccess,
7197         Deoptimizer::SOFT);
7198   }
7199   if (access_type == LOAD) {
7200     Handle<TypeFeedbackVector> vector =
7201         handle(current_feedback_vector(), isolate());
7202
7203     if (!expr->AsProperty()->key()->IsPropertyName()) {
7204       // It's possible that a keyed load of a constant string was converted
7205       // to a named load. Here, at the last minute, we need to make sure to
7206       // use a generic Keyed Load if we are using the type vector, because
7207       // it has to share information with full code.
7208       HConstant* key = Add<HConstant>(name);
7209       HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7210           object, key, function_language_mode(), PREMONOMORPHIC);
7211       result->SetVectorAndSlot(vector, slot);
7212       return result;
7213     }
7214
7215     HLoadNamedGeneric* result = New<HLoadNamedGeneric>(
7216         object, name, function_language_mode(), PREMONOMORPHIC);
7217     result->SetVectorAndSlot(vector, slot);
7218     return result;
7219   } else {
7220     if (FLAG_vector_stores &&
7221         current_feedback_vector()->GetKind(slot) == Code::KEYED_STORE_IC) {
7222       // It's possible that a keyed store of a constant string was converted
7223       // to a named store. Here, at the last minute, we need to make sure to
7224       // use a generic Keyed Store if we are using the type vector, because
7225       // it has to share information with full code.
7226       HConstant* key = Add<HConstant>(name);
7227       HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7228           object, key, value, function_language_mode(), PREMONOMORPHIC);
7229       Handle<TypeFeedbackVector> vector =
7230           handle(current_feedback_vector(), isolate());
7231       result->SetVectorAndSlot(vector, slot);
7232       return result;
7233     }
7234
7235     HStoreNamedGeneric* result = New<HStoreNamedGeneric>(
7236         object, name, value, function_language_mode(), PREMONOMORPHIC);
7237     if (FLAG_vector_stores) {
7238       Handle<TypeFeedbackVector> vector =
7239           handle(current_feedback_vector(), isolate());
7240       result->SetVectorAndSlot(vector, slot);
7241     }
7242     return result;
7243   }
7244 }
7245
7246
7247 HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
7248     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7249     HValue* object, HValue* key, HValue* value) {
7250   if (access_type == LOAD) {
7251     InlineCacheState initial_state = expr->AsProperty()->GetInlineCacheState();
7252     HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7253         object, key, function_language_mode(), initial_state);
7254     // HLoadKeyedGeneric with vector ics benefits from being encoded as
7255     // MEGAMORPHIC because the vector/slot combo becomes unnecessary.
7256     if (initial_state != MEGAMORPHIC) {
7257       // We need to pass vector information.
7258       Handle<TypeFeedbackVector> vector =
7259           handle(current_feedback_vector(), isolate());
7260       result->SetVectorAndSlot(vector, slot);
7261     }
7262     return result;
7263   } else {
7264     HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7265         object, key, value, function_language_mode(), PREMONOMORPHIC);
7266     if (FLAG_vector_stores) {
7267       Handle<TypeFeedbackVector> vector =
7268           handle(current_feedback_vector(), isolate());
7269       result->SetVectorAndSlot(vector, slot);
7270     }
7271     return result;
7272   }
7273 }
7274
7275
7276 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
7277   // Loads from a "stock" fast holey double arrays can elide the hole check.
7278   // Loads from a "stock" fast holey array can convert the hole to undefined
7279   // with impunity.
7280   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
7281   bool holey_double_elements =
7282       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
7283   bool holey_elements =
7284       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
7285   if ((holey_double_elements || holey_elements) &&
7286       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
7287     load_mode =
7288         holey_double_elements ? ALLOW_RETURN_HOLE : CONVERT_HOLE_TO_UNDEFINED;
7289
7290     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
7291     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
7292     BuildCheckPrototypeMaps(prototype, object_prototype);
7293     graph()->MarkDependsOnEmptyArrayProtoElements();
7294   }
7295   return load_mode;
7296 }
7297
7298
7299 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
7300     HValue* object,
7301     HValue* key,
7302     HValue* val,
7303     HValue* dependency,
7304     Handle<Map> map,
7305     PropertyAccessType access_type,
7306     KeyedAccessStoreMode store_mode) {
7307   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
7308
7309   if (access_type == STORE && map->prototype()->IsJSObject()) {
7310     // monomorphic stores need a prototype chain check because shape
7311     // changes could allow callbacks on elements in the chain that
7312     // aren't compatible with monomorphic keyed stores.
7313     PrototypeIterator iter(map);
7314     JSObject* holder = NULL;
7315     while (!iter.IsAtEnd()) {
7316       holder = JSObject::cast(*PrototypeIterator::GetCurrent(iter));
7317       iter.Advance();
7318     }
7319     DCHECK(holder && holder->IsJSObject());
7320
7321     BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
7322                             Handle<JSObject>(holder));
7323   }
7324
7325   LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7326   return BuildUncheckedMonomorphicElementAccess(
7327       checked_object, key, val,
7328       map->instance_type() == JS_ARRAY_TYPE,
7329       map->elements_kind(), access_type,
7330       load_mode, store_mode);
7331 }
7332
7333
7334 static bool CanInlineElementAccess(Handle<Map> map) {
7335   return map->IsJSObjectMap() && !map->has_dictionary_elements() &&
7336          !map->has_sloppy_arguments_elements() &&
7337          !map->has_indexed_interceptor() && !map->is_access_check_needed();
7338 }
7339
7340
7341 HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
7342     HValue* object,
7343     HValue* key,
7344     HValue* val,
7345     SmallMapList* maps) {
7346   // For polymorphic loads of similar elements kinds (i.e. all tagged or all
7347   // double), always use the "worst case" code without a transition.  This is
7348   // much faster than transitioning the elements to the worst case, trading a
7349   // HTransitionElements for a HCheckMaps, and avoiding mutation of the array.
7350   bool has_double_maps = false;
7351   bool has_smi_or_object_maps = false;
7352   bool has_js_array_access = false;
7353   bool has_non_js_array_access = false;
7354   bool has_seen_holey_elements = false;
7355   Handle<Map> most_general_consolidated_map;
7356   for (int i = 0; i < maps->length(); ++i) {
7357     Handle<Map> map = maps->at(i);
7358     if (!CanInlineElementAccess(map)) return NULL;
7359     // Don't allow mixing of JSArrays with JSObjects.
7360     if (map->instance_type() == JS_ARRAY_TYPE) {
7361       if (has_non_js_array_access) return NULL;
7362       has_js_array_access = true;
7363     } else if (has_js_array_access) {
7364       return NULL;
7365     } else {
7366       has_non_js_array_access = true;
7367     }
7368     // Don't allow mixed, incompatible elements kinds.
7369     if (map->has_fast_double_elements()) {
7370       if (has_smi_or_object_maps) return NULL;
7371       has_double_maps = true;
7372     } else if (map->has_fast_smi_or_object_elements()) {
7373       if (has_double_maps) return NULL;
7374       has_smi_or_object_maps = true;
7375     } else {
7376       return NULL;
7377     }
7378     // Remember if we've ever seen holey elements.
7379     if (IsHoleyElementsKind(map->elements_kind())) {
7380       has_seen_holey_elements = true;
7381     }
7382     // Remember the most general elements kind, the code for its load will
7383     // properly handle all of the more specific cases.
7384     if ((i == 0) || IsMoreGeneralElementsKindTransition(
7385             most_general_consolidated_map->elements_kind(),
7386             map->elements_kind())) {
7387       most_general_consolidated_map = map;
7388     }
7389   }
7390   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
7391
7392   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
7393   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
7394   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
7395   ElementsKind consolidated_elements_kind = has_seen_holey_elements
7396       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
7397       : most_general_consolidated_map->elements_kind();
7398   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
7399       checked_object, key, val,
7400       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
7401       consolidated_elements_kind,
7402       LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
7403   return instr;
7404 }
7405
7406
7407 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
7408     Expression* expr, FeedbackVectorICSlot slot, HValue* object, HValue* key,
7409     HValue* val, SmallMapList* maps, PropertyAccessType access_type,
7410     KeyedAccessStoreMode store_mode, bool* has_side_effects) {
7411   *has_side_effects = false;
7412   BuildCheckHeapObject(object);
7413
7414   if (access_type == LOAD) {
7415     HInstruction* consolidated_load =
7416         TryBuildConsolidatedElementLoad(object, key, val, maps);
7417     if (consolidated_load != NULL) {
7418       *has_side_effects |= consolidated_load->HasObservableSideEffects();
7419       return consolidated_load;
7420     }
7421   }
7422
7423   // Elements_kind transition support.
7424   MapHandleList transition_target(maps->length());
7425   // Collect possible transition targets.
7426   MapHandleList possible_transitioned_maps(maps->length());
7427   for (int i = 0; i < maps->length(); ++i) {
7428     Handle<Map> map = maps->at(i);
7429     // Loads from strings or loads with a mix of string and non-string maps
7430     // shouldn't be handled polymorphically.
7431     DCHECK(access_type != LOAD || !map->IsStringMap());
7432     ElementsKind elements_kind = map->elements_kind();
7433     if (CanInlineElementAccess(map) && IsFastElementsKind(elements_kind) &&
7434         elements_kind != GetInitialFastElementsKind()) {
7435       possible_transitioned_maps.Add(map);
7436     }
7437     if (IsSloppyArgumentsElements(elements_kind)) {
7438       HInstruction* result =
7439           BuildKeyedGeneric(access_type, expr, slot, object, key, val);
7440       *has_side_effects = result->HasObservableSideEffects();
7441       return AddInstruction(result);
7442     }
7443   }
7444   // Get transition target for each map (NULL == no transition).
7445   for (int i = 0; i < maps->length(); ++i) {
7446     Handle<Map> map = maps->at(i);
7447     Handle<Map> transitioned_map =
7448         Map::FindTransitionedMap(map, &possible_transitioned_maps);
7449     transition_target.Add(transitioned_map);
7450   }
7451
7452   MapHandleList untransitionable_maps(maps->length());
7453   HTransitionElementsKind* transition = NULL;
7454   for (int i = 0; i < maps->length(); ++i) {
7455     Handle<Map> map = maps->at(i);
7456     DCHECK(map->IsMap());
7457     if (!transition_target.at(i).is_null()) {
7458       DCHECK(Map::IsValidElementsTransition(
7459           map->elements_kind(),
7460           transition_target.at(i)->elements_kind()));
7461       transition = Add<HTransitionElementsKind>(object, map,
7462                                                 transition_target.at(i));
7463     } else {
7464       untransitionable_maps.Add(map);
7465     }
7466   }
7467
7468   // If only one map is left after transitioning, handle this case
7469   // monomorphically.
7470   DCHECK(untransitionable_maps.length() >= 1);
7471   if (untransitionable_maps.length() == 1) {
7472     Handle<Map> untransitionable_map = untransitionable_maps[0];
7473     HInstruction* instr = NULL;
7474     if (!CanInlineElementAccess(untransitionable_map)) {
7475       instr = AddInstruction(
7476           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7477     } else {
7478       instr = BuildMonomorphicElementAccess(
7479           object, key, val, transition, untransitionable_map, access_type,
7480           store_mode);
7481     }
7482     *has_side_effects |= instr->HasObservableSideEffects();
7483     return access_type == STORE ? val : instr;
7484   }
7485
7486   HBasicBlock* join = graph()->CreateBasicBlock();
7487
7488   for (int i = 0; i < untransitionable_maps.length(); ++i) {
7489     Handle<Map> map = untransitionable_maps[i];
7490     ElementsKind elements_kind = map->elements_kind();
7491     HBasicBlock* this_map = graph()->CreateBasicBlock();
7492     HBasicBlock* other_map = graph()->CreateBasicBlock();
7493     HCompareMap* mapcompare =
7494         New<HCompareMap>(object, map, this_map, other_map);
7495     FinishCurrentBlock(mapcompare);
7496
7497     set_current_block(this_map);
7498     HInstruction* access = NULL;
7499     if (!CanInlineElementAccess(map)) {
7500       access = AddInstruction(
7501           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7502     } else {
7503       DCHECK(IsFastElementsKind(elements_kind) ||
7504              IsFixedTypedArrayElementsKind(elements_kind));
7505       LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7506       // Happily, mapcompare is a checked object.
7507       access = BuildUncheckedMonomorphicElementAccess(
7508           mapcompare, key, val,
7509           map->instance_type() == JS_ARRAY_TYPE,
7510           elements_kind, access_type,
7511           load_mode,
7512           store_mode);
7513     }
7514     *has_side_effects |= access->HasObservableSideEffects();
7515     // The caller will use has_side_effects and add a correct Simulate.
7516     access->SetFlag(HValue::kHasNoObservableSideEffects);
7517     if (access_type == LOAD) {
7518       Push(access);
7519     }
7520     NoObservableSideEffectsScope scope(this);
7521     GotoNoSimulate(join);
7522     set_current_block(other_map);
7523   }
7524
7525   // Ensure that we visited at least one map above that goes to join. This is
7526   // necessary because FinishExitWithHardDeoptimization does an AbnormalExit
7527   // rather than joining the join block. If this becomes an issue, insert a
7528   // generic access in the case length() == 0.
7529   DCHECK(join->predecessors()->length() > 0);
7530   // Deopt if none of the cases matched.
7531   NoObservableSideEffectsScope scope(this);
7532   FinishExitWithHardDeoptimization(
7533       Deoptimizer::kUnknownMapInPolymorphicElementAccess);
7534   set_current_block(join);
7535   return access_type == STORE ? val : Pop();
7536 }
7537
7538
7539 HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
7540     HValue* obj, HValue* key, HValue* val, Expression* expr,
7541     FeedbackVectorICSlot slot, BailoutId ast_id, BailoutId return_id,
7542     PropertyAccessType access_type, bool* has_side_effects) {
7543   if (key->ActualValue()->IsConstant()) {
7544     Handle<Object> constant =
7545         HConstant::cast(key->ActualValue())->handle(isolate());
7546     uint32_t array_index;
7547     if (constant->IsString() &&
7548         !Handle<String>::cast(constant)->AsArrayIndex(&array_index)) {
7549       if (!constant->IsUniqueName()) {
7550         constant = isolate()->factory()->InternalizeString(
7551             Handle<String>::cast(constant));
7552       }
7553       HValue* access =
7554           BuildNamedAccess(access_type, ast_id, return_id, expr, slot, obj,
7555                            Handle<String>::cast(constant), val, false);
7556       if (access == NULL || access->IsPhi() ||
7557           HInstruction::cast(access)->IsLinked()) {
7558         *has_side_effects = false;
7559       } else {
7560         HInstruction* instr = HInstruction::cast(access);
7561         AddInstruction(instr);
7562         *has_side_effects = instr->HasObservableSideEffects();
7563       }
7564       return access;
7565     }
7566   }
7567
7568   DCHECK(!expr->IsPropertyName());
7569   HInstruction* instr = NULL;
7570
7571   SmallMapList* maps;
7572   bool monomorphic = ComputeReceiverTypes(expr, obj, &maps, zone());
7573
7574   bool force_generic = false;
7575   if (expr->GetKeyType() == PROPERTY) {
7576     // Non-Generic accesses assume that elements are being accessed, and will
7577     // deopt for non-index keys, which the IC knows will occur.
7578     // TODO(jkummerow): Consider adding proper support for property accesses.
7579     force_generic = true;
7580     monomorphic = false;
7581   } else if (access_type == STORE &&
7582              (monomorphic || (maps != NULL && !maps->is_empty()))) {
7583     // Stores can't be mono/polymorphic if their prototype chain has dictionary
7584     // elements. However a receiver map that has dictionary elements itself
7585     // should be left to normal mono/poly behavior (the other maps may benefit
7586     // from highly optimized stores).
7587     for (int i = 0; i < maps->length(); i++) {
7588       Handle<Map> current_map = maps->at(i);
7589       if (current_map->DictionaryElementsInPrototypeChainOnly()) {
7590         force_generic = true;
7591         monomorphic = false;
7592         break;
7593       }
7594     }
7595   } else if (access_type == LOAD && !monomorphic &&
7596              (maps != NULL && !maps->is_empty())) {
7597     // Polymorphic loads have to go generic if any of the maps are strings.
7598     // If some, but not all of the maps are strings, we should go generic
7599     // because polymorphic access wants to key on ElementsKind and isn't
7600     // compatible with strings.
7601     for (int i = 0; i < maps->length(); i++) {
7602       Handle<Map> current_map = maps->at(i);
7603       if (current_map->IsStringMap()) {
7604         force_generic = true;
7605         break;
7606       }
7607     }
7608   }
7609
7610   if (monomorphic) {
7611     Handle<Map> map = maps->first();
7612     if (!CanInlineElementAccess(map)) {
7613       instr = AddInstruction(
7614           BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7615     } else {
7616       BuildCheckHeapObject(obj);
7617       instr = BuildMonomorphicElementAccess(
7618           obj, key, val, NULL, map, access_type, expr->GetStoreMode());
7619     }
7620   } else if (!force_generic && (maps != NULL && !maps->is_empty())) {
7621     return HandlePolymorphicElementAccess(expr, slot, obj, key, val, maps,
7622                                           access_type, expr->GetStoreMode(),
7623                                           has_side_effects);
7624   } else {
7625     if (access_type == STORE) {
7626       if (expr->IsAssignment() &&
7627           expr->AsAssignment()->HasNoTypeInformation()) {
7628         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedStore,
7629                          Deoptimizer::SOFT);
7630       }
7631     } else {
7632       if (expr->AsProperty()->HasNoTypeInformation()) {
7633         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedLoad,
7634                          Deoptimizer::SOFT);
7635       }
7636     }
7637     instr = AddInstruction(
7638         BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7639   }
7640   *has_side_effects = instr->HasObservableSideEffects();
7641   return instr;
7642 }
7643
7644
7645 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
7646   // Outermost function already has arguments on the stack.
7647   if (function_state()->outer() == NULL) return;
7648
7649   if (function_state()->arguments_pushed()) return;
7650
7651   // Push arguments when entering inlined function.
7652   HEnterInlined* entry = function_state()->entry();
7653   entry->set_arguments_pushed();
7654
7655   HArgumentsObject* arguments = entry->arguments_object();
7656   const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
7657
7658   HInstruction* insert_after = entry;
7659   for (int i = 0; i < arguments_values->length(); i++) {
7660     HValue* argument = arguments_values->at(i);
7661     HInstruction* push_argument = New<HPushArguments>(argument);
7662     push_argument->InsertAfter(insert_after);
7663     insert_after = push_argument;
7664   }
7665
7666   HArgumentsElements* arguments_elements = New<HArgumentsElements>(true);
7667   arguments_elements->ClearFlag(HValue::kUseGVN);
7668   arguments_elements->InsertAfter(insert_after);
7669   function_state()->set_arguments_elements(arguments_elements);
7670 }
7671
7672
7673 bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
7674   VariableProxy* proxy = expr->obj()->AsVariableProxy();
7675   if (proxy == NULL) return false;
7676   if (!proxy->var()->IsStackAllocated()) return false;
7677   if (!environment()->Lookup(proxy->var())->CheckFlag(HValue::kIsArguments)) {
7678     return false;
7679   }
7680
7681   HInstruction* result = NULL;
7682   if (expr->key()->IsPropertyName()) {
7683     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7684     if (!String::Equals(name, isolate()->factory()->length_string())) {
7685       return false;
7686     }
7687
7688     if (function_state()->outer() == NULL) {
7689       HInstruction* elements = Add<HArgumentsElements>(false);
7690       result = New<HArgumentsLength>(elements);
7691     } else {
7692       // Number of arguments without receiver.
7693       int argument_count = environment()->
7694           arguments_environment()->parameter_count() - 1;
7695       result = New<HConstant>(argument_count);
7696     }
7697   } else {
7698     Push(graph()->GetArgumentsObject());
7699     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);
7700     HValue* key = Pop();
7701     Drop(1);  // Arguments object.
7702     if (function_state()->outer() == NULL) {
7703       HInstruction* elements = Add<HArgumentsElements>(false);
7704       HInstruction* length = Add<HArgumentsLength>(elements);
7705       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7706       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7707     } else {
7708       EnsureArgumentsArePushedForAccess();
7709
7710       // Number of arguments without receiver.
7711       HInstruction* elements = function_state()->arguments_elements();
7712       int argument_count = environment()->
7713           arguments_environment()->parameter_count() - 1;
7714       HInstruction* length = Add<HConstant>(argument_count);
7715       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7716       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7717     }
7718   }
7719   ast_context()->ReturnInstruction(result, expr->id());
7720   return true;
7721 }
7722
7723
7724 HValue* HOptimizedGraphBuilder::BuildNamedAccess(
7725     PropertyAccessType access, BailoutId ast_id, BailoutId return_id,
7726     Expression* expr, FeedbackVectorICSlot slot, HValue* object,
7727     Handle<String> name, HValue* value, bool is_uninitialized) {
7728   SmallMapList* maps;
7729   ComputeReceiverTypes(expr, object, &maps, zone());
7730   DCHECK(maps != NULL);
7731
7732   if (maps->length() > 0) {
7733     PropertyAccessInfo info(this, access, maps->first(), name);
7734     if (!info.CanAccessAsMonomorphic(maps)) {
7735       HandlePolymorphicNamedFieldAccess(access, expr, slot, ast_id, return_id,
7736                                         object, value, maps, name);
7737       return NULL;
7738     }
7739
7740     HValue* checked_object;
7741     // Type::Number() is only supported by polymorphic load/call handling.
7742     DCHECK(!info.IsNumberType());
7743     BuildCheckHeapObject(object);
7744     if (AreStringTypes(maps)) {
7745       checked_object =
7746           Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
7747     } else {
7748       checked_object = Add<HCheckMaps>(object, maps);
7749     }
7750     return BuildMonomorphicAccess(
7751         &info, object, checked_object, value, ast_id, return_id);
7752   }
7753
7754   return BuildNamedGeneric(access, expr, slot, object, name, value,
7755                            is_uninitialized);
7756 }
7757
7758
7759 void HOptimizedGraphBuilder::PushLoad(Property* expr,
7760                                       HValue* object,
7761                                       HValue* key) {
7762   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
7763   Push(object);
7764   if (key != NULL) Push(key);
7765   BuildLoad(expr, expr->LoadId());
7766 }
7767
7768
7769 void HOptimizedGraphBuilder::BuildLoad(Property* expr,
7770                                        BailoutId ast_id) {
7771   HInstruction* instr = NULL;
7772   if (expr->IsStringAccess()) {
7773     HValue* index = Pop();
7774     HValue* string = Pop();
7775     HInstruction* char_code = BuildStringCharCodeAt(string, index);
7776     AddInstruction(char_code);
7777     instr = NewUncasted<HStringCharFromCode>(char_code);
7778
7779   } else if (expr->key()->IsPropertyName()) {
7780     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7781     HValue* object = Pop();
7782
7783     HValue* value = BuildNamedAccess(LOAD, ast_id, expr->LoadId(), expr,
7784                                      expr->PropertyFeedbackSlot(), object, name,
7785                                      NULL, expr->IsUninitialized());
7786     if (value == NULL) return;
7787     if (value->IsPhi()) return ast_context()->ReturnValue(value);
7788     instr = HInstruction::cast(value);
7789     if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
7790
7791   } else {
7792     HValue* key = Pop();
7793     HValue* obj = Pop();
7794
7795     bool has_side_effects = false;
7796     HValue* load = HandleKeyedElementAccess(
7797         obj, key, NULL, expr, expr->PropertyFeedbackSlot(), ast_id,
7798         expr->LoadId(), LOAD, &has_side_effects);
7799     if (has_side_effects) {
7800       if (ast_context()->IsEffect()) {
7801         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7802       } else {
7803         Push(load);
7804         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7805         Drop(1);
7806       }
7807     }
7808     if (load == NULL) return;
7809     return ast_context()->ReturnValue(load);
7810   }
7811   return ast_context()->ReturnInstruction(instr, ast_id);
7812 }
7813
7814
7815 void HOptimizedGraphBuilder::VisitProperty(Property* expr) {
7816   DCHECK(!HasStackOverflow());
7817   DCHECK(current_block() != NULL);
7818   DCHECK(current_block()->HasPredecessor());
7819
7820   if (TryArgumentsAccess(expr)) return;
7821
7822   CHECK_ALIVE(VisitForValue(expr->obj()));
7823   if (!expr->key()->IsPropertyName() || expr->IsStringAccess()) {
7824     CHECK_ALIVE(VisitForValue(expr->key()));
7825   }
7826
7827   BuildLoad(expr, expr->id());
7828 }
7829
7830
7831 HInstruction* HGraphBuilder::BuildConstantMapCheck(Handle<JSObject> constant) {
7832   HCheckMaps* check = Add<HCheckMaps>(
7833       Add<HConstant>(constant), handle(constant->map()));
7834   check->ClearDependsOnFlag(kElementsKind);
7835   return check;
7836 }
7837
7838
7839 HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
7840                                                      Handle<JSObject> holder) {
7841   PrototypeIterator iter(isolate(), prototype,
7842                          PrototypeIterator::START_AT_RECEIVER);
7843   while (holder.is_null() ||
7844          !PrototypeIterator::GetCurrent(iter).is_identical_to(holder)) {
7845     BuildConstantMapCheck(
7846         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7847     iter.Advance();
7848     if (iter.IsAtEnd()) {
7849       return NULL;
7850     }
7851   }
7852   return BuildConstantMapCheck(
7853       Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7854 }
7855
7856
7857 void HOptimizedGraphBuilder::AddCheckPrototypeMaps(Handle<JSObject> holder,
7858                                                    Handle<Map> receiver_map) {
7859   if (!holder.is_null()) {
7860     Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
7861     BuildCheckPrototypeMaps(prototype, holder);
7862   }
7863 }
7864
7865
7866 HInstruction* HOptimizedGraphBuilder::NewPlainFunctionCall(
7867     HValue* fun, int argument_count, bool pass_argument_count) {
7868   return New<HCallJSFunction>(fun, argument_count, pass_argument_count);
7869 }
7870
7871
7872 HInstruction* HOptimizedGraphBuilder::NewArgumentAdaptorCall(
7873     HValue* fun, HValue* context,
7874     int argument_count, HValue* expected_param_count) {
7875   ArgumentAdaptorDescriptor descriptor(isolate());
7876   HValue* arity = Add<HConstant>(argument_count - 1);
7877
7878   HValue* op_vals[] = { context, fun, arity, expected_param_count };
7879
7880   Handle<Code> adaptor =
7881       isolate()->builtins()->ArgumentsAdaptorTrampoline();
7882   HConstant* adaptor_value = Add<HConstant>(adaptor);
7883
7884   return New<HCallWithDescriptor>(adaptor_value, argument_count, descriptor,
7885                                   Vector<HValue*>(op_vals, arraysize(op_vals)));
7886 }
7887
7888
7889 HInstruction* HOptimizedGraphBuilder::BuildCallConstantFunction(
7890     Handle<JSFunction> jsfun, int argument_count) {
7891   HValue* target = Add<HConstant>(jsfun);
7892   // For constant functions, we try to avoid calling the
7893   // argument adaptor and instead call the function directly
7894   int formal_parameter_count =
7895       jsfun->shared()->internal_formal_parameter_count();
7896   bool dont_adapt_arguments =
7897       (formal_parameter_count ==
7898        SharedFunctionInfo::kDontAdaptArgumentsSentinel);
7899   int arity = argument_count - 1;
7900   bool can_invoke_directly =
7901       dont_adapt_arguments || formal_parameter_count == arity;
7902   if (can_invoke_directly) {
7903     if (jsfun.is_identical_to(current_info()->closure())) {
7904       graph()->MarkRecursive();
7905     }
7906     return NewPlainFunctionCall(target, argument_count, dont_adapt_arguments);
7907   } else {
7908     HValue* param_count_value = Add<HConstant>(formal_parameter_count);
7909     HValue* context = Add<HLoadNamedField>(
7910         target, nullptr, HObjectAccess::ForFunctionContextPointer());
7911     return NewArgumentAdaptorCall(target, context,
7912         argument_count, param_count_value);
7913   }
7914   UNREACHABLE();
7915   return NULL;
7916 }
7917
7918
7919 class FunctionSorter {
7920  public:
7921   explicit FunctionSorter(int index = 0, int ticks = 0, int size = 0)
7922       : index_(index), ticks_(ticks), size_(size) {}
7923
7924   int index() const { return index_; }
7925   int ticks() const { return ticks_; }
7926   int size() const { return size_; }
7927
7928  private:
7929   int index_;
7930   int ticks_;
7931   int size_;
7932 };
7933
7934
7935 inline bool operator<(const FunctionSorter& lhs, const FunctionSorter& rhs) {
7936   int diff = lhs.ticks() - rhs.ticks();
7937   if (diff != 0) return diff > 0;
7938   return lhs.size() < rhs.size();
7939 }
7940
7941
7942 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(Call* expr,
7943                                                         HValue* receiver,
7944                                                         SmallMapList* maps,
7945                                                         Handle<String> name) {
7946   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
7947   FunctionSorter order[kMaxCallPolymorphism];
7948
7949   bool handle_smi = false;
7950   bool handled_string = false;
7951   int ordered_functions = 0;
7952
7953   int i;
7954   for (i = 0; i < maps->length() && ordered_functions < kMaxCallPolymorphism;
7955        ++i) {
7956     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
7957     if (info.CanAccessMonomorphic() && info.IsDataConstant() &&
7958         info.constant()->IsJSFunction()) {
7959       if (info.IsStringType()) {
7960         if (handled_string) continue;
7961         handled_string = true;
7962       }
7963       Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7964       if (info.IsNumberType()) {
7965         handle_smi = true;
7966       }
7967       expr->set_target(target);
7968       order[ordered_functions++] = FunctionSorter(
7969           i, target->shared()->profiler_ticks(), InliningAstSize(target));
7970     }
7971   }
7972
7973   std::sort(order, order + ordered_functions);
7974
7975   if (i < maps->length()) {
7976     maps->Clear();
7977     ordered_functions = -1;
7978   }
7979
7980   HBasicBlock* number_block = NULL;
7981   HBasicBlock* join = NULL;
7982   handled_string = false;
7983   int count = 0;
7984
7985   for (int fn = 0; fn < ordered_functions; ++fn) {
7986     int i = order[fn].index();
7987     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
7988     if (info.IsStringType()) {
7989       if (handled_string) continue;
7990       handled_string = true;
7991     }
7992     // Reloads the target.
7993     info.CanAccessMonomorphic();
7994     Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7995
7996     expr->set_target(target);
7997     if (count == 0) {
7998       // Only needed once.
7999       join = graph()->CreateBasicBlock();
8000       if (handle_smi) {
8001         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
8002         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
8003         number_block = graph()->CreateBasicBlock();
8004         FinishCurrentBlock(New<HIsSmiAndBranch>(
8005                 receiver, empty_smi_block, not_smi_block));
8006         GotoNoSimulate(empty_smi_block, number_block);
8007         set_current_block(not_smi_block);
8008       } else {
8009         BuildCheckHeapObject(receiver);
8010       }
8011     }
8012     ++count;
8013     HBasicBlock* if_true = graph()->CreateBasicBlock();
8014     HBasicBlock* if_false = graph()->CreateBasicBlock();
8015     HUnaryControlInstruction* compare;
8016
8017     Handle<Map> map = info.map();
8018     if (info.IsNumberType()) {
8019       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
8020       compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
8021     } else if (info.IsStringType()) {
8022       compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
8023     } else {
8024       compare = New<HCompareMap>(receiver, map, if_true, if_false);
8025     }
8026     FinishCurrentBlock(compare);
8027
8028     if (info.IsNumberType()) {
8029       GotoNoSimulate(if_true, number_block);
8030       if_true = number_block;
8031     }
8032
8033     set_current_block(if_true);
8034
8035     AddCheckPrototypeMaps(info.holder(), map);
8036
8037     HValue* function = Add<HConstant>(expr->target());
8038     environment()->SetExpressionStackAt(0, function);
8039     Push(receiver);
8040     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8041     bool needs_wrapping = info.NeedsWrappingFor(target);
8042     bool try_inline = FLAG_polymorphic_inlining && !needs_wrapping;
8043     if (FLAG_trace_inlining && try_inline) {
8044       Handle<JSFunction> caller = current_info()->closure();
8045       base::SmartArrayPointer<char> caller_name =
8046           caller->shared()->DebugName()->ToCString();
8047       PrintF("Trying to inline the polymorphic call to %s from %s\n",
8048              name->ToCString().get(),
8049              caller_name.get());
8050     }
8051     if (try_inline && TryInlineCall(expr)) {
8052       // Trying to inline will signal that we should bailout from the
8053       // entire compilation by setting stack overflow on the visitor.
8054       if (HasStackOverflow()) return;
8055     } else {
8056       // Since HWrapReceiver currently cannot actually wrap numbers and strings,
8057       // use the regular CallFunctionStub for method calls to wrap the receiver.
8058       // TODO(verwaest): Support creation of value wrappers directly in
8059       // HWrapReceiver.
8060       HInstruction* call = needs_wrapping
8061           ? NewUncasted<HCallFunction>(
8062               function, argument_count, WRAP_AND_CALL)
8063           : BuildCallConstantFunction(target, argument_count);
8064       PushArgumentsFromEnvironment(argument_count);
8065       AddInstruction(call);
8066       Drop(1);  // Drop the function.
8067       if (!ast_context()->IsEffect()) Push(call);
8068     }
8069
8070     if (current_block() != NULL) Goto(join);
8071     set_current_block(if_false);
8072   }
8073
8074   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
8075   // know about and do not want to handle ones we've never seen.  Otherwise
8076   // use a generic IC.
8077   if (ordered_functions == maps->length() && FLAG_deoptimize_uncommon_cases) {
8078     FinishExitWithHardDeoptimization(Deoptimizer::kUnknownMapInPolymorphicCall);
8079   } else {
8080     Property* prop = expr->expression()->AsProperty();
8081     HInstruction* function =
8082         BuildNamedGeneric(LOAD, prop, prop->PropertyFeedbackSlot(), receiver,
8083                           name, NULL, prop->IsUninitialized());
8084     AddInstruction(function);
8085     Push(function);
8086     AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
8087
8088     environment()->SetExpressionStackAt(1, function);
8089     environment()->SetExpressionStackAt(0, receiver);
8090     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8091
8092     CallFunctionFlags flags = receiver->type().IsJSObject()
8093         ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
8094     HInstruction* call = New<HCallFunction>(
8095         function, argument_count, flags);
8096
8097     PushArgumentsFromEnvironment(argument_count);
8098
8099     Drop(1);  // Function.
8100
8101     if (join != NULL) {
8102       AddInstruction(call);
8103       if (!ast_context()->IsEffect()) Push(call);
8104       Goto(join);
8105     } else {
8106       return ast_context()->ReturnInstruction(call, expr->id());
8107     }
8108   }
8109
8110   // We assume that control flow is always live after an expression.  So
8111   // even without predecessors to the join block, we set it as the exit
8112   // block and continue by adding instructions there.
8113   DCHECK(join != NULL);
8114   if (join->HasPredecessor()) {
8115     set_current_block(join);
8116     join->SetJoinId(expr->id());
8117     if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
8118   } else {
8119     set_current_block(NULL);
8120   }
8121 }
8122
8123
8124 void HOptimizedGraphBuilder::TraceInline(Handle<JSFunction> target,
8125                                          Handle<JSFunction> caller,
8126                                          const char* reason) {
8127   if (FLAG_trace_inlining) {
8128     base::SmartArrayPointer<char> target_name =
8129         target->shared()->DebugName()->ToCString();
8130     base::SmartArrayPointer<char> caller_name =
8131         caller->shared()->DebugName()->ToCString();
8132     if (reason == NULL) {
8133       PrintF("Inlined %s called from %s.\n", target_name.get(),
8134              caller_name.get());
8135     } else {
8136       PrintF("Did not inline %s called from %s (%s).\n",
8137              target_name.get(), caller_name.get(), reason);
8138     }
8139   }
8140 }
8141
8142
8143 static const int kNotInlinable = 1000000000;
8144
8145
8146 int HOptimizedGraphBuilder::InliningAstSize(Handle<JSFunction> target) {
8147   if (!FLAG_use_inlining) return kNotInlinable;
8148
8149   // Precondition: call is monomorphic and we have found a target with the
8150   // appropriate arity.
8151   Handle<JSFunction> caller = current_info()->closure();
8152   Handle<SharedFunctionInfo> target_shared(target->shared());
8153
8154   // Always inline functions that force inlining.
8155   if (target_shared->force_inline()) {
8156     return 0;
8157   }
8158   if (target->IsBuiltin()) {
8159     return kNotInlinable;
8160   }
8161
8162   if (target_shared->IsApiFunction()) {
8163     TraceInline(target, caller, "target is api function");
8164     return kNotInlinable;
8165   }
8166
8167   // Do a quick check on source code length to avoid parsing large
8168   // inlining candidates.
8169   if (target_shared->SourceSize() >
8170       Min(FLAG_max_inlined_source_size, kUnlimitedMaxInlinedSourceSize)) {
8171     TraceInline(target, caller, "target text too big");
8172     return kNotInlinable;
8173   }
8174
8175   // Target must be inlineable.
8176   if (!target_shared->IsInlineable()) {
8177     TraceInline(target, caller, "target not inlineable");
8178     return kNotInlinable;
8179   }
8180   if (target_shared->disable_optimization_reason() != kNoReason) {
8181     TraceInline(target, caller, "target contains unsupported syntax [early]");
8182     return kNotInlinable;
8183   }
8184
8185   int nodes_added = target_shared->ast_node_count();
8186   return nodes_added;
8187 }
8188
8189
8190 bool HOptimizedGraphBuilder::TryInline(Handle<JSFunction> target,
8191                                        int arguments_count,
8192                                        HValue* implicit_return_value,
8193                                        BailoutId ast_id, BailoutId return_id,
8194                                        InliningKind inlining_kind) {
8195   if (target->context()->native_context() !=
8196       top_info()->closure()->context()->native_context()) {
8197     return false;
8198   }
8199   int nodes_added = InliningAstSize(target);
8200   if (nodes_added == kNotInlinable) return false;
8201
8202   Handle<JSFunction> caller = current_info()->closure();
8203
8204   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8205     TraceInline(target, caller, "target AST is too large [early]");
8206     return false;
8207   }
8208
8209   // Don't inline deeper than the maximum number of inlining levels.
8210   HEnvironment* env = environment();
8211   int current_level = 1;
8212   while (env->outer() != NULL) {
8213     if (current_level == FLAG_max_inlining_levels) {
8214       TraceInline(target, caller, "inline depth limit reached");
8215       return false;
8216     }
8217     if (env->outer()->frame_type() == JS_FUNCTION) {
8218       current_level++;
8219     }
8220     env = env->outer();
8221   }
8222
8223   // Don't inline recursive functions.
8224   for (FunctionState* state = function_state();
8225        state != NULL;
8226        state = state->outer()) {
8227     if (*state->compilation_info()->closure() == *target) {
8228       TraceInline(target, caller, "target is recursive");
8229       return false;
8230     }
8231   }
8232
8233   // We don't want to add more than a certain number of nodes from inlining.
8234   // Always inline small methods (<= 10 nodes).
8235   if (inlined_count_ > Min(FLAG_max_inlined_nodes_cumulative,
8236                            kUnlimitedMaxInlinedNodesCumulative)) {
8237     TraceInline(target, caller, "cumulative AST node limit reached");
8238     return false;
8239   }
8240
8241   // Parse and allocate variables.
8242   // Use the same AstValueFactory for creating strings in the sub-compilation
8243   // step, but don't transfer ownership to target_info.
8244   ParseInfo parse_info(zone(), target);
8245   parse_info.set_ast_value_factory(
8246       top_info()->parse_info()->ast_value_factory());
8247   parse_info.set_ast_value_factory_owned(false);
8248
8249   CompilationInfo target_info(&parse_info);
8250   Handle<SharedFunctionInfo> target_shared(target->shared());
8251   if (target_shared->HasDebugInfo()) {
8252     TraceInline(target, caller, "target is being debugged");
8253     return false;
8254   }
8255   if (!Compiler::ParseAndAnalyze(target_info.parse_info())) {
8256     if (target_info.isolate()->has_pending_exception()) {
8257       // Parse or scope error, never optimize this function.
8258       SetStackOverflow();
8259       target_shared->DisableOptimization(kParseScopeError);
8260     }
8261     TraceInline(target, caller, "parse failure");
8262     return false;
8263   }
8264
8265   if (target_info.scope()->num_heap_slots() > 0) {
8266     TraceInline(target, caller, "target has context-allocated variables");
8267     return false;
8268   }
8269   FunctionLiteral* function = target_info.literal();
8270
8271   // The following conditions must be checked again after re-parsing, because
8272   // earlier the information might not have been complete due to lazy parsing.
8273   nodes_added = function->ast_node_count();
8274   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8275     TraceInline(target, caller, "target AST is too large [late]");
8276     return false;
8277   }
8278   if (function->dont_optimize()) {
8279     TraceInline(target, caller, "target contains unsupported syntax [late]");
8280     return false;
8281   }
8282
8283   // If the function uses the arguments object check that inlining of functions
8284   // with arguments object is enabled and the arguments-variable is
8285   // stack allocated.
8286   if (function->scope()->arguments() != NULL) {
8287     if (!FLAG_inline_arguments) {
8288       TraceInline(target, caller, "target uses arguments object");
8289       return false;
8290     }
8291   }
8292
8293   // All declarations must be inlineable.
8294   ZoneList<Declaration*>* decls = target_info.scope()->declarations();
8295   int decl_count = decls->length();
8296   for (int i = 0; i < decl_count; ++i) {
8297     if (!decls->at(i)->IsInlineable()) {
8298       TraceInline(target, caller, "target has non-trivial declaration");
8299       return false;
8300     }
8301   }
8302
8303   // Generate the deoptimization data for the unoptimized version of
8304   // the target function if we don't already have it.
8305   if (!Compiler::EnsureDeoptimizationSupport(&target_info)) {
8306     TraceInline(target, caller, "could not generate deoptimization info");
8307     return false;
8308   }
8309
8310   // In strong mode it is an error to call a function with too few arguments.
8311   // In that case do not inline because then the arity check would be skipped.
8312   if (is_strong(function->language_mode()) &&
8313       arguments_count < function->parameter_count()) {
8314     TraceInline(target, caller,
8315                 "too few arguments passed to a strong function");
8316     return false;
8317   }
8318
8319   // ----------------------------------------------------------------
8320   // After this point, we've made a decision to inline this function (so
8321   // TryInline should always return true).
8322
8323   // Type-check the inlined function.
8324   DCHECK(target_shared->has_deoptimization_support());
8325   AstTyper(&target_info).Run();
8326
8327   int inlining_id = 0;
8328   if (top_info()->is_tracking_positions()) {
8329     inlining_id = top_info()->TraceInlinedFunction(
8330         target_shared, source_position(), function_state()->inlining_id());
8331   }
8332
8333   // Save the pending call context. Set up new one for the inlined function.
8334   // The function state is new-allocated because we need to delete it
8335   // in two different places.
8336   FunctionState* target_state =
8337       new FunctionState(this, &target_info, inlining_kind, inlining_id);
8338
8339   HConstant* undefined = graph()->GetConstantUndefined();
8340
8341   HEnvironment* inner_env =
8342       environment()->CopyForInlining(target,
8343                                      arguments_count,
8344                                      function,
8345                                      undefined,
8346                                      function_state()->inlining_kind());
8347
8348   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
8349   inner_env->BindContext(context);
8350
8351   // Create a dematerialized arguments object for the function, also copy the
8352   // current arguments values to use them for materialization.
8353   HEnvironment* arguments_env = inner_env->arguments_environment();
8354   int parameter_count = arguments_env->parameter_count();
8355   HArgumentsObject* arguments_object = Add<HArgumentsObject>(parameter_count);
8356   for (int i = 0; i < parameter_count; i++) {
8357     arguments_object->AddArgument(arguments_env->Lookup(i), zone());
8358   }
8359
8360   // If the function uses arguments object then bind bind one.
8361   if (function->scope()->arguments() != NULL) {
8362     DCHECK(function->scope()->arguments()->IsStackAllocated());
8363     inner_env->Bind(function->scope()->arguments(), arguments_object);
8364   }
8365
8366   // Capture the state before invoking the inlined function for deopt in the
8367   // inlined function. This simulate has no bailout-id since it's not directly
8368   // reachable for deopt, and is only used to capture the state. If the simulate
8369   // becomes reachable by merging, the ast id of the simulate merged into it is
8370   // adopted.
8371   Add<HSimulate>(BailoutId::None());
8372
8373   current_block()->UpdateEnvironment(inner_env);
8374   Scope* saved_scope = scope();
8375   set_scope(target_info.scope());
8376   HEnterInlined* enter_inlined =
8377       Add<HEnterInlined>(return_id, target, context, arguments_count, function,
8378                          function_state()->inlining_kind(),
8379                          function->scope()->arguments(), arguments_object);
8380   if (top_info()->is_tracking_positions()) {
8381     enter_inlined->set_inlining_id(inlining_id);
8382   }
8383   function_state()->set_entry(enter_inlined);
8384
8385   VisitDeclarations(target_info.scope()->declarations());
8386   VisitStatements(function->body());
8387   set_scope(saved_scope);
8388   if (HasStackOverflow()) {
8389     // Bail out if the inline function did, as we cannot residualize a call
8390     // instead, but do not disable optimization for the outer function.
8391     TraceInline(target, caller, "inline graph construction failed");
8392     target_shared->DisableOptimization(kInliningBailedOut);
8393     current_info()->RetryOptimization(kInliningBailedOut);
8394     delete target_state;
8395     return true;
8396   }
8397
8398   // Update inlined nodes count.
8399   inlined_count_ += nodes_added;
8400
8401   Handle<Code> unoptimized_code(target_shared->code());
8402   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
8403   Handle<TypeFeedbackInfo> type_info(
8404       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
8405   graph()->update_type_change_checksum(type_info->own_type_change_checksum());
8406
8407   TraceInline(target, caller, NULL);
8408
8409   if (current_block() != NULL) {
8410     FunctionState* state = function_state();
8411     if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
8412       // Falling off the end of an inlined construct call. In a test context the
8413       // return value will always evaluate to true, in a value context the
8414       // return value is the newly allocated receiver.
8415       if (call_context()->IsTest()) {
8416         Goto(inlined_test_context()->if_true(), state);
8417       } else if (call_context()->IsEffect()) {
8418         Goto(function_return(), state);
8419       } else {
8420         DCHECK(call_context()->IsValue());
8421         AddLeaveInlined(implicit_return_value, state);
8422       }
8423     } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
8424       // Falling off the end of an inlined setter call. The returned value is
8425       // never used, the value of an assignment is always the value of the RHS
8426       // of the assignment.
8427       if (call_context()->IsTest()) {
8428         inlined_test_context()->ReturnValue(implicit_return_value);
8429       } else if (call_context()->IsEffect()) {
8430         Goto(function_return(), state);
8431       } else {
8432         DCHECK(call_context()->IsValue());
8433         AddLeaveInlined(implicit_return_value, state);
8434       }
8435     } else {
8436       // Falling off the end of a normal inlined function. This basically means
8437       // returning undefined.
8438       if (call_context()->IsTest()) {
8439         Goto(inlined_test_context()->if_false(), state);
8440       } else if (call_context()->IsEffect()) {
8441         Goto(function_return(), state);
8442       } else {
8443         DCHECK(call_context()->IsValue());
8444         AddLeaveInlined(undefined, state);
8445       }
8446     }
8447   }
8448
8449   // Fix up the function exits.
8450   if (inlined_test_context() != NULL) {
8451     HBasicBlock* if_true = inlined_test_context()->if_true();
8452     HBasicBlock* if_false = inlined_test_context()->if_false();
8453
8454     HEnterInlined* entry = function_state()->entry();
8455
8456     // Pop the return test context from the expression context stack.
8457     DCHECK(ast_context() == inlined_test_context());
8458     ClearInlinedTestContext();
8459     delete target_state;
8460
8461     // Forward to the real test context.
8462     if (if_true->HasPredecessor()) {
8463       entry->RegisterReturnTarget(if_true, zone());
8464       if_true->SetJoinId(ast_id);
8465       HBasicBlock* true_target = TestContext::cast(ast_context())->if_true();
8466       Goto(if_true, true_target, function_state());
8467     }
8468     if (if_false->HasPredecessor()) {
8469       entry->RegisterReturnTarget(if_false, zone());
8470       if_false->SetJoinId(ast_id);
8471       HBasicBlock* false_target = TestContext::cast(ast_context())->if_false();
8472       Goto(if_false, false_target, function_state());
8473     }
8474     set_current_block(NULL);
8475     return true;
8476
8477   } else if (function_return()->HasPredecessor()) {
8478     function_state()->entry()->RegisterReturnTarget(function_return(), zone());
8479     function_return()->SetJoinId(ast_id);
8480     set_current_block(function_return());
8481   } else {
8482     set_current_block(NULL);
8483   }
8484   delete target_state;
8485   return true;
8486 }
8487
8488
8489 bool HOptimizedGraphBuilder::TryInlineCall(Call* expr) {
8490   return TryInline(expr->target(), expr->arguments()->length(), NULL,
8491                    expr->id(), expr->ReturnId(), NORMAL_RETURN);
8492 }
8493
8494
8495 bool HOptimizedGraphBuilder::TryInlineConstruct(CallNew* expr,
8496                                                 HValue* implicit_return_value) {
8497   return TryInline(expr->target(), expr->arguments()->length(),
8498                    implicit_return_value, expr->id(), expr->ReturnId(),
8499                    CONSTRUCT_CALL_RETURN);
8500 }
8501
8502
8503 bool HOptimizedGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
8504                                              Handle<Map> receiver_map,
8505                                              BailoutId ast_id,
8506                                              BailoutId return_id) {
8507   if (TryInlineApiGetter(getter, receiver_map, ast_id)) return true;
8508   return TryInline(getter, 0, NULL, ast_id, return_id, GETTER_CALL_RETURN);
8509 }
8510
8511
8512 bool HOptimizedGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
8513                                              Handle<Map> receiver_map,
8514                                              BailoutId id,
8515                                              BailoutId assignment_id,
8516                                              HValue* implicit_return_value) {
8517   if (TryInlineApiSetter(setter, receiver_map, id)) return true;
8518   return TryInline(setter, 1, implicit_return_value, id, assignment_id,
8519                    SETTER_CALL_RETURN);
8520 }
8521
8522
8523 bool HOptimizedGraphBuilder::TryInlineIndirectCall(Handle<JSFunction> function,
8524                                                    Call* expr,
8525                                                    int arguments_count) {
8526   return TryInline(function, arguments_count, NULL, expr->id(),
8527                    expr->ReturnId(), NORMAL_RETURN);
8528 }
8529
8530
8531 bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
8532   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8533   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8534   switch (id) {
8535     case kMathExp:
8536       if (!FLAG_fast_math) break;
8537       // Fall through if FLAG_fast_math.
8538     case kMathRound:
8539     case kMathFround:
8540     case kMathFloor:
8541     case kMathAbs:
8542     case kMathSqrt:
8543     case kMathLog:
8544     case kMathClz32:
8545       if (expr->arguments()->length() == 1) {
8546         HValue* argument = Pop();
8547         Drop(2);  // Receiver and function.
8548         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8549         ast_context()->ReturnInstruction(op, expr->id());
8550         return true;
8551       }
8552       break;
8553     case kMathImul:
8554       if (expr->arguments()->length() == 2) {
8555         HValue* right = Pop();
8556         HValue* left = Pop();
8557         Drop(2);  // Receiver and function.
8558         HInstruction* op =
8559             HMul::NewImul(isolate(), zone(), context(), left, right);
8560         ast_context()->ReturnInstruction(op, expr->id());
8561         return true;
8562       }
8563       break;
8564     default:
8565       // Not supported for inlining yet.
8566       break;
8567   }
8568   return false;
8569 }
8570
8571
8572 // static
8573 bool HOptimizedGraphBuilder::IsReadOnlyLengthDescriptor(
8574     Handle<Map> jsarray_map) {
8575   DCHECK(!jsarray_map->is_dictionary_map());
8576   Isolate* isolate = jsarray_map->GetIsolate();
8577   Handle<Name> length_string = isolate->factory()->length_string();
8578   DescriptorArray* descriptors = jsarray_map->instance_descriptors();
8579   int number = descriptors->SearchWithCache(*length_string, *jsarray_map);
8580   DCHECK_NE(DescriptorArray::kNotFound, number);
8581   return descriptors->GetDetails(number).IsReadOnly();
8582 }
8583
8584
8585 // static
8586 bool HOptimizedGraphBuilder::CanInlineArrayResizeOperation(
8587     Handle<Map> receiver_map) {
8588   return !receiver_map.is_null() &&
8589          receiver_map->instance_type() == JS_ARRAY_TYPE &&
8590          IsFastElementsKind(receiver_map->elements_kind()) &&
8591          !receiver_map->is_dictionary_map() && !receiver_map->is_observed() &&
8592          receiver_map->is_extensible() &&
8593          (!receiver_map->is_prototype_map() || receiver_map->is_stable()) &&
8594          !IsReadOnlyLengthDescriptor(receiver_map);
8595 }
8596
8597
8598 bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
8599     Call* expr, Handle<JSFunction> function, Handle<Map> receiver_map,
8600     int args_count_no_receiver) {
8601   if (!function->shared()->HasBuiltinFunctionId()) return false;
8602   BuiltinFunctionId id = function->shared()->builtin_function_id();
8603   int argument_count = args_count_no_receiver + 1;  // Plus receiver.
8604
8605   if (receiver_map.is_null()) {
8606     HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
8607     if (receiver->IsConstant() &&
8608         HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
8609       receiver_map =
8610           handle(Handle<HeapObject>::cast(
8611                      HConstant::cast(receiver)->handle(isolate()))->map());
8612     }
8613   }
8614   // Try to inline calls like Math.* as operations in the calling function.
8615   switch (id) {
8616     case kStringCharCodeAt:
8617     case kStringCharAt:
8618       if (argument_count == 2) {
8619         HValue* index = Pop();
8620         HValue* string = Pop();
8621         Drop(1);  // Function.
8622         HInstruction* char_code =
8623             BuildStringCharCodeAt(string, index);
8624         if (id == kStringCharCodeAt) {
8625           ast_context()->ReturnInstruction(char_code, expr->id());
8626           return true;
8627         }
8628         AddInstruction(char_code);
8629         HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
8630         ast_context()->ReturnInstruction(result, expr->id());
8631         return true;
8632       }
8633       break;
8634     case kStringFromCharCode:
8635       if (argument_count == 2) {
8636         HValue* argument = Pop();
8637         Drop(2);  // Receiver and function.
8638         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
8639         ast_context()->ReturnInstruction(result, expr->id());
8640         return true;
8641       }
8642       break;
8643     case kMathExp:
8644       if (!FLAG_fast_math) break;
8645       // Fall through if FLAG_fast_math.
8646     case kMathRound:
8647     case kMathFround:
8648     case kMathFloor:
8649     case kMathAbs:
8650     case kMathSqrt:
8651     case kMathLog:
8652     case kMathClz32:
8653       if (argument_count == 2) {
8654         HValue* argument = Pop();
8655         Drop(2);  // Receiver and function.
8656         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8657         ast_context()->ReturnInstruction(op, expr->id());
8658         return true;
8659       }
8660       break;
8661     case kMathPow:
8662       if (argument_count == 3) {
8663         HValue* right = Pop();
8664         HValue* left = Pop();
8665         Drop(2);  // Receiver and function.
8666         HInstruction* result = NULL;
8667         // Use sqrt() if exponent is 0.5 or -0.5.
8668         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
8669           double exponent = HConstant::cast(right)->DoubleValue();
8670           if (exponent == 0.5) {
8671             result = NewUncasted<HUnaryMathOperation>(left, kMathPowHalf);
8672           } else if (exponent == -0.5) {
8673             HValue* one = graph()->GetConstant1();
8674             HInstruction* sqrt = AddUncasted<HUnaryMathOperation>(
8675                 left, kMathPowHalf);
8676             // MathPowHalf doesn't have side effects so there's no need for
8677             // an environment simulation here.
8678             DCHECK(!sqrt->HasObservableSideEffects());
8679             result = NewUncasted<HDiv>(one, sqrt);
8680           } else if (exponent == 2.0) {
8681             result = NewUncasted<HMul>(left, left);
8682           }
8683         }
8684
8685         if (result == NULL) {
8686           result = NewUncasted<HPower>(left, right);
8687         }
8688         ast_context()->ReturnInstruction(result, expr->id());
8689         return true;
8690       }
8691       break;
8692     case kMathMax:
8693     case kMathMin:
8694       if (argument_count == 3) {
8695         HValue* right = Pop();
8696         HValue* left = Pop();
8697         Drop(2);  // Receiver and function.
8698         HMathMinMax::Operation op = (id == kMathMin) ? HMathMinMax::kMathMin
8699                                                      : HMathMinMax::kMathMax;
8700         HInstruction* result = NewUncasted<HMathMinMax>(left, right, op);
8701         ast_context()->ReturnInstruction(result, expr->id());
8702         return true;
8703       }
8704       break;
8705     case kMathImul:
8706       if (argument_count == 3) {
8707         HValue* right = Pop();
8708         HValue* left = Pop();
8709         Drop(2);  // Receiver and function.
8710         HInstruction* result =
8711             HMul::NewImul(isolate(), zone(), context(), left, right);
8712         ast_context()->ReturnInstruction(result, expr->id());
8713         return true;
8714       }
8715       break;
8716     case kArrayPop: {
8717       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8718       ElementsKind elements_kind = receiver_map->elements_kind();
8719
8720       Drop(args_count_no_receiver);
8721       HValue* result;
8722       HValue* reduced_length;
8723       HValue* receiver = Pop();
8724
8725       HValue* checked_object = AddCheckMap(receiver, receiver_map);
8726       HValue* length =
8727           Add<HLoadNamedField>(checked_object, nullptr,
8728                                HObjectAccess::ForArrayLength(elements_kind));
8729
8730       Drop(1);  // Function.
8731
8732       { NoObservableSideEffectsScope scope(this);
8733         IfBuilder length_checker(this);
8734
8735         HValue* bounds_check = length_checker.If<HCompareNumericAndBranch>(
8736             length, graph()->GetConstant0(), Token::EQ);
8737         length_checker.Then();
8738
8739         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8740
8741         length_checker.Else();
8742         HValue* elements = AddLoadElements(checked_object);
8743         // Ensure that we aren't popping from a copy-on-write array.
8744         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8745           elements = BuildCopyElementsOnWrite(checked_object, elements,
8746                                               elements_kind, length);
8747         }
8748         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
8749         result = AddElementAccess(elements, reduced_length, NULL,
8750                                   bounds_check, elements_kind, LOAD);
8751         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
8752                            ? graph()->GetConstantHole()
8753                            : Add<HConstant>(HConstant::kHoleNaN);
8754         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8755           elements_kind = FAST_HOLEY_ELEMENTS;
8756         }
8757         AddElementAccess(
8758             elements, reduced_length, hole, bounds_check, elements_kind, STORE);
8759         Add<HStoreNamedField>(
8760             checked_object, HObjectAccess::ForArrayLength(elements_kind),
8761             reduced_length, STORE_TO_INITIALIZED_ENTRY);
8762
8763         if (!ast_context()->IsEffect()) Push(result);
8764
8765         length_checker.End();
8766       }
8767       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8768       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8769       if (!ast_context()->IsEffect()) Drop(1);
8770
8771       ast_context()->ReturnValue(result);
8772       return true;
8773     }
8774     case kArrayPush: {
8775       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8776       ElementsKind elements_kind = receiver_map->elements_kind();
8777
8778       // If there may be elements accessors in the prototype chain, the fast
8779       // inlined version can't be used.
8780       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8781       // If there currently can be no elements accessors on the prototype chain,
8782       // it doesn't mean that there won't be any later. Install a full prototype
8783       // chain check to trap element accessors being installed on the prototype
8784       // chain, which would cause elements to go to dictionary mode and result
8785       // in a map change.
8786       Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
8787       BuildCheckPrototypeMaps(prototype, Handle<JSObject>());
8788
8789       // Protect against adding elements to the Array prototype, which needs to
8790       // route through appropriate bottlenecks.
8791       if (isolate()->IsFastArrayConstructorPrototypeChainIntact() &&
8792           !prototype->IsJSArray()) {
8793         return false;
8794       }
8795
8796       const int argc = args_count_no_receiver;
8797       if (argc != 1) return false;
8798
8799       HValue* value_to_push = Pop();
8800       HValue* array = Pop();
8801       Drop(1);  // Drop function.
8802
8803       HInstruction* new_size = NULL;
8804       HValue* length = NULL;
8805
8806       {
8807         NoObservableSideEffectsScope scope(this);
8808
8809         length = Add<HLoadNamedField>(
8810             array, nullptr, HObjectAccess::ForArrayLength(elements_kind));
8811
8812         new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
8813
8814         bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
8815         HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
8816         BuildUncheckedMonomorphicElementAccess(
8817             checked_array, length, value_to_push, is_array, elements_kind,
8818             STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
8819
8820         if (!ast_context()->IsEffect()) Push(new_size);
8821         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8822         if (!ast_context()->IsEffect()) Drop(1);
8823       }
8824
8825       ast_context()->ReturnValue(new_size);
8826       return true;
8827     }
8828     case kArrayShift: {
8829       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8830       ElementsKind kind = receiver_map->elements_kind();
8831
8832       // If there may be elements accessors in the prototype chain, the fast
8833       // inlined version can't be used.
8834       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8835
8836       // If there currently can be no elements accessors on the prototype chain,
8837       // it doesn't mean that there won't be any later. Install a full prototype
8838       // chain check to trap element accessors being installed on the prototype
8839       // chain, which would cause elements to go to dictionary mode and result
8840       // in a map change.
8841       BuildCheckPrototypeMaps(
8842           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8843           Handle<JSObject>::null());
8844
8845       // Threshold for fast inlined Array.shift().
8846       HConstant* inline_threshold = Add<HConstant>(static_cast<int32_t>(16));
8847
8848       Drop(args_count_no_receiver);
8849       HValue* receiver = Pop();
8850       HValue* function = Pop();
8851       HValue* result;
8852
8853       {
8854         NoObservableSideEffectsScope scope(this);
8855
8856         HValue* length = Add<HLoadNamedField>(
8857             receiver, nullptr, HObjectAccess::ForArrayLength(kind));
8858
8859         IfBuilder if_lengthiszero(this);
8860         HValue* lengthiszero = if_lengthiszero.If<HCompareNumericAndBranch>(
8861             length, graph()->GetConstant0(), Token::EQ);
8862         if_lengthiszero.Then();
8863         {
8864           if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8865         }
8866         if_lengthiszero.Else();
8867         {
8868           HValue* elements = AddLoadElements(receiver);
8869
8870           // Check if we can use the fast inlined Array.shift().
8871           IfBuilder if_inline(this);
8872           if_inline.If<HCompareNumericAndBranch>(
8873               length, inline_threshold, Token::LTE);
8874           if (IsFastSmiOrObjectElementsKind(kind)) {
8875             // We cannot handle copy-on-write backing stores here.
8876             if_inline.AndIf<HCompareMap>(
8877                 elements, isolate()->factory()->fixed_array_map());
8878           }
8879           if_inline.Then();
8880           {
8881             // Remember the result.
8882             if (!ast_context()->IsEffect()) {
8883               Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
8884                                     lengthiszero, kind, LOAD));
8885             }
8886
8887             // Compute the new length.
8888             HValue* new_length = AddUncasted<HSub>(
8889                 length, graph()->GetConstant1());
8890             new_length->ClearFlag(HValue::kCanOverflow);
8891
8892             // Copy the remaining elements.
8893             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
8894             {
8895               HValue* new_key = loop.BeginBody(
8896                   graph()->GetConstant0(), new_length, Token::LT);
8897               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
8898               key->ClearFlag(HValue::kCanOverflow);
8899               ElementsKind copy_kind =
8900                   kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
8901               HValue* element = AddUncasted<HLoadKeyed>(
8902                   elements, key, lengthiszero, copy_kind, ALLOW_RETURN_HOLE);
8903               HStoreKeyed* store =
8904                   Add<HStoreKeyed>(elements, new_key, element, copy_kind);
8905               store->SetFlag(HValue::kAllowUndefinedAsNaN);
8906             }
8907             loop.EndBody();
8908
8909             // Put a hole at the end.
8910             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
8911                                ? graph()->GetConstantHole()
8912                                : Add<HConstant>(HConstant::kHoleNaN);
8913             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
8914             Add<HStoreKeyed>(
8915                 elements, new_length, hole, kind, INITIALIZING_STORE);
8916
8917             // Remember new length.
8918             Add<HStoreNamedField>(
8919                 receiver, HObjectAccess::ForArrayLength(kind),
8920                 new_length, STORE_TO_INITIALIZED_ENTRY);
8921           }
8922           if_inline.Else();
8923           {
8924             Add<HPushArguments>(receiver);
8925             result = Add<HCallJSFunction>(function, 1, true);
8926             if (!ast_context()->IsEffect()) Push(result);
8927           }
8928           if_inline.End();
8929         }
8930         if_lengthiszero.End();
8931       }
8932       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8933       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8934       if (!ast_context()->IsEffect()) Drop(1);
8935       ast_context()->ReturnValue(result);
8936       return true;
8937     }
8938     case kArrayIndexOf:
8939     case kArrayLastIndexOf: {
8940       if (receiver_map.is_null()) return false;
8941       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8942       ElementsKind kind = receiver_map->elements_kind();
8943       if (!IsFastElementsKind(kind)) return false;
8944       if (receiver_map->is_observed()) return false;
8945       if (argument_count != 2) return false;
8946       if (!receiver_map->is_extensible()) return false;
8947
8948       // If there may be elements accessors in the prototype chain, the fast
8949       // inlined version can't be used.
8950       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8951
8952       // If there currently can be no elements accessors on the prototype chain,
8953       // it doesn't mean that there won't be any later. Install a full prototype
8954       // chain check to trap element accessors being installed on the prototype
8955       // chain, which would cause elements to go to dictionary mode and result
8956       // in a map change.
8957       BuildCheckPrototypeMaps(
8958           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8959           Handle<JSObject>::null());
8960
8961       HValue* search_element = Pop();
8962       HValue* receiver = Pop();
8963       Drop(1);  // Drop function.
8964
8965       ArrayIndexOfMode mode = (id == kArrayIndexOf)
8966           ? kFirstIndexOf : kLastIndexOf;
8967       HValue* index = BuildArrayIndexOf(receiver, search_element, kind, mode);
8968
8969       if (!ast_context()->IsEffect()) Push(index);
8970       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8971       if (!ast_context()->IsEffect()) Drop(1);
8972       ast_context()->ReturnValue(index);
8973       return true;
8974     }
8975     default:
8976       // Not yet supported for inlining.
8977       break;
8978   }
8979   return false;
8980 }
8981
8982
8983 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
8984                                                       HValue* receiver) {
8985   Handle<JSFunction> function = expr->target();
8986   int argc = expr->arguments()->length();
8987   SmallMapList receiver_maps;
8988   return TryInlineApiCall(function,
8989                           receiver,
8990                           &receiver_maps,
8991                           argc,
8992                           expr->id(),
8993                           kCallApiFunction);
8994 }
8995
8996
8997 bool HOptimizedGraphBuilder::TryInlineApiMethodCall(
8998     Call* expr,
8999     HValue* receiver,
9000     SmallMapList* receiver_maps) {
9001   Handle<JSFunction> function = expr->target();
9002   int argc = expr->arguments()->length();
9003   return TryInlineApiCall(function,
9004                           receiver,
9005                           receiver_maps,
9006                           argc,
9007                           expr->id(),
9008                           kCallApiMethod);
9009 }
9010
9011
9012 bool HOptimizedGraphBuilder::TryInlineApiGetter(Handle<JSFunction> function,
9013                                                 Handle<Map> receiver_map,
9014                                                 BailoutId ast_id) {
9015   SmallMapList receiver_maps(1, zone());
9016   receiver_maps.Add(receiver_map, zone());
9017   return TryInlineApiCall(function,
9018                           NULL,  // Receiver is on expression stack.
9019                           &receiver_maps,
9020                           0,
9021                           ast_id,
9022                           kCallApiGetter);
9023 }
9024
9025
9026 bool HOptimizedGraphBuilder::TryInlineApiSetter(Handle<JSFunction> function,
9027                                                 Handle<Map> receiver_map,
9028                                                 BailoutId ast_id) {
9029   SmallMapList receiver_maps(1, zone());
9030   receiver_maps.Add(receiver_map, zone());
9031   return TryInlineApiCall(function,
9032                           NULL,  // Receiver is on expression stack.
9033                           &receiver_maps,
9034                           1,
9035                           ast_id,
9036                           kCallApiSetter);
9037 }
9038
9039
9040 bool HOptimizedGraphBuilder::TryInlineApiCall(Handle<JSFunction> function,
9041                                                HValue* receiver,
9042                                                SmallMapList* receiver_maps,
9043                                                int argc,
9044                                                BailoutId ast_id,
9045                                                ApiCallType call_type) {
9046   if (function->context()->native_context() !=
9047       top_info()->closure()->context()->native_context()) {
9048     return false;
9049   }
9050   CallOptimization optimization(function);
9051   if (!optimization.is_simple_api_call()) return false;
9052   Handle<Map> holder_map;
9053   for (int i = 0; i < receiver_maps->length(); ++i) {
9054     auto map = receiver_maps->at(i);
9055     // Don't inline calls to receivers requiring accesschecks.
9056     if (map->is_access_check_needed()) return false;
9057   }
9058   if (call_type == kCallApiFunction) {
9059     // Cannot embed a direct reference to the global proxy map
9060     // as it maybe dropped on deserialization.
9061     CHECK(!isolate()->serializer_enabled());
9062     DCHECK_EQ(0, receiver_maps->length());
9063     receiver_maps->Add(handle(function->global_proxy()->map()), zone());
9064   }
9065   CallOptimization::HolderLookup holder_lookup =
9066       CallOptimization::kHolderNotFound;
9067   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
9068       receiver_maps->first(), &holder_lookup);
9069   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
9070
9071   if (FLAG_trace_inlining) {
9072     PrintF("Inlining api function ");
9073     function->ShortPrint();
9074     PrintF("\n");
9075   }
9076
9077   bool is_function = false;
9078   bool is_store = false;
9079   switch (call_type) {
9080     case kCallApiFunction:
9081     case kCallApiMethod:
9082       // Need to check that none of the receiver maps could have changed.
9083       Add<HCheckMaps>(receiver, receiver_maps);
9084       // Need to ensure the chain between receiver and api_holder is intact.
9085       if (holder_lookup == CallOptimization::kHolderFound) {
9086         AddCheckPrototypeMaps(api_holder, receiver_maps->first());
9087       } else {
9088         DCHECK_EQ(holder_lookup, CallOptimization::kHolderIsReceiver);
9089       }
9090       // Includes receiver.
9091       PushArgumentsFromEnvironment(argc + 1);
9092       is_function = true;
9093       break;
9094     case kCallApiGetter:
9095       // Receiver and prototype chain cannot have changed.
9096       DCHECK_EQ(0, argc);
9097       DCHECK_NULL(receiver);
9098       // Receiver is on expression stack.
9099       receiver = Pop();
9100       Add<HPushArguments>(receiver);
9101       break;
9102     case kCallApiSetter:
9103       {
9104         is_store = true;
9105         // Receiver and prototype chain cannot have changed.
9106         DCHECK_EQ(1, argc);
9107         DCHECK_NULL(receiver);
9108         // Receiver and value are on expression stack.
9109         HValue* value = Pop();
9110         receiver = Pop();
9111         Add<HPushArguments>(receiver, value);
9112         break;
9113      }
9114   }
9115
9116   HValue* holder = NULL;
9117   switch (holder_lookup) {
9118     case CallOptimization::kHolderFound:
9119       holder = Add<HConstant>(api_holder);
9120       break;
9121     case CallOptimization::kHolderIsReceiver:
9122       holder = receiver;
9123       break;
9124     case CallOptimization::kHolderNotFound:
9125       UNREACHABLE();
9126       break;
9127   }
9128   Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
9129   Handle<Object> call_data_obj(api_call_info->data(), isolate());
9130   bool call_data_undefined = call_data_obj->IsUndefined();
9131   HValue* call_data = Add<HConstant>(call_data_obj);
9132   ApiFunction fun(v8::ToCData<Address>(api_call_info->callback()));
9133   ExternalReference ref = ExternalReference(&fun,
9134                                             ExternalReference::DIRECT_API_CALL,
9135                                             isolate());
9136   HValue* api_function_address = Add<HConstant>(ExternalReference(ref));
9137
9138   HValue* op_vals[] = {context(), Add<HConstant>(function), call_data, holder,
9139                        api_function_address, nullptr};
9140
9141   HInstruction* call = nullptr;
9142   if (!is_function) {
9143     CallApiAccessorStub stub(isolate(), is_store, call_data_undefined);
9144     Handle<Code> code = stub.GetCode();
9145     HConstant* code_value = Add<HConstant>(code);
9146     ApiAccessorDescriptor descriptor(isolate());
9147     call = New<HCallWithDescriptor>(
9148         code_value, argc + 1, descriptor,
9149         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9150   } else if (argc <= CallApiFunctionWithFixedArgsStub::kMaxFixedArgs) {
9151     CallApiFunctionWithFixedArgsStub stub(isolate(), argc, call_data_undefined);
9152     Handle<Code> code = stub.GetCode();
9153     HConstant* code_value = Add<HConstant>(code);
9154     ApiFunctionWithFixedArgsDescriptor descriptor(isolate());
9155     call = New<HCallWithDescriptor>(
9156         code_value, argc + 1, descriptor,
9157         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9158     Drop(1);  // Drop function.
9159   } else {
9160     op_vals[arraysize(op_vals) - 1] = Add<HConstant>(argc);
9161     CallApiFunctionStub stub(isolate(), call_data_undefined);
9162     Handle<Code> code = stub.GetCode();
9163     HConstant* code_value = Add<HConstant>(code);
9164     ApiFunctionDescriptor descriptor(isolate());
9165     call =
9166         New<HCallWithDescriptor>(code_value, argc + 1, descriptor,
9167                                  Vector<HValue*>(op_vals, arraysize(op_vals)));
9168     Drop(1);  // Drop function.
9169   }
9170
9171   ast_context()->ReturnInstruction(call, ast_id);
9172   return true;
9173 }
9174
9175
9176 void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
9177                                                 int arguments_count) {
9178   Handle<JSFunction> known_function;
9179   int args_count_no_receiver = arguments_count - 1;
9180   if (function->IsConstant() &&
9181       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9182     known_function =
9183         Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
9184     if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
9185                                    args_count_no_receiver)) {
9186       if (FLAG_trace_inlining) {
9187         PrintF("Inlining builtin ");
9188         known_function->ShortPrint();
9189         PrintF("\n");
9190       }
9191       return;
9192     }
9193
9194     if (TryInlineIndirectCall(known_function, expr, args_count_no_receiver)) {
9195       return;
9196     }
9197   }
9198
9199   PushArgumentsFromEnvironment(arguments_count);
9200   HInvokeFunction* call =
9201       New<HInvokeFunction>(function, known_function, arguments_count);
9202   Drop(1);  // Function
9203   ast_context()->ReturnInstruction(call, expr->id());
9204 }
9205
9206
9207 bool HOptimizedGraphBuilder::TryIndirectCall(Call* expr) {
9208   DCHECK(expr->expression()->IsProperty());
9209
9210   if (!expr->IsMonomorphic()) {
9211     return false;
9212   }
9213   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9214   if (function_map->instance_type() != JS_FUNCTION_TYPE ||
9215       !expr->target()->shared()->HasBuiltinFunctionId()) {
9216     return false;
9217   }
9218
9219   switch (expr->target()->shared()->builtin_function_id()) {
9220     case kFunctionCall: {
9221       if (expr->arguments()->length() == 0) return false;
9222       BuildFunctionCall(expr);
9223       return true;
9224     }
9225     case kFunctionApply: {
9226       // For .apply, only the pattern f.apply(receiver, arguments)
9227       // is supported.
9228       if (current_info()->scope()->arguments() == NULL) return false;
9229
9230       if (!CanBeFunctionApplyArguments(expr)) return false;
9231
9232       BuildFunctionApply(expr);
9233       return true;
9234     }
9235     default: { return false; }
9236   }
9237   UNREACHABLE();
9238 }
9239
9240
9241 void HOptimizedGraphBuilder::BuildFunctionApply(Call* expr) {
9242   ZoneList<Expression*>* args = expr->arguments();
9243   CHECK_ALIVE(VisitForValue(args->at(0)));
9244   HValue* receiver = Pop();  // receiver
9245   HValue* function = Pop();  // f
9246   Drop(1);  // apply
9247
9248   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9249   HValue* checked_function = AddCheckMap(function, function_map);
9250
9251   if (function_state()->outer() == NULL) {
9252     HInstruction* elements = Add<HArgumentsElements>(false);
9253     HInstruction* length = Add<HArgumentsLength>(elements);
9254     HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
9255     HInstruction* result = New<HApplyArguments>(function,
9256                                                 wrapped_receiver,
9257                                                 length,
9258                                                 elements);
9259     ast_context()->ReturnInstruction(result, expr->id());
9260   } else {
9261     // We are inside inlined function and we know exactly what is inside
9262     // arguments object. But we need to be able to materialize at deopt.
9263     DCHECK_EQ(environment()->arguments_environment()->parameter_count(),
9264               function_state()->entry()->arguments_object()->arguments_count());
9265     HArgumentsObject* args = function_state()->entry()->arguments_object();
9266     const ZoneList<HValue*>* arguments_values = args->arguments_values();
9267     int arguments_count = arguments_values->length();
9268     Push(function);
9269     Push(BuildWrapReceiver(receiver, checked_function));
9270     for (int i = 1; i < arguments_count; i++) {
9271       Push(arguments_values->at(i));
9272     }
9273     HandleIndirectCall(expr, function, arguments_count);
9274   }
9275 }
9276
9277
9278 // f.call(...)
9279 void HOptimizedGraphBuilder::BuildFunctionCall(Call* expr) {
9280   HValue* function = Top();  // f
9281   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9282   HValue* checked_function = AddCheckMap(function, function_map);
9283
9284   // f and call are on the stack in the unoptimized code
9285   // during evaluation of the arguments.
9286   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9287
9288   int args_length = expr->arguments()->length();
9289   int receiver_index = args_length - 1;
9290   // Patch the receiver.
9291   HValue* receiver = BuildWrapReceiver(
9292       environment()->ExpressionStackAt(receiver_index), checked_function);
9293   environment()->SetExpressionStackAt(receiver_index, receiver);
9294
9295   // Call must not be on the stack from now on.
9296   int call_index = args_length + 1;
9297   environment()->RemoveExpressionStackAt(call_index);
9298
9299   HandleIndirectCall(expr, function, args_length);
9300 }
9301
9302
9303 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
9304                                                     Handle<JSFunction> target) {
9305   SharedFunctionInfo* shared = target->shared();
9306   if (is_sloppy(shared->language_mode()) && !shared->native()) {
9307     // Cannot embed a direct reference to the global proxy
9308     // as is it dropped on deserialization.
9309     CHECK(!isolate()->serializer_enabled());
9310     Handle<JSObject> global_proxy(target->context()->global_proxy());
9311     return Add<HConstant>(global_proxy);
9312   }
9313   return graph()->GetConstantUndefined();
9314 }
9315
9316
9317 void HOptimizedGraphBuilder::BuildArrayCall(Expression* expression,
9318                                             int arguments_count,
9319                                             HValue* function,
9320                                             Handle<AllocationSite> site) {
9321   Add<HCheckValue>(function, array_function());
9322
9323   if (IsCallArrayInlineable(arguments_count, site)) {
9324     BuildInlinedCallArray(expression, arguments_count, site);
9325     return;
9326   }
9327
9328   HInstruction* call = PreProcessCall(New<HCallNewArray>(
9329       function, arguments_count + 1, site->GetElementsKind(), site));
9330   if (expression->IsCall()) {
9331     Drop(1);
9332   }
9333   ast_context()->ReturnInstruction(call, expression->id());
9334 }
9335
9336
9337 HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
9338                                                   HValue* search_element,
9339                                                   ElementsKind kind,
9340                                                   ArrayIndexOfMode mode) {
9341   DCHECK(IsFastElementsKind(kind));
9342
9343   NoObservableSideEffectsScope no_effects(this);
9344
9345   HValue* elements = AddLoadElements(receiver);
9346   HValue* length = AddLoadArrayLength(receiver, kind);
9347
9348   HValue* initial;
9349   HValue* terminating;
9350   Token::Value token;
9351   LoopBuilder::Direction direction;
9352   if (mode == kFirstIndexOf) {
9353     initial = graph()->GetConstant0();
9354     terminating = length;
9355     token = Token::LT;
9356     direction = LoopBuilder::kPostIncrement;
9357   } else {
9358     DCHECK_EQ(kLastIndexOf, mode);
9359     initial = length;
9360     terminating = graph()->GetConstant0();
9361     token = Token::GT;
9362     direction = LoopBuilder::kPreDecrement;
9363   }
9364
9365   Push(graph()->GetConstantMinus1());
9366   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
9367     // Make sure that we can actually compare numbers correctly below, see
9368     // https://code.google.com/p/chromium/issues/detail?id=407946 for details.
9369     search_element = AddUncasted<HForceRepresentation>(
9370         search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
9371                                                     : Representation::Double());
9372
9373     LoopBuilder loop(this, context(), direction);
9374     {
9375       HValue* index = loop.BeginBody(initial, terminating, token);
9376       HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr, kind,
9377                                                 ALLOW_RETURN_HOLE);
9378       IfBuilder if_issame(this);
9379       if_issame.If<HCompareNumericAndBranch>(element, search_element,
9380                                              Token::EQ_STRICT);
9381       if_issame.Then();
9382       {
9383         Drop(1);
9384         Push(index);
9385         loop.Break();
9386       }
9387       if_issame.End();
9388     }
9389     loop.EndBody();
9390   } else {
9391     IfBuilder if_isstring(this);
9392     if_isstring.If<HIsStringAndBranch>(search_element);
9393     if_isstring.Then();
9394     {
9395       LoopBuilder loop(this, context(), direction);
9396       {
9397         HValue* index = loop.BeginBody(initial, terminating, token);
9398         HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9399                                                   kind, ALLOW_RETURN_HOLE);
9400         IfBuilder if_issame(this);
9401         if_issame.If<HIsStringAndBranch>(element);
9402         if_issame.AndIf<HStringCompareAndBranch>(
9403             element, search_element, Token::EQ_STRICT);
9404         if_issame.Then();
9405         {
9406           Drop(1);
9407           Push(index);
9408           loop.Break();
9409         }
9410         if_issame.End();
9411       }
9412       loop.EndBody();
9413     }
9414     if_isstring.Else();
9415     {
9416       IfBuilder if_isnumber(this);
9417       if_isnumber.If<HIsSmiAndBranch>(search_element);
9418       if_isnumber.OrIf<HCompareMap>(
9419           search_element, isolate()->factory()->heap_number_map());
9420       if_isnumber.Then();
9421       {
9422         HValue* search_number =
9423             AddUncasted<HForceRepresentation>(search_element,
9424                                               Representation::Double());
9425         LoopBuilder loop(this, context(), direction);
9426         {
9427           HValue* index = loop.BeginBody(initial, terminating, token);
9428           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9429                                                     kind, ALLOW_RETURN_HOLE);
9430
9431           IfBuilder if_element_isnumber(this);
9432           if_element_isnumber.If<HIsSmiAndBranch>(element);
9433           if_element_isnumber.OrIf<HCompareMap>(
9434               element, isolate()->factory()->heap_number_map());
9435           if_element_isnumber.Then();
9436           {
9437             HValue* number =
9438                 AddUncasted<HForceRepresentation>(element,
9439                                                   Representation::Double());
9440             IfBuilder if_issame(this);
9441             if_issame.If<HCompareNumericAndBranch>(
9442                 number, search_number, Token::EQ_STRICT);
9443             if_issame.Then();
9444             {
9445               Drop(1);
9446               Push(index);
9447               loop.Break();
9448             }
9449             if_issame.End();
9450           }
9451           if_element_isnumber.End();
9452         }
9453         loop.EndBody();
9454       }
9455       if_isnumber.Else();
9456       {
9457         LoopBuilder loop(this, context(), direction);
9458         {
9459           HValue* index = loop.BeginBody(initial, terminating, token);
9460           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9461                                                     kind, ALLOW_RETURN_HOLE);
9462           IfBuilder if_issame(this);
9463           if_issame.If<HCompareObjectEqAndBranch>(
9464               element, search_element);
9465           if_issame.Then();
9466           {
9467             Drop(1);
9468             Push(index);
9469             loop.Break();
9470           }
9471           if_issame.End();
9472         }
9473         loop.EndBody();
9474       }
9475       if_isnumber.End();
9476     }
9477     if_isstring.End();
9478   }
9479
9480   return Pop();
9481 }
9482
9483
9484 bool HOptimizedGraphBuilder::TryHandleArrayCall(Call* expr, HValue* function) {
9485   if (!array_function().is_identical_to(expr->target())) {
9486     return false;
9487   }
9488
9489   Handle<AllocationSite> site = expr->allocation_site();
9490   if (site.is_null()) return false;
9491
9492   BuildArrayCall(expr,
9493                  expr->arguments()->length(),
9494                  function,
9495                  site);
9496   return true;
9497 }
9498
9499
9500 bool HOptimizedGraphBuilder::TryHandleArrayCallNew(CallNew* expr,
9501                                                    HValue* function) {
9502   if (!array_function().is_identical_to(expr->target())) {
9503     return false;
9504   }
9505
9506   Handle<AllocationSite> site = expr->allocation_site();
9507   if (site.is_null()) return false;
9508
9509   BuildArrayCall(expr, expr->arguments()->length(), function, site);
9510   return true;
9511 }
9512
9513
9514 bool HOptimizedGraphBuilder::CanBeFunctionApplyArguments(Call* expr) {
9515   ZoneList<Expression*>* args = expr->arguments();
9516   if (args->length() != 2) return false;
9517   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
9518   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
9519   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
9520   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
9521   return true;
9522 }
9523
9524
9525 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
9526   DCHECK(!HasStackOverflow());
9527   DCHECK(current_block() != NULL);
9528   DCHECK(current_block()->HasPredecessor());
9529   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9530   Expression* callee = expr->expression();
9531   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
9532   HInstruction* call = NULL;
9533
9534   Property* prop = callee->AsProperty();
9535   if (prop != NULL) {
9536     CHECK_ALIVE(VisitForValue(prop->obj()));
9537     HValue* receiver = Top();
9538
9539     SmallMapList* maps;
9540     ComputeReceiverTypes(expr, receiver, &maps, zone());
9541
9542     if (prop->key()->IsPropertyName() && maps->length() > 0) {
9543       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
9544       PropertyAccessInfo info(this, LOAD, maps->first(), name);
9545       if (!info.CanAccessAsMonomorphic(maps)) {
9546         HandlePolymorphicCallNamed(expr, receiver, maps, name);
9547         return;
9548       }
9549     }
9550     HValue* key = NULL;
9551     if (!prop->key()->IsPropertyName()) {
9552       CHECK_ALIVE(VisitForValue(prop->key()));
9553       key = Pop();
9554     }
9555
9556     CHECK_ALIVE(PushLoad(prop, receiver, key));
9557     HValue* function = Pop();
9558
9559     if (function->IsConstant() &&
9560         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9561       // Push the function under the receiver.
9562       environment()->SetExpressionStackAt(0, function);
9563       Push(receiver);
9564
9565       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
9566           HConstant::cast(function)->handle(isolate()));
9567       expr->set_target(known_function);
9568
9569       if (TryIndirectCall(expr)) return;
9570       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9571
9572       Handle<Map> map = maps->length() == 1 ? maps->first() : Handle<Map>();
9573       if (TryInlineBuiltinMethodCall(expr, known_function, map,
9574                                      expr->arguments()->length())) {
9575         if (FLAG_trace_inlining) {
9576           PrintF("Inlining builtin ");
9577           known_function->ShortPrint();
9578           PrintF("\n");
9579         }
9580         return;
9581       }
9582       if (TryInlineApiMethodCall(expr, receiver, maps)) return;
9583
9584       // Wrap the receiver if necessary.
9585       if (NeedsWrapping(maps->first(), known_function)) {
9586         // Since HWrapReceiver currently cannot actually wrap numbers and
9587         // strings, use the regular CallFunctionStub for method calls to wrap
9588         // the receiver.
9589         // TODO(verwaest): Support creation of value wrappers directly in
9590         // HWrapReceiver.
9591         call = New<HCallFunction>(
9592             function, argument_count, WRAP_AND_CALL);
9593       } else if (TryInlineCall(expr)) {
9594         return;
9595       } else {
9596         call = BuildCallConstantFunction(known_function, argument_count);
9597       }
9598
9599     } else {
9600       ArgumentsAllowedFlag arguments_flag = ARGUMENTS_NOT_ALLOWED;
9601       if (CanBeFunctionApplyArguments(expr) && expr->is_uninitialized()) {
9602         // We have to use EAGER deoptimization here because Deoptimizer::SOFT
9603         // gets ignored by the always-opt flag, which leads to incorrect code.
9604         Add<HDeoptimize>(
9605             Deoptimizer::kInsufficientTypeFeedbackForCallWithArguments,
9606             Deoptimizer::EAGER);
9607         arguments_flag = ARGUMENTS_FAKED;
9608       }
9609
9610       // Push the function under the receiver.
9611       environment()->SetExpressionStackAt(0, function);
9612       Push(receiver);
9613
9614       CHECK_ALIVE(VisitExpressions(expr->arguments(), arguments_flag));
9615       CallFunctionFlags flags = receiver->type().IsJSObject()
9616           ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
9617       call = New<HCallFunction>(function, argument_count, flags);
9618     }
9619     PushArgumentsFromEnvironment(argument_count);
9620
9621   } else {
9622     VariableProxy* proxy = expr->expression()->AsVariableProxy();
9623     if (proxy != NULL && proxy->var()->is_possibly_eval(isolate())) {
9624       return Bailout(kPossibleDirectCallToEval);
9625     }
9626
9627     // The function is on the stack in the unoptimized code during
9628     // evaluation of the arguments.
9629     CHECK_ALIVE(VisitForValue(expr->expression()));
9630     HValue* function = Top();
9631     if (function->IsConstant() &&
9632         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9633       Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9634       Handle<JSFunction> target = Handle<JSFunction>::cast(constant);
9635       expr->SetKnownGlobalTarget(target);
9636     }
9637
9638     // Placeholder for the receiver.
9639     Push(graph()->GetConstantUndefined());
9640     CHECK_ALIVE(VisitExpressions(expr->arguments()));
9641
9642     if (expr->IsMonomorphic()) {
9643       Add<HCheckValue>(function, expr->target());
9644
9645       // Patch the global object on the stack by the expected receiver.
9646       HValue* receiver = ImplicitReceiverFor(function, expr->target());
9647       const int receiver_index = argument_count - 1;
9648       environment()->SetExpressionStackAt(receiver_index, receiver);
9649
9650       if (TryInlineBuiltinFunctionCall(expr)) {
9651         if (FLAG_trace_inlining) {
9652           PrintF("Inlining builtin ");
9653           expr->target()->ShortPrint();
9654           PrintF("\n");
9655         }
9656         return;
9657       }
9658       if (TryInlineApiFunctionCall(expr, receiver)) return;
9659       if (TryHandleArrayCall(expr, function)) return;
9660       if (TryInlineCall(expr)) return;
9661
9662       PushArgumentsFromEnvironment(argument_count);
9663       call = BuildCallConstantFunction(expr->target(), argument_count);
9664     } else {
9665       PushArgumentsFromEnvironment(argument_count);
9666       HCallFunction* call_function =
9667           New<HCallFunction>(function, argument_count);
9668       call = call_function;
9669       if (expr->is_uninitialized() &&
9670           expr->IsUsingCallFeedbackICSlot(isolate())) {
9671         // We've never seen this call before, so let's have Crankshaft learn
9672         // through the type vector.
9673         Handle<TypeFeedbackVector> vector =
9674             handle(current_feedback_vector(), isolate());
9675         FeedbackVectorICSlot slot = expr->CallFeedbackICSlot();
9676         call_function->SetVectorAndSlot(vector, slot);
9677       }
9678     }
9679   }
9680
9681   Drop(1);  // Drop the function.
9682   return ast_context()->ReturnInstruction(call, expr->id());
9683 }
9684
9685
9686 void HOptimizedGraphBuilder::BuildInlinedCallArray(
9687     Expression* expression,
9688     int argument_count,
9689     Handle<AllocationSite> site) {
9690   DCHECK(!site.is_null());
9691   DCHECK(argument_count >= 0 && argument_count <= 1);
9692   NoObservableSideEffectsScope no_effects(this);
9693
9694   // We should at least have the constructor on the expression stack.
9695   HValue* constructor = environment()->ExpressionStackAt(argument_count);
9696
9697   // Register on the site for deoptimization if the transition feedback changes.
9698   top_info()->dependencies()->AssumeTransitionStable(site);
9699   ElementsKind kind = site->GetElementsKind();
9700   HInstruction* site_instruction = Add<HConstant>(site);
9701
9702   // In the single constant argument case, we may have to adjust elements kind
9703   // to avoid creating a packed non-empty array.
9704   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
9705     HValue* argument = environment()->Top();
9706     if (argument->IsConstant()) {
9707       HConstant* constant_argument = HConstant::cast(argument);
9708       DCHECK(constant_argument->HasSmiValue());
9709       int constant_array_size = constant_argument->Integer32Value();
9710       if (constant_array_size != 0) {
9711         kind = GetHoleyElementsKind(kind);
9712       }
9713     }
9714   }
9715
9716   // Build the array.
9717   JSArrayBuilder array_builder(this,
9718                                kind,
9719                                site_instruction,
9720                                constructor,
9721                                DISABLE_ALLOCATION_SITES);
9722   HValue* new_object = argument_count == 0
9723       ? array_builder.AllocateEmptyArray()
9724       : BuildAllocateArrayFromLength(&array_builder, Top());
9725
9726   int args_to_drop = argument_count + (expression->IsCall() ? 2 : 1);
9727   Drop(args_to_drop);
9728   ast_context()->ReturnValue(new_object);
9729 }
9730
9731
9732 // Checks whether allocation using the given constructor can be inlined.
9733 static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
9734   return constructor->has_initial_map() &&
9735          constructor->initial_map()->instance_type() == JS_OBJECT_TYPE &&
9736          constructor->initial_map()->instance_size() <
9737              HAllocate::kMaxInlineSize;
9738 }
9739
9740
9741 bool HOptimizedGraphBuilder::IsCallArrayInlineable(
9742     int argument_count,
9743     Handle<AllocationSite> site) {
9744   Handle<JSFunction> caller = current_info()->closure();
9745   Handle<JSFunction> target = array_function();
9746   // We should have the function plus array arguments on the environment stack.
9747   DCHECK(environment()->length() >= (argument_count + 1));
9748   DCHECK(!site.is_null());
9749
9750   bool inline_ok = false;
9751   if (site->CanInlineCall()) {
9752     // We also want to avoid inlining in certain 1 argument scenarios.
9753     if (argument_count == 1) {
9754       HValue* argument = Top();
9755       if (argument->IsConstant()) {
9756         // Do not inline if the constant length argument is not a smi or
9757         // outside the valid range for unrolled loop initialization.
9758         HConstant* constant_argument = HConstant::cast(argument);
9759         if (constant_argument->HasSmiValue()) {
9760           int value = constant_argument->Integer32Value();
9761           inline_ok = value >= 0 && value <= kElementLoopUnrollThreshold;
9762           if (!inline_ok) {
9763             TraceInline(target, caller,
9764                         "Constant length outside of valid inlining range.");
9765           }
9766         }
9767       } else {
9768         TraceInline(target, caller,
9769                     "Dont inline [new] Array(n) where n isn't constant.");
9770       }
9771     } else if (argument_count == 0) {
9772       inline_ok = true;
9773     } else {
9774       TraceInline(target, caller, "Too many arguments to inline.");
9775     }
9776   } else {
9777     TraceInline(target, caller, "AllocationSite requested no inlining.");
9778   }
9779
9780   if (inline_ok) {
9781     TraceInline(target, caller, NULL);
9782   }
9783   return inline_ok;
9784 }
9785
9786
9787 void HOptimizedGraphBuilder::VisitCallNew(CallNew* expr) {
9788   DCHECK(!HasStackOverflow());
9789   DCHECK(current_block() != NULL);
9790   DCHECK(current_block()->HasPredecessor());
9791   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9792   int argument_count = expr->arguments()->length() + 1;  // Plus constructor.
9793   Factory* factory = isolate()->factory();
9794
9795   // The constructor function is on the stack in the unoptimized code
9796   // during evaluation of the arguments.
9797   CHECK_ALIVE(VisitForValue(expr->expression()));
9798   HValue* function = Top();
9799   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9800
9801   if (function->IsConstant() &&
9802       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9803     Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9804     expr->SetKnownGlobalTarget(Handle<JSFunction>::cast(constant));
9805   }
9806
9807   if (FLAG_inline_construct &&
9808       expr->IsMonomorphic() &&
9809       IsAllocationInlineable(expr->target())) {
9810     Handle<JSFunction> constructor = expr->target();
9811     HValue* check = Add<HCheckValue>(function, constructor);
9812
9813     // Force completion of inobject slack tracking before generating
9814     // allocation code to finalize instance size.
9815     if (constructor->IsInobjectSlackTrackingInProgress()) {
9816       constructor->CompleteInobjectSlackTracking();
9817     }
9818
9819     // Calculate instance size from initial map of constructor.
9820     DCHECK(constructor->has_initial_map());
9821     Handle<Map> initial_map(constructor->initial_map());
9822     int instance_size = initial_map->instance_size();
9823
9824     // Allocate an instance of the implicit receiver object.
9825     HValue* size_in_bytes = Add<HConstant>(instance_size);
9826     HAllocationMode allocation_mode;
9827     if (FLAG_pretenuring_call_new) {
9828       if (FLAG_allocation_site_pretenuring) {
9829         // Try to use pretenuring feedback.
9830         Handle<AllocationSite> allocation_site = expr->allocation_site();
9831         allocation_mode = HAllocationMode(allocation_site);
9832         // Take a dependency on allocation site.
9833         top_info()->dependencies()->AssumeTenuringDecision(allocation_site);
9834       }
9835     }
9836
9837     HAllocate* receiver = BuildAllocate(
9838         size_in_bytes, HType::JSObject(), JS_OBJECT_TYPE, allocation_mode);
9839     receiver->set_known_initial_map(initial_map);
9840
9841     // Initialize map and fields of the newly allocated object.
9842     { NoObservableSideEffectsScope no_effects(this);
9843       DCHECK(initial_map->instance_type() == JS_OBJECT_TYPE);
9844       Add<HStoreNamedField>(receiver,
9845           HObjectAccess::ForMapAndOffset(initial_map, JSObject::kMapOffset),
9846           Add<HConstant>(initial_map));
9847       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
9848       Add<HStoreNamedField>(receiver,
9849           HObjectAccess::ForMapAndOffset(initial_map,
9850                                          JSObject::kPropertiesOffset),
9851           empty_fixed_array);
9852       Add<HStoreNamedField>(receiver,
9853           HObjectAccess::ForMapAndOffset(initial_map,
9854                                          JSObject::kElementsOffset),
9855           empty_fixed_array);
9856       BuildInitializeInobjectProperties(receiver, initial_map);
9857     }
9858
9859     // Replace the constructor function with a newly allocated receiver using
9860     // the index of the receiver from the top of the expression stack.
9861     const int receiver_index = argument_count - 1;
9862     DCHECK(environment()->ExpressionStackAt(receiver_index) == function);
9863     environment()->SetExpressionStackAt(receiver_index, receiver);
9864
9865     if (TryInlineConstruct(expr, receiver)) {
9866       // Inlining worked, add a dependency on the initial map to make sure that
9867       // this code is deoptimized whenever the initial map of the constructor
9868       // changes.
9869       top_info()->dependencies()->AssumeInitialMapCantChange(initial_map);
9870       return;
9871     }
9872
9873     // TODO(mstarzinger): For now we remove the previous HAllocate and all
9874     // corresponding instructions and instead add HPushArguments for the
9875     // arguments in case inlining failed.  What we actually should do is for
9876     // inlining to try to build a subgraph without mutating the parent graph.
9877     HInstruction* instr = current_block()->last();
9878     do {
9879       HInstruction* prev_instr = instr->previous();
9880       instr->DeleteAndReplaceWith(NULL);
9881       instr = prev_instr;
9882     } while (instr != check);
9883     environment()->SetExpressionStackAt(receiver_index, function);
9884     HInstruction* call =
9885       PreProcessCall(New<HCallNew>(function, argument_count));
9886     return ast_context()->ReturnInstruction(call, expr->id());
9887   } else {
9888     // The constructor function is both an operand to the instruction and an
9889     // argument to the construct call.
9890     if (TryHandleArrayCallNew(expr, function)) return;
9891
9892     HInstruction* call =
9893         PreProcessCall(New<HCallNew>(function, argument_count));
9894     return ast_context()->ReturnInstruction(call, expr->id());
9895   }
9896 }
9897
9898
9899 void HOptimizedGraphBuilder::BuildInitializeInobjectProperties(
9900     HValue* receiver, Handle<Map> initial_map) {
9901   if (initial_map->GetInObjectProperties() != 0) {
9902     HConstant* undefined = graph()->GetConstantUndefined();
9903     for (int i = 0; i < initial_map->GetInObjectProperties(); i++) {
9904       int property_offset = initial_map->GetInObjectPropertyOffset(i);
9905       Add<HStoreNamedField>(receiver, HObjectAccess::ForMapAndOffset(
9906                                           initial_map, property_offset),
9907                             undefined);
9908     }
9909   }
9910 }
9911
9912
9913 HValue* HGraphBuilder::BuildAllocateEmptyArrayBuffer(HValue* byte_length) {
9914   // We HForceRepresentation here to avoid allocations during an *-to-tagged
9915   // HChange that could cause GC while the array buffer object is not fully
9916   // initialized.
9917   HObjectAccess byte_length_access(HObjectAccess::ForJSArrayBufferByteLength());
9918   byte_length = AddUncasted<HForceRepresentation>(
9919       byte_length, byte_length_access.representation());
9920   HAllocate* result =
9921       BuildAllocate(Add<HConstant>(JSArrayBuffer::kSizeWithInternalFields),
9922                     HType::JSObject(), JS_ARRAY_BUFFER_TYPE, HAllocationMode());
9923
9924   HValue* global_object = Add<HLoadNamedField>(
9925       context(), nullptr,
9926       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
9927   HValue* native_context = Add<HLoadNamedField>(
9928       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
9929   Add<HStoreNamedField>(
9930       result, HObjectAccess::ForMap(),
9931       Add<HLoadNamedField>(
9932           native_context, nullptr,
9933           HObjectAccess::ForContextSlot(Context::ARRAY_BUFFER_MAP_INDEX)));
9934
9935   HConstant* empty_fixed_array =
9936       Add<HConstant>(isolate()->factory()->empty_fixed_array());
9937   Add<HStoreNamedField>(
9938       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
9939       empty_fixed_array);
9940   Add<HStoreNamedField>(
9941       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
9942       empty_fixed_array);
9943   Add<HStoreNamedField>(
9944       result, HObjectAccess::ForJSArrayBufferBackingStore().WithRepresentation(
9945                   Representation::Smi()),
9946       graph()->GetConstant0());
9947   Add<HStoreNamedField>(result, byte_length_access, byte_length);
9948   Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBitFieldSlot(),
9949                         graph()->GetConstant0());
9950   Add<HStoreNamedField>(
9951       result, HObjectAccess::ForJSArrayBufferBitField(),
9952       Add<HConstant>((1 << JSArrayBuffer::IsExternal::kShift) |
9953                      (1 << JSArrayBuffer::IsNeuterable::kShift)));
9954
9955   for (int field = 0; field < v8::ArrayBuffer::kInternalFieldCount; ++field) {
9956     Add<HStoreNamedField>(
9957         result,
9958         HObjectAccess::ForObservableJSObjectOffset(
9959             JSArrayBuffer::kSize + field * kPointerSize, Representation::Smi()),
9960         graph()->GetConstant0());
9961   }
9962
9963   return result;
9964 }
9965
9966
9967 template <class ViewClass>
9968 void HGraphBuilder::BuildArrayBufferViewInitialization(
9969     HValue* obj,
9970     HValue* buffer,
9971     HValue* byte_offset,
9972     HValue* byte_length) {
9973
9974   for (int offset = ViewClass::kSize;
9975        offset < ViewClass::kSizeWithInternalFields;
9976        offset += kPointerSize) {
9977     Add<HStoreNamedField>(obj,
9978         HObjectAccess::ForObservableJSObjectOffset(offset),
9979         graph()->GetConstant0());
9980   }
9981
9982   Add<HStoreNamedField>(
9983       obj,
9984       HObjectAccess::ForJSArrayBufferViewByteOffset(),
9985       byte_offset);
9986   Add<HStoreNamedField>(
9987       obj,
9988       HObjectAccess::ForJSArrayBufferViewByteLength(),
9989       byte_length);
9990   Add<HStoreNamedField>(obj, HObjectAccess::ForJSArrayBufferViewBuffer(),
9991                         buffer);
9992 }
9993
9994
9995 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
9996     CallRuntime* expr) {
9997   ZoneList<Expression*>* arguments = expr->arguments();
9998
9999   DCHECK(arguments->length()== 4);
10000   CHECK_ALIVE(VisitForValue(arguments->at(0)));
10001   HValue* obj = Pop();
10002
10003   CHECK_ALIVE(VisitForValue(arguments->at(1)));
10004   HValue* buffer = Pop();
10005
10006   CHECK_ALIVE(VisitForValue(arguments->at(2)));
10007   HValue* byte_offset = Pop();
10008
10009   CHECK_ALIVE(VisitForValue(arguments->at(3)));
10010   HValue* byte_length = Pop();
10011
10012   {
10013     NoObservableSideEffectsScope scope(this);
10014     BuildArrayBufferViewInitialization<JSDataView>(
10015         obj, buffer, byte_offset, byte_length);
10016   }
10017 }
10018
10019
10020 static Handle<Map> TypedArrayMap(Isolate* isolate,
10021                                  ExternalArrayType array_type,
10022                                  ElementsKind target_kind) {
10023   Handle<Context> native_context = isolate->native_context();
10024   Handle<JSFunction> fun;
10025   switch (array_type) {
10026 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
10027     case kExternal##Type##Array:                                              \
10028       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
10029       break;
10030
10031     TYPED_ARRAYS(TYPED_ARRAY_CASE)
10032 #undef TYPED_ARRAY_CASE
10033   }
10034   Handle<Map> map(fun->initial_map());
10035   return Map::AsElementsKind(map, target_kind);
10036 }
10037
10038
10039 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
10040     ExternalArrayType array_type,
10041     bool is_zero_byte_offset,
10042     HValue* buffer, HValue* byte_offset, HValue* length) {
10043   Handle<Map> external_array_map(
10044       isolate()->heap()->MapForFixedTypedArray(array_type));
10045
10046   // The HForceRepresentation is to prevent possible deopt on int-smi
10047   // conversion after allocation but before the new object fields are set.
10048   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10049   HValue* elements = Add<HAllocate>(
10050       Add<HConstant>(FixedTypedArrayBase::kHeaderSize), HType::HeapObject(),
10051       NOT_TENURED, external_array_map->instance_type());
10052
10053   AddStoreMapConstant(elements, external_array_map);
10054   Add<HStoreNamedField>(elements,
10055       HObjectAccess::ForFixedArrayLength(), length);
10056
10057   HValue* backing_store = Add<HLoadNamedField>(
10058       buffer, nullptr, HObjectAccess::ForJSArrayBufferBackingStore());
10059
10060   HValue* typed_array_start;
10061   if (is_zero_byte_offset) {
10062     typed_array_start = backing_store;
10063   } else {
10064     HInstruction* external_pointer =
10065         AddUncasted<HAdd>(backing_store, byte_offset);
10066     // Arguments are checked prior to call to TypedArrayInitialize,
10067     // including byte_offset.
10068     external_pointer->ClearFlag(HValue::kCanOverflow);
10069     typed_array_start = external_pointer;
10070   }
10071
10072   Add<HStoreNamedField>(elements,
10073                         HObjectAccess::ForFixedTypedArrayBaseBasePointer(),
10074                         graph()->GetConstant0());
10075   Add<HStoreNamedField>(elements,
10076                         HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10077                         typed_array_start);
10078
10079   return elements;
10080 }
10081
10082
10083 HValue* HOptimizedGraphBuilder::BuildAllocateFixedTypedArray(
10084     ExternalArrayType array_type, size_t element_size,
10085     ElementsKind fixed_elements_kind, HValue* byte_length, HValue* length,
10086     bool initialize) {
10087   STATIC_ASSERT(
10088       (FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask) == 0);
10089   HValue* total_size;
10090
10091   // if fixed array's elements are not aligned to object's alignment,
10092   // we need to align the whole array to object alignment.
10093   if (element_size % kObjectAlignment != 0) {
10094     total_size = BuildObjectSizeAlignment(
10095         byte_length, FixedTypedArrayBase::kHeaderSize);
10096   } else {
10097     total_size = AddUncasted<HAdd>(byte_length,
10098         Add<HConstant>(FixedTypedArrayBase::kHeaderSize));
10099     total_size->ClearFlag(HValue::kCanOverflow);
10100   }
10101
10102   // The HForceRepresentation is to prevent possible deopt on int-smi
10103   // conversion after allocation but before the new object fields are set.
10104   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10105   Handle<Map> fixed_typed_array_map(
10106       isolate()->heap()->MapForFixedTypedArray(array_type));
10107   HAllocate* elements =
10108       Add<HAllocate>(total_size, HType::HeapObject(), NOT_TENURED,
10109                      fixed_typed_array_map->instance_type());
10110
10111 #ifndef V8_HOST_ARCH_64_BIT
10112   if (array_type == kExternalFloat64Array) {
10113     elements->MakeDoubleAligned();
10114   }
10115 #endif
10116
10117   AddStoreMapConstant(elements, fixed_typed_array_map);
10118
10119   Add<HStoreNamedField>(elements,
10120       HObjectAccess::ForFixedArrayLength(),
10121       length);
10122   Add<HStoreNamedField>(
10123       elements, HObjectAccess::ForFixedTypedArrayBaseBasePointer(), elements);
10124
10125   Add<HStoreNamedField>(
10126       elements, HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10127       Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()));
10128
10129   HValue* filler = Add<HConstant>(static_cast<int32_t>(0));
10130
10131   if (initialize) {
10132     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
10133
10134     HValue* backing_store = AddUncasted<HAdd>(
10135         Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()),
10136         elements, Strength::WEAK, AddOfExternalAndTagged);
10137
10138     HValue* key = builder.BeginBody(
10139         Add<HConstant>(static_cast<int32_t>(0)),
10140         length, Token::LT);
10141     Add<HStoreKeyed>(backing_store, key, filler, fixed_elements_kind);
10142
10143     builder.EndBody();
10144   }
10145   return elements;
10146 }
10147
10148
10149 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
10150     CallRuntime* expr) {
10151   ZoneList<Expression*>* arguments = expr->arguments();
10152
10153   static const int kObjectArg = 0;
10154   static const int kArrayIdArg = 1;
10155   static const int kBufferArg = 2;
10156   static const int kByteOffsetArg = 3;
10157   static const int kByteLengthArg = 4;
10158   static const int kInitializeArg = 5;
10159   static const int kArgsLength = 6;
10160   DCHECK(arguments->length() == kArgsLength);
10161
10162
10163   CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
10164   HValue* obj = Pop();
10165
10166   if (!arguments->at(kArrayIdArg)->IsLiteral()) {
10167     // This should never happen in real use, but can happen when fuzzing.
10168     // Just bail out.
10169     Bailout(kNeedSmiLiteral);
10170     return;
10171   }
10172   Handle<Object> value =
10173       static_cast<Literal*>(arguments->at(kArrayIdArg))->value();
10174   if (!value->IsSmi()) {
10175     // This should never happen in real use, but can happen when fuzzing.
10176     // Just bail out.
10177     Bailout(kNeedSmiLiteral);
10178     return;
10179   }
10180   int array_id = Smi::cast(*value)->value();
10181
10182   HValue* buffer;
10183   if (!arguments->at(kBufferArg)->IsNullLiteral()) {
10184     CHECK_ALIVE(VisitForValue(arguments->at(kBufferArg)));
10185     buffer = Pop();
10186   } else {
10187     buffer = NULL;
10188   }
10189
10190   HValue* byte_offset;
10191   bool is_zero_byte_offset;
10192
10193   if (arguments->at(kByteOffsetArg)->IsLiteral()
10194       && Smi::FromInt(0) ==
10195       *static_cast<Literal*>(arguments->at(kByteOffsetArg))->value()) {
10196     byte_offset = Add<HConstant>(static_cast<int32_t>(0));
10197     is_zero_byte_offset = true;
10198   } else {
10199     CHECK_ALIVE(VisitForValue(arguments->at(kByteOffsetArg)));
10200     byte_offset = Pop();
10201     is_zero_byte_offset = false;
10202     DCHECK(buffer != NULL);
10203   }
10204
10205   CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
10206   HValue* byte_length = Pop();
10207
10208   CHECK(arguments->at(kInitializeArg)->IsLiteral());
10209   bool initialize = static_cast<Literal*>(arguments->at(kInitializeArg))
10210                         ->value()
10211                         ->BooleanValue();
10212
10213   NoObservableSideEffectsScope scope(this);
10214   IfBuilder byte_offset_smi(this);
10215
10216   if (!is_zero_byte_offset) {
10217     byte_offset_smi.If<HIsSmiAndBranch>(byte_offset);
10218     byte_offset_smi.Then();
10219   }
10220
10221   ExternalArrayType array_type =
10222       kExternalInt8Array;  // Bogus initialization.
10223   size_t element_size = 1;  // Bogus initialization.
10224   ElementsKind fixed_elements_kind =  // Bogus initialization.
10225       INT8_ELEMENTS;
10226   Runtime::ArrayIdToTypeAndSize(array_id,
10227       &array_type,
10228       &fixed_elements_kind,
10229       &element_size);
10230
10231
10232   { //  byte_offset is Smi.
10233     HValue* allocated_buffer = buffer;
10234     if (buffer == NULL) {
10235       allocated_buffer = BuildAllocateEmptyArrayBuffer(byte_length);
10236     }
10237     BuildArrayBufferViewInitialization<JSTypedArray>(obj, allocated_buffer,
10238                                                      byte_offset, byte_length);
10239
10240
10241     HInstruction* length = AddUncasted<HDiv>(byte_length,
10242         Add<HConstant>(static_cast<int32_t>(element_size)));
10243
10244     Add<HStoreNamedField>(obj,
10245         HObjectAccess::ForJSTypedArrayLength(),
10246         length);
10247
10248     HValue* elements;
10249     if (buffer != NULL) {
10250       elements = BuildAllocateExternalElements(
10251           array_type, is_zero_byte_offset, buffer, byte_offset, length);
10252       Handle<Map> obj_map =
10253           TypedArrayMap(isolate(), array_type, fixed_elements_kind);
10254       AddStoreMapConstant(obj, obj_map);
10255     } else {
10256       DCHECK(is_zero_byte_offset);
10257       elements = BuildAllocateFixedTypedArray(array_type, element_size,
10258                                               fixed_elements_kind, byte_length,
10259                                               length, initialize);
10260     }
10261     Add<HStoreNamedField>(
10262         obj, HObjectAccess::ForElementsPointer(), elements);
10263   }
10264
10265   if (!is_zero_byte_offset) {
10266     byte_offset_smi.Else();
10267     { //  byte_offset is not Smi.
10268       Push(obj);
10269       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
10270       Push(buffer);
10271       Push(byte_offset);
10272       Push(byte_length);
10273       CHECK_ALIVE(VisitForValue(arguments->at(kInitializeArg)));
10274       PushArgumentsFromEnvironment(kArgsLength);
10275       Add<HCallRuntime>(expr->function(), kArgsLength);
10276     }
10277   }
10278   byte_offset_smi.End();
10279 }
10280
10281
10282 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
10283   DCHECK(expr->arguments()->length() == 0);
10284   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
10285   return ast_context()->ReturnInstruction(max_smi, expr->id());
10286 }
10287
10288
10289 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
10290     CallRuntime* expr) {
10291   DCHECK(expr->arguments()->length() == 0);
10292   HConstant* result = New<HConstant>(static_cast<int32_t>(
10293         FLAG_typed_array_max_size_in_heap));
10294   return ast_context()->ReturnInstruction(result, expr->id());
10295 }
10296
10297
10298 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
10299     CallRuntime* expr) {
10300   DCHECK(expr->arguments()->length() == 1);
10301   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10302   HValue* buffer = Pop();
10303   HInstruction* result = New<HLoadNamedField>(
10304       buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
10305   return ast_context()->ReturnInstruction(result, expr->id());
10306 }
10307
10308
10309 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
10310     CallRuntime* expr) {
10311   NoObservableSideEffectsScope scope(this);
10312   DCHECK(expr->arguments()->length() == 1);
10313   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10314   HValue* view = Pop();
10315
10316   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10317       view, nullptr,
10318       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteLengthOffset)));
10319 }
10320
10321
10322 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
10323     CallRuntime* expr) {
10324   NoObservableSideEffectsScope scope(this);
10325   DCHECK(expr->arguments()->length() == 1);
10326   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10327   HValue* view = Pop();
10328
10329   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10330       view, nullptr,
10331       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset)));
10332 }
10333
10334
10335 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
10336     CallRuntime* expr) {
10337   NoObservableSideEffectsScope scope(this);
10338   DCHECK(expr->arguments()->length() == 1);
10339   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10340   HValue* view = Pop();
10341
10342   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10343       view, nullptr,
10344       FieldIndex::ForInObjectOffset(JSTypedArray::kLengthOffset)));
10345 }
10346
10347
10348 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
10349   DCHECK(!HasStackOverflow());
10350   DCHECK(current_block() != NULL);
10351   DCHECK(current_block()->HasPredecessor());
10352   if (expr->is_jsruntime()) {
10353     return Bailout(kCallToAJavaScriptRuntimeFunction);
10354   }
10355
10356   const Runtime::Function* function = expr->function();
10357   DCHECK(function != NULL);
10358   switch (function->function_id) {
10359 #define CALL_INTRINSIC_GENERATOR(Name) \
10360   case Runtime::kInline##Name:         \
10361     return Generate##Name(expr);
10362
10363     FOR_EACH_HYDROGEN_INTRINSIC(CALL_INTRINSIC_GENERATOR)
10364 #undef CALL_INTRINSIC_GENERATOR
10365     default: {
10366       int argument_count = expr->arguments()->length();
10367       CHECK_ALIVE(VisitExpressions(expr->arguments()));
10368       PushArgumentsFromEnvironment(argument_count);
10369       HCallRuntime* call = New<HCallRuntime>(function, argument_count);
10370       return ast_context()->ReturnInstruction(call, expr->id());
10371     }
10372   }
10373 }
10374
10375
10376 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
10377   DCHECK(!HasStackOverflow());
10378   DCHECK(current_block() != NULL);
10379   DCHECK(current_block()->HasPredecessor());
10380   switch (expr->op()) {
10381     case Token::DELETE: return VisitDelete(expr);
10382     case Token::VOID: return VisitVoid(expr);
10383     case Token::TYPEOF: return VisitTypeof(expr);
10384     case Token::NOT: return VisitNot(expr);
10385     default: UNREACHABLE();
10386   }
10387 }
10388
10389
10390 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
10391   Property* prop = expr->expression()->AsProperty();
10392   VariableProxy* proxy = expr->expression()->AsVariableProxy();
10393   if (prop != NULL) {
10394     CHECK_ALIVE(VisitForValue(prop->obj()));
10395     CHECK_ALIVE(VisitForValue(prop->key()));
10396     HValue* key = Pop();
10397     HValue* obj = Pop();
10398     Add<HPushArguments>(obj, key);
10399     HInstruction* instr = New<HCallRuntime>(
10400         Runtime::FunctionForId(is_strict(function_language_mode())
10401                                    ? Runtime::kDeleteProperty_Strict
10402                                    : Runtime::kDeleteProperty_Sloppy),
10403         2);
10404     return ast_context()->ReturnInstruction(instr, expr->id());
10405   } else if (proxy != NULL) {
10406     Variable* var = proxy->var();
10407     if (var->IsUnallocatedOrGlobalSlot()) {
10408       Bailout(kDeleteWithGlobalVariable);
10409     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
10410       // Result of deleting non-global variables is false.  'this' is not really
10411       // a variable, though we implement it as one.  The subexpression does not
10412       // have side effects.
10413       HValue* value = var->HasThisName(isolate()) ? graph()->GetConstantTrue()
10414                                                   : graph()->GetConstantFalse();
10415       return ast_context()->ReturnValue(value);
10416     } else {
10417       Bailout(kDeleteWithNonGlobalVariable);
10418     }
10419   } else {
10420     // Result of deleting non-property, non-variable reference is true.
10421     // Evaluate the subexpression for side effects.
10422     CHECK_ALIVE(VisitForEffect(expr->expression()));
10423     return ast_context()->ReturnValue(graph()->GetConstantTrue());
10424   }
10425 }
10426
10427
10428 void HOptimizedGraphBuilder::VisitVoid(UnaryOperation* expr) {
10429   CHECK_ALIVE(VisitForEffect(expr->expression()));
10430   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
10431 }
10432
10433
10434 void HOptimizedGraphBuilder::VisitTypeof(UnaryOperation* expr) {
10435   CHECK_ALIVE(VisitForTypeOf(expr->expression()));
10436   HValue* value = Pop();
10437   HInstruction* instr = New<HTypeof>(value);
10438   return ast_context()->ReturnInstruction(instr, expr->id());
10439 }
10440
10441
10442 void HOptimizedGraphBuilder::VisitNot(UnaryOperation* expr) {
10443   if (ast_context()->IsTest()) {
10444     TestContext* context = TestContext::cast(ast_context());
10445     VisitForControl(expr->expression(),
10446                     context->if_false(),
10447                     context->if_true());
10448     return;
10449   }
10450
10451   if (ast_context()->IsEffect()) {
10452     VisitForEffect(expr->expression());
10453     return;
10454   }
10455
10456   DCHECK(ast_context()->IsValue());
10457   HBasicBlock* materialize_false = graph()->CreateBasicBlock();
10458   HBasicBlock* materialize_true = graph()->CreateBasicBlock();
10459   CHECK_BAILOUT(VisitForControl(expr->expression(),
10460                                 materialize_false,
10461                                 materialize_true));
10462
10463   if (materialize_false->HasPredecessor()) {
10464     materialize_false->SetJoinId(expr->MaterializeFalseId());
10465     set_current_block(materialize_false);
10466     Push(graph()->GetConstantFalse());
10467   } else {
10468     materialize_false = NULL;
10469   }
10470
10471   if (materialize_true->HasPredecessor()) {
10472     materialize_true->SetJoinId(expr->MaterializeTrueId());
10473     set_current_block(materialize_true);
10474     Push(graph()->GetConstantTrue());
10475   } else {
10476     materialize_true = NULL;
10477   }
10478
10479   HBasicBlock* join =
10480     CreateJoin(materialize_false, materialize_true, expr->id());
10481   set_current_block(join);
10482   if (join != NULL) return ast_context()->ReturnValue(Pop());
10483 }
10484
10485
10486 static Representation RepresentationFor(Type* type) {
10487   DisallowHeapAllocation no_allocation;
10488   if (type->Is(Type::None())) return Representation::None();
10489   if (type->Is(Type::SignedSmall())) return Representation::Smi();
10490   if (type->Is(Type::Signed32())) return Representation::Integer32();
10491   if (type->Is(Type::Number())) return Representation::Double();
10492   return Representation::Tagged();
10493 }
10494
10495
10496 HInstruction* HOptimizedGraphBuilder::BuildIncrement(
10497     bool returns_original_input,
10498     CountOperation* expr) {
10499   // The input to the count operation is on top of the expression stack.
10500   Representation rep = RepresentationFor(expr->type());
10501   if (rep.IsNone() || rep.IsTagged()) {
10502     rep = Representation::Smi();
10503   }
10504
10505   if (returns_original_input && !is_strong(function_language_mode())) {
10506     // We need an explicit HValue representing ToNumber(input).  The
10507     // actual HChange instruction we need is (sometimes) added in a later
10508     // phase, so it is not available now to be used as an input to HAdd and
10509     // as the return value.
10510     HInstruction* number_input = AddUncasted<HForceRepresentation>(Pop(), rep);
10511     if (!rep.IsDouble()) {
10512       number_input->SetFlag(HInstruction::kFlexibleRepresentation);
10513       number_input->SetFlag(HInstruction::kCannotBeTagged);
10514     }
10515     Push(number_input);
10516   }
10517
10518   // The addition has no side effects, so we do not need
10519   // to simulate the expression stack after this instruction.
10520   // Any later failures deopt to the load of the input or earlier.
10521   HConstant* delta = (expr->op() == Token::INC)
10522       ? graph()->GetConstant1()
10523       : graph()->GetConstantMinus1();
10524   HInstruction* instr =
10525       AddUncasted<HAdd>(Top(), delta, strength(function_language_mode()));
10526   if (instr->IsAdd()) {
10527     HAdd* add = HAdd::cast(instr);
10528     add->set_observed_input_representation(1, rep);
10529     add->set_observed_input_representation(2, Representation::Smi());
10530   }
10531   if (!is_strong(function_language_mode())) {
10532     instr->ClearAllSideEffects();
10533   } else {
10534     Add<HSimulate>(expr->ToNumberId(), REMOVABLE_SIMULATE);
10535   }
10536   instr->SetFlag(HInstruction::kCannotBeTagged);
10537   return instr;
10538 }
10539
10540
10541 void HOptimizedGraphBuilder::BuildStoreForEffect(
10542     Expression* expr, Property* prop, FeedbackVectorICSlot slot,
10543     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* key,
10544     HValue* value) {
10545   EffectContext for_effect(this);
10546   Push(object);
10547   if (key != NULL) Push(key);
10548   Push(value);
10549   BuildStore(expr, prop, slot, ast_id, return_id);
10550 }
10551
10552
10553 void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
10554   DCHECK(!HasStackOverflow());
10555   DCHECK(current_block() != NULL);
10556   DCHECK(current_block()->HasPredecessor());
10557   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
10558   Expression* target = expr->expression();
10559   VariableProxy* proxy = target->AsVariableProxy();
10560   Property* prop = target->AsProperty();
10561   if (proxy == NULL && prop == NULL) {
10562     return Bailout(kInvalidLhsInCountOperation);
10563   }
10564
10565   // Match the full code generator stack by simulating an extra stack
10566   // element for postfix operations in a non-effect context.  The return
10567   // value is ToNumber(input).
10568   bool returns_original_input =
10569       expr->is_postfix() && !ast_context()->IsEffect();
10570   HValue* input = NULL;  // ToNumber(original_input).
10571   HValue* after = NULL;  // The result after incrementing or decrementing.
10572
10573   if (proxy != NULL) {
10574     Variable* var = proxy->var();
10575     if (var->mode() == CONST_LEGACY)  {
10576       return Bailout(kUnsupportedCountOperationWithConst);
10577     }
10578     if (var->mode() == CONST) {
10579       return Bailout(kNonInitializerAssignmentToConst);
10580     }
10581     // Argument of the count operation is a variable, not a property.
10582     DCHECK(prop == NULL);
10583     CHECK_ALIVE(VisitForValue(target));
10584
10585     after = BuildIncrement(returns_original_input, expr);
10586     input = returns_original_input ? Top() : Pop();
10587     Push(after);
10588
10589     switch (var->location()) {
10590       case VariableLocation::GLOBAL:
10591       case VariableLocation::UNALLOCATED:
10592         HandleGlobalVariableAssignment(var, after, expr->CountSlot(),
10593                                        expr->AssignmentId());
10594         break;
10595
10596       case VariableLocation::PARAMETER:
10597       case VariableLocation::LOCAL:
10598         BindIfLive(var, after);
10599         break;
10600
10601       case VariableLocation::CONTEXT: {
10602         // Bail out if we try to mutate a parameter value in a function
10603         // using the arguments object.  We do not (yet) correctly handle the
10604         // arguments property of the function.
10605         if (current_info()->scope()->arguments() != NULL) {
10606           // Parameters will rewrite to context slots.  We have no direct
10607           // way to detect that the variable is a parameter so we use a
10608           // linear search of the parameter list.
10609           int count = current_info()->scope()->num_parameters();
10610           for (int i = 0; i < count; ++i) {
10611             if (var == current_info()->scope()->parameter(i)) {
10612               return Bailout(kAssignmentToParameterInArgumentsObject);
10613             }
10614           }
10615         }
10616
10617         HValue* context = BuildContextChainWalk(var);
10618         HStoreContextSlot::Mode mode = IsLexicalVariableMode(var->mode())
10619             ? HStoreContextSlot::kCheckDeoptimize : HStoreContextSlot::kNoCheck;
10620         HStoreContextSlot* instr = Add<HStoreContextSlot>(context, var->index(),
10621                                                           mode, after);
10622         if (instr->HasObservableSideEffects()) {
10623           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
10624         }
10625         break;
10626       }
10627
10628       case VariableLocation::LOOKUP:
10629         return Bailout(kLookupVariableInCountOperation);
10630     }
10631
10632     Drop(returns_original_input ? 2 : 1);
10633     return ast_context()->ReturnValue(expr->is_postfix() ? input : after);
10634   }
10635
10636   // Argument of the count operation is a property.
10637   DCHECK(prop != NULL);
10638   if (returns_original_input) Push(graph()->GetConstantUndefined());
10639
10640   CHECK_ALIVE(VisitForValue(prop->obj()));
10641   HValue* object = Top();
10642
10643   HValue* key = NULL;
10644   if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
10645     CHECK_ALIVE(VisitForValue(prop->key()));
10646     key = Top();
10647   }
10648
10649   CHECK_ALIVE(PushLoad(prop, object, key));
10650
10651   after = BuildIncrement(returns_original_input, expr);
10652
10653   if (returns_original_input) {
10654     input = Pop();
10655     // Drop object and key to push it again in the effect context below.
10656     Drop(key == NULL ? 1 : 2);
10657     environment()->SetExpressionStackAt(0, input);
10658     CHECK_ALIVE(BuildStoreForEffect(expr, prop, expr->CountSlot(), expr->id(),
10659                                     expr->AssignmentId(), object, key, after));
10660     return ast_context()->ReturnValue(Pop());
10661   }
10662
10663   environment()->SetExpressionStackAt(0, after);
10664   return BuildStore(expr, prop, expr->CountSlot(), expr->id(),
10665                     expr->AssignmentId());
10666 }
10667
10668
10669 HInstruction* HOptimizedGraphBuilder::BuildStringCharCodeAt(
10670     HValue* string,
10671     HValue* index) {
10672   if (string->IsConstant() && index->IsConstant()) {
10673     HConstant* c_string = HConstant::cast(string);
10674     HConstant* c_index = HConstant::cast(index);
10675     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
10676       int32_t i = c_index->NumberValueAsInteger32();
10677       Handle<String> s = c_string->StringValue();
10678       if (i < 0 || i >= s->length()) {
10679         return New<HConstant>(std::numeric_limits<double>::quiet_NaN());
10680       }
10681       return New<HConstant>(s->Get(i));
10682     }
10683   }
10684   string = BuildCheckString(string);
10685   index = Add<HBoundsCheck>(index, AddLoadStringLength(string));
10686   return New<HStringCharCodeAt>(string, index);
10687 }
10688
10689
10690 // Checks if the given shift amounts have following forms:
10691 // (N1) and (N2) with N1 + N2 = 32; (sa) and (32 - sa).
10692 static bool ShiftAmountsAllowReplaceByRotate(HValue* sa,
10693                                              HValue* const32_minus_sa) {
10694   if (sa->IsConstant() && const32_minus_sa->IsConstant()) {
10695     const HConstant* c1 = HConstant::cast(sa);
10696     const HConstant* c2 = HConstant::cast(const32_minus_sa);
10697     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
10698         (c1->Integer32Value() + c2->Integer32Value() == 32);
10699   }
10700   if (!const32_minus_sa->IsSub()) return false;
10701   HSub* sub = HSub::cast(const32_minus_sa);
10702   return sub->left()->EqualsInteger32Constant(32) && sub->right() == sa;
10703 }
10704
10705
10706 // Checks if the left and the right are shift instructions with the oposite
10707 // directions that can be replaced by one rotate right instruction or not.
10708 // Returns the operand and the shift amount for the rotate instruction in the
10709 // former case.
10710 bool HGraphBuilder::MatchRotateRight(HValue* left,
10711                                      HValue* right,
10712                                      HValue** operand,
10713                                      HValue** shift_amount) {
10714   HShl* shl;
10715   HShr* shr;
10716   if (left->IsShl() && right->IsShr()) {
10717     shl = HShl::cast(left);
10718     shr = HShr::cast(right);
10719   } else if (left->IsShr() && right->IsShl()) {
10720     shl = HShl::cast(right);
10721     shr = HShr::cast(left);
10722   } else {
10723     return false;
10724   }
10725   if (shl->left() != shr->left()) return false;
10726
10727   if (!ShiftAmountsAllowReplaceByRotate(shl->right(), shr->right()) &&
10728       !ShiftAmountsAllowReplaceByRotate(shr->right(), shl->right())) {
10729     return false;
10730   }
10731   *operand = shr->left();
10732   *shift_amount = shr->right();
10733   return true;
10734 }
10735
10736
10737 bool CanBeZero(HValue* right) {
10738   if (right->IsConstant()) {
10739     HConstant* right_const = HConstant::cast(right);
10740     if (right_const->HasInteger32Value() &&
10741        (right_const->Integer32Value() & 0x1f) != 0) {
10742       return false;
10743     }
10744   }
10745   return true;
10746 }
10747
10748
10749 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
10750                                          Type* expected) {
10751   if (expected->Is(Type::SignedSmall())) {
10752     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
10753   }
10754   if (expected->Is(Type::Signed32())) {
10755     return AddUncasted<HForceRepresentation>(number,
10756                                              Representation::Integer32());
10757   }
10758   return number;
10759 }
10760
10761
10762 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
10763   if (value->IsConstant()) {
10764     HConstant* constant = HConstant::cast(value);
10765     Maybe<HConstant*> number =
10766         constant->CopyToTruncatedNumber(isolate(), zone());
10767     if (number.IsJust()) {
10768       *expected = Type::Number(zone());
10769       return AddInstruction(number.FromJust());
10770     }
10771   }
10772
10773   // We put temporary values on the stack, which don't correspond to anything
10774   // in baseline code. Since nothing is observable we avoid recording those
10775   // pushes with a NoObservableSideEffectsScope.
10776   NoObservableSideEffectsScope no_effects(this);
10777
10778   Type* expected_type = *expected;
10779
10780   // Separate the number type from the rest.
10781   Type* expected_obj =
10782       Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
10783   Type* expected_number =
10784       Type::Intersect(expected_type, Type::Number(zone()), zone());
10785
10786   // We expect to get a number.
10787   // (We need to check first, since Type::None->Is(Type::Any()) == true.
10788   if (expected_obj->Is(Type::None())) {
10789     DCHECK(!expected_number->Is(Type::None(zone())));
10790     return value;
10791   }
10792
10793   if (expected_obj->Is(Type::Undefined(zone()))) {
10794     // This is already done by HChange.
10795     *expected = Type::Union(expected_number, Type::Number(zone()), zone());
10796     return value;
10797   }
10798
10799   return value;
10800 }
10801
10802
10803 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
10804     BinaryOperation* expr,
10805     HValue* left,
10806     HValue* right,
10807     PushBeforeSimulateBehavior push_sim_result) {
10808   Type* left_type = expr->left()->bounds().lower;
10809   Type* right_type = expr->right()->bounds().lower;
10810   Type* result_type = expr->bounds().lower;
10811   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
10812   Handle<AllocationSite> allocation_site = expr->allocation_site();
10813
10814   HAllocationMode allocation_mode;
10815   if (FLAG_allocation_site_pretenuring && !allocation_site.is_null()) {
10816     allocation_mode = HAllocationMode(allocation_site);
10817   }
10818   HValue* result = HGraphBuilder::BuildBinaryOperation(
10819       expr->op(), left, right, left_type, right_type, result_type,
10820       fixed_right_arg, allocation_mode, strength(function_language_mode()),
10821       expr->id());
10822   // Add a simulate after instructions with observable side effects, and
10823   // after phis, which are the result of BuildBinaryOperation when we
10824   // inlined some complex subgraph.
10825   if (result->HasObservableSideEffects() || result->IsPhi()) {
10826     if (push_sim_result == PUSH_BEFORE_SIMULATE) {
10827       Push(result);
10828       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10829       Drop(1);
10830     } else {
10831       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10832     }
10833   }
10834   return result;
10835 }
10836
10837
10838 HValue* HGraphBuilder::BuildBinaryOperation(
10839     Token::Value op, HValue* left, HValue* right, Type* left_type,
10840     Type* right_type, Type* result_type, Maybe<int> fixed_right_arg,
10841     HAllocationMode allocation_mode, Strength strength, BailoutId opt_id) {
10842   bool maybe_string_add = false;
10843   if (op == Token::ADD) {
10844     // If we are adding constant string with something for which we don't have
10845     // a feedback yet, assume that it's also going to be a string and don't
10846     // generate deopt instructions.
10847     if (!left_type->IsInhabited() && right->IsConstant() &&
10848         HConstant::cast(right)->HasStringValue()) {
10849       left_type = Type::String();
10850     }
10851
10852     if (!right_type->IsInhabited() && left->IsConstant() &&
10853         HConstant::cast(left)->HasStringValue()) {
10854       right_type = Type::String();
10855     }
10856
10857     maybe_string_add = (left_type->Maybe(Type::String()) ||
10858                         left_type->Maybe(Type::Receiver()) ||
10859                         right_type->Maybe(Type::String()) ||
10860                         right_type->Maybe(Type::Receiver()));
10861   }
10862
10863   Representation left_rep = RepresentationFor(left_type);
10864   Representation right_rep = RepresentationFor(right_type);
10865
10866   if (!left_type->IsInhabited()) {
10867     Add<HDeoptimize>(
10868         Deoptimizer::kInsufficientTypeFeedbackForLHSOfBinaryOperation,
10869         Deoptimizer::SOFT);
10870     left_type = Type::Any(zone());
10871     left_rep = RepresentationFor(left_type);
10872     maybe_string_add = op == Token::ADD;
10873   }
10874
10875   if (!right_type->IsInhabited()) {
10876     Add<HDeoptimize>(
10877         Deoptimizer::kInsufficientTypeFeedbackForRHSOfBinaryOperation,
10878         Deoptimizer::SOFT);
10879     right_type = Type::Any(zone());
10880     right_rep = RepresentationFor(right_type);
10881     maybe_string_add = op == Token::ADD;
10882   }
10883
10884   if (!maybe_string_add && !is_strong(strength)) {
10885     left = TruncateToNumber(left, &left_type);
10886     right = TruncateToNumber(right, &right_type);
10887   }
10888
10889   // Special case for string addition here.
10890   if (op == Token::ADD &&
10891       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
10892     if (is_strong(strength)) {
10893       // In strong mode, if the one side of an addition is a string,
10894       // the other side must be a string too.
10895       left = BuildCheckString(left);
10896       right = BuildCheckString(right);
10897     } else {
10898       // Validate type feedback for left argument.
10899       if (left_type->Is(Type::String())) {
10900         left = BuildCheckString(left);
10901       }
10902
10903       // Validate type feedback for right argument.
10904       if (right_type->Is(Type::String())) {
10905         right = BuildCheckString(right);
10906       }
10907
10908       // Convert left argument as necessary.
10909       if (left_type->Is(Type::Number())) {
10910         DCHECK(right_type->Is(Type::String()));
10911         left = BuildNumberToString(left, left_type);
10912       } else if (!left_type->Is(Type::String())) {
10913         DCHECK(right_type->Is(Type::String()));
10914         HValue* function = AddLoadJSBuiltin(Builtins::STRING_ADD_RIGHT);
10915         Add<HPushArguments>(left, right);
10916         return AddUncasted<HInvokeFunction>(function, 2);
10917       }
10918
10919       // Convert right argument as necessary.
10920       if (right_type->Is(Type::Number())) {
10921         DCHECK(left_type->Is(Type::String()));
10922         right = BuildNumberToString(right, right_type);
10923       } else if (!right_type->Is(Type::String())) {
10924         DCHECK(left_type->Is(Type::String()));
10925         HValue* function = AddLoadJSBuiltin(Builtins::STRING_ADD_LEFT);
10926         Add<HPushArguments>(left, right);
10927         return AddUncasted<HInvokeFunction>(function, 2);
10928       }
10929     }
10930
10931     // Fast paths for empty constant strings.
10932     Handle<String> left_string =
10933         left->IsConstant() && HConstant::cast(left)->HasStringValue()
10934             ? HConstant::cast(left)->StringValue()
10935             : Handle<String>();
10936     Handle<String> right_string =
10937         right->IsConstant() && HConstant::cast(right)->HasStringValue()
10938             ? HConstant::cast(right)->StringValue()
10939             : Handle<String>();
10940     if (!left_string.is_null() && left_string->length() == 0) return right;
10941     if (!right_string.is_null() && right_string->length() == 0) return left;
10942     if (!left_string.is_null() && !right_string.is_null()) {
10943       return AddUncasted<HStringAdd>(
10944           left, right, strength, allocation_mode.GetPretenureMode(),
10945           STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10946     }
10947
10948     // Register the dependent code with the allocation site.
10949     if (!allocation_mode.feedback_site().is_null()) {
10950       DCHECK(!graph()->info()->IsStub());
10951       Handle<AllocationSite> site(allocation_mode.feedback_site());
10952       top_info()->dependencies()->AssumeTenuringDecision(site);
10953     }
10954
10955     // Inline the string addition into the stub when creating allocation
10956     // mementos to gather allocation site feedback, or if we can statically
10957     // infer that we're going to create a cons string.
10958     if ((graph()->info()->IsStub() &&
10959          allocation_mode.CreateAllocationMementos()) ||
10960         (left->IsConstant() &&
10961          HConstant::cast(left)->HasStringValue() &&
10962          HConstant::cast(left)->StringValue()->length() + 1 >=
10963            ConsString::kMinLength) ||
10964         (right->IsConstant() &&
10965          HConstant::cast(right)->HasStringValue() &&
10966          HConstant::cast(right)->StringValue()->length() + 1 >=
10967            ConsString::kMinLength)) {
10968       return BuildStringAdd(left, right, allocation_mode);
10969     }
10970
10971     // Fallback to using the string add stub.
10972     return AddUncasted<HStringAdd>(
10973         left, right, strength, allocation_mode.GetPretenureMode(),
10974         STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10975   }
10976
10977   if (graph()->info()->IsStub()) {
10978     left = EnforceNumberType(left, left_type);
10979     right = EnforceNumberType(right, right_type);
10980   }
10981
10982   Representation result_rep = RepresentationFor(result_type);
10983
10984   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
10985                           (right_rep.IsTagged() && !right_rep.IsSmi());
10986
10987   HInstruction* instr = NULL;
10988   // Only the stub is allowed to call into the runtime, since otherwise we would
10989   // inline several instructions (including the two pushes) for every tagged
10990   // operation in optimized code, which is more expensive, than a stub call.
10991   if (graph()->info()->IsStub() && is_non_primitive) {
10992     HValue* function =
10993         AddLoadJSBuiltin(BinaryOpIC::TokenToJSBuiltin(op, strength));
10994     Add<HPushArguments>(left, right);
10995     instr = AddUncasted<HInvokeFunction>(function, 2);
10996   } else {
10997     if (is_strong(strength) && Token::IsBitOp(op)) {
10998       // TODO(conradw): This is not efficient, but is necessary to prevent
10999       // conversion of oddball values to numbers in strong mode. It would be
11000       // better to prevent the conversion rather than adding a runtime check.
11001       IfBuilder if_builder(this);
11002       if_builder.If<HHasInstanceTypeAndBranch>(left, ODDBALL_TYPE);
11003       if_builder.OrIf<HHasInstanceTypeAndBranch>(right, ODDBALL_TYPE);
11004       if_builder.Then();
11005       Add<HCallRuntime>(
11006           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
11007           0);
11008       if (!graph()->info()->IsStub()) {
11009         Add<HSimulate>(opt_id, REMOVABLE_SIMULATE);
11010       }
11011       if_builder.End();
11012     }
11013     switch (op) {
11014       case Token::ADD:
11015         instr = AddUncasted<HAdd>(left, right, strength);
11016         break;
11017       case Token::SUB:
11018         instr = AddUncasted<HSub>(left, right, strength);
11019         break;
11020       case Token::MUL:
11021         instr = AddUncasted<HMul>(left, right, strength);
11022         break;
11023       case Token::MOD: {
11024         if (fixed_right_arg.IsJust() &&
11025             !right->EqualsInteger32Constant(fixed_right_arg.FromJust())) {
11026           HConstant* fixed_right =
11027               Add<HConstant>(static_cast<int>(fixed_right_arg.FromJust()));
11028           IfBuilder if_same(this);
11029           if_same.If<HCompareNumericAndBranch>(right, fixed_right, Token::EQ);
11030           if_same.Then();
11031           if_same.ElseDeopt(Deoptimizer::kUnexpectedRHSOfBinaryOperation);
11032           right = fixed_right;
11033         }
11034         instr = AddUncasted<HMod>(left, right, strength);
11035         break;
11036       }
11037       case Token::DIV:
11038         instr = AddUncasted<HDiv>(left, right, strength);
11039         break;
11040       case Token::BIT_XOR:
11041       case Token::BIT_AND:
11042         instr = AddUncasted<HBitwise>(op, left, right, strength);
11043         break;
11044       case Token::BIT_OR: {
11045         HValue* operand, *shift_amount;
11046         if (left_type->Is(Type::Signed32()) &&
11047             right_type->Is(Type::Signed32()) &&
11048             MatchRotateRight(left, right, &operand, &shift_amount)) {
11049           instr = AddUncasted<HRor>(operand, shift_amount, strength);
11050         } else {
11051           instr = AddUncasted<HBitwise>(op, left, right, strength);
11052         }
11053         break;
11054       }
11055       case Token::SAR:
11056         instr = AddUncasted<HSar>(left, right, strength);
11057         break;
11058       case Token::SHR:
11059         instr = AddUncasted<HShr>(left, right, strength);
11060         if (instr->IsShr() && CanBeZero(right)) {
11061           graph()->RecordUint32Instruction(instr);
11062         }
11063         break;
11064       case Token::SHL:
11065         instr = AddUncasted<HShl>(left, right, strength);
11066         break;
11067       default:
11068         UNREACHABLE();
11069     }
11070   }
11071
11072   if (instr->IsBinaryOperation()) {
11073     HBinaryOperation* binop = HBinaryOperation::cast(instr);
11074     binop->set_observed_input_representation(1, left_rep);
11075     binop->set_observed_input_representation(2, right_rep);
11076     binop->initialize_output_representation(result_rep);
11077     if (graph()->info()->IsStub()) {
11078       // Stub should not call into stub.
11079       instr->SetFlag(HValue::kCannotBeTagged);
11080       // And should truncate on HForceRepresentation already.
11081       if (left->IsForceRepresentation()) {
11082         left->CopyFlag(HValue::kTruncatingToSmi, instr);
11083         left->CopyFlag(HValue::kTruncatingToInt32, instr);
11084       }
11085       if (right->IsForceRepresentation()) {
11086         right->CopyFlag(HValue::kTruncatingToSmi, instr);
11087         right->CopyFlag(HValue::kTruncatingToInt32, instr);
11088       }
11089     }
11090   }
11091   return instr;
11092 }
11093
11094
11095 // Check for the form (%_ClassOf(foo) === 'BarClass').
11096 static bool IsClassOfTest(CompareOperation* expr) {
11097   if (expr->op() != Token::EQ_STRICT) return false;
11098   CallRuntime* call = expr->left()->AsCallRuntime();
11099   if (call == NULL) return false;
11100   Literal* literal = expr->right()->AsLiteral();
11101   if (literal == NULL) return false;
11102   if (!literal->value()->IsString()) return false;
11103   if (!call->is_jsruntime() &&
11104       call->function()->function_id != Runtime::kInlineClassOf) {
11105     return false;
11106   }
11107   DCHECK(call->arguments()->length() == 1);
11108   return true;
11109 }
11110
11111
11112 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
11113   DCHECK(!HasStackOverflow());
11114   DCHECK(current_block() != NULL);
11115   DCHECK(current_block()->HasPredecessor());
11116   switch (expr->op()) {
11117     case Token::COMMA:
11118       return VisitComma(expr);
11119     case Token::OR:
11120     case Token::AND:
11121       return VisitLogicalExpression(expr);
11122     default:
11123       return VisitArithmeticExpression(expr);
11124   }
11125 }
11126
11127
11128 void HOptimizedGraphBuilder::VisitComma(BinaryOperation* expr) {
11129   CHECK_ALIVE(VisitForEffect(expr->left()));
11130   // Visit the right subexpression in the same AST context as the entire
11131   // expression.
11132   Visit(expr->right());
11133 }
11134
11135
11136 void HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
11137   bool is_logical_and = expr->op() == Token::AND;
11138   if (ast_context()->IsTest()) {
11139     TestContext* context = TestContext::cast(ast_context());
11140     // Translate left subexpression.
11141     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11142     if (is_logical_and) {
11143       CHECK_BAILOUT(VisitForControl(expr->left(),
11144                                     eval_right,
11145                                     context->if_false()));
11146     } else {
11147       CHECK_BAILOUT(VisitForControl(expr->left(),
11148                                     context->if_true(),
11149                                     eval_right));
11150     }
11151
11152     // Translate right subexpression by visiting it in the same AST
11153     // context as the entire expression.
11154     if (eval_right->HasPredecessor()) {
11155       eval_right->SetJoinId(expr->RightId());
11156       set_current_block(eval_right);
11157       Visit(expr->right());
11158     }
11159
11160   } else if (ast_context()->IsValue()) {
11161     CHECK_ALIVE(VisitForValue(expr->left()));
11162     DCHECK(current_block() != NULL);
11163     HValue* left_value = Top();
11164
11165     // Short-circuit left values that always evaluate to the same boolean value.
11166     if (expr->left()->ToBooleanIsTrue() || expr->left()->ToBooleanIsFalse()) {
11167       // l (evals true)  && r -> r
11168       // l (evals true)  || r -> l
11169       // l (evals false) && r -> l
11170       // l (evals false) || r -> r
11171       if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
11172         Drop(1);
11173         CHECK_ALIVE(VisitForValue(expr->right()));
11174       }
11175       return ast_context()->ReturnValue(Pop());
11176     }
11177
11178     // We need an extra block to maintain edge-split form.
11179     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11180     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11181     ToBooleanStub::Types expected(expr->left()->to_boolean_types());
11182     HBranch* test = is_logical_and
11183         ? New<HBranch>(left_value, expected, eval_right, empty_block)
11184         : New<HBranch>(left_value, expected, empty_block, eval_right);
11185     FinishCurrentBlock(test);
11186
11187     set_current_block(eval_right);
11188     Drop(1);  // Value of the left subexpression.
11189     CHECK_BAILOUT(VisitForValue(expr->right()));
11190
11191     HBasicBlock* join_block =
11192       CreateJoin(empty_block, current_block(), expr->id());
11193     set_current_block(join_block);
11194     return ast_context()->ReturnValue(Pop());
11195
11196   } else {
11197     DCHECK(ast_context()->IsEffect());
11198     // In an effect context, we don't need the value of the left subexpression,
11199     // only its control flow and side effects.  We need an extra block to
11200     // maintain edge-split form.
11201     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11202     HBasicBlock* right_block = graph()->CreateBasicBlock();
11203     if (is_logical_and) {
11204       CHECK_BAILOUT(VisitForControl(expr->left(), right_block, empty_block));
11205     } else {
11206       CHECK_BAILOUT(VisitForControl(expr->left(), empty_block, right_block));
11207     }
11208
11209     // TODO(kmillikin): Find a way to fix this.  It's ugly that there are
11210     // actually two empty blocks (one here and one inserted by
11211     // TestContext::BuildBranch, and that they both have an HSimulate though the
11212     // second one is not a merge node, and that we really have no good AST ID to
11213     // put on that first HSimulate.
11214
11215     if (empty_block->HasPredecessor()) {
11216       empty_block->SetJoinId(expr->id());
11217     } else {
11218       empty_block = NULL;
11219     }
11220
11221     if (right_block->HasPredecessor()) {
11222       right_block->SetJoinId(expr->RightId());
11223       set_current_block(right_block);
11224       CHECK_BAILOUT(VisitForEffect(expr->right()));
11225       right_block = current_block();
11226     } else {
11227       right_block = NULL;
11228     }
11229
11230     HBasicBlock* join_block =
11231       CreateJoin(empty_block, right_block, expr->id());
11232     set_current_block(join_block);
11233     // We did not materialize any value in the predecessor environments,
11234     // so there is no need to handle it here.
11235   }
11236 }
11237
11238
11239 void HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
11240   CHECK_ALIVE(VisitForValue(expr->left()));
11241   CHECK_ALIVE(VisitForValue(expr->right()));
11242   SetSourcePosition(expr->position());
11243   HValue* right = Pop();
11244   HValue* left = Pop();
11245   HValue* result =
11246       BuildBinaryOperation(expr, left, right,
11247           ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11248                                     : PUSH_BEFORE_SIMULATE);
11249   if (top_info()->is_tracking_positions() && result->IsBinaryOperation()) {
11250     HBinaryOperation::cast(result)->SetOperandPositions(
11251         zone(),
11252         ScriptPositionToSourcePosition(expr->left()->position()),
11253         ScriptPositionToSourcePosition(expr->right()->position()));
11254   }
11255   return ast_context()->ReturnValue(result);
11256 }
11257
11258
11259 void HOptimizedGraphBuilder::HandleLiteralCompareTypeof(CompareOperation* expr,
11260                                                         Expression* sub_expr,
11261                                                         Handle<String> check) {
11262   CHECK_ALIVE(VisitForTypeOf(sub_expr));
11263   SetSourcePosition(expr->position());
11264   HValue* value = Pop();
11265   HTypeofIsAndBranch* instr = New<HTypeofIsAndBranch>(value, check);
11266   return ast_context()->ReturnControl(instr, expr->id());
11267 }
11268
11269
11270 static bool IsLiteralCompareBool(Isolate* isolate,
11271                                  HValue* left,
11272                                  Token::Value op,
11273                                  HValue* right) {
11274   return op == Token::EQ_STRICT &&
11275       ((left->IsConstant() &&
11276           HConstant::cast(left)->handle(isolate)->IsBoolean()) ||
11277        (right->IsConstant() &&
11278            HConstant::cast(right)->handle(isolate)->IsBoolean()));
11279 }
11280
11281
11282 void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
11283   DCHECK(!HasStackOverflow());
11284   DCHECK(current_block() != NULL);
11285   DCHECK(current_block()->HasPredecessor());
11286
11287   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11288
11289   // Check for a few fast cases. The AST visiting behavior must be in sync
11290   // with the full codegen: We don't push both left and right values onto
11291   // the expression stack when one side is a special-case literal.
11292   Expression* sub_expr = NULL;
11293   Handle<String> check;
11294   if (expr->IsLiteralCompareTypeof(&sub_expr, &check)) {
11295     return HandleLiteralCompareTypeof(expr, sub_expr, check);
11296   }
11297   if (expr->IsLiteralCompareUndefined(&sub_expr, isolate())) {
11298     return HandleLiteralCompareNil(expr, sub_expr, kUndefinedValue);
11299   }
11300   if (expr->IsLiteralCompareNull(&sub_expr)) {
11301     return HandleLiteralCompareNil(expr, sub_expr, kNullValue);
11302   }
11303
11304   if (IsClassOfTest(expr)) {
11305     CallRuntime* call = expr->left()->AsCallRuntime();
11306     DCHECK(call->arguments()->length() == 1);
11307     CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11308     HValue* value = Pop();
11309     Literal* literal = expr->right()->AsLiteral();
11310     Handle<String> rhs = Handle<String>::cast(literal->value());
11311     HClassOfTestAndBranch* instr = New<HClassOfTestAndBranch>(value, rhs);
11312     return ast_context()->ReturnControl(instr, expr->id());
11313   }
11314
11315   Type* left_type = expr->left()->bounds().lower;
11316   Type* right_type = expr->right()->bounds().lower;
11317   Type* combined_type = expr->combined_type();
11318
11319   CHECK_ALIVE(VisitForValue(expr->left()));
11320   CHECK_ALIVE(VisitForValue(expr->right()));
11321
11322   HValue* right = Pop();
11323   HValue* left = Pop();
11324   Token::Value op = expr->op();
11325
11326   if (IsLiteralCompareBool(isolate(), left, op, right)) {
11327     HCompareObjectEqAndBranch* result =
11328         New<HCompareObjectEqAndBranch>(left, right);
11329     return ast_context()->ReturnControl(result, expr->id());
11330   }
11331
11332   if (op == Token::INSTANCEOF) {
11333     // Check to see if the rhs of the instanceof is a known function.
11334     if (right->IsConstant() &&
11335         HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
11336       Handle<JSFunction> constructor =
11337           Handle<JSFunction>::cast(HConstant::cast(right)->handle(isolate()));
11338       if (!constructor->map()->has_non_instance_prototype()) {
11339         JSFunction::EnsureHasInitialMap(constructor);
11340         DCHECK(constructor->has_initial_map());
11341         Handle<Map> initial_map(constructor->initial_map(), isolate());
11342         top_info()->dependencies()->AssumeInitialMapCantChange(initial_map);
11343         HInstruction* prototype =
11344             Add<HConstant>(handle(initial_map->prototype(), isolate()));
11345         HHasInPrototypeChainAndBranch* result =
11346             New<HHasInPrototypeChainAndBranch>(left, prototype);
11347         return ast_context()->ReturnControl(result, expr->id());
11348       }
11349     }
11350
11351     HInstanceOf* result = New<HInstanceOf>(left, right);
11352     return ast_context()->ReturnInstruction(result, expr->id());
11353
11354   } else if (op == Token::IN) {
11355     HValue* function = AddLoadJSBuiltin(Builtins::IN);
11356     Add<HPushArguments>(left, right);
11357     // TODO(olivf) InvokeFunction produces a check for the parameter count,
11358     // even though we are certain to pass the correct number of arguments here.
11359     HInstruction* result = New<HInvokeFunction>(function, 2);
11360     return ast_context()->ReturnInstruction(result, expr->id());
11361   }
11362
11363   PushBeforeSimulateBehavior push_behavior =
11364     ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11365                               : PUSH_BEFORE_SIMULATE;
11366   HControlInstruction* compare = BuildCompareInstruction(
11367       op, left, right, left_type, right_type, combined_type,
11368       ScriptPositionToSourcePosition(expr->left()->position()),
11369       ScriptPositionToSourcePosition(expr->right()->position()),
11370       push_behavior, expr->id());
11371   if (compare == NULL) return;  // Bailed out.
11372   return ast_context()->ReturnControl(compare, expr->id());
11373 }
11374
11375
11376 HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
11377     Token::Value op, HValue* left, HValue* right, Type* left_type,
11378     Type* right_type, Type* combined_type, SourcePosition left_position,
11379     SourcePosition right_position, PushBeforeSimulateBehavior push_sim_result,
11380     BailoutId bailout_id) {
11381   // Cases handled below depend on collected type feedback. They should
11382   // soft deoptimize when there is no type feedback.
11383   if (!combined_type->IsInhabited()) {
11384     Add<HDeoptimize>(
11385         Deoptimizer::kInsufficientTypeFeedbackForCombinedTypeOfBinaryOperation,
11386         Deoptimizer::SOFT);
11387     combined_type = left_type = right_type = Type::Any(zone());
11388   }
11389
11390   Representation left_rep = RepresentationFor(left_type);
11391   Representation right_rep = RepresentationFor(right_type);
11392   Representation combined_rep = RepresentationFor(combined_type);
11393
11394   if (combined_type->Is(Type::Receiver())) {
11395     if (Token::IsEqualityOp(op)) {
11396       // HCompareObjectEqAndBranch can only deal with object, so
11397       // exclude numbers.
11398       if ((left->IsConstant() &&
11399            HConstant::cast(left)->HasNumberValue()) ||
11400           (right->IsConstant() &&
11401            HConstant::cast(right)->HasNumberValue())) {
11402         Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11403                          Deoptimizer::SOFT);
11404         // The caller expects a branch instruction, so make it happy.
11405         return New<HBranch>(graph()->GetConstantTrue());
11406       }
11407       // Can we get away with map check and not instance type check?
11408       HValue* operand_to_check =
11409           left->block()->block_id() < right->block()->block_id() ? left : right;
11410       if (combined_type->IsClass()) {
11411         Handle<Map> map = combined_type->AsClass()->Map();
11412         AddCheckMap(operand_to_check, map);
11413         HCompareObjectEqAndBranch* result =
11414             New<HCompareObjectEqAndBranch>(left, right);
11415         if (top_info()->is_tracking_positions()) {
11416           result->set_operand_position(zone(), 0, left_position);
11417           result->set_operand_position(zone(), 1, right_position);
11418         }
11419         return result;
11420       } else {
11421         BuildCheckHeapObject(operand_to_check);
11422         Add<HCheckInstanceType>(operand_to_check,
11423                                 HCheckInstanceType::IS_SPEC_OBJECT);
11424         HCompareObjectEqAndBranch* result =
11425             New<HCompareObjectEqAndBranch>(left, right);
11426         return result;
11427       }
11428     } else {
11429       Bailout(kUnsupportedNonPrimitiveCompare);
11430       return NULL;
11431     }
11432   } else if (combined_type->Is(Type::InternalizedString()) &&
11433              Token::IsEqualityOp(op)) {
11434     // If we have a constant argument, it should be consistent with the type
11435     // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
11436     if ((left->IsConstant() &&
11437          !HConstant::cast(left)->HasInternalizedStringValue()) ||
11438         (right->IsConstant() &&
11439          !HConstant::cast(right)->HasInternalizedStringValue())) {
11440       Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11441                        Deoptimizer::SOFT);
11442       // The caller expects a branch instruction, so make it happy.
11443       return New<HBranch>(graph()->GetConstantTrue());
11444     }
11445     BuildCheckHeapObject(left);
11446     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
11447     BuildCheckHeapObject(right);
11448     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
11449     HCompareObjectEqAndBranch* result =
11450         New<HCompareObjectEqAndBranch>(left, right);
11451     return result;
11452   } else if (combined_type->Is(Type::String())) {
11453     BuildCheckHeapObject(left);
11454     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
11455     BuildCheckHeapObject(right);
11456     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
11457     HStringCompareAndBranch* result =
11458         New<HStringCompareAndBranch>(left, right, op);
11459     return result;
11460   } else {
11461     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
11462       HCompareGeneric* result = Add<HCompareGeneric>(
11463           left, right, op, strength(function_language_mode()));
11464       result->set_observed_input_representation(1, left_rep);
11465       result->set_observed_input_representation(2, right_rep);
11466       if (result->HasObservableSideEffects()) {
11467         if (push_sim_result == PUSH_BEFORE_SIMULATE) {
11468           Push(result);
11469           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11470           Drop(1);
11471         } else {
11472           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11473         }
11474       }
11475       // TODO(jkummerow): Can we make this more efficient?
11476       HBranch* branch = New<HBranch>(result);
11477       return branch;
11478     } else {
11479       HCompareNumericAndBranch* result = New<HCompareNumericAndBranch>(
11480           left, right, op, strength(function_language_mode()));
11481       result->set_observed_input_representation(left_rep, right_rep);
11482       if (top_info()->is_tracking_positions()) {
11483         result->SetOperandPositions(zone(), left_position, right_position);
11484       }
11485       return result;
11486     }
11487   }
11488 }
11489
11490
11491 void HOptimizedGraphBuilder::HandleLiteralCompareNil(CompareOperation* expr,
11492                                                      Expression* sub_expr,
11493                                                      NilValue nil) {
11494   DCHECK(!HasStackOverflow());
11495   DCHECK(current_block() != NULL);
11496   DCHECK(current_block()->HasPredecessor());
11497   DCHECK(expr->op() == Token::EQ || expr->op() == Token::EQ_STRICT);
11498   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11499   CHECK_ALIVE(VisitForValue(sub_expr));
11500   HValue* value = Pop();
11501   if (expr->op() == Token::EQ_STRICT) {
11502     HConstant* nil_constant = nil == kNullValue
11503         ? graph()->GetConstantNull()
11504         : graph()->GetConstantUndefined();
11505     HCompareObjectEqAndBranch* instr =
11506         New<HCompareObjectEqAndBranch>(value, nil_constant);
11507     return ast_context()->ReturnControl(instr, expr->id());
11508   } else {
11509     DCHECK_EQ(Token::EQ, expr->op());
11510     Type* type = expr->combined_type()->Is(Type::None())
11511         ? Type::Any(zone()) : expr->combined_type();
11512     HIfContinuation continuation;
11513     BuildCompareNil(value, type, &continuation);
11514     return ast_context()->ReturnContinuation(&continuation, expr->id());
11515   }
11516 }
11517
11518
11519 void HOptimizedGraphBuilder::VisitSpread(Spread* expr) { UNREACHABLE(); }
11520
11521
11522 void HOptimizedGraphBuilder::VisitEmptyParentheses(EmptyParentheses* expr) {
11523   UNREACHABLE();
11524 }
11525
11526
11527 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
11528   // If we share optimized code between different closures, the
11529   // this-function is not a constant, except inside an inlined body.
11530   if (function_state()->outer() != NULL) {
11531       return New<HConstant>(
11532           function_state()->compilation_info()->closure());
11533   } else {
11534       return New<HThisFunction>();
11535   }
11536 }
11537
11538
11539 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
11540     Handle<JSObject> boilerplate_object,
11541     AllocationSiteUsageContext* site_context) {
11542   NoObservableSideEffectsScope no_effects(this);
11543   Handle<Map> initial_map(boilerplate_object->map());
11544   InstanceType instance_type = initial_map->instance_type();
11545   DCHECK(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
11546
11547   HType type = instance_type == JS_ARRAY_TYPE
11548       ? HType::JSArray() : HType::JSObject();
11549   HValue* object_size_constant = Add<HConstant>(initial_map->instance_size());
11550
11551   PretenureFlag pretenure_flag = NOT_TENURED;
11552   Handle<AllocationSite> top_site(*site_context->top(), isolate());
11553   if (FLAG_allocation_site_pretenuring) {
11554     pretenure_flag = top_site->GetPretenureMode();
11555   }
11556
11557   Handle<AllocationSite> current_site(*site_context->current(), isolate());
11558   if (*top_site == *current_site) {
11559     // We install a dependency for pretenuring only on the outermost literal.
11560     top_info()->dependencies()->AssumeTenuringDecision(top_site);
11561   }
11562   top_info()->dependencies()->AssumeTransitionStable(current_site);
11563
11564   HInstruction* object = Add<HAllocate>(
11565       object_size_constant, type, pretenure_flag, instance_type, top_site);
11566
11567   // If allocation folding reaches Page::kMaxRegularHeapObjectSize the
11568   // elements array may not get folded into the object. Hence, we set the
11569   // elements pointer to empty fixed array and let store elimination remove
11570   // this store in the folding case.
11571   HConstant* empty_fixed_array = Add<HConstant>(
11572       isolate()->factory()->empty_fixed_array());
11573   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11574       empty_fixed_array);
11575
11576   BuildEmitObjectHeader(boilerplate_object, object);
11577
11578   // Similarly to the elements pointer, there is no guarantee that all
11579   // property allocations can get folded, so pre-initialize all in-object
11580   // properties to a safe value.
11581   BuildInitializeInobjectProperties(object, initial_map);
11582
11583   Handle<FixedArrayBase> elements(boilerplate_object->elements());
11584   int elements_size = (elements->length() > 0 &&
11585       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
11586           elements->Size() : 0;
11587
11588   if (pretenure_flag == TENURED &&
11589       elements->map() == isolate()->heap()->fixed_cow_array_map() &&
11590       isolate()->heap()->InNewSpace(*elements)) {
11591     // If we would like to pretenure a fixed cow array, we must ensure that the
11592     // array is already in old space, otherwise we'll create too many old-to-
11593     // new-space pointers (overflowing the store buffer).
11594     elements = Handle<FixedArrayBase>(
11595         isolate()->factory()->CopyAndTenureFixedCOWArray(
11596             Handle<FixedArray>::cast(elements)));
11597     boilerplate_object->set_elements(*elements);
11598   }
11599
11600   HInstruction* object_elements = NULL;
11601   if (elements_size > 0) {
11602     HValue* object_elements_size = Add<HConstant>(elements_size);
11603     InstanceType instance_type = boilerplate_object->HasFastDoubleElements()
11604         ? FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
11605     object_elements = Add<HAllocate>(object_elements_size, HType::HeapObject(),
11606                                      pretenure_flag, instance_type, top_site);
11607     BuildEmitElements(boilerplate_object, elements, object_elements,
11608                       site_context);
11609     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11610                           object_elements);
11611   } else {
11612     Handle<Object> elements_field =
11613         Handle<Object>(boilerplate_object->elements(), isolate());
11614     HInstruction* object_elements_cow = Add<HConstant>(elements_field);
11615     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11616                           object_elements_cow);
11617   }
11618
11619   // Copy in-object properties.
11620   if (initial_map->NumberOfFields() != 0 ||
11621       initial_map->unused_property_fields() > 0) {
11622     BuildEmitInObjectProperties(boilerplate_object, object, site_context,
11623                                 pretenure_flag);
11624   }
11625   return object;
11626 }
11627
11628
11629 void HOptimizedGraphBuilder::BuildEmitObjectHeader(
11630     Handle<JSObject> boilerplate_object,
11631     HInstruction* object) {
11632   DCHECK(boilerplate_object->properties()->length() == 0);
11633
11634   Handle<Map> boilerplate_object_map(boilerplate_object->map());
11635   AddStoreMapConstant(object, boilerplate_object_map);
11636
11637   Handle<Object> properties_field =
11638       Handle<Object>(boilerplate_object->properties(), isolate());
11639   DCHECK(*properties_field == isolate()->heap()->empty_fixed_array());
11640   HInstruction* properties = Add<HConstant>(properties_field);
11641   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
11642   Add<HStoreNamedField>(object, access, properties);
11643
11644   if (boilerplate_object->IsJSArray()) {
11645     Handle<JSArray> boilerplate_array =
11646         Handle<JSArray>::cast(boilerplate_object);
11647     Handle<Object> length_field =
11648         Handle<Object>(boilerplate_array->length(), isolate());
11649     HInstruction* length = Add<HConstant>(length_field);
11650
11651     DCHECK(boilerplate_array->length()->IsSmi());
11652     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
11653         boilerplate_array->GetElementsKind()), length);
11654   }
11655 }
11656
11657
11658 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
11659     Handle<JSObject> boilerplate_object,
11660     HInstruction* object,
11661     AllocationSiteUsageContext* site_context,
11662     PretenureFlag pretenure_flag) {
11663   Handle<Map> boilerplate_map(boilerplate_object->map());
11664   Handle<DescriptorArray> descriptors(boilerplate_map->instance_descriptors());
11665   int limit = boilerplate_map->NumberOfOwnDescriptors();
11666
11667   int copied_fields = 0;
11668   for (int i = 0; i < limit; i++) {
11669     PropertyDetails details = descriptors->GetDetails(i);
11670     if (details.type() != DATA) continue;
11671     copied_fields++;
11672     FieldIndex field_index = FieldIndex::ForDescriptor(*boilerplate_map, i);
11673
11674
11675     int property_offset = field_index.offset();
11676     Handle<Name> name(descriptors->GetKey(i));
11677
11678     // The access for the store depends on the type of the boilerplate.
11679     HObjectAccess access = boilerplate_object->IsJSArray() ?
11680         HObjectAccess::ForJSArrayOffset(property_offset) :
11681         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11682
11683     if (boilerplate_object->IsUnboxedDoubleField(field_index)) {
11684       CHECK(!boilerplate_object->IsJSArray());
11685       double value = boilerplate_object->RawFastDoublePropertyAt(field_index);
11686       access = access.WithRepresentation(Representation::Double());
11687       Add<HStoreNamedField>(object, access, Add<HConstant>(value));
11688       continue;
11689     }
11690     Handle<Object> value(boilerplate_object->RawFastPropertyAt(field_index),
11691                          isolate());
11692
11693     if (value->IsJSObject()) {
11694       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11695       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11696       HInstruction* result =
11697           BuildFastLiteral(value_object, site_context);
11698       site_context->ExitScope(current_site, value_object);
11699       Add<HStoreNamedField>(object, access, result);
11700     } else {
11701       Representation representation = details.representation();
11702       HInstruction* value_instruction;
11703
11704       if (representation.IsDouble()) {
11705         // Allocate a HeapNumber box and store the value into it.
11706         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
11707         HInstruction* double_box =
11708             Add<HAllocate>(heap_number_constant, HType::HeapObject(),
11709                 pretenure_flag, MUTABLE_HEAP_NUMBER_TYPE);
11710         AddStoreMapConstant(double_box,
11711             isolate()->factory()->mutable_heap_number_map());
11712         // Unwrap the mutable heap number from the boilerplate.
11713         HValue* double_value =
11714             Add<HConstant>(Handle<HeapNumber>::cast(value)->value());
11715         Add<HStoreNamedField>(
11716             double_box, HObjectAccess::ForHeapNumberValue(), double_value);
11717         value_instruction = double_box;
11718       } else if (representation.IsSmi()) {
11719         value_instruction = value->IsUninitialized()
11720             ? graph()->GetConstant0()
11721             : Add<HConstant>(value);
11722         // Ensure that value is stored as smi.
11723         access = access.WithRepresentation(representation);
11724       } else {
11725         value_instruction = Add<HConstant>(value);
11726       }
11727
11728       Add<HStoreNamedField>(object, access, value_instruction);
11729     }
11730   }
11731
11732   int inobject_properties = boilerplate_object->map()->GetInObjectProperties();
11733   HInstruction* value_instruction =
11734       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
11735   for (int i = copied_fields; i < inobject_properties; i++) {
11736     DCHECK(boilerplate_object->IsJSObject());
11737     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
11738     HObjectAccess access =
11739         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11740     Add<HStoreNamedField>(object, access, value_instruction);
11741   }
11742 }
11743
11744
11745 void HOptimizedGraphBuilder::BuildEmitElements(
11746     Handle<JSObject> boilerplate_object,
11747     Handle<FixedArrayBase> elements,
11748     HValue* object_elements,
11749     AllocationSiteUsageContext* site_context) {
11750   ElementsKind kind = boilerplate_object->map()->elements_kind();
11751   int elements_length = elements->length();
11752   HValue* object_elements_length = Add<HConstant>(elements_length);
11753   BuildInitializeElementsHeader(object_elements, kind, object_elements_length);
11754
11755   // Copy elements backing store content.
11756   if (elements->IsFixedDoubleArray()) {
11757     BuildEmitFixedDoubleArray(elements, kind, object_elements);
11758   } else if (elements->IsFixedArray()) {
11759     BuildEmitFixedArray(elements, kind, object_elements,
11760                         site_context);
11761   } else {
11762     UNREACHABLE();
11763   }
11764 }
11765
11766
11767 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
11768     Handle<FixedArrayBase> elements,
11769     ElementsKind kind,
11770     HValue* object_elements) {
11771   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11772   int elements_length = elements->length();
11773   for (int i = 0; i < elements_length; i++) {
11774     HValue* key_constant = Add<HConstant>(i);
11775     HInstruction* value_instruction = Add<HLoadKeyed>(
11776         boilerplate_elements, key_constant, nullptr, kind, ALLOW_RETURN_HOLE);
11777     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
11778                                            value_instruction, kind);
11779     store->SetFlag(HValue::kAllowUndefinedAsNaN);
11780   }
11781 }
11782
11783
11784 void HOptimizedGraphBuilder::BuildEmitFixedArray(
11785     Handle<FixedArrayBase> elements,
11786     ElementsKind kind,
11787     HValue* object_elements,
11788     AllocationSiteUsageContext* site_context) {
11789   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11790   int elements_length = elements->length();
11791   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
11792   for (int i = 0; i < elements_length; i++) {
11793     Handle<Object> value(fast_elements->get(i), isolate());
11794     HValue* key_constant = Add<HConstant>(i);
11795     if (value->IsJSObject()) {
11796       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11797       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11798       HInstruction* result =
11799           BuildFastLiteral(value_object, site_context);
11800       site_context->ExitScope(current_site, value_object);
11801       Add<HStoreKeyed>(object_elements, key_constant, result, kind);
11802     } else {
11803       ElementsKind copy_kind =
11804           kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
11805       HInstruction* value_instruction =
11806           Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr,
11807                           copy_kind, ALLOW_RETURN_HOLE);
11808       Add<HStoreKeyed>(object_elements, key_constant, value_instruction,
11809                        copy_kind);
11810     }
11811   }
11812 }
11813
11814
11815 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
11816   DCHECK(!HasStackOverflow());
11817   DCHECK(current_block() != NULL);
11818   DCHECK(current_block()->HasPredecessor());
11819   HInstruction* instr = BuildThisFunction();
11820   return ast_context()->ReturnInstruction(instr, expr->id());
11821 }
11822
11823
11824 void HOptimizedGraphBuilder::VisitSuperPropertyReference(
11825     SuperPropertyReference* expr) {
11826   DCHECK(!HasStackOverflow());
11827   DCHECK(current_block() != NULL);
11828   DCHECK(current_block()->HasPredecessor());
11829   return Bailout(kSuperReference);
11830 }
11831
11832
11833 void HOptimizedGraphBuilder::VisitSuperCallReference(SuperCallReference* expr) {
11834   DCHECK(!HasStackOverflow());
11835   DCHECK(current_block() != NULL);
11836   DCHECK(current_block()->HasPredecessor());
11837   return Bailout(kSuperReference);
11838 }
11839
11840
11841 void HOptimizedGraphBuilder::VisitDeclarations(
11842     ZoneList<Declaration*>* declarations) {
11843   DCHECK(globals_.is_empty());
11844   AstVisitor::VisitDeclarations(declarations);
11845   if (!globals_.is_empty()) {
11846     Handle<FixedArray> array =
11847        isolate()->factory()->NewFixedArray(globals_.length(), TENURED);
11848     for (int i = 0; i < globals_.length(); ++i) array->set(i, *globals_.at(i));
11849     int flags =
11850         DeclareGlobalsEvalFlag::encode(current_info()->is_eval()) |
11851         DeclareGlobalsNativeFlag::encode(current_info()->is_native()) |
11852         DeclareGlobalsLanguageMode::encode(current_info()->language_mode());
11853     Add<HDeclareGlobals>(array, flags);
11854     globals_.Rewind(0);
11855   }
11856 }
11857
11858
11859 void HOptimizedGraphBuilder::VisitVariableDeclaration(
11860     VariableDeclaration* declaration) {
11861   VariableProxy* proxy = declaration->proxy();
11862   VariableMode mode = declaration->mode();
11863   Variable* variable = proxy->var();
11864   bool hole_init = mode == LET || mode == CONST || mode == CONST_LEGACY;
11865   switch (variable->location()) {
11866     case VariableLocation::GLOBAL:
11867     case VariableLocation::UNALLOCATED:
11868       globals_.Add(variable->name(), zone());
11869       globals_.Add(variable->binding_needs_init()
11870                        ? isolate()->factory()->the_hole_value()
11871                        : isolate()->factory()->undefined_value(), zone());
11872       return;
11873     case VariableLocation::PARAMETER:
11874     case VariableLocation::LOCAL:
11875       if (hole_init) {
11876         HValue* value = graph()->GetConstantHole();
11877         environment()->Bind(variable, value);
11878       }
11879       break;
11880     case VariableLocation::CONTEXT:
11881       if (hole_init) {
11882         HValue* value = graph()->GetConstantHole();
11883         HValue* context = environment()->context();
11884         HStoreContextSlot* store = Add<HStoreContextSlot>(
11885             context, variable->index(), HStoreContextSlot::kNoCheck, value);
11886         if (store->HasObservableSideEffects()) {
11887           Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11888         }
11889       }
11890       break;
11891     case VariableLocation::LOOKUP:
11892       return Bailout(kUnsupportedLookupSlotInDeclaration);
11893   }
11894 }
11895
11896
11897 void HOptimizedGraphBuilder::VisitFunctionDeclaration(
11898     FunctionDeclaration* declaration) {
11899   VariableProxy* proxy = declaration->proxy();
11900   Variable* variable = proxy->var();
11901   switch (variable->location()) {
11902     case VariableLocation::GLOBAL:
11903     case VariableLocation::UNALLOCATED: {
11904       globals_.Add(variable->name(), zone());
11905       Handle<SharedFunctionInfo> function = Compiler::GetSharedFunctionInfo(
11906           declaration->fun(), current_info()->script(), top_info());
11907       // Check for stack-overflow exception.
11908       if (function.is_null()) return SetStackOverflow();
11909       globals_.Add(function, zone());
11910       return;
11911     }
11912     case VariableLocation::PARAMETER:
11913     case VariableLocation::LOCAL: {
11914       CHECK_ALIVE(VisitForValue(declaration->fun()));
11915       HValue* value = Pop();
11916       BindIfLive(variable, value);
11917       break;
11918     }
11919     case VariableLocation::CONTEXT: {
11920       CHECK_ALIVE(VisitForValue(declaration->fun()));
11921       HValue* value = Pop();
11922       HValue* context = environment()->context();
11923       HStoreContextSlot* store = Add<HStoreContextSlot>(
11924           context, variable->index(), HStoreContextSlot::kNoCheck, value);
11925       if (store->HasObservableSideEffects()) {
11926         Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11927       }
11928       break;
11929     }
11930     case VariableLocation::LOOKUP:
11931       return Bailout(kUnsupportedLookupSlotInDeclaration);
11932   }
11933 }
11934
11935
11936 void HOptimizedGraphBuilder::VisitImportDeclaration(
11937     ImportDeclaration* declaration) {
11938   UNREACHABLE();
11939 }
11940
11941
11942 void HOptimizedGraphBuilder::VisitExportDeclaration(
11943     ExportDeclaration* declaration) {
11944   UNREACHABLE();
11945 }
11946
11947
11948 // Generators for inline runtime functions.
11949 // Support for types.
11950 void HOptimizedGraphBuilder::GenerateIsSmi(CallRuntime* call) {
11951   DCHECK(call->arguments()->length() == 1);
11952   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11953   HValue* value = Pop();
11954   HIsSmiAndBranch* result = New<HIsSmiAndBranch>(value);
11955   return ast_context()->ReturnControl(result, call->id());
11956 }
11957
11958
11959 void HOptimizedGraphBuilder::GenerateIsSpecObject(CallRuntime* call) {
11960   DCHECK(call->arguments()->length() == 1);
11961   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11962   HValue* value = Pop();
11963   HHasInstanceTypeAndBranch* result =
11964       New<HHasInstanceTypeAndBranch>(value,
11965                                      FIRST_SPEC_OBJECT_TYPE,
11966                                      LAST_SPEC_OBJECT_TYPE);
11967   return ast_context()->ReturnControl(result, call->id());
11968 }
11969
11970
11971 void HOptimizedGraphBuilder::GenerateIsFunction(CallRuntime* call) {
11972   DCHECK(call->arguments()->length() == 1);
11973   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11974   HValue* value = Pop();
11975   HHasInstanceTypeAndBranch* result =
11976       New<HHasInstanceTypeAndBranch>(value, JS_FUNCTION_TYPE);
11977   return ast_context()->ReturnControl(result, call->id());
11978 }
11979
11980
11981 void HOptimizedGraphBuilder::GenerateIsMinusZero(CallRuntime* call) {
11982   DCHECK(call->arguments()->length() == 1);
11983   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11984   HValue* value = Pop();
11985   HCompareMinusZeroAndBranch* result = New<HCompareMinusZeroAndBranch>(value);
11986   return ast_context()->ReturnControl(result, call->id());
11987 }
11988
11989
11990 void HOptimizedGraphBuilder::GenerateHasCachedArrayIndex(CallRuntime* call) {
11991   DCHECK(call->arguments()->length() == 1);
11992   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11993   HValue* value = Pop();
11994   HHasCachedArrayIndexAndBranch* result =
11995       New<HHasCachedArrayIndexAndBranch>(value);
11996   return ast_context()->ReturnControl(result, call->id());
11997 }
11998
11999
12000 void HOptimizedGraphBuilder::GenerateIsArray(CallRuntime* call) {
12001   DCHECK(call->arguments()->length() == 1);
12002   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12003   HValue* value = Pop();
12004   HHasInstanceTypeAndBranch* result =
12005       New<HHasInstanceTypeAndBranch>(value, JS_ARRAY_TYPE);
12006   return ast_context()->ReturnControl(result, call->id());
12007 }
12008
12009
12010 void HOptimizedGraphBuilder::GenerateIsTypedArray(CallRuntime* call) {
12011   DCHECK(call->arguments()->length() == 1);
12012   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12013   HValue* value = Pop();
12014   HHasInstanceTypeAndBranch* result =
12015       New<HHasInstanceTypeAndBranch>(value, JS_TYPED_ARRAY_TYPE);
12016   return ast_context()->ReturnControl(result, call->id());
12017 }
12018
12019
12020 void HOptimizedGraphBuilder::GenerateIsRegExp(CallRuntime* call) {
12021   DCHECK(call->arguments()->length() == 1);
12022   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12023   HValue* value = Pop();
12024   HHasInstanceTypeAndBranch* result =
12025       New<HHasInstanceTypeAndBranch>(value, JS_REGEXP_TYPE);
12026   return ast_context()->ReturnControl(result, call->id());
12027 }
12028
12029
12030 void HOptimizedGraphBuilder::GenerateToObject(CallRuntime* call) {
12031   DCHECK_EQ(1, call->arguments()->length());
12032   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12033   HValue* value = Pop();
12034   HValue* result = BuildToObject(value);
12035   return ast_context()->ReturnValue(result);
12036 }
12037
12038
12039 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
12040   DCHECK(call->arguments()->length() == 1);
12041   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12042   HValue* value = Pop();
12043   HIfContinuation continuation;
12044   IfBuilder if_proxy(this);
12045
12046   HValue* smicheck = if_proxy.IfNot<HIsSmiAndBranch>(value);
12047   if_proxy.And();
12048   HValue* map = Add<HLoadNamedField>(value, smicheck, HObjectAccess::ForMap());
12049   HValue* instance_type =
12050       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
12051   if_proxy.If<HCompareNumericAndBranch>(
12052       instance_type, Add<HConstant>(FIRST_JS_PROXY_TYPE), Token::GTE);
12053   if_proxy.And();
12054   if_proxy.If<HCompareNumericAndBranch>(
12055       instance_type, Add<HConstant>(LAST_JS_PROXY_TYPE), Token::LTE);
12056
12057   if_proxy.CaptureContinuation(&continuation);
12058   return ast_context()->ReturnContinuation(&continuation, call->id());
12059 }
12060
12061
12062 void HOptimizedGraphBuilder::GenerateHasFastPackedElements(CallRuntime* call) {
12063   DCHECK(call->arguments()->length() == 1);
12064   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12065   HValue* object = Pop();
12066   HIfContinuation continuation(graph()->CreateBasicBlock(),
12067                                graph()->CreateBasicBlock());
12068   IfBuilder if_not_smi(this);
12069   if_not_smi.IfNot<HIsSmiAndBranch>(object);
12070   if_not_smi.Then();
12071   {
12072     NoObservableSideEffectsScope no_effects(this);
12073
12074     IfBuilder if_fast_packed(this);
12075     HValue* elements_kind = BuildGetElementsKind(object);
12076     if_fast_packed.If<HCompareNumericAndBranch>(
12077         elements_kind, Add<HConstant>(FAST_SMI_ELEMENTS), Token::EQ);
12078     if_fast_packed.Or();
12079     if_fast_packed.If<HCompareNumericAndBranch>(
12080         elements_kind, Add<HConstant>(FAST_ELEMENTS), Token::EQ);
12081     if_fast_packed.Or();
12082     if_fast_packed.If<HCompareNumericAndBranch>(
12083         elements_kind, Add<HConstant>(FAST_DOUBLE_ELEMENTS), Token::EQ);
12084     if_fast_packed.JoinContinuation(&continuation);
12085   }
12086   if_not_smi.JoinContinuation(&continuation);
12087   return ast_context()->ReturnContinuation(&continuation, call->id());
12088 }
12089
12090
12091 // Support for construct call checks.
12092 void HOptimizedGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
12093   DCHECK(call->arguments()->length() == 0);
12094   if (function_state()->outer() != NULL) {
12095     // We are generating graph for inlined function.
12096     HValue* value = function_state()->inlining_kind() == CONSTRUCT_CALL_RETURN
12097         ? graph()->GetConstantTrue()
12098         : graph()->GetConstantFalse();
12099     return ast_context()->ReturnValue(value);
12100   } else {
12101     return ast_context()->ReturnControl(New<HIsConstructCallAndBranch>(),
12102                                         call->id());
12103   }
12104 }
12105
12106
12107 // Support for arguments.length and arguments[?].
12108 void HOptimizedGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
12109   DCHECK(call->arguments()->length() == 0);
12110   HInstruction* result = NULL;
12111   if (function_state()->outer() == NULL) {
12112     HInstruction* elements = Add<HArgumentsElements>(false);
12113     result = New<HArgumentsLength>(elements);
12114   } else {
12115     // Number of arguments without receiver.
12116     int argument_count = environment()->
12117         arguments_environment()->parameter_count() - 1;
12118     result = New<HConstant>(argument_count);
12119   }
12120   return ast_context()->ReturnInstruction(result, call->id());
12121 }
12122
12123
12124 void HOptimizedGraphBuilder::GenerateArguments(CallRuntime* call) {
12125   DCHECK(call->arguments()->length() == 1);
12126   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12127   HValue* index = Pop();
12128   HInstruction* result = NULL;
12129   if (function_state()->outer() == NULL) {
12130     HInstruction* elements = Add<HArgumentsElements>(false);
12131     HInstruction* length = Add<HArgumentsLength>(elements);
12132     HInstruction* checked_index = Add<HBoundsCheck>(index, length);
12133     result = New<HAccessArgumentsAt>(elements, length, checked_index);
12134   } else {
12135     EnsureArgumentsArePushedForAccess();
12136
12137     // Number of arguments without receiver.
12138     HInstruction* elements = function_state()->arguments_elements();
12139     int argument_count = environment()->
12140         arguments_environment()->parameter_count() - 1;
12141     HInstruction* length = Add<HConstant>(argument_count);
12142     HInstruction* checked_key = Add<HBoundsCheck>(index, length);
12143     result = New<HAccessArgumentsAt>(elements, length, checked_key);
12144   }
12145   return ast_context()->ReturnInstruction(result, call->id());
12146 }
12147
12148
12149 void HOptimizedGraphBuilder::GenerateValueOf(CallRuntime* call) {
12150   DCHECK(call->arguments()->length() == 1);
12151   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12152   HValue* object = Pop();
12153
12154   IfBuilder if_objectisvalue(this);
12155   HValue* objectisvalue = if_objectisvalue.If<HHasInstanceTypeAndBranch>(
12156       object, JS_VALUE_TYPE);
12157   if_objectisvalue.Then();
12158   {
12159     // Return the actual value.
12160     Push(Add<HLoadNamedField>(
12161             object, objectisvalue,
12162             HObjectAccess::ForObservableJSObjectOffset(
12163                 JSValue::kValueOffset)));
12164     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12165   }
12166   if_objectisvalue.Else();
12167   {
12168     // If the object is not a value return the object.
12169     Push(object);
12170     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12171   }
12172   if_objectisvalue.End();
12173   return ast_context()->ReturnValue(Pop());
12174 }
12175
12176
12177 void HOptimizedGraphBuilder::GenerateJSValueGetValue(CallRuntime* call) {
12178   DCHECK(call->arguments()->length() == 1);
12179   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12180   HValue* value = Pop();
12181   HInstruction* result = Add<HLoadNamedField>(
12182       value, nullptr,
12183       HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset));
12184   return ast_context()->ReturnInstruction(result, call->id());
12185 }
12186
12187
12188 void HOptimizedGraphBuilder::GenerateIsDate(CallRuntime* call) {
12189   DCHECK_EQ(1, call->arguments()->length());
12190   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12191   HValue* value = Pop();
12192   HHasInstanceTypeAndBranch* result =
12193       New<HHasInstanceTypeAndBranch>(value, JS_DATE_TYPE);
12194   return ast_context()->ReturnControl(result, call->id());
12195 }
12196
12197
12198 void HOptimizedGraphBuilder::GenerateThrowNotDateError(CallRuntime* call) {
12199   DCHECK_EQ(0, call->arguments()->length());
12200   Add<HDeoptimize>(Deoptimizer::kNotADateObject, Deoptimizer::EAGER);
12201   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12202   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12203 }
12204
12205
12206 void HOptimizedGraphBuilder::GenerateDateField(CallRuntime* call) {
12207   DCHECK(call->arguments()->length() == 2);
12208   DCHECK_NOT_NULL(call->arguments()->at(1)->AsLiteral());
12209   Smi* index = Smi::cast(*(call->arguments()->at(1)->AsLiteral()->value()));
12210   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12211   HValue* date = Pop();
12212   HDateField* result = New<HDateField>(date, index);
12213   return ast_context()->ReturnInstruction(result, call->id());
12214 }
12215
12216
12217 void HOptimizedGraphBuilder::GenerateOneByteSeqStringSetChar(
12218     CallRuntime* call) {
12219   DCHECK(call->arguments()->length() == 3);
12220   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12221   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12222   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12223   HValue* string = Pop();
12224   HValue* value = Pop();
12225   HValue* index = Pop();
12226   Add<HSeqStringSetChar>(String::ONE_BYTE_ENCODING, string,
12227                          index, value);
12228   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12229   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12230 }
12231
12232
12233 void HOptimizedGraphBuilder::GenerateTwoByteSeqStringSetChar(
12234     CallRuntime* call) {
12235   DCHECK(call->arguments()->length() == 3);
12236   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12237   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12238   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12239   HValue* string = Pop();
12240   HValue* value = Pop();
12241   HValue* index = Pop();
12242   Add<HSeqStringSetChar>(String::TWO_BYTE_ENCODING, string,
12243                          index, value);
12244   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12245   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12246 }
12247
12248
12249 void HOptimizedGraphBuilder::GenerateSetValueOf(CallRuntime* call) {
12250   DCHECK(call->arguments()->length() == 2);
12251   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12252   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12253   HValue* value = Pop();
12254   HValue* object = Pop();
12255
12256   // Check if object is a JSValue.
12257   IfBuilder if_objectisvalue(this);
12258   if_objectisvalue.If<HHasInstanceTypeAndBranch>(object, JS_VALUE_TYPE);
12259   if_objectisvalue.Then();
12260   {
12261     // Create in-object property store to kValueOffset.
12262     Add<HStoreNamedField>(object,
12263         HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset),
12264         value);
12265     if (!ast_context()->IsEffect()) {
12266       Push(value);
12267     }
12268     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12269   }
12270   if_objectisvalue.Else();
12271   {
12272     // Nothing to do in this case.
12273     if (!ast_context()->IsEffect()) {
12274       Push(value);
12275     }
12276     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12277   }
12278   if_objectisvalue.End();
12279   if (!ast_context()->IsEffect()) {
12280     Drop(1);
12281   }
12282   return ast_context()->ReturnValue(value);
12283 }
12284
12285
12286 // Fast support for charCodeAt(n).
12287 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
12288   DCHECK(call->arguments()->length() == 2);
12289   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12290   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12291   HValue* index = Pop();
12292   HValue* string = Pop();
12293   HInstruction* result = BuildStringCharCodeAt(string, index);
12294   return ast_context()->ReturnInstruction(result, call->id());
12295 }
12296
12297
12298 // Fast support for string.charAt(n) and string[n].
12299 void HOptimizedGraphBuilder::GenerateStringCharFromCode(CallRuntime* call) {
12300   DCHECK(call->arguments()->length() == 1);
12301   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12302   HValue* char_code = Pop();
12303   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12304   return ast_context()->ReturnInstruction(result, call->id());
12305 }
12306
12307
12308 // Fast support for string.charAt(n) and string[n].
12309 void HOptimizedGraphBuilder::GenerateStringCharAt(CallRuntime* call) {
12310   DCHECK(call->arguments()->length() == 2);
12311   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12312   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12313   HValue* index = Pop();
12314   HValue* string = Pop();
12315   HInstruction* char_code = BuildStringCharCodeAt(string, index);
12316   AddInstruction(char_code);
12317   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12318   return ast_context()->ReturnInstruction(result, call->id());
12319 }
12320
12321
12322 // Fast support for object equality testing.
12323 void HOptimizedGraphBuilder::GenerateObjectEquals(CallRuntime* call) {
12324   DCHECK(call->arguments()->length() == 2);
12325   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12326   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12327   HValue* right = Pop();
12328   HValue* left = Pop();
12329   HCompareObjectEqAndBranch* result =
12330       New<HCompareObjectEqAndBranch>(left, right);
12331   return ast_context()->ReturnControl(result, call->id());
12332 }
12333
12334
12335 // Fast support for StringAdd.
12336 void HOptimizedGraphBuilder::GenerateStringAdd(CallRuntime* call) {
12337   DCHECK_EQ(2, call->arguments()->length());
12338   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12339   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12340   HValue* right = Pop();
12341   HValue* left = Pop();
12342   HInstruction* result =
12343       NewUncasted<HStringAdd>(left, right, strength(function_language_mode()));
12344   return ast_context()->ReturnInstruction(result, call->id());
12345 }
12346
12347
12348 // Fast support for SubString.
12349 void HOptimizedGraphBuilder::GenerateSubString(CallRuntime* call) {
12350   DCHECK_EQ(3, call->arguments()->length());
12351   CHECK_ALIVE(VisitExpressions(call->arguments()));
12352   PushArgumentsFromEnvironment(call->arguments()->length());
12353   HCallStub* result = New<HCallStub>(CodeStub::SubString, 3);
12354   return ast_context()->ReturnInstruction(result, call->id());
12355 }
12356
12357
12358 // Fast support for StringCompare.
12359 void HOptimizedGraphBuilder::GenerateStringCompare(CallRuntime* call) {
12360   DCHECK_EQ(2, call->arguments()->length());
12361   CHECK_ALIVE(VisitExpressions(call->arguments()));
12362   PushArgumentsFromEnvironment(call->arguments()->length());
12363   HCallStub* result = New<HCallStub>(CodeStub::StringCompare, 2);
12364   return ast_context()->ReturnInstruction(result, call->id());
12365 }
12366
12367
12368 void HOptimizedGraphBuilder::GenerateStringGetLength(CallRuntime* call) {
12369   DCHECK(call->arguments()->length() == 1);
12370   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12371   HValue* string = Pop();
12372   HInstruction* result = BuildLoadStringLength(string);
12373   return ast_context()->ReturnInstruction(result, call->id());
12374 }
12375
12376
12377 // Support for direct calls from JavaScript to native RegExp code.
12378 void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
12379   DCHECK_EQ(4, call->arguments()->length());
12380   CHECK_ALIVE(VisitExpressions(call->arguments()));
12381   PushArgumentsFromEnvironment(call->arguments()->length());
12382   HCallStub* result = New<HCallStub>(CodeStub::RegExpExec, 4);
12383   return ast_context()->ReturnInstruction(result, call->id());
12384 }
12385
12386
12387 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
12388   DCHECK_EQ(1, call->arguments()->length());
12389   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12390   HValue* value = Pop();
12391   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::LOW);
12392   return ast_context()->ReturnInstruction(result, call->id());
12393 }
12394
12395
12396 void HOptimizedGraphBuilder::GenerateDoubleHi(CallRuntime* call) {
12397   DCHECK_EQ(1, call->arguments()->length());
12398   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12399   HValue* value = Pop();
12400   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::HIGH);
12401   return ast_context()->ReturnInstruction(result, call->id());
12402 }
12403
12404
12405 void HOptimizedGraphBuilder::GenerateConstructDouble(CallRuntime* call) {
12406   DCHECK_EQ(2, call->arguments()->length());
12407   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12408   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12409   HValue* lo = Pop();
12410   HValue* hi = Pop();
12411   HInstruction* result = NewUncasted<HConstructDouble>(hi, lo);
12412   return ast_context()->ReturnInstruction(result, call->id());
12413 }
12414
12415
12416 // Construct a RegExp exec result with two in-object properties.
12417 void HOptimizedGraphBuilder::GenerateRegExpConstructResult(CallRuntime* call) {
12418   DCHECK_EQ(3, call->arguments()->length());
12419   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12420   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12421   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12422   HValue* input = Pop();
12423   HValue* index = Pop();
12424   HValue* length = Pop();
12425   HValue* result = BuildRegExpConstructResult(length, index, input);
12426   return ast_context()->ReturnValue(result);
12427 }
12428
12429
12430 // Fast support for number to string.
12431 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
12432   DCHECK_EQ(1, call->arguments()->length());
12433   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12434   HValue* number = Pop();
12435   HValue* result = BuildNumberToString(number, Type::Any(zone()));
12436   return ast_context()->ReturnValue(result);
12437 }
12438
12439
12440 // Fast call for custom callbacks.
12441 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
12442   // 1 ~ The function to call is not itself an argument to the call.
12443   int arg_count = call->arguments()->length() - 1;
12444   DCHECK(arg_count >= 1);  // There's always at least a receiver.
12445
12446   CHECK_ALIVE(VisitExpressions(call->arguments()));
12447   // The function is the last argument
12448   HValue* function = Pop();
12449   // Push the arguments to the stack
12450   PushArgumentsFromEnvironment(arg_count);
12451
12452   IfBuilder if_is_jsfunction(this);
12453   if_is_jsfunction.If<HHasInstanceTypeAndBranch>(function, JS_FUNCTION_TYPE);
12454
12455   if_is_jsfunction.Then();
12456   {
12457     HInstruction* invoke_result =
12458         Add<HInvokeFunction>(function, arg_count);
12459     if (!ast_context()->IsEffect()) {
12460       Push(invoke_result);
12461     }
12462     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12463   }
12464
12465   if_is_jsfunction.Else();
12466   {
12467     HInstruction* call_result =
12468         Add<HCallFunction>(function, arg_count);
12469     if (!ast_context()->IsEffect()) {
12470       Push(call_result);
12471     }
12472     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12473   }
12474   if_is_jsfunction.End();
12475
12476   if (ast_context()->IsEffect()) {
12477     // EffectContext::ReturnValue ignores the value, so we can just pass
12478     // 'undefined' (as we do not have the call result anymore).
12479     return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12480   } else {
12481     return ast_context()->ReturnValue(Pop());
12482   }
12483 }
12484
12485
12486 // Fast call to math functions.
12487 void HOptimizedGraphBuilder::GenerateMathPow(CallRuntime* call) {
12488   DCHECK_EQ(2, call->arguments()->length());
12489   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12490   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12491   HValue* right = Pop();
12492   HValue* left = Pop();
12493   HInstruction* result = NewUncasted<HPower>(left, right);
12494   return ast_context()->ReturnInstruction(result, call->id());
12495 }
12496
12497
12498 void HOptimizedGraphBuilder::GenerateMathClz32(CallRuntime* call) {
12499   DCHECK(call->arguments()->length() == 1);
12500   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12501   HValue* value = Pop();
12502   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathClz32);
12503   return ast_context()->ReturnInstruction(result, call->id());
12504 }
12505
12506
12507 void HOptimizedGraphBuilder::GenerateMathFloor(CallRuntime* call) {
12508   DCHECK(call->arguments()->length() == 1);
12509   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12510   HValue* value = Pop();
12511   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathFloor);
12512   return ast_context()->ReturnInstruction(result, call->id());
12513 }
12514
12515
12516 void HOptimizedGraphBuilder::GenerateMathLogRT(CallRuntime* call) {
12517   DCHECK(call->arguments()->length() == 1);
12518   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12519   HValue* value = Pop();
12520   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathLog);
12521   return ast_context()->ReturnInstruction(result, call->id());
12522 }
12523
12524
12525 void HOptimizedGraphBuilder::GenerateMathSqrt(CallRuntime* call) {
12526   DCHECK(call->arguments()->length() == 1);
12527   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12528   HValue* value = Pop();
12529   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathSqrt);
12530   return ast_context()->ReturnInstruction(result, call->id());
12531 }
12532
12533
12534 void HOptimizedGraphBuilder::GenerateLikely(CallRuntime* call) {
12535   DCHECK(call->arguments()->length() == 1);
12536   Visit(call->arguments()->at(0));
12537 }
12538
12539
12540 void HOptimizedGraphBuilder::GenerateUnlikely(CallRuntime* call) {
12541   return GenerateLikely(call);
12542 }
12543
12544
12545 void HOptimizedGraphBuilder::GenerateHasInPrototypeChain(CallRuntime* call) {
12546   DCHECK_EQ(2, call->arguments()->length());
12547   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12548   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12549   HValue* prototype = Pop();
12550   HValue* object = Pop();
12551   HHasInPrototypeChainAndBranch* result =
12552       New<HHasInPrototypeChainAndBranch>(object, prototype);
12553   return ast_context()->ReturnControl(result, call->id());
12554 }
12555
12556
12557 void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
12558   DCHECK(call->arguments()->length() == 2);
12559   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12560   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12561   HValue* index = Pop();
12562   HValue* object = Pop();
12563   HInstruction* result = New<HLoadKeyed>(
12564       object, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
12565   return ast_context()->ReturnInstruction(result, call->id());
12566 }
12567
12568
12569 void HOptimizedGraphBuilder::GenerateFixedArraySet(CallRuntime* call) {
12570   DCHECK(call->arguments()->length() == 3);
12571   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12572   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12573   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12574   HValue* value = Pop();
12575   HValue* index = Pop();
12576   HValue* object = Pop();
12577   NoObservableSideEffectsScope no_effects(this);
12578   Add<HStoreKeyed>(object, index, value, FAST_HOLEY_ELEMENTS);
12579   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12580 }
12581
12582
12583 void HOptimizedGraphBuilder::GenerateTheHole(CallRuntime* call) {
12584   DCHECK(call->arguments()->length() == 0);
12585   return ast_context()->ReturnValue(graph()->GetConstantHole());
12586 }
12587
12588
12589 void HOptimizedGraphBuilder::GenerateJSCollectionGetTable(CallRuntime* call) {
12590   DCHECK(call->arguments()->length() == 1);
12591   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12592   HValue* receiver = Pop();
12593   HInstruction* result = New<HLoadNamedField>(
12594       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12595   return ast_context()->ReturnInstruction(result, call->id());
12596 }
12597
12598
12599 void HOptimizedGraphBuilder::GenerateStringGetRawHashField(CallRuntime* call) {
12600   DCHECK(call->arguments()->length() == 1);
12601   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12602   HValue* object = Pop();
12603   HInstruction* result = New<HLoadNamedField>(
12604       object, nullptr, HObjectAccess::ForStringHashField());
12605   return ast_context()->ReturnInstruction(result, call->id());
12606 }
12607
12608
12609 template <typename CollectionType>
12610 HValue* HOptimizedGraphBuilder::BuildAllocateOrderedHashTable() {
12611   static const int kCapacity = CollectionType::kMinCapacity;
12612   static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
12613   static const int kFixedArrayLength = CollectionType::kHashTableStartIndex +
12614                                        kBucketCount +
12615                                        (kCapacity * CollectionType::kEntrySize);
12616   static const int kSizeInBytes =
12617       FixedArray::kHeaderSize + (kFixedArrayLength * kPointerSize);
12618
12619   // Allocate the table and add the proper map.
12620   HValue* table =
12621       Add<HAllocate>(Add<HConstant>(kSizeInBytes), HType::HeapObject(),
12622                      NOT_TENURED, FIXED_ARRAY_TYPE);
12623   AddStoreMapConstant(table, isolate()->factory()->ordered_hash_table_map());
12624
12625   // Initialize the FixedArray...
12626   HValue* length = Add<HConstant>(kFixedArrayLength);
12627   Add<HStoreNamedField>(table, HObjectAccess::ForFixedArrayLength(), length);
12628
12629   // ...and the OrderedHashTable fields.
12630   Add<HStoreNamedField>(
12631       table,
12632       HObjectAccess::ForOrderedHashTableNumberOfBuckets<CollectionType>(),
12633       Add<HConstant>(kBucketCount));
12634   Add<HStoreNamedField>(
12635       table,
12636       HObjectAccess::ForOrderedHashTableNumberOfElements<CollectionType>(),
12637       graph()->GetConstant0());
12638   Add<HStoreNamedField>(
12639       table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12640                  CollectionType>(),
12641       graph()->GetConstant0());
12642
12643   // Fill the buckets with kNotFound.
12644   HValue* not_found = Add<HConstant>(CollectionType::kNotFound);
12645   for (int i = 0; i < kBucketCount; ++i) {
12646     Add<HStoreNamedField>(
12647         table, HObjectAccess::ForOrderedHashTableBucket<CollectionType>(i),
12648         not_found);
12649   }
12650
12651   // Fill the data table with undefined.
12652   HValue* undefined = graph()->GetConstantUndefined();
12653   for (int i = 0; i < (kCapacity * CollectionType::kEntrySize); ++i) {
12654     Add<HStoreNamedField>(table,
12655                           HObjectAccess::ForOrderedHashTableDataTableIndex<
12656                               CollectionType, kBucketCount>(i),
12657                           undefined);
12658   }
12659
12660   return table;
12661 }
12662
12663
12664 void HOptimizedGraphBuilder::GenerateSetInitialize(CallRuntime* call) {
12665   DCHECK(call->arguments()->length() == 1);
12666   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12667   HValue* receiver = Pop();
12668
12669   NoObservableSideEffectsScope no_effects(this);
12670   HValue* table = BuildAllocateOrderedHashTable<OrderedHashSet>();
12671   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12672   return ast_context()->ReturnValue(receiver);
12673 }
12674
12675
12676 void HOptimizedGraphBuilder::GenerateMapInitialize(CallRuntime* call) {
12677   DCHECK(call->arguments()->length() == 1);
12678   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12679   HValue* receiver = Pop();
12680
12681   NoObservableSideEffectsScope no_effects(this);
12682   HValue* table = BuildAllocateOrderedHashTable<OrderedHashMap>();
12683   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12684   return ast_context()->ReturnValue(receiver);
12685 }
12686
12687
12688 template <typename CollectionType>
12689 void HOptimizedGraphBuilder::BuildOrderedHashTableClear(HValue* receiver) {
12690   HValue* old_table = Add<HLoadNamedField>(
12691       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12692   HValue* new_table = BuildAllocateOrderedHashTable<CollectionType>();
12693   Add<HStoreNamedField>(
12694       old_table, HObjectAccess::ForOrderedHashTableNextTable<CollectionType>(),
12695       new_table);
12696   Add<HStoreNamedField>(
12697       old_table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12698                      CollectionType>(),
12699       Add<HConstant>(CollectionType::kClearedTableSentinel));
12700   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(),
12701                         new_table);
12702 }
12703
12704
12705 void HOptimizedGraphBuilder::GenerateSetClear(CallRuntime* call) {
12706   DCHECK(call->arguments()->length() == 1);
12707   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12708   HValue* receiver = Pop();
12709
12710   NoObservableSideEffectsScope no_effects(this);
12711   BuildOrderedHashTableClear<OrderedHashSet>(receiver);
12712   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12713 }
12714
12715
12716 void HOptimizedGraphBuilder::GenerateMapClear(CallRuntime* call) {
12717   DCHECK(call->arguments()->length() == 1);
12718   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12719   HValue* receiver = Pop();
12720
12721   NoObservableSideEffectsScope no_effects(this);
12722   BuildOrderedHashTableClear<OrderedHashMap>(receiver);
12723   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12724 }
12725
12726
12727 void HOptimizedGraphBuilder::GenerateGetCachedArrayIndex(CallRuntime* call) {
12728   DCHECK(call->arguments()->length() == 1);
12729   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12730   HValue* value = Pop();
12731   HGetCachedArrayIndex* result = New<HGetCachedArrayIndex>(value);
12732   return ast_context()->ReturnInstruction(result, call->id());
12733 }
12734
12735
12736 void HOptimizedGraphBuilder::GenerateFastOneByteArrayJoin(CallRuntime* call) {
12737   // Simply returning undefined here would be semantically correct and even
12738   // avoid the bailout. Nevertheless, some ancient benchmarks like SunSpider's
12739   // string-fasta would tank, because fullcode contains an optimized version.
12740   // Obviously the fullcode => Crankshaft => bailout => fullcode dance is
12741   // faster... *sigh*
12742   return Bailout(kInlinedRuntimeFunctionFastOneByteArrayJoin);
12743 }
12744
12745
12746 void HOptimizedGraphBuilder::GenerateDebugBreakInOptimizedCode(
12747     CallRuntime* call) {
12748   Add<HDebugBreak>();
12749   return ast_context()->ReturnValue(graph()->GetConstant0());
12750 }
12751
12752
12753 void HOptimizedGraphBuilder::GenerateDebugIsActive(CallRuntime* call) {
12754   DCHECK(call->arguments()->length() == 0);
12755   HValue* ref =
12756       Add<HConstant>(ExternalReference::debug_is_active_address(isolate()));
12757   HValue* value =
12758       Add<HLoadNamedField>(ref, nullptr, HObjectAccess::ForExternalUInteger8());
12759   return ast_context()->ReturnValue(value);
12760 }
12761
12762
12763 void HOptimizedGraphBuilder::GenerateGetPrototype(CallRuntime* call) {
12764   DCHECK(call->arguments()->length() == 1);
12765   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12766   HValue* object = Pop();
12767
12768   NoObservableSideEffectsScope no_effects(this);
12769
12770   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
12771   HValue* bit_field =
12772       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField());
12773   HValue* is_access_check_needed_mask =
12774       Add<HConstant>(1 << Map::kIsAccessCheckNeeded);
12775   HValue* is_access_check_needed_test = AddUncasted<HBitwise>(
12776       Token::BIT_AND, bit_field, is_access_check_needed_mask);
12777
12778   HValue* proto =
12779       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForPrototype());
12780   HValue* proto_map =
12781       Add<HLoadNamedField>(proto, nullptr, HObjectAccess::ForMap());
12782   HValue* proto_bit_field =
12783       Add<HLoadNamedField>(proto_map, nullptr, HObjectAccess::ForMapBitField());
12784   HValue* is_hidden_prototype_mask =
12785       Add<HConstant>(1 << Map::kIsHiddenPrototype);
12786   HValue* is_hidden_prototype_test = AddUncasted<HBitwise>(
12787       Token::BIT_AND, proto_bit_field, is_hidden_prototype_mask);
12788
12789   {
12790     IfBuilder needs_runtime(this);
12791     needs_runtime.If<HCompareNumericAndBranch>(
12792         is_access_check_needed_test, graph()->GetConstant0(), Token::NE);
12793     needs_runtime.OrIf<HCompareNumericAndBranch>(
12794         is_hidden_prototype_test, graph()->GetConstant0(), Token::NE);
12795
12796     needs_runtime.Then();
12797     {
12798       Add<HPushArguments>(object);
12799       Push(
12800           Add<HCallRuntime>(Runtime::FunctionForId(Runtime::kGetPrototype), 1));
12801     }
12802
12803     needs_runtime.Else();
12804     Push(proto);
12805   }
12806   return ast_context()->ReturnValue(Pop());
12807 }
12808
12809
12810 #undef CHECK_BAILOUT
12811 #undef CHECK_ALIVE
12812
12813
12814 HEnvironment::HEnvironment(HEnvironment* outer,
12815                            Scope* scope,
12816                            Handle<JSFunction> closure,
12817                            Zone* zone)
12818     : closure_(closure),
12819       values_(0, zone),
12820       frame_type_(JS_FUNCTION),
12821       parameter_count_(0),
12822       specials_count_(1),
12823       local_count_(0),
12824       outer_(outer),
12825       entry_(NULL),
12826       pop_count_(0),
12827       push_count_(0),
12828       ast_id_(BailoutId::None()),
12829       zone_(zone) {
12830   Scope* declaration_scope = scope->DeclarationScope();
12831   Initialize(declaration_scope->num_parameters() + 1,
12832              declaration_scope->num_stack_slots(), 0);
12833 }
12834
12835
12836 HEnvironment::HEnvironment(Zone* zone, int parameter_count)
12837     : values_(0, zone),
12838       frame_type_(STUB),
12839       parameter_count_(parameter_count),
12840       specials_count_(1),
12841       local_count_(0),
12842       outer_(NULL),
12843       entry_(NULL),
12844       pop_count_(0),
12845       push_count_(0),
12846       ast_id_(BailoutId::None()),
12847       zone_(zone) {
12848   Initialize(parameter_count, 0, 0);
12849 }
12850
12851
12852 HEnvironment::HEnvironment(const HEnvironment* other, Zone* zone)
12853     : values_(0, zone),
12854       frame_type_(JS_FUNCTION),
12855       parameter_count_(0),
12856       specials_count_(0),
12857       local_count_(0),
12858       outer_(NULL),
12859       entry_(NULL),
12860       pop_count_(0),
12861       push_count_(0),
12862       ast_id_(other->ast_id()),
12863       zone_(zone) {
12864   Initialize(other);
12865 }
12866
12867
12868 HEnvironment::HEnvironment(HEnvironment* outer,
12869                            Handle<JSFunction> closure,
12870                            FrameType frame_type,
12871                            int arguments,
12872                            Zone* zone)
12873     : closure_(closure),
12874       values_(arguments, zone),
12875       frame_type_(frame_type),
12876       parameter_count_(arguments),
12877       specials_count_(0),
12878       local_count_(0),
12879       outer_(outer),
12880       entry_(NULL),
12881       pop_count_(0),
12882       push_count_(0),
12883       ast_id_(BailoutId::None()),
12884       zone_(zone) {
12885 }
12886
12887
12888 void HEnvironment::Initialize(int parameter_count,
12889                               int local_count,
12890                               int stack_height) {
12891   parameter_count_ = parameter_count;
12892   local_count_ = local_count;
12893
12894   // Avoid reallocating the temporaries' backing store on the first Push.
12895   int total = parameter_count + specials_count_ + local_count + stack_height;
12896   values_.Initialize(total + 4, zone());
12897   for (int i = 0; i < total; ++i) values_.Add(NULL, zone());
12898 }
12899
12900
12901 void HEnvironment::Initialize(const HEnvironment* other) {
12902   closure_ = other->closure();
12903   values_.AddAll(other->values_, zone());
12904   assigned_variables_.Union(other->assigned_variables_, zone());
12905   frame_type_ = other->frame_type_;
12906   parameter_count_ = other->parameter_count_;
12907   local_count_ = other->local_count_;
12908   if (other->outer_ != NULL) outer_ = other->outer_->Copy();  // Deep copy.
12909   entry_ = other->entry_;
12910   pop_count_ = other->pop_count_;
12911   push_count_ = other->push_count_;
12912   specials_count_ = other->specials_count_;
12913   ast_id_ = other->ast_id_;
12914 }
12915
12916
12917 void HEnvironment::AddIncomingEdge(HBasicBlock* block, HEnvironment* other) {
12918   DCHECK(!block->IsLoopHeader());
12919   DCHECK(values_.length() == other->values_.length());
12920
12921   int length = values_.length();
12922   for (int i = 0; i < length; ++i) {
12923     HValue* value = values_[i];
12924     if (value != NULL && value->IsPhi() && value->block() == block) {
12925       // There is already a phi for the i'th value.
12926       HPhi* phi = HPhi::cast(value);
12927       // Assert index is correct and that we haven't missed an incoming edge.
12928       DCHECK(phi->merged_index() == i || !phi->HasMergedIndex());
12929       DCHECK(phi->OperandCount() == block->predecessors()->length());
12930       phi->AddInput(other->values_[i]);
12931     } else if (values_[i] != other->values_[i]) {
12932       // There is a fresh value on the incoming edge, a phi is needed.
12933       DCHECK(values_[i] != NULL && other->values_[i] != NULL);
12934       HPhi* phi = block->AddNewPhi(i);
12935       HValue* old_value = values_[i];
12936       for (int j = 0; j < block->predecessors()->length(); j++) {
12937         phi->AddInput(old_value);
12938       }
12939       phi->AddInput(other->values_[i]);
12940       this->values_[i] = phi;
12941     }
12942   }
12943 }
12944
12945
12946 void HEnvironment::Bind(int index, HValue* value) {
12947   DCHECK(value != NULL);
12948   assigned_variables_.Add(index, zone());
12949   values_[index] = value;
12950 }
12951
12952
12953 bool HEnvironment::HasExpressionAt(int index) const {
12954   return index >= parameter_count_ + specials_count_ + local_count_;
12955 }
12956
12957
12958 bool HEnvironment::ExpressionStackIsEmpty() const {
12959   DCHECK(length() >= first_expression_index());
12960   return length() == first_expression_index();
12961 }
12962
12963
12964 void HEnvironment::SetExpressionStackAt(int index_from_top, HValue* value) {
12965   int count = index_from_top + 1;
12966   int index = values_.length() - count;
12967   DCHECK(HasExpressionAt(index));
12968   // The push count must include at least the element in question or else
12969   // the new value will not be included in this environment's history.
12970   if (push_count_ < count) {
12971     // This is the same effect as popping then re-pushing 'count' elements.
12972     pop_count_ += (count - push_count_);
12973     push_count_ = count;
12974   }
12975   values_[index] = value;
12976 }
12977
12978
12979 HValue* HEnvironment::RemoveExpressionStackAt(int index_from_top) {
12980   int count = index_from_top + 1;
12981   int index = values_.length() - count;
12982   DCHECK(HasExpressionAt(index));
12983   // Simulate popping 'count' elements and then
12984   // pushing 'count - 1' elements back.
12985   pop_count_ += Max(count - push_count_, 0);
12986   push_count_ = Max(push_count_ - count, 0) + (count - 1);
12987   return values_.Remove(index);
12988 }
12989
12990
12991 void HEnvironment::Drop(int count) {
12992   for (int i = 0; i < count; ++i) {
12993     Pop();
12994   }
12995 }
12996
12997
12998 HEnvironment* HEnvironment::Copy() const {
12999   return new(zone()) HEnvironment(this, zone());
13000 }
13001
13002
13003 HEnvironment* HEnvironment::CopyWithoutHistory() const {
13004   HEnvironment* result = Copy();
13005   result->ClearHistory();
13006   return result;
13007 }
13008
13009
13010 HEnvironment* HEnvironment::CopyAsLoopHeader(HBasicBlock* loop_header) const {
13011   HEnvironment* new_env = Copy();
13012   for (int i = 0; i < values_.length(); ++i) {
13013     HPhi* phi = loop_header->AddNewPhi(i);
13014     phi->AddInput(values_[i]);
13015     new_env->values_[i] = phi;
13016   }
13017   new_env->ClearHistory();
13018   return new_env;
13019 }
13020
13021
13022 HEnvironment* HEnvironment::CreateStubEnvironment(HEnvironment* outer,
13023                                                   Handle<JSFunction> target,
13024                                                   FrameType frame_type,
13025                                                   int arguments) const {
13026   HEnvironment* new_env =
13027       new(zone()) HEnvironment(outer, target, frame_type,
13028                                arguments + 1, zone());
13029   for (int i = 0; i <= arguments; ++i) {  // Include receiver.
13030     new_env->Push(ExpressionStackAt(arguments - i));
13031   }
13032   new_env->ClearHistory();
13033   return new_env;
13034 }
13035
13036
13037 HEnvironment* HEnvironment::CopyForInlining(
13038     Handle<JSFunction> target,
13039     int arguments,
13040     FunctionLiteral* function,
13041     HConstant* undefined,
13042     InliningKind inlining_kind) const {
13043   DCHECK(frame_type() == JS_FUNCTION);
13044
13045   // Outer environment is a copy of this one without the arguments.
13046   int arity = function->scope()->num_parameters();
13047
13048   HEnvironment* outer = Copy();
13049   outer->Drop(arguments + 1);  // Including receiver.
13050   outer->ClearHistory();
13051
13052   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
13053     // Create artificial constructor stub environment.  The receiver should
13054     // actually be the constructor function, but we pass the newly allocated
13055     // object instead, DoComputeConstructStubFrame() relies on that.
13056     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
13057   } else if (inlining_kind == GETTER_CALL_RETURN) {
13058     // We need an additional StackFrame::INTERNAL frame for restoring the
13059     // correct context.
13060     outer = CreateStubEnvironment(outer, target, JS_GETTER, arguments);
13061   } else if (inlining_kind == SETTER_CALL_RETURN) {
13062     // We need an additional StackFrame::INTERNAL frame for temporarily saving
13063     // the argument of the setter, see StoreStubCompiler::CompileStoreViaSetter.
13064     outer = CreateStubEnvironment(outer, target, JS_SETTER, arguments);
13065   }
13066
13067   if (arity != arguments) {
13068     // Create artificial arguments adaptation environment.
13069     outer = CreateStubEnvironment(outer, target, ARGUMENTS_ADAPTOR, arguments);
13070   }
13071
13072   HEnvironment* inner =
13073       new(zone()) HEnvironment(outer, function->scope(), target, zone());
13074   // Get the argument values from the original environment.
13075   for (int i = 0; i <= arity; ++i) {  // Include receiver.
13076     HValue* push = (i <= arguments) ?
13077         ExpressionStackAt(arguments - i) : undefined;
13078     inner->SetValueAt(i, push);
13079   }
13080   inner->SetValueAt(arity + 1, context());
13081   for (int i = arity + 2; i < inner->length(); ++i) {
13082     inner->SetValueAt(i, undefined);
13083   }
13084
13085   inner->set_ast_id(BailoutId::FunctionEntry());
13086   return inner;
13087 }
13088
13089
13090 std::ostream& operator<<(std::ostream& os, const HEnvironment& env) {
13091   for (int i = 0; i < env.length(); i++) {
13092     if (i == 0) os << "parameters\n";
13093     if (i == env.parameter_count()) os << "specials\n";
13094     if (i == env.parameter_count() + env.specials_count()) os << "locals\n";
13095     if (i == env.parameter_count() + env.specials_count() + env.local_count()) {
13096       os << "expressions\n";
13097     }
13098     HValue* val = env.values()->at(i);
13099     os << i << ": ";
13100     if (val != NULL) {
13101       os << val;
13102     } else {
13103       os << "NULL";
13104     }
13105     os << "\n";
13106   }
13107   return os << "\n";
13108 }
13109
13110
13111 void HTracer::TraceCompilation(CompilationInfo* info) {
13112   Tag tag(this, "compilation");
13113   base::SmartArrayPointer<char> name = info->GetDebugName();
13114   if (info->IsOptimizing()) {
13115     PrintStringProperty("name", name.get());
13116     PrintIndent();
13117     trace_.Add("method \"%s:%d\"\n", name.get(), info->optimization_id());
13118   } else {
13119     PrintStringProperty("name", name.get());
13120     PrintStringProperty("method", "stub");
13121   }
13122   PrintLongProperty("date",
13123                     static_cast<int64_t>(base::OS::TimeCurrentMillis()));
13124 }
13125
13126
13127 void HTracer::TraceLithium(const char* name, LChunk* chunk) {
13128   DCHECK(!chunk->isolate()->concurrent_recompilation_enabled());
13129   AllowHandleDereference allow_deref;
13130   AllowDeferredHandleDereference allow_deferred_deref;
13131   Trace(name, chunk->graph(), chunk);
13132 }
13133
13134
13135 void HTracer::TraceHydrogen(const char* name, HGraph* graph) {
13136   DCHECK(!graph->isolate()->concurrent_recompilation_enabled());
13137   AllowHandleDereference allow_deref;
13138   AllowDeferredHandleDereference allow_deferred_deref;
13139   Trace(name, graph, NULL);
13140 }
13141
13142
13143 void HTracer::Trace(const char* name, HGraph* graph, LChunk* chunk) {
13144   Tag tag(this, "cfg");
13145   PrintStringProperty("name", name);
13146   const ZoneList<HBasicBlock*>* blocks = graph->blocks();
13147   for (int i = 0; i < blocks->length(); i++) {
13148     HBasicBlock* current = blocks->at(i);
13149     Tag block_tag(this, "block");
13150     PrintBlockProperty("name", current->block_id());
13151     PrintIntProperty("from_bci", -1);
13152     PrintIntProperty("to_bci", -1);
13153
13154     if (!current->predecessors()->is_empty()) {
13155       PrintIndent();
13156       trace_.Add("predecessors");
13157       for (int j = 0; j < current->predecessors()->length(); ++j) {
13158         trace_.Add(" \"B%d\"", current->predecessors()->at(j)->block_id());
13159       }
13160       trace_.Add("\n");
13161     } else {
13162       PrintEmptyProperty("predecessors");
13163     }
13164
13165     if (current->end()->SuccessorCount() == 0) {
13166       PrintEmptyProperty("successors");
13167     } else  {
13168       PrintIndent();
13169       trace_.Add("successors");
13170       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
13171         trace_.Add(" \"B%d\"", it.Current()->block_id());
13172       }
13173       trace_.Add("\n");
13174     }
13175
13176     PrintEmptyProperty("xhandlers");
13177
13178     {
13179       PrintIndent();
13180       trace_.Add("flags");
13181       if (current->IsLoopSuccessorDominator()) {
13182         trace_.Add(" \"dom-loop-succ\"");
13183       }
13184       if (current->IsUnreachable()) {
13185         trace_.Add(" \"dead\"");
13186       }
13187       if (current->is_osr_entry()) {
13188         trace_.Add(" \"osr\"");
13189       }
13190       trace_.Add("\n");
13191     }
13192
13193     if (current->dominator() != NULL) {
13194       PrintBlockProperty("dominator", current->dominator()->block_id());
13195     }
13196
13197     PrintIntProperty("loop_depth", current->LoopNestingDepth());
13198
13199     if (chunk != NULL) {
13200       int first_index = current->first_instruction_index();
13201       int last_index = current->last_instruction_index();
13202       PrintIntProperty(
13203           "first_lir_id",
13204           LifetimePosition::FromInstructionIndex(first_index).Value());
13205       PrintIntProperty(
13206           "last_lir_id",
13207           LifetimePosition::FromInstructionIndex(last_index).Value());
13208     }
13209
13210     {
13211       Tag states_tag(this, "states");
13212       Tag locals_tag(this, "locals");
13213       int total = current->phis()->length();
13214       PrintIntProperty("size", current->phis()->length());
13215       PrintStringProperty("method", "None");
13216       for (int j = 0; j < total; ++j) {
13217         HPhi* phi = current->phis()->at(j);
13218         PrintIndent();
13219         std::ostringstream os;
13220         os << phi->merged_index() << " " << NameOf(phi) << " " << *phi << "\n";
13221         trace_.Add(os.str().c_str());
13222       }
13223     }
13224
13225     {
13226       Tag HIR_tag(this, "HIR");
13227       for (HInstructionIterator it(current); !it.Done(); it.Advance()) {
13228         HInstruction* instruction = it.Current();
13229         int uses = instruction->UseCount();
13230         PrintIndent();
13231         std::ostringstream os;
13232         os << "0 " << uses << " " << NameOf(instruction) << " " << *instruction;
13233         if (graph->info()->is_tracking_positions() &&
13234             instruction->has_position() && instruction->position().raw() != 0) {
13235           const SourcePosition pos = instruction->position();
13236           os << " pos:";
13237           if (pos.inlining_id() != 0) os << pos.inlining_id() << "_";
13238           os << pos.position();
13239         }
13240         os << " <|@\n";
13241         trace_.Add(os.str().c_str());
13242       }
13243     }
13244
13245
13246     if (chunk != NULL) {
13247       Tag LIR_tag(this, "LIR");
13248       int first_index = current->first_instruction_index();
13249       int last_index = current->last_instruction_index();
13250       if (first_index != -1 && last_index != -1) {
13251         const ZoneList<LInstruction*>* instructions = chunk->instructions();
13252         for (int i = first_index; i <= last_index; ++i) {
13253           LInstruction* linstr = instructions->at(i);
13254           if (linstr != NULL) {
13255             PrintIndent();
13256             trace_.Add("%d ",
13257                        LifetimePosition::FromInstructionIndex(i).Value());
13258             linstr->PrintTo(&trace_);
13259             std::ostringstream os;
13260             os << " [hir:" << NameOf(linstr->hydrogen_value()) << "] <|@\n";
13261             trace_.Add(os.str().c_str());
13262           }
13263         }
13264       }
13265     }
13266   }
13267 }
13268
13269
13270 void HTracer::TraceLiveRanges(const char* name, LAllocator* allocator) {
13271   Tag tag(this, "intervals");
13272   PrintStringProperty("name", name);
13273
13274   const Vector<LiveRange*>* fixed_d = allocator->fixed_double_live_ranges();
13275   for (int i = 0; i < fixed_d->length(); ++i) {
13276     TraceLiveRange(fixed_d->at(i), "fixed", allocator->zone());
13277   }
13278
13279   const Vector<LiveRange*>* fixed = allocator->fixed_live_ranges();
13280   for (int i = 0; i < fixed->length(); ++i) {
13281     TraceLiveRange(fixed->at(i), "fixed", allocator->zone());
13282   }
13283
13284   const ZoneList<LiveRange*>* live_ranges = allocator->live_ranges();
13285   for (int i = 0; i < live_ranges->length(); ++i) {
13286     TraceLiveRange(live_ranges->at(i), "object", allocator->zone());
13287   }
13288 }
13289
13290
13291 void HTracer::TraceLiveRange(LiveRange* range, const char* type,
13292                              Zone* zone) {
13293   if (range != NULL && !range->IsEmpty()) {
13294     PrintIndent();
13295     trace_.Add("%d %s", range->id(), type);
13296     if (range->HasRegisterAssigned()) {
13297       LOperand* op = range->CreateAssignedOperand(zone);
13298       int assigned_reg = op->index();
13299       if (op->IsDoubleRegister()) {
13300         trace_.Add(" \"%s\"",
13301                    DoubleRegister::AllocationIndexToString(assigned_reg));
13302       } else {
13303         DCHECK(op->IsRegister());
13304         trace_.Add(" \"%s\"", Register::AllocationIndexToString(assigned_reg));
13305       }
13306     } else if (range->IsSpilled()) {
13307       LOperand* op = range->TopLevel()->GetSpillOperand();
13308       if (op->IsDoubleStackSlot()) {
13309         trace_.Add(" \"double_stack:%d\"", op->index());
13310       } else {
13311         DCHECK(op->IsStackSlot());
13312         trace_.Add(" \"stack:%d\"", op->index());
13313       }
13314     }
13315     int parent_index = -1;
13316     if (range->IsChild()) {
13317       parent_index = range->parent()->id();
13318     } else {
13319       parent_index = range->id();
13320     }
13321     LOperand* op = range->FirstHint();
13322     int hint_index = -1;
13323     if (op != NULL && op->IsUnallocated()) {
13324       hint_index = LUnallocated::cast(op)->virtual_register();
13325     }
13326     trace_.Add(" %d %d", parent_index, hint_index);
13327     UseInterval* cur_interval = range->first_interval();
13328     while (cur_interval != NULL && range->Covers(cur_interval->start())) {
13329       trace_.Add(" [%d, %d[",
13330                  cur_interval->start().Value(),
13331                  cur_interval->end().Value());
13332       cur_interval = cur_interval->next();
13333     }
13334
13335     UsePosition* current_pos = range->first_pos();
13336     while (current_pos != NULL) {
13337       if (current_pos->RegisterIsBeneficial() || FLAG_trace_all_uses) {
13338         trace_.Add(" %d M", current_pos->pos().Value());
13339       }
13340       current_pos = current_pos->next();
13341     }
13342
13343     trace_.Add(" \"\"\n");
13344   }
13345 }
13346
13347
13348 void HTracer::FlushToFile() {
13349   AppendChars(filename_.start(), trace_.ToCString().get(), trace_.length(),
13350               false);
13351   trace_.Reset();
13352 }
13353
13354
13355 void HStatistics::Initialize(CompilationInfo* info) {
13356   if (info->shared_info().is_null()) return;
13357   source_size_ += info->shared_info()->SourceSize();
13358 }
13359
13360
13361 void HStatistics::Print() {
13362   PrintF(
13363       "\n"
13364       "----------------------------------------"
13365       "----------------------------------------\n"
13366       "--- Hydrogen timing results:\n"
13367       "----------------------------------------"
13368       "----------------------------------------\n");
13369   base::TimeDelta sum;
13370   for (int i = 0; i < times_.length(); ++i) {
13371     sum += times_[i];
13372   }
13373
13374   for (int i = 0; i < names_.length(); ++i) {
13375     PrintF("%33s", names_[i]);
13376     double ms = times_[i].InMillisecondsF();
13377     double percent = times_[i].PercentOf(sum);
13378     PrintF(" %8.3f ms / %4.1f %% ", ms, percent);
13379
13380     size_t size = sizes_[i];
13381     double size_percent = static_cast<double>(size) * 100 / total_size_;
13382     PrintF(" %9zu bytes / %4.1f %%\n", size, size_percent);
13383   }
13384
13385   PrintF(
13386       "----------------------------------------"
13387       "----------------------------------------\n");
13388   base::TimeDelta total = create_graph_ + optimize_graph_ + generate_code_;
13389   PrintF("%33s %8.3f ms / %4.1f %% \n", "Create graph",
13390          create_graph_.InMillisecondsF(), create_graph_.PercentOf(total));
13391   PrintF("%33s %8.3f ms / %4.1f %% \n", "Optimize graph",
13392          optimize_graph_.InMillisecondsF(), optimize_graph_.PercentOf(total));
13393   PrintF("%33s %8.3f ms / %4.1f %% \n", "Generate and install code",
13394          generate_code_.InMillisecondsF(), generate_code_.PercentOf(total));
13395   PrintF(
13396       "----------------------------------------"
13397       "----------------------------------------\n");
13398   PrintF("%33s %8.3f ms           %9zu bytes\n", "Total",
13399          total.InMillisecondsF(), total_size_);
13400   PrintF("%33s     (%.1f times slower than full code gen)\n", "",
13401          total.TimesOf(full_code_gen_));
13402
13403   double source_size_in_kb = static_cast<double>(source_size_) / 1024;
13404   double normalized_time =  source_size_in_kb > 0
13405       ? total.InMillisecondsF() / source_size_in_kb
13406       : 0;
13407   double normalized_size_in_kb =
13408       source_size_in_kb > 0
13409           ? static_cast<double>(total_size_) / 1024 / source_size_in_kb
13410           : 0;
13411   PrintF("%33s %8.3f ms           %7.3f kB allocated\n",
13412          "Average per kB source", normalized_time, normalized_size_in_kb);
13413 }
13414
13415
13416 void HStatistics::SaveTiming(const char* name, base::TimeDelta time,
13417                              size_t size) {
13418   total_size_ += size;
13419   for (int i = 0; i < names_.length(); ++i) {
13420     if (strcmp(names_[i], name) == 0) {
13421       times_[i] += time;
13422       sizes_[i] += size;
13423       return;
13424     }
13425   }
13426   names_.Add(name);
13427   times_.Add(time);
13428   sizes_.Add(size);
13429 }
13430
13431
13432 HPhase::~HPhase() {
13433   if (ShouldProduceTraceOutput()) {
13434     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
13435   }
13436
13437 #ifdef DEBUG
13438   graph_->Verify(false);  // No full verify.
13439 #endif
13440 }
13441
13442 }  // namespace internal
13443 }  // namespace v8