src/hydrogen.cc

   1 // Copyright 2013 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/hydrogen.h"
   6
   7 #include <sstream>
   8
   9 #include "src/v8.h"
  10
  11 #include "src/allocation-site-scopes.h"
  12 #include "src/ast-numbering.h"
  13 #include "src/full-codegen/full-codegen.h"
  14 #include "src/hydrogen-bce.h"
  15 #include "src/hydrogen-bch.h"
  16 #include "src/hydrogen-canonicalize.h"
  17 #include "src/hydrogen-check-elimination.h"
  18 #include "src/hydrogen-dce.h"
  19 #include "src/hydrogen-dehoist.h"
  20 #include "src/hydrogen-environment-liveness.h"
  21 #include "src/hydrogen-escape-analysis.h"
  22 #include "src/hydrogen-gvn.h"
  23 #include "src/hydrogen-infer-representation.h"
  24 #include "src/hydrogen-infer-types.h"
  25 #include "src/hydrogen-load-elimination.h"
  26 #include "src/hydrogen-mark-deoptimize.h"
  27 #include "src/hydrogen-mark-unreachable.h"
  28 #include "src/hydrogen-osr.h"
  29 #include "src/hydrogen-range-analysis.h"
  30 #include "src/hydrogen-redundant-phi.h"
  31 #include "src/hydrogen-removable-simulates.h"
  32 #include "src/hydrogen-representation-changes.h"
  33 #include "src/hydrogen-sce.h"
  34 #include "src/hydrogen-store-elimination.h"
  35 #include "src/hydrogen-uint32-analysis.h"
  36 #include "src/ic/call-optimization.h"
  37 #include "src/ic/ic.h"
  38 // GetRootConstructor
  39 #include "src/ic/ic-inl.h"
  40 #include "src/lithium-allocator.h"
  41 #include "src/parser.h"
  42 #include "src/runtime/runtime.h"
  43 #include "src/scopeinfo.h"
  44 #include "src/typing.h"
  45
  46 #if V8_TARGET_ARCH_IA32
  47 #include "src/ia32/lithium-codegen-ia32.h"  // NOLINT
  48 #elif V8_TARGET_ARCH_X64
  49 #include "src/x64/lithium-codegen-x64.h"  // NOLINT
  50 #elif V8_TARGET_ARCH_ARM64
  51 #include "src/arm64/lithium-codegen-arm64.h"  // NOLINT
  52 #elif V8_TARGET_ARCH_ARM
  53 #include "src/arm/lithium-codegen-arm.h"  // NOLINT
  54 #elif V8_TARGET_ARCH_PPC
  55 #include "src/ppc/lithium-codegen-ppc.h"  // NOLINT
  56 #elif V8_TARGET_ARCH_MIPS
  57 #include "src/mips/lithium-codegen-mips.h"  // NOLINT
  58 #elif V8_TARGET_ARCH_MIPS64
  59 #include "src/mips64/lithium-codegen-mips64.h"  // NOLINT
  60 #elif V8_TARGET_ARCH_X87
  61 #include "src/x87/lithium-codegen-x87.h"  // NOLINT
  62 #else
  63 #error Unsupported target architecture.
  64 #endif
  65
  66 namespace v8 {
  67 namespace internal {
  68
  69 HBasicBlock::HBasicBlock(HGraph* graph)
  70     : block_id_(graph->GetNextBlockID()),
  71       graph_(graph),
  72       phis_(4, graph->zone()),
  73       first_(NULL),
  74       last_(NULL),
  75       end_(NULL),
  76       loop_information_(NULL),
  77       predecessors_(2, graph->zone()),
  78       dominator_(NULL),
  79       dominated_blocks_(4, graph->zone()),
  80       last_environment_(NULL),
  81       argument_count_(-1),
  82       first_instruction_index_(-1),
  83       last_instruction_index_(-1),
  84       deleted_phis_(4, graph->zone()),
  85       parent_loop_header_(NULL),
  86       inlined_entry_block_(NULL),
  87       is_inline_return_target_(false),
  88       is_reachable_(true),
  89       dominates_loop_successors_(false),
  90       is_osr_entry_(false),
  91       is_ordered_(false) { }
  92
  93
  94 Isolate* HBasicBlock::isolate() const {
  95   return graph_->isolate();
  96 }
  97
  98
  99 void HBasicBlock::MarkUnreachable() {
 100   is_reachable_ = false;
 101 }
 102
 103
 104 void HBasicBlock::AttachLoopInformation() {
 105   DCHECK(!IsLoopHeader());
 106   loop_information_ = new(zone()) HLoopInformation(this, zone());
 107 }
 108
 109
 110 void HBasicBlock::DetachLoopInformation() {
 111   DCHECK(IsLoopHeader());
 112   loop_information_ = NULL;
 113 }
 114
 115
 116 void HBasicBlock::AddPhi(HPhi* phi) {
 117   DCHECK(!IsStartBlock());
 118   phis_.Add(phi, zone());
 119   phi->SetBlock(this);
 120 }
 121
 122
 123 void HBasicBlock::RemovePhi(HPhi* phi) {
 124   DCHECK(phi->block() == this);
 125   DCHECK(phis_.Contains(phi));
 126   phi->Kill();
 127   phis_.RemoveElement(phi);
 128   phi->SetBlock(NULL);
 129 }
 130
 131
 132 void HBasicBlock::AddInstruction(HInstruction* instr, SourcePosition position) {
 133   DCHECK(!IsStartBlock() || !IsFinished());
 134   DCHECK(!instr->IsLinked());
 135   DCHECK(!IsFinished());
 136
 137   if (!position.IsUnknown()) {
 138     instr->set_position(position);
 139   }
 140   if (first_ == NULL) {
 141     DCHECK(last_environment() != NULL);
 142     DCHECK(!last_environment()->ast_id().IsNone());
 143     HBlockEntry* entry = new(zone()) HBlockEntry();
 144     entry->InitializeAsFirst(this);
 145     if (!position.IsUnknown()) {
 146       entry->set_position(position);
 147     } else {
 148       DCHECK(!FLAG_hydrogen_track_positions ||
 149              !graph()->info()->IsOptimizing() || instr->IsAbnormalExit());
 150     }
 151     first_ = last_ = entry;
 152   }
 153   instr->InsertAfter(last_);
 154 }
 155
 156
 157 HPhi* HBasicBlock::AddNewPhi(int merged_index) {
 158   if (graph()->IsInsideNoSideEffectsScope()) {
 159     merged_index = HPhi::kInvalidMergedIndex;
 160   }
 161   HPhi* phi = new(zone()) HPhi(merged_index, zone());
 162   AddPhi(phi);
 163   return phi;
 164 }
 165
 166
 167 HSimulate* HBasicBlock::CreateSimulate(BailoutId ast_id,
 168                                        RemovableSimulate removable) {
 169   DCHECK(HasEnvironment());
 170   HEnvironment* environment = last_environment();
 171   DCHECK(ast_id.IsNone() ||
 172          ast_id == BailoutId::StubEntry() ||
 173          environment->closure()->shared()->VerifyBailoutId(ast_id));
 174
 175   int push_count = environment->push_count();
 176   int pop_count = environment->pop_count();
 177
 178   HSimulate* instr =
 179       new(zone()) HSimulate(ast_id, pop_count, zone(), removable);
 180 #ifdef DEBUG
 181   instr->set_closure(environment->closure());
 182 #endif
 183   // Order of pushed values: newest (top of stack) first. This allows
 184   // HSimulate::MergeWith() to easily append additional pushed values
 185   // that are older (from further down the stack).
 186   for (int i = 0; i < push_count; ++i) {
 187     instr->AddPushedValue(environment->ExpressionStackAt(i));
 188   }
 189   for (GrowableBitVector::Iterator it(environment->assigned_variables(),
 190                                       zone());
 191        !it.Done();
 192        it.Advance()) {
 193     int index = it.Current();
 194     instr->AddAssignedValue(index, environment->Lookup(index));
 195   }
 196   environment->ClearHistory();
 197   return instr;
 198 }
 199
 200
 201 void HBasicBlock::Finish(HControlInstruction* end, SourcePosition position) {
 202   DCHECK(!IsFinished());
 203   AddInstruction(end, position);
 204   end_ = end;
 205   for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 206     it.Current()->RegisterPredecessor(this);
 207   }
 208 }
 209
 210
 211 void HBasicBlock::Goto(HBasicBlock* block, SourcePosition position,
 212                        FunctionState* state, bool add_simulate) {
 213   bool drop_extra = state != NULL &&
 214       state->inlining_kind() == NORMAL_RETURN;
 215
 216   if (block->IsInlineReturnTarget()) {
 217     HEnvironment* env = last_environment();
 218     int argument_count = env->arguments_environment()->parameter_count();
 219     AddInstruction(new(zone())
 220                    HLeaveInlined(state->entry(), argument_count),
 221                    position);
 222     UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 223   }
 224
 225   if (add_simulate) AddNewSimulate(BailoutId::None(), position);
 226   HGoto* instr = new(zone()) HGoto(block);
 227   Finish(instr, position);
 228 }
 229
 230
 231 void HBasicBlock::AddLeaveInlined(HValue* return_value, FunctionState* state,
 232                                   SourcePosition position) {
 233   HBasicBlock* target = state->function_return();
 234   bool drop_extra = state->inlining_kind() == NORMAL_RETURN;
 235
 236   DCHECK(target->IsInlineReturnTarget());
 237   DCHECK(return_value != NULL);
 238   HEnvironment* env = last_environment();
 239   int argument_count = env->arguments_environment()->parameter_count();
 240   AddInstruction(new(zone()) HLeaveInlined(state->entry(), argument_count),
 241                  position);
 242   UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 243   last_environment()->Push(return_value);
 244   AddNewSimulate(BailoutId::None(), position);
 245   HGoto* instr = new(zone()) HGoto(target);
 246   Finish(instr, position);
 247 }
 248
 249
 250 void HBasicBlock::SetInitialEnvironment(HEnvironment* env) {
 251   DCHECK(!HasEnvironment());
 252   DCHECK(first() == NULL);
 253   UpdateEnvironment(env);
 254 }
 255
 256
 257 void HBasicBlock::UpdateEnvironment(HEnvironment* env) {
 258   last_environment_ = env;
 259   graph()->update_maximum_environment_size(env->first_expression_index());
 260 }
 261
 262
 263 void HBasicBlock::SetJoinId(BailoutId ast_id) {
 264   int length = predecessors_.length();
 265   DCHECK(length > 0);
 266   for (int i = 0; i < length; i++) {
 267     HBasicBlock* predecessor = predecessors_[i];
 268     DCHECK(predecessor->end()->IsGoto());
 269     HSimulate* simulate = HSimulate::cast(predecessor->end()->previous());
 270     DCHECK(i != 0 ||
 271            (predecessor->last_environment()->closure().is_null() ||
 272             predecessor->last_environment()->closure()->shared()
 273               ->VerifyBailoutId(ast_id)));
 274     simulate->set_ast_id(ast_id);
 275     predecessor->last_environment()->set_ast_id(ast_id);
 276   }
 277 }
 278
 279
 280 bool HBasicBlock::Dominates(HBasicBlock* other) const {
 281   HBasicBlock* current = other->dominator();
 282   while (current != NULL) {
 283     if (current == this) return true;
 284     current = current->dominator();
 285   }
 286   return false;
 287 }
 288
 289
 290 bool HBasicBlock::EqualToOrDominates(HBasicBlock* other) const {
 291   if (this == other) return true;
 292   return Dominates(other);
 293 }
 294
 295
 296 int HBasicBlock::LoopNestingDepth() const {
 297   const HBasicBlock* current = this;
 298   int result  = (current->IsLoopHeader()) ? 1 : 0;
 299   while (current->parent_loop_header() != NULL) {
 300     current = current->parent_loop_header();
 301     result++;
 302   }
 303   return result;
 304 }
 305
 306
 307 void HBasicBlock::PostProcessLoopHeader(IterationStatement* stmt) {
 308   DCHECK(IsLoopHeader());
 309
 310   SetJoinId(stmt->EntryId());
 311   if (predecessors()->length() == 1) {
 312     // This is a degenerated loop.
 313     DetachLoopInformation();
 314     return;
 315   }
 316
 317   // Only the first entry into the loop is from outside the loop. All other
 318   // entries must be back edges.
 319   for (int i = 1; i < predecessors()->length(); ++i) {
 320     loop_information()->RegisterBackEdge(predecessors()->at(i));
 321   }
 322 }
 323
 324
 325 void HBasicBlock::MarkSuccEdgeUnreachable(int succ) {
 326   DCHECK(IsFinished());
 327   HBasicBlock* succ_block = end()->SuccessorAt(succ);
 328
 329   DCHECK(succ_block->predecessors()->length() == 1);
 330   succ_block->MarkUnreachable();
 331 }
 332
 333
 334 void HBasicBlock::RegisterPredecessor(HBasicBlock* pred) {
 335   if (HasPredecessor()) {
 336     // Only loop header blocks can have a predecessor added after
 337     // instructions have been added to the block (they have phis for all
 338     // values in the environment, these phis may be eliminated later).
 339     DCHECK(IsLoopHeader() || first_ == NULL);
 340     HEnvironment* incoming_env = pred->last_environment();
 341     if (IsLoopHeader()) {
 342       DCHECK_EQ(phis()->length(), incoming_env->length());
 343       for (int i = 0; i < phis_.length(); ++i) {
 344         phis_[i]->AddInput(incoming_env->values()->at(i));
 345       }
 346     } else {
 347       last_environment()->AddIncomingEdge(this, pred->last_environment());
 348     }
 349   } else if (!HasEnvironment() && !IsFinished()) {
 350     DCHECK(!IsLoopHeader());
 351     SetInitialEnvironment(pred->last_environment()->Copy());
 352   }
 353
 354   predecessors_.Add(pred, zone());
 355 }
 356
 357
 358 void HBasicBlock::AddDominatedBlock(HBasicBlock* block) {
 359   DCHECK(!dominated_blocks_.Contains(block));
 360   // Keep the list of dominated blocks sorted such that if there is two
 361   // succeeding block in this list, the predecessor is before the successor.
 362   int index = 0;
 363   while (index < dominated_blocks_.length() &&
 364          dominated_blocks_[index]->block_id() < block->block_id()) {
 365     ++index;
 366   }
 367   dominated_blocks_.InsertAt(index, block, zone());
 368 }
 369
 370
 371 void HBasicBlock::AssignCommonDominator(HBasicBlock* other) {
 372   if (dominator_ == NULL) {
 373     dominator_ = other;
 374     other->AddDominatedBlock(this);
 375   } else if (other->dominator() != NULL) {
 376     HBasicBlock* first = dominator_;
 377     HBasicBlock* second = other;
 378
 379     while (first != second) {
 380       if (first->block_id() > second->block_id()) {
 381         first = first->dominator();
 382       } else {
 383         second = second->dominator();
 384       }
 385       DCHECK(first != NULL && second != NULL);
 386     }
 387
 388     if (dominator_ != first) {
 389       DCHECK(dominator_->dominated_blocks_.Contains(this));
 390       dominator_->dominated_blocks_.RemoveElement(this);
 391       dominator_ = first;
 392       first->AddDominatedBlock(this);
 393     }
 394   }
 395 }
 396
 397
 398 void HBasicBlock::AssignLoopSuccessorDominators() {
 399   // Mark blocks that dominate all subsequent reachable blocks inside their
 400   // loop. Exploit the fact that blocks are sorted in reverse post order. When
 401   // the loop is visited in increasing block id order, if the number of
 402   // non-loop-exiting successor edges at the dominator_candidate block doesn't
 403   // exceed the number of previously encountered predecessor edges, there is no
 404   // path from the loop header to any block with higher id that doesn't go
 405   // through the dominator_candidate block. In this case, the
 406   // dominator_candidate block is guaranteed to dominate all blocks reachable
 407   // from it with higher ids.
 408   HBasicBlock* last = loop_information()->GetLastBackEdge();
 409   int outstanding_successors = 1;  // one edge from the pre-header
 410   // Header always dominates everything.
 411   MarkAsLoopSuccessorDominator();
 412   for (int j = block_id(); j <= last->block_id(); ++j) {
 413     HBasicBlock* dominator_candidate = graph_->blocks()->at(j);
 414     for (HPredecessorIterator it(dominator_candidate); !it.Done();
 415          it.Advance()) {
 416       HBasicBlock* predecessor = it.Current();
 417       // Don't count back edges.
 418       if (predecessor->block_id() < dominator_candidate->block_id()) {
 419         outstanding_successors--;
 420       }
 421     }
 422
 423     // If more successors than predecessors have been seen in the loop up to
 424     // now, it's not possible to guarantee that the current block dominates
 425     // all of the blocks with higher IDs. In this case, assume conservatively
 426     // that those paths through loop that don't go through the current block
 427     // contain all of the loop's dependencies. Also be careful to record
 428     // dominator information about the current loop that's being processed,
 429     // and not nested loops, which will be processed when
 430     // AssignLoopSuccessorDominators gets called on their header.
 431     DCHECK(outstanding_successors >= 0);
 432     HBasicBlock* parent_loop_header = dominator_candidate->parent_loop_header();
 433     if (outstanding_successors == 0 &&
 434         (parent_loop_header == this && !dominator_candidate->IsLoopHeader())) {
 435       dominator_candidate->MarkAsLoopSuccessorDominator();
 436     }
 437     HControlInstruction* end = dominator_candidate->end();
 438     for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 439       HBasicBlock* successor = it.Current();
 440       // Only count successors that remain inside the loop and don't loop back
 441       // to a loop header.
 442       if (successor->block_id() > dominator_candidate->block_id() &&
 443           successor->block_id() <= last->block_id()) {
 444         // Backwards edges must land on loop headers.
 445         DCHECK(successor->block_id() > dominator_candidate->block_id() ||
 446                successor->IsLoopHeader());
 447         outstanding_successors++;
 448       }
 449     }
 450   }
 451 }
 452
 453
 454 int HBasicBlock::PredecessorIndexOf(HBasicBlock* predecessor) const {
 455   for (int i = 0; i < predecessors_.length(); ++i) {
 456     if (predecessors_[i] == predecessor) return i;
 457   }
 458   UNREACHABLE();
 459   return -1;
 460 }
 461
 462
 463 #ifdef DEBUG
 464 void HBasicBlock::Verify() {
 465   // Check that every block is finished.
 466   DCHECK(IsFinished());
 467   DCHECK(block_id() >= 0);
 468
 469   // Check that the incoming edges are in edge split form.
 470   if (predecessors_.length() > 1) {
 471     for (int i = 0; i < predecessors_.length(); ++i) {
 472       DCHECK(predecessors_[i]->end()->SecondSuccessor() == NULL);
 473     }
 474   }
 475 }
 476 #endif
 477
 478
 479 void HLoopInformation::RegisterBackEdge(HBasicBlock* block) {
 480   this->back_edges_.Add(block, block->zone());
 481   AddBlock(block);
 482 }
 483
 484
 485 HBasicBlock* HLoopInformation::GetLastBackEdge() const {
 486   int max_id = -1;
 487   HBasicBlock* result = NULL;
 488   for (int i = 0; i < back_edges_.length(); ++i) {
 489     HBasicBlock* cur = back_edges_[i];
 490     if (cur->block_id() > max_id) {
 491       max_id = cur->block_id();
 492       result = cur;
 493     }
 494   }
 495   return result;
 496 }
 497
 498
 499 void HLoopInformation::AddBlock(HBasicBlock* block) {
 500   if (block == loop_header()) return;
 501   if (block->parent_loop_header() == loop_header()) return;
 502   if (block->parent_loop_header() != NULL) {
 503     AddBlock(block->parent_loop_header());
 504   } else {
 505     block->set_parent_loop_header(loop_header());
 506     blocks_.Add(block, block->zone());
 507     for (int i = 0; i < block->predecessors()->length(); ++i) {
 508       AddBlock(block->predecessors()->at(i));
 509     }
 510   }
 511 }
 512
 513
 514 #ifdef DEBUG
 515
 516 // Checks reachability of the blocks in this graph and stores a bit in
 517 // the BitVector "reachable()" for every block that can be reached
 518 // from the start block of the graph. If "dont_visit" is non-null, the given
 519 // block is treated as if it would not be part of the graph. "visited_count()"
 520 // returns the number of reachable blocks.
 521 class ReachabilityAnalyzer BASE_EMBEDDED {
 522  public:
 523   ReachabilityAnalyzer(HBasicBlock* entry_block,
 524                        int block_count,
 525                        HBasicBlock* dont_visit)
 526       : visited_count_(0),
 527         stack_(16, entry_block->zone()),
 528         reachable_(block_count, entry_block->zone()),
 529         dont_visit_(dont_visit) {
 530     PushBlock(entry_block);
 531     Analyze();
 532   }
 533
 534   int visited_count() const { return visited_count_; }
 535   const BitVector* reachable() const { return &reachable_; }
 536
 537  private:
 538   void PushBlock(HBasicBlock* block) {
 539     if (block != NULL && block != dont_visit_ &&
 540         !reachable_.Contains(block->block_id())) {
 541       reachable_.Add(block->block_id());
 542       stack_.Add(block, block->zone());
 543       visited_count_++;
 544     }
 545   }
 546
 547   void Analyze() {
 548     while (!stack_.is_empty()) {
 549       HControlInstruction* end = stack_.RemoveLast()->end();
 550       for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 551         PushBlock(it.Current());
 552       }
 553     }
 554   }
 555
 556   int visited_count_;
 557   ZoneList<HBasicBlock*> stack_;
 558   BitVector reachable_;
 559   HBasicBlock* dont_visit_;
 560 };
 561
 562
 563 void HGraph::Verify(bool do_full_verify) const {
 564   Heap::RelocationLock relocation_lock(isolate()->heap());
 565   AllowHandleDereference allow_deref;
 566   AllowDeferredHandleDereference allow_deferred_deref;
 567   for (int i = 0; i < blocks_.length(); i++) {
 568     HBasicBlock* block = blocks_.at(i);
 569
 570     block->Verify();
 571
 572     // Check that every block contains at least one node and that only the last
 573     // node is a control instruction.
 574     HInstruction* current = block->first();
 575     DCHECK(current != NULL && current->IsBlockEntry());
 576     while (current != NULL) {
 577       DCHECK((current->next() == NULL) == current->IsControlInstruction());
 578       DCHECK(current->block() == block);
 579       current->Verify();
 580       current = current->next();
 581     }
 582
 583     // Check that successors are correctly set.
 584     HBasicBlock* first = block->end()->FirstSuccessor();
 585     HBasicBlock* second = block->end()->SecondSuccessor();
 586     DCHECK(second == NULL || first != NULL);
 587
 588     // Check that the predecessor array is correct.
 589     if (first != NULL) {
 590       DCHECK(first->predecessors()->Contains(block));
 591       if (second != NULL) {
 592         DCHECK(second->predecessors()->Contains(block));
 593       }
 594     }
 595
 596     // Check that phis have correct arguments.
 597     for (int j = 0; j < block->phis()->length(); j++) {
 598       HPhi* phi = block->phis()->at(j);
 599       phi->Verify();
 600     }
 601
 602     // Check that all join blocks have predecessors that end with an
 603     // unconditional goto and agree on their environment node id.
 604     if (block->predecessors()->length() >= 2) {
 605       BailoutId id =
 606           block->predecessors()->first()->last_environment()->ast_id();
 607       for (int k = 0; k < block->predecessors()->length(); k++) {
 608         HBasicBlock* predecessor = block->predecessors()->at(k);
 609         DCHECK(predecessor->end()->IsGoto() ||
 610                predecessor->end()->IsDeoptimize());
 611         DCHECK(predecessor->last_environment()->ast_id() == id);
 612       }
 613     }
 614   }
 615
 616   // Check special property of first block to have no predecessors.
 617   DCHECK(blocks_.at(0)->predecessors()->is_empty());
 618
 619   if (do_full_verify) {
 620     // Check that the graph is fully connected.
 621     ReachabilityAnalyzer analyzer(entry_block_, blocks_.length(), NULL);
 622     DCHECK(analyzer.visited_count() == blocks_.length());
 623
 624     // Check that entry block dominator is NULL.
 625     DCHECK(entry_block_->dominator() == NULL);
 626
 627     // Check dominators.
 628     for (int i = 0; i < blocks_.length(); ++i) {
 629       HBasicBlock* block = blocks_.at(i);
 630       if (block->dominator() == NULL) {
 631         // Only start block may have no dominator assigned to.
 632         DCHECK(i == 0);
 633       } else {
 634         // Assert that block is unreachable if dominator must not be visited.
 635         ReachabilityAnalyzer dominator_analyzer(entry_block_,
 636                                                 blocks_.length(),
 637                                                 block->dominator());
 638         DCHECK(!dominator_analyzer.reachable()->Contains(block->block_id()));
 639       }
 640     }
 641   }
 642 }
 643
 644 #endif
 645
 646
 647 HConstant* HGraph::GetConstant(SetOncePointer<HConstant>* pointer,
 648                                int32_t value) {
 649   if (!pointer->is_set()) {
 650     // Can't pass GetInvalidContext() to HConstant::New, because that will
 651     // recursively call GetConstant
 652     HConstant* constant = HConstant::New(isolate(), zone(), NULL, value);
 653     constant->InsertAfter(entry_block()->first());
 654     pointer->set(constant);
 655     return constant;
 656   }
 657   return ReinsertConstantIfNecessary(pointer->get());
 658 }
 659
 660
 661 HConstant* HGraph::ReinsertConstantIfNecessary(HConstant* constant) {
 662   if (!constant->IsLinked()) {
 663     // The constant was removed from the graph. Reinsert.
 664     constant->ClearFlag(HValue::kIsDead);
 665     constant->InsertAfter(entry_block()->first());
 666   }
 667   return constant;
 668 }
 669
 670
 671 HConstant* HGraph::GetConstant0() {
 672   return GetConstant(&constant_0_, 0);
 673 }
 674
 675
 676 HConstant* HGraph::GetConstant1() {
 677   return GetConstant(&constant_1_, 1);
 678 }
 679
 680
 681 HConstant* HGraph::GetConstantMinus1() {
 682   return GetConstant(&constant_minus1_, -1);
 683 }
 684
 685
 686 HConstant* HGraph::GetConstantBool(bool value) {
 687   return value ? GetConstantTrue() : GetConstantFalse();
 688 }
 689
 690
 691 #define DEFINE_GET_CONSTANT(Name, name, type, htype, boolean_value)            \
 692 HConstant* HGraph::GetConstant##Name() {                                       \
 693   if (!constant_##name##_.is_set()) {                                          \
 694     HConstant* constant = new(zone()) HConstant(                               \
 695         Unique<Object>::CreateImmovable(isolate()->factory()->name##_value()), \
 696         Unique<Map>::CreateImmovable(isolate()->factory()->type##_map()),      \
 697         false,                                                                 \
 698         Representation::Tagged(),                                              \
 699         htype,                                                                 \
 700         true,                                                                  \
 701         boolean_value,                                                         \
 702         false,                                                                 \
 703         ODDBALL_TYPE);                                                         \
 704     constant->InsertAfter(entry_block()->first());                             \
 705     constant_##name##_.set(constant);                                          \
 706   }                                                                            \
 707   return ReinsertConstantIfNecessary(constant_##name##_.get());                \
 708 }
 709
 710
 711 DEFINE_GET_CONSTANT(Undefined, undefined, undefined, HType::Undefined(), false)
 712 DEFINE_GET_CONSTANT(True, true, boolean, HType::Boolean(), true)
 713 DEFINE_GET_CONSTANT(False, false, boolean, HType::Boolean(), false)
 714 DEFINE_GET_CONSTANT(Hole, the_hole, the_hole, HType::None(), false)
 715 DEFINE_GET_CONSTANT(Null, null, null, HType::Null(), false)
 716
 717
 718 #undef DEFINE_GET_CONSTANT
 719
 720 #define DEFINE_IS_CONSTANT(Name, name)                                         \
 721 bool HGraph::IsConstant##Name(HConstant* constant) {                           \
 722   return constant_##name##_.is_set() && constant == constant_##name##_.get();  \
 723 }
 724 DEFINE_IS_CONSTANT(Undefined, undefined)
 725 DEFINE_IS_CONSTANT(0, 0)
 726 DEFINE_IS_CONSTANT(1, 1)
 727 DEFINE_IS_CONSTANT(Minus1, minus1)
 728 DEFINE_IS_CONSTANT(True, true)
 729 DEFINE_IS_CONSTANT(False, false)
 730 DEFINE_IS_CONSTANT(Hole, the_hole)
 731 DEFINE_IS_CONSTANT(Null, null)
 732
 733 #undef DEFINE_IS_CONSTANT
 734
 735
 736 HConstant* HGraph::GetInvalidContext() {
 737   return GetConstant(&constant_invalid_context_, 0xFFFFC0C7);
 738 }
 739
 740
 741 bool HGraph::IsStandardConstant(HConstant* constant) {
 742   if (IsConstantUndefined(constant)) return true;
 743   if (IsConstant0(constant)) return true;
 744   if (IsConstant1(constant)) return true;
 745   if (IsConstantMinus1(constant)) return true;
 746   if (IsConstantTrue(constant)) return true;
 747   if (IsConstantFalse(constant)) return true;
 748   if (IsConstantHole(constant)) return true;
 749   if (IsConstantNull(constant)) return true;
 750   return false;
 751 }
 752
 753
 754 HGraphBuilder::IfBuilder::IfBuilder() : builder_(NULL), needs_compare_(true) {}
 755
 756
 757 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder)
 758     : needs_compare_(true) {
 759   Initialize(builder);
 760 }
 761
 762
 763 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder,
 764                                     HIfContinuation* continuation)
 765     : needs_compare_(false), first_true_block_(NULL), first_false_block_(NULL) {
 766   InitializeDontCreateBlocks(builder);
 767   continuation->Continue(&first_true_block_, &first_false_block_);
 768 }
 769
 770
 771 void HGraphBuilder::IfBuilder::InitializeDontCreateBlocks(
 772     HGraphBuilder* builder) {
 773   builder_ = builder;
 774   finished_ = false;
 775   did_then_ = false;
 776   did_else_ = false;
 777   did_else_if_ = false;
 778   did_and_ = false;
 779   did_or_ = false;
 780   captured_ = false;
 781   pending_merge_block_ = false;
 782   split_edge_merge_block_ = NULL;
 783   merge_at_join_blocks_ = NULL;
 784   normal_merge_at_join_block_count_ = 0;
 785   deopt_merge_at_join_block_count_ = 0;
 786 }
 787
 788
 789 void HGraphBuilder::IfBuilder::Initialize(HGraphBuilder* builder) {
 790   InitializeDontCreateBlocks(builder);
 791   HEnvironment* env = builder->environment();
 792   first_true_block_ = builder->CreateBasicBlock(env->Copy());
 793   first_false_block_ = builder->CreateBasicBlock(env->Copy());
 794 }
 795
 796
 797 HControlInstruction* HGraphBuilder::IfBuilder::AddCompare(
 798     HControlInstruction* compare) {
 799   DCHECK(did_then_ == did_else_);
 800   if (did_else_) {
 801     // Handle if-then-elseif
 802     did_else_if_ = true;
 803     did_else_ = false;
 804     did_then_ = false;
 805     did_and_ = false;
 806     did_or_ = false;
 807     pending_merge_block_ = false;
 808     split_edge_merge_block_ = NULL;
 809     HEnvironment* env = builder()->environment();
 810     first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 811     first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 812   }
 813   if (split_edge_merge_block_ != NULL) {
 814     HEnvironment* env = first_false_block_->last_environment();
 815     HBasicBlock* split_edge = builder()->CreateBasicBlock(env->Copy());
 816     if (did_or_) {
 817       compare->SetSuccessorAt(0, split_edge);
 818       compare->SetSuccessorAt(1, first_false_block_);
 819     } else {
 820       compare->SetSuccessorAt(0, first_true_block_);
 821       compare->SetSuccessorAt(1, split_edge);
 822     }
 823     builder()->GotoNoSimulate(split_edge, split_edge_merge_block_);
 824   } else {
 825     compare->SetSuccessorAt(0, first_true_block_);
 826     compare->SetSuccessorAt(1, first_false_block_);
 827   }
 828   builder()->FinishCurrentBlock(compare);
 829   needs_compare_ = false;
 830   return compare;
 831 }
 832
 833
 834 void HGraphBuilder::IfBuilder::Or() {
 835   DCHECK(!needs_compare_);
 836   DCHECK(!did_and_);
 837   did_or_ = true;
 838   HEnvironment* env = first_false_block_->last_environment();
 839   if (split_edge_merge_block_ == NULL) {
 840     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 841     builder()->GotoNoSimulate(first_true_block_, split_edge_merge_block_);
 842     first_true_block_ = split_edge_merge_block_;
 843   }
 844   builder()->set_current_block(first_false_block_);
 845   first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 846 }
 847
 848
 849 void HGraphBuilder::IfBuilder::And() {
 850   DCHECK(!needs_compare_);
 851   DCHECK(!did_or_);
 852   did_and_ = true;
 853   HEnvironment* env = first_false_block_->last_environment();
 854   if (split_edge_merge_block_ == NULL) {
 855     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 856     builder()->GotoNoSimulate(first_false_block_, split_edge_merge_block_);
 857     first_false_block_ = split_edge_merge_block_;
 858   }
 859   builder()->set_current_block(first_true_block_);
 860   first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 861 }
 862
 863
 864 void HGraphBuilder::IfBuilder::CaptureContinuation(
 865     HIfContinuation* continuation) {
 866   DCHECK(!did_else_if_);
 867   DCHECK(!finished_);
 868   DCHECK(!captured_);
 869
 870   HBasicBlock* true_block = NULL;
 871   HBasicBlock* false_block = NULL;
 872   Finish(&true_block, &false_block);
 873   DCHECK(true_block != NULL);
 874   DCHECK(false_block != NULL);
 875   continuation->Capture(true_block, false_block);
 876   captured_ = true;
 877   builder()->set_current_block(NULL);
 878   End();
 879 }
 880
 881
 882 void HGraphBuilder::IfBuilder::JoinContinuation(HIfContinuation* continuation) {
 883   DCHECK(!did_else_if_);
 884   DCHECK(!finished_);
 885   DCHECK(!captured_);
 886   HBasicBlock* true_block = NULL;
 887   HBasicBlock* false_block = NULL;
 888   Finish(&true_block, &false_block);
 889   merge_at_join_blocks_ = NULL;
 890   if (true_block != NULL && !true_block->IsFinished()) {
 891     DCHECK(continuation->IsTrueReachable());
 892     builder()->GotoNoSimulate(true_block, continuation->true_branch());
 893   }
 894   if (false_block != NULL && !false_block->IsFinished()) {
 895     DCHECK(continuation->IsFalseReachable());
 896     builder()->GotoNoSimulate(false_block, continuation->false_branch());
 897   }
 898   captured_ = true;
 899   End();
 900 }
 901
 902
 903 void HGraphBuilder::IfBuilder::Then() {
 904   DCHECK(!captured_);
 905   DCHECK(!finished_);
 906   did_then_ = true;
 907   if (needs_compare_) {
 908     // Handle if's without any expressions, they jump directly to the "else"
 909     // branch. However, we must pretend that the "then" branch is reachable,
 910     // so that the graph builder visits it and sees any live range extending
 911     // constructs within it.
 912     HConstant* constant_false = builder()->graph()->GetConstantFalse();
 913     ToBooleanStub::Types boolean_type = ToBooleanStub::Types();
 914     boolean_type.Add(ToBooleanStub::BOOLEAN);
 915     HBranch* branch = builder()->New<HBranch>(
 916         constant_false, boolean_type, first_true_block_, first_false_block_);
 917     builder()->FinishCurrentBlock(branch);
 918   }
 919   builder()->set_current_block(first_true_block_);
 920   pending_merge_block_ = true;
 921 }
 922
 923
 924 void HGraphBuilder::IfBuilder::Else() {
 925   DCHECK(did_then_);
 926   DCHECK(!captured_);
 927   DCHECK(!finished_);
 928   AddMergeAtJoinBlock(false);
 929   builder()->set_current_block(first_false_block_);
 930   pending_merge_block_ = true;
 931   did_else_ = true;
 932 }
 933
 934
 935 void HGraphBuilder::IfBuilder::Deopt(Deoptimizer::DeoptReason reason) {
 936   DCHECK(did_then_);
 937   builder()->Add<HDeoptimize>(reason, Deoptimizer::EAGER);
 938   AddMergeAtJoinBlock(true);
 939 }
 940
 941
 942 void HGraphBuilder::IfBuilder::Return(HValue* value) {
 943   HValue* parameter_count = builder()->graph()->GetConstantMinus1();
 944   builder()->FinishExitCurrentBlock(
 945       builder()->New<HReturn>(value, parameter_count));
 946   AddMergeAtJoinBlock(false);
 947 }
 948
 949
 950 void HGraphBuilder::IfBuilder::AddMergeAtJoinBlock(bool deopt) {
 951   if (!pending_merge_block_) return;
 952   HBasicBlock* block = builder()->current_block();
 953   DCHECK(block == NULL || !block->IsFinished());
 954   MergeAtJoinBlock* record = new (builder()->zone())
 955       MergeAtJoinBlock(block, deopt, merge_at_join_blocks_);
 956   merge_at_join_blocks_ = record;
 957   if (block != NULL) {
 958     DCHECK(block->end() == NULL);
 959     if (deopt) {
 960       normal_merge_at_join_block_count_++;
 961     } else {
 962       deopt_merge_at_join_block_count_++;
 963     }
 964   }
 965   builder()->set_current_block(NULL);
 966   pending_merge_block_ = false;
 967 }
 968
 969
 970 void HGraphBuilder::IfBuilder::Finish() {
 971   DCHECK(!finished_);
 972   if (!did_then_) {
 973     Then();
 974   }
 975   AddMergeAtJoinBlock(false);
 976   if (!did_else_) {
 977     Else();
 978     AddMergeAtJoinBlock(false);
 979   }
 980   finished_ = true;
 981 }
 982
 983
 984 void HGraphBuilder::IfBuilder::Finish(HBasicBlock** then_continuation,
 985                                       HBasicBlock** else_continuation) {
 986   Finish();
 987
 988   MergeAtJoinBlock* else_record = merge_at_join_blocks_;
 989   if (else_continuation != NULL) {
 990     *else_continuation = else_record->block_;
 991   }
 992   MergeAtJoinBlock* then_record = else_record->next_;
 993   if (then_continuation != NULL) {
 994     *then_continuation = then_record->block_;
 995   }
 996   DCHECK(then_record->next_ == NULL);
 997 }
 998
 999
1000 void HGraphBuilder::IfBuilder::EndUnreachable() {
1001   if (captured_) return;
1002   Finish();
1003   builder()->set_current_block(nullptr);
1004 }
1005
1006
1007 void HGraphBuilder::IfBuilder::End() {
1008   if (captured_) return;
1009   Finish();
1010
1011   int total_merged_blocks = normal_merge_at_join_block_count_ +
1012     deopt_merge_at_join_block_count_;
1013   DCHECK(total_merged_blocks >= 1);
1014   HBasicBlock* merge_block =
1015       total_merged_blocks == 1 ? NULL : builder()->graph()->CreateBasicBlock();
1016
1017   // Merge non-deopt blocks first to ensure environment has right size for
1018   // padding.
1019   MergeAtJoinBlock* current = merge_at_join_blocks_;
1020   while (current != NULL) {
1021     if (!current->deopt_ && current->block_ != NULL) {
1022       // If there is only one block that makes it through to the end of the
1023       // if, then just set it as the current block and continue rather then
1024       // creating an unnecessary merge block.
1025       if (total_merged_blocks == 1) {
1026         builder()->set_current_block(current->block_);
1027         return;
1028       }
1029       builder()->GotoNoSimulate(current->block_, merge_block);
1030     }
1031     current = current->next_;
1032   }
1033
1034   // Merge deopt blocks, padding when necessary.
1035   current = merge_at_join_blocks_;
1036   while (current != NULL) {
1037     if (current->deopt_ && current->block_ != NULL) {
1038       current->block_->FinishExit(
1039           HAbnormalExit::New(builder()->isolate(), builder()->zone(), NULL),
1040           SourcePosition::Unknown());
1041     }
1042     current = current->next_;
1043   }
1044   builder()->set_current_block(merge_block);
1045 }
1046
1047
1048 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder) {
1049   Initialize(builder, NULL, kWhileTrue, NULL);
1050 }
1051
1052
1053 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1054                                         LoopBuilder::Direction direction) {
1055   Initialize(builder, context, direction, builder->graph()->GetConstant1());
1056 }
1057
1058
1059 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1060                                         LoopBuilder::Direction direction,
1061                                         HValue* increment_amount) {
1062   Initialize(builder, context, direction, increment_amount);
1063   increment_amount_ = increment_amount;
1064 }
1065
1066
1067 void HGraphBuilder::LoopBuilder::Initialize(HGraphBuilder* builder,
1068                                             HValue* context,
1069                                             Direction direction,
1070                                             HValue* increment_amount) {
1071   builder_ = builder;
1072   context_ = context;
1073   direction_ = direction;
1074   increment_amount_ = increment_amount;
1075
1076   finished_ = false;
1077   header_block_ = builder->CreateLoopHeaderBlock();
1078   body_block_ = NULL;
1079   exit_block_ = NULL;
1080   exit_trampoline_block_ = NULL;
1081 }
1082
1083
1084 HValue* HGraphBuilder::LoopBuilder::BeginBody(
1085     HValue* initial,
1086     HValue* terminating,
1087     Token::Value token) {
1088   DCHECK(direction_ != kWhileTrue);
1089   HEnvironment* env = builder_->environment();
1090   phi_ = header_block_->AddNewPhi(env->values()->length());
1091   phi_->AddInput(initial);
1092   env->Push(initial);
1093   builder_->GotoNoSimulate(header_block_);
1094
1095   HEnvironment* body_env = env->Copy();
1096   HEnvironment* exit_env = env->Copy();
1097   // Remove the phi from the expression stack
1098   body_env->Pop();
1099   exit_env->Pop();
1100   body_block_ = builder_->CreateBasicBlock(body_env);
1101   exit_block_ = builder_->CreateBasicBlock(exit_env);
1102
1103   builder_->set_current_block(header_block_);
1104   env->Pop();
1105   builder_->FinishCurrentBlock(builder_->New<HCompareNumericAndBranch>(
1106           phi_, terminating, token, body_block_, exit_block_));
1107
1108   builder_->set_current_block(body_block_);
1109   if (direction_ == kPreIncrement || direction_ == kPreDecrement) {
1110     Isolate* isolate = builder_->isolate();
1111     HValue* one = builder_->graph()->GetConstant1();
1112     if (direction_ == kPreIncrement) {
1113       increment_ = HAdd::New(isolate, zone(), context_, phi_, one);
1114     } else {
1115       increment_ = HSub::New(isolate, zone(), context_, phi_, one);
1116     }
1117     increment_->ClearFlag(HValue::kCanOverflow);
1118     builder_->AddInstruction(increment_);
1119     return increment_;
1120   } else {
1121     return phi_;
1122   }
1123 }
1124
1125
1126 void HGraphBuilder::LoopBuilder::BeginBody(int drop_count) {
1127   DCHECK(direction_ == kWhileTrue);
1128   HEnvironment* env = builder_->environment();
1129   builder_->GotoNoSimulate(header_block_);
1130   builder_->set_current_block(header_block_);
1131   env->Drop(drop_count);
1132 }
1133
1134
1135 void HGraphBuilder::LoopBuilder::Break() {
1136   if (exit_trampoline_block_ == NULL) {
1137     // Its the first time we saw a break.
1138     if (direction_ == kWhileTrue) {
1139       HEnvironment* env = builder_->environment()->Copy();
1140       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1141     } else {
1142       HEnvironment* env = exit_block_->last_environment()->Copy();
1143       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1144       builder_->GotoNoSimulate(exit_block_, exit_trampoline_block_);
1145     }
1146   }
1147
1148   builder_->GotoNoSimulate(exit_trampoline_block_);
1149   builder_->set_current_block(NULL);
1150 }
1151
1152
1153 void HGraphBuilder::LoopBuilder::EndBody() {
1154   DCHECK(!finished_);
1155
1156   if (direction_ == kPostIncrement || direction_ == kPostDecrement) {
1157     Isolate* isolate = builder_->isolate();
1158     if (direction_ == kPostIncrement) {
1159       increment_ =
1160           HAdd::New(isolate, zone(), context_, phi_, increment_amount_);
1161     } else {
1162       increment_ =
1163           HSub::New(isolate, zone(), context_, phi_, increment_amount_);
1164     }
1165     increment_->ClearFlag(HValue::kCanOverflow);
1166     builder_->AddInstruction(increment_);
1167   }
1168
1169   if (direction_ != kWhileTrue) {
1170     // Push the new increment value on the expression stack to merge into
1171     // the phi.
1172     builder_->environment()->Push(increment_);
1173   }
1174   HBasicBlock* last_block = builder_->current_block();
1175   builder_->GotoNoSimulate(last_block, header_block_);
1176   header_block_->loop_information()->RegisterBackEdge(last_block);
1177
1178   if (exit_trampoline_block_ != NULL) {
1179     builder_->set_current_block(exit_trampoline_block_);
1180   } else {
1181     builder_->set_current_block(exit_block_);
1182   }
1183   finished_ = true;
1184 }
1185
1186
1187 HGraph* HGraphBuilder::CreateGraph() {
1188   graph_ = new(zone()) HGraph(info_);
1189   if (FLAG_hydrogen_stats) isolate()->GetHStatistics()->Initialize(info_);
1190   CompilationPhase phase("H_Block building", info_);
1191   set_current_block(graph()->entry_block());
1192   if (!BuildGraph()) return NULL;
1193   graph()->FinalizeUniqueness();
1194   return graph_;
1195 }
1196
1197
1198 HInstruction* HGraphBuilder::AddInstruction(HInstruction* instr) {
1199   DCHECK(current_block() != NULL);
1200   DCHECK(!FLAG_hydrogen_track_positions ||
1201          !position_.IsUnknown() ||
1202          !info_->IsOptimizing());
1203   current_block()->AddInstruction(instr, source_position());
1204   if (graph()->IsInsideNoSideEffectsScope()) {
1205     instr->SetFlag(HValue::kHasNoObservableSideEffects);
1206   }
1207   return instr;
1208 }
1209
1210
1211 void HGraphBuilder::FinishCurrentBlock(HControlInstruction* last) {
1212   DCHECK(!FLAG_hydrogen_track_positions ||
1213          !info_->IsOptimizing() ||
1214          !position_.IsUnknown());
1215   current_block()->Finish(last, source_position());
1216   if (last->IsReturn() || last->IsAbnormalExit()) {
1217     set_current_block(NULL);
1218   }
1219 }
1220
1221
1222 void HGraphBuilder::FinishExitCurrentBlock(HControlInstruction* instruction) {
1223   DCHECK(!FLAG_hydrogen_track_positions || !info_->IsOptimizing() ||
1224          !position_.IsUnknown());
1225   current_block()->FinishExit(instruction, source_position());
1226   if (instruction->IsReturn() || instruction->IsAbnormalExit()) {
1227     set_current_block(NULL);
1228   }
1229 }
1230
1231
1232 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
1233   if (FLAG_native_code_counters && counter->Enabled()) {
1234     HValue* reference = Add<HConstant>(ExternalReference(counter));
1235     HValue* old_value =
1236         Add<HLoadNamedField>(reference, nullptr, HObjectAccess::ForCounter());
1237     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
1238     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
1239     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
1240                           new_value, STORE_TO_INITIALIZED_ENTRY);
1241   }
1242 }
1243
1244
1245 void HGraphBuilder::AddSimulate(BailoutId id,
1246                                 RemovableSimulate removable) {
1247   DCHECK(current_block() != NULL);
1248   DCHECK(!graph()->IsInsideNoSideEffectsScope());
1249   current_block()->AddNewSimulate(id, source_position(), removable);
1250 }
1251
1252
1253 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
1254   HBasicBlock* b = graph()->CreateBasicBlock();
1255   b->SetInitialEnvironment(env);
1256   return b;
1257 }
1258
1259
1260 HBasicBlock* HGraphBuilder::CreateLoopHeaderBlock() {
1261   HBasicBlock* header = graph()->CreateBasicBlock();
1262   HEnvironment* entry_env = environment()->CopyAsLoopHeader(header);
1263   header->SetInitialEnvironment(entry_env);
1264   header->AttachLoopInformation();
1265   return header;
1266 }
1267
1268
1269 HValue* HGraphBuilder::BuildGetElementsKind(HValue* object) {
1270   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
1271
1272   HValue* bit_field2 =
1273       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
1274   return BuildDecodeField<Map::ElementsKindBits>(bit_field2);
1275 }
1276
1277
1278 HValue* HGraphBuilder::BuildCheckHeapObject(HValue* obj) {
1279   if (obj->type().IsHeapObject()) return obj;
1280   return Add<HCheckHeapObject>(obj);
1281 }
1282
1283
1284 void HGraphBuilder::FinishExitWithHardDeoptimization(
1285     Deoptimizer::DeoptReason reason) {
1286   Add<HDeoptimize>(reason, Deoptimizer::EAGER);
1287   FinishExitCurrentBlock(New<HAbnormalExit>());
1288 }
1289
1290
1291 HValue* HGraphBuilder::BuildCheckString(HValue* string) {
1292   if (!string->type().IsString()) {
1293     DCHECK(!string->IsConstant() ||
1294            !HConstant::cast(string)->HasStringValue());
1295     BuildCheckHeapObject(string);
1296     return Add<HCheckInstanceType>(string, HCheckInstanceType::IS_STRING);
1297   }
1298   return string;
1299 }
1300
1301
1302 HValue* HGraphBuilder::BuildWrapReceiver(HValue* object, HValue* function) {
1303   if (object->type().IsJSObject()) return object;
1304   if (function->IsConstant() &&
1305       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
1306     Handle<JSFunction> f = Handle<JSFunction>::cast(
1307         HConstant::cast(function)->handle(isolate()));
1308     SharedFunctionInfo* shared = f->shared();
1309     if (is_strict(shared->language_mode()) || shared->native()) return object;
1310   }
1311   return Add<HWrapReceiver>(object, function);
1312 }
1313
1314
1315 HValue* HGraphBuilder::BuildCheckAndGrowElementsCapacity(
1316     HValue* object, HValue* elements, ElementsKind kind, HValue* length,
1317     HValue* capacity, HValue* key) {
1318   HValue* max_gap = Add<HConstant>(static_cast<int32_t>(JSObject::kMaxGap));
1319   HValue* max_capacity = AddUncasted<HAdd>(capacity, max_gap);
1320   Add<HBoundsCheck>(key, max_capacity);
1321
1322   HValue* new_capacity = BuildNewElementsCapacity(key);
1323   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind, kind,
1324                                                    length, new_capacity);
1325   return new_elements;
1326 }
1327
1328
1329 HValue* HGraphBuilder::BuildCheckForCapacityGrow(
1330     HValue* object,
1331     HValue* elements,
1332     ElementsKind kind,
1333     HValue* length,
1334     HValue* key,
1335     bool is_js_array,
1336     PropertyAccessType access_type) {
1337   IfBuilder length_checker(this);
1338
1339   Token::Value token = IsHoleyElementsKind(kind) ? Token::GTE : Token::EQ;
1340   length_checker.If<HCompareNumericAndBranch>(key, length, token);
1341
1342   length_checker.Then();
1343
1344   HValue* current_capacity = AddLoadFixedArrayLength(elements);
1345
1346   if (top_info()->IsStub()) {
1347     IfBuilder capacity_checker(this);
1348     capacity_checker.If<HCompareNumericAndBranch>(key, current_capacity,
1349                                                   Token::GTE);
1350     capacity_checker.Then();
1351     HValue* new_elements = BuildCheckAndGrowElementsCapacity(
1352         object, elements, kind, length, current_capacity, key);
1353     environment()->Push(new_elements);
1354     capacity_checker.Else();
1355     environment()->Push(elements);
1356     capacity_checker.End();
1357   } else {
1358     HValue* result = Add<HMaybeGrowElements>(
1359         object, elements, key, current_capacity, is_js_array, kind);
1360     environment()->Push(result);
1361   }
1362
1363   if (is_js_array) {
1364     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
1365     new_length->ClearFlag(HValue::kCanOverflow);
1366
1367     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
1368                           new_length);
1369   }
1370
1371   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
1372     HValue* checked_elements = environment()->Top();
1373
1374     // Write zero to ensure that the new element is initialized with some smi.
1375     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
1376   }
1377
1378   length_checker.Else();
1379   Add<HBoundsCheck>(key, length);
1380
1381   environment()->Push(elements);
1382   length_checker.End();
1383
1384   return environment()->Pop();
1385 }
1386
1387
1388 HValue* HGraphBuilder::BuildCopyElementsOnWrite(HValue* object,
1389                                                 HValue* elements,
1390                                                 ElementsKind kind,
1391                                                 HValue* length) {
1392   Factory* factory = isolate()->factory();
1393
1394   IfBuilder cow_checker(this);
1395
1396   cow_checker.If<HCompareMap>(elements, factory->fixed_cow_array_map());
1397   cow_checker.Then();
1398
1399   HValue* capacity = AddLoadFixedArrayLength(elements);
1400
1401   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
1402                                                    kind, length, capacity);
1403
1404   environment()->Push(new_elements);
1405
1406   cow_checker.Else();
1407
1408   environment()->Push(elements);
1409
1410   cow_checker.End();
1411
1412   return environment()->Pop();
1413 }
1414
1415
1416 void HGraphBuilder::BuildTransitionElementsKind(HValue* object,
1417                                                 HValue* map,
1418                                                 ElementsKind from_kind,
1419                                                 ElementsKind to_kind,
1420                                                 bool is_jsarray) {
1421   DCHECK(!IsFastHoleyElementsKind(from_kind) ||
1422          IsFastHoleyElementsKind(to_kind));
1423
1424   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
1425     Add<HTrapAllocationMemento>(object);
1426   }
1427
1428   if (!IsSimpleMapChangeTransition(from_kind, to_kind)) {
1429     HInstruction* elements = AddLoadElements(object);
1430
1431     HInstruction* empty_fixed_array = Add<HConstant>(
1432         isolate()->factory()->empty_fixed_array());
1433
1434     IfBuilder if_builder(this);
1435
1436     if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
1437
1438     if_builder.Then();
1439
1440     HInstruction* elements_length = AddLoadFixedArrayLength(elements);
1441
1442     HInstruction* array_length =
1443         is_jsarray
1444             ? Add<HLoadNamedField>(object, nullptr,
1445                                    HObjectAccess::ForArrayLength(from_kind))
1446             : elements_length;
1447
1448     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
1449                               array_length, elements_length);
1450
1451     if_builder.End();
1452   }
1453
1454   Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
1455 }
1456
1457
1458 void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
1459                                        int bit_field_mask) {
1460   // Check that the object isn't a smi.
1461   Add<HCheckHeapObject>(receiver);
1462
1463   // Get the map of the receiver.
1464   HValue* map =
1465       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1466
1467   // Check the instance type and if an access check is needed, this can be
1468   // done with a single load, since both bytes are adjacent in the map.
1469   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
1470   HValue* instance_type_and_bit_field =
1471       Add<HLoadNamedField>(map, nullptr, access);
1472
1473   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
1474   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
1475                                              instance_type_and_bit_field,
1476                                              mask);
1477   HValue* sub_result = AddUncasted<HSub>(and_result,
1478                                          Add<HConstant>(JS_OBJECT_TYPE));
1479   Add<HBoundsCheck>(sub_result,
1480                     Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
1481 }
1482
1483
1484 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
1485                                          HIfContinuation* join_continuation) {
1486   // The sometimes unintuitively backward ordering of the ifs below is
1487   // convoluted, but necessary.  All of the paths must guarantee that the
1488   // if-true of the continuation returns a smi element index and the if-false of
1489   // the continuation returns either a symbol or a unique string key. All other
1490   // object types cause a deopt to fall back to the runtime.
1491
1492   IfBuilder key_smi_if(this);
1493   key_smi_if.If<HIsSmiAndBranch>(key);
1494   key_smi_if.Then();
1495   {
1496     Push(key);  // Nothing to do, just continue to true of continuation.
1497   }
1498   key_smi_if.Else();
1499   {
1500     HValue* map = Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForMap());
1501     HValue* instance_type =
1502         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1503
1504     // Non-unique string, check for a string with a hash code that is actually
1505     // an index.
1506     STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
1507     IfBuilder not_string_or_name_if(this);
1508     not_string_or_name_if.If<HCompareNumericAndBranch>(
1509         instance_type,
1510         Add<HConstant>(LAST_UNIQUE_NAME_TYPE),
1511         Token::GT);
1512
1513     not_string_or_name_if.Then();
1514     {
1515       // Non-smi, non-Name, non-String: Try to convert to smi in case of
1516       // HeapNumber.
1517       // TODO(danno): This could call some variant of ToString
1518       Push(AddUncasted<HForceRepresentation>(key, Representation::Smi()));
1519     }
1520     not_string_or_name_if.Else();
1521     {
1522       // String or Name: check explicitly for Name, they can short-circuit
1523       // directly to unique non-index key path.
1524       IfBuilder not_symbol_if(this);
1525       not_symbol_if.If<HCompareNumericAndBranch>(
1526           instance_type,
1527           Add<HConstant>(SYMBOL_TYPE),
1528           Token::NE);
1529
1530       not_symbol_if.Then();
1531       {
1532         // String: check whether the String is a String of an index. If it is,
1533         // extract the index value from the hash.
1534         HValue* hash = Add<HLoadNamedField>(key, nullptr,
1535                                             HObjectAccess::ForNameHashField());
1536         HValue* not_index_mask = Add<HConstant>(static_cast<int>(
1537             String::kContainsCachedArrayIndexMask));
1538
1539         HValue* not_index_test = AddUncasted<HBitwise>(
1540             Token::BIT_AND, hash, not_index_mask);
1541
1542         IfBuilder string_index_if(this);
1543         string_index_if.If<HCompareNumericAndBranch>(not_index_test,
1544                                                      graph()->GetConstant0(),
1545                                                      Token::EQ);
1546         string_index_if.Then();
1547         {
1548           // String with index in hash: extract string and merge to index path.
1549           Push(BuildDecodeField<String::ArrayIndexValueBits>(hash));
1550         }
1551         string_index_if.Else();
1552         {
1553           // Key is a non-index String, check for uniqueness/internalization.
1554           // If it's not internalized yet, internalize it now.
1555           HValue* not_internalized_bit = AddUncasted<HBitwise>(
1556               Token::BIT_AND,
1557               instance_type,
1558               Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1559
1560           IfBuilder internalized(this);
1561           internalized.If<HCompareNumericAndBranch>(not_internalized_bit,
1562                                                     graph()->GetConstant0(),
1563                                                     Token::EQ);
1564           internalized.Then();
1565           Push(key);
1566
1567           internalized.Else();
1568           Add<HPushArguments>(key);
1569           HValue* intern_key = Add<HCallRuntime>(
1570               isolate()->factory()->empty_string(),
1571               Runtime::FunctionForId(Runtime::kInternalizeString), 1);
1572           Push(intern_key);
1573
1574           internalized.End();
1575           // Key guaranteed to be a unique string
1576         }
1577         string_index_if.JoinContinuation(join_continuation);
1578       }
1579       not_symbol_if.Else();
1580       {
1581         Push(key);  // Key is symbol
1582       }
1583       not_symbol_if.JoinContinuation(join_continuation);
1584     }
1585     not_string_or_name_if.JoinContinuation(join_continuation);
1586   }
1587   key_smi_if.JoinContinuation(join_continuation);
1588 }
1589
1590
1591 void HGraphBuilder::BuildNonGlobalObjectCheck(HValue* receiver) {
1592   // Get the the instance type of the receiver, and make sure that it is
1593   // not one of the global object types.
1594   HValue* map =
1595       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1596   HValue* instance_type =
1597       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1598   STATIC_ASSERT(JS_BUILTINS_OBJECT_TYPE == JS_GLOBAL_OBJECT_TYPE + 1);
1599   HValue* min_global_type = Add<HConstant>(JS_GLOBAL_OBJECT_TYPE);
1600   HValue* max_global_type = Add<HConstant>(JS_BUILTINS_OBJECT_TYPE);
1601
1602   IfBuilder if_global_object(this);
1603   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1604                                                 max_global_type,
1605                                                 Token::LTE);
1606   if_global_object.And();
1607   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1608                                                 min_global_type,
1609                                                 Token::GTE);
1610   if_global_object.ThenDeopt(Deoptimizer::kReceiverWasAGlobalObject);
1611   if_global_object.End();
1612 }
1613
1614
1615 void HGraphBuilder::BuildTestForDictionaryProperties(
1616     HValue* object,
1617     HIfContinuation* continuation) {
1618   HValue* properties = Add<HLoadNamedField>(
1619       object, nullptr, HObjectAccess::ForPropertiesPointer());
1620   HValue* properties_map =
1621       Add<HLoadNamedField>(properties, nullptr, HObjectAccess::ForMap());
1622   HValue* hash_map = Add<HLoadRoot>(Heap::kHashTableMapRootIndex);
1623   IfBuilder builder(this);
1624   builder.If<HCompareObjectEqAndBranch>(properties_map, hash_map);
1625   builder.CaptureContinuation(continuation);
1626 }
1627
1628
1629 HValue* HGraphBuilder::BuildKeyedLookupCacheHash(HValue* object,
1630                                                  HValue* key) {
1631   // Load the map of the receiver, compute the keyed lookup cache hash
1632   // based on 32 bits of the map pointer and the string hash.
1633   HValue* object_map =
1634       Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMapAsInteger32());
1635   HValue* shifted_map = AddUncasted<HShr>(
1636       object_map, Add<HConstant>(KeyedLookupCache::kMapHashShift));
1637   HValue* string_hash =
1638       Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForStringHashField());
1639   HValue* shifted_hash = AddUncasted<HShr>(
1640       string_hash, Add<HConstant>(String::kHashShift));
1641   HValue* xor_result = AddUncasted<HBitwise>(Token::BIT_XOR, shifted_map,
1642                                              shifted_hash);
1643   int mask = (KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask);
1644   return AddUncasted<HBitwise>(Token::BIT_AND, xor_result,
1645                                Add<HConstant>(mask));
1646 }
1647
1648
1649 HValue* HGraphBuilder::BuildElementIndexHash(HValue* index) {
1650   int32_t seed_value = static_cast<uint32_t>(isolate()->heap()->HashSeed());
1651   HValue* seed = Add<HConstant>(seed_value);
1652   HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, index, seed);
1653
1654   // hash = ~hash + (hash << 15);
1655   HValue* shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(15));
1656   HValue* not_hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash,
1657                                            graph()->GetConstantMinus1());
1658   hash = AddUncasted<HAdd>(shifted_hash, not_hash);
1659
1660   // hash = hash ^ (hash >> 12);
1661   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(12));
1662   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1663
1664   // hash = hash + (hash << 2);
1665   shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(2));
1666   hash = AddUncasted<HAdd>(hash, shifted_hash);
1667
1668   // hash = hash ^ (hash >> 4);
1669   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(4));
1670   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1671
1672   // hash = hash * 2057;
1673   hash = AddUncasted<HMul>(hash, Add<HConstant>(2057));
1674   hash->ClearFlag(HValue::kCanOverflow);
1675
1676   // hash = hash ^ (hash >> 16);
1677   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
1678   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1679 }
1680
1681
1682 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(
1683     HValue* receiver, HValue* elements, HValue* key, HValue* hash,
1684     LanguageMode language_mode) {
1685   HValue* capacity =
1686       Add<HLoadKeyed>(elements, Add<HConstant>(NameDictionary::kCapacityIndex),
1687                       nullptr, FAST_ELEMENTS);
1688
1689   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
1690   mask->ChangeRepresentation(Representation::Integer32());
1691   mask->ClearFlag(HValue::kCanOverflow);
1692
1693   HValue* entry = hash;
1694   HValue* count = graph()->GetConstant1();
1695   Push(entry);
1696   Push(count);
1697
1698   HIfContinuation return_or_loop_continuation(graph()->CreateBasicBlock(),
1699                                               graph()->CreateBasicBlock());
1700   HIfContinuation found_key_match_continuation(graph()->CreateBasicBlock(),
1701                                                graph()->CreateBasicBlock());
1702   LoopBuilder probe_loop(this);
1703   probe_loop.BeginBody(2);  // Drop entry, count from last environment to
1704                             // appease live range building without simulates.
1705
1706   count = Pop();
1707   entry = Pop();
1708   entry = AddUncasted<HBitwise>(Token::BIT_AND, entry, mask);
1709   int entry_size = SeededNumberDictionary::kEntrySize;
1710   HValue* base_index = AddUncasted<HMul>(entry, Add<HConstant>(entry_size));
1711   base_index->ClearFlag(HValue::kCanOverflow);
1712   int start_offset = SeededNumberDictionary::kElementsStartIndex;
1713   HValue* key_index =
1714       AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset));
1715   key_index->ClearFlag(HValue::kCanOverflow);
1716
1717   HValue* candidate_key =
1718       Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
1719   IfBuilder if_undefined(this);
1720   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
1721                                              graph()->GetConstantUndefined());
1722   if_undefined.Then();
1723   {
1724     // element == undefined means "not found". Call the runtime.
1725     // TODO(jkummerow): walk the prototype chain instead.
1726     Add<HPushArguments>(receiver, key);
1727     Push(Add<HCallRuntime>(
1728         isolate()->factory()->empty_string(),
1729         Runtime::FunctionForId(is_strong(language_mode)
1730                                    ? Runtime::kKeyedGetPropertyStrong
1731                                    : Runtime::kKeyedGetProperty),
1732         2));
1733   }
1734   if_undefined.Else();
1735   {
1736     IfBuilder if_match(this);
1737     if_match.If<HCompareObjectEqAndBranch>(candidate_key, key);
1738     if_match.Then();
1739     if_match.Else();
1740
1741     // Update non-internalized string in the dictionary with internalized key?
1742     IfBuilder if_update_with_internalized(this);
1743     HValue* smi_check =
1744         if_update_with_internalized.IfNot<HIsSmiAndBranch>(candidate_key);
1745     if_update_with_internalized.And();
1746     HValue* map = AddLoadMap(candidate_key, smi_check);
1747     HValue* instance_type =
1748         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1749     HValue* not_internalized_bit = AddUncasted<HBitwise>(
1750         Token::BIT_AND, instance_type,
1751         Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1752     if_update_with_internalized.If<HCompareNumericAndBranch>(
1753         not_internalized_bit, graph()->GetConstant0(), Token::NE);
1754     if_update_with_internalized.And();
1755     if_update_with_internalized.IfNot<HCompareObjectEqAndBranch>(
1756         candidate_key, graph()->GetConstantHole());
1757     if_update_with_internalized.AndIf<HStringCompareAndBranch>(candidate_key,
1758                                                                key, Token::EQ);
1759     if_update_with_internalized.Then();
1760     // Replace a key that is a non-internalized string by the equivalent
1761     // internalized string for faster further lookups.
1762     Add<HStoreKeyed>(elements, key_index, key, FAST_ELEMENTS);
1763     if_update_with_internalized.Else();
1764
1765     if_update_with_internalized.JoinContinuation(&found_key_match_continuation);
1766     if_match.JoinContinuation(&found_key_match_continuation);
1767
1768     IfBuilder found_key_match(this, &found_key_match_continuation);
1769     found_key_match.Then();
1770     // Key at current probe matches. Relevant bits in the |details| field must
1771     // be zero, otherwise the dictionary element requires special handling.
1772     HValue* details_index =
1773         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 2));
1774     details_index->ClearFlag(HValue::kCanOverflow);
1775     HValue* details =
1776         Add<HLoadKeyed>(elements, details_index, nullptr, FAST_ELEMENTS);
1777     int details_mask = PropertyDetails::TypeField::kMask;
1778     details = AddUncasted<HBitwise>(Token::BIT_AND, details,
1779                                     Add<HConstant>(details_mask));
1780     IfBuilder details_compare(this);
1781     details_compare.If<HCompareNumericAndBranch>(
1782         details, graph()->GetConstant0(), Token::EQ);
1783     details_compare.Then();
1784     HValue* result_index =
1785         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
1786     result_index->ClearFlag(HValue::kCanOverflow);
1787     Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
1788     details_compare.Else();
1789     Add<HPushArguments>(receiver, key);
1790     Push(Add<HCallRuntime>(
1791         isolate()->factory()->empty_string(),
1792         Runtime::FunctionForId(is_strong(language_mode)
1793                                    ? Runtime::kKeyedGetPropertyStrong
1794                                    : Runtime::kKeyedGetProperty),
1795         2));
1796     details_compare.End();
1797
1798     found_key_match.Else();
1799     found_key_match.JoinContinuation(&return_or_loop_continuation);
1800   }
1801   if_undefined.JoinContinuation(&return_or_loop_continuation);
1802
1803   IfBuilder return_or_loop(this, &return_or_loop_continuation);
1804   return_or_loop.Then();
1805   probe_loop.Break();
1806
1807   return_or_loop.Else();
1808   entry = AddUncasted<HAdd>(entry, count);
1809   entry->ClearFlag(HValue::kCanOverflow);
1810   count = AddUncasted<HAdd>(count, graph()->GetConstant1());
1811   count->ClearFlag(HValue::kCanOverflow);
1812   Push(entry);
1813   Push(count);
1814
1815   probe_loop.EndBody();
1816
1817   return_or_loop.End();
1818
1819   return Pop();
1820 }
1821
1822
1823 HValue* HGraphBuilder::BuildRegExpConstructResult(HValue* length,
1824                                                   HValue* index,
1825                                                   HValue* input) {
1826   NoObservableSideEffectsScope scope(this);
1827   HConstant* max_length = Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1828   Add<HBoundsCheck>(length, max_length);
1829
1830   // Generate size calculation code here in order to make it dominate
1831   // the JSRegExpResult allocation.
1832   ElementsKind elements_kind = FAST_ELEMENTS;
1833   HValue* size = BuildCalculateElementsSize(elements_kind, length);
1834
1835   // Allocate the JSRegExpResult and the FixedArray in one step.
1836   HValue* result = Add<HAllocate>(
1837       Add<HConstant>(JSRegExpResult::kSize), HType::JSArray(),
1838       NOT_TENURED, JS_ARRAY_TYPE);
1839
1840   // Initialize the JSRegExpResult header.
1841   HValue* global_object = Add<HLoadNamedField>(
1842       context(), nullptr,
1843       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1844   HValue* native_context = Add<HLoadNamedField>(
1845       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
1846   Add<HStoreNamedField>(
1847       result, HObjectAccess::ForMap(),
1848       Add<HLoadNamedField>(
1849           native_context, nullptr,
1850           HObjectAccess::ForContextSlot(Context::REGEXP_RESULT_MAP_INDEX)));
1851   HConstant* empty_fixed_array =
1852       Add<HConstant>(isolate()->factory()->empty_fixed_array());
1853   Add<HStoreNamedField>(
1854       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
1855       empty_fixed_array);
1856   Add<HStoreNamedField>(
1857       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1858       empty_fixed_array);
1859   Add<HStoreNamedField>(
1860       result, HObjectAccess::ForJSArrayOffset(JSArray::kLengthOffset), length);
1861
1862   // Initialize the additional fields.
1863   Add<HStoreNamedField>(
1864       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kIndexOffset),
1865       index);
1866   Add<HStoreNamedField>(
1867       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kInputOffset),
1868       input);
1869
1870   // Allocate and initialize the elements header.
1871   HAllocate* elements = BuildAllocateElements(elements_kind, size);
1872   BuildInitializeElementsHeader(elements, elements_kind, length);
1873
1874   if (!elements->has_size_upper_bound()) {
1875     HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
1876         elements_kind, max_length->Integer32Value());
1877     elements->set_size_upper_bound(size_in_bytes_upper_bound);
1878   }
1879
1880   Add<HStoreNamedField>(
1881       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1882       elements);
1883
1884   // Initialize the elements contents with undefined.
1885   BuildFillElementsWithValue(
1886       elements, elements_kind, graph()->GetConstant0(), length,
1887       graph()->GetConstantUndefined());
1888
1889   return result;
1890 }
1891
1892
1893 HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
1894   NoObservableSideEffectsScope scope(this);
1895
1896   // Convert constant numbers at compile time.
1897   if (object->IsConstant() && HConstant::cast(object)->HasNumberValue()) {
1898     Handle<Object> number = HConstant::cast(object)->handle(isolate());
1899     Handle<String> result = isolate()->factory()->NumberToString(number);
1900     return Add<HConstant>(result);
1901   }
1902
1903   // Create a joinable continuation.
1904   HIfContinuation found(graph()->CreateBasicBlock(),
1905                         graph()->CreateBasicBlock());
1906
1907   // Load the number string cache.
1908   HValue* number_string_cache =
1909       Add<HLoadRoot>(Heap::kNumberStringCacheRootIndex);
1910
1911   // Make the hash mask from the length of the number string cache. It
1912   // contains two elements (number and string) for each cache entry.
1913   HValue* mask = AddLoadFixedArrayLength(number_string_cache);
1914   mask->set_type(HType::Smi());
1915   mask = AddUncasted<HSar>(mask, graph()->GetConstant1());
1916   mask = AddUncasted<HSub>(mask, graph()->GetConstant1());
1917
1918   // Check whether object is a smi.
1919   IfBuilder if_objectissmi(this);
1920   if_objectissmi.If<HIsSmiAndBranch>(object);
1921   if_objectissmi.Then();
1922   {
1923     // Compute hash for smi similar to smi_get_hash().
1924     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
1925
1926     // Load the key.
1927     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1928     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1929                                   FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1930
1931     // Check if object == key.
1932     IfBuilder if_objectiskey(this);
1933     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
1934     if_objectiskey.Then();
1935     {
1936       // Make the key_index available.
1937       Push(key_index);
1938     }
1939     if_objectiskey.JoinContinuation(&found);
1940   }
1941   if_objectissmi.Else();
1942   {
1943     if (type->Is(Type::SignedSmall())) {
1944       if_objectissmi.Deopt(Deoptimizer::kExpectedSmi);
1945     } else {
1946       // Check if the object is a heap number.
1947       IfBuilder if_objectisnumber(this);
1948       HValue* objectisnumber = if_objectisnumber.If<HCompareMap>(
1949           object, isolate()->factory()->heap_number_map());
1950       if_objectisnumber.Then();
1951       {
1952         // Compute hash for heap number similar to double_get_hash().
1953         HValue* low = Add<HLoadNamedField>(
1954             object, objectisnumber,
1955             HObjectAccess::ForHeapNumberValueLowestBits());
1956         HValue* high = Add<HLoadNamedField>(
1957             object, objectisnumber,
1958             HObjectAccess::ForHeapNumberValueHighestBits());
1959         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
1960         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
1961
1962         // Load the key.
1963         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1964         HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1965                                       FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1966
1967         // Check if the key is a heap number and compare it with the object.
1968         IfBuilder if_keyisnotsmi(this);
1969         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
1970         if_keyisnotsmi.Then();
1971         {
1972           IfBuilder if_keyisheapnumber(this);
1973           if_keyisheapnumber.If<HCompareMap>(
1974               key, isolate()->factory()->heap_number_map());
1975           if_keyisheapnumber.Then();
1976           {
1977             // Check if values of key and object match.
1978             IfBuilder if_keyeqobject(this);
1979             if_keyeqobject.If<HCompareNumericAndBranch>(
1980                 Add<HLoadNamedField>(key, keyisnotsmi,
1981                                      HObjectAccess::ForHeapNumberValue()),
1982                 Add<HLoadNamedField>(object, objectisnumber,
1983                                      HObjectAccess::ForHeapNumberValue()),
1984                 Token::EQ);
1985             if_keyeqobject.Then();
1986             {
1987               // Make the key_index available.
1988               Push(key_index);
1989             }
1990             if_keyeqobject.JoinContinuation(&found);
1991           }
1992           if_keyisheapnumber.JoinContinuation(&found);
1993         }
1994         if_keyisnotsmi.JoinContinuation(&found);
1995       }
1996       if_objectisnumber.Else();
1997       {
1998         if (type->Is(Type::Number())) {
1999           if_objectisnumber.Deopt(Deoptimizer::kExpectedHeapNumber);
2000         }
2001       }
2002       if_objectisnumber.JoinContinuation(&found);
2003     }
2004   }
2005   if_objectissmi.JoinContinuation(&found);
2006
2007   // Check for cache hit.
2008   IfBuilder if_found(this, &found);
2009   if_found.Then();
2010   {
2011     // Count number to string operation in native code.
2012     AddIncrementCounter(isolate()->counters()->number_to_string_native());
2013
2014     // Load the value in case of cache hit.
2015     HValue* key_index = Pop();
2016     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
2017     Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
2018                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
2019   }
2020   if_found.Else();
2021   {
2022     // Cache miss, fallback to runtime.
2023     Add<HPushArguments>(object);
2024     Push(Add<HCallRuntime>(
2025             isolate()->factory()->empty_string(),
2026             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
2027             1));
2028   }
2029   if_found.End();
2030
2031   return Pop();
2032 }
2033
2034
2035 HValue* HGraphBuilder::BuildToObject(HValue* receiver) {
2036   NoObservableSideEffectsScope scope(this);
2037
2038   // Create a joinable continuation.
2039   HIfContinuation wrap(graph()->CreateBasicBlock(),
2040                        graph()->CreateBasicBlock());
2041
2042   // Determine the proper global constructor function required to wrap
2043   // {receiver} into a JSValue, unless {receiver} is already a {JSReceiver}, in
2044   // which case we just return it.  Deopts to Runtime::kToObject if {receiver}
2045   // is undefined or null.
2046   IfBuilder receiver_is_smi(this);
2047   receiver_is_smi.If<HIsSmiAndBranch>(receiver);
2048   receiver_is_smi.Then();
2049   {
2050     // Load native context.
2051     HValue* native_context = BuildGetNativeContext();
2052
2053     // Load global Number function.
2054     HValue* constructor = Add<HLoadNamedField>(
2055         native_context, nullptr,
2056         HObjectAccess::ForContextSlot(Context::NUMBER_FUNCTION_INDEX));
2057     Push(constructor);
2058   }
2059   receiver_is_smi.Else();
2060   {
2061     // Determine {receiver} map and instance type.
2062     HValue* receiver_map =
2063         Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
2064     HValue* receiver_instance_type = Add<HLoadNamedField>(
2065         receiver_map, nullptr, HObjectAccess::ForMapInstanceType());
2066
2067     // First check whether {receiver} is already a spec object (fast case).
2068     IfBuilder receiver_is_not_spec_object(this);
2069     receiver_is_not_spec_object.If<HCompareNumericAndBranch>(
2070         receiver_instance_type, Add<HConstant>(FIRST_SPEC_OBJECT_TYPE),
2071         Token::LT);
2072     receiver_is_not_spec_object.Then();
2073     {
2074       // Load native context.
2075       HValue* native_context = BuildGetNativeContext();
2076
2077       IfBuilder receiver_is_heap_number(this);
2078       receiver_is_heap_number.If<HCompareNumericAndBranch>(
2079           receiver_instance_type, Add<HConstant>(HEAP_NUMBER_TYPE), Token::EQ);
2080       receiver_is_heap_number.Then();
2081       {
2082         // Load global Number function.
2083         HValue* constructor = Add<HLoadNamedField>(
2084             native_context, nullptr,
2085             HObjectAccess::ForContextSlot(Context::NUMBER_FUNCTION_INDEX));
2086         Push(constructor);
2087       }
2088       receiver_is_heap_number.Else();
2089       {
2090         // Load boolean map (we cannot decide based on instance type, because
2091         // it's ODDBALL_TYPE, which would also include null and undefined).
2092         HValue* boolean_map = Add<HLoadRoot>(Heap::kBooleanMapRootIndex);
2093
2094         IfBuilder receiver_is_boolean(this);
2095         receiver_is_boolean.If<HCompareObjectEqAndBranch>(receiver_map,
2096                                                           boolean_map);
2097         receiver_is_boolean.Then();
2098         {
2099           // Load global Boolean function.
2100           HValue* constructor = Add<HLoadNamedField>(
2101               native_context, nullptr,
2102               HObjectAccess::ForContextSlot(Context::BOOLEAN_FUNCTION_INDEX));
2103           Push(constructor);
2104         }
2105         receiver_is_boolean.Else();
2106         {
2107           IfBuilder receiver_is_string(this);
2108           receiver_is_string.If<HCompareNumericAndBranch>(
2109               receiver_instance_type, Add<HConstant>(FIRST_NONSTRING_TYPE),
2110               Token::LT);
2111           receiver_is_string.Then();
2112           {
2113             // Load global String function.
2114             HValue* constructor = Add<HLoadNamedField>(
2115                 native_context, nullptr,
2116                 HObjectAccess::ForContextSlot(Context::STRING_FUNCTION_INDEX));
2117             Push(constructor);
2118           }
2119           receiver_is_string.Else();
2120           {
2121             IfBuilder receiver_is_symbol(this);
2122             receiver_is_symbol.If<HCompareNumericAndBranch>(
2123                 receiver_instance_type, Add<HConstant>(SYMBOL_TYPE), Token::EQ);
2124             receiver_is_symbol.Then();
2125             {
2126               // Load global Symbol function.
2127               HValue* constructor = Add<HLoadNamedField>(
2128                   native_context, nullptr, HObjectAccess::ForContextSlot(
2129                                                Context::SYMBOL_FUNCTION_INDEX));
2130               Push(constructor);
2131             }
2132             // TODO(bmeurer): Don't inline this into crankshaft code, as it will
2133             // deoptimize on all SIMD128 objects.
2134             receiver_is_symbol.ElseDeopt(
2135                 Deoptimizer::kUndefinedOrNullInToObject);
2136             receiver_is_symbol.JoinContinuation(&wrap);
2137           }
2138           receiver_is_string.JoinContinuation(&wrap);
2139         }
2140         receiver_is_boolean.JoinContinuation(&wrap);
2141       }
2142       receiver_is_heap_number.JoinContinuation(&wrap);
2143     }
2144     receiver_is_not_spec_object.JoinContinuation(&wrap);
2145   }
2146   receiver_is_smi.JoinContinuation(&wrap);
2147
2148   // Wrap the receiver if necessary.
2149   IfBuilder if_wrap(this, &wrap);
2150   if_wrap.Then();
2151   {
2152     // Determine the initial map for the global constructor.
2153     HValue* constructor = Pop();
2154     HValue* constructor_initial_map = Add<HLoadNamedField>(
2155         constructor, nullptr, HObjectAccess::ForPrototypeOrInitialMap());
2156     // Allocate and initialize a JSValue wrapper.
2157     HValue* value =
2158         BuildAllocate(Add<HConstant>(JSValue::kSize), HType::JSObject(),
2159                       JS_VALUE_TYPE, HAllocationMode());
2160     Add<HStoreNamedField>(value, HObjectAccess::ForMap(),
2161                           constructor_initial_map);
2162     HValue* empty_fixed_array = Add<HLoadRoot>(Heap::kEmptyFixedArrayRootIndex);
2163     Add<HStoreNamedField>(value, HObjectAccess::ForPropertiesPointer(),
2164                           empty_fixed_array);
2165     Add<HStoreNamedField>(value, HObjectAccess::ForElementsPointer(),
2166                           empty_fixed_array);
2167     Add<HStoreNamedField>(value, HObjectAccess::ForObservableJSObjectOffset(
2168                                      JSValue::kValueOffset),
2169                           receiver);
2170     Push(value);
2171   }
2172   if_wrap.Else();
2173   { Push(receiver); }
2174   if_wrap.End();
2175   return Pop();
2176 }
2177
2178
2179 HAllocate* HGraphBuilder::BuildAllocate(
2180     HValue* object_size,
2181     HType type,
2182     InstanceType instance_type,
2183     HAllocationMode allocation_mode) {
2184   // Compute the effective allocation size.
2185   HValue* size = object_size;
2186   if (allocation_mode.CreateAllocationMementos()) {
2187     size = AddUncasted<HAdd>(size, Add<HConstant>(AllocationMemento::kSize));
2188     size->ClearFlag(HValue::kCanOverflow);
2189   }
2190
2191   // Perform the actual allocation.
2192   HAllocate* object = Add<HAllocate>(
2193       size, type, allocation_mode.GetPretenureMode(),
2194       instance_type, allocation_mode.feedback_site());
2195
2196   // Setup the allocation memento.
2197   if (allocation_mode.CreateAllocationMementos()) {
2198     BuildCreateAllocationMemento(
2199         object, object_size, allocation_mode.current_site());
2200   }
2201
2202   return object;
2203 }
2204
2205
2206 HValue* HGraphBuilder::BuildAddStringLengths(HValue* left_length,
2207                                              HValue* right_length) {
2208   // Compute the combined string length and check against max string length.
2209   HValue* length = AddUncasted<HAdd>(left_length, right_length);
2210   // Check that length <= kMaxLength <=> length < MaxLength + 1.
2211   HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
2212   Add<HBoundsCheck>(length, max_length);
2213   return length;
2214 }
2215
2216
2217 HValue* HGraphBuilder::BuildCreateConsString(
2218     HValue* length,
2219     HValue* left,
2220     HValue* right,
2221     HAllocationMode allocation_mode) {
2222   // Determine the string instance types.
2223   HInstruction* left_instance_type = AddLoadStringInstanceType(left);
2224   HInstruction* right_instance_type = AddLoadStringInstanceType(right);
2225
2226   // Allocate the cons string object. HAllocate does not care whether we
2227   // pass CONS_STRING_TYPE or CONS_ONE_BYTE_STRING_TYPE here, so we just use
2228   // CONS_STRING_TYPE here. Below we decide whether the cons string is
2229   // one-byte or two-byte and set the appropriate map.
2230   DCHECK(HAllocate::CompatibleInstanceTypes(CONS_STRING_TYPE,
2231                                             CONS_ONE_BYTE_STRING_TYPE));
2232   HAllocate* result = BuildAllocate(Add<HConstant>(ConsString::kSize),
2233                                     HType::String(), CONS_STRING_TYPE,
2234                                     allocation_mode);
2235
2236   // Compute intersection and difference of instance types.
2237   HValue* anded_instance_types = AddUncasted<HBitwise>(
2238       Token::BIT_AND, left_instance_type, right_instance_type);
2239   HValue* xored_instance_types = AddUncasted<HBitwise>(
2240       Token::BIT_XOR, left_instance_type, right_instance_type);
2241
2242   // We create a one-byte cons string if
2243   // 1. both strings are one-byte, or
2244   // 2. at least one of the strings is two-byte, but happens to contain only
2245   //    one-byte characters.
2246   // To do this, we check
2247   // 1. if both strings are one-byte, or if the one-byte data hint is set in
2248   //    both strings, or
2249   // 2. if one of the strings has the one-byte data hint set and the other
2250   //    string is one-byte.
2251   IfBuilder if_onebyte(this);
2252   STATIC_ASSERT(kOneByteStringTag != 0);
2253   STATIC_ASSERT(kOneByteDataHintMask != 0);
2254   if_onebyte.If<HCompareNumericAndBranch>(
2255       AddUncasted<HBitwise>(
2256           Token::BIT_AND, anded_instance_types,
2257           Add<HConstant>(static_cast<int32_t>(
2258                   kStringEncodingMask | kOneByteDataHintMask))),
2259       graph()->GetConstant0(), Token::NE);
2260   if_onebyte.Or();
2261   STATIC_ASSERT(kOneByteStringTag != 0 &&
2262                 kOneByteDataHintTag != 0 &&
2263                 kOneByteDataHintTag != kOneByteStringTag);
2264   if_onebyte.If<HCompareNumericAndBranch>(
2265       AddUncasted<HBitwise>(
2266           Token::BIT_AND, xored_instance_types,
2267           Add<HConstant>(static_cast<int32_t>(
2268                   kOneByteStringTag | kOneByteDataHintTag))),
2269       Add<HConstant>(static_cast<int32_t>(
2270               kOneByteStringTag | kOneByteDataHintTag)), Token::EQ);
2271   if_onebyte.Then();
2272   {
2273     // We can safely skip the write barrier for storing the map here.
2274     Add<HStoreNamedField>(
2275         result, HObjectAccess::ForMap(),
2276         Add<HConstant>(isolate()->factory()->cons_one_byte_string_map()));
2277   }
2278   if_onebyte.Else();
2279   {
2280     // We can safely skip the write barrier for storing the map here.
2281     Add<HStoreNamedField>(
2282         result, HObjectAccess::ForMap(),
2283         Add<HConstant>(isolate()->factory()->cons_string_map()));
2284   }
2285   if_onebyte.End();
2286
2287   // Initialize the cons string fields.
2288   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2289                         Add<HConstant>(String::kEmptyHashField));
2290   Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2291   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
2292   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
2293
2294   // Count the native string addition.
2295   AddIncrementCounter(isolate()->counters()->string_add_native());
2296
2297   return result;
2298 }
2299
2300
2301 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
2302                                             HValue* src_offset,
2303                                             String::Encoding src_encoding,
2304                                             HValue* dst,
2305                                             HValue* dst_offset,
2306                                             String::Encoding dst_encoding,
2307                                             HValue* length) {
2308   DCHECK(dst_encoding != String::ONE_BYTE_ENCODING ||
2309          src_encoding == String::ONE_BYTE_ENCODING);
2310   LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
2311   HValue* index = loop.BeginBody(graph()->GetConstant0(), length, Token::LT);
2312   {
2313     HValue* src_index = AddUncasted<HAdd>(src_offset, index);
2314     HValue* value =
2315         AddUncasted<HSeqStringGetChar>(src_encoding, src, src_index);
2316     HValue* dst_index = AddUncasted<HAdd>(dst_offset, index);
2317     Add<HSeqStringSetChar>(dst_encoding, dst, dst_index, value);
2318   }
2319   loop.EndBody();
2320 }
2321
2322
2323 HValue* HGraphBuilder::BuildObjectSizeAlignment(
2324     HValue* unaligned_size, int header_size) {
2325   DCHECK((header_size & kObjectAlignmentMask) == 0);
2326   HValue* size = AddUncasted<HAdd>(
2327       unaligned_size, Add<HConstant>(static_cast<int32_t>(
2328           header_size + kObjectAlignmentMask)));
2329   size->ClearFlag(HValue::kCanOverflow);
2330   return AddUncasted<HBitwise>(
2331       Token::BIT_AND, size, Add<HConstant>(static_cast<int32_t>(
2332           ~kObjectAlignmentMask)));
2333 }
2334
2335
2336 HValue* HGraphBuilder::BuildUncheckedStringAdd(
2337     HValue* left,
2338     HValue* right,
2339     HAllocationMode allocation_mode) {
2340   // Determine the string lengths.
2341   HValue* left_length = AddLoadStringLength(left);
2342   HValue* right_length = AddLoadStringLength(right);
2343
2344   // Compute the combined string length.
2345   HValue* length = BuildAddStringLengths(left_length, right_length);
2346
2347   // Do some manual constant folding here.
2348   if (left_length->IsConstant()) {
2349     HConstant* c_left_length = HConstant::cast(left_length);
2350     DCHECK_NE(0, c_left_length->Integer32Value());
2351     if (c_left_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2352       // The right string contains at least one character.
2353       return BuildCreateConsString(length, left, right, allocation_mode);
2354     }
2355   } else if (right_length->IsConstant()) {
2356     HConstant* c_right_length = HConstant::cast(right_length);
2357     DCHECK_NE(0, c_right_length->Integer32Value());
2358     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2359       // The left string contains at least one character.
2360       return BuildCreateConsString(length, left, right, allocation_mode);
2361     }
2362   }
2363
2364   // Check if we should create a cons string.
2365   IfBuilder if_createcons(this);
2366   if_createcons.If<HCompareNumericAndBranch>(
2367       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
2368   if_createcons.Then();
2369   {
2370     // Create a cons string.
2371     Push(BuildCreateConsString(length, left, right, allocation_mode));
2372   }
2373   if_createcons.Else();
2374   {
2375     // Determine the string instance types.
2376     HValue* left_instance_type = AddLoadStringInstanceType(left);
2377     HValue* right_instance_type = AddLoadStringInstanceType(right);
2378
2379     // Compute union and difference of instance types.
2380     HValue* ored_instance_types = AddUncasted<HBitwise>(
2381         Token::BIT_OR, left_instance_type, right_instance_type);
2382     HValue* xored_instance_types = AddUncasted<HBitwise>(
2383         Token::BIT_XOR, left_instance_type, right_instance_type);
2384
2385     // Check if both strings have the same encoding and both are
2386     // sequential.
2387     IfBuilder if_sameencodingandsequential(this);
2388     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2389         AddUncasted<HBitwise>(
2390             Token::BIT_AND, xored_instance_types,
2391             Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2392         graph()->GetConstant0(), Token::EQ);
2393     if_sameencodingandsequential.And();
2394     STATIC_ASSERT(kSeqStringTag == 0);
2395     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2396         AddUncasted<HBitwise>(
2397             Token::BIT_AND, ored_instance_types,
2398             Add<HConstant>(static_cast<int32_t>(kStringRepresentationMask))),
2399         graph()->GetConstant0(), Token::EQ);
2400     if_sameencodingandsequential.Then();
2401     {
2402       HConstant* string_map =
2403           Add<HConstant>(isolate()->factory()->string_map());
2404       HConstant* one_byte_string_map =
2405           Add<HConstant>(isolate()->factory()->one_byte_string_map());
2406
2407       // Determine map and size depending on whether result is one-byte string.
2408       IfBuilder if_onebyte(this);
2409       STATIC_ASSERT(kOneByteStringTag != 0);
2410       if_onebyte.If<HCompareNumericAndBranch>(
2411           AddUncasted<HBitwise>(
2412               Token::BIT_AND, ored_instance_types,
2413               Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2414           graph()->GetConstant0(), Token::NE);
2415       if_onebyte.Then();
2416       {
2417         // Allocate sequential one-byte string object.
2418         Push(length);
2419         Push(one_byte_string_map);
2420       }
2421       if_onebyte.Else();
2422       {
2423         // Allocate sequential two-byte string object.
2424         HValue* size = AddUncasted<HShl>(length, graph()->GetConstant1());
2425         size->ClearFlag(HValue::kCanOverflow);
2426         size->SetFlag(HValue::kUint32);
2427         Push(size);
2428         Push(string_map);
2429       }
2430       if_onebyte.End();
2431       HValue* map = Pop();
2432
2433       // Calculate the number of bytes needed for the characters in the
2434       // string while observing object alignment.
2435       STATIC_ASSERT((SeqString::kHeaderSize & kObjectAlignmentMask) == 0);
2436       HValue* size = BuildObjectSizeAlignment(Pop(), SeqString::kHeaderSize);
2437
2438       // Allocate the string object. HAllocate does not care whether we pass
2439       // STRING_TYPE or ONE_BYTE_STRING_TYPE here, so we just use STRING_TYPE.
2440       HAllocate* result = BuildAllocate(
2441           size, HType::String(), STRING_TYPE, allocation_mode);
2442       Add<HStoreNamedField>(result, HObjectAccess::ForMap(), map);
2443
2444       // Initialize the string fields.
2445       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2446                             Add<HConstant>(String::kEmptyHashField));
2447       Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2448
2449       // Copy characters to the result string.
2450       IfBuilder if_twobyte(this);
2451       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
2452       if_twobyte.Then();
2453       {
2454         // Copy characters from the left string.
2455         BuildCopySeqStringChars(
2456             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2457             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2458             left_length);
2459
2460         // Copy characters from the right string.
2461         BuildCopySeqStringChars(
2462             right, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2463             result, left_length, String::TWO_BYTE_ENCODING,
2464             right_length);
2465       }
2466       if_twobyte.Else();
2467       {
2468         // Copy characters from the left string.
2469         BuildCopySeqStringChars(
2470             left, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2471             result, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2472             left_length);
2473
2474         // Copy characters from the right string.
2475         BuildCopySeqStringChars(
2476             right, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2477             result, left_length, String::ONE_BYTE_ENCODING,
2478             right_length);
2479       }
2480       if_twobyte.End();
2481
2482       // Count the native string addition.
2483       AddIncrementCounter(isolate()->counters()->string_add_native());
2484
2485       // Return the sequential string.
2486       Push(result);
2487     }
2488     if_sameencodingandsequential.Else();
2489     {
2490       // Fallback to the runtime to add the two strings.
2491       Add<HPushArguments>(left, right);
2492       Push(Add<HCallRuntime>(isolate()->factory()->empty_string(),
2493                              Runtime::FunctionForId(Runtime::kStringAdd), 2));
2494     }
2495     if_sameencodingandsequential.End();
2496   }
2497   if_createcons.End();
2498
2499   return Pop();
2500 }
2501
2502
2503 HValue* HGraphBuilder::BuildStringAdd(
2504     HValue* left,
2505     HValue* right,
2506     HAllocationMode allocation_mode) {
2507   NoObservableSideEffectsScope no_effects(this);
2508
2509   // Determine string lengths.
2510   HValue* left_length = AddLoadStringLength(left);
2511   HValue* right_length = AddLoadStringLength(right);
2512
2513   // Check if left string is empty.
2514   IfBuilder if_leftempty(this);
2515   if_leftempty.If<HCompareNumericAndBranch>(
2516       left_length, graph()->GetConstant0(), Token::EQ);
2517   if_leftempty.Then();
2518   {
2519     // Count the native string addition.
2520     AddIncrementCounter(isolate()->counters()->string_add_native());
2521
2522     // Just return the right string.
2523     Push(right);
2524   }
2525   if_leftempty.Else();
2526   {
2527     // Check if right string is empty.
2528     IfBuilder if_rightempty(this);
2529     if_rightempty.If<HCompareNumericAndBranch>(
2530         right_length, graph()->GetConstant0(), Token::EQ);
2531     if_rightempty.Then();
2532     {
2533       // Count the native string addition.
2534       AddIncrementCounter(isolate()->counters()->string_add_native());
2535
2536       // Just return the left string.
2537       Push(left);
2538     }
2539     if_rightempty.Else();
2540     {
2541       // Add the two non-empty strings.
2542       Push(BuildUncheckedStringAdd(left, right, allocation_mode));
2543     }
2544     if_rightempty.End();
2545   }
2546   if_leftempty.End();
2547
2548   return Pop();
2549 }
2550
2551
2552 HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
2553     HValue* checked_object,
2554     HValue* key,
2555     HValue* val,
2556     bool is_js_array,
2557     ElementsKind elements_kind,
2558     PropertyAccessType access_type,
2559     LoadKeyedHoleMode load_mode,
2560     KeyedAccessStoreMode store_mode) {
2561   DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
2562          checked_object->IsCheckMaps());
2563   DCHECK(!IsFixedTypedArrayElementsKind(elements_kind) || !is_js_array);
2564   // No GVNFlag is necessary for ElementsKind if there is an explicit dependency
2565   // on a HElementsTransition instruction. The flag can also be removed if the
2566   // map to check has FAST_HOLEY_ELEMENTS, since there can be no further
2567   // ElementsKind transitions. Finally, the dependency can be removed for stores
2568   // for FAST_ELEMENTS, since a transition to HOLEY elements won't change the
2569   // generated store code.
2570   if ((elements_kind == FAST_HOLEY_ELEMENTS) ||
2571       (elements_kind == FAST_ELEMENTS && access_type == STORE)) {
2572     checked_object->ClearDependsOnFlag(kElementsKind);
2573   }
2574
2575   bool fast_smi_only_elements = IsFastSmiElementsKind(elements_kind);
2576   bool fast_elements = IsFastObjectElementsKind(elements_kind);
2577   HValue* elements = AddLoadElements(checked_object);
2578   if (access_type == STORE && (fast_elements || fast_smi_only_elements) &&
2579       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
2580     HCheckMaps* check_cow_map = Add<HCheckMaps>(
2581         elements, isolate()->factory()->fixed_array_map());
2582     check_cow_map->ClearDependsOnFlag(kElementsKind);
2583   }
2584   HInstruction* length = NULL;
2585   if (is_js_array) {
2586     length = Add<HLoadNamedField>(
2587         checked_object->ActualValue(), checked_object,
2588         HObjectAccess::ForArrayLength(elements_kind));
2589   } else {
2590     length = AddLoadFixedArrayLength(elements);
2591   }
2592   length->set_type(HType::Smi());
2593   HValue* checked_key = NULL;
2594   if (IsFixedTypedArrayElementsKind(elements_kind)) {
2595     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
2596
2597     HValue* external_pointer = Add<HLoadNamedField>(
2598         elements, nullptr,
2599         HObjectAccess::ForFixedTypedArrayBaseExternalPointer());
2600     HValue* base_pointer = Add<HLoadNamedField>(
2601         elements, nullptr, HObjectAccess::ForFixedTypedArrayBaseBasePointer());
2602     HValue* backing_store = AddUncasted<HAdd>(
2603         external_pointer, base_pointer, Strength::WEAK, AddOfExternalAndTagged);
2604
2605     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
2606       NoObservableSideEffectsScope no_effects(this);
2607       IfBuilder length_checker(this);
2608       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
2609       length_checker.Then();
2610       IfBuilder negative_checker(this);
2611       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
2612           key, graph()->GetConstant0(), Token::GTE);
2613       negative_checker.Then();
2614       HInstruction* result = AddElementAccess(
2615           backing_store, key, val, bounds_check, elements_kind, access_type);
2616       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
2617       negative_checker.End();
2618       length_checker.End();
2619       return result;
2620     } else {
2621       DCHECK(store_mode == STANDARD_STORE);
2622       checked_key = Add<HBoundsCheck>(key, length);
2623       return AddElementAccess(
2624           backing_store, checked_key, val,
2625           checked_object, elements_kind, access_type);
2626     }
2627   }
2628   DCHECK(fast_smi_only_elements ||
2629          fast_elements ||
2630          IsFastDoubleElementsKind(elements_kind));
2631
2632   // In case val is stored into a fast smi array, assure that the value is a smi
2633   // before manipulating the backing store. Otherwise the actual store may
2634   // deopt, leaving the backing store in an invalid state.
2635   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
2636       !val->type().IsSmi()) {
2637     val = AddUncasted<HForceRepresentation>(val, Representation::Smi());
2638   }
2639
2640   if (IsGrowStoreMode(store_mode)) {
2641     NoObservableSideEffectsScope no_effects(this);
2642     Representation representation = HStoreKeyed::RequiredValueRepresentation(
2643         elements_kind, STORE_TO_INITIALIZED_ENTRY);
2644     val = AddUncasted<HForceRepresentation>(val, representation);
2645     elements = BuildCheckForCapacityGrow(checked_object, elements,
2646                                          elements_kind, length, key,
2647                                          is_js_array, access_type);
2648     checked_key = key;
2649   } else {
2650     checked_key = Add<HBoundsCheck>(key, length);
2651
2652     if (access_type == STORE && (fast_elements || fast_smi_only_elements)) {
2653       if (store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
2654         NoObservableSideEffectsScope no_effects(this);
2655         elements = BuildCopyElementsOnWrite(checked_object, elements,
2656                                             elements_kind, length);
2657       } else {
2658         HCheckMaps* check_cow_map = Add<HCheckMaps>(
2659             elements, isolate()->factory()->fixed_array_map());
2660         check_cow_map->ClearDependsOnFlag(kElementsKind);
2661       }
2662     }
2663   }
2664   return AddElementAccess(elements, checked_key, val, checked_object,
2665                           elements_kind, access_type, load_mode);
2666 }
2667
2668
2669 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
2670     JSArrayBuilder* array_builder,
2671     HValue* length_argument) {
2672   if (length_argument->IsConstant() &&
2673       HConstant::cast(length_argument)->HasSmiValue()) {
2674     int array_length = HConstant::cast(length_argument)->Integer32Value();
2675     if (array_length == 0) {
2676       return array_builder->AllocateEmptyArray();
2677     } else {
2678       return array_builder->AllocateArray(length_argument,
2679                                           array_length,
2680                                           length_argument);
2681     }
2682   }
2683
2684   HValue* constant_zero = graph()->GetConstant0();
2685   HConstant* max_alloc_length =
2686       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
2687   HInstruction* checked_length = Add<HBoundsCheck>(length_argument,
2688                                                    max_alloc_length);
2689   IfBuilder if_builder(this);
2690   if_builder.If<HCompareNumericAndBranch>(checked_length, constant_zero,
2691                                           Token::EQ);
2692   if_builder.Then();
2693   const int initial_capacity = JSArray::kPreallocatedArrayElements;
2694   HConstant* initial_capacity_node = Add<HConstant>(initial_capacity);
2695   Push(initial_capacity_node);  // capacity
2696   Push(constant_zero);          // length
2697   if_builder.Else();
2698   if (!(top_info()->IsStub()) &&
2699       IsFastPackedElementsKind(array_builder->kind())) {
2700     // We'll come back later with better (holey) feedback.
2701     if_builder.Deopt(
2702         Deoptimizer::kHoleyArrayDespitePackedElements_kindFeedback);
2703   } else {
2704     Push(checked_length);         // capacity
2705     Push(checked_length);         // length
2706   }
2707   if_builder.End();
2708
2709   // Figure out total size
2710   HValue* length = Pop();
2711   HValue* capacity = Pop();
2712   return array_builder->AllocateArray(capacity, max_alloc_length, length);
2713 }
2714
2715
2716 HValue* HGraphBuilder::BuildCalculateElementsSize(ElementsKind kind,
2717                                                   HValue* capacity) {
2718   int elements_size = IsFastDoubleElementsKind(kind)
2719       ? kDoubleSize
2720       : kPointerSize;
2721
2722   HConstant* elements_size_value = Add<HConstant>(elements_size);
2723   HInstruction* mul =
2724       HMul::NewImul(isolate(), zone(), context(), capacity->ActualValue(),
2725                     elements_size_value);
2726   AddInstruction(mul);
2727   mul->ClearFlag(HValue::kCanOverflow);
2728
2729   STATIC_ASSERT(FixedDoubleArray::kHeaderSize == FixedArray::kHeaderSize);
2730
2731   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
2732   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
2733   total_size->ClearFlag(HValue::kCanOverflow);
2734   return total_size;
2735 }
2736
2737
2738 HAllocate* HGraphBuilder::AllocateJSArrayObject(AllocationSiteMode mode) {
2739   int base_size = JSArray::kSize;
2740   if (mode == TRACK_ALLOCATION_SITE) {
2741     base_size += AllocationMemento::kSize;
2742   }
2743   HConstant* size_in_bytes = Add<HConstant>(base_size);
2744   return Add<HAllocate>(
2745       size_in_bytes, HType::JSArray(), NOT_TENURED, JS_OBJECT_TYPE);
2746 }
2747
2748
2749 HConstant* HGraphBuilder::EstablishElementsAllocationSize(
2750     ElementsKind kind,
2751     int capacity) {
2752   int base_size = IsFastDoubleElementsKind(kind)
2753       ? FixedDoubleArray::SizeFor(capacity)
2754       : FixedArray::SizeFor(capacity);
2755
2756   return Add<HConstant>(base_size);
2757 }
2758
2759
2760 HAllocate* HGraphBuilder::BuildAllocateElements(ElementsKind kind,
2761                                                 HValue* size_in_bytes) {
2762   InstanceType instance_type = IsFastDoubleElementsKind(kind)
2763       ? FIXED_DOUBLE_ARRAY_TYPE
2764       : FIXED_ARRAY_TYPE;
2765
2766   return Add<HAllocate>(size_in_bytes, HType::HeapObject(), NOT_TENURED,
2767                         instance_type);
2768 }
2769
2770
2771 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
2772                                                   ElementsKind kind,
2773                                                   HValue* capacity) {
2774   Factory* factory = isolate()->factory();
2775   Handle<Map> map = IsFastDoubleElementsKind(kind)
2776       ? factory->fixed_double_array_map()
2777       : factory->fixed_array_map();
2778
2779   Add<HStoreNamedField>(elements, HObjectAccess::ForMap(), Add<HConstant>(map));
2780   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
2781                         capacity);
2782 }
2783
2784
2785 HValue* HGraphBuilder::BuildAllocateAndInitializeArray(ElementsKind kind,
2786                                                        HValue* capacity) {
2787   // The HForceRepresentation is to prevent possible deopt on int-smi
2788   // conversion after allocation but before the new object fields are set.
2789   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
2790   HValue* size_in_bytes = BuildCalculateElementsSize(kind, capacity);
2791   HValue* new_array = BuildAllocateElements(kind, size_in_bytes);
2792   BuildInitializeElementsHeader(new_array, kind, capacity);
2793   return new_array;
2794 }
2795
2796
2797 void HGraphBuilder::BuildJSArrayHeader(HValue* array,
2798                                        HValue* array_map,
2799                                        HValue* elements,
2800                                        AllocationSiteMode mode,
2801                                        ElementsKind elements_kind,
2802                                        HValue* allocation_site_payload,
2803                                        HValue* length_field) {
2804   Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
2805
2806   HConstant* empty_fixed_array =
2807     Add<HConstant>(isolate()->factory()->empty_fixed_array());
2808
2809   Add<HStoreNamedField>(
2810       array, HObjectAccess::ForPropertiesPointer(), empty_fixed_array);
2811
2812   Add<HStoreNamedField>(
2813       array, HObjectAccess::ForElementsPointer(),
2814       elements != NULL ? elements : empty_fixed_array);
2815
2816   Add<HStoreNamedField>(
2817       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
2818
2819   if (mode == TRACK_ALLOCATION_SITE) {
2820     BuildCreateAllocationMemento(
2821         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
2822   }
2823 }
2824
2825
2826 HInstruction* HGraphBuilder::AddElementAccess(
2827     HValue* elements,
2828     HValue* checked_key,
2829     HValue* val,
2830     HValue* dependency,
2831     ElementsKind elements_kind,
2832     PropertyAccessType access_type,
2833     LoadKeyedHoleMode load_mode) {
2834   if (access_type == STORE) {
2835     DCHECK(val != NULL);
2836     if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
2837       val = Add<HClampToUint8>(val);
2838     }
2839     return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
2840                             STORE_TO_INITIALIZED_ENTRY);
2841   }
2842
2843   DCHECK(access_type == LOAD);
2844   DCHECK(val == NULL);
2845   HLoadKeyed* load = Add<HLoadKeyed>(
2846       elements, checked_key, dependency, elements_kind, load_mode);
2847   if (elements_kind == UINT32_ELEMENTS) {
2848     graph()->RecordUint32Instruction(load);
2849   }
2850   return load;
2851 }
2852
2853
2854 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
2855                                            HValue* dependency) {
2856   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
2857 }
2858
2859
2860 HLoadNamedField* HGraphBuilder::AddLoadElements(HValue* object,
2861                                                 HValue* dependency) {
2862   return Add<HLoadNamedField>(
2863       object, dependency, HObjectAccess::ForElementsPointer());
2864 }
2865
2866
2867 HLoadNamedField* HGraphBuilder::AddLoadFixedArrayLength(
2868     HValue* array,
2869     HValue* dependency) {
2870   return Add<HLoadNamedField>(
2871       array, dependency, HObjectAccess::ForFixedArrayLength());
2872 }
2873
2874
2875 HLoadNamedField* HGraphBuilder::AddLoadArrayLength(HValue* array,
2876                                                    ElementsKind kind,
2877                                                    HValue* dependency) {
2878   return Add<HLoadNamedField>(
2879       array, dependency, HObjectAccess::ForArrayLength(kind));
2880 }
2881
2882
2883 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* old_capacity) {
2884   HValue* half_old_capacity = AddUncasted<HShr>(old_capacity,
2885                                                 graph_->GetConstant1());
2886
2887   HValue* new_capacity = AddUncasted<HAdd>(half_old_capacity, old_capacity);
2888   new_capacity->ClearFlag(HValue::kCanOverflow);
2889
2890   HValue* min_growth = Add<HConstant>(16);
2891
2892   new_capacity = AddUncasted<HAdd>(new_capacity, min_growth);
2893   new_capacity->ClearFlag(HValue::kCanOverflow);
2894
2895   return new_capacity;
2896 }
2897
2898
2899 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
2900                                                  HValue* elements,
2901                                                  ElementsKind kind,
2902                                                  ElementsKind new_kind,
2903                                                  HValue* length,
2904                                                  HValue* new_capacity) {
2905   Add<HBoundsCheck>(new_capacity, Add<HConstant>(
2906           (Page::kMaxRegularHeapObjectSize - FixedArray::kHeaderSize) >>
2907           ElementsKindToShiftSize(new_kind)));
2908
2909   HValue* new_elements =
2910       BuildAllocateAndInitializeArray(new_kind, new_capacity);
2911
2912   BuildCopyElements(elements, kind, new_elements,
2913                     new_kind, length, new_capacity);
2914
2915   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
2916                         new_elements);
2917
2918   return new_elements;
2919 }
2920
2921
2922 void HGraphBuilder::BuildFillElementsWithValue(HValue* elements,
2923                                                ElementsKind elements_kind,
2924                                                HValue* from,
2925                                                HValue* to,
2926                                                HValue* value) {
2927   if (to == NULL) {
2928     to = AddLoadFixedArrayLength(elements);
2929   }
2930
2931   // Special loop unfolding case
2932   STATIC_ASSERT(JSArray::kPreallocatedArrayElements <=
2933                 kElementLoopUnrollThreshold);
2934   int initial_capacity = -1;
2935   if (from->IsInteger32Constant() && to->IsInteger32Constant()) {
2936     int constant_from = from->GetInteger32Constant();
2937     int constant_to = to->GetInteger32Constant();
2938
2939     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
2940       initial_capacity = constant_to;
2941     }
2942   }
2943
2944   if (initial_capacity >= 0) {
2945     for (int i = 0; i < initial_capacity; i++) {
2946       HInstruction* key = Add<HConstant>(i);
2947       Add<HStoreKeyed>(elements, key, value, elements_kind);
2948     }
2949   } else {
2950     // Carefully loop backwards so that the "from" remains live through the loop
2951     // rather than the to. This often corresponds to keeping length live rather
2952     // then capacity, which helps register allocation, since length is used more
2953     // other than capacity after filling with holes.
2954     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2955
2956     HValue* key = builder.BeginBody(to, from, Token::GT);
2957
2958     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
2959     adjusted_key->ClearFlag(HValue::kCanOverflow);
2960
2961     Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
2962
2963     builder.EndBody();
2964   }
2965 }
2966
2967
2968 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
2969                                               ElementsKind elements_kind,
2970                                               HValue* from,
2971                                               HValue* to) {
2972   // Fast elements kinds need to be initialized in case statements below cause a
2973   // garbage collection.
2974
2975   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
2976                      ? graph()->GetConstantHole()
2977                      : Add<HConstant>(HConstant::kHoleNaN);
2978
2979   // Since we're about to store a hole value, the store instruction below must
2980   // assume an elements kind that supports heap object values.
2981   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
2982     elements_kind = FAST_HOLEY_ELEMENTS;
2983   }
2984
2985   BuildFillElementsWithValue(elements, elements_kind, from, to, hole);
2986 }
2987
2988
2989 void HGraphBuilder::BuildCopyProperties(HValue* from_properties,
2990                                         HValue* to_properties, HValue* length,
2991                                         HValue* capacity) {
2992   ElementsKind kind = FAST_ELEMENTS;
2993
2994   BuildFillElementsWithValue(to_properties, kind, length, capacity,
2995                              graph()->GetConstantUndefined());
2996
2997   LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2998
2999   HValue* key = builder.BeginBody(length, graph()->GetConstant0(), Token::GT);
3000
3001   key = AddUncasted<HSub>(key, graph()->GetConstant1());
3002   key->ClearFlag(HValue::kCanOverflow);
3003
3004   HValue* element = Add<HLoadKeyed>(from_properties, key, nullptr, kind);
3005
3006   Add<HStoreKeyed>(to_properties, key, element, kind);
3007
3008   builder.EndBody();
3009 }
3010
3011
3012 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
3013                                       ElementsKind from_elements_kind,
3014                                       HValue* to_elements,
3015                                       ElementsKind to_elements_kind,
3016                                       HValue* length,
3017                                       HValue* capacity) {
3018   int constant_capacity = -1;
3019   if (capacity != NULL &&
3020       capacity->IsConstant() &&
3021       HConstant::cast(capacity)->HasInteger32Value()) {
3022     int constant_candidate = HConstant::cast(capacity)->Integer32Value();
3023     if (constant_candidate <= kElementLoopUnrollThreshold) {
3024       constant_capacity = constant_candidate;
3025     }
3026   }
3027
3028   bool pre_fill_with_holes =
3029     IsFastDoubleElementsKind(from_elements_kind) &&
3030     IsFastObjectElementsKind(to_elements_kind);
3031   if (pre_fill_with_holes) {
3032     // If the copy might trigger a GC, make sure that the FixedArray is
3033     // pre-initialized with holes to make sure that it's always in a
3034     // consistent state.
3035     BuildFillElementsWithHole(to_elements, to_elements_kind,
3036                               graph()->GetConstant0(), NULL);
3037   }
3038
3039   if (constant_capacity != -1) {
3040     // Unroll the loop for small elements kinds.
3041     for (int i = 0; i < constant_capacity; i++) {
3042       HValue* key_constant = Add<HConstant>(i);
3043       HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
3044                                             nullptr, from_elements_kind);
3045       Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
3046     }
3047   } else {
3048     if (!pre_fill_with_holes &&
3049         (capacity == NULL || !length->Equals(capacity))) {
3050       BuildFillElementsWithHole(to_elements, to_elements_kind,
3051                                 length, NULL);
3052     }
3053
3054     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
3055
3056     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
3057                                     Token::GT);
3058
3059     key = AddUncasted<HSub>(key, graph()->GetConstant1());
3060     key->ClearFlag(HValue::kCanOverflow);
3061
3062     HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr,
3063                                       from_elements_kind, ALLOW_RETURN_HOLE);
3064
3065     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
3066                          IsFastSmiElementsKind(to_elements_kind))
3067       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
3068
3069     if (IsHoleyElementsKind(from_elements_kind) &&
3070         from_elements_kind != to_elements_kind) {
3071       IfBuilder if_hole(this);
3072       if_hole.If<HCompareHoleAndBranch>(element);
3073       if_hole.Then();
3074       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
3075                                      ? Add<HConstant>(HConstant::kHoleNaN)
3076                                      : graph()->GetConstantHole();
3077       Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
3078       if_hole.Else();
3079       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3080       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3081       if_hole.End();
3082     } else {
3083       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3084       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3085     }
3086
3087     builder.EndBody();
3088   }
3089
3090   Counters* counters = isolate()->counters();
3091   AddIncrementCounter(counters->inlined_copied_elements());
3092 }
3093
3094
3095 HValue* HGraphBuilder::BuildCloneShallowArrayCow(HValue* boilerplate,
3096                                                  HValue* allocation_site,
3097                                                  AllocationSiteMode mode,
3098                                                  ElementsKind kind) {
3099   HAllocate* array = AllocateJSArrayObject(mode);
3100
3101   HValue* map = AddLoadMap(boilerplate);
3102   HValue* elements = AddLoadElements(boilerplate);
3103   HValue* length = AddLoadArrayLength(boilerplate, kind);
3104
3105   BuildJSArrayHeader(array,
3106                      map,
3107                      elements,
3108                      mode,
3109                      FAST_ELEMENTS,
3110                      allocation_site,
3111                      length);
3112   return array;
3113 }
3114
3115
3116 HValue* HGraphBuilder::BuildCloneShallowArrayEmpty(HValue* boilerplate,
3117                                                    HValue* allocation_site,
3118                                                    AllocationSiteMode mode) {
3119   HAllocate* array = AllocateJSArrayObject(mode);
3120
3121   HValue* map = AddLoadMap(boilerplate);
3122
3123   BuildJSArrayHeader(array,
3124                      map,
3125                      NULL,  // set elements to empty fixed array
3126                      mode,
3127                      FAST_ELEMENTS,
3128                      allocation_site,
3129                      graph()->GetConstant0());
3130   return array;
3131 }
3132
3133
3134 HValue* HGraphBuilder::BuildCloneShallowArrayNonEmpty(HValue* boilerplate,
3135                                                       HValue* allocation_site,
3136                                                       AllocationSiteMode mode,
3137                                                       ElementsKind kind) {
3138   HValue* boilerplate_elements = AddLoadElements(boilerplate);
3139   HValue* capacity = AddLoadFixedArrayLength(boilerplate_elements);
3140
3141   // Generate size calculation code here in order to make it dominate
3142   // the JSArray allocation.
3143   HValue* elements_size = BuildCalculateElementsSize(kind, capacity);
3144
3145   // Create empty JSArray object for now, store elimination should remove
3146   // redundant initialization of elements and length fields and at the same
3147   // time the object will be fully prepared for GC if it happens during
3148   // elements allocation.
3149   HValue* result = BuildCloneShallowArrayEmpty(
3150       boilerplate, allocation_site, mode);
3151
3152   HAllocate* elements = BuildAllocateElements(kind, elements_size);
3153
3154   // This function implicitly relies on the fact that the
3155   // FastCloneShallowArrayStub is called only for literals shorter than
3156   // JSObject::kInitialMaxFastElementArray.
3157   // Can't add HBoundsCheck here because otherwise the stub will eager a frame.
3158   HConstant* size_upper_bound = EstablishElementsAllocationSize(
3159       kind, JSObject::kInitialMaxFastElementArray);
3160   elements->set_size_upper_bound(size_upper_bound);
3161
3162   Add<HStoreNamedField>(result, HObjectAccess::ForElementsPointer(), elements);
3163
3164   // The allocation for the cloned array above causes register pressure on
3165   // machines with low register counts. Force a reload of the boilerplate
3166   // elements here to free up a register for the allocation to avoid unnecessary
3167   // spillage.
3168   boilerplate_elements = AddLoadElements(boilerplate);
3169   boilerplate_elements->SetFlag(HValue::kCantBeReplaced);
3170
3171   // Copy the elements array header.
3172   for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
3173     HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
3174     Add<HStoreNamedField>(
3175         elements, access,
3176         Add<HLoadNamedField>(boilerplate_elements, nullptr, access));
3177   }
3178
3179   // And the result of the length
3180   HValue* length = AddLoadArrayLength(boilerplate, kind);
3181   Add<HStoreNamedField>(result, HObjectAccess::ForArrayLength(kind), length);
3182
3183   BuildCopyElements(boilerplate_elements, kind, elements,
3184                     kind, length, NULL);
3185   return result;
3186 }
3187
3188
3189 void HGraphBuilder::BuildCompareNil(HValue* value, Type* type,
3190                                     HIfContinuation* continuation,
3191                                     MapEmbedding map_embedding) {
3192   IfBuilder if_nil(this);
3193   bool some_case_handled = false;
3194   bool some_case_missing = false;
3195
3196   if (type->Maybe(Type::Null())) {
3197     if (some_case_handled) if_nil.Or();
3198     if_nil.If<HCompareObjectEqAndBranch>(value, graph()->GetConstantNull());
3199     some_case_handled = true;
3200   } else {
3201     some_case_missing = true;
3202   }
3203
3204   if (type->Maybe(Type::Undefined())) {
3205     if (some_case_handled) if_nil.Or();
3206     if_nil.If<HCompareObjectEqAndBranch>(value,
3207                                          graph()->GetConstantUndefined());
3208     some_case_handled = true;
3209   } else {
3210     some_case_missing = true;
3211   }
3212
3213   if (type->Maybe(Type::Undetectable())) {
3214     if (some_case_handled) if_nil.Or();
3215     if_nil.If<HIsUndetectableAndBranch>(value);
3216     some_case_handled = true;
3217   } else {
3218     some_case_missing = true;
3219   }
3220
3221   if (some_case_missing) {
3222     if_nil.Then();
3223     if_nil.Else();
3224     if (type->NumClasses() == 1) {
3225       BuildCheckHeapObject(value);
3226       // For ICs, the map checked below is a sentinel map that gets replaced by
3227       // the monomorphic map when the code is used as a template to generate a
3228       // new IC. For optimized functions, there is no sentinel map, the map
3229       // emitted below is the actual monomorphic map.
3230       if (map_embedding == kEmbedMapsViaWeakCells) {
3231         HValue* cell =
3232             Add<HConstant>(Map::WeakCellForMap(type->Classes().Current()));
3233         HValue* expected_map = Add<HLoadNamedField>(
3234             cell, nullptr, HObjectAccess::ForWeakCellValue());
3235         HValue* map =
3236             Add<HLoadNamedField>(value, nullptr, HObjectAccess::ForMap());
3237         IfBuilder map_check(this);
3238         map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
3239         map_check.ThenDeopt(Deoptimizer::kUnknownMap);
3240         map_check.End();
3241       } else {
3242         DCHECK(map_embedding == kEmbedMapsDirectly);
3243         Add<HCheckMaps>(value, type->Classes().Current());
3244       }
3245     } else {
3246       if_nil.Deopt(Deoptimizer::kTooManyUndetectableTypes);
3247     }
3248   }
3249
3250   if_nil.CaptureContinuation(continuation);
3251 }
3252
3253
3254 void HGraphBuilder::BuildCreateAllocationMemento(
3255     HValue* previous_object,
3256     HValue* previous_object_size,
3257     HValue* allocation_site) {
3258   DCHECK(allocation_site != NULL);
3259   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
3260       previous_object, previous_object_size, HType::HeapObject());
3261   AddStoreMapConstant(
3262       allocation_memento, isolate()->factory()->allocation_memento_map());
3263   Add<HStoreNamedField>(
3264       allocation_memento,
3265       HObjectAccess::ForAllocationMementoSite(),
3266       allocation_site);
3267   if (FLAG_allocation_site_pretenuring) {
3268     HValue* memento_create_count =
3269         Add<HLoadNamedField>(allocation_site, nullptr,
3270                              HObjectAccess::ForAllocationSiteOffset(
3271                                  AllocationSite::kPretenureCreateCountOffset));
3272     memento_create_count = AddUncasted<HAdd>(
3273         memento_create_count, graph()->GetConstant1());
3274     // This smi value is reset to zero after every gc, overflow isn't a problem
3275     // since the counter is bounded by the new space size.
3276     memento_create_count->ClearFlag(HValue::kCanOverflow);
3277     Add<HStoreNamedField>(
3278         allocation_site, HObjectAccess::ForAllocationSiteOffset(
3279             AllocationSite::kPretenureCreateCountOffset), memento_create_count);
3280   }
3281 }
3282
3283
3284 HInstruction* HGraphBuilder::BuildGetNativeContext() {
3285   // Get the global object, then the native context
3286   HValue* global_object = Add<HLoadNamedField>(
3287       context(), nullptr,
3288       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3289   return Add<HLoadNamedField>(global_object, nullptr,
3290                               HObjectAccess::ForObservableJSObjectOffset(
3291                                   GlobalObject::kNativeContextOffset));
3292 }
3293
3294
3295 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
3296   // Get the global object, then the native context
3297   HInstruction* context = Add<HLoadNamedField>(
3298       closure, nullptr, HObjectAccess::ForFunctionContextPointer());
3299   HInstruction* global_object = Add<HLoadNamedField>(
3300       context, nullptr,
3301       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3302   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3303       GlobalObject::kNativeContextOffset);
3304   return Add<HLoadNamedField>(global_object, nullptr, access);
3305 }
3306
3307
3308 HInstruction* HGraphBuilder::BuildGetScriptContext(int context_index) {
3309   HValue* native_context = BuildGetNativeContext();
3310   HValue* script_context_table = Add<HLoadNamedField>(
3311       native_context, nullptr,
3312       HObjectAccess::ForContextSlot(Context::SCRIPT_CONTEXT_TABLE_INDEX));
3313   return Add<HLoadNamedField>(script_context_table, nullptr,
3314                               HObjectAccess::ForScriptContext(context_index));
3315 }
3316
3317
3318 HValue* HGraphBuilder::BuildGetParentContext(HValue* depth, int depth_value) {
3319   HValue* script_context = context();
3320   if (depth != NULL) {
3321     HValue* zero = graph()->GetConstant0();
3322
3323     Push(script_context);
3324     Push(depth);
3325
3326     LoopBuilder loop(this);
3327     loop.BeginBody(2);  // Drop script_context and depth from last environment
3328                         // to appease live range building without simulates.
3329     depth = Pop();
3330     script_context = Pop();
3331
3332     script_context = Add<HLoadNamedField>(
3333         script_context, nullptr,
3334         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3335     depth = AddUncasted<HSub>(depth, graph()->GetConstant1());
3336     depth->ClearFlag(HValue::kCanOverflow);
3337
3338     IfBuilder if_break(this);
3339     if_break.If<HCompareNumericAndBranch, HValue*>(depth, zero, Token::EQ);
3340     if_break.Then();
3341     {
3342       Push(script_context);  // The result.
3343       loop.Break();
3344     }
3345     if_break.Else();
3346     {
3347       Push(script_context);
3348       Push(depth);
3349     }
3350     loop.EndBody();
3351     if_break.End();
3352
3353     script_context = Pop();
3354   } else if (depth_value > 0) {
3355     // Unroll the above loop.
3356     for (int i = 0; i < depth_value; i++) {
3357       script_context = Add<HLoadNamedField>(
3358           script_context, nullptr,
3359           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3360     }
3361   }
3362   return script_context;
3363 }
3364
3365
3366 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
3367   HInstruction* native_context = BuildGetNativeContext();
3368   HInstruction* index =
3369       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
3370   return Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3371 }
3372
3373
3374 HValue* HGraphBuilder::BuildArrayBufferViewFieldAccessor(HValue* object,
3375                                                          HValue* checked_object,
3376                                                          FieldIndex index) {
3377   NoObservableSideEffectsScope scope(this);
3378   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3379       index.offset(), Representation::Tagged());
3380   HInstruction* buffer = Add<HLoadNamedField>(
3381       object, checked_object, HObjectAccess::ForJSArrayBufferViewBuffer());
3382   HInstruction* field = Add<HLoadNamedField>(object, checked_object, access);
3383
3384   HInstruction* flags = Add<HLoadNamedField>(
3385       buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
3386   HValue* was_neutered_mask =
3387       Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
3388   HValue* was_neutered_test =
3389       AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
3390
3391   IfBuilder if_was_neutered(this);
3392   if_was_neutered.If<HCompareNumericAndBranch>(
3393       was_neutered_test, graph()->GetConstant0(), Token::NE);
3394   if_was_neutered.Then();
3395   Push(graph()->GetConstant0());
3396   if_was_neutered.Else();
3397   Push(field);
3398   if_was_neutered.End();
3399
3400   return Pop();
3401 }
3402
3403
3404 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3405     ElementsKind kind,
3406     HValue* allocation_site_payload,
3407     HValue* constructor_function,
3408     AllocationSiteOverrideMode override_mode) :
3409         builder_(builder),
3410         kind_(kind),
3411         allocation_site_payload_(allocation_site_payload),
3412         constructor_function_(constructor_function) {
3413   DCHECK(!allocation_site_payload->IsConstant() ||
3414          HConstant::cast(allocation_site_payload)->handle(
3415              builder_->isolate())->IsAllocationSite());
3416   mode_ = override_mode == DISABLE_ALLOCATION_SITES
3417       ? DONT_TRACK_ALLOCATION_SITE
3418       : AllocationSite::GetMode(kind);
3419 }
3420
3421
3422 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3423                                               ElementsKind kind,
3424                                               HValue* constructor_function) :
3425     builder_(builder),
3426     kind_(kind),
3427     mode_(DONT_TRACK_ALLOCATION_SITE),
3428     allocation_site_payload_(NULL),
3429     constructor_function_(constructor_function) {
3430 }
3431
3432
3433 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode() {
3434   if (!builder()->top_info()->IsStub()) {
3435     // A constant map is fine.
3436     Handle<Map> map(builder()->isolate()->get_initial_js_array_map(kind_),
3437                     builder()->isolate());
3438     return builder()->Add<HConstant>(map);
3439   }
3440
3441   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
3442     // No need for a context lookup if the kind_ matches the initial
3443     // map, because we can just load the map in that case.
3444     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3445     return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3446                                            access);
3447   }
3448
3449   // TODO(mvstanton): we should always have a constructor function if we
3450   // are creating a stub.
3451   HInstruction* native_context = constructor_function_ != NULL
3452       ? builder()->BuildGetNativeContext(constructor_function_)
3453       : builder()->BuildGetNativeContext();
3454
3455   HInstruction* index = builder()->Add<HConstant>(
3456       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
3457
3458   HInstruction* map_array =
3459       builder()->Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3460
3461   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
3462
3463   return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr,
3464                                     FAST_ELEMENTS);
3465 }
3466
3467
3468 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
3469   // Find the map near the constructor function
3470   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3471   return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3472                                          access);
3473 }
3474
3475
3476 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
3477   HConstant* capacity = builder()->Add<HConstant>(initial_capacity());
3478   return AllocateArray(capacity,
3479                        capacity,
3480                        builder()->graph()->GetConstant0());
3481 }
3482
3483
3484 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3485     HValue* capacity,
3486     HConstant* capacity_upper_bound,
3487     HValue* length_field,
3488     FillMode fill_mode) {
3489   return AllocateArray(capacity,
3490                        capacity_upper_bound->GetInteger32Constant(),
3491                        length_field,
3492                        fill_mode);
3493 }
3494
3495
3496 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3497     HValue* capacity,
3498     int capacity_upper_bound,
3499     HValue* length_field,
3500     FillMode fill_mode) {
3501   HConstant* elememts_size_upper_bound = capacity->IsInteger32Constant()
3502       ? HConstant::cast(capacity)
3503       : builder()->EstablishElementsAllocationSize(kind_, capacity_upper_bound);
3504
3505   HAllocate* array = AllocateArray(capacity, length_field, fill_mode);
3506   if (!elements_location_->has_size_upper_bound()) {
3507     elements_location_->set_size_upper_bound(elememts_size_upper_bound);
3508   }
3509   return array;
3510 }
3511
3512
3513 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3514     HValue* capacity,
3515     HValue* length_field,
3516     FillMode fill_mode) {
3517   // These HForceRepresentations are because we store these as fields in the
3518   // objects we construct, and an int32-to-smi HChange could deopt. Accept
3519   // the deopt possibility now, before allocation occurs.
3520   capacity =
3521       builder()->AddUncasted<HForceRepresentation>(capacity,
3522                                                    Representation::Smi());
3523   length_field =
3524       builder()->AddUncasted<HForceRepresentation>(length_field,
3525                                                    Representation::Smi());
3526
3527   // Generate size calculation code here in order to make it dominate
3528   // the JSArray allocation.
3529   HValue* elements_size =
3530       builder()->BuildCalculateElementsSize(kind_, capacity);
3531
3532   // Allocate (dealing with failure appropriately)
3533   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
3534
3535   // Fill in the fields: map, properties, length
3536   HValue* map;
3537   if (allocation_site_payload_ == NULL) {
3538     map = EmitInternalMapCode();
3539   } else {
3540     map = EmitMapCode();
3541   }
3542
3543   builder()->BuildJSArrayHeader(array_object,
3544                                 map,
3545                                 NULL,  // set elements to empty fixed array
3546                                 mode_,
3547                                 kind_,
3548                                 allocation_site_payload_,
3549                                 length_field);
3550
3551   // Allocate and initialize the elements
3552   elements_location_ = builder()->BuildAllocateElements(kind_, elements_size);
3553
3554   builder()->BuildInitializeElementsHeader(elements_location_, kind_, capacity);
3555
3556   // Set the elements
3557   builder()->Add<HStoreNamedField>(
3558       array_object, HObjectAccess::ForElementsPointer(), elements_location_);
3559
3560   if (fill_mode == FILL_WITH_HOLE) {
3561     builder()->BuildFillElementsWithHole(elements_location_, kind_,
3562                                          graph()->GetConstant0(), capacity);
3563   }
3564
3565   return array_object;
3566 }
3567
3568
3569 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
3570   HValue* global_object = Add<HLoadNamedField>(
3571       context(), nullptr,
3572       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3573   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3574       GlobalObject::kBuiltinsOffset);
3575   HValue* builtins = Add<HLoadNamedField>(global_object, nullptr, access);
3576   HObjectAccess function_access = HObjectAccess::ForObservableJSObjectOffset(
3577           JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
3578   return Add<HLoadNamedField>(builtins, nullptr, function_access);
3579 }
3580
3581
3582 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
3583     : HGraphBuilder(info),
3584       function_state_(NULL),
3585       initial_function_state_(this, info, NORMAL_RETURN, 0),
3586       ast_context_(NULL),
3587       break_scope_(NULL),
3588       inlined_count_(0),
3589       globals_(10, info->zone()),
3590       osr_(new(info->zone()) HOsrBuilder(this)) {
3591   // This is not initialized in the initializer list because the
3592   // constructor for the initial state relies on function_state_ == NULL
3593   // to know it's the initial state.
3594   function_state_ = &initial_function_state_;
3595   InitializeAstVisitor(info->isolate(), info->zone());
3596   if (top_info()->is_tracking_positions()) {
3597     SetSourcePosition(info->shared_info()->start_position());
3598   }
3599 }
3600
3601
3602 HBasicBlock* HOptimizedGraphBuilder::CreateJoin(HBasicBlock* first,
3603                                                 HBasicBlock* second,
3604                                                 BailoutId join_id) {
3605   if (first == NULL) {
3606     return second;
3607   } else if (second == NULL) {
3608     return first;
3609   } else {
3610     HBasicBlock* join_block = graph()->CreateBasicBlock();
3611     Goto(first, join_block);
3612     Goto(second, join_block);
3613     join_block->SetJoinId(join_id);
3614     return join_block;
3615   }
3616 }
3617
3618
3619 HBasicBlock* HOptimizedGraphBuilder::JoinContinue(IterationStatement* statement,
3620                                                   HBasicBlock* exit_block,
3621                                                   HBasicBlock* continue_block) {
3622   if (continue_block != NULL) {
3623     if (exit_block != NULL) Goto(exit_block, continue_block);
3624     continue_block->SetJoinId(statement->ContinueId());
3625     return continue_block;
3626   }
3627   return exit_block;
3628 }
3629
3630
3631 HBasicBlock* HOptimizedGraphBuilder::CreateLoop(IterationStatement* statement,
3632                                                 HBasicBlock* loop_entry,
3633                                                 HBasicBlock* body_exit,
3634                                                 HBasicBlock* loop_successor,
3635                                                 HBasicBlock* break_block) {
3636   if (body_exit != NULL) Goto(body_exit, loop_entry);
3637   loop_entry->PostProcessLoopHeader(statement);
3638   if (break_block != NULL) {
3639     if (loop_successor != NULL) Goto(loop_successor, break_block);
3640     break_block->SetJoinId(statement->ExitId());
3641     return break_block;
3642   }
3643   return loop_successor;
3644 }
3645
3646
3647 // Build a new loop header block and set it as the current block.
3648 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry() {
3649   HBasicBlock* loop_entry = CreateLoopHeaderBlock();
3650   Goto(loop_entry);
3651   set_current_block(loop_entry);
3652   return loop_entry;
3653 }
3654
3655
3656 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry(
3657     IterationStatement* statement) {
3658   HBasicBlock* loop_entry = osr()->HasOsrEntryAt(statement)
3659       ? osr()->BuildOsrLoopEntry(statement)
3660       : BuildLoopEntry();
3661   return loop_entry;
3662 }
3663
3664
3665 void HBasicBlock::FinishExit(HControlInstruction* instruction,
3666                              SourcePosition position) {
3667   Finish(instruction, position);
3668   ClearEnvironment();
3669 }
3670
3671
3672 std::ostream& operator<<(std::ostream& os, const HBasicBlock& b) {
3673   return os << "B" << b.block_id();
3674 }
3675
3676
3677 HGraph::HGraph(CompilationInfo* info)
3678     : isolate_(info->isolate()),
3679       next_block_id_(0),
3680       entry_block_(NULL),
3681       blocks_(8, info->zone()),
3682       values_(16, info->zone()),
3683       phi_list_(NULL),
3684       uint32_instructions_(NULL),
3685       osr_(NULL),
3686       info_(info),
3687       zone_(info->zone()),
3688       is_recursive_(false),
3689       use_optimistic_licm_(false),
3690       depends_on_empty_array_proto_elements_(false),
3691       type_change_checksum_(0),
3692       maximum_environment_size_(0),
3693       no_side_effects_scope_count_(0),
3694       disallow_adding_new_values_(false) {
3695   if (info->IsStub()) {
3696     CallInterfaceDescriptor descriptor =
3697         info->code_stub()->GetCallInterfaceDescriptor();
3698     start_environment_ =
3699         new (zone_) HEnvironment(zone_, descriptor.GetRegisterParameterCount());
3700   } else {
3701     if (info->is_tracking_positions()) {
3702       info->TraceInlinedFunction(info->shared_info(), SourcePosition::Unknown(),
3703                                  InlinedFunctionInfo::kNoParentId);
3704     }
3705     start_environment_ =
3706         new(zone_) HEnvironment(NULL, info->scope(), info->closure(), zone_);
3707   }
3708   start_environment_->set_ast_id(BailoutId::FunctionEntry());
3709   entry_block_ = CreateBasicBlock();
3710   entry_block_->SetInitialEnvironment(start_environment_);
3711 }
3712
3713
3714 HBasicBlock* HGraph::CreateBasicBlock() {
3715   HBasicBlock* result = new(zone()) HBasicBlock(this);
3716   blocks_.Add(result, zone());
3717   return result;
3718 }
3719
3720
3721 void HGraph::FinalizeUniqueness() {
3722   DisallowHeapAllocation no_gc;
3723   for (int i = 0; i < blocks()->length(); ++i) {
3724     for (HInstructionIterator it(blocks()->at(i)); !it.Done(); it.Advance()) {
3725       it.Current()->FinalizeUniqueness();
3726     }
3727   }
3728 }
3729
3730
3731 int HGraph::SourcePositionToScriptPosition(SourcePosition pos) {
3732   return (FLAG_hydrogen_track_positions && !pos.IsUnknown())
3733              ? info()->start_position_for(pos.inlining_id()) + pos.position()
3734              : pos.raw();
3735 }
3736
3737
3738 // Block ordering was implemented with two mutually recursive methods,
3739 // HGraph::Postorder and HGraph::PostorderLoopBlocks.
3740 // The recursion could lead to stack overflow so the algorithm has been
3741 // implemented iteratively.
3742 // At a high level the algorithm looks like this:
3743 //
3744 // Postorder(block, loop_header) : {
3745 //   if (block has already been visited or is of another loop) return;
3746 //   mark block as visited;
3747 //   if (block is a loop header) {
3748 //     VisitLoopMembers(block, loop_header);
3749 //     VisitSuccessorsOfLoopHeader(block);
3750 //   } else {
3751 //     VisitSuccessors(block)
3752 //   }
3753 //   put block in result list;
3754 // }
3755 //
3756 // VisitLoopMembers(block, outer_loop_header) {
3757 //   foreach (block b in block loop members) {
3758 //     VisitSuccessorsOfLoopMember(b, outer_loop_header);
3759 //     if (b is loop header) VisitLoopMembers(b);
3760 //   }
3761 // }
3762 //
3763 // VisitSuccessorsOfLoopMember(block, outer_loop_header) {
3764 //   foreach (block b in block successors) Postorder(b, outer_loop_header)
3765 // }
3766 //
3767 // VisitSuccessorsOfLoopHeader(block) {
3768 //   foreach (block b in block successors) Postorder(b, block)
3769 // }
3770 //
3771 // VisitSuccessors(block, loop_header) {
3772 //   foreach (block b in block successors) Postorder(b, loop_header)
3773 // }
3774 //
3775 // The ordering is started calling Postorder(entry, NULL).
3776 //
3777 // Each instance of PostorderProcessor represents the "stack frame" of the
3778 // recursion, and particularly keeps the state of the loop (iteration) of the
3779 // "Visit..." function it represents.
3780 // To recycle memory we keep all the frames in a double linked list but
3781 // this means that we cannot use constructors to initialize the frames.
3782 //
3783 class PostorderProcessor : public ZoneObject {
3784  public:
3785   // Back link (towards the stack bottom).
3786   PostorderProcessor* parent() {return father_; }
3787   // Forward link (towards the stack top).
3788   PostorderProcessor* child() {return child_; }
3789   HBasicBlock* block() { return block_; }
3790   HLoopInformation* loop() { return loop_; }
3791   HBasicBlock* loop_header() { return loop_header_; }
3792
3793   static PostorderProcessor* CreateEntryProcessor(Zone* zone,
3794                                                   HBasicBlock* block) {
3795     PostorderProcessor* result = new(zone) PostorderProcessor(NULL);
3796     return result->SetupSuccessors(zone, block, NULL);
3797   }
3798
3799   PostorderProcessor* PerformStep(Zone* zone,
3800                                   ZoneList<HBasicBlock*>* order) {
3801     PostorderProcessor* next =
3802         PerformNonBacktrackingStep(zone, order);
3803     if (next != NULL) {
3804       return next;
3805     } else {
3806       return Backtrack(zone, order);
3807     }
3808   }
3809
3810  private:
3811   explicit PostorderProcessor(PostorderProcessor* father)
3812       : father_(father), child_(NULL), successor_iterator(NULL) { }
3813
3814   // Each enum value states the cycle whose state is kept by this instance.
3815   enum LoopKind {
3816     NONE,
3817     SUCCESSORS,
3818     SUCCESSORS_OF_LOOP_HEADER,
3819     LOOP_MEMBERS,
3820     SUCCESSORS_OF_LOOP_MEMBER
3821   };
3822
3823   // Each "Setup..." method is like a constructor for a cycle state.
3824   PostorderProcessor* SetupSuccessors(Zone* zone,
3825                                       HBasicBlock* block,
3826                                       HBasicBlock* loop_header) {
3827     if (block == NULL || block->IsOrdered() ||
3828         block->parent_loop_header() != loop_header) {
3829       kind_ = NONE;
3830       block_ = NULL;
3831       loop_ = NULL;
3832       loop_header_ = NULL;
3833       return this;
3834     } else {
3835       block_ = block;
3836       loop_ = NULL;
3837       block->MarkAsOrdered();
3838
3839       if (block->IsLoopHeader()) {
3840         kind_ = SUCCESSORS_OF_LOOP_HEADER;
3841         loop_header_ = block;
3842         InitializeSuccessors();
3843         PostorderProcessor* result = Push(zone);
3844         return result->SetupLoopMembers(zone, block, block->loop_information(),
3845                                         loop_header);
3846       } else {
3847         DCHECK(block->IsFinished());
3848         kind_ = SUCCESSORS;
3849         loop_header_ = loop_header;
3850         InitializeSuccessors();
3851         return this;
3852       }
3853     }
3854   }
3855
3856   PostorderProcessor* SetupLoopMembers(Zone* zone,
3857                                        HBasicBlock* block,
3858                                        HLoopInformation* loop,
3859                                        HBasicBlock* loop_header) {
3860     kind_ = LOOP_MEMBERS;
3861     block_ = block;
3862     loop_ = loop;
3863     loop_header_ = loop_header;
3864     InitializeLoopMembers();
3865     return this;
3866   }
3867
3868   PostorderProcessor* SetupSuccessorsOfLoopMember(
3869       HBasicBlock* block,
3870       HLoopInformation* loop,
3871       HBasicBlock* loop_header) {
3872     kind_ = SUCCESSORS_OF_LOOP_MEMBER;
3873     block_ = block;
3874     loop_ = loop;
3875     loop_header_ = loop_header;
3876     InitializeSuccessors();
3877     return this;
3878   }
3879
3880   // This method "allocates" a new stack frame.
3881   PostorderProcessor* Push(Zone* zone) {
3882     if (child_ == NULL) {
3883       child_ = new(zone) PostorderProcessor(this);
3884     }
3885     return child_;
3886   }
3887
3888   void ClosePostorder(ZoneList<HBasicBlock*>* order, Zone* zone) {
3889     DCHECK(block_->end()->FirstSuccessor() == NULL ||
3890            order->Contains(block_->end()->FirstSuccessor()) ||
3891            block_->end()->FirstSuccessor()->IsLoopHeader());
3892     DCHECK(block_->end()->SecondSuccessor() == NULL ||
3893            order->Contains(block_->end()->SecondSuccessor()) ||
3894            block_->end()->SecondSuccessor()->IsLoopHeader());
3895     order->Add(block_, zone);
3896   }
3897
3898   // This method is the basic block to walk up the stack.
3899   PostorderProcessor* Pop(Zone* zone,
3900                           ZoneList<HBasicBlock*>* order) {
3901     switch (kind_) {
3902       case SUCCESSORS:
3903       case SUCCESSORS_OF_LOOP_HEADER:
3904         ClosePostorder(order, zone);
3905         return father_;
3906       case LOOP_MEMBERS:
3907         return father_;
3908       case SUCCESSORS_OF_LOOP_MEMBER:
3909         if (block()->IsLoopHeader() && block() != loop_->loop_header()) {
3910           // In this case we need to perform a LOOP_MEMBERS cycle so we
3911           // initialize it and return this instead of father.
3912           return SetupLoopMembers(zone, block(),
3913                                   block()->loop_information(), loop_header_);
3914         } else {
3915           return father_;
3916         }
3917       case NONE:
3918         return father_;
3919     }
3920     UNREACHABLE();
3921     return NULL;
3922   }
3923
3924   // Walks up the stack.
3925   PostorderProcessor* Backtrack(Zone* zone,
3926                                 ZoneList<HBasicBlock*>* order) {
3927     PostorderProcessor* parent = Pop(zone, order);
3928     while (parent != NULL) {
3929       PostorderProcessor* next =
3930           parent->PerformNonBacktrackingStep(zone, order);
3931       if (next != NULL) {
3932         return next;
3933       } else {
3934         parent = parent->Pop(zone, order);
3935       }
3936     }
3937     return NULL;
3938   }
3939
3940   PostorderProcessor* PerformNonBacktrackingStep(
3941       Zone* zone,
3942       ZoneList<HBasicBlock*>* order) {
3943     HBasicBlock* next_block;
3944     switch (kind_) {
3945       case SUCCESSORS:
3946         next_block = AdvanceSuccessors();
3947         if (next_block != NULL) {
3948           PostorderProcessor* result = Push(zone);
3949           return result->SetupSuccessors(zone, next_block, loop_header_);
3950         }
3951         break;
3952       case SUCCESSORS_OF_LOOP_HEADER:
3953         next_block = AdvanceSuccessors();
3954         if (next_block != NULL) {
3955           PostorderProcessor* result = Push(zone);
3956           return result->SetupSuccessors(zone, next_block, block());
3957         }
3958         break;
3959       case LOOP_MEMBERS:
3960         next_block = AdvanceLoopMembers();
3961         if (next_block != NULL) {
3962           PostorderProcessor* result = Push(zone);
3963           return result->SetupSuccessorsOfLoopMember(next_block,
3964                                                      loop_, loop_header_);
3965         }
3966         break;
3967       case SUCCESSORS_OF_LOOP_MEMBER:
3968         next_block = AdvanceSuccessors();
3969         if (next_block != NULL) {
3970           PostorderProcessor* result = Push(zone);
3971           return result->SetupSuccessors(zone, next_block, loop_header_);
3972         }
3973         break;
3974       case NONE:
3975         return NULL;
3976     }
3977     return NULL;
3978   }
3979
3980   // The following two methods implement a "foreach b in successors" cycle.
3981   void InitializeSuccessors() {
3982     loop_index = 0;
3983     loop_length = 0;
3984     successor_iterator = HSuccessorIterator(block_->end());
3985   }
3986
3987   HBasicBlock* AdvanceSuccessors() {
3988     if (!successor_iterator.Done()) {
3989       HBasicBlock* result = successor_iterator.Current();
3990       successor_iterator.Advance();
3991       return result;
3992     }
3993     return NULL;
3994   }
3995
3996   // The following two methods implement a "foreach b in loop members" cycle.
3997   void InitializeLoopMembers() {
3998     loop_index = 0;
3999     loop_length = loop_->blocks()->length();
4000   }
4001
4002   HBasicBlock* AdvanceLoopMembers() {
4003     if (loop_index < loop_length) {
4004       HBasicBlock* result = loop_->blocks()->at(loop_index);
4005       loop_index++;
4006       return result;
4007     } else {
4008       return NULL;
4009     }
4010   }
4011
4012   LoopKind kind_;
4013   PostorderProcessor* father_;
4014   PostorderProcessor* child_;
4015   HLoopInformation* loop_;
4016   HBasicBlock* block_;
4017   HBasicBlock* loop_header_;
4018   int loop_index;
4019   int loop_length;
4020   HSuccessorIterator successor_iterator;
4021 };
4022
4023
4024 void HGraph::OrderBlocks() {
4025   CompilationPhase phase("H_Block ordering", info());
4026
4027 #ifdef DEBUG
4028   // Initially the blocks must not be ordered.
4029   for (int i = 0; i < blocks_.length(); ++i) {
4030     DCHECK(!blocks_[i]->IsOrdered());
4031   }
4032 #endif
4033
4034   PostorderProcessor* postorder =
4035       PostorderProcessor::CreateEntryProcessor(zone(), blocks_[0]);
4036   blocks_.Rewind(0);
4037   while (postorder) {
4038     postorder = postorder->PerformStep(zone(), &blocks_);
4039   }
4040
4041 #ifdef DEBUG
4042   // Now all blocks must be marked as ordered.
4043   for (int i = 0; i < blocks_.length(); ++i) {
4044     DCHECK(blocks_[i]->IsOrdered());
4045   }
4046 #endif
4047
4048   // Reverse block list and assign block IDs.
4049   for (int i = 0, j = blocks_.length(); --j >= i; ++i) {
4050     HBasicBlock* bi = blocks_[i];
4051     HBasicBlock* bj = blocks_[j];
4052     bi->set_block_id(j);
4053     bj->set_block_id(i);
4054     blocks_[i] = bj;
4055     blocks_[j] = bi;
4056   }
4057 }
4058
4059
4060 void HGraph::AssignDominators() {
4061   HPhase phase("H_Assign dominators", this);
4062   for (int i = 0; i < blocks_.length(); ++i) {
4063     HBasicBlock* block = blocks_[i];
4064     if (block->IsLoopHeader()) {
4065       // Only the first predecessor of a loop header is from outside the loop.
4066       // All others are back edges, and thus cannot dominate the loop header.
4067       block->AssignCommonDominator(block->predecessors()->first());
4068       block->AssignLoopSuccessorDominators();
4069     } else {
4070       for (int j = blocks_[i]->predecessors()->length() - 1; j >= 0; --j) {
4071         blocks_[i]->AssignCommonDominator(blocks_[i]->predecessors()->at(j));
4072       }
4073     }
4074   }
4075 }
4076
4077
4078 bool HGraph::CheckArgumentsPhiUses() {
4079   int block_count = blocks_.length();
4080   for (int i = 0; i < block_count; ++i) {
4081     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4082       HPhi* phi = blocks_[i]->phis()->at(j);
4083       // We don't support phi uses of arguments for now.
4084       if (phi->CheckFlag(HValue::kIsArguments)) return false;
4085     }
4086   }
4087   return true;
4088 }
4089
4090
4091 bool HGraph::CheckConstPhiUses() {
4092   int block_count = blocks_.length();
4093   for (int i = 0; i < block_count; ++i) {
4094     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4095       HPhi* phi = blocks_[i]->phis()->at(j);
4096       // Check for the hole value (from an uninitialized const).
4097       for (int k = 0; k < phi->OperandCount(); k++) {
4098         if (phi->OperandAt(k) == GetConstantHole()) return false;
4099       }
4100     }
4101   }
4102   return true;
4103 }
4104
4105
4106 void HGraph::CollectPhis() {
4107   int block_count = blocks_.length();
4108   phi_list_ = new(zone()) ZoneList<HPhi*>(block_count, zone());
4109   for (int i = 0; i < block_count; ++i) {
4110     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4111       HPhi* phi = blocks_[i]->phis()->at(j);
4112       phi_list_->Add(phi, zone());
4113     }
4114   }
4115 }
4116
4117
4118 // Implementation of utility class to encapsulate the translation state for
4119 // a (possibly inlined) function.
4120 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
4121                              CompilationInfo* info, InliningKind inlining_kind,
4122                              int inlining_id)
4123     : owner_(owner),
4124       compilation_info_(info),
4125       call_context_(NULL),
4126       inlining_kind_(inlining_kind),
4127       function_return_(NULL),
4128       test_context_(NULL),
4129       entry_(NULL),
4130       arguments_object_(NULL),
4131       arguments_elements_(NULL),
4132       inlining_id_(inlining_id),
4133       outer_source_position_(SourcePosition::Unknown()),
4134       outer_(owner->function_state()) {
4135   if (outer_ != NULL) {
4136     // State for an inline function.
4137     if (owner->ast_context()->IsTest()) {
4138       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
4139       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
4140       if_true->MarkAsInlineReturnTarget(owner->current_block());
4141       if_false->MarkAsInlineReturnTarget(owner->current_block());
4142       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
4143       Expression* cond = outer_test_context->condition();
4144       // The AstContext constructor pushed on the context stack.  This newed
4145       // instance is the reason that AstContext can't be BASE_EMBEDDED.
4146       test_context_ = new TestContext(owner, cond, if_true, if_false);
4147     } else {
4148       function_return_ = owner->graph()->CreateBasicBlock();
4149       function_return()->MarkAsInlineReturnTarget(owner->current_block());
4150     }
4151     // Set this after possibly allocating a new TestContext above.
4152     call_context_ = owner->ast_context();
4153   }
4154
4155   // Push on the state stack.
4156   owner->set_function_state(this);
4157
4158   if (compilation_info_->is_tracking_positions()) {
4159     outer_source_position_ = owner->source_position();
4160     owner->EnterInlinedSource(
4161       info->shared_info()->start_position(),
4162       inlining_id);
4163     owner->SetSourcePosition(info->shared_info()->start_position());
4164   }
4165 }
4166
4167
4168 FunctionState::~FunctionState() {
4169   delete test_context_;
4170   owner_->set_function_state(outer_);
4171
4172   if (compilation_info_->is_tracking_positions()) {
4173     owner_->set_source_position(outer_source_position_);
4174     owner_->EnterInlinedSource(
4175       outer_->compilation_info()->shared_info()->start_position(),
4176       outer_->inlining_id());
4177   }
4178 }
4179
4180
4181 // Implementation of utility classes to represent an expression's context in
4182 // the AST.
4183 AstContext::AstContext(HOptimizedGraphBuilder* owner, Expression::Context kind)
4184     : owner_(owner),
4185       kind_(kind),
4186       outer_(owner->ast_context()),
4187       typeof_mode_(NOT_INSIDE_TYPEOF) {
4188   owner->set_ast_context(this);  // Push.
4189 #ifdef DEBUG
4190   DCHECK(owner->environment()->frame_type() == JS_FUNCTION);
4191   original_length_ = owner->environment()->length();
4192 #endif
4193 }
4194
4195
4196 AstContext::~AstContext() {
4197   owner_->set_ast_context(outer_);  // Pop.
4198 }
4199
4200
4201 EffectContext::~EffectContext() {
4202   DCHECK(owner()->HasStackOverflow() ||
4203          owner()->current_block() == NULL ||
4204          (owner()->environment()->length() == original_length_ &&
4205           owner()->environment()->frame_type() == JS_FUNCTION));
4206 }
4207
4208
4209 ValueContext::~ValueContext() {
4210   DCHECK(owner()->HasStackOverflow() ||
4211          owner()->current_block() == NULL ||
4212          (owner()->environment()->length() == original_length_ + 1 &&
4213           owner()->environment()->frame_type() == JS_FUNCTION));
4214 }
4215
4216
4217 void EffectContext::ReturnValue(HValue* value) {
4218   // The value is simply ignored.
4219 }
4220
4221
4222 void ValueContext::ReturnValue(HValue* value) {
4223   // The value is tracked in the bailout environment, and communicated
4224   // through the environment as the result of the expression.
4225   if (value->CheckFlag(HValue::kIsArguments)) {
4226     if (flag_ == ARGUMENTS_FAKED) {
4227       value = owner()->graph()->GetConstantUndefined();
4228     } else if (!arguments_allowed()) {
4229       owner()->Bailout(kBadValueContextForArgumentsValue);
4230     }
4231   }
4232   owner()->Push(value);
4233 }
4234
4235
4236 void TestContext::ReturnValue(HValue* value) {
4237   BuildBranch(value);
4238 }
4239
4240
4241 void EffectContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4242   DCHECK(!instr->IsControlInstruction());
4243   owner()->AddInstruction(instr);
4244   if (instr->HasObservableSideEffects()) {
4245     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4246   }
4247 }
4248
4249
4250 void EffectContext::ReturnControl(HControlInstruction* instr,
4251                                   BailoutId ast_id) {
4252   DCHECK(!instr->HasObservableSideEffects());
4253   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4254   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4255   instr->SetSuccessorAt(0, empty_true);
4256   instr->SetSuccessorAt(1, empty_false);
4257   owner()->FinishCurrentBlock(instr);
4258   HBasicBlock* join = owner()->CreateJoin(empty_true, empty_false, ast_id);
4259   owner()->set_current_block(join);
4260 }
4261
4262
4263 void EffectContext::ReturnContinuation(HIfContinuation* continuation,
4264                                        BailoutId ast_id) {
4265   HBasicBlock* true_branch = NULL;
4266   HBasicBlock* false_branch = NULL;
4267   continuation->Continue(&true_branch, &false_branch);
4268   if (!continuation->IsTrueReachable()) {
4269     owner()->set_current_block(false_branch);
4270   } else if (!continuation->IsFalseReachable()) {
4271     owner()->set_current_block(true_branch);
4272   } else {
4273     HBasicBlock* join = owner()->CreateJoin(true_branch, false_branch, ast_id);
4274     owner()->set_current_block(join);
4275   }
4276 }
4277
4278
4279 void ValueContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4280   DCHECK(!instr->IsControlInstruction());
4281   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4282     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4283   }
4284   owner()->AddInstruction(instr);
4285   owner()->Push(instr);
4286   if (instr->HasObservableSideEffects()) {
4287     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4288   }
4289 }
4290
4291
4292 void ValueContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4293   DCHECK(!instr->HasObservableSideEffects());
4294   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4295     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4296   }
4297   HBasicBlock* materialize_false = owner()->graph()->CreateBasicBlock();
4298   HBasicBlock* materialize_true = owner()->graph()->CreateBasicBlock();
4299   instr->SetSuccessorAt(0, materialize_true);
4300   instr->SetSuccessorAt(1, materialize_false);
4301   owner()->FinishCurrentBlock(instr);
4302   owner()->set_current_block(materialize_true);
4303   owner()->Push(owner()->graph()->GetConstantTrue());
4304   owner()->set_current_block(materialize_false);
4305   owner()->Push(owner()->graph()->GetConstantFalse());
4306   HBasicBlock* join =
4307     owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4308   owner()->set_current_block(join);
4309 }
4310
4311
4312 void ValueContext::ReturnContinuation(HIfContinuation* continuation,
4313                                       BailoutId ast_id) {
4314   HBasicBlock* materialize_true = NULL;
4315   HBasicBlock* materialize_false = NULL;
4316   continuation->Continue(&materialize_true, &materialize_false);
4317   if (continuation->IsTrueReachable()) {
4318     owner()->set_current_block(materialize_true);
4319     owner()->Push(owner()->graph()->GetConstantTrue());
4320     owner()->set_current_block(materialize_true);
4321   }
4322   if (continuation->IsFalseReachable()) {
4323     owner()->set_current_block(materialize_false);
4324     owner()->Push(owner()->graph()->GetConstantFalse());
4325     owner()->set_current_block(materialize_false);
4326   }
4327   if (continuation->TrueAndFalseReachable()) {
4328     HBasicBlock* join =
4329         owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4330     owner()->set_current_block(join);
4331   }
4332 }
4333
4334
4335 void TestContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4336   DCHECK(!instr->IsControlInstruction());
4337   HOptimizedGraphBuilder* builder = owner();
4338   builder->AddInstruction(instr);
4339   // We expect a simulate after every expression with side effects, though
4340   // this one isn't actually needed (and wouldn't work if it were targeted).
4341   if (instr->HasObservableSideEffects()) {
4342     builder->Push(instr);
4343     builder->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4344     builder->Pop();
4345   }
4346   BuildBranch(instr);
4347 }
4348
4349
4350 void TestContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4351   DCHECK(!instr->HasObservableSideEffects());
4352   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4353   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4354   instr->SetSuccessorAt(0, empty_true);
4355   instr->SetSuccessorAt(1, empty_false);
4356   owner()->FinishCurrentBlock(instr);
4357   owner()->Goto(empty_true, if_true(), owner()->function_state());
4358   owner()->Goto(empty_false, if_false(), owner()->function_state());
4359   owner()->set_current_block(NULL);
4360 }
4361
4362
4363 void TestContext::ReturnContinuation(HIfContinuation* continuation,
4364                                      BailoutId ast_id) {
4365   HBasicBlock* true_branch = NULL;
4366   HBasicBlock* false_branch = NULL;
4367   continuation->Continue(&true_branch, &false_branch);
4368   if (continuation->IsTrueReachable()) {
4369     owner()->Goto(true_branch, if_true(), owner()->function_state());
4370   }
4371   if (continuation->IsFalseReachable()) {
4372     owner()->Goto(false_branch, if_false(), owner()->function_state());
4373   }
4374   owner()->set_current_block(NULL);
4375 }
4376
4377
4378 void TestContext::BuildBranch(HValue* value) {
4379   // We expect the graph to be in edge-split form: there is no edge that
4380   // connects a branch node to a join node.  We conservatively ensure that
4381   // property by always adding an empty block on the outgoing edges of this
4382   // branch.
4383   HOptimizedGraphBuilder* builder = owner();
4384   if (value != NULL && value->CheckFlag(HValue::kIsArguments)) {
4385     builder->Bailout(kArgumentsObjectValueInATestContext);
4386   }
4387   ToBooleanStub::Types expected(condition()->to_boolean_types());
4388   ReturnControl(owner()->New<HBranch>(value, expected), BailoutId::None());
4389 }
4390
4391
4392 // HOptimizedGraphBuilder infrastructure for bailing out and checking bailouts.
4393 #define CHECK_BAILOUT(call)                     \
4394   do {                                          \
4395     call;                                       \
4396     if (HasStackOverflow()) return;             \
4397   } while (false)
4398
4399
4400 #define CHECK_ALIVE(call)                                       \
4401   do {                                                          \
4402     call;                                                       \
4403     if (HasStackOverflow() || current_block() == NULL) return;  \
4404   } while (false)
4405
4406
4407 #define CHECK_ALIVE_OR_RETURN(call, value)                            \
4408   do {                                                                \
4409     call;                                                             \
4410     if (HasStackOverflow() || current_block() == NULL) return value;  \
4411   } while (false)
4412
4413
4414 void HOptimizedGraphBuilder::Bailout(BailoutReason reason) {
4415   current_info()->AbortOptimization(reason);
4416   SetStackOverflow();
4417 }
4418
4419
4420 void HOptimizedGraphBuilder::VisitForEffect(Expression* expr) {
4421   EffectContext for_effect(this);
4422   Visit(expr);
4423 }
4424
4425
4426 void HOptimizedGraphBuilder::VisitForValue(Expression* expr,
4427                                            ArgumentsAllowedFlag flag) {
4428   ValueContext for_value(this, flag);
4429   Visit(expr);
4430 }
4431
4432
4433 void HOptimizedGraphBuilder::VisitForTypeOf(Expression* expr) {
4434   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
4435   for_value.set_typeof_mode(INSIDE_TYPEOF);
4436   Visit(expr);
4437 }
4438
4439
4440 void HOptimizedGraphBuilder::VisitForControl(Expression* expr,
4441                                              HBasicBlock* true_block,
4442                                              HBasicBlock* false_block) {
4443   TestContext for_test(this, expr, true_block, false_block);
4444   Visit(expr);
4445 }
4446
4447
4448 void HOptimizedGraphBuilder::VisitExpressions(
4449     ZoneList<Expression*>* exprs) {
4450   for (int i = 0; i < exprs->length(); ++i) {
4451     CHECK_ALIVE(VisitForValue(exprs->at(i)));
4452   }
4453 }
4454
4455
4456 void HOptimizedGraphBuilder::VisitExpressions(ZoneList<Expression*>* exprs,
4457                                               ArgumentsAllowedFlag flag) {
4458   for (int i = 0; i < exprs->length(); ++i) {
4459     CHECK_ALIVE(VisitForValue(exprs->at(i), flag));
4460   }
4461 }
4462
4463
4464 bool HOptimizedGraphBuilder::BuildGraph() {
4465   if (IsSubclassConstructor(current_info()->function()->kind())) {
4466     Bailout(kSuperReference);
4467     return false;
4468   }
4469
4470   int slots = current_info()->num_heap_slots() - Context::MIN_CONTEXT_SLOTS;
4471   if (current_info()->scope()->is_script_scope() && slots > 0) {
4472     Bailout(kScriptContext);
4473     return false;
4474   }
4475
4476   Scope* scope = current_info()->scope();
4477   SetUpScope(scope);
4478
4479   // Add an edge to the body entry.  This is warty: the graph's start
4480   // environment will be used by the Lithium translation as the initial
4481   // environment on graph entry, but it has now been mutated by the
4482   // Hydrogen translation of the instructions in the start block.  This
4483   // environment uses values which have not been defined yet.  These
4484   // Hydrogen instructions will then be replayed by the Lithium
4485   // translation, so they cannot have an environment effect.  The edge to
4486   // the body's entry block (along with some special logic for the start
4487   // block in HInstruction::InsertAfter) seals the start block from
4488   // getting unwanted instructions inserted.
4489   //
4490   // TODO(kmillikin): Fix this.  Stop mutating the initial environment.
4491   // Make the Hydrogen instructions in the initial block into Hydrogen
4492   // values (but not instructions), present in the initial environment and
4493   // not replayed by the Lithium translation.
4494   HEnvironment* initial_env = environment()->CopyWithoutHistory();
4495   HBasicBlock* body_entry = CreateBasicBlock(initial_env);
4496   Goto(body_entry);
4497   body_entry->SetJoinId(BailoutId::FunctionEntry());
4498   set_current_block(body_entry);
4499
4500   VisitDeclarations(scope->declarations());
4501   Add<HSimulate>(BailoutId::Declarations());
4502
4503   Add<HStackCheck>(HStackCheck::kFunctionEntry);
4504
4505   VisitStatements(current_info()->function()->body());
4506   if (HasStackOverflow()) return false;
4507
4508   if (current_block() != NULL) {
4509     Add<HReturn>(graph()->GetConstantUndefined());
4510     set_current_block(NULL);
4511   }
4512
4513   // If the checksum of the number of type info changes is the same as the
4514   // last time this function was compiled, then this recompile is likely not
4515   // due to missing/inadequate type feedback, but rather too aggressive
4516   // optimization. Disable optimistic LICM in that case.
4517   Handle<Code> unoptimized_code(current_info()->shared_info()->code());
4518   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
4519   Handle<TypeFeedbackInfo> type_info(
4520       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
4521   int checksum = type_info->own_type_change_checksum();
4522   int composite_checksum = graph()->update_type_change_checksum(checksum);
4523   graph()->set_use_optimistic_licm(
4524       !type_info->matches_inlined_type_change_checksum(composite_checksum));
4525   type_info->set_inlined_type_change_checksum(composite_checksum);
4526
4527   // Perform any necessary OSR-specific cleanups or changes to the graph.
4528   osr()->FinishGraph();
4529
4530   return true;
4531 }
4532
4533
4534 bool HGraph::Optimize(BailoutReason* bailout_reason) {
4535   OrderBlocks();
4536   AssignDominators();
4537
4538   // We need to create a HConstant "zero" now so that GVN will fold every
4539   // zero-valued constant in the graph together.
4540   // The constant is needed to make idef-based bounds check work: the pass
4541   // evaluates relations with "zero" and that zero cannot be created after GVN.
4542   GetConstant0();
4543
4544 #ifdef DEBUG
4545   // Do a full verify after building the graph and computing dominators.
4546   Verify(true);
4547 #endif
4548
4549   if (FLAG_analyze_environment_liveness && maximum_environment_size() != 0) {
4550     Run<HEnvironmentLivenessAnalysisPhase>();
4551   }
4552
4553   if (!CheckConstPhiUses()) {
4554     *bailout_reason = kUnsupportedPhiUseOfConstVariable;
4555     return false;
4556   }
4557   Run<HRedundantPhiEliminationPhase>();
4558   if (!CheckArgumentsPhiUses()) {
4559     *bailout_reason = kUnsupportedPhiUseOfArguments;
4560     return false;
4561   }
4562
4563   // Find and mark unreachable code to simplify optimizations, especially gvn,
4564   // where unreachable code could unnecessarily defeat LICM.
4565   Run<HMarkUnreachableBlocksPhase>();
4566
4567   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4568   if (FLAG_use_escape_analysis) Run<HEscapeAnalysisPhase>();
4569
4570   if (FLAG_load_elimination) Run<HLoadEliminationPhase>();
4571
4572   CollectPhis();
4573
4574   if (has_osr()) osr()->FinishOsrValues();
4575
4576   Run<HInferRepresentationPhase>();
4577
4578   // Remove HSimulate instructions that have turned out not to be needed
4579   // after all by folding them into the following HSimulate.
4580   // This must happen after inferring representations.
4581   Run<HMergeRemovableSimulatesPhase>();
4582
4583   Run<HMarkDeoptimizeOnUndefinedPhase>();
4584   Run<HRepresentationChangesPhase>();
4585
4586   Run<HInferTypesPhase>();
4587
4588   // Must be performed before canonicalization to ensure that Canonicalize
4589   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
4590   // zero.
4591   Run<HUint32AnalysisPhase>();
4592
4593   if (FLAG_use_canonicalizing) Run<HCanonicalizePhase>();
4594
4595   if (FLAG_use_gvn) Run<HGlobalValueNumberingPhase>();
4596
4597   if (FLAG_check_elimination) Run<HCheckEliminationPhase>();
4598
4599   if (FLAG_store_elimination) Run<HStoreEliminationPhase>();
4600
4601   Run<HRangeAnalysisPhase>();
4602
4603   Run<HComputeChangeUndefinedToNaN>();
4604
4605   // Eliminate redundant stack checks on backwards branches.
4606   Run<HStackCheckEliminationPhase>();
4607
4608   if (FLAG_array_bounds_checks_elimination) Run<HBoundsCheckEliminationPhase>();
4609   if (FLAG_array_bounds_checks_hoisting) Run<HBoundsCheckHoistingPhase>();
4610   if (FLAG_array_index_dehoisting) Run<HDehoistIndexComputationsPhase>();
4611   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4612
4613   RestoreActualValues();
4614
4615   // Find unreachable code a second time, GVN and other optimizations may have
4616   // made blocks unreachable that were previously reachable.
4617   Run<HMarkUnreachableBlocksPhase>();
4618
4619   return true;
4620 }
4621
4622
4623 void HGraph::RestoreActualValues() {
4624   HPhase phase("H_Restore actual values", this);
4625
4626   for (int block_index = 0; block_index < blocks()->length(); block_index++) {
4627     HBasicBlock* block = blocks()->at(block_index);
4628
4629 #ifdef DEBUG
4630     for (int i = 0; i < block->phis()->length(); i++) {
4631       HPhi* phi = block->phis()->at(i);
4632       DCHECK(phi->ActualValue() == phi);
4633     }
4634 #endif
4635
4636     for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
4637       HInstruction* instruction = it.Current();
4638       if (instruction->ActualValue() == instruction) continue;
4639       if (instruction->CheckFlag(HValue::kIsDead)) {
4640         // The instruction was marked as deleted but left in the graph
4641         // as a control flow dependency point for subsequent
4642         // instructions.
4643         instruction->DeleteAndReplaceWith(instruction->ActualValue());
4644       } else {
4645         DCHECK(instruction->IsInformativeDefinition());
4646         if (instruction->IsPurelyInformativeDefinition()) {
4647           instruction->DeleteAndReplaceWith(instruction->RedefinedOperand());
4648         } else {
4649           instruction->ReplaceAllUsesWith(instruction->ActualValue());
4650         }
4651       }
4652     }
4653   }
4654 }
4655
4656
4657 void HOptimizedGraphBuilder::PushArgumentsFromEnvironment(int count) {
4658   ZoneList<HValue*> arguments(count, zone());
4659   for (int i = 0; i < count; ++i) {
4660     arguments.Add(Pop(), zone());
4661   }
4662
4663   HPushArguments* push_args = New<HPushArguments>();
4664   while (!arguments.is_empty()) {
4665     push_args->AddInput(arguments.RemoveLast());
4666   }
4667   AddInstruction(push_args);
4668 }
4669
4670
4671 template <class Instruction>
4672 HInstruction* HOptimizedGraphBuilder::PreProcessCall(Instruction* call) {
4673   PushArgumentsFromEnvironment(call->argument_count());
4674   return call;
4675 }
4676
4677
4678 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
4679   // First special is HContext.
4680   HInstruction* context = Add<HContext>();
4681   environment()->BindContext(context);
4682
4683   // Create an arguments object containing the initial parameters.  Set the
4684   // initial values of parameters including "this" having parameter index 0.
4685   DCHECK_EQ(scope->num_parameters() + 1, environment()->parameter_count());
4686   HArgumentsObject* arguments_object =
4687       New<HArgumentsObject>(environment()->parameter_count());
4688   for (int i = 0; i < environment()->parameter_count(); ++i) {
4689     HInstruction* parameter = Add<HParameter>(i);
4690     arguments_object->AddArgument(parameter, zone());
4691     environment()->Bind(i, parameter);
4692   }
4693   AddInstruction(arguments_object);
4694   graph()->SetArgumentsObject(arguments_object);
4695
4696   HConstant* undefined_constant = graph()->GetConstantUndefined();
4697   // Initialize specials and locals to undefined.
4698   for (int i = environment()->parameter_count() + 1;
4699        i < environment()->length();
4700        ++i) {
4701     environment()->Bind(i, undefined_constant);
4702   }
4703
4704   // Handle the arguments and arguments shadow variables specially (they do
4705   // not have declarations).
4706   if (scope->arguments() != NULL) {
4707     environment()->Bind(scope->arguments(),
4708                         graph()->GetArgumentsObject());
4709   }
4710
4711   int rest_index;
4712   Variable* rest = scope->rest_parameter(&rest_index);
4713   if (rest) {
4714     return Bailout(kRestParameter);
4715   }
4716
4717   if (scope->this_function_var() != nullptr ||
4718       scope->new_target_var() != nullptr) {
4719     return Bailout(kSuperReference);
4720   }
4721 }
4722
4723
4724 void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>* statements) {
4725   for (int i = 0; i < statements->length(); i++) {
4726     Statement* stmt = statements->at(i);
4727     CHECK_ALIVE(Visit(stmt));
4728     if (stmt->IsJump()) break;
4729   }
4730 }
4731
4732
4733 void HOptimizedGraphBuilder::VisitBlock(Block* stmt) {
4734   DCHECK(!HasStackOverflow());
4735   DCHECK(current_block() != NULL);
4736   DCHECK(current_block()->HasPredecessor());
4737
4738   Scope* outer_scope = scope();
4739   Scope* scope = stmt->scope();
4740   BreakAndContinueInfo break_info(stmt, outer_scope);
4741
4742   { BreakAndContinueScope push(&break_info, this);
4743     if (scope != NULL) {
4744       if (scope->ContextLocalCount() > 0) {
4745         // Load the function object.
4746         Scope* declaration_scope = scope->DeclarationScope();
4747         HInstruction* function;
4748         HValue* outer_context = environment()->context();
4749         if (declaration_scope->is_script_scope() ||
4750             declaration_scope->is_eval_scope()) {
4751           function = new (zone())
4752               HLoadContextSlot(outer_context, Context::CLOSURE_INDEX,
4753                                HLoadContextSlot::kNoCheck);
4754         } else {
4755           function = New<HThisFunction>();
4756         }
4757         AddInstruction(function);
4758         // Allocate a block context and store it to the stack frame.
4759         HInstruction* inner_context = Add<HAllocateBlockContext>(
4760             outer_context, function, scope->GetScopeInfo(isolate()));
4761         HInstruction* instr = Add<HStoreFrameContext>(inner_context);
4762         set_scope(scope);
4763         environment()->BindContext(inner_context);
4764         if (instr->HasObservableSideEffects()) {
4765           AddSimulate(stmt->EntryId(), REMOVABLE_SIMULATE);
4766         }
4767       }
4768       VisitDeclarations(scope->declarations());
4769       AddSimulate(stmt->DeclsId(), REMOVABLE_SIMULATE);
4770     }
4771     CHECK_BAILOUT(VisitStatements(stmt->statements()));
4772   }
4773   set_scope(outer_scope);
4774   if (scope != NULL && current_block() != NULL &&
4775       scope->ContextLocalCount() > 0) {
4776     HValue* inner_context = environment()->context();
4777     HValue* outer_context = Add<HLoadNamedField>(
4778         inner_context, nullptr,
4779         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4780
4781     HInstruction* instr = Add<HStoreFrameContext>(outer_context);
4782     environment()->BindContext(outer_context);
4783     if (instr->HasObservableSideEffects()) {
4784       AddSimulate(stmt->ExitId(), REMOVABLE_SIMULATE);
4785     }
4786   }
4787   HBasicBlock* break_block = break_info.break_block();
4788   if (break_block != NULL) {
4789     if (current_block() != NULL) Goto(break_block);
4790     break_block->SetJoinId(stmt->ExitId());
4791     set_current_block(break_block);
4792   }
4793 }
4794
4795
4796 void HOptimizedGraphBuilder::VisitExpressionStatement(
4797     ExpressionStatement* stmt) {
4798   DCHECK(!HasStackOverflow());
4799   DCHECK(current_block() != NULL);
4800   DCHECK(current_block()->HasPredecessor());
4801   VisitForEffect(stmt->expression());
4802 }
4803
4804
4805 void HOptimizedGraphBuilder::VisitEmptyStatement(EmptyStatement* stmt) {
4806   DCHECK(!HasStackOverflow());
4807   DCHECK(current_block() != NULL);
4808   DCHECK(current_block()->HasPredecessor());
4809 }
4810
4811
4812 void HOptimizedGraphBuilder::VisitIfStatement(IfStatement* stmt) {
4813   DCHECK(!HasStackOverflow());
4814   DCHECK(current_block() != NULL);
4815   DCHECK(current_block()->HasPredecessor());
4816   if (stmt->condition()->ToBooleanIsTrue()) {
4817     Add<HSimulate>(stmt->ThenId());
4818     Visit(stmt->then_statement());
4819   } else if (stmt->condition()->ToBooleanIsFalse()) {
4820     Add<HSimulate>(stmt->ElseId());
4821     Visit(stmt->else_statement());
4822   } else {
4823     HBasicBlock* cond_true = graph()->CreateBasicBlock();
4824     HBasicBlock* cond_false = graph()->CreateBasicBlock();
4825     CHECK_BAILOUT(VisitForControl(stmt->condition(), cond_true, cond_false));
4826
4827     if (cond_true->HasPredecessor()) {
4828       cond_true->SetJoinId(stmt->ThenId());
4829       set_current_block(cond_true);
4830       CHECK_BAILOUT(Visit(stmt->then_statement()));
4831       cond_true = current_block();
4832     } else {
4833       cond_true = NULL;
4834     }
4835
4836     if (cond_false->HasPredecessor()) {
4837       cond_false->SetJoinId(stmt->ElseId());
4838       set_current_block(cond_false);
4839       CHECK_BAILOUT(Visit(stmt->else_statement()));
4840       cond_false = current_block();
4841     } else {
4842       cond_false = NULL;
4843     }
4844
4845     HBasicBlock* join = CreateJoin(cond_true, cond_false, stmt->IfId());
4846     set_current_block(join);
4847   }
4848 }
4849
4850
4851 HBasicBlock* HOptimizedGraphBuilder::BreakAndContinueScope::Get(
4852     BreakableStatement* stmt,
4853     BreakType type,
4854     Scope** scope,
4855     int* drop_extra) {
4856   *drop_extra = 0;
4857   BreakAndContinueScope* current = this;
4858   while (current != NULL && current->info()->target() != stmt) {
4859     *drop_extra += current->info()->drop_extra();
4860     current = current->next();
4861   }
4862   DCHECK(current != NULL);  // Always found (unless stack is malformed).
4863   *scope = current->info()->scope();
4864
4865   if (type == BREAK) {
4866     *drop_extra += current->info()->drop_extra();
4867   }
4868
4869   HBasicBlock* block = NULL;
4870   switch (type) {
4871     case BREAK:
4872       block = current->info()->break_block();
4873       if (block == NULL) {
4874         block = current->owner()->graph()->CreateBasicBlock();
4875         current->info()->set_break_block(block);
4876       }
4877       break;
4878
4879     case CONTINUE:
4880       block = current->info()->continue_block();
4881       if (block == NULL) {
4882         block = current->owner()->graph()->CreateBasicBlock();
4883         current->info()->set_continue_block(block);
4884       }
4885       break;
4886   }
4887
4888   return block;
4889 }
4890
4891
4892 void HOptimizedGraphBuilder::VisitContinueStatement(
4893     ContinueStatement* stmt) {
4894   DCHECK(!HasStackOverflow());
4895   DCHECK(current_block() != NULL);
4896   DCHECK(current_block()->HasPredecessor());
4897   Scope* outer_scope = NULL;
4898   Scope* inner_scope = scope();
4899   int drop_extra = 0;
4900   HBasicBlock* continue_block = break_scope()->Get(
4901       stmt->target(), BreakAndContinueScope::CONTINUE,
4902       &outer_scope, &drop_extra);
4903   HValue* context = environment()->context();
4904   Drop(drop_extra);
4905   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4906   if (context_pop_count > 0) {
4907     while (context_pop_count-- > 0) {
4908       HInstruction* context_instruction = Add<HLoadNamedField>(
4909           context, nullptr,
4910           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4911       context = context_instruction;
4912     }
4913     HInstruction* instr = Add<HStoreFrameContext>(context);
4914     if (instr->HasObservableSideEffects()) {
4915       AddSimulate(stmt->target()->EntryId(), REMOVABLE_SIMULATE);
4916     }
4917     environment()->BindContext(context);
4918   }
4919
4920   Goto(continue_block);
4921   set_current_block(NULL);
4922 }
4923
4924
4925 void HOptimizedGraphBuilder::VisitBreakStatement(BreakStatement* stmt) {
4926   DCHECK(!HasStackOverflow());
4927   DCHECK(current_block() != NULL);
4928   DCHECK(current_block()->HasPredecessor());
4929   Scope* outer_scope = NULL;
4930   Scope* inner_scope = scope();
4931   int drop_extra = 0;
4932   HBasicBlock* break_block = break_scope()->Get(
4933       stmt->target(), BreakAndContinueScope::BREAK,
4934       &outer_scope, &drop_extra);
4935   HValue* context = environment()->context();
4936   Drop(drop_extra);
4937   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4938   if (context_pop_count > 0) {
4939     while (context_pop_count-- > 0) {
4940       HInstruction* context_instruction = Add<HLoadNamedField>(
4941           context, nullptr,
4942           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4943       context = context_instruction;
4944     }
4945     HInstruction* instr = Add<HStoreFrameContext>(context);
4946     if (instr->HasObservableSideEffects()) {
4947       AddSimulate(stmt->target()->ExitId(), REMOVABLE_SIMULATE);
4948     }
4949     environment()->BindContext(context);
4950   }
4951   Goto(break_block);
4952   set_current_block(NULL);
4953 }
4954
4955
4956 void HOptimizedGraphBuilder::VisitReturnStatement(ReturnStatement* stmt) {
4957   DCHECK(!HasStackOverflow());
4958   DCHECK(current_block() != NULL);
4959   DCHECK(current_block()->HasPredecessor());
4960   FunctionState* state = function_state();
4961   AstContext* context = call_context();
4962   if (context == NULL) {
4963     // Not an inlined return, so an actual one.
4964     CHECK_ALIVE(VisitForValue(stmt->expression()));
4965     HValue* result = environment()->Pop();
4966     Add<HReturn>(result);
4967   } else if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
4968     // Return from an inlined construct call. In a test context the return value
4969     // will always evaluate to true, in a value context the return value needs
4970     // to be a JSObject.
4971     if (context->IsTest()) {
4972       TestContext* test = TestContext::cast(context);
4973       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4974       Goto(test->if_true(), state);
4975     } else if (context->IsEffect()) {
4976       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4977       Goto(function_return(), state);
4978     } else {
4979       DCHECK(context->IsValue());
4980       CHECK_ALIVE(VisitForValue(stmt->expression()));
4981       HValue* return_value = Pop();
4982       HValue* receiver = environment()->arguments_environment()->Lookup(0);
4983       HHasInstanceTypeAndBranch* typecheck =
4984           New<HHasInstanceTypeAndBranch>(return_value,
4985                                          FIRST_SPEC_OBJECT_TYPE,
4986                                          LAST_SPEC_OBJECT_TYPE);
4987       HBasicBlock* if_spec_object = graph()->CreateBasicBlock();
4988       HBasicBlock* not_spec_object = graph()->CreateBasicBlock();
4989       typecheck->SetSuccessorAt(0, if_spec_object);
4990       typecheck->SetSuccessorAt(1, not_spec_object);
4991       FinishCurrentBlock(typecheck);
4992       AddLeaveInlined(if_spec_object, return_value, state);
4993       AddLeaveInlined(not_spec_object, receiver, state);
4994     }
4995   } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
4996     // Return from an inlined setter call. The returned value is never used, the
4997     // value of an assignment is always the value of the RHS of the assignment.
4998     CHECK_ALIVE(VisitForEffect(stmt->expression()));
4999     if (context->IsTest()) {
5000       HValue* rhs = environment()->arguments_environment()->Lookup(1);
5001       context->ReturnValue(rhs);
5002     } else if (context->IsEffect()) {
5003       Goto(function_return(), state);
5004     } else {
5005       DCHECK(context->IsValue());
5006       HValue* rhs = environment()->arguments_environment()->Lookup(1);
5007       AddLeaveInlined(rhs, state);
5008     }
5009   } else {
5010     // Return from a normal inlined function. Visit the subexpression in the
5011     // expression context of the call.
5012     if (context->IsTest()) {
5013       TestContext* test = TestContext::cast(context);
5014       VisitForControl(stmt->expression(), test->if_true(), test->if_false());
5015     } else if (context->IsEffect()) {
5016       // Visit in value context and ignore the result. This is needed to keep
5017       // environment in sync with full-codegen since some visitors (e.g.
5018       // VisitCountOperation) use the operand stack differently depending on
5019       // context.
5020       CHECK_ALIVE(VisitForValue(stmt->expression()));
5021       Pop();
5022       Goto(function_return(), state);
5023     } else {
5024       DCHECK(context->IsValue());
5025       CHECK_ALIVE(VisitForValue(stmt->expression()));
5026       AddLeaveInlined(Pop(), state);
5027     }
5028   }
5029   set_current_block(NULL);
5030 }
5031
5032
5033 void HOptimizedGraphBuilder::VisitWithStatement(WithStatement* stmt) {
5034   DCHECK(!HasStackOverflow());
5035   DCHECK(current_block() != NULL);
5036   DCHECK(current_block()->HasPredecessor());
5037   return Bailout(kWithStatement);
5038 }
5039
5040
5041 void HOptimizedGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
5042   DCHECK(!HasStackOverflow());
5043   DCHECK(current_block() != NULL);
5044   DCHECK(current_block()->HasPredecessor());
5045
5046   ZoneList<CaseClause*>* clauses = stmt->cases();
5047   int clause_count = clauses->length();
5048   ZoneList<HBasicBlock*> body_blocks(clause_count, zone());
5049
5050   CHECK_ALIVE(VisitForValue(stmt->tag()));
5051   Add<HSimulate>(stmt->EntryId());
5052   HValue* tag_value = Top();
5053   Type* tag_type = stmt->tag()->bounds().lower;
5054
5055   // 1. Build all the tests, with dangling true branches
5056   BailoutId default_id = BailoutId::None();
5057   for (int i = 0; i < clause_count; ++i) {
5058     CaseClause* clause = clauses->at(i);
5059     if (clause->is_default()) {
5060       body_blocks.Add(NULL, zone());
5061       if (default_id.IsNone()) default_id = clause->EntryId();
5062       continue;
5063     }
5064
5065     // Generate a compare and branch.
5066     CHECK_ALIVE(VisitForValue(clause->label()));
5067     HValue* label_value = Pop();
5068
5069     Type* label_type = clause->label()->bounds().lower;
5070     Type* combined_type = clause->compare_type();
5071     HControlInstruction* compare = BuildCompareInstruction(
5072         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
5073         combined_type,
5074         ScriptPositionToSourcePosition(stmt->tag()->position()),
5075         ScriptPositionToSourcePosition(clause->label()->position()),
5076         PUSH_BEFORE_SIMULATE, clause->id());
5077
5078     HBasicBlock* next_test_block = graph()->CreateBasicBlock();
5079     HBasicBlock* body_block = graph()->CreateBasicBlock();
5080     body_blocks.Add(body_block, zone());
5081     compare->SetSuccessorAt(0, body_block);
5082     compare->SetSuccessorAt(1, next_test_block);
5083     FinishCurrentBlock(compare);
5084
5085     set_current_block(body_block);
5086     Drop(1);  // tag_value
5087
5088     set_current_block(next_test_block);
5089   }
5090
5091   // Save the current block to use for the default or to join with the
5092   // exit.
5093   HBasicBlock* last_block = current_block();
5094   Drop(1);  // tag_value
5095
5096   // 2. Loop over the clauses and the linked list of tests in lockstep,
5097   // translating the clause bodies.
5098   HBasicBlock* fall_through_block = NULL;
5099
5100   BreakAndContinueInfo break_info(stmt, scope());
5101   { BreakAndContinueScope push(&break_info, this);
5102     for (int i = 0; i < clause_count; ++i) {
5103       CaseClause* clause = clauses->at(i);
5104
5105       // Identify the block where normal (non-fall-through) control flow
5106       // goes to.
5107       HBasicBlock* normal_block = NULL;
5108       if (clause->is_default()) {
5109         if (last_block == NULL) continue;
5110         normal_block = last_block;
5111         last_block = NULL;  // Cleared to indicate we've handled it.
5112       } else {
5113         normal_block = body_blocks[i];
5114       }
5115
5116       if (fall_through_block == NULL) {
5117         set_current_block(normal_block);
5118       } else {
5119         HBasicBlock* join = CreateJoin(fall_through_block,
5120                                        normal_block,
5121                                        clause->EntryId());
5122         set_current_block(join);
5123       }
5124
5125       CHECK_BAILOUT(VisitStatements(clause->statements()));
5126       fall_through_block = current_block();
5127     }
5128   }
5129
5130   // Create an up-to-3-way join.  Use the break block if it exists since
5131   // it's already a join block.
5132   HBasicBlock* break_block = break_info.break_block();
5133   if (break_block == NULL) {
5134     set_current_block(CreateJoin(fall_through_block,
5135                                  last_block,
5136                                  stmt->ExitId()));
5137   } else {
5138     if (fall_through_block != NULL) Goto(fall_through_block, break_block);
5139     if (last_block != NULL) Goto(last_block, break_block);
5140     break_block->SetJoinId(stmt->ExitId());
5141     set_current_block(break_block);
5142   }
5143 }
5144
5145
5146 void HOptimizedGraphBuilder::VisitLoopBody(IterationStatement* stmt,
5147                                            HBasicBlock* loop_entry) {
5148   Add<HSimulate>(stmt->StackCheckId());
5149   HStackCheck* stack_check =
5150       HStackCheck::cast(Add<HStackCheck>(HStackCheck::kBackwardsBranch));
5151   DCHECK(loop_entry->IsLoopHeader());
5152   loop_entry->loop_information()->set_stack_check(stack_check);
5153   CHECK_BAILOUT(Visit(stmt->body()));
5154 }
5155
5156
5157 void HOptimizedGraphBuilder::VisitDoWhileStatement(DoWhileStatement* stmt) {
5158   DCHECK(!HasStackOverflow());
5159   DCHECK(current_block() != NULL);
5160   DCHECK(current_block()->HasPredecessor());
5161   DCHECK(current_block() != NULL);
5162   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5163
5164   BreakAndContinueInfo break_info(stmt, scope());
5165   {
5166     BreakAndContinueScope push(&break_info, this);
5167     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5168   }
5169   HBasicBlock* body_exit =
5170       JoinContinue(stmt, current_block(), break_info.continue_block());
5171   HBasicBlock* loop_successor = NULL;
5172   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
5173     set_current_block(body_exit);
5174     loop_successor = graph()->CreateBasicBlock();
5175     if (stmt->cond()->ToBooleanIsFalse()) {
5176       loop_entry->loop_information()->stack_check()->Eliminate();
5177       Goto(loop_successor);
5178       body_exit = NULL;
5179     } else {
5180       // The block for a true condition, the actual predecessor block of the
5181       // back edge.
5182       body_exit = graph()->CreateBasicBlock();
5183       CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
5184     }
5185     if (body_exit != NULL && body_exit->HasPredecessor()) {
5186       body_exit->SetJoinId(stmt->BackEdgeId());
5187     } else {
5188       body_exit = NULL;
5189     }
5190     if (loop_successor->HasPredecessor()) {
5191       loop_successor->SetJoinId(stmt->ExitId());
5192     } else {
5193       loop_successor = NULL;
5194     }
5195   }
5196   HBasicBlock* loop_exit = CreateLoop(stmt,
5197                                       loop_entry,
5198                                       body_exit,
5199                                       loop_successor,
5200                                       break_info.break_block());
5201   set_current_block(loop_exit);
5202 }
5203
5204
5205 void HOptimizedGraphBuilder::VisitWhileStatement(WhileStatement* stmt) {
5206   DCHECK(!HasStackOverflow());
5207   DCHECK(current_block() != NULL);
5208   DCHECK(current_block()->HasPredecessor());
5209   DCHECK(current_block() != NULL);
5210   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5211
5212   // If the condition is constant true, do not generate a branch.
5213   HBasicBlock* loop_successor = NULL;
5214   if (!stmt->cond()->ToBooleanIsTrue()) {
5215     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5216     loop_successor = graph()->CreateBasicBlock();
5217     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5218     if (body_entry->HasPredecessor()) {
5219       body_entry->SetJoinId(stmt->BodyId());
5220       set_current_block(body_entry);
5221     }
5222     if (loop_successor->HasPredecessor()) {
5223       loop_successor->SetJoinId(stmt->ExitId());
5224     } else {
5225       loop_successor = NULL;
5226     }
5227   }
5228
5229   BreakAndContinueInfo break_info(stmt, scope());
5230   if (current_block() != NULL) {
5231     BreakAndContinueScope push(&break_info, this);
5232     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5233   }
5234   HBasicBlock* body_exit =
5235       JoinContinue(stmt, current_block(), break_info.continue_block());
5236   HBasicBlock* loop_exit = CreateLoop(stmt,
5237                                       loop_entry,
5238                                       body_exit,
5239                                       loop_successor,
5240                                       break_info.break_block());
5241   set_current_block(loop_exit);
5242 }
5243
5244
5245 void HOptimizedGraphBuilder::VisitForStatement(ForStatement* stmt) {
5246   DCHECK(!HasStackOverflow());
5247   DCHECK(current_block() != NULL);
5248   DCHECK(current_block()->HasPredecessor());
5249   if (stmt->init() != NULL) {
5250     CHECK_ALIVE(Visit(stmt->init()));
5251   }
5252   DCHECK(current_block() != NULL);
5253   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5254
5255   HBasicBlock* loop_successor = NULL;
5256   if (stmt->cond() != NULL) {
5257     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5258     loop_successor = graph()->CreateBasicBlock();
5259     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5260     if (body_entry->HasPredecessor()) {
5261       body_entry->SetJoinId(stmt->BodyId());
5262       set_current_block(body_entry);
5263     }
5264     if (loop_successor->HasPredecessor()) {
5265       loop_successor->SetJoinId(stmt->ExitId());
5266     } else {
5267       loop_successor = NULL;
5268     }
5269   }
5270
5271   BreakAndContinueInfo break_info(stmt, scope());
5272   if (current_block() != NULL) {
5273     BreakAndContinueScope push(&break_info, this);
5274     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5275   }
5276   HBasicBlock* body_exit =
5277       JoinContinue(stmt, current_block(), break_info.continue_block());
5278
5279   if (stmt->next() != NULL && body_exit != NULL) {
5280     set_current_block(body_exit);
5281     CHECK_BAILOUT(Visit(stmt->next()));
5282     body_exit = current_block();
5283   }
5284
5285   HBasicBlock* loop_exit = CreateLoop(stmt,
5286                                       loop_entry,
5287                                       body_exit,
5288                                       loop_successor,
5289                                       break_info.break_block());
5290   set_current_block(loop_exit);
5291 }
5292
5293
5294 void HOptimizedGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
5295   DCHECK(!HasStackOverflow());
5296   DCHECK(current_block() != NULL);
5297   DCHECK(current_block()->HasPredecessor());
5298
5299   if (!FLAG_optimize_for_in) {
5300     return Bailout(kForInStatementOptimizationIsDisabled);
5301   }
5302
5303   if (!stmt->each()->IsVariableProxy() ||
5304       !stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
5305     return Bailout(kForInStatementWithNonLocalEachVariable);
5306   }
5307
5308   Variable* each_var = stmt->each()->AsVariableProxy()->var();
5309
5310   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
5311   HValue* enumerable = Top();  // Leave enumerable at the top.
5312
5313   IfBuilder if_undefined_or_null(this);
5314   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5315       enumerable, graph()->GetConstantUndefined());
5316   if_undefined_or_null.Or();
5317   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5318       enumerable, graph()->GetConstantNull());
5319   if_undefined_or_null.ThenDeopt(Deoptimizer::kUndefinedOrNullInForIn);
5320   if_undefined_or_null.End();
5321   BuildForInBody(stmt, each_var, enumerable);
5322 }
5323
5324
5325 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
5326                                             Variable* each_var,
5327                                             HValue* enumerable) {
5328   HInstruction* map;
5329   HInstruction* array;
5330   HInstruction* enum_length;
5331   bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
5332   if (fast) {
5333     map = Add<HForInPrepareMap>(enumerable);
5334     Add<HSimulate>(stmt->PrepareId());
5335
5336     array = Add<HForInCacheArray>(enumerable, map,
5337                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
5338     enum_length = Add<HMapEnumLength>(map);
5339
5340     HInstruction* index_cache = Add<HForInCacheArray>(
5341         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
5342     HForInCacheArray::cast(array)
5343         ->set_index_cache(HForInCacheArray::cast(index_cache));
5344   } else {
5345     Add<HSimulate>(stmt->PrepareId());
5346     {
5347       NoObservableSideEffectsScope no_effects(this);
5348       BuildJSObjectCheck(enumerable, 0);
5349     }
5350     Add<HSimulate>(stmt->ToObjectId());
5351
5352     map = graph()->GetConstant1();
5353     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
5354     Add<HPushArguments>(enumerable);
5355     array = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5356                               Runtime::FunctionForId(function_id), 1);
5357     Push(array);
5358     Add<HSimulate>(stmt->EnumId());
5359     Drop(1);
5360     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
5361     HValue* check = Add<HCheckMaps>(array, array_map);
5362     enum_length = AddLoadFixedArrayLength(array, check);
5363   }
5364
5365   HInstruction* start_index = Add<HConstant>(0);
5366
5367   Push(map);
5368   Push(array);
5369   Push(enum_length);
5370   Push(start_index);
5371
5372   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5373
5374   // Reload the values to ensure we have up-to-date values inside of the loop.
5375   // This is relevant especially for OSR where the values don't come from the
5376   // computation above, but from the OSR entry block.
5377   enumerable = environment()->ExpressionStackAt(4);
5378   HValue* index = environment()->ExpressionStackAt(0);
5379   HValue* limit = environment()->ExpressionStackAt(1);
5380
5381   // Check that we still have more keys.
5382   HCompareNumericAndBranch* compare_index =
5383       New<HCompareNumericAndBranch>(index, limit, Token::LT);
5384   compare_index->set_observed_input_representation(
5385       Representation::Smi(), Representation::Smi());
5386
5387   HBasicBlock* loop_body = graph()->CreateBasicBlock();
5388   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
5389
5390   compare_index->SetSuccessorAt(0, loop_body);
5391   compare_index->SetSuccessorAt(1, loop_successor);
5392   FinishCurrentBlock(compare_index);
5393
5394   set_current_block(loop_successor);
5395   Drop(5);
5396
5397   set_current_block(loop_body);
5398
5399   HValue* key =
5400       Add<HLoadKeyed>(environment()->ExpressionStackAt(2),  // Enum cache.
5401                       index, index, FAST_ELEMENTS);
5402
5403   if (fast) {
5404     // Check if the expected map still matches that of the enumerable.
5405     // If not just deoptimize.
5406     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
5407     Bind(each_var, key);
5408   } else {
5409     Add<HPushArguments>(enumerable, key);
5410     Runtime::FunctionId function_id = Runtime::kForInFilter;
5411     key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5412                             Runtime::FunctionForId(function_id), 2);
5413     Push(key);
5414     Add<HSimulate>(stmt->FilterId());
5415     key = Pop();
5416     Bind(each_var, key);
5417     IfBuilder if_undefined(this);
5418     if_undefined.If<HCompareObjectEqAndBranch>(key,
5419                                                graph()->GetConstantUndefined());
5420     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
5421     if_undefined.End();
5422     Add<HSimulate>(stmt->AssignmentId());
5423   }
5424
5425   BreakAndContinueInfo break_info(stmt, scope(), 5);
5426   {
5427     BreakAndContinueScope push(&break_info, this);
5428     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5429   }
5430
5431   HBasicBlock* body_exit =
5432       JoinContinue(stmt, current_block(), break_info.continue_block());
5433
5434   if (body_exit != NULL) {
5435     set_current_block(body_exit);
5436
5437     HValue* current_index = Pop();
5438     Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
5439     body_exit = current_block();
5440   }
5441
5442   HBasicBlock* loop_exit = CreateLoop(stmt,
5443                                       loop_entry,
5444                                       body_exit,
5445                                       loop_successor,
5446                                       break_info.break_block());
5447
5448   set_current_block(loop_exit);
5449 }
5450
5451
5452 void HOptimizedGraphBuilder::VisitForOfStatement(ForOfStatement* stmt) {
5453   DCHECK(!HasStackOverflow());
5454   DCHECK(current_block() != NULL);
5455   DCHECK(current_block()->HasPredecessor());
5456   return Bailout(kForOfStatement);
5457 }
5458
5459
5460 void HOptimizedGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
5461   DCHECK(!HasStackOverflow());
5462   DCHECK(current_block() != NULL);
5463   DCHECK(current_block()->HasPredecessor());
5464   return Bailout(kTryCatchStatement);
5465 }
5466
5467
5468 void HOptimizedGraphBuilder::VisitTryFinallyStatement(
5469     TryFinallyStatement* stmt) {
5470   DCHECK(!HasStackOverflow());
5471   DCHECK(current_block() != NULL);
5472   DCHECK(current_block()->HasPredecessor());
5473   return Bailout(kTryFinallyStatement);
5474 }
5475
5476
5477 void HOptimizedGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
5478   DCHECK(!HasStackOverflow());
5479   DCHECK(current_block() != NULL);
5480   DCHECK(current_block()->HasPredecessor());
5481   return Bailout(kDebuggerStatement);
5482 }
5483
5484
5485 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
5486   UNREACHABLE();
5487 }
5488
5489
5490 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
5491   DCHECK(!HasStackOverflow());
5492   DCHECK(current_block() != NULL);
5493   DCHECK(current_block()->HasPredecessor());
5494   Handle<SharedFunctionInfo> shared_info = Compiler::GetSharedFunctionInfo(
5495       expr, current_info()->script(), top_info());
5496   // We also have a stack overflow if the recursive compilation did.
5497   if (HasStackOverflow()) return;
5498   HFunctionLiteral* instr =
5499       New<HFunctionLiteral>(shared_info, expr->pretenure());
5500   return ast_context()->ReturnInstruction(instr, expr->id());
5501 }
5502
5503
5504 void HOptimizedGraphBuilder::VisitClassLiteral(ClassLiteral* lit) {
5505   DCHECK(!HasStackOverflow());
5506   DCHECK(current_block() != NULL);
5507   DCHECK(current_block()->HasPredecessor());
5508   return Bailout(kClassLiteral);
5509 }
5510
5511
5512 void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
5513     NativeFunctionLiteral* expr) {
5514   DCHECK(!HasStackOverflow());
5515   DCHECK(current_block() != NULL);
5516   DCHECK(current_block()->HasPredecessor());
5517   return Bailout(kNativeFunctionLiteral);
5518 }
5519
5520
5521 void HOptimizedGraphBuilder::VisitConditional(Conditional* expr) {
5522   DCHECK(!HasStackOverflow());
5523   DCHECK(current_block() != NULL);
5524   DCHECK(current_block()->HasPredecessor());
5525   HBasicBlock* cond_true = graph()->CreateBasicBlock();
5526   HBasicBlock* cond_false = graph()->CreateBasicBlock();
5527   CHECK_BAILOUT(VisitForControl(expr->condition(), cond_true, cond_false));
5528
5529   // Visit the true and false subexpressions in the same AST context as the
5530   // whole expression.
5531   if (cond_true->HasPredecessor()) {
5532     cond_true->SetJoinId(expr->ThenId());
5533     set_current_block(cond_true);
5534     CHECK_BAILOUT(Visit(expr->then_expression()));
5535     cond_true = current_block();
5536   } else {
5537     cond_true = NULL;
5538   }
5539
5540   if (cond_false->HasPredecessor()) {
5541     cond_false->SetJoinId(expr->ElseId());
5542     set_current_block(cond_false);
5543     CHECK_BAILOUT(Visit(expr->else_expression()));
5544     cond_false = current_block();
5545   } else {
5546     cond_false = NULL;
5547   }
5548
5549   if (!ast_context()->IsTest()) {
5550     HBasicBlock* join = CreateJoin(cond_true, cond_false, expr->id());
5551     set_current_block(join);
5552     if (join != NULL && !ast_context()->IsEffect()) {
5553       return ast_context()->ReturnValue(Pop());
5554     }
5555   }
5556 }
5557
5558
5559 HOptimizedGraphBuilder::GlobalPropertyAccess
5560 HOptimizedGraphBuilder::LookupGlobalProperty(Variable* var, LookupIterator* it,
5561                                              PropertyAccessType access_type) {
5562   if (var->is_this() || !current_info()->has_global_object()) {
5563     return kUseGeneric;
5564   }
5565
5566   switch (it->state()) {
5567     case LookupIterator::ACCESSOR:
5568     case LookupIterator::ACCESS_CHECK:
5569     case LookupIterator::INTERCEPTOR:
5570     case LookupIterator::INTEGER_INDEXED_EXOTIC:
5571     case LookupIterator::NOT_FOUND:
5572       return kUseGeneric;
5573     case LookupIterator::DATA:
5574       if (access_type == STORE && it->IsReadOnly()) return kUseGeneric;
5575       return kUseCell;
5576     case LookupIterator::JSPROXY:
5577     case LookupIterator::TRANSITION:
5578       UNREACHABLE();
5579   }
5580   UNREACHABLE();
5581   return kUseGeneric;
5582 }
5583
5584
5585 HValue* HOptimizedGraphBuilder::BuildContextChainWalk(Variable* var) {
5586   DCHECK(var->IsContextSlot());
5587   HValue* context = environment()->context();
5588   int length = scope()->ContextChainLength(var->scope());
5589   while (length-- > 0) {
5590     context = Add<HLoadNamedField>(
5591         context, nullptr,
5592         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
5593   }
5594   return context;
5595 }
5596
5597
5598 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
5599   DCHECK(!HasStackOverflow());
5600   DCHECK(current_block() != NULL);
5601   DCHECK(current_block()->HasPredecessor());
5602   Variable* variable = expr->var();
5603   switch (variable->location()) {
5604     case VariableLocation::GLOBAL:
5605     case VariableLocation::UNALLOCATED: {
5606       if (IsLexicalVariableMode(variable->mode())) {
5607         // TODO(rossberg): should this be an DCHECK?
5608         return Bailout(kReferenceToGlobalLexicalVariable);
5609       }
5610       // Handle known global constants like 'undefined' specially to avoid a
5611       // load from a global cell for them.
5612       Handle<Object> constant_value =
5613           isolate()->factory()->GlobalConstantFor(variable->name());
5614       if (!constant_value.is_null()) {
5615         HConstant* instr = New<HConstant>(constant_value);
5616         return ast_context()->ReturnInstruction(instr, expr->id());
5617       }
5618
5619       Handle<GlobalObject> global(current_info()->global_object());
5620
5621       // Lookup in script contexts.
5622       {
5623         Handle<ScriptContextTable> script_contexts(
5624             global->native_context()->script_context_table());
5625         ScriptContextTable::LookupResult lookup;
5626         if (ScriptContextTable::Lookup(script_contexts, variable->name(),
5627                                        &lookup)) {
5628           Handle<Context> script_context = ScriptContextTable::GetContext(
5629               script_contexts, lookup.context_index);
5630           Handle<Object> current_value =
5631               FixedArray::get(script_context, lookup.slot_index);
5632
5633           // If the values is not the hole, it will stay initialized,
5634           // so no need to generate a check.
5635           if (*current_value == *isolate()->factory()->the_hole_value()) {
5636             return Bailout(kReferenceToUninitializedVariable);
5637           }
5638           HInstruction* result = New<HLoadNamedField>(
5639               Add<HConstant>(script_context), nullptr,
5640               HObjectAccess::ForContextSlot(lookup.slot_index));
5641           return ast_context()->ReturnInstruction(result, expr->id());
5642         }
5643       }
5644
5645       LookupIterator it(global, variable->name(), LookupIterator::OWN);
5646       GlobalPropertyAccess type = LookupGlobalProperty(variable, &it, LOAD);
5647
5648       if (type == kUseCell) {
5649         Handle<PropertyCell> cell = it.GetPropertyCell();
5650         top_info()->dependencies()->AssumePropertyCell(cell);
5651         auto cell_type = it.property_details().cell_type();
5652         if (cell_type == PropertyCellType::kConstant ||
5653             cell_type == PropertyCellType::kUndefined) {
5654           Handle<Object> constant_object(cell->value(), isolate());
5655           if (constant_object->IsConsString()) {
5656             constant_object =
5657                 String::Flatten(Handle<String>::cast(constant_object));
5658           }
5659           HConstant* constant = New<HConstant>(constant_object);
5660           return ast_context()->ReturnInstruction(constant, expr->id());
5661         } else {
5662           auto access = HObjectAccess::ForPropertyCellValue();
5663           UniqueSet<Map>* field_maps = nullptr;
5664           if (cell_type == PropertyCellType::kConstantType) {
5665             switch (cell->GetConstantType()) {
5666               case PropertyCellConstantType::kSmi:
5667                 access = access.WithRepresentation(Representation::Smi());
5668                 break;
5669               case PropertyCellConstantType::kStableMap: {
5670                 // Check that the map really is stable. The heap object could
5671                 // have mutated without the cell updating state. In that case,
5672                 // make no promises about the loaded value except that it's a
5673                 // heap object.
5674                 access =
5675                     access.WithRepresentation(Representation::HeapObject());
5676                 Handle<Map> map(HeapObject::cast(cell->value())->map());
5677                 if (map->is_stable()) {
5678                   field_maps = new (zone())
5679                       UniqueSet<Map>(Unique<Map>::CreateImmovable(map), zone());
5680                 }
5681                 break;
5682               }
5683             }
5684           }
5685           HConstant* cell_constant = Add<HConstant>(cell);
5686           HLoadNamedField* instr;
5687           if (field_maps == nullptr) {
5688             instr = New<HLoadNamedField>(cell_constant, nullptr, access);
5689           } else {
5690             instr = New<HLoadNamedField>(cell_constant, nullptr, access,
5691                                          field_maps, HType::HeapObject());
5692           }
5693           instr->ClearDependsOnFlag(kInobjectFields);
5694           instr->SetDependsOnFlag(kGlobalVars);
5695           return ast_context()->ReturnInstruction(instr, expr->id());
5696         }
5697       } else if (variable->IsGlobalSlot()) {
5698         DCHECK(variable->index() > 0);
5699         DCHECK(variable->IsStaticGlobalObjectProperty());
5700         int slot_index = variable->index();
5701         int depth = scope()->ContextChainLength(variable->scope());
5702
5703         HLoadGlobalViaContext* instr =
5704             New<HLoadGlobalViaContext>(depth, slot_index);
5705         return ast_context()->ReturnInstruction(instr, expr->id());
5706
5707       } else {
5708         HValue* global_object = Add<HLoadNamedField>(
5709             context(), nullptr,
5710             HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
5711         HLoadGlobalGeneric* instr = New<HLoadGlobalGeneric>(
5712             global_object, variable->name(), ast_context()->typeof_mode());
5713         instr->SetVectorAndSlot(handle(current_feedback_vector(), isolate()),
5714                                 expr->VariableFeedbackSlot());
5715         return ast_context()->ReturnInstruction(instr, expr->id());
5716       }
5717     }
5718
5719     case VariableLocation::PARAMETER:
5720     case VariableLocation::LOCAL: {
5721       HValue* value = LookupAndMakeLive(variable);
5722       if (value == graph()->GetConstantHole()) {
5723         DCHECK(IsDeclaredVariableMode(variable->mode()) &&
5724                variable->mode() != VAR);
5725         return Bailout(kReferenceToUninitializedVariable);
5726       }
5727       return ast_context()->ReturnValue(value);
5728     }
5729
5730     case VariableLocation::CONTEXT: {
5731       HValue* context = BuildContextChainWalk(variable);
5732       HLoadContextSlot::Mode mode;
5733       switch (variable->mode()) {
5734         case LET:
5735         case CONST:
5736           mode = HLoadContextSlot::kCheckDeoptimize;
5737           break;
5738         case CONST_LEGACY:
5739           mode = HLoadContextSlot::kCheckReturnUndefined;
5740           break;
5741         default:
5742           mode = HLoadContextSlot::kNoCheck;
5743           break;
5744       }
5745       HLoadContextSlot* instr =
5746           new(zone()) HLoadContextSlot(context, variable->index(), mode);
5747       return ast_context()->ReturnInstruction(instr, expr->id());
5748     }
5749
5750     case VariableLocation::LOOKUP:
5751       return Bailout(kReferenceToAVariableWhichRequiresDynamicLookup);
5752   }
5753 }
5754
5755
5756 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
5757   DCHECK(!HasStackOverflow());
5758   DCHECK(current_block() != NULL);
5759   DCHECK(current_block()->HasPredecessor());
5760   HConstant* instr = New<HConstant>(expr->value());
5761   return ast_context()->ReturnInstruction(instr, expr->id());
5762 }
5763
5764
5765 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
5766   DCHECK(!HasStackOverflow());
5767   DCHECK(current_block() != NULL);
5768   DCHECK(current_block()->HasPredecessor());
5769   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5770   Handle<FixedArray> literals(closure->literals());
5771   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
5772                                               expr->pattern(),
5773                                               expr->flags(),
5774                                               expr->literal_index());
5775   return ast_context()->ReturnInstruction(instr, expr->id());
5776 }
5777
5778
5779 static bool CanInlinePropertyAccess(Handle<Map> map) {
5780   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
5781   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
5782   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
5783          !map->has_named_interceptor() &&
5784          // TODO(verwaest): Whitelist contexts to which we have access.
5785          !map->is_access_check_needed();
5786 }
5787
5788
5789 // Determines whether the given array or object literal boilerplate satisfies
5790 // all limits to be considered for fast deep-copying and computes the total
5791 // size of all objects that are part of the graph.
5792 static bool IsFastLiteral(Handle<JSObject> boilerplate,
5793                           int max_depth,
5794                           int* max_properties) {
5795   if (boilerplate->map()->is_deprecated() &&
5796       !JSObject::TryMigrateInstance(boilerplate)) {
5797     return false;
5798   }
5799
5800   DCHECK(max_depth >= 0 && *max_properties >= 0);
5801   if (max_depth == 0) return false;
5802
5803   Isolate* isolate = boilerplate->GetIsolate();
5804   Handle<FixedArrayBase> elements(boilerplate->elements());
5805   if (elements->length() > 0 &&
5806       elements->map() != isolate->heap()->fixed_cow_array_map()) {
5807     if (boilerplate->HasFastSmiOrObjectElements()) {
5808       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
5809       int length = elements->length();
5810       for (int i = 0; i < length; i++) {
5811         if ((*max_properties)-- == 0) return false;
5812         Handle<Object> value(fast_elements->get(i), isolate);
5813         if (value->IsJSObject()) {
5814           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5815           if (!IsFastLiteral(value_object,
5816                              max_depth - 1,
5817                              max_properties)) {
5818             return false;
5819           }
5820         }
5821       }
5822     } else if (!boilerplate->HasFastDoubleElements()) {
5823       return false;
5824     }
5825   }
5826
5827   Handle<FixedArray> properties(boilerplate->properties());
5828   if (properties->length() > 0) {
5829     return false;
5830   } else {
5831     Handle<DescriptorArray> descriptors(
5832         boilerplate->map()->instance_descriptors());
5833     int limit = boilerplate->map()->NumberOfOwnDescriptors();
5834     for (int i = 0; i < limit; i++) {
5835       PropertyDetails details = descriptors->GetDetails(i);
5836       if (details.type() != DATA) continue;
5837       if ((*max_properties)-- == 0) return false;
5838       FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
5839       if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
5840       Handle<Object> value(boilerplate->RawFastPropertyAt(field_index),
5841                            isolate);
5842       if (value->IsJSObject()) {
5843         Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5844         if (!IsFastLiteral(value_object,
5845                            max_depth - 1,
5846                            max_properties)) {
5847           return false;
5848         }
5849       }
5850     }
5851   }
5852   return true;
5853 }
5854
5855
5856 void HOptimizedGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
5857   DCHECK(!HasStackOverflow());
5858   DCHECK(current_block() != NULL);
5859   DCHECK(current_block()->HasPredecessor());
5860
5861   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5862   HInstruction* literal;
5863
5864   // Check whether to use fast or slow deep-copying for boilerplate.
5865   int max_properties = kMaxFastLiteralProperties;
5866   Handle<Object> literals_cell(closure->literals()->get(expr->literal_index()),
5867                                isolate());
5868   Handle<AllocationSite> site;
5869   Handle<JSObject> boilerplate;
5870   if (!literals_cell->IsUndefined()) {
5871     // Retrieve the boilerplate
5872     site = Handle<AllocationSite>::cast(literals_cell);
5873     boilerplate = Handle<JSObject>(JSObject::cast(site->transition_info()),
5874                                    isolate());
5875   }
5876
5877   if (!boilerplate.is_null() &&
5878       IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
5879     AllocationSiteUsageContext site_context(isolate(), site, false);
5880     site_context.EnterNewScope();
5881     literal = BuildFastLiteral(boilerplate, &site_context);
5882     site_context.ExitScope(site, boilerplate);
5883   } else {
5884     NoObservableSideEffectsScope no_effects(this);
5885     Handle<FixedArray> closure_literals(closure->literals(), isolate());
5886     Handle<FixedArray> constant_properties = expr->constant_properties();
5887     int literal_index = expr->literal_index();
5888     int flags = expr->ComputeFlags(true);
5889
5890     Add<HPushArguments>(Add<HConstant>(closure_literals),
5891                         Add<HConstant>(literal_index),
5892                         Add<HConstant>(constant_properties),
5893                         Add<HConstant>(flags));
5894
5895     Runtime::FunctionId function_id = Runtime::kCreateObjectLiteral;
5896     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5897                                 Runtime::FunctionForId(function_id),
5898                                 4);
5899   }
5900
5901   // The object is expected in the bailout environment during computation
5902   // of the property values and is the value of the entire expression.
5903   Push(literal);
5904   int store_slot_index = 0;
5905   for (int i = 0; i < expr->properties()->length(); i++) {
5906     ObjectLiteral::Property* property = expr->properties()->at(i);
5907     if (property->is_computed_name()) return Bailout(kComputedPropertyName);
5908     if (property->IsCompileTimeValue()) continue;
5909
5910     Literal* key = property->key()->AsLiteral();
5911     Expression* value = property->value();
5912
5913     switch (property->kind()) {
5914       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
5915         DCHECK(!CompileTimeValue::IsCompileTimeValue(value));
5916         // Fall through.
5917       case ObjectLiteral::Property::COMPUTED:
5918         // It is safe to use [[Put]] here because the boilerplate already
5919         // contains computed properties with an uninitialized value.
5920         if (key->value()->IsInternalizedString()) {
5921           if (property->emit_store()) {
5922             CHECK_ALIVE(VisitForValue(value));
5923             HValue* value = Pop();
5924
5925             Handle<Map> map = property->GetReceiverType();
5926             Handle<String> name = key->AsPropertyName();
5927             HValue* store;
5928             FeedbackVectorICSlot slot = expr->GetNthSlot(store_slot_index++);
5929             if (map.is_null()) {
5930               // If we don't know the monomorphic type, do a generic store.
5931               CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot, literal,
5932                                                     name, value));
5933             } else {
5934               PropertyAccessInfo info(this, STORE, map, name);
5935               if (info.CanAccessMonomorphic()) {
5936                 HValue* checked_literal = Add<HCheckMaps>(literal, map);
5937                 DCHECK(!info.IsAccessorConstant());
5938                 store = BuildMonomorphicAccess(
5939                     &info, literal, checked_literal, value,
5940                     BailoutId::None(), BailoutId::None());
5941               } else {
5942                 CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot,
5943                                                       literal, name, value));
5944               }
5945             }
5946             if (store->IsInstruction()) {
5947               AddInstruction(HInstruction::cast(store));
5948             }
5949             DCHECK(store->HasObservableSideEffects());
5950             Add<HSimulate>(key->id(), REMOVABLE_SIMULATE);
5951
5952             // Add [[HomeObject]] to function literals.
5953             if (FunctionLiteral::NeedsHomeObject(property->value())) {
5954               Handle<Symbol> sym = isolate()->factory()->home_object_symbol();
5955               HInstruction* store_home = BuildNamedGeneric(
5956                   STORE, NULL, expr->GetNthSlot(store_slot_index++), value, sym,
5957                   literal);
5958               AddInstruction(store_home);
5959               DCHECK(store_home->HasObservableSideEffects());
5960               Add<HSimulate>(property->value()->id(), REMOVABLE_SIMULATE);
5961             }
5962           } else {
5963             CHECK_ALIVE(VisitForEffect(value));
5964           }
5965           break;
5966         }
5967         // Fall through.
5968       case ObjectLiteral::Property::PROTOTYPE:
5969       case ObjectLiteral::Property::SETTER:
5970       case ObjectLiteral::Property::GETTER:
5971         return Bailout(kObjectLiteralWithComplexProperty);
5972       default: UNREACHABLE();
5973     }
5974   }
5975
5976   // Crankshaft may not consume all the slots because it doesn't emit accessors.
5977   DCHECK(!FLAG_vector_stores || store_slot_index <= expr->slot_count());
5978
5979   if (expr->has_function()) {
5980     // Return the result of the transformation to fast properties
5981     // instead of the original since this operation changes the map
5982     // of the object. This makes sure that the original object won't
5983     // be used by other optimized code before it is transformed
5984     // (e.g. because of code motion).
5985     HToFastProperties* result = Add<HToFastProperties>(Pop());
5986     return ast_context()->ReturnValue(result);
5987   } else {
5988     return ast_context()->ReturnValue(Pop());
5989   }
5990 }
5991
5992
5993 void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
5994   DCHECK(!HasStackOverflow());
5995   DCHECK(current_block() != NULL);
5996   DCHECK(current_block()->HasPredecessor());
5997   expr->BuildConstantElements(isolate());
5998   ZoneList<Expression*>* subexprs = expr->values();
5999   int length = subexprs->length();
6000   HInstruction* literal;
6001
6002   Handle<AllocationSite> site;
6003   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
6004   bool uninitialized = false;
6005   Handle<Object> literals_cell(literals->get(expr->literal_index()),
6006                                isolate());
6007   Handle<JSObject> boilerplate_object;
6008   if (literals_cell->IsUndefined()) {
6009     uninitialized = true;
6010     Handle<Object> raw_boilerplate;
6011     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
6012         isolate(), raw_boilerplate,
6013         Runtime::CreateArrayLiteralBoilerplate(
6014             isolate(), literals, expr->constant_elements(),
6015             is_strong(function_language_mode())),
6016         Bailout(kArrayBoilerplateCreationFailed));
6017
6018     boilerplate_object = Handle<JSObject>::cast(raw_boilerplate);
6019     AllocationSiteCreationContext creation_context(isolate());
6020     site = creation_context.EnterNewScope();
6021     if (JSObject::DeepWalk(boilerplate_object, &creation_context).is_null()) {
6022       return Bailout(kArrayBoilerplateCreationFailed);
6023     }
6024     creation_context.ExitScope(site, boilerplate_object);
6025     literals->set(expr->literal_index(), *site);
6026
6027     if (boilerplate_object->elements()->map() ==
6028         isolate()->heap()->fixed_cow_array_map()) {
6029       isolate()->counters()->cow_arrays_created_runtime()->Increment();
6030     }
6031   } else {
6032     DCHECK(literals_cell->IsAllocationSite());
6033     site = Handle<AllocationSite>::cast(literals_cell);
6034     boilerplate_object = Handle<JSObject>(
6035         JSObject::cast(site->transition_info()), isolate());
6036   }
6037
6038   DCHECK(!boilerplate_object.is_null());
6039   DCHECK(site->SitePointsToLiteral());
6040
6041   ElementsKind boilerplate_elements_kind =
6042       boilerplate_object->GetElementsKind();
6043
6044   // Check whether to use fast or slow deep-copying for boilerplate.
6045   int max_properties = kMaxFastLiteralProperties;
6046   if (IsFastLiteral(boilerplate_object,
6047                     kMaxFastLiteralDepth,
6048                     &max_properties)) {
6049     AllocationSiteUsageContext site_context(isolate(), site, false);
6050     site_context.EnterNewScope();
6051     literal = BuildFastLiteral(boilerplate_object, &site_context);
6052     site_context.ExitScope(site, boilerplate_object);
6053   } else {
6054     NoObservableSideEffectsScope no_effects(this);
6055     // Boilerplate already exists and constant elements are never accessed,
6056     // pass an empty fixed array to the runtime function instead.
6057     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
6058     int literal_index = expr->literal_index();
6059     int flags = expr->ComputeFlags(true);
6060
6061     Add<HPushArguments>(Add<HConstant>(literals),
6062                         Add<HConstant>(literal_index),
6063                         Add<HConstant>(constants),
6064                         Add<HConstant>(flags));
6065
6066     Runtime::FunctionId function_id = Runtime::kCreateArrayLiteral;
6067     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
6068                                 Runtime::FunctionForId(function_id),
6069                                 4);
6070
6071     // Register to deopt if the boilerplate ElementsKind changes.
6072     top_info()->dependencies()->AssumeTransitionStable(site);
6073   }
6074
6075   // The array is expected in the bailout environment during computation
6076   // of the property values and is the value of the entire expression.
6077   Push(literal);
6078   // The literal index is on the stack, too.
6079   Push(Add<HConstant>(expr->literal_index()));
6080
6081   HInstruction* elements = NULL;
6082
6083   for (int i = 0; i < length; i++) {
6084     Expression* subexpr = subexprs->at(i);
6085     if (subexpr->IsSpread()) {
6086       return Bailout(kSpread);
6087     }
6088
6089     // If the subexpression is a literal or a simple materialized literal it
6090     // is already set in the cloned array.
6091     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
6092
6093     CHECK_ALIVE(VisitForValue(subexpr));
6094     HValue* value = Pop();
6095     if (!Smi::IsValid(i)) return Bailout(kNonSmiKeyInArrayLiteral);
6096
6097     elements = AddLoadElements(literal);
6098
6099     HValue* key = Add<HConstant>(i);
6100
6101     switch (boilerplate_elements_kind) {
6102       case FAST_SMI_ELEMENTS:
6103       case FAST_HOLEY_SMI_ELEMENTS:
6104       case FAST_ELEMENTS:
6105       case FAST_HOLEY_ELEMENTS:
6106       case FAST_DOUBLE_ELEMENTS:
6107       case FAST_HOLEY_DOUBLE_ELEMENTS: {
6108         HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
6109                                               boilerplate_elements_kind);
6110         instr->SetUninitialized(uninitialized);
6111         break;
6112       }
6113       default:
6114         UNREACHABLE();
6115         break;
6116     }
6117
6118     Add<HSimulate>(expr->GetIdForElement(i));
6119   }
6120
6121   Drop(1);  // array literal index
6122   return ast_context()->ReturnValue(Pop());
6123 }
6124
6125
6126 HCheckMaps* HOptimizedGraphBuilder::AddCheckMap(HValue* object,
6127                                                 Handle<Map> map) {
6128   BuildCheckHeapObject(object);
6129   return Add<HCheckMaps>(object, map);
6130 }
6131
6132
6133 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
6134     PropertyAccessInfo* info,
6135     HValue* checked_object) {
6136   // See if this is a load for an immutable property
6137   if (checked_object->ActualValue()->IsConstant()) {
6138     Handle<Object> object(
6139         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
6140
6141     if (object->IsJSObject()) {
6142       LookupIterator it(object, info->name(),
6143                         LookupIterator::OWN_SKIP_INTERCEPTOR);
6144       Handle<Object> value = JSReceiver::GetDataProperty(&it);
6145       if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
6146         return New<HConstant>(value);
6147       }
6148     }
6149   }
6150
6151   HObjectAccess access = info->access();
6152   if (access.representation().IsDouble() &&
6153       (!FLAG_unbox_double_fields || !access.IsInobject())) {
6154     // Load the heap number.
6155     checked_object = Add<HLoadNamedField>(
6156         checked_object, nullptr,
6157         access.WithRepresentation(Representation::Tagged()));
6158     // Load the double value from it.
6159     access = HObjectAccess::ForHeapNumberValue();
6160   }
6161
6162   SmallMapList* map_list = info->field_maps();
6163   if (map_list->length() == 0) {
6164     return New<HLoadNamedField>(checked_object, checked_object, access);
6165   }
6166
6167   UniqueSet<Map>* maps = new(zone()) UniqueSet<Map>(map_list->length(), zone());
6168   for (int i = 0; i < map_list->length(); ++i) {
6169     maps->Add(Unique<Map>::CreateImmovable(map_list->at(i)), zone());
6170   }
6171   return New<HLoadNamedField>(
6172       checked_object, checked_object, access, maps, info->field_type());
6173 }
6174
6175
6176 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
6177     PropertyAccessInfo* info,
6178     HValue* checked_object,
6179     HValue* value) {
6180   bool transition_to_field = info->IsTransition();
6181   // TODO(verwaest): Move this logic into PropertyAccessInfo.
6182   HObjectAccess field_access = info->access();
6183
6184   HStoreNamedField *instr;
6185   if (field_access.representation().IsDouble() &&
6186       (!FLAG_unbox_double_fields || !field_access.IsInobject())) {
6187     HObjectAccess heap_number_access =
6188         field_access.WithRepresentation(Representation::Tagged());
6189     if (transition_to_field) {
6190       // The store requires a mutable HeapNumber to be allocated.
6191       NoObservableSideEffectsScope no_side_effects(this);
6192       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
6193
6194       // TODO(hpayer): Allocation site pretenuring support.
6195       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
6196           HType::HeapObject(),
6197           NOT_TENURED,
6198           MUTABLE_HEAP_NUMBER_TYPE);
6199       AddStoreMapConstant(
6200           heap_number, isolate()->factory()->mutable_heap_number_map());
6201       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
6202                             value);
6203       instr = New<HStoreNamedField>(checked_object->ActualValue(),
6204                                     heap_number_access,
6205                                     heap_number);
6206     } else {
6207       // Already holds a HeapNumber; load the box and write its value field.
6208       HInstruction* heap_number =
6209           Add<HLoadNamedField>(checked_object, nullptr, heap_number_access);
6210       instr = New<HStoreNamedField>(heap_number,
6211                                     HObjectAccess::ForHeapNumberValue(),
6212                                     value, STORE_TO_INITIALIZED_ENTRY);
6213     }
6214   } else {
6215     if (field_access.representation().IsHeapObject()) {
6216       BuildCheckHeapObject(value);
6217     }
6218
6219     if (!info->field_maps()->is_empty()) {
6220       DCHECK(field_access.representation().IsHeapObject());
6221       value = Add<HCheckMaps>(value, info->field_maps());
6222     }
6223
6224     // This is a normal store.
6225     instr = New<HStoreNamedField>(
6226         checked_object->ActualValue(), field_access, value,
6227         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
6228   }
6229
6230   if (transition_to_field) {
6231     Handle<Map> transition(info->transition());
6232     DCHECK(!transition->is_deprecated());
6233     instr->SetTransition(Add<HConstant>(transition));
6234   }
6235   return instr;
6236 }
6237
6238
6239 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
6240     PropertyAccessInfo* info) {
6241   if (!CanInlinePropertyAccess(map_)) return false;
6242
6243   // Currently only handle Type::Number as a polymorphic case.
6244   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6245   // instruction.
6246   if (IsNumberType()) return false;
6247
6248   // Values are only compatible for monomorphic load if they all behave the same
6249   // regarding value wrappers.
6250   if (IsValueWrapped() != info->IsValueWrapped()) return false;
6251
6252   if (!LookupDescriptor()) return false;
6253
6254   if (!IsFound()) {
6255     return (!info->IsFound() || info->has_holder()) &&
6256            map()->prototype() == info->map()->prototype();
6257   }
6258
6259   // Mismatch if the other access info found the property in the prototype
6260   // chain.
6261   if (info->has_holder()) return false;
6262
6263   if (IsAccessorConstant()) {
6264     return accessor_.is_identical_to(info->accessor_) &&
6265         api_holder_.is_identical_to(info->api_holder_);
6266   }
6267
6268   if (IsDataConstant()) {
6269     return constant_.is_identical_to(info->constant_);
6270   }
6271
6272   DCHECK(IsData());
6273   if (!info->IsData()) return false;
6274
6275   Representation r = access_.representation();
6276   if (IsLoad()) {
6277     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
6278   } else {
6279     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
6280   }
6281   if (info->access_.offset() != access_.offset()) return false;
6282   if (info->access_.IsInobject() != access_.IsInobject()) return false;
6283   if (IsLoad()) {
6284     if (field_maps_.is_empty()) {
6285       info->field_maps_.Clear();
6286     } else if (!info->field_maps_.is_empty()) {
6287       for (int i = 0; i < field_maps_.length(); ++i) {
6288         info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
6289       }
6290       info->field_maps_.Sort();
6291     }
6292   } else {
6293     // We can only merge stores that agree on their field maps. The comparison
6294     // below is safe, since we keep the field maps sorted.
6295     if (field_maps_.length() != info->field_maps_.length()) return false;
6296     for (int i = 0; i < field_maps_.length(); ++i) {
6297       if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
6298         return false;
6299       }
6300     }
6301   }
6302   info->GeneralizeRepresentation(r);
6303   info->field_type_ = info->field_type_.Combine(field_type_);
6304   return true;
6305 }
6306
6307
6308 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
6309   if (!map_->IsJSObjectMap()) return true;
6310   LookupDescriptor(*map_, *name_);
6311   return LoadResult(map_);
6312 }
6313
6314
6315 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
6316   if (!IsLoad() && IsProperty() && IsReadOnly()) {
6317     return false;
6318   }
6319
6320   if (IsData()) {
6321     // Construct the object field access.
6322     int index = GetLocalFieldIndexFromMap(map);
6323     access_ = HObjectAccess::ForField(map, index, representation(), name_);
6324
6325     // Load field map for heap objects.
6326     return LoadFieldMaps(map);
6327   } else if (IsAccessorConstant()) {
6328     Handle<Object> accessors = GetAccessorsFromMap(map);
6329     if (!accessors->IsAccessorPair()) return false;
6330     Object* raw_accessor =
6331         IsLoad() ? Handle<AccessorPair>::cast(accessors)->getter()
6332                  : Handle<AccessorPair>::cast(accessors)->setter();
6333     if (!raw_accessor->IsJSFunction()) return false;
6334     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
6335     if (accessor->shared()->IsApiFunction()) {
6336       CallOptimization call_optimization(accessor);
6337       if (call_optimization.is_simple_api_call()) {
6338         CallOptimization::HolderLookup holder_lookup;
6339         api_holder_ =
6340             call_optimization.LookupHolderOfExpectedType(map_, &holder_lookup);
6341       }
6342     }
6343     accessor_ = accessor;
6344   } else if (IsDataConstant()) {
6345     constant_ = GetConstantFromMap(map);
6346   }
6347
6348   return true;
6349 }
6350
6351
6352 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
6353     Handle<Map> map) {
6354   // Clear any previously collected field maps/type.
6355   field_maps_.Clear();
6356   field_type_ = HType::Tagged();
6357
6358   // Figure out the field type from the accessor map.
6359   Handle<HeapType> field_type = GetFieldTypeFromMap(map);
6360
6361   // Collect the (stable) maps from the field type.
6362   int num_field_maps = field_type->NumClasses();
6363   if (num_field_maps > 0) {
6364     DCHECK(access_.representation().IsHeapObject());
6365     field_maps_.Reserve(num_field_maps, zone());
6366     HeapType::Iterator<Map> it = field_type->Classes();
6367     while (!it.Done()) {
6368       Handle<Map> field_map = it.Current();
6369       if (!field_map->is_stable()) {
6370         field_maps_.Clear();
6371         break;
6372       }
6373       field_maps_.Add(field_map, zone());
6374       it.Advance();
6375     }
6376   }
6377
6378   if (field_maps_.is_empty()) {
6379     // Store is not safe if the field map was cleared.
6380     return IsLoad() || !field_type->Is(HeapType::None());
6381   }
6382
6383   field_maps_.Sort();
6384   DCHECK_EQ(num_field_maps, field_maps_.length());
6385
6386   // Determine field HType from field HeapType.
6387   field_type_ = HType::FromType<HeapType>(field_type);
6388   DCHECK(field_type_.IsHeapObject());
6389
6390   // Add dependency on the map that introduced the field.
6391   top_info()->dependencies()->AssumeFieldType(GetFieldOwnerFromMap(map));
6392   return true;
6393 }
6394
6395
6396 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
6397   Handle<Map> map = this->map();
6398
6399   while (map->prototype()->IsJSObject()) {
6400     holder_ = handle(JSObject::cast(map->prototype()));
6401     if (holder_->map()->is_deprecated()) {
6402       JSObject::TryMigrateInstance(holder_);
6403     }
6404     map = Handle<Map>(holder_->map());
6405     if (!CanInlinePropertyAccess(map)) {
6406       NotFound();
6407       return false;
6408     }
6409     LookupDescriptor(*map, *name_);
6410     if (IsFound()) return LoadResult(map);
6411   }
6412
6413   NotFound();
6414   return !map->prototype()->IsJSReceiver();
6415 }
6416
6417
6418 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsIntegerIndexedExotic() {
6419   InstanceType instance_type = map_->instance_type();
6420   return instance_type == JS_TYPED_ARRAY_TYPE &&
6421          IsSpecialIndex(isolate()->unicode_cache(), *name_);
6422 }
6423
6424
6425 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
6426   if (!CanInlinePropertyAccess(map_)) return false;
6427   if (IsJSObjectFieldAccessor()) return IsLoad();
6428   if (IsJSArrayBufferViewFieldAccessor()) return IsLoad();
6429   if (map_->function_with_prototype() && !map_->has_non_instance_prototype() &&
6430       name_.is_identical_to(isolate()->factory()->prototype_string())) {
6431     return IsLoad();
6432   }
6433   if (!LookupDescriptor()) return false;
6434   if (IsFound()) return IsLoad() || !IsReadOnly();
6435   if (IsIntegerIndexedExotic()) return false;
6436   if (!LookupInPrototypes()) return false;
6437   if (IsLoad()) return true;
6438
6439   if (IsAccessorConstant()) return true;
6440   LookupTransition(*map_, *name_, NONE);
6441   if (IsTransitionToData() && map_->unused_property_fields() > 0) {
6442     // Construct the object field access.
6443     int descriptor = transition()->LastAdded();
6444     int index =
6445         transition()->instance_descriptors()->GetFieldIndex(descriptor) -
6446         map_->inobject_properties();
6447     PropertyDetails details =
6448         transition()->instance_descriptors()->GetDetails(descriptor);
6449     Representation representation = details.representation();
6450     access_ = HObjectAccess::ForField(map_, index, representation, name_);
6451
6452     // Load field map for heap objects.
6453     return LoadFieldMaps(transition());
6454   }
6455   return false;
6456 }
6457
6458
6459 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
6460     SmallMapList* maps) {
6461   DCHECK(map_.is_identical_to(maps->first()));
6462   if (!CanAccessMonomorphic()) return false;
6463   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6464   if (maps->length() > kMaxLoadPolymorphism) return false;
6465   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6466   if (GetJSObjectFieldAccess(&access)) {
6467     for (int i = 1; i < maps->length(); ++i) {
6468       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6469       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6470       if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
6471       if (!access.Equals(test_access)) return false;
6472     }
6473     return true;
6474   }
6475   if (GetJSArrayBufferViewFieldAccess(&access)) {
6476     for (int i = 1; i < maps->length(); ++i) {
6477       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6478       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6479       if (!test_info.GetJSArrayBufferViewFieldAccess(&test_access)) {
6480         return false;
6481       }
6482       if (!access.Equals(test_access)) return false;
6483     }
6484     return true;
6485   }
6486
6487   // Currently only handle numbers as a polymorphic case.
6488   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6489   // instruction.
6490   if (IsNumberType()) return false;
6491
6492   // Multiple maps cannot transition to the same target map.
6493   DCHECK(!IsLoad() || !IsTransition());
6494   if (IsTransition() && maps->length() > 1) return false;
6495
6496   for (int i = 1; i < maps->length(); ++i) {
6497     PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6498     if (!test_info.IsCompatible(this)) return false;
6499   }
6500
6501   return true;
6502 }
6503
6504
6505 Handle<Map> HOptimizedGraphBuilder::PropertyAccessInfo::map() {
6506   JSFunction* ctor = IC::GetRootConstructor(
6507       *map_, current_info()->closure()->context()->native_context());
6508   if (ctor != NULL) return handle(ctor->initial_map());
6509   return map_;
6510 }
6511
6512
6513 static bool NeedsWrapping(Handle<Map> map, Handle<JSFunction> target) {
6514   return !map->IsJSObjectMap() &&
6515          is_sloppy(target->shared()->language_mode()) &&
6516          !target->shared()->native();
6517 }
6518
6519
6520 bool HOptimizedGraphBuilder::PropertyAccessInfo::NeedsWrappingFor(
6521     Handle<JSFunction> target) const {
6522   return NeedsWrapping(map_, target);
6523 }
6524
6525
6526 HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
6527     PropertyAccessInfo* info, HValue* object, HValue* checked_object,
6528     HValue* value, BailoutId ast_id, BailoutId return_id,
6529     bool can_inline_accessor) {
6530   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6531   if (info->GetJSObjectFieldAccess(&access)) {
6532     DCHECK(info->IsLoad());
6533     return New<HLoadNamedField>(object, checked_object, access);
6534   }
6535
6536   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
6537     DCHECK(info->IsLoad());
6538     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
6539     return New<HLoadNamedField>(object, checked_object, access);
6540   }
6541
6542   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
6543       info->map()->function_with_prototype()) {
6544     DCHECK(!info->map()->has_non_instance_prototype());
6545     return New<HLoadFunctionPrototype>(checked_object);
6546   }
6547
6548   HValue* checked_holder = checked_object;
6549   if (info->has_holder()) {
6550     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
6551     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
6552   }
6553
6554   if (!info->IsFound()) {
6555     DCHECK(info->IsLoad());
6556     if (is_strong(function_language_mode())) {
6557       return New<HCallRuntime>(
6558           isolate()->factory()->empty_string(),
6559           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
6560           0);
6561     } else {
6562       return graph()->GetConstantUndefined();
6563     }
6564   }
6565
6566   if (info->IsData()) {
6567     if (info->IsLoad()) {
6568       return BuildLoadNamedField(info, checked_holder);
6569     } else {
6570       return BuildStoreNamedField(info, checked_object, value);
6571     }
6572   }
6573
6574   if (info->IsTransition()) {
6575     DCHECK(!info->IsLoad());
6576     return BuildStoreNamedField(info, checked_object, value);
6577   }
6578
6579   if (info->IsAccessorConstant()) {
6580     Push(checked_object);
6581     int argument_count = 1;
6582     if (!info->IsLoad()) {
6583       argument_count = 2;
6584       Push(value);
6585     }
6586
6587     if (info->NeedsWrappingFor(info->accessor())) {
6588       HValue* function = Add<HConstant>(info->accessor());
6589       PushArgumentsFromEnvironment(argument_count);
6590       return New<HCallFunction>(function, argument_count, WRAP_AND_CALL);
6591     } else if (FLAG_inline_accessors && can_inline_accessor) {
6592       bool success = info->IsLoad()
6593           ? TryInlineGetter(info->accessor(), info->map(), ast_id, return_id)
6594           : TryInlineSetter(
6595               info->accessor(), info->map(), ast_id, return_id, value);
6596       if (success || HasStackOverflow()) return NULL;
6597     }
6598
6599     PushArgumentsFromEnvironment(argument_count);
6600     return BuildCallConstantFunction(info->accessor(), argument_count);
6601   }
6602
6603   DCHECK(info->IsDataConstant());
6604   if (info->IsLoad()) {
6605     return New<HConstant>(info->constant());
6606   } else {
6607     return New<HCheckValue>(value, Handle<JSFunction>::cast(info->constant()));
6608   }
6609 }
6610
6611
6612 void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
6613     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
6614     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* value,
6615     SmallMapList* maps, Handle<String> name) {
6616   // Something did not match; must use a polymorphic load.
6617   int count = 0;
6618   HBasicBlock* join = NULL;
6619   HBasicBlock* number_block = NULL;
6620   bool handled_string = false;
6621
6622   bool handle_smi = false;
6623   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6624   int i;
6625   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6626     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6627     if (info.IsStringType()) {
6628       if (handled_string) continue;
6629       handled_string = true;
6630     }
6631     if (info.CanAccessMonomorphic()) {
6632       count++;
6633       if (info.IsNumberType()) {
6634         handle_smi = true;
6635         break;
6636       }
6637     }
6638   }
6639
6640   if (i < maps->length()) {
6641     count = -1;
6642     maps->Clear();
6643   } else {
6644     count = 0;
6645   }
6646   HControlInstruction* smi_check = NULL;
6647   handled_string = false;
6648
6649   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6650     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6651     if (info.IsStringType()) {
6652       if (handled_string) continue;
6653       handled_string = true;
6654     }
6655     if (!info.CanAccessMonomorphic()) continue;
6656
6657     if (count == 0) {
6658       join = graph()->CreateBasicBlock();
6659       if (handle_smi) {
6660         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
6661         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
6662         number_block = graph()->CreateBasicBlock();
6663         smi_check = New<HIsSmiAndBranch>(
6664             object, empty_smi_block, not_smi_block);
6665         FinishCurrentBlock(smi_check);
6666         GotoNoSimulate(empty_smi_block, number_block);
6667         set_current_block(not_smi_block);
6668       } else {
6669         BuildCheckHeapObject(object);
6670       }
6671     }
6672     ++count;
6673     HBasicBlock* if_true = graph()->CreateBasicBlock();
6674     HBasicBlock* if_false = graph()->CreateBasicBlock();
6675     HUnaryControlInstruction* compare;
6676
6677     HValue* dependency;
6678     if (info.IsNumberType()) {
6679       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
6680       compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
6681       dependency = smi_check;
6682     } else if (info.IsStringType()) {
6683       compare = New<HIsStringAndBranch>(object, if_true, if_false);
6684       dependency = compare;
6685     } else {
6686       compare = New<HCompareMap>(object, info.map(), if_true, if_false);
6687       dependency = compare;
6688     }
6689     FinishCurrentBlock(compare);
6690
6691     if (info.IsNumberType()) {
6692       GotoNoSimulate(if_true, number_block);
6693       if_true = number_block;
6694     }
6695
6696     set_current_block(if_true);
6697
6698     HValue* access =
6699         BuildMonomorphicAccess(&info, object, dependency, value, ast_id,
6700                                return_id, FLAG_polymorphic_inlining);
6701
6702     HValue* result = NULL;
6703     switch (access_type) {
6704       case LOAD:
6705         result = access;
6706         break;
6707       case STORE:
6708         result = value;
6709         break;
6710     }
6711
6712     if (access == NULL) {
6713       if (HasStackOverflow()) return;
6714     } else {
6715       if (access->IsInstruction()) {
6716         HInstruction* instr = HInstruction::cast(access);
6717         if (!instr->IsLinked()) AddInstruction(instr);
6718       }
6719       if (!ast_context()->IsEffect()) Push(result);
6720     }
6721
6722     if (current_block() != NULL) Goto(join);
6723     set_current_block(if_false);
6724   }
6725
6726   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
6727   // know about and do not want to handle ones we've never seen.  Otherwise
6728   // use a generic IC.
6729   if (count == maps->length() && FLAG_deoptimize_uncommon_cases) {
6730     FinishExitWithHardDeoptimization(
6731         Deoptimizer::kUnknownMapInPolymorphicAccess);
6732   } else {
6733     HInstruction* instr =
6734         BuildNamedGeneric(access_type, expr, slot, object, name, value);
6735     AddInstruction(instr);
6736     if (!ast_context()->IsEffect()) Push(access_type == LOAD ? instr : value);
6737
6738     if (join != NULL) {
6739       Goto(join);
6740     } else {
6741       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6742       if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6743       return;
6744     }
6745   }
6746
6747   DCHECK(join != NULL);
6748   if (join->HasPredecessor()) {
6749     join->SetJoinId(ast_id);
6750     set_current_block(join);
6751     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6752   } else {
6753     set_current_block(NULL);
6754   }
6755 }
6756
6757
6758 static bool ComputeReceiverTypes(Expression* expr,
6759                                  HValue* receiver,
6760                                  SmallMapList** t,
6761                                  Zone* zone) {
6762   SmallMapList* maps = expr->GetReceiverTypes();
6763   *t = maps;
6764   bool monomorphic = expr->IsMonomorphic();
6765   if (maps != NULL && receiver->HasMonomorphicJSObjectType()) {
6766     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
6767     maps->FilterForPossibleTransitions(root_map);
6768     monomorphic = maps->length() == 1;
6769   }
6770   return monomorphic && CanInlinePropertyAccess(maps->first());
6771 }
6772
6773
6774 static bool AreStringTypes(SmallMapList* maps) {
6775   for (int i = 0; i < maps->length(); i++) {
6776     if (maps->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
6777   }
6778   return true;
6779 }
6780
6781
6782 void HOptimizedGraphBuilder::BuildStore(Expression* expr, Property* prop,
6783                                         FeedbackVectorICSlot slot,
6784                                         BailoutId ast_id, BailoutId return_id,
6785                                         bool is_uninitialized) {
6786   if (!prop->key()->IsPropertyName()) {
6787     // Keyed store.
6788     HValue* value = Pop();
6789     HValue* key = Pop();
6790     HValue* object = Pop();
6791     bool has_side_effects = false;
6792     HValue* result =
6793         HandleKeyedElementAccess(object, key, value, expr, slot, ast_id,
6794                                  return_id, STORE, &has_side_effects);
6795     if (has_side_effects) {
6796       if (!ast_context()->IsEffect()) Push(value);
6797       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6798       if (!ast_context()->IsEffect()) Drop(1);
6799     }
6800     if (result == NULL) return;
6801     return ast_context()->ReturnValue(value);
6802   }
6803
6804   // Named store.
6805   HValue* value = Pop();
6806   HValue* object = Pop();
6807
6808   Literal* key = prop->key()->AsLiteral();
6809   Handle<String> name = Handle<String>::cast(key->value());
6810   DCHECK(!name.is_null());
6811
6812   HValue* access = BuildNamedAccess(STORE, ast_id, return_id, expr, slot,
6813                                     object, name, value, is_uninitialized);
6814   if (access == NULL) return;
6815
6816   if (!ast_context()->IsEffect()) Push(value);
6817   if (access->IsInstruction()) AddInstruction(HInstruction::cast(access));
6818   if (access->HasObservableSideEffects()) {
6819     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6820   }
6821   if (!ast_context()->IsEffect()) Drop(1);
6822   return ast_context()->ReturnValue(value);
6823 }
6824
6825
6826 void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
6827   Property* prop = expr->target()->AsProperty();
6828   DCHECK(prop != NULL);
6829   CHECK_ALIVE(VisitForValue(prop->obj()));
6830   if (!prop->key()->IsPropertyName()) {
6831     CHECK_ALIVE(VisitForValue(prop->key()));
6832   }
6833   CHECK_ALIVE(VisitForValue(expr->value()));
6834   BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
6835              expr->AssignmentId(), expr->IsUninitialized());
6836 }
6837
6838
6839 // Because not every expression has a position and there is not common
6840 // superclass of Assignment and CountOperation, we cannot just pass the
6841 // owning expression instead of position and ast_id separately.
6842 void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
6843     Variable* var, HValue* value, FeedbackVectorICSlot ic_slot,
6844     BailoutId ast_id) {
6845   Handle<GlobalObject> global(current_info()->global_object());
6846
6847   // Lookup in script contexts.
6848   {
6849     Handle<ScriptContextTable> script_contexts(
6850         global->native_context()->script_context_table());
6851     ScriptContextTable::LookupResult lookup;
6852     if (ScriptContextTable::Lookup(script_contexts, var->name(), &lookup)) {
6853       if (lookup.mode == CONST) {
6854         return Bailout(kNonInitializerAssignmentToConst);
6855       }
6856       Handle<Context> script_context =
6857           ScriptContextTable::GetContext(script_contexts, lookup.context_index);
6858
6859       Handle<Object> current_value =
6860           FixedArray::get(script_context, lookup.slot_index);
6861
6862       // If the values is not the hole, it will stay initialized,
6863       // so no need to generate a check.
6864       if (*current_value == *isolate()->factory()->the_hole_value()) {
6865         return Bailout(kReferenceToUninitializedVariable);
6866       }
6867
6868       HStoreNamedField* instr = Add<HStoreNamedField>(
6869           Add<HConstant>(script_context),
6870           HObjectAccess::ForContextSlot(lookup.slot_index), value);
6871       USE(instr);
6872       DCHECK(instr->HasObservableSideEffects());
6873       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6874       return;
6875     }
6876   }
6877
6878   LookupIterator it(global, var->name(), LookupIterator::OWN);
6879   GlobalPropertyAccess type = LookupGlobalProperty(var, &it, STORE);
6880   if (type == kUseCell) {
6881     Handle<PropertyCell> cell = it.GetPropertyCell();
6882     top_info()->dependencies()->AssumePropertyCell(cell);
6883     auto cell_type = it.property_details().cell_type();
6884     if (cell_type == PropertyCellType::kConstant ||
6885         cell_type == PropertyCellType::kUndefined) {
6886       Handle<Object> constant(cell->value(), isolate());
6887       if (value->IsConstant()) {
6888         HConstant* c_value = HConstant::cast(value);
6889         if (!constant.is_identical_to(c_value->handle(isolate()))) {
6890           Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6891                            Deoptimizer::EAGER);
6892         }
6893       } else {
6894         HValue* c_constant = Add<HConstant>(constant);
6895         IfBuilder builder(this);
6896         if (constant->IsNumber()) {
6897           builder.If<HCompareNumericAndBranch>(value, c_constant, Token::EQ);
6898         } else {
6899           builder.If<HCompareObjectEqAndBranch>(value, c_constant);
6900         }
6901         builder.Then();
6902         builder.Else();
6903         Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6904                          Deoptimizer::EAGER);
6905         builder.End();
6906       }
6907     }
6908     HConstant* cell_constant = Add<HConstant>(cell);
6909     auto access = HObjectAccess::ForPropertyCellValue();
6910     if (cell_type == PropertyCellType::kConstantType) {
6911       switch (cell->GetConstantType()) {
6912         case PropertyCellConstantType::kSmi:
6913           access = access.WithRepresentation(Representation::Smi());
6914           break;
6915         case PropertyCellConstantType::kStableMap: {
6916           // The map may no longer be stable, deopt if it's ever different from
6917           // what is currently there, which will allow for restablization.
6918           Handle<Map> map(HeapObject::cast(cell->value())->map());
6919           Add<HCheckHeapObject>(value);
6920           value = Add<HCheckMaps>(value, map);
6921           access = access.WithRepresentation(Representation::HeapObject());
6922           break;
6923         }
6924       }
6925     }
6926     HInstruction* instr = Add<HStoreNamedField>(cell_constant, access, value);
6927     instr->ClearChangesFlag(kInobjectFields);
6928     instr->SetChangesFlag(kGlobalVars);
6929     if (instr->HasObservableSideEffects()) {
6930       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6931     }
6932   } else if (var->IsGlobalSlot()) {
6933     DCHECK(var->index() > 0);
6934     DCHECK(var->IsStaticGlobalObjectProperty());
6935     int slot_index = var->index();
6936     int depth = scope()->ContextChainLength(var->scope());
6937
6938     HStoreGlobalViaContext* instr = Add<HStoreGlobalViaContext>(
6939         value, depth, slot_index, function_language_mode());
6940     USE(instr);
6941     DCHECK(instr->HasObservableSideEffects());
6942     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6943
6944   } else {
6945     HValue* global_object = Add<HLoadNamedField>(
6946         context(), nullptr,
6947         HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
6948     HStoreNamedGeneric* instr =
6949         Add<HStoreNamedGeneric>(global_object, var->name(), value,
6950                                 function_language_mode(), PREMONOMORPHIC);
6951     if (FLAG_vector_stores) {
6952       Handle<TypeFeedbackVector> vector =
6953           handle(current_feedback_vector(), isolate());
6954       instr->SetVectorAndSlot(vector, ic_slot);
6955     }
6956     USE(instr);
6957     DCHECK(instr->HasObservableSideEffects());
6958     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6959   }
6960 }
6961
6962
6963 void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
6964   Expression* target = expr->target();
6965   VariableProxy* proxy = target->AsVariableProxy();
6966   Property* prop = target->AsProperty();
6967   DCHECK(proxy == NULL || prop == NULL);
6968
6969   // We have a second position recorded in the FullCodeGenerator to have
6970   // type feedback for the binary operation.
6971   BinaryOperation* operation = expr->binary_operation();
6972
6973   if (proxy != NULL) {
6974     Variable* var = proxy->var();
6975     if (var->mode() == LET)  {
6976       return Bailout(kUnsupportedLetCompoundAssignment);
6977     }
6978
6979     CHECK_ALIVE(VisitForValue(operation));
6980
6981     switch (var->location()) {
6982       case VariableLocation::GLOBAL:
6983       case VariableLocation::UNALLOCATED:
6984         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
6985                                        expr->AssignmentId());
6986         break;
6987
6988       case VariableLocation::PARAMETER:
6989       case VariableLocation::LOCAL:
6990         if (var->mode() == CONST_LEGACY)  {
6991           return Bailout(kUnsupportedConstCompoundAssignment);
6992         }
6993         if (var->mode() == CONST) {
6994           return Bailout(kNonInitializerAssignmentToConst);
6995         }
6996         BindIfLive(var, Top());
6997         break;
6998
6999       case VariableLocation::CONTEXT: {
7000         // Bail out if we try to mutate a parameter value in a function
7001         // using the arguments object.  We do not (yet) correctly handle the
7002         // arguments property of the function.
7003         if (current_info()->scope()->arguments() != NULL) {
7004           // Parameters will be allocated to context slots.  We have no
7005           // direct way to detect that the variable is a parameter so we do
7006           // a linear search of the parameter variables.
7007           int count = current_info()->scope()->num_parameters();
7008           for (int i = 0; i < count; ++i) {
7009             if (var == current_info()->scope()->parameter(i)) {
7010               Bailout(kAssignmentToParameterFunctionUsesArgumentsObject);
7011             }
7012           }
7013         }
7014
7015         HStoreContextSlot::Mode mode;
7016
7017         switch (var->mode()) {
7018           case LET:
7019             mode = HStoreContextSlot::kCheckDeoptimize;
7020             break;
7021           case CONST:
7022             return Bailout(kNonInitializerAssignmentToConst);
7023           case CONST_LEGACY:
7024             return ast_context()->ReturnValue(Pop());
7025           default:
7026             mode = HStoreContextSlot::kNoCheck;
7027         }
7028
7029         HValue* context = BuildContextChainWalk(var);
7030         HStoreContextSlot* instr = Add<HStoreContextSlot>(
7031             context, var->index(), mode, Top());
7032         if (instr->HasObservableSideEffects()) {
7033           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
7034         }
7035         break;
7036       }
7037
7038       case VariableLocation::LOOKUP:
7039         return Bailout(kCompoundAssignmentToLookupSlot);
7040     }
7041     return ast_context()->ReturnValue(Pop());
7042
7043   } else if (prop != NULL) {
7044     CHECK_ALIVE(VisitForValue(prop->obj()));
7045     HValue* object = Top();
7046     HValue* key = NULL;
7047     if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
7048       CHECK_ALIVE(VisitForValue(prop->key()));
7049       key = Top();
7050     }
7051
7052     CHECK_ALIVE(PushLoad(prop, object, key));
7053
7054     CHECK_ALIVE(VisitForValue(expr->value()));
7055     HValue* right = Pop();
7056     HValue* left = Pop();
7057
7058     Push(BuildBinaryOperation(operation, left, right, PUSH_BEFORE_SIMULATE));
7059
7060     BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
7061                expr->AssignmentId(), expr->IsUninitialized());
7062   } else {
7063     return Bailout(kInvalidLhsInCompoundAssignment);
7064   }
7065 }
7066
7067
7068 void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
7069   DCHECK(!HasStackOverflow());
7070   DCHECK(current_block() != NULL);
7071   DCHECK(current_block()->HasPredecessor());
7072   VariableProxy* proxy = expr->target()->AsVariableProxy();
7073   Property* prop = expr->target()->AsProperty();
7074   DCHECK(proxy == NULL || prop == NULL);
7075
7076   if (expr->is_compound()) {
7077     HandleCompoundAssignment(expr);
7078     return;
7079   }
7080
7081   if (prop != NULL) {
7082     HandlePropertyAssignment(expr);
7083   } else if (proxy != NULL) {
7084     Variable* var = proxy->var();
7085
7086     if (var->mode() == CONST) {
7087       if (expr->op() != Token::INIT_CONST) {
7088         return Bailout(kNonInitializerAssignmentToConst);
7089       }
7090     } else if (var->mode() == CONST_LEGACY) {
7091       if (expr->op() != Token::INIT_CONST_LEGACY) {
7092         CHECK_ALIVE(VisitForValue(expr->value()));
7093         return ast_context()->ReturnValue(Pop());
7094       }
7095
7096       if (var->IsStackAllocated()) {
7097         // We insert a use of the old value to detect unsupported uses of const
7098         // variables (e.g. initialization inside a loop).
7099         HValue* old_value = environment()->Lookup(var);
7100         Add<HUseConst>(old_value);
7101       }
7102     }
7103
7104     if (proxy->IsArguments()) return Bailout(kAssignmentToArguments);
7105
7106     // Handle the assignment.
7107     switch (var->location()) {
7108       case VariableLocation::GLOBAL:
7109       case VariableLocation::UNALLOCATED:
7110         CHECK_ALIVE(VisitForValue(expr->value()));
7111         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
7112                                        expr->AssignmentId());
7113         return ast_context()->ReturnValue(Pop());
7114
7115       case VariableLocation::PARAMETER:
7116       case VariableLocation::LOCAL: {
7117         // Perform an initialization check for let declared variables
7118         // or parameters.
7119         if (var->mode() == LET && expr->op() == Token::ASSIGN) {
7120           HValue* env_value = environment()->Lookup(var);
7121           if (env_value == graph()->GetConstantHole()) {
7122             return Bailout(kAssignmentToLetVariableBeforeInitialization);
7123           }
7124         }
7125         // We do not allow the arguments object to occur in a context where it
7126         // may escape, but assignments to stack-allocated locals are
7127         // permitted.
7128         CHECK_ALIVE(VisitForValue(expr->value(), ARGUMENTS_ALLOWED));
7129         HValue* value = Pop();
7130         BindIfLive(var, value);
7131         return ast_context()->ReturnValue(value);
7132       }
7133
7134       case VariableLocation::CONTEXT: {
7135         // Bail out if we try to mutate a parameter value in a function using
7136         // the arguments object.  We do not (yet) correctly handle the
7137         // arguments property of the function.
7138         if (current_info()->scope()->arguments() != NULL) {
7139           // Parameters will rewrite to context slots.  We have no direct way
7140           // to detect that the variable is a parameter.
7141           int count = current_info()->scope()->num_parameters();
7142           for (int i = 0; i < count; ++i) {
7143             if (var == current_info()->scope()->parameter(i)) {
7144               return Bailout(kAssignmentToParameterInArgumentsObject);
7145             }
7146           }
7147         }
7148
7149         CHECK_ALIVE(VisitForValue(expr->value()));
7150         HStoreContextSlot::Mode mode;
7151         if (expr->op() == Token::ASSIGN) {
7152           switch (var->mode()) {
7153             case LET:
7154               mode = HStoreContextSlot::kCheckDeoptimize;
7155               break;
7156             case CONST:
7157               // This case is checked statically so no need to
7158               // perform checks here
7159               UNREACHABLE();
7160             case CONST_LEGACY:
7161               return ast_context()->ReturnValue(Pop());
7162             default:
7163               mode = HStoreContextSlot::kNoCheck;
7164           }
7165         } else if (expr->op() == Token::INIT_VAR ||
7166                    expr->op() == Token::INIT_LET ||
7167                    expr->op() == Token::INIT_CONST) {
7168           mode = HStoreContextSlot::kNoCheck;
7169         } else {
7170           DCHECK(expr->op() == Token::INIT_CONST_LEGACY);
7171
7172           mode = HStoreContextSlot::kCheckIgnoreAssignment;
7173         }
7174
7175         HValue* context = BuildContextChainWalk(var);
7176         HStoreContextSlot* instr = Add<HStoreContextSlot>(
7177             context, var->index(), mode, Top());
7178         if (instr->HasObservableSideEffects()) {
7179           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
7180         }
7181         return ast_context()->ReturnValue(Pop());
7182       }
7183
7184       case VariableLocation::LOOKUP:
7185         return Bailout(kAssignmentToLOOKUPVariable);
7186     }
7187   } else {
7188     return Bailout(kInvalidLeftHandSideInAssignment);
7189   }
7190 }
7191
7192
7193 void HOptimizedGraphBuilder::VisitYield(Yield* expr) {
7194   // Generators are not optimized, so we should never get here.
7195   UNREACHABLE();
7196 }
7197
7198
7199 void HOptimizedGraphBuilder::VisitThrow(Throw* expr) {
7200   DCHECK(!HasStackOverflow());
7201   DCHECK(current_block() != NULL);
7202   DCHECK(current_block()->HasPredecessor());
7203   if (!ast_context()->IsEffect()) {
7204     // The parser turns invalid left-hand sides in assignments into throw
7205     // statements, which may not be in effect contexts. We might still try
7206     // to optimize such functions; bail out now if we do.
7207     return Bailout(kInvalidLeftHandSideInAssignment);
7208   }
7209   CHECK_ALIVE(VisitForValue(expr->exception()));
7210
7211   HValue* value = environment()->Pop();
7212   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
7213   Add<HPushArguments>(value);
7214   Add<HCallRuntime>(isolate()->factory()->empty_string(),
7215                     Runtime::FunctionForId(Runtime::kThrow), 1);
7216   Add<HSimulate>(expr->id());
7217
7218   // If the throw definitely exits the function, we can finish with a dummy
7219   // control flow at this point.  This is not the case if the throw is inside
7220   // an inlined function which may be replaced.
7221   if (call_context() == NULL) {
7222     FinishExitCurrentBlock(New<HAbnormalExit>());
7223   }
7224 }
7225
7226
7227 HInstruction* HGraphBuilder::AddLoadStringInstanceType(HValue* string) {
7228   if (string->IsConstant()) {
7229     HConstant* c_string = HConstant::cast(string);
7230     if (c_string->HasStringValue()) {
7231       return Add<HConstant>(c_string->StringValue()->map()->instance_type());
7232     }
7233   }
7234   return Add<HLoadNamedField>(
7235       Add<HLoadNamedField>(string, nullptr, HObjectAccess::ForMap()), nullptr,
7236       HObjectAccess::ForMapInstanceType());
7237 }
7238
7239
7240 HInstruction* HGraphBuilder::AddLoadStringLength(HValue* string) {
7241   return AddInstruction(BuildLoadStringLength(string));
7242 }
7243
7244
7245 HInstruction* HGraphBuilder::BuildLoadStringLength(HValue* string) {
7246   if (string->IsConstant()) {
7247     HConstant* c_string = HConstant::cast(string);
7248     if (c_string->HasStringValue()) {
7249       return New<HConstant>(c_string->StringValue()->length());
7250     }
7251   }
7252   return New<HLoadNamedField>(string, nullptr,
7253                               HObjectAccess::ForStringLength());
7254 }
7255
7256
7257 HInstruction* HOptimizedGraphBuilder::BuildNamedGeneric(
7258     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7259     HValue* object, Handle<Name> name, HValue* value, bool is_uninitialized) {
7260   if (is_uninitialized) {
7261     Add<HDeoptimize>(
7262         Deoptimizer::kInsufficientTypeFeedbackForGenericNamedAccess,
7263         Deoptimizer::SOFT);
7264   }
7265   if (access_type == LOAD) {
7266     Handle<TypeFeedbackVector> vector =
7267         handle(current_feedback_vector(), isolate());
7268
7269     if (!expr->AsProperty()->key()->IsPropertyName()) {
7270       // It's possible that a keyed load of a constant string was converted
7271       // to a named load. Here, at the last minute, we need to make sure to
7272       // use a generic Keyed Load if we are using the type vector, because
7273       // it has to share information with full code.
7274       HConstant* key = Add<HConstant>(name);
7275       HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7276           object, key, function_language_mode(), PREMONOMORPHIC);
7277       result->SetVectorAndSlot(vector, slot);
7278       return result;
7279     }
7280
7281     HLoadNamedGeneric* result = New<HLoadNamedGeneric>(
7282         object, name, function_language_mode(), PREMONOMORPHIC);
7283     result->SetVectorAndSlot(vector, slot);
7284     return result;
7285   } else {
7286     if (FLAG_vector_stores &&
7287         current_feedback_vector()->GetKind(slot) == Code::KEYED_STORE_IC) {
7288       // It's possible that a keyed store of a constant string was converted
7289       // to a named store. Here, at the last minute, we need to make sure to
7290       // use a generic Keyed Store if we are using the type vector, because
7291       // it has to share information with full code.
7292       HConstant* key = Add<HConstant>(name);
7293       HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7294           object, key, value, function_language_mode(), PREMONOMORPHIC);
7295       Handle<TypeFeedbackVector> vector =
7296           handle(current_feedback_vector(), isolate());
7297       result->SetVectorAndSlot(vector, slot);
7298       return result;
7299     }
7300
7301     HStoreNamedGeneric* result = New<HStoreNamedGeneric>(
7302         object, name, value, function_language_mode(), PREMONOMORPHIC);
7303     if (FLAG_vector_stores) {
7304       Handle<TypeFeedbackVector> vector =
7305           handle(current_feedback_vector(), isolate());
7306       result->SetVectorAndSlot(vector, slot);
7307     }
7308     return result;
7309   }
7310 }
7311
7312
7313 HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
7314     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7315     HValue* object, HValue* key, HValue* value) {
7316   if (access_type == LOAD) {
7317     InlineCacheState initial_state = expr->AsProperty()->GetInlineCacheState();
7318     HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7319         object, key, function_language_mode(), initial_state);
7320     // HLoadKeyedGeneric with vector ics benefits from being encoded as
7321     // MEGAMORPHIC because the vector/slot combo becomes unnecessary.
7322     if (initial_state != MEGAMORPHIC) {
7323       // We need to pass vector information.
7324       Handle<TypeFeedbackVector> vector =
7325           handle(current_feedback_vector(), isolate());
7326       result->SetVectorAndSlot(vector, slot);
7327     }
7328     return result;
7329   } else {
7330     HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7331         object, key, value, function_language_mode(), PREMONOMORPHIC);
7332     if (FLAG_vector_stores) {
7333       Handle<TypeFeedbackVector> vector =
7334           handle(current_feedback_vector(), isolate());
7335       result->SetVectorAndSlot(vector, slot);
7336     }
7337     return result;
7338   }
7339 }
7340
7341
7342 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
7343   // Loads from a "stock" fast holey double arrays can elide the hole check.
7344   // Loads from a "stock" fast holey array can convert the hole to undefined
7345   // with impunity.
7346   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
7347   bool holey_double_elements =
7348       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
7349   bool holey_elements =
7350       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
7351   if ((holey_double_elements || holey_elements) &&
7352       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
7353     load_mode =
7354         holey_double_elements ? ALLOW_RETURN_HOLE : CONVERT_HOLE_TO_UNDEFINED;
7355
7356     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
7357     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
7358     BuildCheckPrototypeMaps(prototype, object_prototype);
7359     graph()->MarkDependsOnEmptyArrayProtoElements();
7360   }
7361   return load_mode;
7362 }
7363
7364
7365 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
7366     HValue* object,
7367     HValue* key,
7368     HValue* val,
7369     HValue* dependency,
7370     Handle<Map> map,
7371     PropertyAccessType access_type,
7372     KeyedAccessStoreMode store_mode) {
7373   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
7374
7375   if (access_type == STORE && map->prototype()->IsJSObject()) {
7376     // monomorphic stores need a prototype chain check because shape
7377     // changes could allow callbacks on elements in the chain that
7378     // aren't compatible with monomorphic keyed stores.
7379     PrototypeIterator iter(map);
7380     JSObject* holder = NULL;
7381     while (!iter.IsAtEnd()) {
7382       holder = JSObject::cast(*PrototypeIterator::GetCurrent(iter));
7383       iter.Advance();
7384     }
7385     DCHECK(holder && holder->IsJSObject());
7386
7387     BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
7388                             Handle<JSObject>(holder));
7389   }
7390
7391   LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7392   return BuildUncheckedMonomorphicElementAccess(
7393       checked_object, key, val,
7394       map->instance_type() == JS_ARRAY_TYPE,
7395       map->elements_kind(), access_type,
7396       load_mode, store_mode);
7397 }
7398
7399
7400 static bool CanInlineElementAccess(Handle<Map> map) {
7401   return map->IsJSObjectMap() && !map->has_dictionary_elements() &&
7402          !map->has_sloppy_arguments_elements() &&
7403          !map->has_indexed_interceptor() && !map->is_access_check_needed();
7404 }
7405
7406
7407 HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
7408     HValue* object,
7409     HValue* key,
7410     HValue* val,
7411     SmallMapList* maps) {
7412   // For polymorphic loads of similar elements kinds (i.e. all tagged or all
7413   // double), always use the "worst case" code without a transition.  This is
7414   // much faster than transitioning the elements to the worst case, trading a
7415   // HTransitionElements for a HCheckMaps, and avoiding mutation of the array.
7416   bool has_double_maps = false;
7417   bool has_smi_or_object_maps = false;
7418   bool has_js_array_access = false;
7419   bool has_non_js_array_access = false;
7420   bool has_seen_holey_elements = false;
7421   Handle<Map> most_general_consolidated_map;
7422   for (int i = 0; i < maps->length(); ++i) {
7423     Handle<Map> map = maps->at(i);
7424     if (!CanInlineElementAccess(map)) return NULL;
7425     // Don't allow mixing of JSArrays with JSObjects.
7426     if (map->instance_type() == JS_ARRAY_TYPE) {
7427       if (has_non_js_array_access) return NULL;
7428       has_js_array_access = true;
7429     } else if (has_js_array_access) {
7430       return NULL;
7431     } else {
7432       has_non_js_array_access = true;
7433     }
7434     // Don't allow mixed, incompatible elements kinds.
7435     if (map->has_fast_double_elements()) {
7436       if (has_smi_or_object_maps) return NULL;
7437       has_double_maps = true;
7438     } else if (map->has_fast_smi_or_object_elements()) {
7439       if (has_double_maps) return NULL;
7440       has_smi_or_object_maps = true;
7441     } else {
7442       return NULL;
7443     }
7444     // Remember if we've ever seen holey elements.
7445     if (IsHoleyElementsKind(map->elements_kind())) {
7446       has_seen_holey_elements = true;
7447     }
7448     // Remember the most general elements kind, the code for its load will
7449     // properly handle all of the more specific cases.
7450     if ((i == 0) || IsMoreGeneralElementsKindTransition(
7451             most_general_consolidated_map->elements_kind(),
7452             map->elements_kind())) {
7453       most_general_consolidated_map = map;
7454     }
7455   }
7456   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
7457
7458   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
7459   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
7460   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
7461   ElementsKind consolidated_elements_kind = has_seen_holey_elements
7462       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
7463       : most_general_consolidated_map->elements_kind();
7464   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
7465       checked_object, key, val,
7466       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
7467       consolidated_elements_kind,
7468       LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
7469   return instr;
7470 }
7471
7472
7473 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
7474     Expression* expr, FeedbackVectorICSlot slot, HValue* object, HValue* key,
7475     HValue* val, SmallMapList* maps, PropertyAccessType access_type,
7476     KeyedAccessStoreMode store_mode, bool* has_side_effects) {
7477   *has_side_effects = false;
7478   BuildCheckHeapObject(object);
7479
7480   if (access_type == LOAD) {
7481     HInstruction* consolidated_load =
7482         TryBuildConsolidatedElementLoad(object, key, val, maps);
7483     if (consolidated_load != NULL) {
7484       *has_side_effects |= consolidated_load->HasObservableSideEffects();
7485       return consolidated_load;
7486     }
7487   }
7488
7489   // Elements_kind transition support.
7490   MapHandleList transition_target(maps->length());
7491   // Collect possible transition targets.
7492   MapHandleList possible_transitioned_maps(maps->length());
7493   for (int i = 0; i < maps->length(); ++i) {
7494     Handle<Map> map = maps->at(i);
7495     // Loads from strings or loads with a mix of string and non-string maps
7496     // shouldn't be handled polymorphically.
7497     DCHECK(access_type != LOAD || !map->IsStringMap());
7498     ElementsKind elements_kind = map->elements_kind();
7499     if (CanInlineElementAccess(map) && IsFastElementsKind(elements_kind) &&
7500         elements_kind != GetInitialFastElementsKind()) {
7501       possible_transitioned_maps.Add(map);
7502     }
7503     if (IsSloppyArgumentsElements(elements_kind)) {
7504       HInstruction* result =
7505           BuildKeyedGeneric(access_type, expr, slot, object, key, val);
7506       *has_side_effects = result->HasObservableSideEffects();
7507       return AddInstruction(result);
7508     }
7509   }
7510   // Get transition target for each map (NULL == no transition).
7511   for (int i = 0; i < maps->length(); ++i) {
7512     Handle<Map> map = maps->at(i);
7513     Handle<Map> transitioned_map =
7514         Map::FindTransitionedMap(map, &possible_transitioned_maps);
7515     transition_target.Add(transitioned_map);
7516   }
7517
7518   MapHandleList untransitionable_maps(maps->length());
7519   HTransitionElementsKind* transition = NULL;
7520   for (int i = 0; i < maps->length(); ++i) {
7521     Handle<Map> map = maps->at(i);
7522     DCHECK(map->IsMap());
7523     if (!transition_target.at(i).is_null()) {
7524       DCHECK(Map::IsValidElementsTransition(
7525           map->elements_kind(),
7526           transition_target.at(i)->elements_kind()));
7527       transition = Add<HTransitionElementsKind>(object, map,
7528                                                 transition_target.at(i));
7529     } else {
7530       untransitionable_maps.Add(map);
7531     }
7532   }
7533
7534   // If only one map is left after transitioning, handle this case
7535   // monomorphically.
7536   DCHECK(untransitionable_maps.length() >= 1);
7537   if (untransitionable_maps.length() == 1) {
7538     Handle<Map> untransitionable_map = untransitionable_maps[0];
7539     HInstruction* instr = NULL;
7540     if (!CanInlineElementAccess(untransitionable_map)) {
7541       instr = AddInstruction(
7542           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7543     } else {
7544       instr = BuildMonomorphicElementAccess(
7545           object, key, val, transition, untransitionable_map, access_type,
7546           store_mode);
7547     }
7548     *has_side_effects |= instr->HasObservableSideEffects();
7549     return access_type == STORE ? val : instr;
7550   }
7551
7552   HBasicBlock* join = graph()->CreateBasicBlock();
7553
7554   for (int i = 0; i < untransitionable_maps.length(); ++i) {
7555     Handle<Map> map = untransitionable_maps[i];
7556     ElementsKind elements_kind = map->elements_kind();
7557     HBasicBlock* this_map = graph()->CreateBasicBlock();
7558     HBasicBlock* other_map = graph()->CreateBasicBlock();
7559     HCompareMap* mapcompare =
7560         New<HCompareMap>(object, map, this_map, other_map);
7561     FinishCurrentBlock(mapcompare);
7562
7563     set_current_block(this_map);
7564     HInstruction* access = NULL;
7565     if (!CanInlineElementAccess(map)) {
7566       access = AddInstruction(
7567           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7568     } else {
7569       DCHECK(IsFastElementsKind(elements_kind) ||
7570              IsFixedTypedArrayElementsKind(elements_kind));
7571       LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7572       // Happily, mapcompare is a checked object.
7573       access = BuildUncheckedMonomorphicElementAccess(
7574           mapcompare, key, val,
7575           map->instance_type() == JS_ARRAY_TYPE,
7576           elements_kind, access_type,
7577           load_mode,
7578           store_mode);
7579     }
7580     *has_side_effects |= access->HasObservableSideEffects();
7581     // The caller will use has_side_effects and add a correct Simulate.
7582     access->SetFlag(HValue::kHasNoObservableSideEffects);
7583     if (access_type == LOAD) {
7584       Push(access);
7585     }
7586     NoObservableSideEffectsScope scope(this);
7587     GotoNoSimulate(join);
7588     set_current_block(other_map);
7589   }
7590
7591   // Ensure that we visited at least one map above that goes to join. This is
7592   // necessary because FinishExitWithHardDeoptimization does an AbnormalExit
7593   // rather than joining the join block. If this becomes an issue, insert a
7594   // generic access in the case length() == 0.
7595   DCHECK(join->predecessors()->length() > 0);
7596   // Deopt if none of the cases matched.
7597   NoObservableSideEffectsScope scope(this);
7598   FinishExitWithHardDeoptimization(
7599       Deoptimizer::kUnknownMapInPolymorphicElementAccess);
7600   set_current_block(join);
7601   return access_type == STORE ? val : Pop();
7602 }
7603
7604
7605 HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
7606     HValue* obj, HValue* key, HValue* val, Expression* expr,
7607     FeedbackVectorICSlot slot, BailoutId ast_id, BailoutId return_id,
7608     PropertyAccessType access_type, bool* has_side_effects) {
7609   if (key->ActualValue()->IsConstant()) {
7610     Handle<Object> constant =
7611         HConstant::cast(key->ActualValue())->handle(isolate());
7612     uint32_t array_index;
7613     if (constant->IsString() &&
7614         !Handle<String>::cast(constant)->AsArrayIndex(&array_index)) {
7615       if (!constant->IsUniqueName()) {
7616         constant = isolate()->factory()->InternalizeString(
7617             Handle<String>::cast(constant));
7618       }
7619       HValue* access =
7620           BuildNamedAccess(access_type, ast_id, return_id, expr, slot, obj,
7621                            Handle<String>::cast(constant), val, false);
7622       if (access == NULL || access->IsPhi() ||
7623           HInstruction::cast(access)->IsLinked()) {
7624         *has_side_effects = false;
7625       } else {
7626         HInstruction* instr = HInstruction::cast(access);
7627         AddInstruction(instr);
7628         *has_side_effects = instr->HasObservableSideEffects();
7629       }
7630       return access;
7631     }
7632   }
7633
7634   DCHECK(!expr->IsPropertyName());
7635   HInstruction* instr = NULL;
7636
7637   SmallMapList* maps;
7638   bool monomorphic = ComputeReceiverTypes(expr, obj, &maps, zone());
7639
7640   bool force_generic = false;
7641   if (expr->GetKeyType() == PROPERTY) {
7642     // Non-Generic accesses assume that elements are being accessed, and will
7643     // deopt for non-index keys, which the IC knows will occur.
7644     // TODO(jkummerow): Consider adding proper support for property accesses.
7645     force_generic = true;
7646     monomorphic = false;
7647   } else if (access_type == STORE &&
7648              (monomorphic || (maps != NULL && !maps->is_empty()))) {
7649     // Stores can't be mono/polymorphic if their prototype chain has dictionary
7650     // elements. However a receiver map that has dictionary elements itself
7651     // should be left to normal mono/poly behavior (the other maps may benefit
7652     // from highly optimized stores).
7653     for (int i = 0; i < maps->length(); i++) {
7654       Handle<Map> current_map = maps->at(i);
7655       if (current_map->DictionaryElementsInPrototypeChainOnly()) {
7656         force_generic = true;
7657         monomorphic = false;
7658         break;
7659       }
7660     }
7661   } else if (access_type == LOAD && !monomorphic &&
7662              (maps != NULL && !maps->is_empty())) {
7663     // Polymorphic loads have to go generic if any of the maps are strings.
7664     // If some, but not all of the maps are strings, we should go generic
7665     // because polymorphic access wants to key on ElementsKind and isn't
7666     // compatible with strings.
7667     for (int i = 0; i < maps->length(); i++) {
7668       Handle<Map> current_map = maps->at(i);
7669       if (current_map->IsStringMap()) {
7670         force_generic = true;
7671         break;
7672       }
7673     }
7674   }
7675
7676   if (monomorphic) {
7677     Handle<Map> map = maps->first();
7678     if (!CanInlineElementAccess(map)) {
7679       instr = AddInstruction(
7680           BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7681     } else {
7682       BuildCheckHeapObject(obj);
7683       instr = BuildMonomorphicElementAccess(
7684           obj, key, val, NULL, map, access_type, expr->GetStoreMode());
7685     }
7686   } else if (!force_generic && (maps != NULL && !maps->is_empty())) {
7687     return HandlePolymorphicElementAccess(expr, slot, obj, key, val, maps,
7688                                           access_type, expr->GetStoreMode(),
7689                                           has_side_effects);
7690   } else {
7691     if (access_type == STORE) {
7692       if (expr->IsAssignment() &&
7693           expr->AsAssignment()->HasNoTypeInformation()) {
7694         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedStore,
7695                          Deoptimizer::SOFT);
7696       }
7697     } else {
7698       if (expr->AsProperty()->HasNoTypeInformation()) {
7699         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedLoad,
7700                          Deoptimizer::SOFT);
7701       }
7702     }
7703     instr = AddInstruction(
7704         BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7705   }
7706   *has_side_effects = instr->HasObservableSideEffects();
7707   return instr;
7708 }
7709
7710
7711 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
7712   // Outermost function already has arguments on the stack.
7713   if (function_state()->outer() == NULL) return;
7714
7715   if (function_state()->arguments_pushed()) return;
7716
7717   // Push arguments when entering inlined function.
7718   HEnterInlined* entry = function_state()->entry();
7719   entry->set_arguments_pushed();
7720
7721   HArgumentsObject* arguments = entry->arguments_object();
7722   const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
7723
7724   HInstruction* insert_after = entry;
7725   for (int i = 0; i < arguments_values->length(); i++) {
7726     HValue* argument = arguments_values->at(i);
7727     HInstruction* push_argument = New<HPushArguments>(argument);
7728     push_argument->InsertAfter(insert_after);
7729     insert_after = push_argument;
7730   }
7731
7732   HArgumentsElements* arguments_elements = New<HArgumentsElements>(true);
7733   arguments_elements->ClearFlag(HValue::kUseGVN);
7734   arguments_elements->InsertAfter(insert_after);
7735   function_state()->set_arguments_elements(arguments_elements);
7736 }
7737
7738
7739 bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
7740   VariableProxy* proxy = expr->obj()->AsVariableProxy();
7741   if (proxy == NULL) return false;
7742   if (!proxy->var()->IsStackAllocated()) return false;
7743   if (!environment()->Lookup(proxy->var())->CheckFlag(HValue::kIsArguments)) {
7744     return false;
7745   }
7746
7747   HInstruction* result = NULL;
7748   if (expr->key()->IsPropertyName()) {
7749     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7750     if (!String::Equals(name, isolate()->factory()->length_string())) {
7751       return false;
7752     }
7753
7754     if (function_state()->outer() == NULL) {
7755       HInstruction* elements = Add<HArgumentsElements>(false);
7756       result = New<HArgumentsLength>(elements);
7757     } else {
7758       // Number of arguments without receiver.
7759       int argument_count = environment()->
7760           arguments_environment()->parameter_count() - 1;
7761       result = New<HConstant>(argument_count);
7762     }
7763   } else {
7764     Push(graph()->GetArgumentsObject());
7765     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);
7766     HValue* key = Pop();
7767     Drop(1);  // Arguments object.
7768     if (function_state()->outer() == NULL) {
7769       HInstruction* elements = Add<HArgumentsElements>(false);
7770       HInstruction* length = Add<HArgumentsLength>(elements);
7771       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7772       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7773     } else {
7774       EnsureArgumentsArePushedForAccess();
7775
7776       // Number of arguments without receiver.
7777       HInstruction* elements = function_state()->arguments_elements();
7778       int argument_count = environment()->
7779           arguments_environment()->parameter_count() - 1;
7780       HInstruction* length = Add<HConstant>(argument_count);
7781       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7782       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7783     }
7784   }
7785   ast_context()->ReturnInstruction(result, expr->id());
7786   return true;
7787 }
7788
7789
7790 HValue* HOptimizedGraphBuilder::BuildNamedAccess(
7791     PropertyAccessType access, BailoutId ast_id, BailoutId return_id,
7792     Expression* expr, FeedbackVectorICSlot slot, HValue* object,
7793     Handle<String> name, HValue* value, bool is_uninitialized) {
7794   SmallMapList* maps;
7795   ComputeReceiverTypes(expr, object, &maps, zone());
7796   DCHECK(maps != NULL);
7797
7798   if (maps->length() > 0) {
7799     PropertyAccessInfo info(this, access, maps->first(), name);
7800     if (!info.CanAccessAsMonomorphic(maps)) {
7801       HandlePolymorphicNamedFieldAccess(access, expr, slot, ast_id, return_id,
7802                                         object, value, maps, name);
7803       return NULL;
7804     }
7805
7806     HValue* checked_object;
7807     // Type::Number() is only supported by polymorphic load/call handling.
7808     DCHECK(!info.IsNumberType());
7809     BuildCheckHeapObject(object);
7810     if (AreStringTypes(maps)) {
7811       checked_object =
7812           Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
7813     } else {
7814       checked_object = Add<HCheckMaps>(object, maps);
7815     }
7816     return BuildMonomorphicAccess(
7817         &info, object, checked_object, value, ast_id, return_id);
7818   }
7819
7820   return BuildNamedGeneric(access, expr, slot, object, name, value,
7821                            is_uninitialized);
7822 }
7823
7824
7825 void HOptimizedGraphBuilder::PushLoad(Property* expr,
7826                                       HValue* object,
7827                                       HValue* key) {
7828   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
7829   Push(object);
7830   if (key != NULL) Push(key);
7831   BuildLoad(expr, expr->LoadId());
7832 }
7833
7834
7835 void HOptimizedGraphBuilder::BuildLoad(Property* expr,
7836                                        BailoutId ast_id) {
7837   HInstruction* instr = NULL;
7838   if (expr->IsStringAccess()) {
7839     HValue* index = Pop();
7840     HValue* string = Pop();
7841     HInstruction* char_code = BuildStringCharCodeAt(string, index);
7842     AddInstruction(char_code);
7843     instr = NewUncasted<HStringCharFromCode>(char_code);
7844
7845   } else if (expr->key()->IsPropertyName()) {
7846     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7847     HValue* object = Pop();
7848
7849     HValue* value = BuildNamedAccess(LOAD, ast_id, expr->LoadId(), expr,
7850                                      expr->PropertyFeedbackSlot(), object, name,
7851                                      NULL, expr->IsUninitialized());
7852     if (value == NULL) return;
7853     if (value->IsPhi()) return ast_context()->ReturnValue(value);
7854     instr = HInstruction::cast(value);
7855     if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
7856
7857   } else {
7858     HValue* key = Pop();
7859     HValue* obj = Pop();
7860
7861     bool has_side_effects = false;
7862     HValue* load = HandleKeyedElementAccess(
7863         obj, key, NULL, expr, expr->PropertyFeedbackSlot(), ast_id,
7864         expr->LoadId(), LOAD, &has_side_effects);
7865     if (has_side_effects) {
7866       if (ast_context()->IsEffect()) {
7867         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7868       } else {
7869         Push(load);
7870         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7871         Drop(1);
7872       }
7873     }
7874     if (load == NULL) return;
7875     return ast_context()->ReturnValue(load);
7876   }
7877   return ast_context()->ReturnInstruction(instr, ast_id);
7878 }
7879
7880
7881 void HOptimizedGraphBuilder::VisitProperty(Property* expr) {
7882   DCHECK(!HasStackOverflow());
7883   DCHECK(current_block() != NULL);
7884   DCHECK(current_block()->HasPredecessor());
7885
7886   if (TryArgumentsAccess(expr)) return;
7887
7888   CHECK_ALIVE(VisitForValue(expr->obj()));
7889   if (!expr->key()->IsPropertyName() || expr->IsStringAccess()) {
7890     CHECK_ALIVE(VisitForValue(expr->key()));
7891   }
7892
7893   BuildLoad(expr, expr->id());
7894 }
7895
7896
7897 HInstruction* HGraphBuilder::BuildConstantMapCheck(Handle<JSObject> constant) {
7898   HCheckMaps* check = Add<HCheckMaps>(
7899       Add<HConstant>(constant), handle(constant->map()));
7900   check->ClearDependsOnFlag(kElementsKind);
7901   return check;
7902 }
7903
7904
7905 HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
7906                                                      Handle<JSObject> holder) {
7907   PrototypeIterator iter(isolate(), prototype,
7908                          PrototypeIterator::START_AT_RECEIVER);
7909   while (holder.is_null() ||
7910          !PrototypeIterator::GetCurrent(iter).is_identical_to(holder)) {
7911     BuildConstantMapCheck(
7912         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7913     iter.Advance();
7914     if (iter.IsAtEnd()) {
7915       return NULL;
7916     }
7917   }
7918   return BuildConstantMapCheck(
7919       Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7920 }
7921
7922
7923 void HOptimizedGraphBuilder::AddCheckPrototypeMaps(Handle<JSObject> holder,
7924                                                    Handle<Map> receiver_map) {
7925   if (!holder.is_null()) {
7926     Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
7927     BuildCheckPrototypeMaps(prototype, holder);
7928   }
7929 }
7930
7931
7932 HInstruction* HOptimizedGraphBuilder::NewPlainFunctionCall(
7933     HValue* fun, int argument_count, bool pass_argument_count) {
7934   return New<HCallJSFunction>(fun, argument_count, pass_argument_count);
7935 }
7936
7937
7938 HInstruction* HOptimizedGraphBuilder::NewArgumentAdaptorCall(
7939     HValue* fun, HValue* context,
7940     int argument_count, HValue* expected_param_count) {
7941   ArgumentAdaptorDescriptor descriptor(isolate());
7942   HValue* arity = Add<HConstant>(argument_count - 1);
7943
7944   HValue* op_vals[] = { context, fun, arity, expected_param_count };
7945
7946   Handle<Code> adaptor =
7947       isolate()->builtins()->ArgumentsAdaptorTrampoline();
7948   HConstant* adaptor_value = Add<HConstant>(adaptor);
7949
7950   return New<HCallWithDescriptor>(adaptor_value, argument_count, descriptor,
7951                                   Vector<HValue*>(op_vals, arraysize(op_vals)));
7952 }
7953
7954
7955 HInstruction* HOptimizedGraphBuilder::BuildCallConstantFunction(
7956     Handle<JSFunction> jsfun, int argument_count) {
7957   HValue* target = Add<HConstant>(jsfun);
7958   // For constant functions, we try to avoid calling the
7959   // argument adaptor and instead call the function directly
7960   int formal_parameter_count =
7961       jsfun->shared()->internal_formal_parameter_count();
7962   bool dont_adapt_arguments =
7963       (formal_parameter_count ==
7964        SharedFunctionInfo::kDontAdaptArgumentsSentinel);
7965   int arity = argument_count - 1;
7966   bool can_invoke_directly =
7967       dont_adapt_arguments || formal_parameter_count == arity;
7968   if (can_invoke_directly) {
7969     if (jsfun.is_identical_to(current_info()->closure())) {
7970       graph()->MarkRecursive();
7971     }
7972     return NewPlainFunctionCall(target, argument_count, dont_adapt_arguments);
7973   } else {
7974     HValue* param_count_value = Add<HConstant>(formal_parameter_count);
7975     HValue* context = Add<HLoadNamedField>(
7976         target, nullptr, HObjectAccess::ForFunctionContextPointer());
7977     return NewArgumentAdaptorCall(target, context,
7978         argument_count, param_count_value);
7979   }
7980   UNREACHABLE();
7981   return NULL;
7982 }
7983
7984
7985 class FunctionSorter {
7986  public:
7987   explicit FunctionSorter(int index = 0, int ticks = 0, int size = 0)
7988       : index_(index), ticks_(ticks), size_(size) {}
7989
7990   int index() const { return index_; }
7991   int ticks() const { return ticks_; }
7992   int size() const { return size_; }
7993
7994  private:
7995   int index_;
7996   int ticks_;
7997   int size_;
7998 };
7999
8000
8001 inline bool operator<(const FunctionSorter& lhs, const FunctionSorter& rhs) {
8002   int diff = lhs.ticks() - rhs.ticks();
8003   if (diff != 0) return diff > 0;
8004   return lhs.size() < rhs.size();
8005 }
8006
8007
8008 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(Call* expr,
8009                                                         HValue* receiver,
8010                                                         SmallMapList* maps,
8011                                                         Handle<String> name) {
8012   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
8013   FunctionSorter order[kMaxCallPolymorphism];
8014
8015   bool handle_smi = false;
8016   bool handled_string = false;
8017   int ordered_functions = 0;
8018
8019   int i;
8020   for (i = 0; i < maps->length() && ordered_functions < kMaxCallPolymorphism;
8021        ++i) {
8022     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
8023     if (info.CanAccessMonomorphic() && info.IsDataConstant() &&
8024         info.constant()->IsJSFunction()) {
8025       if (info.IsStringType()) {
8026         if (handled_string) continue;
8027         handled_string = true;
8028       }
8029       Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
8030       if (info.IsNumberType()) {
8031         handle_smi = true;
8032       }
8033       expr->set_target(target);
8034       order[ordered_functions++] = FunctionSorter(
8035           i, target->shared()->profiler_ticks(), InliningAstSize(target));
8036     }
8037   }
8038
8039   std::sort(order, order + ordered_functions);
8040
8041   if (i < maps->length()) {
8042     maps->Clear();
8043     ordered_functions = -1;
8044   }
8045
8046   HBasicBlock* number_block = NULL;
8047   HBasicBlock* join = NULL;
8048   handled_string = false;
8049   int count = 0;
8050
8051   for (int fn = 0; fn < ordered_functions; ++fn) {
8052     int i = order[fn].index();
8053     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
8054     if (info.IsStringType()) {
8055       if (handled_string) continue;
8056       handled_string = true;
8057     }
8058     // Reloads the target.
8059     info.CanAccessMonomorphic();
8060     Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
8061
8062     expr->set_target(target);
8063     if (count == 0) {
8064       // Only needed once.
8065       join = graph()->CreateBasicBlock();
8066       if (handle_smi) {
8067         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
8068         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
8069         number_block = graph()->CreateBasicBlock();
8070         FinishCurrentBlock(New<HIsSmiAndBranch>(
8071                 receiver, empty_smi_block, not_smi_block));
8072         GotoNoSimulate(empty_smi_block, number_block);
8073         set_current_block(not_smi_block);
8074       } else {
8075         BuildCheckHeapObject(receiver);
8076       }
8077     }
8078     ++count;
8079     HBasicBlock* if_true = graph()->CreateBasicBlock();
8080     HBasicBlock* if_false = graph()->CreateBasicBlock();
8081     HUnaryControlInstruction* compare;
8082
8083     Handle<Map> map = info.map();
8084     if (info.IsNumberType()) {
8085       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
8086       compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
8087     } else if (info.IsStringType()) {
8088       compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
8089     } else {
8090       compare = New<HCompareMap>(receiver, map, if_true, if_false);
8091     }
8092     FinishCurrentBlock(compare);
8093
8094     if (info.IsNumberType()) {
8095       GotoNoSimulate(if_true, number_block);
8096       if_true = number_block;
8097     }
8098
8099     set_current_block(if_true);
8100
8101     AddCheckPrototypeMaps(info.holder(), map);
8102
8103     HValue* function = Add<HConstant>(expr->target());
8104     environment()->SetExpressionStackAt(0, function);
8105     Push(receiver);
8106     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8107     bool needs_wrapping = info.NeedsWrappingFor(target);
8108     bool try_inline = FLAG_polymorphic_inlining && !needs_wrapping;
8109     if (FLAG_trace_inlining && try_inline) {
8110       Handle<JSFunction> caller = current_info()->closure();
8111       base::SmartArrayPointer<char> caller_name =
8112           caller->shared()->DebugName()->ToCString();
8113       PrintF("Trying to inline the polymorphic call to %s from %s\n",
8114              name->ToCString().get(),
8115              caller_name.get());
8116     }
8117     if (try_inline && TryInlineCall(expr)) {
8118       // Trying to inline will signal that we should bailout from the
8119       // entire compilation by setting stack overflow on the visitor.
8120       if (HasStackOverflow()) return;
8121     } else {
8122       // Since HWrapReceiver currently cannot actually wrap numbers and strings,
8123       // use the regular CallFunctionStub for method calls to wrap the receiver.
8124       // TODO(verwaest): Support creation of value wrappers directly in
8125       // HWrapReceiver.
8126       HInstruction* call = needs_wrapping
8127           ? NewUncasted<HCallFunction>(
8128               function, argument_count, WRAP_AND_CALL)
8129           : BuildCallConstantFunction(target, argument_count);
8130       PushArgumentsFromEnvironment(argument_count);
8131       AddInstruction(call);
8132       Drop(1);  // Drop the function.
8133       if (!ast_context()->IsEffect()) Push(call);
8134     }
8135
8136     if (current_block() != NULL) Goto(join);
8137     set_current_block(if_false);
8138   }
8139
8140   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
8141   // know about and do not want to handle ones we've never seen.  Otherwise
8142   // use a generic IC.
8143   if (ordered_functions == maps->length() && FLAG_deoptimize_uncommon_cases) {
8144     FinishExitWithHardDeoptimization(Deoptimizer::kUnknownMapInPolymorphicCall);
8145   } else {
8146     Property* prop = expr->expression()->AsProperty();
8147     HInstruction* function =
8148         BuildNamedGeneric(LOAD, prop, prop->PropertyFeedbackSlot(), receiver,
8149                           name, NULL, prop->IsUninitialized());
8150     AddInstruction(function);
8151     Push(function);
8152     AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
8153
8154     environment()->SetExpressionStackAt(1, function);
8155     environment()->SetExpressionStackAt(0, receiver);
8156     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8157
8158     CallFunctionFlags flags = receiver->type().IsJSObject()
8159         ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
8160     HInstruction* call = New<HCallFunction>(
8161         function, argument_count, flags);
8162
8163     PushArgumentsFromEnvironment(argument_count);
8164
8165     Drop(1);  // Function.
8166
8167     if (join != NULL) {
8168       AddInstruction(call);
8169       if (!ast_context()->IsEffect()) Push(call);
8170       Goto(join);
8171     } else {
8172       return ast_context()->ReturnInstruction(call, expr->id());
8173     }
8174   }
8175
8176   // We assume that control flow is always live after an expression.  So
8177   // even without predecessors to the join block, we set it as the exit
8178   // block and continue by adding instructions there.
8179   DCHECK(join != NULL);
8180   if (join->HasPredecessor()) {
8181     set_current_block(join);
8182     join->SetJoinId(expr->id());
8183     if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
8184   } else {
8185     set_current_block(NULL);
8186   }
8187 }
8188
8189
8190 void HOptimizedGraphBuilder::TraceInline(Handle<JSFunction> target,
8191                                          Handle<JSFunction> caller,
8192                                          const char* reason) {
8193   if (FLAG_trace_inlining) {
8194     base::SmartArrayPointer<char> target_name =
8195         target->shared()->DebugName()->ToCString();
8196     base::SmartArrayPointer<char> caller_name =
8197         caller->shared()->DebugName()->ToCString();
8198     if (reason == NULL) {
8199       PrintF("Inlined %s called from %s.\n", target_name.get(),
8200              caller_name.get());
8201     } else {
8202       PrintF("Did not inline %s called from %s (%s).\n",
8203              target_name.get(), caller_name.get(), reason);
8204     }
8205   }
8206 }
8207
8208
8209 static const int kNotInlinable = 1000000000;
8210
8211
8212 int HOptimizedGraphBuilder::InliningAstSize(Handle<JSFunction> target) {
8213   if (!FLAG_use_inlining) return kNotInlinable;
8214
8215   // Precondition: call is monomorphic and we have found a target with the
8216   // appropriate arity.
8217   Handle<JSFunction> caller = current_info()->closure();
8218   Handle<SharedFunctionInfo> target_shared(target->shared());
8219
8220   // Always inline functions that force inlining.
8221   if (target_shared->force_inline()) {
8222     return 0;
8223   }
8224   if (target->IsBuiltin()) {
8225     return kNotInlinable;
8226   }
8227
8228   if (target_shared->IsApiFunction()) {
8229     TraceInline(target, caller, "target is api function");
8230     return kNotInlinable;
8231   }
8232
8233   // Do a quick check on source code length to avoid parsing large
8234   // inlining candidates.
8235   if (target_shared->SourceSize() >
8236       Min(FLAG_max_inlined_source_size, kUnlimitedMaxInlinedSourceSize)) {
8237     TraceInline(target, caller, "target text too big");
8238     return kNotInlinable;
8239   }
8240
8241   // Target must be inlineable.
8242   if (!target_shared->IsInlineable()) {
8243     TraceInline(target, caller, "target not inlineable");
8244     return kNotInlinable;
8245   }
8246   if (target_shared->disable_optimization_reason() != kNoReason) {
8247     TraceInline(target, caller, "target contains unsupported syntax [early]");
8248     return kNotInlinable;
8249   }
8250
8251   int nodes_added = target_shared->ast_node_count();
8252   return nodes_added;
8253 }
8254
8255
8256 bool HOptimizedGraphBuilder::TryInline(Handle<JSFunction> target,
8257                                        int arguments_count,
8258                                        HValue* implicit_return_value,
8259                                        BailoutId ast_id, BailoutId return_id,
8260                                        InliningKind inlining_kind) {
8261   if (target->context()->native_context() !=
8262       top_info()->closure()->context()->native_context()) {
8263     return false;
8264   }
8265   int nodes_added = InliningAstSize(target);
8266   if (nodes_added == kNotInlinable) return false;
8267
8268   Handle<JSFunction> caller = current_info()->closure();
8269
8270   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8271     TraceInline(target, caller, "target AST is too large [early]");
8272     return false;
8273   }
8274
8275   // Don't inline deeper than the maximum number of inlining levels.
8276   HEnvironment* env = environment();
8277   int current_level = 1;
8278   while (env->outer() != NULL) {
8279     if (current_level == FLAG_max_inlining_levels) {
8280       TraceInline(target, caller, "inline depth limit reached");
8281       return false;
8282     }
8283     if (env->outer()->frame_type() == JS_FUNCTION) {
8284       current_level++;
8285     }
8286     env = env->outer();
8287   }
8288
8289   // Don't inline recursive functions.
8290   for (FunctionState* state = function_state();
8291        state != NULL;
8292        state = state->outer()) {
8293     if (*state->compilation_info()->closure() == *target) {
8294       TraceInline(target, caller, "target is recursive");
8295       return false;
8296     }
8297   }
8298
8299   // We don't want to add more than a certain number of nodes from inlining.
8300   // Always inline small methods (<= 10 nodes).
8301   if (inlined_count_ > Min(FLAG_max_inlined_nodes_cumulative,
8302                            kUnlimitedMaxInlinedNodesCumulative)) {
8303     TraceInline(target, caller, "cumulative AST node limit reached");
8304     return false;
8305   }
8306
8307   // Parse and allocate variables.
8308   // Use the same AstValueFactory for creating strings in the sub-compilation
8309   // step, but don't transfer ownership to target_info.
8310   ParseInfo parse_info(zone(), target);
8311   parse_info.set_ast_value_factory(
8312       top_info()->parse_info()->ast_value_factory());
8313   parse_info.set_ast_value_factory_owned(false);
8314
8315   CompilationInfo target_info(&parse_info);
8316   Handle<SharedFunctionInfo> target_shared(target->shared());
8317   if (target_shared->HasDebugInfo()) {
8318     TraceInline(target, caller, "target is being debugged");
8319     return false;
8320   }
8321   if (!Compiler::ParseAndAnalyze(target_info.parse_info())) {
8322     if (target_info.isolate()->has_pending_exception()) {
8323       // Parse or scope error, never optimize this function.
8324       SetStackOverflow();
8325       target_shared->DisableOptimization(kParseScopeError);
8326     }
8327     TraceInline(target, caller, "parse failure");
8328     return false;
8329   }
8330
8331   if (target_info.scope()->num_heap_slots() > 0) {
8332     TraceInline(target, caller, "target has context-allocated variables");
8333     return false;
8334   }
8335   FunctionLiteral* function = target_info.function();
8336
8337   // The following conditions must be checked again after re-parsing, because
8338   // earlier the information might not have been complete due to lazy parsing.
8339   nodes_added = function->ast_node_count();
8340   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8341     TraceInline(target, caller, "target AST is too large [late]");
8342     return false;
8343   }
8344   if (function->dont_optimize()) {
8345     TraceInline(target, caller, "target contains unsupported syntax [late]");
8346     return false;
8347   }
8348
8349   // If the function uses the arguments object check that inlining of functions
8350   // with arguments object is enabled and the arguments-variable is
8351   // stack allocated.
8352   if (function->scope()->arguments() != NULL) {
8353     if (!FLAG_inline_arguments) {
8354       TraceInline(target, caller, "target uses arguments object");
8355       return false;
8356     }
8357   }
8358
8359   // All declarations must be inlineable.
8360   ZoneList<Declaration*>* decls = target_info.scope()->declarations();
8361   int decl_count = decls->length();
8362   for (int i = 0; i < decl_count; ++i) {
8363     if (!decls->at(i)->IsInlineable()) {
8364       TraceInline(target, caller, "target has non-trivial declaration");
8365       return false;
8366     }
8367   }
8368
8369   // Generate the deoptimization data for the unoptimized version of
8370   // the target function if we don't already have it.
8371   if (!Compiler::EnsureDeoptimizationSupport(&target_info)) {
8372     TraceInline(target, caller, "could not generate deoptimization info");
8373     return false;
8374   }
8375
8376   // In strong mode it is an error to call a function with too few arguments.
8377   // In that case do not inline because then the arity check would be skipped.
8378   if (is_strong(function->language_mode()) &&
8379       arguments_count < function->parameter_count()) {
8380     TraceInline(target, caller,
8381                 "too few arguments passed to a strong function");
8382     return false;
8383   }
8384
8385   // ----------------------------------------------------------------
8386   // After this point, we've made a decision to inline this function (so
8387   // TryInline should always return true).
8388
8389   // Type-check the inlined function.
8390   DCHECK(target_shared->has_deoptimization_support());
8391   AstTyper::Run(&target_info);
8392
8393   int inlining_id = 0;
8394   if (top_info()->is_tracking_positions()) {
8395     inlining_id = top_info()->TraceInlinedFunction(
8396         target_shared, source_position(), function_state()->inlining_id());
8397   }
8398
8399   // Save the pending call context. Set up new one for the inlined function.
8400   // The function state is new-allocated because we need to delete it
8401   // in two different places.
8402   FunctionState* target_state =
8403       new FunctionState(this, &target_info, inlining_kind, inlining_id);
8404
8405   HConstant* undefined = graph()->GetConstantUndefined();
8406
8407   HEnvironment* inner_env =
8408       environment()->CopyForInlining(target,
8409                                      arguments_count,
8410                                      function,
8411                                      undefined,
8412                                      function_state()->inlining_kind());
8413
8414   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
8415   inner_env->BindContext(context);
8416
8417   // Create a dematerialized arguments object for the function, also copy the
8418   // current arguments values to use them for materialization.
8419   HEnvironment* arguments_env = inner_env->arguments_environment();
8420   int parameter_count = arguments_env->parameter_count();
8421   HArgumentsObject* arguments_object = Add<HArgumentsObject>(parameter_count);
8422   for (int i = 0; i < parameter_count; i++) {
8423     arguments_object->AddArgument(arguments_env->Lookup(i), zone());
8424   }
8425
8426   // If the function uses arguments object then bind bind one.
8427   if (function->scope()->arguments() != NULL) {
8428     DCHECK(function->scope()->arguments()->IsStackAllocated());
8429     inner_env->Bind(function->scope()->arguments(), arguments_object);
8430   }
8431
8432   // Capture the state before invoking the inlined function for deopt in the
8433   // inlined function. This simulate has no bailout-id since it's not directly
8434   // reachable for deopt, and is only used to capture the state. If the simulate
8435   // becomes reachable by merging, the ast id of the simulate merged into it is
8436   // adopted.
8437   Add<HSimulate>(BailoutId::None());
8438
8439   current_block()->UpdateEnvironment(inner_env);
8440   Scope* saved_scope = scope();
8441   set_scope(target_info.scope());
8442   HEnterInlined* enter_inlined =
8443       Add<HEnterInlined>(return_id, target, context, arguments_count, function,
8444                          function_state()->inlining_kind(),
8445                          function->scope()->arguments(), arguments_object);
8446   if (top_info()->is_tracking_positions()) {
8447     enter_inlined->set_inlining_id(inlining_id);
8448   }
8449   function_state()->set_entry(enter_inlined);
8450
8451   VisitDeclarations(target_info.scope()->declarations());
8452   VisitStatements(function->body());
8453   set_scope(saved_scope);
8454   if (HasStackOverflow()) {
8455     // Bail out if the inline function did, as we cannot residualize a call
8456     // instead, but do not disable optimization for the outer function.
8457     TraceInline(target, caller, "inline graph construction failed");
8458     target_shared->DisableOptimization(kInliningBailedOut);
8459     current_info()->RetryOptimization(kInliningBailedOut);
8460     delete target_state;
8461     return true;
8462   }
8463
8464   // Update inlined nodes count.
8465   inlined_count_ += nodes_added;
8466
8467   Handle<Code> unoptimized_code(target_shared->code());
8468   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
8469   Handle<TypeFeedbackInfo> type_info(
8470       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
8471   graph()->update_type_change_checksum(type_info->own_type_change_checksum());
8472
8473   TraceInline(target, caller, NULL);
8474
8475   if (current_block() != NULL) {
8476     FunctionState* state = function_state();
8477     if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
8478       // Falling off the end of an inlined construct call. In a test context the
8479       // return value will always evaluate to true, in a value context the
8480       // return value is the newly allocated receiver.
8481       if (call_context()->IsTest()) {
8482         Goto(inlined_test_context()->if_true(), state);
8483       } else if (call_context()->IsEffect()) {
8484         Goto(function_return(), state);
8485       } else {
8486         DCHECK(call_context()->IsValue());
8487         AddLeaveInlined(implicit_return_value, state);
8488       }
8489     } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
8490       // Falling off the end of an inlined setter call. The returned value is
8491       // never used, the value of an assignment is always the value of the RHS
8492       // of the assignment.
8493       if (call_context()->IsTest()) {
8494         inlined_test_context()->ReturnValue(implicit_return_value);
8495       } else if (call_context()->IsEffect()) {
8496         Goto(function_return(), state);
8497       } else {
8498         DCHECK(call_context()->IsValue());
8499         AddLeaveInlined(implicit_return_value, state);
8500       }
8501     } else {
8502       // Falling off the end of a normal inlined function. This basically means
8503       // returning undefined.
8504       if (call_context()->IsTest()) {
8505         Goto(inlined_test_context()->if_false(), state);
8506       } else if (call_context()->IsEffect()) {
8507         Goto(function_return(), state);
8508       } else {
8509         DCHECK(call_context()->IsValue());
8510         AddLeaveInlined(undefined, state);
8511       }
8512     }
8513   }
8514
8515   // Fix up the function exits.
8516   if (inlined_test_context() != NULL) {
8517     HBasicBlock* if_true = inlined_test_context()->if_true();
8518     HBasicBlock* if_false = inlined_test_context()->if_false();
8519
8520     HEnterInlined* entry = function_state()->entry();
8521
8522     // Pop the return test context from the expression context stack.
8523     DCHECK(ast_context() == inlined_test_context());
8524     ClearInlinedTestContext();
8525     delete target_state;
8526
8527     // Forward to the real test context.
8528     if (if_true->HasPredecessor()) {
8529       entry->RegisterReturnTarget(if_true, zone());
8530       if_true->SetJoinId(ast_id);
8531       HBasicBlock* true_target = TestContext::cast(ast_context())->if_true();
8532       Goto(if_true, true_target, function_state());
8533     }
8534     if (if_false->HasPredecessor()) {
8535       entry->RegisterReturnTarget(if_false, zone());
8536       if_false->SetJoinId(ast_id);
8537       HBasicBlock* false_target = TestContext::cast(ast_context())->if_false();
8538       Goto(if_false, false_target, function_state());
8539     }
8540     set_current_block(NULL);
8541     return true;
8542
8543   } else if (function_return()->HasPredecessor()) {
8544     function_state()->entry()->RegisterReturnTarget(function_return(), zone());
8545     function_return()->SetJoinId(ast_id);
8546     set_current_block(function_return());
8547   } else {
8548     set_current_block(NULL);
8549   }
8550   delete target_state;
8551   return true;
8552 }
8553
8554
8555 bool HOptimizedGraphBuilder::TryInlineCall(Call* expr) {
8556   return TryInline(expr->target(), expr->arguments()->length(), NULL,
8557                    expr->id(), expr->ReturnId(), NORMAL_RETURN);
8558 }
8559
8560
8561 bool HOptimizedGraphBuilder::TryInlineConstruct(CallNew* expr,
8562                                                 HValue* implicit_return_value) {
8563   return TryInline(expr->target(), expr->arguments()->length(),
8564                    implicit_return_value, expr->id(), expr->ReturnId(),
8565                    CONSTRUCT_CALL_RETURN);
8566 }
8567
8568
8569 bool HOptimizedGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
8570                                              Handle<Map> receiver_map,
8571                                              BailoutId ast_id,
8572                                              BailoutId return_id) {
8573   if (TryInlineApiGetter(getter, receiver_map, ast_id)) return true;
8574   return TryInline(getter, 0, NULL, ast_id, return_id, GETTER_CALL_RETURN);
8575 }
8576
8577
8578 bool HOptimizedGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
8579                                              Handle<Map> receiver_map,
8580                                              BailoutId id,
8581                                              BailoutId assignment_id,
8582                                              HValue* implicit_return_value) {
8583   if (TryInlineApiSetter(setter, receiver_map, id)) return true;
8584   return TryInline(setter, 1, implicit_return_value, id, assignment_id,
8585                    SETTER_CALL_RETURN);
8586 }
8587
8588
8589 bool HOptimizedGraphBuilder::TryInlineIndirectCall(Handle<JSFunction> function,
8590                                                    Call* expr,
8591                                                    int arguments_count) {
8592   return TryInline(function, arguments_count, NULL, expr->id(),
8593                    expr->ReturnId(), NORMAL_RETURN);
8594 }
8595
8596
8597 bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
8598   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8599   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8600   switch (id) {
8601     case kMathExp:
8602       if (!FLAG_fast_math) break;
8603       // Fall through if FLAG_fast_math.
8604     case kMathRound:
8605     case kMathFround:
8606     case kMathFloor:
8607     case kMathAbs:
8608     case kMathSqrt:
8609     case kMathLog:
8610     case kMathClz32:
8611       if (expr->arguments()->length() == 1) {
8612         HValue* argument = Pop();
8613         Drop(2);  // Receiver and function.
8614         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8615         ast_context()->ReturnInstruction(op, expr->id());
8616         return true;
8617       }
8618       break;
8619     case kMathImul:
8620       if (expr->arguments()->length() == 2) {
8621         HValue* right = Pop();
8622         HValue* left = Pop();
8623         Drop(2);  // Receiver and function.
8624         HInstruction* op =
8625             HMul::NewImul(isolate(), zone(), context(), left, right);
8626         ast_context()->ReturnInstruction(op, expr->id());
8627         return true;
8628       }
8629       break;
8630     default:
8631       // Not supported for inlining yet.
8632       break;
8633   }
8634   return false;
8635 }
8636
8637
8638 // static
8639 bool HOptimizedGraphBuilder::IsReadOnlyLengthDescriptor(
8640     Handle<Map> jsarray_map) {
8641   DCHECK(!jsarray_map->is_dictionary_map());
8642   Isolate* isolate = jsarray_map->GetIsolate();
8643   Handle<Name> length_string = isolate->factory()->length_string();
8644   DescriptorArray* descriptors = jsarray_map->instance_descriptors();
8645   int number = descriptors->SearchWithCache(*length_string, *jsarray_map);
8646   DCHECK_NE(DescriptorArray::kNotFound, number);
8647   return descriptors->GetDetails(number).IsReadOnly();
8648 }
8649
8650
8651 // static
8652 bool HOptimizedGraphBuilder::CanInlineArrayResizeOperation(
8653     Handle<Map> receiver_map) {
8654   return !receiver_map.is_null() &&
8655          receiver_map->instance_type() == JS_ARRAY_TYPE &&
8656          IsFastElementsKind(receiver_map->elements_kind()) &&
8657          !receiver_map->is_dictionary_map() &&
8658          !IsReadOnlyLengthDescriptor(receiver_map) &&
8659          !receiver_map->is_observed() && receiver_map->is_extensible();
8660 }
8661
8662
8663 bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
8664     Call* expr, Handle<JSFunction> function, Handle<Map> receiver_map,
8665     int args_count_no_receiver) {
8666   if (!function->shared()->HasBuiltinFunctionId()) return false;
8667   BuiltinFunctionId id = function->shared()->builtin_function_id();
8668   int argument_count = args_count_no_receiver + 1;  // Plus receiver.
8669
8670   if (receiver_map.is_null()) {
8671     HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
8672     if (receiver->IsConstant() &&
8673         HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
8674       receiver_map =
8675           handle(Handle<HeapObject>::cast(
8676                      HConstant::cast(receiver)->handle(isolate()))->map());
8677     }
8678   }
8679   // Try to inline calls like Math.* as operations in the calling function.
8680   switch (id) {
8681     case kStringCharCodeAt:
8682     case kStringCharAt:
8683       if (argument_count == 2) {
8684         HValue* index = Pop();
8685         HValue* string = Pop();
8686         Drop(1);  // Function.
8687         HInstruction* char_code =
8688             BuildStringCharCodeAt(string, index);
8689         if (id == kStringCharCodeAt) {
8690           ast_context()->ReturnInstruction(char_code, expr->id());
8691           return true;
8692         }
8693         AddInstruction(char_code);
8694         HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
8695         ast_context()->ReturnInstruction(result, expr->id());
8696         return true;
8697       }
8698       break;
8699     case kStringFromCharCode:
8700       if (argument_count == 2) {
8701         HValue* argument = Pop();
8702         Drop(2);  // Receiver and function.
8703         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
8704         ast_context()->ReturnInstruction(result, expr->id());
8705         return true;
8706       }
8707       break;
8708     case kMathExp:
8709       if (!FLAG_fast_math) break;
8710       // Fall through if FLAG_fast_math.
8711     case kMathRound:
8712     case kMathFround:
8713     case kMathFloor:
8714     case kMathAbs:
8715     case kMathSqrt:
8716     case kMathLog:
8717     case kMathClz32:
8718       if (argument_count == 2) {
8719         HValue* argument = Pop();
8720         Drop(2);  // Receiver and function.
8721         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8722         ast_context()->ReturnInstruction(op, expr->id());
8723         return true;
8724       }
8725       break;
8726     case kMathPow:
8727       if (argument_count == 3) {
8728         HValue* right = Pop();
8729         HValue* left = Pop();
8730         Drop(2);  // Receiver and function.
8731         HInstruction* result = NULL;
8732         // Use sqrt() if exponent is 0.5 or -0.5.
8733         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
8734           double exponent = HConstant::cast(right)->DoubleValue();
8735           if (exponent == 0.5) {
8736             result = NewUncasted<HUnaryMathOperation>(left, kMathPowHalf);
8737           } else if (exponent == -0.5) {
8738             HValue* one = graph()->GetConstant1();
8739             HInstruction* sqrt = AddUncasted<HUnaryMathOperation>(
8740                 left, kMathPowHalf);
8741             // MathPowHalf doesn't have side effects so there's no need for
8742             // an environment simulation here.
8743             DCHECK(!sqrt->HasObservableSideEffects());
8744             result = NewUncasted<HDiv>(one, sqrt);
8745           } else if (exponent == 2.0) {
8746             result = NewUncasted<HMul>(left, left);
8747           }
8748         }
8749
8750         if (result == NULL) {
8751           result = NewUncasted<HPower>(left, right);
8752         }
8753         ast_context()->ReturnInstruction(result, expr->id());
8754         return true;
8755       }
8756       break;
8757     case kMathMax:
8758     case kMathMin:
8759       if (argument_count == 3) {
8760         HValue* right = Pop();
8761         HValue* left = Pop();
8762         Drop(2);  // Receiver and function.
8763         HMathMinMax::Operation op = (id == kMathMin) ? HMathMinMax::kMathMin
8764                                                      : HMathMinMax::kMathMax;
8765         HInstruction* result = NewUncasted<HMathMinMax>(left, right, op);
8766         ast_context()->ReturnInstruction(result, expr->id());
8767         return true;
8768       }
8769       break;
8770     case kMathImul:
8771       if (argument_count == 3) {
8772         HValue* right = Pop();
8773         HValue* left = Pop();
8774         Drop(2);  // Receiver and function.
8775         HInstruction* result =
8776             HMul::NewImul(isolate(), zone(), context(), left, right);
8777         ast_context()->ReturnInstruction(result, expr->id());
8778         return true;
8779       }
8780       break;
8781     case kArrayPop: {
8782       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8783       ElementsKind elements_kind = receiver_map->elements_kind();
8784
8785       Drop(args_count_no_receiver);
8786       HValue* result;
8787       HValue* reduced_length;
8788       HValue* receiver = Pop();
8789
8790       HValue* checked_object = AddCheckMap(receiver, receiver_map);
8791       HValue* length =
8792           Add<HLoadNamedField>(checked_object, nullptr,
8793                                HObjectAccess::ForArrayLength(elements_kind));
8794
8795       Drop(1);  // Function.
8796
8797       { NoObservableSideEffectsScope scope(this);
8798         IfBuilder length_checker(this);
8799
8800         HValue* bounds_check = length_checker.If<HCompareNumericAndBranch>(
8801             length, graph()->GetConstant0(), Token::EQ);
8802         length_checker.Then();
8803
8804         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8805
8806         length_checker.Else();
8807         HValue* elements = AddLoadElements(checked_object);
8808         // Ensure that we aren't popping from a copy-on-write array.
8809         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8810           elements = BuildCopyElementsOnWrite(checked_object, elements,
8811                                               elements_kind, length);
8812         }
8813         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
8814         result = AddElementAccess(elements, reduced_length, NULL,
8815                                   bounds_check, elements_kind, LOAD);
8816         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
8817                            ? graph()->GetConstantHole()
8818                            : Add<HConstant>(HConstant::kHoleNaN);
8819         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8820           elements_kind = FAST_HOLEY_ELEMENTS;
8821         }
8822         AddElementAccess(
8823             elements, reduced_length, hole, bounds_check, elements_kind, STORE);
8824         Add<HStoreNamedField>(
8825             checked_object, HObjectAccess::ForArrayLength(elements_kind),
8826             reduced_length, STORE_TO_INITIALIZED_ENTRY);
8827
8828         if (!ast_context()->IsEffect()) Push(result);
8829
8830         length_checker.End();
8831       }
8832       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8833       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8834       if (!ast_context()->IsEffect()) Drop(1);
8835
8836       ast_context()->ReturnValue(result);
8837       return true;
8838     }
8839     case kArrayPush: {
8840       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8841       ElementsKind elements_kind = receiver_map->elements_kind();
8842
8843       // If there may be elements accessors in the prototype chain, the fast
8844       // inlined version can't be used.
8845       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8846       // If there currently can be no elements accessors on the prototype chain,
8847       // it doesn't mean that there won't be any later. Install a full prototype
8848       // chain check to trap element accessors being installed on the prototype
8849       // chain, which would cause elements to go to dictionary mode and result
8850       // in a map change.
8851       Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
8852       BuildCheckPrototypeMaps(prototype, Handle<JSObject>());
8853
8854       // Protect against adding elements to the Array prototype, which needs to
8855       // route through appropriate bottlenecks.
8856       if (isolate()->IsFastArrayConstructorPrototypeChainIntact() &&
8857           !prototype->IsJSArray()) {
8858         return false;
8859       }
8860
8861       const int argc = args_count_no_receiver;
8862       if (argc != 1) return false;
8863
8864       HValue* value_to_push = Pop();
8865       HValue* array = Pop();
8866       Drop(1);  // Drop function.
8867
8868       HInstruction* new_size = NULL;
8869       HValue* length = NULL;
8870
8871       {
8872         NoObservableSideEffectsScope scope(this);
8873
8874         length = Add<HLoadNamedField>(
8875             array, nullptr, HObjectAccess::ForArrayLength(elements_kind));
8876
8877         new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
8878
8879         bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
8880         HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
8881         BuildUncheckedMonomorphicElementAccess(
8882             checked_array, length, value_to_push, is_array, elements_kind,
8883             STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
8884
8885         if (!ast_context()->IsEffect()) Push(new_size);
8886         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8887         if (!ast_context()->IsEffect()) Drop(1);
8888       }
8889
8890       ast_context()->ReturnValue(new_size);
8891       return true;
8892     }
8893     case kArrayShift: {
8894       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8895       ElementsKind kind = receiver_map->elements_kind();
8896
8897       // If there may be elements accessors in the prototype chain, the fast
8898       // inlined version can't be used.
8899       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8900
8901       // If there currently can be no elements accessors on the prototype chain,
8902       // it doesn't mean that there won't be any later. Install a full prototype
8903       // chain check to trap element accessors being installed on the prototype
8904       // chain, which would cause elements to go to dictionary mode and result
8905       // in a map change.
8906       BuildCheckPrototypeMaps(
8907           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8908           Handle<JSObject>::null());
8909
8910       // Threshold for fast inlined Array.shift().
8911       HConstant* inline_threshold = Add<HConstant>(static_cast<int32_t>(16));
8912
8913       Drop(args_count_no_receiver);
8914       HValue* receiver = Pop();
8915       HValue* function = Pop();
8916       HValue* result;
8917
8918       {
8919         NoObservableSideEffectsScope scope(this);
8920
8921         HValue* length = Add<HLoadNamedField>(
8922             receiver, nullptr, HObjectAccess::ForArrayLength(kind));
8923
8924         IfBuilder if_lengthiszero(this);
8925         HValue* lengthiszero = if_lengthiszero.If<HCompareNumericAndBranch>(
8926             length, graph()->GetConstant0(), Token::EQ);
8927         if_lengthiszero.Then();
8928         {
8929           if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8930         }
8931         if_lengthiszero.Else();
8932         {
8933           HValue* elements = AddLoadElements(receiver);
8934
8935           // Check if we can use the fast inlined Array.shift().
8936           IfBuilder if_inline(this);
8937           if_inline.If<HCompareNumericAndBranch>(
8938               length, inline_threshold, Token::LTE);
8939           if (IsFastSmiOrObjectElementsKind(kind)) {
8940             // We cannot handle copy-on-write backing stores here.
8941             if_inline.AndIf<HCompareMap>(
8942                 elements, isolate()->factory()->fixed_array_map());
8943           }
8944           if_inline.Then();
8945           {
8946             // Remember the result.
8947             if (!ast_context()->IsEffect()) {
8948               Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
8949                                     lengthiszero, kind, LOAD));
8950             }
8951
8952             // Compute the new length.
8953             HValue* new_length = AddUncasted<HSub>(
8954                 length, graph()->GetConstant1());
8955             new_length->ClearFlag(HValue::kCanOverflow);
8956
8957             // Copy the remaining elements.
8958             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
8959             {
8960               HValue* new_key = loop.BeginBody(
8961                   graph()->GetConstant0(), new_length, Token::LT);
8962               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
8963               key->ClearFlag(HValue::kCanOverflow);
8964               ElementsKind copy_kind =
8965                   kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
8966               HValue* element = AddUncasted<HLoadKeyed>(
8967                   elements, key, lengthiszero, copy_kind, ALLOW_RETURN_HOLE);
8968               HStoreKeyed* store =
8969                   Add<HStoreKeyed>(elements, new_key, element, copy_kind);
8970               store->SetFlag(HValue::kAllowUndefinedAsNaN);
8971             }
8972             loop.EndBody();
8973
8974             // Put a hole at the end.
8975             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
8976                                ? graph()->GetConstantHole()
8977                                : Add<HConstant>(HConstant::kHoleNaN);
8978             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
8979             Add<HStoreKeyed>(
8980                 elements, new_length, hole, kind, INITIALIZING_STORE);
8981
8982             // Remember new length.
8983             Add<HStoreNamedField>(
8984                 receiver, HObjectAccess::ForArrayLength(kind),
8985                 new_length, STORE_TO_INITIALIZED_ENTRY);
8986           }
8987           if_inline.Else();
8988           {
8989             Add<HPushArguments>(receiver);
8990             result = Add<HCallJSFunction>(function, 1, true);
8991             if (!ast_context()->IsEffect()) Push(result);
8992           }
8993           if_inline.End();
8994         }
8995         if_lengthiszero.End();
8996       }
8997       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8998       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8999       if (!ast_context()->IsEffect()) Drop(1);
9000       ast_context()->ReturnValue(result);
9001       return true;
9002     }
9003     case kArrayIndexOf:
9004     case kArrayLastIndexOf: {
9005       if (receiver_map.is_null()) return false;
9006       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
9007       ElementsKind kind = receiver_map->elements_kind();
9008       if (!IsFastElementsKind(kind)) return false;
9009       if (receiver_map->is_observed()) return false;
9010       if (argument_count != 2) return false;
9011       if (!receiver_map->is_extensible()) return false;
9012
9013       // If there may be elements accessors in the prototype chain, the fast
9014       // inlined version can't be used.
9015       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
9016
9017       // If there currently can be no elements accessors on the prototype chain,
9018       // it doesn't mean that there won't be any later. Install a full prototype
9019       // chain check to trap element accessors being installed on the prototype
9020       // chain, which would cause elements to go to dictionary mode and result
9021       // in a map change.
9022       BuildCheckPrototypeMaps(
9023           handle(JSObject::cast(receiver_map->prototype()), isolate()),
9024           Handle<JSObject>::null());
9025
9026       HValue* search_element = Pop();
9027       HValue* receiver = Pop();
9028       Drop(1);  // Drop function.
9029
9030       ArrayIndexOfMode mode = (id == kArrayIndexOf)
9031           ? kFirstIndexOf : kLastIndexOf;
9032       HValue* index = BuildArrayIndexOf(receiver, search_element, kind, mode);
9033
9034       if (!ast_context()->IsEffect()) Push(index);
9035       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
9036       if (!ast_context()->IsEffect()) Drop(1);
9037       ast_context()->ReturnValue(index);
9038       return true;
9039     }
9040     default:
9041       // Not yet supported for inlining.
9042       break;
9043   }
9044   return false;
9045 }
9046
9047
9048 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
9049                                                       HValue* receiver) {
9050   Handle<JSFunction> function = expr->target();
9051   int argc = expr->arguments()->length();
9052   SmallMapList receiver_maps;
9053   return TryInlineApiCall(function,
9054                           receiver,
9055                           &receiver_maps,
9056                           argc,
9057                           expr->id(),
9058                           kCallApiFunction);
9059 }
9060
9061
9062 bool HOptimizedGraphBuilder::TryInlineApiMethodCall(
9063     Call* expr,
9064     HValue* receiver,
9065     SmallMapList* receiver_maps) {
9066   Handle<JSFunction> function = expr->target();
9067   int argc = expr->arguments()->length();
9068   return TryInlineApiCall(function,
9069                           receiver,
9070                           receiver_maps,
9071                           argc,
9072                           expr->id(),
9073                           kCallApiMethod);
9074 }
9075
9076
9077 bool HOptimizedGraphBuilder::TryInlineApiGetter(Handle<JSFunction> function,
9078                                                 Handle<Map> receiver_map,
9079                                                 BailoutId ast_id) {
9080   SmallMapList receiver_maps(1, zone());
9081   receiver_maps.Add(receiver_map, zone());
9082   return TryInlineApiCall(function,
9083                           NULL,  // Receiver is on expression stack.
9084                           &receiver_maps,
9085                           0,
9086                           ast_id,
9087                           kCallApiGetter);
9088 }
9089
9090
9091 bool HOptimizedGraphBuilder::TryInlineApiSetter(Handle<JSFunction> function,
9092                                                 Handle<Map> receiver_map,
9093                                                 BailoutId ast_id) {
9094   SmallMapList receiver_maps(1, zone());
9095   receiver_maps.Add(receiver_map, zone());
9096   return TryInlineApiCall(function,
9097                           NULL,  // Receiver is on expression stack.
9098                           &receiver_maps,
9099                           1,
9100                           ast_id,
9101                           kCallApiSetter);
9102 }
9103
9104
9105 bool HOptimizedGraphBuilder::TryInlineApiCall(Handle<JSFunction> function,
9106                                                HValue* receiver,
9107                                                SmallMapList* receiver_maps,
9108                                                int argc,
9109                                                BailoutId ast_id,
9110                                                ApiCallType call_type) {
9111   if (function->context()->native_context() !=
9112       top_info()->closure()->context()->native_context()) {
9113     return false;
9114   }
9115   CallOptimization optimization(function);
9116   if (!optimization.is_simple_api_call()) return false;
9117   Handle<Map> holder_map;
9118   for (int i = 0; i < receiver_maps->length(); ++i) {
9119     auto map = receiver_maps->at(i);
9120     // Don't inline calls to receivers requiring accesschecks.
9121     if (map->is_access_check_needed()) return false;
9122   }
9123   if (call_type == kCallApiFunction) {
9124     // Cannot embed a direct reference to the global proxy map
9125     // as it maybe dropped on deserialization.
9126     CHECK(!isolate()->serializer_enabled());
9127     DCHECK_EQ(0, receiver_maps->length());
9128     receiver_maps->Add(handle(function->global_proxy()->map()), zone());
9129   }
9130   CallOptimization::HolderLookup holder_lookup =
9131       CallOptimization::kHolderNotFound;
9132   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
9133       receiver_maps->first(), &holder_lookup);
9134   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
9135
9136   if (FLAG_trace_inlining) {
9137     PrintF("Inlining api function ");
9138     function->ShortPrint();
9139     PrintF("\n");
9140   }
9141
9142   bool is_function = false;
9143   bool is_store = false;
9144   switch (call_type) {
9145     case kCallApiFunction:
9146     case kCallApiMethod:
9147       // Need to check that none of the receiver maps could have changed.
9148       Add<HCheckMaps>(receiver, receiver_maps);
9149       // Need to ensure the chain between receiver and api_holder is intact.
9150       if (holder_lookup == CallOptimization::kHolderFound) {
9151         AddCheckPrototypeMaps(api_holder, receiver_maps->first());
9152       } else {
9153         DCHECK_EQ(holder_lookup, CallOptimization::kHolderIsReceiver);
9154       }
9155       // Includes receiver.
9156       PushArgumentsFromEnvironment(argc + 1);
9157       is_function = true;
9158       break;
9159     case kCallApiGetter:
9160       // Receiver and prototype chain cannot have changed.
9161       DCHECK_EQ(0, argc);
9162       DCHECK_NULL(receiver);
9163       // Receiver is on expression stack.
9164       receiver = Pop();
9165       Add<HPushArguments>(receiver);
9166       break;
9167     case kCallApiSetter:
9168       {
9169         is_store = true;
9170         // Receiver and prototype chain cannot have changed.
9171         DCHECK_EQ(1, argc);
9172         DCHECK_NULL(receiver);
9173         // Receiver and value are on expression stack.
9174         HValue* value = Pop();
9175         receiver = Pop();
9176         Add<HPushArguments>(receiver, value);
9177         break;
9178      }
9179   }
9180
9181   HValue* holder = NULL;
9182   switch (holder_lookup) {
9183     case CallOptimization::kHolderFound:
9184       holder = Add<HConstant>(api_holder);
9185       break;
9186     case CallOptimization::kHolderIsReceiver:
9187       holder = receiver;
9188       break;
9189     case CallOptimization::kHolderNotFound:
9190       UNREACHABLE();
9191       break;
9192   }
9193   Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
9194   Handle<Object> call_data_obj(api_call_info->data(), isolate());
9195   bool call_data_undefined = call_data_obj->IsUndefined();
9196   HValue* call_data = Add<HConstant>(call_data_obj);
9197   ApiFunction fun(v8::ToCData<Address>(api_call_info->callback()));
9198   ExternalReference ref = ExternalReference(&fun,
9199                                             ExternalReference::DIRECT_API_CALL,
9200                                             isolate());
9201   HValue* api_function_address = Add<HConstant>(ExternalReference(ref));
9202
9203   HValue* op_vals[] = {context(), Add<HConstant>(function), call_data, holder,
9204                        api_function_address, nullptr};
9205
9206   HInstruction* call = nullptr;
9207   if (!is_function) {
9208     CallApiAccessorStub stub(isolate(), is_store, call_data_undefined);
9209     Handle<Code> code = stub.GetCode();
9210     HConstant* code_value = Add<HConstant>(code);
9211     ApiAccessorDescriptor descriptor(isolate());
9212     call = New<HCallWithDescriptor>(
9213         code_value, argc + 1, descriptor,
9214         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9215   } else if (argc <= CallApiFunctionWithFixedArgsStub::kMaxFixedArgs) {
9216     CallApiFunctionWithFixedArgsStub stub(isolate(), argc, call_data_undefined);
9217     Handle<Code> code = stub.GetCode();
9218     HConstant* code_value = Add<HConstant>(code);
9219     ApiFunctionWithFixedArgsDescriptor descriptor(isolate());
9220     call = New<HCallWithDescriptor>(
9221         code_value, argc + 1, descriptor,
9222         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9223     Drop(1);  // Drop function.
9224   } else {
9225     op_vals[arraysize(op_vals) - 1] = Add<HConstant>(argc);
9226     CallApiFunctionStub stub(isolate(), call_data_undefined);
9227     Handle<Code> code = stub.GetCode();
9228     HConstant* code_value = Add<HConstant>(code);
9229     ApiFunctionDescriptor descriptor(isolate());
9230     call =
9231         New<HCallWithDescriptor>(code_value, argc + 1, descriptor,
9232                                  Vector<HValue*>(op_vals, arraysize(op_vals)));
9233     Drop(1);  // Drop function.
9234   }
9235
9236   ast_context()->ReturnInstruction(call, ast_id);
9237   return true;
9238 }
9239
9240
9241 void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
9242                                                 int arguments_count) {
9243   Handle<JSFunction> known_function;
9244   int args_count_no_receiver = arguments_count - 1;
9245   if (function->IsConstant() &&
9246       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9247     known_function =
9248         Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
9249     if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
9250                                    args_count_no_receiver)) {
9251       if (FLAG_trace_inlining) {
9252         PrintF("Inlining builtin ");
9253         known_function->ShortPrint();
9254         PrintF("\n");
9255       }
9256       return;
9257     }
9258
9259     if (TryInlineIndirectCall(known_function, expr, args_count_no_receiver)) {
9260       return;
9261     }
9262   }
9263
9264   PushArgumentsFromEnvironment(arguments_count);
9265   HInvokeFunction* call =
9266       New<HInvokeFunction>(function, known_function, arguments_count);
9267   Drop(1);  // Function
9268   ast_context()->ReturnInstruction(call, expr->id());
9269 }
9270
9271
9272 bool HOptimizedGraphBuilder::TryIndirectCall(Call* expr) {
9273   DCHECK(expr->expression()->IsProperty());
9274
9275   if (!expr->IsMonomorphic()) {
9276     return false;
9277   }
9278   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9279   if (function_map->instance_type() != JS_FUNCTION_TYPE ||
9280       !expr->target()->shared()->HasBuiltinFunctionId()) {
9281     return false;
9282   }
9283
9284   switch (expr->target()->shared()->builtin_function_id()) {
9285     case kFunctionCall: {
9286       if (expr->arguments()->length() == 0) return false;
9287       BuildFunctionCall(expr);
9288       return true;
9289     }
9290     case kFunctionApply: {
9291       // For .apply, only the pattern f.apply(receiver, arguments)
9292       // is supported.
9293       if (current_info()->scope()->arguments() == NULL) return false;
9294
9295       if (!CanBeFunctionApplyArguments(expr)) return false;
9296
9297       BuildFunctionApply(expr);
9298       return true;
9299     }
9300     default: { return false; }
9301   }
9302   UNREACHABLE();
9303 }
9304
9305
9306 void HOptimizedGraphBuilder::BuildFunctionApply(Call* expr) {
9307   ZoneList<Expression*>* args = expr->arguments();
9308   CHECK_ALIVE(VisitForValue(args->at(0)));
9309   HValue* receiver = Pop();  // receiver
9310   HValue* function = Pop();  // f
9311   Drop(1);  // apply
9312
9313   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9314   HValue* checked_function = AddCheckMap(function, function_map);
9315
9316   if (function_state()->outer() == NULL) {
9317     HInstruction* elements = Add<HArgumentsElements>(false);
9318     HInstruction* length = Add<HArgumentsLength>(elements);
9319     HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
9320     HInstruction* result = New<HApplyArguments>(function,
9321                                                 wrapped_receiver,
9322                                                 length,
9323                                                 elements);
9324     ast_context()->ReturnInstruction(result, expr->id());
9325   } else {
9326     // We are inside inlined function and we know exactly what is inside
9327     // arguments object. But we need to be able to materialize at deopt.
9328     DCHECK_EQ(environment()->arguments_environment()->parameter_count(),
9329               function_state()->entry()->arguments_object()->arguments_count());
9330     HArgumentsObject* args = function_state()->entry()->arguments_object();
9331     const ZoneList<HValue*>* arguments_values = args->arguments_values();
9332     int arguments_count = arguments_values->length();
9333     Push(function);
9334     Push(BuildWrapReceiver(receiver, checked_function));
9335     for (int i = 1; i < arguments_count; i++) {
9336       Push(arguments_values->at(i));
9337     }
9338     HandleIndirectCall(expr, function, arguments_count);
9339   }
9340 }
9341
9342
9343 // f.call(...)
9344 void HOptimizedGraphBuilder::BuildFunctionCall(Call* expr) {
9345   HValue* function = Top();  // f
9346   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9347   HValue* checked_function = AddCheckMap(function, function_map);
9348
9349   // f and call are on the stack in the unoptimized code
9350   // during evaluation of the arguments.
9351   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9352
9353   int args_length = expr->arguments()->length();
9354   int receiver_index = args_length - 1;
9355   // Patch the receiver.
9356   HValue* receiver = BuildWrapReceiver(
9357       environment()->ExpressionStackAt(receiver_index), checked_function);
9358   environment()->SetExpressionStackAt(receiver_index, receiver);
9359
9360   // Call must not be on the stack from now on.
9361   int call_index = args_length + 1;
9362   environment()->RemoveExpressionStackAt(call_index);
9363
9364   HandleIndirectCall(expr, function, args_length);
9365 }
9366
9367
9368 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
9369                                                     Handle<JSFunction> target) {
9370   SharedFunctionInfo* shared = target->shared();
9371   if (is_sloppy(shared->language_mode()) && !shared->native()) {
9372     // Cannot embed a direct reference to the global proxy
9373     // as is it dropped on deserialization.
9374     CHECK(!isolate()->serializer_enabled());
9375     Handle<JSObject> global_proxy(target->context()->global_proxy());
9376     return Add<HConstant>(global_proxy);
9377   }
9378   return graph()->GetConstantUndefined();
9379 }
9380
9381
9382 void HOptimizedGraphBuilder::BuildArrayCall(Expression* expression,
9383                                             int arguments_count,
9384                                             HValue* function,
9385                                             Handle<AllocationSite> site) {
9386   Add<HCheckValue>(function, array_function());
9387
9388   if (IsCallArrayInlineable(arguments_count, site)) {
9389     BuildInlinedCallArray(expression, arguments_count, site);
9390     return;
9391   }
9392
9393   HInstruction* call = PreProcessCall(New<HCallNewArray>(
9394       function, arguments_count + 1, site->GetElementsKind(), site));
9395   if (expression->IsCall()) {
9396     Drop(1);
9397   }
9398   ast_context()->ReturnInstruction(call, expression->id());
9399 }
9400
9401
9402 HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
9403                                                   HValue* search_element,
9404                                                   ElementsKind kind,
9405                                                   ArrayIndexOfMode mode) {
9406   DCHECK(IsFastElementsKind(kind));
9407
9408   NoObservableSideEffectsScope no_effects(this);
9409
9410   HValue* elements = AddLoadElements(receiver);
9411   HValue* length = AddLoadArrayLength(receiver, kind);
9412
9413   HValue* initial;
9414   HValue* terminating;
9415   Token::Value token;
9416   LoopBuilder::Direction direction;
9417   if (mode == kFirstIndexOf) {
9418     initial = graph()->GetConstant0();
9419     terminating = length;
9420     token = Token::LT;
9421     direction = LoopBuilder::kPostIncrement;
9422   } else {
9423     DCHECK_EQ(kLastIndexOf, mode);
9424     initial = length;
9425     terminating = graph()->GetConstant0();
9426     token = Token::GT;
9427     direction = LoopBuilder::kPreDecrement;
9428   }
9429
9430   Push(graph()->GetConstantMinus1());
9431   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
9432     // Make sure that we can actually compare numbers correctly below, see
9433     // https://code.google.com/p/chromium/issues/detail?id=407946 for details.
9434     search_element = AddUncasted<HForceRepresentation>(
9435         search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
9436                                                     : Representation::Double());
9437
9438     LoopBuilder loop(this, context(), direction);
9439     {
9440       HValue* index = loop.BeginBody(initial, terminating, token);
9441       HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr, kind,
9442                                                 ALLOW_RETURN_HOLE);
9443       IfBuilder if_issame(this);
9444       if_issame.If<HCompareNumericAndBranch>(element, search_element,
9445                                              Token::EQ_STRICT);
9446       if_issame.Then();
9447       {
9448         Drop(1);
9449         Push(index);
9450         loop.Break();
9451       }
9452       if_issame.End();
9453     }
9454     loop.EndBody();
9455   } else {
9456     IfBuilder if_isstring(this);
9457     if_isstring.If<HIsStringAndBranch>(search_element);
9458     if_isstring.Then();
9459     {
9460       LoopBuilder loop(this, context(), direction);
9461       {
9462         HValue* index = loop.BeginBody(initial, terminating, token);
9463         HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9464                                                   kind, ALLOW_RETURN_HOLE);
9465         IfBuilder if_issame(this);
9466         if_issame.If<HIsStringAndBranch>(element);
9467         if_issame.AndIf<HStringCompareAndBranch>(
9468             element, search_element, Token::EQ_STRICT);
9469         if_issame.Then();
9470         {
9471           Drop(1);
9472           Push(index);
9473           loop.Break();
9474         }
9475         if_issame.End();
9476       }
9477       loop.EndBody();
9478     }
9479     if_isstring.Else();
9480     {
9481       IfBuilder if_isnumber(this);
9482       if_isnumber.If<HIsSmiAndBranch>(search_element);
9483       if_isnumber.OrIf<HCompareMap>(
9484           search_element, isolate()->factory()->heap_number_map());
9485       if_isnumber.Then();
9486       {
9487         HValue* search_number =
9488             AddUncasted<HForceRepresentation>(search_element,
9489                                               Representation::Double());
9490         LoopBuilder loop(this, context(), direction);
9491         {
9492           HValue* index = loop.BeginBody(initial, terminating, token);
9493           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9494                                                     kind, ALLOW_RETURN_HOLE);
9495
9496           IfBuilder if_element_isnumber(this);
9497           if_element_isnumber.If<HIsSmiAndBranch>(element);
9498           if_element_isnumber.OrIf<HCompareMap>(
9499               element, isolate()->factory()->heap_number_map());
9500           if_element_isnumber.Then();
9501           {
9502             HValue* number =
9503                 AddUncasted<HForceRepresentation>(element,
9504                                                   Representation::Double());
9505             IfBuilder if_issame(this);
9506             if_issame.If<HCompareNumericAndBranch>(
9507                 number, search_number, Token::EQ_STRICT);
9508             if_issame.Then();
9509             {
9510               Drop(1);
9511               Push(index);
9512               loop.Break();
9513             }
9514             if_issame.End();
9515           }
9516           if_element_isnumber.End();
9517         }
9518         loop.EndBody();
9519       }
9520       if_isnumber.Else();
9521       {
9522         LoopBuilder loop(this, context(), direction);
9523         {
9524           HValue* index = loop.BeginBody(initial, terminating, token);
9525           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9526                                                     kind, ALLOW_RETURN_HOLE);
9527           IfBuilder if_issame(this);
9528           if_issame.If<HCompareObjectEqAndBranch>(
9529               element, search_element);
9530           if_issame.Then();
9531           {
9532             Drop(1);
9533             Push(index);
9534             loop.Break();
9535           }
9536           if_issame.End();
9537         }
9538         loop.EndBody();
9539       }
9540       if_isnumber.End();
9541     }
9542     if_isstring.End();
9543   }
9544
9545   return Pop();
9546 }
9547
9548
9549 bool HOptimizedGraphBuilder::TryHandleArrayCall(Call* expr, HValue* function) {
9550   if (!array_function().is_identical_to(expr->target())) {
9551     return false;
9552   }
9553
9554   Handle<AllocationSite> site = expr->allocation_site();
9555   if (site.is_null()) return false;
9556
9557   BuildArrayCall(expr,
9558                  expr->arguments()->length(),
9559                  function,
9560                  site);
9561   return true;
9562 }
9563
9564
9565 bool HOptimizedGraphBuilder::TryHandleArrayCallNew(CallNew* expr,
9566                                                    HValue* function) {
9567   if (!array_function().is_identical_to(expr->target())) {
9568     return false;
9569   }
9570
9571   Handle<AllocationSite> site = expr->allocation_site();
9572   if (site.is_null()) return false;
9573
9574   BuildArrayCall(expr, expr->arguments()->length(), function, site);
9575   return true;
9576 }
9577
9578
9579 bool HOptimizedGraphBuilder::CanBeFunctionApplyArguments(Call* expr) {
9580   ZoneList<Expression*>* args = expr->arguments();
9581   if (args->length() != 2) return false;
9582   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
9583   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
9584   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
9585   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
9586   return true;
9587 }
9588
9589
9590 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
9591   DCHECK(!HasStackOverflow());
9592   DCHECK(current_block() != NULL);
9593   DCHECK(current_block()->HasPredecessor());
9594   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9595   Expression* callee = expr->expression();
9596   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
9597   HInstruction* call = NULL;
9598
9599   Property* prop = callee->AsProperty();
9600   if (prop != NULL) {
9601     CHECK_ALIVE(VisitForValue(prop->obj()));
9602     HValue* receiver = Top();
9603
9604     SmallMapList* maps;
9605     ComputeReceiverTypes(expr, receiver, &maps, zone());
9606
9607     if (prop->key()->IsPropertyName() && maps->length() > 0) {
9608       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
9609       PropertyAccessInfo info(this, LOAD, maps->first(), name);
9610       if (!info.CanAccessAsMonomorphic(maps)) {
9611         HandlePolymorphicCallNamed(expr, receiver, maps, name);
9612         return;
9613       }
9614     }
9615     HValue* key = NULL;
9616     if (!prop->key()->IsPropertyName()) {
9617       CHECK_ALIVE(VisitForValue(prop->key()));
9618       key = Pop();
9619     }
9620
9621     CHECK_ALIVE(PushLoad(prop, receiver, key));
9622     HValue* function = Pop();
9623
9624     if (function->IsConstant() &&
9625         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9626       // Push the function under the receiver.
9627       environment()->SetExpressionStackAt(0, function);
9628       Push(receiver);
9629
9630       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
9631           HConstant::cast(function)->handle(isolate()));
9632       expr->set_target(known_function);
9633
9634       if (TryIndirectCall(expr)) return;
9635       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9636
9637       Handle<Map> map = maps->length() == 1 ? maps->first() : Handle<Map>();
9638       if (TryInlineBuiltinMethodCall(expr, known_function, map,
9639                                      expr->arguments()->length())) {
9640         if (FLAG_trace_inlining) {
9641           PrintF("Inlining builtin ");
9642           known_function->ShortPrint();
9643           PrintF("\n");
9644         }
9645         return;
9646       }
9647       if (TryInlineApiMethodCall(expr, receiver, maps)) return;
9648
9649       // Wrap the receiver if necessary.
9650       if (NeedsWrapping(maps->first(), known_function)) {
9651         // Since HWrapReceiver currently cannot actually wrap numbers and
9652         // strings, use the regular CallFunctionStub for method calls to wrap
9653         // the receiver.
9654         // TODO(verwaest): Support creation of value wrappers directly in
9655         // HWrapReceiver.
9656         call = New<HCallFunction>(
9657             function, argument_count, WRAP_AND_CALL);
9658       } else if (TryInlineCall(expr)) {
9659         return;
9660       } else {
9661         call = BuildCallConstantFunction(known_function, argument_count);
9662       }
9663
9664     } else {
9665       ArgumentsAllowedFlag arguments_flag = ARGUMENTS_NOT_ALLOWED;
9666       if (CanBeFunctionApplyArguments(expr) && expr->is_uninitialized()) {
9667         // We have to use EAGER deoptimization here because Deoptimizer::SOFT
9668         // gets ignored by the always-opt flag, which leads to incorrect code.
9669         Add<HDeoptimize>(
9670             Deoptimizer::kInsufficientTypeFeedbackForCallWithArguments,
9671             Deoptimizer::EAGER);
9672         arguments_flag = ARGUMENTS_FAKED;
9673       }
9674
9675       // Push the function under the receiver.
9676       environment()->SetExpressionStackAt(0, function);
9677       Push(receiver);
9678
9679       CHECK_ALIVE(VisitExpressions(expr->arguments(), arguments_flag));
9680       CallFunctionFlags flags = receiver->type().IsJSObject()
9681           ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
9682       call = New<HCallFunction>(function, argument_count, flags);
9683     }
9684     PushArgumentsFromEnvironment(argument_count);
9685
9686   } else {
9687     VariableProxy* proxy = expr->expression()->AsVariableProxy();
9688     if (proxy != NULL && proxy->var()->is_possibly_eval(isolate())) {
9689       return Bailout(kPossibleDirectCallToEval);
9690     }
9691
9692     // The function is on the stack in the unoptimized code during
9693     // evaluation of the arguments.
9694     CHECK_ALIVE(VisitForValue(expr->expression()));
9695     HValue* function = Top();
9696     if (function->IsConstant() &&
9697         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9698       Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9699       Handle<JSFunction> target = Handle<JSFunction>::cast(constant);
9700       expr->SetKnownGlobalTarget(target);
9701     }
9702
9703     // Placeholder for the receiver.
9704     Push(graph()->GetConstantUndefined());
9705     CHECK_ALIVE(VisitExpressions(expr->arguments()));
9706
9707     if (expr->IsMonomorphic()) {
9708       Add<HCheckValue>(function, expr->target());
9709
9710       // Patch the global object on the stack by the expected receiver.
9711       HValue* receiver = ImplicitReceiverFor(function, expr->target());
9712       const int receiver_index = argument_count - 1;
9713       environment()->SetExpressionStackAt(receiver_index, receiver);
9714
9715       if (TryInlineBuiltinFunctionCall(expr)) {
9716         if (FLAG_trace_inlining) {
9717           PrintF("Inlining builtin ");
9718           expr->target()->ShortPrint();
9719           PrintF("\n");
9720         }
9721         return;
9722       }
9723       if (TryInlineApiFunctionCall(expr, receiver)) return;
9724       if (TryHandleArrayCall(expr, function)) return;
9725       if (TryInlineCall(expr)) return;
9726
9727       PushArgumentsFromEnvironment(argument_count);
9728       call = BuildCallConstantFunction(expr->target(), argument_count);
9729     } else {
9730       PushArgumentsFromEnvironment(argument_count);
9731       HCallFunction* call_function =
9732           New<HCallFunction>(function, argument_count);
9733       call = call_function;
9734       if (expr->is_uninitialized() &&
9735           expr->IsUsingCallFeedbackICSlot(isolate())) {
9736         // We've never seen this call before, so let's have Crankshaft learn
9737         // through the type vector.
9738         Handle<TypeFeedbackVector> vector =
9739             handle(current_feedback_vector(), isolate());
9740         FeedbackVectorICSlot slot = expr->CallFeedbackICSlot();
9741         call_function->SetVectorAndSlot(vector, slot);
9742       }
9743     }
9744   }
9745
9746   Drop(1);  // Drop the function.
9747   return ast_context()->ReturnInstruction(call, expr->id());
9748 }
9749
9750
9751 void HOptimizedGraphBuilder::BuildInlinedCallArray(
9752     Expression* expression,
9753     int argument_count,
9754     Handle<AllocationSite> site) {
9755   DCHECK(!site.is_null());
9756   DCHECK(argument_count >= 0 && argument_count <= 1);
9757   NoObservableSideEffectsScope no_effects(this);
9758
9759   // We should at least have the constructor on the expression stack.
9760   HValue* constructor = environment()->ExpressionStackAt(argument_count);
9761
9762   // Register on the site for deoptimization if the transition feedback changes.
9763   top_info()->dependencies()->AssumeTransitionStable(site);
9764   ElementsKind kind = site->GetElementsKind();
9765   HInstruction* site_instruction = Add<HConstant>(site);
9766
9767   // In the single constant argument case, we may have to adjust elements kind
9768   // to avoid creating a packed non-empty array.
9769   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
9770     HValue* argument = environment()->Top();
9771     if (argument->IsConstant()) {
9772       HConstant* constant_argument = HConstant::cast(argument);
9773       DCHECK(constant_argument->HasSmiValue());
9774       int constant_array_size = constant_argument->Integer32Value();
9775       if (constant_array_size != 0) {
9776         kind = GetHoleyElementsKind(kind);
9777       }
9778     }
9779   }
9780
9781   // Build the array.
9782   JSArrayBuilder array_builder(this,
9783                                kind,
9784                                site_instruction,
9785                                constructor,
9786                                DISABLE_ALLOCATION_SITES);
9787   HValue* new_object = argument_count == 0
9788       ? array_builder.AllocateEmptyArray()
9789       : BuildAllocateArrayFromLength(&array_builder, Top());
9790
9791   int args_to_drop = argument_count + (expression->IsCall() ? 2 : 1);
9792   Drop(args_to_drop);
9793   ast_context()->ReturnValue(new_object);
9794 }
9795
9796
9797 // Checks whether allocation using the given constructor can be inlined.
9798 static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
9799   return constructor->has_initial_map() &&
9800          constructor->initial_map()->instance_type() == JS_OBJECT_TYPE &&
9801          constructor->initial_map()->instance_size() <
9802              HAllocate::kMaxInlineSize;
9803 }
9804
9805
9806 bool HOptimizedGraphBuilder::IsCallArrayInlineable(
9807     int argument_count,
9808     Handle<AllocationSite> site) {
9809   Handle<JSFunction> caller = current_info()->closure();
9810   Handle<JSFunction> target = array_function();
9811   // We should have the function plus array arguments on the environment stack.
9812   DCHECK(environment()->length() >= (argument_count + 1));
9813   DCHECK(!site.is_null());
9814
9815   bool inline_ok = false;
9816   if (site->CanInlineCall()) {
9817     // We also want to avoid inlining in certain 1 argument scenarios.
9818     if (argument_count == 1) {
9819       HValue* argument = Top();
9820       if (argument->IsConstant()) {
9821         // Do not inline if the constant length argument is not a smi or
9822         // outside the valid range for unrolled loop initialization.
9823         HConstant* constant_argument = HConstant::cast(argument);
9824         if (constant_argument->HasSmiValue()) {
9825           int value = constant_argument->Integer32Value();
9826           inline_ok = value >= 0 && value <= kElementLoopUnrollThreshold;
9827           if (!inline_ok) {
9828             TraceInline(target, caller,
9829                         "Constant length outside of valid inlining range.");
9830           }
9831         }
9832       } else {
9833         TraceInline(target, caller,
9834                     "Dont inline [new] Array(n) where n isn't constant.");
9835       }
9836     } else if (argument_count == 0) {
9837       inline_ok = true;
9838     } else {
9839       TraceInline(target, caller, "Too many arguments to inline.");
9840     }
9841   } else {
9842     TraceInline(target, caller, "AllocationSite requested no inlining.");
9843   }
9844
9845   if (inline_ok) {
9846     TraceInline(target, caller, NULL);
9847   }
9848   return inline_ok;
9849 }
9850
9851
9852 void HOptimizedGraphBuilder::VisitCallNew(CallNew* expr) {
9853   DCHECK(!HasStackOverflow());
9854   DCHECK(current_block() != NULL);
9855   DCHECK(current_block()->HasPredecessor());
9856   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9857   int argument_count = expr->arguments()->length() + 1;  // Plus constructor.
9858   Factory* factory = isolate()->factory();
9859
9860   // The constructor function is on the stack in the unoptimized code
9861   // during evaluation of the arguments.
9862   CHECK_ALIVE(VisitForValue(expr->expression()));
9863   HValue* function = Top();
9864   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9865
9866   if (function->IsConstant() &&
9867       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9868     Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9869     expr->SetKnownGlobalTarget(Handle<JSFunction>::cast(constant));
9870   }
9871
9872   if (FLAG_inline_construct &&
9873       expr->IsMonomorphic() &&
9874       IsAllocationInlineable(expr->target())) {
9875     Handle<JSFunction> constructor = expr->target();
9876     HValue* check = Add<HCheckValue>(function, constructor);
9877
9878     // Force completion of inobject slack tracking before generating
9879     // allocation code to finalize instance size.
9880     if (constructor->IsInobjectSlackTrackingInProgress()) {
9881       constructor->CompleteInobjectSlackTracking();
9882     }
9883
9884     // Calculate instance size from initial map of constructor.
9885     DCHECK(constructor->has_initial_map());
9886     Handle<Map> initial_map(constructor->initial_map());
9887     int instance_size = initial_map->instance_size();
9888
9889     // Allocate an instance of the implicit receiver object.
9890     HValue* size_in_bytes = Add<HConstant>(instance_size);
9891     HAllocationMode allocation_mode;
9892     if (FLAG_pretenuring_call_new) {
9893       if (FLAG_allocation_site_pretenuring) {
9894         // Try to use pretenuring feedback.
9895         Handle<AllocationSite> allocation_site = expr->allocation_site();
9896         allocation_mode = HAllocationMode(allocation_site);
9897         // Take a dependency on allocation site.
9898         top_info()->dependencies()->AssumeTenuringDecision(allocation_site);
9899       }
9900     }
9901
9902     HAllocate* receiver = BuildAllocate(
9903         size_in_bytes, HType::JSObject(), JS_OBJECT_TYPE, allocation_mode);
9904     receiver->set_known_initial_map(initial_map);
9905
9906     // Initialize map and fields of the newly allocated object.
9907     { NoObservableSideEffectsScope no_effects(this);
9908       DCHECK(initial_map->instance_type() == JS_OBJECT_TYPE);
9909       Add<HStoreNamedField>(receiver,
9910           HObjectAccess::ForMapAndOffset(initial_map, JSObject::kMapOffset),
9911           Add<HConstant>(initial_map));
9912       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
9913       Add<HStoreNamedField>(receiver,
9914           HObjectAccess::ForMapAndOffset(initial_map,
9915                                          JSObject::kPropertiesOffset),
9916           empty_fixed_array);
9917       Add<HStoreNamedField>(receiver,
9918           HObjectAccess::ForMapAndOffset(initial_map,
9919                                          JSObject::kElementsOffset),
9920           empty_fixed_array);
9921       BuildInitializeInobjectProperties(receiver, initial_map);
9922     }
9923
9924     // Replace the constructor function with a newly allocated receiver using
9925     // the index of the receiver from the top of the expression stack.
9926     const int receiver_index = argument_count - 1;
9927     DCHECK(environment()->ExpressionStackAt(receiver_index) == function);
9928     environment()->SetExpressionStackAt(receiver_index, receiver);
9929
9930     if (TryInlineConstruct(expr, receiver)) {
9931       // Inlining worked, add a dependency on the initial map to make sure that
9932       // this code is deoptimized whenever the initial map of the constructor
9933       // changes.
9934       top_info()->dependencies()->AssumeInitialMapCantChange(initial_map);
9935       return;
9936     }
9937
9938     // TODO(mstarzinger): For now we remove the previous HAllocate and all
9939     // corresponding instructions and instead add HPushArguments for the
9940     // arguments in case inlining failed.  What we actually should do is for
9941     // inlining to try to build a subgraph without mutating the parent graph.
9942     HInstruction* instr = current_block()->last();
9943     do {
9944       HInstruction* prev_instr = instr->previous();
9945       instr->DeleteAndReplaceWith(NULL);
9946       instr = prev_instr;
9947     } while (instr != check);
9948     environment()->SetExpressionStackAt(receiver_index, function);
9949     HInstruction* call =
9950       PreProcessCall(New<HCallNew>(function, argument_count));
9951     return ast_context()->ReturnInstruction(call, expr->id());
9952   } else {
9953     // The constructor function is both an operand to the instruction and an
9954     // argument to the construct call.
9955     if (TryHandleArrayCallNew(expr, function)) return;
9956
9957     HInstruction* call =
9958         PreProcessCall(New<HCallNew>(function, argument_count));
9959     return ast_context()->ReturnInstruction(call, expr->id());
9960   }
9961 }
9962
9963
9964 void HOptimizedGraphBuilder::BuildInitializeInobjectProperties(
9965     HValue* receiver, Handle<Map> initial_map) {
9966   if (initial_map->inobject_properties() != 0) {
9967     HConstant* undefined = graph()->GetConstantUndefined();
9968     for (int i = 0; i < initial_map->inobject_properties(); i++) {
9969       int property_offset = initial_map->GetInObjectPropertyOffset(i);
9970       Add<HStoreNamedField>(receiver, HObjectAccess::ForMapAndOffset(
9971                                           initial_map, property_offset),
9972                             undefined);
9973     }
9974   }
9975 }
9976
9977
9978 HValue* HGraphBuilder::BuildAllocateEmptyArrayBuffer(HValue* byte_length) {
9979   // We HForceRepresentation here to avoid allocations during an *-to-tagged
9980   // HChange that could cause GC while the array buffer object is not fully
9981   // initialized.
9982   HObjectAccess byte_length_access(HObjectAccess::ForJSArrayBufferByteLength());
9983   byte_length = AddUncasted<HForceRepresentation>(
9984       byte_length, byte_length_access.representation());
9985   HAllocate* result =
9986       BuildAllocate(Add<HConstant>(JSArrayBuffer::kSizeWithInternalFields),
9987                     HType::JSObject(), JS_ARRAY_BUFFER_TYPE, HAllocationMode());
9988
9989   HValue* global_object = Add<HLoadNamedField>(
9990       context(), nullptr,
9991       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
9992   HValue* native_context = Add<HLoadNamedField>(
9993       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
9994   Add<HStoreNamedField>(
9995       result, HObjectAccess::ForMap(),
9996       Add<HLoadNamedField>(
9997           native_context, nullptr,
9998           HObjectAccess::ForContextSlot(Context::ARRAY_BUFFER_MAP_INDEX)));
9999
10000   HConstant* empty_fixed_array =
10001       Add<HConstant>(isolate()->factory()->empty_fixed_array());
10002   Add<HStoreNamedField>(
10003       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
10004       empty_fixed_array);
10005   Add<HStoreNamedField>(
10006       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
10007       empty_fixed_array);
10008   Add<HStoreNamedField>(
10009       result, HObjectAccess::ForJSArrayBufferBackingStore().WithRepresentation(
10010                   Representation::Smi()),
10011       graph()->GetConstant0());
10012   Add<HStoreNamedField>(result, byte_length_access, byte_length);
10013   Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBitFieldSlot(),
10014                         graph()->GetConstant0());
10015   Add<HStoreNamedField>(
10016       result, HObjectAccess::ForJSArrayBufferBitField(),
10017       Add<HConstant>((1 << JSArrayBuffer::IsExternal::kShift) |
10018                      (1 << JSArrayBuffer::IsNeuterable::kShift)));
10019
10020   for (int field = 0; field < v8::ArrayBuffer::kInternalFieldCount; ++field) {
10021     Add<HStoreNamedField>(
10022         result,
10023         HObjectAccess::ForObservableJSObjectOffset(
10024             JSArrayBuffer::kSize + field * kPointerSize, Representation::Smi()),
10025         graph()->GetConstant0());
10026   }
10027
10028   return result;
10029 }
10030
10031
10032 template <class ViewClass>
10033 void HGraphBuilder::BuildArrayBufferViewInitialization(
10034     HValue* obj,
10035     HValue* buffer,
10036     HValue* byte_offset,
10037     HValue* byte_length) {
10038
10039   for (int offset = ViewClass::kSize;
10040        offset < ViewClass::kSizeWithInternalFields;
10041        offset += kPointerSize) {
10042     Add<HStoreNamedField>(obj,
10043         HObjectAccess::ForObservableJSObjectOffset(offset),
10044         graph()->GetConstant0());
10045   }
10046
10047   Add<HStoreNamedField>(
10048       obj,
10049       HObjectAccess::ForJSArrayBufferViewByteOffset(),
10050       byte_offset);
10051   Add<HStoreNamedField>(
10052       obj,
10053       HObjectAccess::ForJSArrayBufferViewByteLength(),
10054       byte_length);
10055   Add<HStoreNamedField>(obj, HObjectAccess::ForJSArrayBufferViewBuffer(),
10056                         buffer);
10057 }
10058
10059
10060 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
10061     CallRuntime* expr) {
10062   ZoneList<Expression*>* arguments = expr->arguments();
10063
10064   DCHECK(arguments->length()== 4);
10065   CHECK_ALIVE(VisitForValue(arguments->at(0)));
10066   HValue* obj = Pop();
10067
10068   CHECK_ALIVE(VisitForValue(arguments->at(1)));
10069   HValue* buffer = Pop();
10070
10071   CHECK_ALIVE(VisitForValue(arguments->at(2)));
10072   HValue* byte_offset = Pop();
10073
10074   CHECK_ALIVE(VisitForValue(arguments->at(3)));
10075   HValue* byte_length = Pop();
10076
10077   {
10078     NoObservableSideEffectsScope scope(this);
10079     BuildArrayBufferViewInitialization<JSDataView>(
10080         obj, buffer, byte_offset, byte_length);
10081   }
10082 }
10083
10084
10085 static Handle<Map> TypedArrayMap(Isolate* isolate,
10086                                  ExternalArrayType array_type,
10087                                  ElementsKind target_kind) {
10088   Handle<Context> native_context = isolate->native_context();
10089   Handle<JSFunction> fun;
10090   switch (array_type) {
10091 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
10092     case kExternal##Type##Array:                                              \
10093       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
10094       break;
10095
10096     TYPED_ARRAYS(TYPED_ARRAY_CASE)
10097 #undef TYPED_ARRAY_CASE
10098   }
10099   Handle<Map> map(fun->initial_map());
10100   return Map::AsElementsKind(map, target_kind);
10101 }
10102
10103
10104 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
10105     ExternalArrayType array_type,
10106     bool is_zero_byte_offset,
10107     HValue* buffer, HValue* byte_offset, HValue* length) {
10108   Handle<Map> external_array_map(
10109       isolate()->heap()->MapForFixedTypedArray(array_type));
10110
10111   // The HForceRepresentation is to prevent possible deopt on int-smi
10112   // conversion after allocation but before the new object fields are set.
10113   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10114   HValue* elements = Add<HAllocate>(
10115       Add<HConstant>(FixedTypedArrayBase::kHeaderSize), HType::HeapObject(),
10116       NOT_TENURED, external_array_map->instance_type());
10117
10118   AddStoreMapConstant(elements, external_array_map);
10119   Add<HStoreNamedField>(elements,
10120       HObjectAccess::ForFixedArrayLength(), length);
10121
10122   HValue* backing_store = Add<HLoadNamedField>(
10123       buffer, nullptr, HObjectAccess::ForJSArrayBufferBackingStore());
10124
10125   HValue* typed_array_start;
10126   if (is_zero_byte_offset) {
10127     typed_array_start = backing_store;
10128   } else {
10129     HInstruction* external_pointer =
10130         AddUncasted<HAdd>(backing_store, byte_offset);
10131     // Arguments are checked prior to call to TypedArrayInitialize,
10132     // including byte_offset.
10133     external_pointer->ClearFlag(HValue::kCanOverflow);
10134     typed_array_start = external_pointer;
10135   }
10136
10137   Add<HStoreNamedField>(elements,
10138                         HObjectAccess::ForFixedTypedArrayBaseBasePointer(),
10139                         graph()->GetConstant0());
10140   Add<HStoreNamedField>(elements,
10141                         HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10142                         typed_array_start);
10143
10144   return elements;
10145 }
10146
10147
10148 HValue* HOptimizedGraphBuilder::BuildAllocateFixedTypedArray(
10149     ExternalArrayType array_type, size_t element_size,
10150     ElementsKind fixed_elements_kind, HValue* byte_length, HValue* length,
10151     bool initialize) {
10152   STATIC_ASSERT(
10153       (FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask) == 0);
10154   HValue* total_size;
10155
10156   // if fixed array's elements are not aligned to object's alignment,
10157   // we need to align the whole array to object alignment.
10158   if (element_size % kObjectAlignment != 0) {
10159     total_size = BuildObjectSizeAlignment(
10160         byte_length, FixedTypedArrayBase::kHeaderSize);
10161   } else {
10162     total_size = AddUncasted<HAdd>(byte_length,
10163         Add<HConstant>(FixedTypedArrayBase::kHeaderSize));
10164     total_size->ClearFlag(HValue::kCanOverflow);
10165   }
10166
10167   // The HForceRepresentation is to prevent possible deopt on int-smi
10168   // conversion after allocation but before the new object fields are set.
10169   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10170   Handle<Map> fixed_typed_array_map(
10171       isolate()->heap()->MapForFixedTypedArray(array_type));
10172   HAllocate* elements =
10173       Add<HAllocate>(total_size, HType::HeapObject(), NOT_TENURED,
10174                      fixed_typed_array_map->instance_type());
10175
10176 #ifndef V8_HOST_ARCH_64_BIT
10177   if (array_type == kExternalFloat64Array) {
10178     elements->MakeDoubleAligned();
10179   }
10180 #endif
10181
10182   AddStoreMapConstant(elements, fixed_typed_array_map);
10183
10184   Add<HStoreNamedField>(elements,
10185       HObjectAccess::ForFixedArrayLength(),
10186       length);
10187   Add<HStoreNamedField>(
10188       elements, HObjectAccess::ForFixedTypedArrayBaseBasePointer(), elements);
10189
10190   Add<HStoreNamedField>(
10191       elements, HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10192       Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()));
10193
10194   HValue* filler = Add<HConstant>(static_cast<int32_t>(0));
10195
10196   if (initialize) {
10197     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
10198
10199     HValue* backing_store = AddUncasted<HAdd>(
10200         Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()),
10201         elements, Strength::WEAK, AddOfExternalAndTagged);
10202
10203     HValue* key = builder.BeginBody(
10204         Add<HConstant>(static_cast<int32_t>(0)),
10205         length, Token::LT);
10206     Add<HStoreKeyed>(backing_store, key, filler, fixed_elements_kind);
10207
10208     builder.EndBody();
10209   }
10210   return elements;
10211 }
10212
10213
10214 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
10215     CallRuntime* expr) {
10216   ZoneList<Expression*>* arguments = expr->arguments();
10217
10218   static const int kObjectArg = 0;
10219   static const int kArrayIdArg = 1;
10220   static const int kBufferArg = 2;
10221   static const int kByteOffsetArg = 3;
10222   static const int kByteLengthArg = 4;
10223   static const int kInitializeArg = 5;
10224   static const int kArgsLength = 6;
10225   DCHECK(arguments->length() == kArgsLength);
10226
10227
10228   CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
10229   HValue* obj = Pop();
10230
10231   if (!arguments->at(kArrayIdArg)->IsLiteral()) {
10232     // This should never happen in real use, but can happen when fuzzing.
10233     // Just bail out.
10234     Bailout(kNeedSmiLiteral);
10235     return;
10236   }
10237   Handle<Object> value =
10238       static_cast<Literal*>(arguments->at(kArrayIdArg))->value();
10239   if (!value->IsSmi()) {
10240     // This should never happen in real use, but can happen when fuzzing.
10241     // Just bail out.
10242     Bailout(kNeedSmiLiteral);
10243     return;
10244   }
10245   int array_id = Smi::cast(*value)->value();
10246
10247   HValue* buffer;
10248   if (!arguments->at(kBufferArg)->IsNullLiteral()) {
10249     CHECK_ALIVE(VisitForValue(arguments->at(kBufferArg)));
10250     buffer = Pop();
10251   } else {
10252     buffer = NULL;
10253   }
10254
10255   HValue* byte_offset;
10256   bool is_zero_byte_offset;
10257
10258   if (arguments->at(kByteOffsetArg)->IsLiteral()
10259       && Smi::FromInt(0) ==
10260       *static_cast<Literal*>(arguments->at(kByteOffsetArg))->value()) {
10261     byte_offset = Add<HConstant>(static_cast<int32_t>(0));
10262     is_zero_byte_offset = true;
10263   } else {
10264     CHECK_ALIVE(VisitForValue(arguments->at(kByteOffsetArg)));
10265     byte_offset = Pop();
10266     is_zero_byte_offset = false;
10267     DCHECK(buffer != NULL);
10268   }
10269
10270   CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
10271   HValue* byte_length = Pop();
10272
10273   CHECK(arguments->at(kInitializeArg)->IsLiteral());
10274   bool initialize = static_cast<Literal*>(arguments->at(kInitializeArg))
10275                         ->value()
10276                         ->BooleanValue();
10277
10278   NoObservableSideEffectsScope scope(this);
10279   IfBuilder byte_offset_smi(this);
10280
10281   if (!is_zero_byte_offset) {
10282     byte_offset_smi.If<HIsSmiAndBranch>(byte_offset);
10283     byte_offset_smi.Then();
10284   }
10285
10286   ExternalArrayType array_type =
10287       kExternalInt8Array;  // Bogus initialization.
10288   size_t element_size = 1;  // Bogus initialization.
10289   ElementsKind fixed_elements_kind =  // Bogus initialization.
10290       INT8_ELEMENTS;
10291   Runtime::ArrayIdToTypeAndSize(array_id,
10292       &array_type,
10293       &fixed_elements_kind,
10294       &element_size);
10295
10296
10297   { //  byte_offset is Smi.
10298     HValue* allocated_buffer = buffer;
10299     if (buffer == NULL) {
10300       allocated_buffer = BuildAllocateEmptyArrayBuffer(byte_length);
10301     }
10302     BuildArrayBufferViewInitialization<JSTypedArray>(obj, allocated_buffer,
10303                                                      byte_offset, byte_length);
10304
10305
10306     HInstruction* length = AddUncasted<HDiv>(byte_length,
10307         Add<HConstant>(static_cast<int32_t>(element_size)));
10308
10309     Add<HStoreNamedField>(obj,
10310         HObjectAccess::ForJSTypedArrayLength(),
10311         length);
10312
10313     HValue* elements;
10314     if (buffer != NULL) {
10315       elements = BuildAllocateExternalElements(
10316           array_type, is_zero_byte_offset, buffer, byte_offset, length);
10317       Handle<Map> obj_map =
10318           TypedArrayMap(isolate(), array_type, fixed_elements_kind);
10319       AddStoreMapConstant(obj, obj_map);
10320     } else {
10321       DCHECK(is_zero_byte_offset);
10322       elements = BuildAllocateFixedTypedArray(array_type, element_size,
10323                                               fixed_elements_kind, byte_length,
10324                                               length, initialize);
10325     }
10326     Add<HStoreNamedField>(
10327         obj, HObjectAccess::ForElementsPointer(), elements);
10328   }
10329
10330   if (!is_zero_byte_offset) {
10331     byte_offset_smi.Else();
10332     { //  byte_offset is not Smi.
10333       Push(obj);
10334       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
10335       Push(buffer);
10336       Push(byte_offset);
10337       Push(byte_length);
10338       CHECK_ALIVE(VisitForValue(arguments->at(kInitializeArg)));
10339       PushArgumentsFromEnvironment(kArgsLength);
10340       Add<HCallRuntime>(expr->name(), expr->function(), kArgsLength);
10341     }
10342   }
10343   byte_offset_smi.End();
10344 }
10345
10346
10347 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
10348   DCHECK(expr->arguments()->length() == 0);
10349   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
10350   return ast_context()->ReturnInstruction(max_smi, expr->id());
10351 }
10352
10353
10354 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
10355     CallRuntime* expr) {
10356   DCHECK(expr->arguments()->length() == 0);
10357   HConstant* result = New<HConstant>(static_cast<int32_t>(
10358         FLAG_typed_array_max_size_in_heap));
10359   return ast_context()->ReturnInstruction(result, expr->id());
10360 }
10361
10362
10363 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
10364     CallRuntime* expr) {
10365   DCHECK(expr->arguments()->length() == 1);
10366   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10367   HValue* buffer = Pop();
10368   HInstruction* result = New<HLoadNamedField>(
10369       buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
10370   return ast_context()->ReturnInstruction(result, expr->id());
10371 }
10372
10373
10374 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
10375     CallRuntime* expr) {
10376   NoObservableSideEffectsScope scope(this);
10377   DCHECK(expr->arguments()->length() == 1);
10378   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10379   HValue* view = Pop();
10380
10381   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10382       view, nullptr,
10383       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteLengthOffset)));
10384 }
10385
10386
10387 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
10388     CallRuntime* expr) {
10389   NoObservableSideEffectsScope scope(this);
10390   DCHECK(expr->arguments()->length() == 1);
10391   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10392   HValue* view = Pop();
10393
10394   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10395       view, nullptr,
10396       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset)));
10397 }
10398
10399
10400 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
10401     CallRuntime* expr) {
10402   NoObservableSideEffectsScope scope(this);
10403   DCHECK(expr->arguments()->length() == 1);
10404   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10405   HValue* view = Pop();
10406
10407   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10408       view, nullptr,
10409       FieldIndex::ForInObjectOffset(JSTypedArray::kLengthOffset)));
10410 }
10411
10412
10413 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
10414   DCHECK(!HasStackOverflow());
10415   DCHECK(current_block() != NULL);
10416   DCHECK(current_block()->HasPredecessor());
10417   if (expr->is_jsruntime()) {
10418     return Bailout(kCallToAJavaScriptRuntimeFunction);
10419   }
10420
10421   const Runtime::Function* function = expr->function();
10422   DCHECK(function != NULL);
10423   switch (function->function_id) {
10424 #define CALL_INTRINSIC_GENERATOR(Name) \
10425   case Runtime::kInline##Name:         \
10426     return Generate##Name(expr);
10427
10428     FOR_EACH_HYDROGEN_INTRINSIC(CALL_INTRINSIC_GENERATOR)
10429 #undef CALL_INTRINSIC_GENERATOR
10430     default: {
10431       Handle<String> name = expr->name();
10432       int argument_count = expr->arguments()->length();
10433       CHECK_ALIVE(VisitExpressions(expr->arguments()));
10434       PushArgumentsFromEnvironment(argument_count);
10435       HCallRuntime* call = New<HCallRuntime>(name, function, argument_count);
10436       return ast_context()->ReturnInstruction(call, expr->id());
10437     }
10438   }
10439 }
10440
10441
10442 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
10443   DCHECK(!HasStackOverflow());
10444   DCHECK(current_block() != NULL);
10445   DCHECK(current_block()->HasPredecessor());
10446   switch (expr->op()) {
10447     case Token::DELETE: return VisitDelete(expr);
10448     case Token::VOID: return VisitVoid(expr);
10449     case Token::TYPEOF: return VisitTypeof(expr);
10450     case Token::NOT: return VisitNot(expr);
10451     default: UNREACHABLE();
10452   }
10453 }
10454
10455
10456 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
10457   Property* prop = expr->expression()->AsProperty();
10458   VariableProxy* proxy = expr->expression()->AsVariableProxy();
10459   if (prop != NULL) {
10460     CHECK_ALIVE(VisitForValue(prop->obj()));
10461     CHECK_ALIVE(VisitForValue(prop->key()));
10462     HValue* key = Pop();
10463     HValue* obj = Pop();
10464     HValue* function = AddLoadJSBuiltin(Builtins::DELETE);
10465     Add<HPushArguments>(obj, key, Add<HConstant>(function_language_mode()));
10466     // TODO(olivf) InvokeFunction produces a check for the parameter count,
10467     // even though we are certain to pass the correct number of arguments here.
10468     HInstruction* instr = New<HInvokeFunction>(function, 3);
10469     return ast_context()->ReturnInstruction(instr, expr->id());
10470   } else if (proxy != NULL) {
10471     Variable* var = proxy->var();
10472     if (var->IsUnallocatedOrGlobalSlot()) {
10473       Bailout(kDeleteWithGlobalVariable);
10474     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
10475       // Result of deleting non-global variables is false.  'this' is not really
10476       // a variable, though we implement it as one.  The subexpression does not
10477       // have side effects.
10478       HValue* value = var->HasThisName(isolate()) ? graph()->GetConstantTrue()
10479                                                   : graph()->GetConstantFalse();
10480       return ast_context()->ReturnValue(value);
10481     } else {
10482       Bailout(kDeleteWithNonGlobalVariable);
10483     }
10484   } else {
10485     // Result of deleting non-property, non-variable reference is true.
10486     // Evaluate the subexpression for side effects.
10487     CHECK_ALIVE(VisitForEffect(expr->expression()));
10488     return ast_context()->ReturnValue(graph()->GetConstantTrue());
10489   }
10490 }
10491
10492
10493 void HOptimizedGraphBuilder::VisitVoid(UnaryOperation* expr) {
10494   CHECK_ALIVE(VisitForEffect(expr->expression()));
10495   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
10496 }
10497
10498
10499 void HOptimizedGraphBuilder::VisitTypeof(UnaryOperation* expr) {
10500   CHECK_ALIVE(VisitForTypeOf(expr->expression()));
10501   HValue* value = Pop();
10502   HInstruction* instr = New<HTypeof>(value);
10503   return ast_context()->ReturnInstruction(instr, expr->id());
10504 }
10505
10506
10507 void HOptimizedGraphBuilder::VisitNot(UnaryOperation* expr) {
10508   if (ast_context()->IsTest()) {
10509     TestContext* context = TestContext::cast(ast_context());
10510     VisitForControl(expr->expression(),
10511                     context->if_false(),
10512                     context->if_true());
10513     return;
10514   }
10515
10516   if (ast_context()->IsEffect()) {
10517     VisitForEffect(expr->expression());
10518     return;
10519   }
10520
10521   DCHECK(ast_context()->IsValue());
10522   HBasicBlock* materialize_false = graph()->CreateBasicBlock();
10523   HBasicBlock* materialize_true = graph()->CreateBasicBlock();
10524   CHECK_BAILOUT(VisitForControl(expr->expression(),
10525                                 materialize_false,
10526                                 materialize_true));
10527
10528   if (materialize_false->HasPredecessor()) {
10529     materialize_false->SetJoinId(expr->MaterializeFalseId());
10530     set_current_block(materialize_false);
10531     Push(graph()->GetConstantFalse());
10532   } else {
10533     materialize_false = NULL;
10534   }
10535
10536   if (materialize_true->HasPredecessor()) {
10537     materialize_true->SetJoinId(expr->MaterializeTrueId());
10538     set_current_block(materialize_true);
10539     Push(graph()->GetConstantTrue());
10540   } else {
10541     materialize_true = NULL;
10542   }
10543
10544   HBasicBlock* join =
10545     CreateJoin(materialize_false, materialize_true, expr->id());
10546   set_current_block(join);
10547   if (join != NULL) return ast_context()->ReturnValue(Pop());
10548 }
10549
10550
10551 static Representation RepresentationFor(Type* type) {
10552   DisallowHeapAllocation no_allocation;
10553   if (type->Is(Type::None())) return Representation::None();
10554   if (type->Is(Type::SignedSmall())) return Representation::Smi();
10555   if (type->Is(Type::Signed32())) return Representation::Integer32();
10556   if (type->Is(Type::Number())) return Representation::Double();
10557   return Representation::Tagged();
10558 }
10559
10560
10561 HInstruction* HOptimizedGraphBuilder::BuildIncrement(
10562     bool returns_original_input,
10563     CountOperation* expr) {
10564   // The input to the count operation is on top of the expression stack.
10565   Representation rep = RepresentationFor(expr->type());
10566   if (rep.IsNone() || rep.IsTagged()) {
10567     rep = Representation::Smi();
10568   }
10569
10570   if (returns_original_input && !is_strong(function_language_mode())) {
10571     // We need an explicit HValue representing ToNumber(input).  The
10572     // actual HChange instruction we need is (sometimes) added in a later
10573     // phase, so it is not available now to be used as an input to HAdd and
10574     // as the return value.
10575     HInstruction* number_input = AddUncasted<HForceRepresentation>(Pop(), rep);
10576     if (!rep.IsDouble()) {
10577       number_input->SetFlag(HInstruction::kFlexibleRepresentation);
10578       number_input->SetFlag(HInstruction::kCannotBeTagged);
10579     }
10580     Push(number_input);
10581   }
10582
10583   // The addition has no side effects, so we do not need
10584   // to simulate the expression stack after this instruction.
10585   // Any later failures deopt to the load of the input or earlier.
10586   HConstant* delta = (expr->op() == Token::INC)
10587       ? graph()->GetConstant1()
10588       : graph()->GetConstantMinus1();
10589   HInstruction* instr =
10590       AddUncasted<HAdd>(Top(), delta, strength(function_language_mode()));
10591   if (instr->IsAdd()) {
10592     HAdd* add = HAdd::cast(instr);
10593     add->set_observed_input_representation(1, rep);
10594     add->set_observed_input_representation(2, Representation::Smi());
10595   }
10596   if (!is_strong(function_language_mode())) {
10597     instr->ClearAllSideEffects();
10598   } else {
10599     Add<HSimulate>(expr->ToNumberId(), REMOVABLE_SIMULATE);
10600   }
10601   instr->SetFlag(HInstruction::kCannotBeTagged);
10602   return instr;
10603 }
10604
10605
10606 void HOptimizedGraphBuilder::BuildStoreForEffect(
10607     Expression* expr, Property* prop, FeedbackVectorICSlot slot,
10608     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* key,
10609     HValue* value) {
10610   EffectContext for_effect(this);
10611   Push(object);
10612   if (key != NULL) Push(key);
10613   Push(value);
10614   BuildStore(expr, prop, slot, ast_id, return_id);
10615 }
10616
10617
10618 void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
10619   DCHECK(!HasStackOverflow());
10620   DCHECK(current_block() != NULL);
10621   DCHECK(current_block()->HasPredecessor());
10622   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
10623   Expression* target = expr->expression();
10624   VariableProxy* proxy = target->AsVariableProxy();
10625   Property* prop = target->AsProperty();
10626   if (proxy == NULL && prop == NULL) {
10627     return Bailout(kInvalidLhsInCountOperation);
10628   }
10629
10630   // Match the full code generator stack by simulating an extra stack
10631   // element for postfix operations in a non-effect context.  The return
10632   // value is ToNumber(input).
10633   bool returns_original_input =
10634       expr->is_postfix() && !ast_context()->IsEffect();
10635   HValue* input = NULL;  // ToNumber(original_input).
10636   HValue* after = NULL;  // The result after incrementing or decrementing.
10637
10638   if (proxy != NULL) {
10639     Variable* var = proxy->var();
10640     if (var->mode() == CONST_LEGACY)  {
10641       return Bailout(kUnsupportedCountOperationWithConst);
10642     }
10643     if (var->mode() == CONST) {
10644       return Bailout(kNonInitializerAssignmentToConst);
10645     }
10646     // Argument of the count operation is a variable, not a property.
10647     DCHECK(prop == NULL);
10648     CHECK_ALIVE(VisitForValue(target));
10649
10650     after = BuildIncrement(returns_original_input, expr);
10651     input = returns_original_input ? Top() : Pop();
10652     Push(after);
10653
10654     switch (var->location()) {
10655       case VariableLocation::GLOBAL:
10656       case VariableLocation::UNALLOCATED:
10657         HandleGlobalVariableAssignment(var, after, expr->CountSlot(),
10658                                        expr->AssignmentId());
10659         break;
10660
10661       case VariableLocation::PARAMETER:
10662       case VariableLocation::LOCAL:
10663         BindIfLive(var, after);
10664         break;
10665
10666       case VariableLocation::CONTEXT: {
10667         // Bail out if we try to mutate a parameter value in a function
10668         // using the arguments object.  We do not (yet) correctly handle the
10669         // arguments property of the function.
10670         if (current_info()->scope()->arguments() != NULL) {
10671           // Parameters will rewrite to context slots.  We have no direct
10672           // way to detect that the variable is a parameter so we use a
10673           // linear search of the parameter list.
10674           int count = current_info()->scope()->num_parameters();
10675           for (int i = 0; i < count; ++i) {
10676             if (var == current_info()->scope()->parameter(i)) {
10677               return Bailout(kAssignmentToParameterInArgumentsObject);
10678             }
10679           }
10680         }
10681
10682         HValue* context = BuildContextChainWalk(var);
10683         HStoreContextSlot::Mode mode = IsLexicalVariableMode(var->mode())
10684             ? HStoreContextSlot::kCheckDeoptimize : HStoreContextSlot::kNoCheck;
10685         HStoreContextSlot* instr = Add<HStoreContextSlot>(context, var->index(),
10686                                                           mode, after);
10687         if (instr->HasObservableSideEffects()) {
10688           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
10689         }
10690         break;
10691       }
10692
10693       case VariableLocation::LOOKUP:
10694         return Bailout(kLookupVariableInCountOperation);
10695     }
10696
10697     Drop(returns_original_input ? 2 : 1);
10698     return ast_context()->ReturnValue(expr->is_postfix() ? input : after);
10699   }
10700
10701   // Argument of the count operation is a property.
10702   DCHECK(prop != NULL);
10703   if (returns_original_input) Push(graph()->GetConstantUndefined());
10704
10705   CHECK_ALIVE(VisitForValue(prop->obj()));
10706   HValue* object = Top();
10707
10708   HValue* key = NULL;
10709   if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
10710     CHECK_ALIVE(VisitForValue(prop->key()));
10711     key = Top();
10712   }
10713
10714   CHECK_ALIVE(PushLoad(prop, object, key));
10715
10716   after = BuildIncrement(returns_original_input, expr);
10717
10718   if (returns_original_input) {
10719     input = Pop();
10720     // Drop object and key to push it again in the effect context below.
10721     Drop(key == NULL ? 1 : 2);
10722     environment()->SetExpressionStackAt(0, input);
10723     CHECK_ALIVE(BuildStoreForEffect(expr, prop, expr->CountSlot(), expr->id(),
10724                                     expr->AssignmentId(), object, key, after));
10725     return ast_context()->ReturnValue(Pop());
10726   }
10727
10728   environment()->SetExpressionStackAt(0, after);
10729   return BuildStore(expr, prop, expr->CountSlot(), expr->id(),
10730                     expr->AssignmentId());
10731 }
10732
10733
10734 HInstruction* HOptimizedGraphBuilder::BuildStringCharCodeAt(
10735     HValue* string,
10736     HValue* index) {
10737   if (string->IsConstant() && index->IsConstant()) {
10738     HConstant* c_string = HConstant::cast(string);
10739     HConstant* c_index = HConstant::cast(index);
10740     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
10741       int32_t i = c_index->NumberValueAsInteger32();
10742       Handle<String> s = c_string->StringValue();
10743       if (i < 0 || i >= s->length()) {
10744         return New<HConstant>(std::numeric_limits<double>::quiet_NaN());
10745       }
10746       return New<HConstant>(s->Get(i));
10747     }
10748   }
10749   string = BuildCheckString(string);
10750   index = Add<HBoundsCheck>(index, AddLoadStringLength(string));
10751   return New<HStringCharCodeAt>(string, index);
10752 }
10753
10754
10755 // Checks if the given shift amounts have following forms:
10756 // (N1) and (N2) with N1 + N2 = 32; (sa) and (32 - sa).
10757 static bool ShiftAmountsAllowReplaceByRotate(HValue* sa,
10758                                              HValue* const32_minus_sa) {
10759   if (sa->IsConstant() && const32_minus_sa->IsConstant()) {
10760     const HConstant* c1 = HConstant::cast(sa);
10761     const HConstant* c2 = HConstant::cast(const32_minus_sa);
10762     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
10763         (c1->Integer32Value() + c2->Integer32Value() == 32);
10764   }
10765   if (!const32_minus_sa->IsSub()) return false;
10766   HSub* sub = HSub::cast(const32_minus_sa);
10767   return sub->left()->EqualsInteger32Constant(32) && sub->right() == sa;
10768 }
10769
10770
10771 // Checks if the left and the right are shift instructions with the oposite
10772 // directions that can be replaced by one rotate right instruction or not.
10773 // Returns the operand and the shift amount for the rotate instruction in the
10774 // former case.
10775 bool HGraphBuilder::MatchRotateRight(HValue* left,
10776                                      HValue* right,
10777                                      HValue** operand,
10778                                      HValue** shift_amount) {
10779   HShl* shl;
10780   HShr* shr;
10781   if (left->IsShl() && right->IsShr()) {
10782     shl = HShl::cast(left);
10783     shr = HShr::cast(right);
10784   } else if (left->IsShr() && right->IsShl()) {
10785     shl = HShl::cast(right);
10786     shr = HShr::cast(left);
10787   } else {
10788     return false;
10789   }
10790   if (shl->left() != shr->left()) return false;
10791
10792   if (!ShiftAmountsAllowReplaceByRotate(shl->right(), shr->right()) &&
10793       !ShiftAmountsAllowReplaceByRotate(shr->right(), shl->right())) {
10794     return false;
10795   }
10796   *operand = shr->left();
10797   *shift_amount = shr->right();
10798   return true;
10799 }
10800
10801
10802 bool CanBeZero(HValue* right) {
10803   if (right->IsConstant()) {
10804     HConstant* right_const = HConstant::cast(right);
10805     if (right_const->HasInteger32Value() &&
10806        (right_const->Integer32Value() & 0x1f) != 0) {
10807       return false;
10808     }
10809   }
10810   return true;
10811 }
10812
10813
10814 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
10815                                          Type* expected) {
10816   if (expected->Is(Type::SignedSmall())) {
10817     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
10818   }
10819   if (expected->Is(Type::Signed32())) {
10820     return AddUncasted<HForceRepresentation>(number,
10821                                              Representation::Integer32());
10822   }
10823   return number;
10824 }
10825
10826
10827 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
10828   if (value->IsConstant()) {
10829     HConstant* constant = HConstant::cast(value);
10830     Maybe<HConstant*> number =
10831         constant->CopyToTruncatedNumber(isolate(), zone());
10832     if (number.IsJust()) {
10833       *expected = Type::Number(zone());
10834       return AddInstruction(number.FromJust());
10835     }
10836   }
10837
10838   // We put temporary values on the stack, which don't correspond to anything
10839   // in baseline code. Since nothing is observable we avoid recording those
10840   // pushes with a NoObservableSideEffectsScope.
10841   NoObservableSideEffectsScope no_effects(this);
10842
10843   Type* expected_type = *expected;
10844
10845   // Separate the number type from the rest.
10846   Type* expected_obj =
10847       Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
10848   Type* expected_number =
10849       Type::Intersect(expected_type, Type::Number(zone()), zone());
10850
10851   // We expect to get a number.
10852   // (We need to check first, since Type::None->Is(Type::Any()) == true.
10853   if (expected_obj->Is(Type::None())) {
10854     DCHECK(!expected_number->Is(Type::None(zone())));
10855     return value;
10856   }
10857
10858   if (expected_obj->Is(Type::Undefined(zone()))) {
10859     // This is already done by HChange.
10860     *expected = Type::Union(expected_number, Type::Number(zone()), zone());
10861     return value;
10862   }
10863
10864   return value;
10865 }
10866
10867
10868 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
10869     BinaryOperation* expr,
10870     HValue* left,
10871     HValue* right,
10872     PushBeforeSimulateBehavior push_sim_result) {
10873   Type* left_type = expr->left()->bounds().lower;
10874   Type* right_type = expr->right()->bounds().lower;
10875   Type* result_type = expr->bounds().lower;
10876   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
10877   Handle<AllocationSite> allocation_site = expr->allocation_site();
10878
10879   HAllocationMode allocation_mode;
10880   if (FLAG_allocation_site_pretenuring && !allocation_site.is_null()) {
10881     allocation_mode = HAllocationMode(allocation_site);
10882   }
10883   HValue* result = HGraphBuilder::BuildBinaryOperation(
10884       expr->op(), left, right, left_type, right_type, result_type,
10885       fixed_right_arg, allocation_mode, strength(function_language_mode()),
10886       expr->id());
10887   // Add a simulate after instructions with observable side effects, and
10888   // after phis, which are the result of BuildBinaryOperation when we
10889   // inlined some complex subgraph.
10890   if (result->HasObservableSideEffects() || result->IsPhi()) {
10891     if (push_sim_result == PUSH_BEFORE_SIMULATE) {
10892       Push(result);
10893       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10894       Drop(1);
10895     } else {
10896       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10897     }
10898   }
10899   return result;
10900 }
10901
10902
10903 HValue* HGraphBuilder::BuildBinaryOperation(
10904     Token::Value op, HValue* left, HValue* right, Type* left_type,
10905     Type* right_type, Type* result_type, Maybe<int> fixed_right_arg,
10906     HAllocationMode allocation_mode, Strength strength, BailoutId opt_id) {
10907   bool maybe_string_add = false;
10908   if (op == Token::ADD) {
10909     // If we are adding constant string with something for which we don't have
10910     // a feedback yet, assume that it's also going to be a string and don't
10911     // generate deopt instructions.
10912     if (!left_type->IsInhabited() && right->IsConstant() &&
10913         HConstant::cast(right)->HasStringValue()) {
10914       left_type = Type::String();
10915     }
10916
10917     if (!right_type->IsInhabited() && left->IsConstant() &&
10918         HConstant::cast(left)->HasStringValue()) {
10919       right_type = Type::String();
10920     }
10921
10922     maybe_string_add = (left_type->Maybe(Type::String()) ||
10923                         left_type->Maybe(Type::Receiver()) ||
10924                         right_type->Maybe(Type::String()) ||
10925                         right_type->Maybe(Type::Receiver()));
10926   }
10927
10928   Representation left_rep = RepresentationFor(left_type);
10929   Representation right_rep = RepresentationFor(right_type);
10930
10931   if (!left_type->IsInhabited()) {
10932     Add<HDeoptimize>(
10933         Deoptimizer::kInsufficientTypeFeedbackForLHSOfBinaryOperation,
10934         Deoptimizer::SOFT);
10935     left_type = Type::Any(zone());
10936     left_rep = RepresentationFor(left_type);
10937     maybe_string_add = op == Token::ADD;
10938   }
10939
10940   if (!right_type->IsInhabited()) {
10941     Add<HDeoptimize>(
10942         Deoptimizer::kInsufficientTypeFeedbackForRHSOfBinaryOperation,
10943         Deoptimizer::SOFT);
10944     right_type = Type::Any(zone());
10945     right_rep = RepresentationFor(right_type);
10946     maybe_string_add = op == Token::ADD;
10947   }
10948
10949   if (!maybe_string_add && !is_strong(strength)) {
10950     left = TruncateToNumber(left, &left_type);
10951     right = TruncateToNumber(right, &right_type);
10952   }
10953
10954   // Special case for string addition here.
10955   if (op == Token::ADD &&
10956       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
10957     // Validate type feedback for left argument.
10958     if (left_type->Is(Type::String())) {
10959       left = BuildCheckString(left);
10960     }
10961
10962     // Validate type feedback for right argument.
10963     if (right_type->Is(Type::String())) {
10964       right = BuildCheckString(right);
10965     }
10966
10967     // Convert left argument as necessary.
10968     if (left_type->Is(Type::Number()) && !is_strong(strength)) {
10969       DCHECK(right_type->Is(Type::String()));
10970       left = BuildNumberToString(left, left_type);
10971     } else if (!left_type->Is(Type::String())) {
10972       DCHECK(right_type->Is(Type::String()));
10973       HValue* function = AddLoadJSBuiltin(
10974           is_strong(strength) ? Builtins::STRING_ADD_RIGHT_STRONG
10975                               : Builtins::STRING_ADD_RIGHT);
10976       Add<HPushArguments>(left, right);
10977       return AddUncasted<HInvokeFunction>(function, 2);
10978     }
10979
10980     // Convert right argument as necessary.
10981     if (right_type->Is(Type::Number()) && !is_strong(strength)) {
10982       DCHECK(left_type->Is(Type::String()));
10983       right = BuildNumberToString(right, right_type);
10984     } else if (!right_type->Is(Type::String())) {
10985       DCHECK(left_type->Is(Type::String()));
10986       HValue* function = AddLoadJSBuiltin(is_strong(strength)
10987                                               ? Builtins::STRING_ADD_LEFT_STRONG
10988                                               : Builtins::STRING_ADD_LEFT);
10989       Add<HPushArguments>(left, right);
10990       return AddUncasted<HInvokeFunction>(function, 2);
10991     }
10992
10993     // Fast paths for empty constant strings.
10994     Handle<String> left_string =
10995         left->IsConstant() && HConstant::cast(left)->HasStringValue()
10996             ? HConstant::cast(left)->StringValue()
10997             : Handle<String>();
10998     Handle<String> right_string =
10999         right->IsConstant() && HConstant::cast(right)->HasStringValue()
11000             ? HConstant::cast(right)->StringValue()
11001             : Handle<String>();
11002     if (!left_string.is_null() && left_string->length() == 0) return right;
11003     if (!right_string.is_null() && right_string->length() == 0) return left;
11004     if (!left_string.is_null() && !right_string.is_null()) {
11005       return AddUncasted<HStringAdd>(
11006           left, right, strength, allocation_mode.GetPretenureMode(),
11007           STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
11008     }
11009
11010     // Register the dependent code with the allocation site.
11011     if (!allocation_mode.feedback_site().is_null()) {
11012       DCHECK(!graph()->info()->IsStub());
11013       Handle<AllocationSite> site(allocation_mode.feedback_site());
11014       top_info()->dependencies()->AssumeTenuringDecision(site);
11015     }
11016
11017     // Inline the string addition into the stub when creating allocation
11018     // mementos to gather allocation site feedback, or if we can statically
11019     // infer that we're going to create a cons string.
11020     if ((graph()->info()->IsStub() &&
11021          allocation_mode.CreateAllocationMementos()) ||
11022         (left->IsConstant() &&
11023          HConstant::cast(left)->HasStringValue() &&
11024          HConstant::cast(left)->StringValue()->length() + 1 >=
11025            ConsString::kMinLength) ||
11026         (right->IsConstant() &&
11027          HConstant::cast(right)->HasStringValue() &&
11028          HConstant::cast(right)->StringValue()->length() + 1 >=
11029            ConsString::kMinLength)) {
11030       return BuildStringAdd(left, right, allocation_mode);
11031     }
11032
11033     // Fallback to using the string add stub.
11034     return AddUncasted<HStringAdd>(
11035         left, right, strength, allocation_mode.GetPretenureMode(),
11036         STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
11037   }
11038
11039   if (graph()->info()->IsStub()) {
11040     left = EnforceNumberType(left, left_type);
11041     right = EnforceNumberType(right, right_type);
11042   }
11043
11044   Representation result_rep = RepresentationFor(result_type);
11045
11046   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
11047                           (right_rep.IsTagged() && !right_rep.IsSmi());
11048
11049   HInstruction* instr = NULL;
11050   // Only the stub is allowed to call into the runtime, since otherwise we would
11051   // inline several instructions (including the two pushes) for every tagged
11052   // operation in optimized code, which is more expensive, than a stub call.
11053   if (graph()->info()->IsStub() && is_non_primitive) {
11054     HValue* function =
11055         AddLoadJSBuiltin(BinaryOpIC::TokenToJSBuiltin(op, strength));
11056     Add<HPushArguments>(left, right);
11057     instr = AddUncasted<HInvokeFunction>(function, 2);
11058   } else {
11059     if (is_strong(strength) && Token::IsBitOp(op)) {
11060       // TODO(conradw): This is not efficient, but is necessary to prevent
11061       // conversion of oddball values to numbers in strong mode. It would be
11062       // better to prevent the conversion rather than adding a runtime check.
11063       IfBuilder if_builder(this);
11064       if_builder.If<HHasInstanceTypeAndBranch>(left, ODDBALL_TYPE);
11065       if_builder.OrIf<HHasInstanceTypeAndBranch>(right, ODDBALL_TYPE);
11066       if_builder.Then();
11067       Add<HCallRuntime>(
11068           isolate()->factory()->empty_string(),
11069           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
11070           0);
11071       if (!graph()->info()->IsStub()) {
11072         Add<HSimulate>(opt_id, REMOVABLE_SIMULATE);
11073       }
11074       if_builder.End();
11075     }
11076     switch (op) {
11077       case Token::ADD:
11078         instr = AddUncasted<HAdd>(left, right, strength);
11079         break;
11080       case Token::SUB:
11081         instr = AddUncasted<HSub>(left, right, strength);
11082         break;
11083       case Token::MUL:
11084         instr = AddUncasted<HMul>(left, right, strength);
11085         break;
11086       case Token::MOD: {
11087         if (fixed_right_arg.IsJust() &&
11088             !right->EqualsInteger32Constant(fixed_right_arg.FromJust())) {
11089           HConstant* fixed_right =
11090               Add<HConstant>(static_cast<int>(fixed_right_arg.FromJust()));
11091           IfBuilder if_same(this);
11092           if_same.If<HCompareNumericAndBranch>(right, fixed_right, Token::EQ);
11093           if_same.Then();
11094           if_same.ElseDeopt(Deoptimizer::kUnexpectedRHSOfBinaryOperation);
11095           right = fixed_right;
11096         }
11097         instr = AddUncasted<HMod>(left, right, strength);
11098         break;
11099       }
11100       case Token::DIV:
11101         instr = AddUncasted<HDiv>(left, right, strength);
11102         break;
11103       case Token::BIT_XOR:
11104       case Token::BIT_AND:
11105         instr = AddUncasted<HBitwise>(op, left, right, strength);
11106         break;
11107       case Token::BIT_OR: {
11108         HValue* operand, *shift_amount;
11109         if (left_type->Is(Type::Signed32()) &&
11110             right_type->Is(Type::Signed32()) &&
11111             MatchRotateRight(left, right, &operand, &shift_amount)) {
11112           instr = AddUncasted<HRor>(operand, shift_amount, strength);
11113         } else {
11114           instr = AddUncasted<HBitwise>(op, left, right, strength);
11115         }
11116         break;
11117       }
11118       case Token::SAR:
11119         instr = AddUncasted<HSar>(left, right, strength);
11120         break;
11121       case Token::SHR:
11122         instr = AddUncasted<HShr>(left, right, strength);
11123         if (instr->IsShr() && CanBeZero(right)) {
11124           graph()->RecordUint32Instruction(instr);
11125         }
11126         break;
11127       case Token::SHL:
11128         instr = AddUncasted<HShl>(left, right, strength);
11129         break;
11130       default:
11131         UNREACHABLE();
11132     }
11133   }
11134
11135   if (instr->IsBinaryOperation()) {
11136     HBinaryOperation* binop = HBinaryOperation::cast(instr);
11137     binop->set_observed_input_representation(1, left_rep);
11138     binop->set_observed_input_representation(2, right_rep);
11139     binop->initialize_output_representation(result_rep);
11140     if (graph()->info()->IsStub()) {
11141       // Stub should not call into stub.
11142       instr->SetFlag(HValue::kCannotBeTagged);
11143       // And should truncate on HForceRepresentation already.
11144       if (left->IsForceRepresentation()) {
11145         left->CopyFlag(HValue::kTruncatingToSmi, instr);
11146         left->CopyFlag(HValue::kTruncatingToInt32, instr);
11147       }
11148       if (right->IsForceRepresentation()) {
11149         right->CopyFlag(HValue::kTruncatingToSmi, instr);
11150         right->CopyFlag(HValue::kTruncatingToInt32, instr);
11151       }
11152     }
11153   }
11154   return instr;
11155 }
11156
11157
11158 // Check for the form (%_ClassOf(foo) === 'BarClass').
11159 static bool IsClassOfTest(CompareOperation* expr) {
11160   if (expr->op() != Token::EQ_STRICT) return false;
11161   CallRuntime* call = expr->left()->AsCallRuntime();
11162   if (call == NULL) return false;
11163   Literal* literal = expr->right()->AsLiteral();
11164   if (literal == NULL) return false;
11165   if (!literal->value()->IsString()) return false;
11166   if (!call->name()->IsOneByteEqualTo(STATIC_CHAR_VECTOR("_ClassOf"))) {
11167     return false;
11168   }
11169   DCHECK(call->arguments()->length() == 1);
11170   return true;
11171 }
11172
11173
11174 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
11175   DCHECK(!HasStackOverflow());
11176   DCHECK(current_block() != NULL);
11177   DCHECK(current_block()->HasPredecessor());
11178   switch (expr->op()) {
11179     case Token::COMMA:
11180       return VisitComma(expr);
11181     case Token::OR:
11182     case Token::AND:
11183       return VisitLogicalExpression(expr);
11184     default:
11185       return VisitArithmeticExpression(expr);
11186   }
11187 }
11188
11189
11190 void HOptimizedGraphBuilder::VisitComma(BinaryOperation* expr) {
11191   CHECK_ALIVE(VisitForEffect(expr->left()));
11192   // Visit the right subexpression in the same AST context as the entire
11193   // expression.
11194   Visit(expr->right());
11195 }
11196
11197
11198 void HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
11199   bool is_logical_and = expr->op() == Token::AND;
11200   if (ast_context()->IsTest()) {
11201     TestContext* context = TestContext::cast(ast_context());
11202     // Translate left subexpression.
11203     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11204     if (is_logical_and) {
11205       CHECK_BAILOUT(VisitForControl(expr->left(),
11206                                     eval_right,
11207                                     context->if_false()));
11208     } else {
11209       CHECK_BAILOUT(VisitForControl(expr->left(),
11210                                     context->if_true(),
11211                                     eval_right));
11212     }
11213
11214     // Translate right subexpression by visiting it in the same AST
11215     // context as the entire expression.
11216     if (eval_right->HasPredecessor()) {
11217       eval_right->SetJoinId(expr->RightId());
11218       set_current_block(eval_right);
11219       Visit(expr->right());
11220     }
11221
11222   } else if (ast_context()->IsValue()) {
11223     CHECK_ALIVE(VisitForValue(expr->left()));
11224     DCHECK(current_block() != NULL);
11225     HValue* left_value = Top();
11226
11227     // Short-circuit left values that always evaluate to the same boolean value.
11228     if (expr->left()->ToBooleanIsTrue() || expr->left()->ToBooleanIsFalse()) {
11229       // l (evals true)  && r -> r
11230       // l (evals true)  || r -> l
11231       // l (evals false) && r -> l
11232       // l (evals false) || r -> r
11233       if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
11234         Drop(1);
11235         CHECK_ALIVE(VisitForValue(expr->right()));
11236       }
11237       return ast_context()->ReturnValue(Pop());
11238     }
11239
11240     // We need an extra block to maintain edge-split form.
11241     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11242     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11243     ToBooleanStub::Types expected(expr->left()->to_boolean_types());
11244     HBranch* test = is_logical_and
11245         ? New<HBranch>(left_value, expected, eval_right, empty_block)
11246         : New<HBranch>(left_value, expected, empty_block, eval_right);
11247     FinishCurrentBlock(test);
11248
11249     set_current_block(eval_right);
11250     Drop(1);  // Value of the left subexpression.
11251     CHECK_BAILOUT(VisitForValue(expr->right()));
11252
11253     HBasicBlock* join_block =
11254       CreateJoin(empty_block, current_block(), expr->id());
11255     set_current_block(join_block);
11256     return ast_context()->ReturnValue(Pop());
11257
11258   } else {
11259     DCHECK(ast_context()->IsEffect());
11260     // In an effect context, we don't need the value of the left subexpression,
11261     // only its control flow and side effects.  We need an extra block to
11262     // maintain edge-split form.
11263     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11264     HBasicBlock* right_block = graph()->CreateBasicBlock();
11265     if (is_logical_and) {
11266       CHECK_BAILOUT(VisitForControl(expr->left(), right_block, empty_block));
11267     } else {
11268       CHECK_BAILOUT(VisitForControl(expr->left(), empty_block, right_block));
11269     }
11270
11271     // TODO(kmillikin): Find a way to fix this.  It's ugly that there are
11272     // actually two empty blocks (one here and one inserted by
11273     // TestContext::BuildBranch, and that they both have an HSimulate though the
11274     // second one is not a merge node, and that we really have no good AST ID to
11275     // put on that first HSimulate.
11276
11277     if (empty_block->HasPredecessor()) {
11278       empty_block->SetJoinId(expr->id());
11279     } else {
11280       empty_block = NULL;
11281     }
11282
11283     if (right_block->HasPredecessor()) {
11284       right_block->SetJoinId(expr->RightId());
11285       set_current_block(right_block);
11286       CHECK_BAILOUT(VisitForEffect(expr->right()));
11287       right_block = current_block();
11288     } else {
11289       right_block = NULL;
11290     }
11291
11292     HBasicBlock* join_block =
11293       CreateJoin(empty_block, right_block, expr->id());
11294     set_current_block(join_block);
11295     // We did not materialize any value in the predecessor environments,
11296     // so there is no need to handle it here.
11297   }
11298 }
11299
11300
11301 void HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
11302   CHECK_ALIVE(VisitForValue(expr->left()));
11303   CHECK_ALIVE(VisitForValue(expr->right()));
11304   SetSourcePosition(expr->position());
11305   HValue* right = Pop();
11306   HValue* left = Pop();
11307   HValue* result =
11308       BuildBinaryOperation(expr, left, right,
11309           ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11310                                     : PUSH_BEFORE_SIMULATE);
11311   if (top_info()->is_tracking_positions() && result->IsBinaryOperation()) {
11312     HBinaryOperation::cast(result)->SetOperandPositions(
11313         zone(),
11314         ScriptPositionToSourcePosition(expr->left()->position()),
11315         ScriptPositionToSourcePosition(expr->right()->position()));
11316   }
11317   return ast_context()->ReturnValue(result);
11318 }
11319
11320
11321 void HOptimizedGraphBuilder::HandleLiteralCompareTypeof(CompareOperation* expr,
11322                                                         Expression* sub_expr,
11323                                                         Handle<String> check) {
11324   CHECK_ALIVE(VisitForTypeOf(sub_expr));
11325   SetSourcePosition(expr->position());
11326   HValue* value = Pop();
11327   HTypeofIsAndBranch* instr = New<HTypeofIsAndBranch>(value, check);
11328   return ast_context()->ReturnControl(instr, expr->id());
11329 }
11330
11331
11332 static bool IsLiteralCompareBool(Isolate* isolate,
11333                                  HValue* left,
11334                                  Token::Value op,
11335                                  HValue* right) {
11336   return op == Token::EQ_STRICT &&
11337       ((left->IsConstant() &&
11338           HConstant::cast(left)->handle(isolate)->IsBoolean()) ||
11339        (right->IsConstant() &&
11340            HConstant::cast(right)->handle(isolate)->IsBoolean()));
11341 }
11342
11343
11344 void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
11345   DCHECK(!HasStackOverflow());
11346   DCHECK(current_block() != NULL);
11347   DCHECK(current_block()->HasPredecessor());
11348
11349   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11350
11351   // Check for a few fast cases. The AST visiting behavior must be in sync
11352   // with the full codegen: We don't push both left and right values onto
11353   // the expression stack when one side is a special-case literal.
11354   Expression* sub_expr = NULL;
11355   Handle<String> check;
11356   if (expr->IsLiteralCompareTypeof(&sub_expr, &check)) {
11357     return HandleLiteralCompareTypeof(expr, sub_expr, check);
11358   }
11359   if (expr->IsLiteralCompareUndefined(&sub_expr, isolate())) {
11360     return HandleLiteralCompareNil(expr, sub_expr, kUndefinedValue);
11361   }
11362   if (expr->IsLiteralCompareNull(&sub_expr)) {
11363     return HandleLiteralCompareNil(expr, sub_expr, kNullValue);
11364   }
11365
11366   if (IsClassOfTest(expr)) {
11367     CallRuntime* call = expr->left()->AsCallRuntime();
11368     DCHECK(call->arguments()->length() == 1);
11369     CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11370     HValue* value = Pop();
11371     Literal* literal = expr->right()->AsLiteral();
11372     Handle<String> rhs = Handle<String>::cast(literal->value());
11373     HClassOfTestAndBranch* instr = New<HClassOfTestAndBranch>(value, rhs);
11374     return ast_context()->ReturnControl(instr, expr->id());
11375   }
11376
11377   Type* left_type = expr->left()->bounds().lower;
11378   Type* right_type = expr->right()->bounds().lower;
11379   Type* combined_type = expr->combined_type();
11380
11381   CHECK_ALIVE(VisitForValue(expr->left()));
11382   CHECK_ALIVE(VisitForValue(expr->right()));
11383
11384   HValue* right = Pop();
11385   HValue* left = Pop();
11386   Token::Value op = expr->op();
11387
11388   if (IsLiteralCompareBool(isolate(), left, op, right)) {
11389     HCompareObjectEqAndBranch* result =
11390         New<HCompareObjectEqAndBranch>(left, right);
11391     return ast_context()->ReturnControl(result, expr->id());
11392   }
11393
11394   if (op == Token::INSTANCEOF) {
11395     // Check to see if the rhs of the instanceof is a known function.
11396     if (right->IsConstant() &&
11397         HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
11398       Handle<Object> function = HConstant::cast(right)->handle(isolate());
11399       Handle<JSFunction> target = Handle<JSFunction>::cast(function);
11400       HInstanceOfKnownGlobal* result =
11401           New<HInstanceOfKnownGlobal>(left, target);
11402       return ast_context()->ReturnInstruction(result, expr->id());
11403     }
11404
11405     HInstanceOf* result = New<HInstanceOf>(left, right);
11406     return ast_context()->ReturnInstruction(result, expr->id());
11407
11408   } else if (op == Token::IN) {
11409     HValue* function = AddLoadJSBuiltin(Builtins::IN);
11410     Add<HPushArguments>(left, right);
11411     // TODO(olivf) InvokeFunction produces a check for the parameter count,
11412     // even though we are certain to pass the correct number of arguments here.
11413     HInstruction* result = New<HInvokeFunction>(function, 2);
11414     return ast_context()->ReturnInstruction(result, expr->id());
11415   }
11416
11417   PushBeforeSimulateBehavior push_behavior =
11418     ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11419                               : PUSH_BEFORE_SIMULATE;
11420   HControlInstruction* compare = BuildCompareInstruction(
11421       op, left, right, left_type, right_type, combined_type,
11422       ScriptPositionToSourcePosition(expr->left()->position()),
11423       ScriptPositionToSourcePosition(expr->right()->position()),
11424       push_behavior, expr->id());
11425   if (compare == NULL) return;  // Bailed out.
11426   return ast_context()->ReturnControl(compare, expr->id());
11427 }
11428
11429
11430 HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
11431     Token::Value op, HValue* left, HValue* right, Type* left_type,
11432     Type* right_type, Type* combined_type, SourcePosition left_position,
11433     SourcePosition right_position, PushBeforeSimulateBehavior push_sim_result,
11434     BailoutId bailout_id) {
11435   // Cases handled below depend on collected type feedback. They should
11436   // soft deoptimize when there is no type feedback.
11437   if (!combined_type->IsInhabited()) {
11438     Add<HDeoptimize>(
11439         Deoptimizer::kInsufficientTypeFeedbackForCombinedTypeOfBinaryOperation,
11440         Deoptimizer::SOFT);
11441     combined_type = left_type = right_type = Type::Any(zone());
11442   }
11443
11444   Representation left_rep = RepresentationFor(left_type);
11445   Representation right_rep = RepresentationFor(right_type);
11446   Representation combined_rep = RepresentationFor(combined_type);
11447
11448   if (combined_type->Is(Type::Receiver())) {
11449     if (Token::IsEqualityOp(op)) {
11450       // HCompareObjectEqAndBranch can only deal with object, so
11451       // exclude numbers.
11452       if ((left->IsConstant() &&
11453            HConstant::cast(left)->HasNumberValue()) ||
11454           (right->IsConstant() &&
11455            HConstant::cast(right)->HasNumberValue())) {
11456         Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11457                          Deoptimizer::SOFT);
11458         // The caller expects a branch instruction, so make it happy.
11459         return New<HBranch>(graph()->GetConstantTrue());
11460       }
11461       // Can we get away with map check and not instance type check?
11462       HValue* operand_to_check =
11463           left->block()->block_id() < right->block()->block_id() ? left : right;
11464       if (combined_type->IsClass()) {
11465         Handle<Map> map = combined_type->AsClass()->Map();
11466         AddCheckMap(operand_to_check, map);
11467         HCompareObjectEqAndBranch* result =
11468             New<HCompareObjectEqAndBranch>(left, right);
11469         if (top_info()->is_tracking_positions()) {
11470           result->set_operand_position(zone(), 0, left_position);
11471           result->set_operand_position(zone(), 1, right_position);
11472         }
11473         return result;
11474       } else {
11475         BuildCheckHeapObject(operand_to_check);
11476         Add<HCheckInstanceType>(operand_to_check,
11477                                 HCheckInstanceType::IS_SPEC_OBJECT);
11478         HCompareObjectEqAndBranch* result =
11479             New<HCompareObjectEqAndBranch>(left, right);
11480         return result;
11481       }
11482     } else {
11483       Bailout(kUnsupportedNonPrimitiveCompare);
11484       return NULL;
11485     }
11486   } else if (combined_type->Is(Type::InternalizedString()) &&
11487              Token::IsEqualityOp(op)) {
11488     // If we have a constant argument, it should be consistent with the type
11489     // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
11490     if ((left->IsConstant() &&
11491          !HConstant::cast(left)->HasInternalizedStringValue()) ||
11492         (right->IsConstant() &&
11493          !HConstant::cast(right)->HasInternalizedStringValue())) {
11494       Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11495                        Deoptimizer::SOFT);
11496       // The caller expects a branch instruction, so make it happy.
11497       return New<HBranch>(graph()->GetConstantTrue());
11498     }
11499     BuildCheckHeapObject(left);
11500     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
11501     BuildCheckHeapObject(right);
11502     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
11503     HCompareObjectEqAndBranch* result =
11504         New<HCompareObjectEqAndBranch>(left, right);
11505     return result;
11506   } else if (combined_type->Is(Type::String())) {
11507     BuildCheckHeapObject(left);
11508     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
11509     BuildCheckHeapObject(right);
11510     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
11511     HStringCompareAndBranch* result =
11512         New<HStringCompareAndBranch>(left, right, op);
11513     return result;
11514   } else {
11515     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
11516       HCompareGeneric* result = Add<HCompareGeneric>(
11517           left, right, op, strength(function_language_mode()));
11518       result->set_observed_input_representation(1, left_rep);
11519       result->set_observed_input_representation(2, right_rep);
11520       if (result->HasObservableSideEffects()) {
11521         if (push_sim_result == PUSH_BEFORE_SIMULATE) {
11522           Push(result);
11523           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11524           Drop(1);
11525         } else {
11526           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11527         }
11528       }
11529       // TODO(jkummerow): Can we make this more efficient?
11530       HBranch* branch = New<HBranch>(result);
11531       return branch;
11532     } else {
11533       HCompareNumericAndBranch* result = New<HCompareNumericAndBranch>(
11534           left, right, op, strength(function_language_mode()));
11535       result->set_observed_input_representation(left_rep, right_rep);
11536       if (top_info()->is_tracking_positions()) {
11537         result->SetOperandPositions(zone(), left_position, right_position);
11538       }
11539       return result;
11540     }
11541   }
11542 }
11543
11544
11545 void HOptimizedGraphBuilder::HandleLiteralCompareNil(CompareOperation* expr,
11546                                                      Expression* sub_expr,
11547                                                      NilValue nil) {
11548   DCHECK(!HasStackOverflow());
11549   DCHECK(current_block() != NULL);
11550   DCHECK(current_block()->HasPredecessor());
11551   DCHECK(expr->op() == Token::EQ || expr->op() == Token::EQ_STRICT);
11552   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11553   CHECK_ALIVE(VisitForValue(sub_expr));
11554   HValue* value = Pop();
11555   if (expr->op() == Token::EQ_STRICT) {
11556     HConstant* nil_constant = nil == kNullValue
11557         ? graph()->GetConstantNull()
11558         : graph()->GetConstantUndefined();
11559     HCompareObjectEqAndBranch* instr =
11560         New<HCompareObjectEqAndBranch>(value, nil_constant);
11561     return ast_context()->ReturnControl(instr, expr->id());
11562   } else {
11563     DCHECK_EQ(Token::EQ, expr->op());
11564     Type* type = expr->combined_type()->Is(Type::None())
11565         ? Type::Any(zone()) : expr->combined_type();
11566     HIfContinuation continuation;
11567     BuildCompareNil(value, type, &continuation);
11568     return ast_context()->ReturnContinuation(&continuation, expr->id());
11569   }
11570 }
11571
11572
11573 void HOptimizedGraphBuilder::VisitSpread(Spread* expr) { UNREACHABLE(); }
11574
11575
11576 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
11577   // If we share optimized code between different closures, the
11578   // this-function is not a constant, except inside an inlined body.
11579   if (function_state()->outer() != NULL) {
11580       return New<HConstant>(
11581           function_state()->compilation_info()->closure());
11582   } else {
11583       return New<HThisFunction>();
11584   }
11585 }
11586
11587
11588 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
11589     Handle<JSObject> boilerplate_object,
11590     AllocationSiteUsageContext* site_context) {
11591   NoObservableSideEffectsScope no_effects(this);
11592   Handle<Map> initial_map(boilerplate_object->map());
11593   InstanceType instance_type = initial_map->instance_type();
11594   DCHECK(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
11595
11596   HType type = instance_type == JS_ARRAY_TYPE
11597       ? HType::JSArray() : HType::JSObject();
11598   HValue* object_size_constant = Add<HConstant>(initial_map->instance_size());
11599
11600   PretenureFlag pretenure_flag = NOT_TENURED;
11601   Handle<AllocationSite> top_site(*site_context->top(), isolate());
11602   if (FLAG_allocation_site_pretenuring) {
11603     pretenure_flag = top_site->GetPretenureMode();
11604   }
11605
11606   Handle<AllocationSite> current_site(*site_context->current(), isolate());
11607   if (*top_site == *current_site) {
11608     // We install a dependency for pretenuring only on the outermost literal.
11609     top_info()->dependencies()->AssumeTenuringDecision(top_site);
11610   }
11611   top_info()->dependencies()->AssumeTransitionStable(current_site);
11612
11613   HInstruction* object = Add<HAllocate>(
11614       object_size_constant, type, pretenure_flag, instance_type, top_site);
11615
11616   // If allocation folding reaches Page::kMaxRegularHeapObjectSize the
11617   // elements array may not get folded into the object. Hence, we set the
11618   // elements pointer to empty fixed array and let store elimination remove
11619   // this store in the folding case.
11620   HConstant* empty_fixed_array = Add<HConstant>(
11621       isolate()->factory()->empty_fixed_array());
11622   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11623       empty_fixed_array);
11624
11625   BuildEmitObjectHeader(boilerplate_object, object);
11626
11627   // Similarly to the elements pointer, there is no guarantee that all
11628   // property allocations can get folded, so pre-initialize all in-object
11629   // properties to a safe value.
11630   BuildInitializeInobjectProperties(object, initial_map);
11631
11632   Handle<FixedArrayBase> elements(boilerplate_object->elements());
11633   int elements_size = (elements->length() > 0 &&
11634       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
11635           elements->Size() : 0;
11636
11637   if (pretenure_flag == TENURED &&
11638       elements->map() == isolate()->heap()->fixed_cow_array_map() &&
11639       isolate()->heap()->InNewSpace(*elements)) {
11640     // If we would like to pretenure a fixed cow array, we must ensure that the
11641     // array is already in old space, otherwise we'll create too many old-to-
11642     // new-space pointers (overflowing the store buffer).
11643     elements = Handle<FixedArrayBase>(
11644         isolate()->factory()->CopyAndTenureFixedCOWArray(
11645             Handle<FixedArray>::cast(elements)));
11646     boilerplate_object->set_elements(*elements);
11647   }
11648
11649   HInstruction* object_elements = NULL;
11650   if (elements_size > 0) {
11651     HValue* object_elements_size = Add<HConstant>(elements_size);
11652     InstanceType instance_type = boilerplate_object->HasFastDoubleElements()
11653         ? FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
11654     object_elements = Add<HAllocate>(object_elements_size, HType::HeapObject(),
11655                                      pretenure_flag, instance_type, top_site);
11656     BuildEmitElements(boilerplate_object, elements, object_elements,
11657                       site_context);
11658     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11659                           object_elements);
11660   } else {
11661     Handle<Object> elements_field =
11662         Handle<Object>(boilerplate_object->elements(), isolate());
11663     HInstruction* object_elements_cow = Add<HConstant>(elements_field);
11664     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11665                           object_elements_cow);
11666   }
11667
11668   // Copy in-object properties.
11669   if (initial_map->NumberOfFields() != 0 ||
11670       initial_map->unused_property_fields() > 0) {
11671     BuildEmitInObjectProperties(boilerplate_object, object, site_context,
11672                                 pretenure_flag);
11673   }
11674   return object;
11675 }
11676
11677
11678 void HOptimizedGraphBuilder::BuildEmitObjectHeader(
11679     Handle<JSObject> boilerplate_object,
11680     HInstruction* object) {
11681   DCHECK(boilerplate_object->properties()->length() == 0);
11682
11683   Handle<Map> boilerplate_object_map(boilerplate_object->map());
11684   AddStoreMapConstant(object, boilerplate_object_map);
11685
11686   Handle<Object> properties_field =
11687       Handle<Object>(boilerplate_object->properties(), isolate());
11688   DCHECK(*properties_field == isolate()->heap()->empty_fixed_array());
11689   HInstruction* properties = Add<HConstant>(properties_field);
11690   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
11691   Add<HStoreNamedField>(object, access, properties);
11692
11693   if (boilerplate_object->IsJSArray()) {
11694     Handle<JSArray> boilerplate_array =
11695         Handle<JSArray>::cast(boilerplate_object);
11696     Handle<Object> length_field =
11697         Handle<Object>(boilerplate_array->length(), isolate());
11698     HInstruction* length = Add<HConstant>(length_field);
11699
11700     DCHECK(boilerplate_array->length()->IsSmi());
11701     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
11702         boilerplate_array->GetElementsKind()), length);
11703   }
11704 }
11705
11706
11707 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
11708     Handle<JSObject> boilerplate_object,
11709     HInstruction* object,
11710     AllocationSiteUsageContext* site_context,
11711     PretenureFlag pretenure_flag) {
11712   Handle<Map> boilerplate_map(boilerplate_object->map());
11713   Handle<DescriptorArray> descriptors(boilerplate_map->instance_descriptors());
11714   int limit = boilerplate_map->NumberOfOwnDescriptors();
11715
11716   int copied_fields = 0;
11717   for (int i = 0; i < limit; i++) {
11718     PropertyDetails details = descriptors->GetDetails(i);
11719     if (details.type() != DATA) continue;
11720     copied_fields++;
11721     FieldIndex field_index = FieldIndex::ForDescriptor(*boilerplate_map, i);
11722
11723
11724     int property_offset = field_index.offset();
11725     Handle<Name> name(descriptors->GetKey(i));
11726
11727     // The access for the store depends on the type of the boilerplate.
11728     HObjectAccess access = boilerplate_object->IsJSArray() ?
11729         HObjectAccess::ForJSArrayOffset(property_offset) :
11730         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11731
11732     if (boilerplate_object->IsUnboxedDoubleField(field_index)) {
11733       CHECK(!boilerplate_object->IsJSArray());
11734       double value = boilerplate_object->RawFastDoublePropertyAt(field_index);
11735       access = access.WithRepresentation(Representation::Double());
11736       Add<HStoreNamedField>(object, access, Add<HConstant>(value));
11737       continue;
11738     }
11739     Handle<Object> value(boilerplate_object->RawFastPropertyAt(field_index),
11740                          isolate());
11741
11742     if (value->IsJSObject()) {
11743       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11744       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11745       HInstruction* result =
11746           BuildFastLiteral(value_object, site_context);
11747       site_context->ExitScope(current_site, value_object);
11748       Add<HStoreNamedField>(object, access, result);
11749     } else {
11750       Representation representation = details.representation();
11751       HInstruction* value_instruction;
11752
11753       if (representation.IsDouble()) {
11754         // Allocate a HeapNumber box and store the value into it.
11755         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
11756         HInstruction* double_box =
11757             Add<HAllocate>(heap_number_constant, HType::HeapObject(),
11758                 pretenure_flag, MUTABLE_HEAP_NUMBER_TYPE);
11759         AddStoreMapConstant(double_box,
11760             isolate()->factory()->mutable_heap_number_map());
11761         // Unwrap the mutable heap number from the boilerplate.
11762         HValue* double_value =
11763             Add<HConstant>(Handle<HeapNumber>::cast(value)->value());
11764         Add<HStoreNamedField>(
11765             double_box, HObjectAccess::ForHeapNumberValue(), double_value);
11766         value_instruction = double_box;
11767       } else if (representation.IsSmi()) {
11768         value_instruction = value->IsUninitialized()
11769             ? graph()->GetConstant0()
11770             : Add<HConstant>(value);
11771         // Ensure that value is stored as smi.
11772         access = access.WithRepresentation(representation);
11773       } else {
11774         value_instruction = Add<HConstant>(value);
11775       }
11776
11777       Add<HStoreNamedField>(object, access, value_instruction);
11778     }
11779   }
11780
11781   int inobject_properties = boilerplate_object->map()->inobject_properties();
11782   HInstruction* value_instruction =
11783       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
11784   for (int i = copied_fields; i < inobject_properties; i++) {
11785     DCHECK(boilerplate_object->IsJSObject());
11786     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
11787     HObjectAccess access =
11788         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11789     Add<HStoreNamedField>(object, access, value_instruction);
11790   }
11791 }
11792
11793
11794 void HOptimizedGraphBuilder::BuildEmitElements(
11795     Handle<JSObject> boilerplate_object,
11796     Handle<FixedArrayBase> elements,
11797     HValue* object_elements,
11798     AllocationSiteUsageContext* site_context) {
11799   ElementsKind kind = boilerplate_object->map()->elements_kind();
11800   int elements_length = elements->length();
11801   HValue* object_elements_length = Add<HConstant>(elements_length);
11802   BuildInitializeElementsHeader(object_elements, kind, object_elements_length);
11803
11804   // Copy elements backing store content.
11805   if (elements->IsFixedDoubleArray()) {
11806     BuildEmitFixedDoubleArray(elements, kind, object_elements);
11807   } else if (elements->IsFixedArray()) {
11808     BuildEmitFixedArray(elements, kind, object_elements,
11809                         site_context);
11810   } else {
11811     UNREACHABLE();
11812   }
11813 }
11814
11815
11816 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
11817     Handle<FixedArrayBase> elements,
11818     ElementsKind kind,
11819     HValue* object_elements) {
11820   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11821   int elements_length = elements->length();
11822   for (int i = 0; i < elements_length; i++) {
11823     HValue* key_constant = Add<HConstant>(i);
11824     HInstruction* value_instruction = Add<HLoadKeyed>(
11825         boilerplate_elements, key_constant, nullptr, kind, ALLOW_RETURN_HOLE);
11826     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
11827                                            value_instruction, kind);
11828     store->SetFlag(HValue::kAllowUndefinedAsNaN);
11829   }
11830 }
11831
11832
11833 void HOptimizedGraphBuilder::BuildEmitFixedArray(
11834     Handle<FixedArrayBase> elements,
11835     ElementsKind kind,
11836     HValue* object_elements,
11837     AllocationSiteUsageContext* site_context) {
11838   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11839   int elements_length = elements->length();
11840   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
11841   for (int i = 0; i < elements_length; i++) {
11842     Handle<Object> value(fast_elements->get(i), isolate());
11843     HValue* key_constant = Add<HConstant>(i);
11844     if (value->IsJSObject()) {
11845       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11846       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11847       HInstruction* result =
11848           BuildFastLiteral(value_object, site_context);
11849       site_context->ExitScope(current_site, value_object);
11850       Add<HStoreKeyed>(object_elements, key_constant, result, kind);
11851     } else {
11852       ElementsKind copy_kind =
11853           kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
11854       HInstruction* value_instruction =
11855           Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr,
11856                           copy_kind, ALLOW_RETURN_HOLE);
11857       Add<HStoreKeyed>(object_elements, key_constant, value_instruction,
11858                        copy_kind);
11859     }
11860   }
11861 }
11862
11863
11864 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
11865   DCHECK(!HasStackOverflow());
11866   DCHECK(current_block() != NULL);
11867   DCHECK(current_block()->HasPredecessor());
11868   HInstruction* instr = BuildThisFunction();
11869   return ast_context()->ReturnInstruction(instr, expr->id());
11870 }
11871
11872
11873 void HOptimizedGraphBuilder::VisitSuperPropertyReference(
11874     SuperPropertyReference* expr) {
11875   DCHECK(!HasStackOverflow());
11876   DCHECK(current_block() != NULL);
11877   DCHECK(current_block()->HasPredecessor());
11878   return Bailout(kSuperReference);
11879 }
11880
11881
11882 void HOptimizedGraphBuilder::VisitSuperCallReference(SuperCallReference* expr) {
11883   DCHECK(!HasStackOverflow());
11884   DCHECK(current_block() != NULL);
11885   DCHECK(current_block()->HasPredecessor());
11886   return Bailout(kSuperReference);
11887 }
11888
11889
11890 void HOptimizedGraphBuilder::VisitDeclarations(
11891     ZoneList<Declaration*>* declarations) {
11892   DCHECK(globals_.is_empty());
11893   AstVisitor::VisitDeclarations(declarations);
11894   if (!globals_.is_empty()) {
11895     Handle<FixedArray> array =
11896        isolate()->factory()->NewFixedArray(globals_.length(), TENURED);
11897     for (int i = 0; i < globals_.length(); ++i) array->set(i, *globals_.at(i));
11898     int flags =
11899         DeclareGlobalsEvalFlag::encode(current_info()->is_eval()) |
11900         DeclareGlobalsNativeFlag::encode(current_info()->is_native()) |
11901         DeclareGlobalsLanguageMode::encode(current_info()->language_mode());
11902     Add<HDeclareGlobals>(array, flags);
11903     globals_.Rewind(0);
11904   }
11905 }
11906
11907
11908 void HOptimizedGraphBuilder::VisitVariableDeclaration(
11909     VariableDeclaration* declaration) {
11910   VariableProxy* proxy = declaration->proxy();
11911   VariableMode mode = declaration->mode();
11912   Variable* variable = proxy->var();
11913   bool hole_init = mode == LET || mode == CONST || mode == CONST_LEGACY;
11914   switch (variable->location()) {
11915     case VariableLocation::GLOBAL:
11916     case VariableLocation::UNALLOCATED:
11917       globals_.Add(variable->name(), zone());
11918       globals_.Add(variable->binding_needs_init()
11919                        ? isolate()->factory()->the_hole_value()
11920                        : isolate()->factory()->undefined_value(), zone());
11921       return;
11922     case VariableLocation::PARAMETER:
11923     case VariableLocation::LOCAL:
11924       if (hole_init) {
11925         HValue* value = graph()->GetConstantHole();
11926         environment()->Bind(variable, value);
11927       }
11928       break;
11929     case VariableLocation::CONTEXT:
11930       if (hole_init) {
11931         HValue* value = graph()->GetConstantHole();
11932         HValue* context = environment()->context();
11933         HStoreContextSlot* store = Add<HStoreContextSlot>(
11934             context, variable->index(), HStoreContextSlot::kNoCheck, value);
11935         if (store->HasObservableSideEffects()) {
11936           Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11937         }
11938       }
11939       break;
11940     case VariableLocation::LOOKUP:
11941       return Bailout(kUnsupportedLookupSlotInDeclaration);
11942   }
11943 }
11944
11945
11946 void HOptimizedGraphBuilder::VisitFunctionDeclaration(
11947     FunctionDeclaration* declaration) {
11948   VariableProxy* proxy = declaration->proxy();
11949   Variable* variable = proxy->var();
11950   switch (variable->location()) {
11951     case VariableLocation::GLOBAL:
11952     case VariableLocation::UNALLOCATED: {
11953       globals_.Add(variable->name(), zone());
11954       Handle<SharedFunctionInfo> function = Compiler::GetSharedFunctionInfo(
11955           declaration->fun(), current_info()->script(), top_info());
11956       // Check for stack-overflow exception.
11957       if (function.is_null()) return SetStackOverflow();
11958       globals_.Add(function, zone());
11959       return;
11960     }
11961     case VariableLocation::PARAMETER:
11962     case VariableLocation::LOCAL: {
11963       CHECK_ALIVE(VisitForValue(declaration->fun()));
11964       HValue* value = Pop();
11965       BindIfLive(variable, value);
11966       break;
11967     }
11968     case VariableLocation::CONTEXT: {
11969       CHECK_ALIVE(VisitForValue(declaration->fun()));
11970       HValue* value = Pop();
11971       HValue* context = environment()->context();
11972       HStoreContextSlot* store = Add<HStoreContextSlot>(
11973           context, variable->index(), HStoreContextSlot::kNoCheck, value);
11974       if (store->HasObservableSideEffects()) {
11975         Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11976       }
11977       break;
11978     }
11979     case VariableLocation::LOOKUP:
11980       return Bailout(kUnsupportedLookupSlotInDeclaration);
11981   }
11982 }
11983
11984
11985 void HOptimizedGraphBuilder::VisitImportDeclaration(
11986     ImportDeclaration* declaration) {
11987   UNREACHABLE();
11988 }
11989
11990
11991 void HOptimizedGraphBuilder::VisitExportDeclaration(
11992     ExportDeclaration* declaration) {
11993   UNREACHABLE();
11994 }
11995
11996
11997 // Generators for inline runtime functions.
11998 // Support for types.
11999 void HOptimizedGraphBuilder::GenerateIsSmi(CallRuntime* call) {
12000   DCHECK(call->arguments()->length() == 1);
12001   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12002   HValue* value = Pop();
12003   HIsSmiAndBranch* result = New<HIsSmiAndBranch>(value);
12004   return ast_context()->ReturnControl(result, call->id());
12005 }
12006
12007
12008 void HOptimizedGraphBuilder::GenerateIsSpecObject(CallRuntime* call) {
12009   DCHECK(call->arguments()->length() == 1);
12010   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12011   HValue* value = Pop();
12012   HHasInstanceTypeAndBranch* result =
12013       New<HHasInstanceTypeAndBranch>(value,
12014                                      FIRST_SPEC_OBJECT_TYPE,
12015                                      LAST_SPEC_OBJECT_TYPE);
12016   return ast_context()->ReturnControl(result, call->id());
12017 }
12018
12019
12020 void HOptimizedGraphBuilder::GenerateIsFunction(CallRuntime* call) {
12021   DCHECK(call->arguments()->length() == 1);
12022   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12023   HValue* value = Pop();
12024   HHasInstanceTypeAndBranch* result =
12025       New<HHasInstanceTypeAndBranch>(value, JS_FUNCTION_TYPE);
12026   return ast_context()->ReturnControl(result, call->id());
12027 }
12028
12029
12030 void HOptimizedGraphBuilder::GenerateIsMinusZero(CallRuntime* call) {
12031   DCHECK(call->arguments()->length() == 1);
12032   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12033   HValue* value = Pop();
12034   HCompareMinusZeroAndBranch* result = New<HCompareMinusZeroAndBranch>(value);
12035   return ast_context()->ReturnControl(result, call->id());
12036 }
12037
12038
12039 void HOptimizedGraphBuilder::GenerateHasCachedArrayIndex(CallRuntime* call) {
12040   DCHECK(call->arguments()->length() == 1);
12041   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12042   HValue* value = Pop();
12043   HHasCachedArrayIndexAndBranch* result =
12044       New<HHasCachedArrayIndexAndBranch>(value);
12045   return ast_context()->ReturnControl(result, call->id());
12046 }
12047
12048
12049 void HOptimizedGraphBuilder::GenerateIsArray(CallRuntime* call) {
12050   DCHECK(call->arguments()->length() == 1);
12051   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12052   HValue* value = Pop();
12053   HHasInstanceTypeAndBranch* result =
12054       New<HHasInstanceTypeAndBranch>(value, JS_ARRAY_TYPE);
12055   return ast_context()->ReturnControl(result, call->id());
12056 }
12057
12058
12059 void HOptimizedGraphBuilder::GenerateIsTypedArray(CallRuntime* call) {
12060   DCHECK(call->arguments()->length() == 1);
12061   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12062   HValue* value = Pop();
12063   HHasInstanceTypeAndBranch* result =
12064       New<HHasInstanceTypeAndBranch>(value, JS_TYPED_ARRAY_TYPE);
12065   return ast_context()->ReturnControl(result, call->id());
12066 }
12067
12068
12069 void HOptimizedGraphBuilder::GenerateIsRegExp(CallRuntime* call) {
12070   DCHECK(call->arguments()->length() == 1);
12071   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12072   HValue* value = Pop();
12073   HHasInstanceTypeAndBranch* result =
12074       New<HHasInstanceTypeAndBranch>(value, JS_REGEXP_TYPE);
12075   return ast_context()->ReturnControl(result, call->id());
12076 }
12077
12078
12079 void HOptimizedGraphBuilder::GenerateIsObject(CallRuntime* call) {
12080   DCHECK(call->arguments()->length() == 1);
12081   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12082   HValue* value = Pop();
12083   HIsObjectAndBranch* result = New<HIsObjectAndBranch>(value);
12084   return ast_context()->ReturnControl(result, call->id());
12085 }
12086
12087
12088 void HOptimizedGraphBuilder::GenerateToObject(CallRuntime* call) {
12089   DCHECK_EQ(1, call->arguments()->length());
12090   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12091   HValue* value = Pop();
12092   HValue* result = BuildToObject(value);
12093   return ast_context()->ReturnValue(result);
12094 }
12095
12096
12097 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
12098   DCHECK(call->arguments()->length() == 1);
12099   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12100   HValue* value = Pop();
12101   HIfContinuation continuation;
12102   IfBuilder if_proxy(this);
12103
12104   HValue* smicheck = if_proxy.IfNot<HIsSmiAndBranch>(value);
12105   if_proxy.And();
12106   HValue* map = Add<HLoadNamedField>(value, smicheck, HObjectAccess::ForMap());
12107   HValue* instance_type =
12108       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
12109   if_proxy.If<HCompareNumericAndBranch>(
12110       instance_type, Add<HConstant>(FIRST_JS_PROXY_TYPE), Token::GTE);
12111   if_proxy.And();
12112   if_proxy.If<HCompareNumericAndBranch>(
12113       instance_type, Add<HConstant>(LAST_JS_PROXY_TYPE), Token::LTE);
12114
12115   if_proxy.CaptureContinuation(&continuation);
12116   return ast_context()->ReturnContinuation(&continuation, call->id());
12117 }
12118
12119
12120 void HOptimizedGraphBuilder::GenerateHasFastPackedElements(CallRuntime* call) {
12121   DCHECK(call->arguments()->length() == 1);
12122   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12123   HValue* object = Pop();
12124   HIfContinuation continuation(graph()->CreateBasicBlock(),
12125                                graph()->CreateBasicBlock());
12126   IfBuilder if_not_smi(this);
12127   if_not_smi.IfNot<HIsSmiAndBranch>(object);
12128   if_not_smi.Then();
12129   {
12130     NoObservableSideEffectsScope no_effects(this);
12131
12132     IfBuilder if_fast_packed(this);
12133     HValue* elements_kind = BuildGetElementsKind(object);
12134     if_fast_packed.If<HCompareNumericAndBranch>(
12135         elements_kind, Add<HConstant>(FAST_SMI_ELEMENTS), Token::EQ);
12136     if_fast_packed.Or();
12137     if_fast_packed.If<HCompareNumericAndBranch>(
12138         elements_kind, Add<HConstant>(FAST_ELEMENTS), Token::EQ);
12139     if_fast_packed.Or();
12140     if_fast_packed.If<HCompareNumericAndBranch>(
12141         elements_kind, Add<HConstant>(FAST_DOUBLE_ELEMENTS), Token::EQ);
12142     if_fast_packed.JoinContinuation(&continuation);
12143   }
12144   if_not_smi.JoinContinuation(&continuation);
12145   return ast_context()->ReturnContinuation(&continuation, call->id());
12146 }
12147
12148
12149 void HOptimizedGraphBuilder::GenerateIsUndetectableObject(CallRuntime* call) {
12150   DCHECK(call->arguments()->length() == 1);
12151   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12152   HValue* value = Pop();
12153   HIsUndetectableAndBranch* result = New<HIsUndetectableAndBranch>(value);
12154   return ast_context()->ReturnControl(result, call->id());
12155 }
12156
12157
12158 // Support for construct call checks.
12159 void HOptimizedGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
12160   DCHECK(call->arguments()->length() == 0);
12161   if (function_state()->outer() != NULL) {
12162     // We are generating graph for inlined function.
12163     HValue* value = function_state()->inlining_kind() == CONSTRUCT_CALL_RETURN
12164         ? graph()->GetConstantTrue()
12165         : graph()->GetConstantFalse();
12166     return ast_context()->ReturnValue(value);
12167   } else {
12168     return ast_context()->ReturnControl(New<HIsConstructCallAndBranch>(),
12169                                         call->id());
12170   }
12171 }
12172
12173
12174 // Support for arguments.length and arguments[?].
12175 void HOptimizedGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
12176   DCHECK(call->arguments()->length() == 0);
12177   HInstruction* result = NULL;
12178   if (function_state()->outer() == NULL) {
12179     HInstruction* elements = Add<HArgumentsElements>(false);
12180     result = New<HArgumentsLength>(elements);
12181   } else {
12182     // Number of arguments without receiver.
12183     int argument_count = environment()->
12184         arguments_environment()->parameter_count() - 1;
12185     result = New<HConstant>(argument_count);
12186   }
12187   return ast_context()->ReturnInstruction(result, call->id());
12188 }
12189
12190
12191 void HOptimizedGraphBuilder::GenerateArguments(CallRuntime* call) {
12192   DCHECK(call->arguments()->length() == 1);
12193   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12194   HValue* index = Pop();
12195   HInstruction* result = NULL;
12196   if (function_state()->outer() == NULL) {
12197     HInstruction* elements = Add<HArgumentsElements>(false);
12198     HInstruction* length = Add<HArgumentsLength>(elements);
12199     HInstruction* checked_index = Add<HBoundsCheck>(index, length);
12200     result = New<HAccessArgumentsAt>(elements, length, checked_index);
12201   } else {
12202     EnsureArgumentsArePushedForAccess();
12203
12204     // Number of arguments without receiver.
12205     HInstruction* elements = function_state()->arguments_elements();
12206     int argument_count = environment()->
12207         arguments_environment()->parameter_count() - 1;
12208     HInstruction* length = Add<HConstant>(argument_count);
12209     HInstruction* checked_key = Add<HBoundsCheck>(index, length);
12210     result = New<HAccessArgumentsAt>(elements, length, checked_key);
12211   }
12212   return ast_context()->ReturnInstruction(result, call->id());
12213 }
12214
12215
12216 void HOptimizedGraphBuilder::GenerateValueOf(CallRuntime* call) {
12217   DCHECK(call->arguments()->length() == 1);
12218   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12219   HValue* object = Pop();
12220
12221   IfBuilder if_objectisvalue(this);
12222   HValue* objectisvalue = if_objectisvalue.If<HHasInstanceTypeAndBranch>(
12223       object, JS_VALUE_TYPE);
12224   if_objectisvalue.Then();
12225   {
12226     // Return the actual value.
12227     Push(Add<HLoadNamedField>(
12228             object, objectisvalue,
12229             HObjectAccess::ForObservableJSObjectOffset(
12230                 JSValue::kValueOffset)));
12231     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12232   }
12233   if_objectisvalue.Else();
12234   {
12235     // If the object is not a value return the object.
12236     Push(object);
12237     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12238   }
12239   if_objectisvalue.End();
12240   return ast_context()->ReturnValue(Pop());
12241 }
12242
12243
12244 void HOptimizedGraphBuilder::GenerateJSValueGetValue(CallRuntime* call) {
12245   DCHECK(call->arguments()->length() == 1);
12246   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12247   HValue* value = Pop();
12248   HInstruction* result = Add<HLoadNamedField>(
12249       value, nullptr,
12250       HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset));
12251   return ast_context()->ReturnInstruction(result, call->id());
12252 }
12253
12254
12255 void HOptimizedGraphBuilder::GenerateIsDate(CallRuntime* call) {
12256   DCHECK_EQ(1, call->arguments()->length());
12257   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12258   HValue* value = Pop();
12259   HHasInstanceTypeAndBranch* result =
12260       New<HHasInstanceTypeAndBranch>(value, JS_DATE_TYPE);
12261   return ast_context()->ReturnControl(result, call->id());
12262 }
12263
12264
12265 void HOptimizedGraphBuilder::GenerateThrowNotDateError(CallRuntime* call) {
12266   DCHECK_EQ(0, call->arguments()->length());
12267   Add<HDeoptimize>(Deoptimizer::kNotADateObject, Deoptimizer::EAGER);
12268   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12269   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12270 }
12271
12272
12273 void HOptimizedGraphBuilder::GenerateDateField(CallRuntime* call) {
12274   DCHECK(call->arguments()->length() == 2);
12275   DCHECK_NOT_NULL(call->arguments()->at(1)->AsLiteral());
12276   Smi* index = Smi::cast(*(call->arguments()->at(1)->AsLiteral()->value()));
12277   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12278   HValue* date = Pop();
12279   HDateField* result = New<HDateField>(date, index);
12280   return ast_context()->ReturnInstruction(result, call->id());
12281 }
12282
12283
12284 void HOptimizedGraphBuilder::GenerateOneByteSeqStringSetChar(
12285     CallRuntime* call) {
12286   DCHECK(call->arguments()->length() == 3);
12287   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12288   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12289   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12290   HValue* string = Pop();
12291   HValue* value = Pop();
12292   HValue* index = Pop();
12293   Add<HSeqStringSetChar>(String::ONE_BYTE_ENCODING, string,
12294                          index, value);
12295   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12296   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12297 }
12298
12299
12300 void HOptimizedGraphBuilder::GenerateTwoByteSeqStringSetChar(
12301     CallRuntime* call) {
12302   DCHECK(call->arguments()->length() == 3);
12303   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12304   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12305   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12306   HValue* string = Pop();
12307   HValue* value = Pop();
12308   HValue* index = Pop();
12309   Add<HSeqStringSetChar>(String::TWO_BYTE_ENCODING, string,
12310                          index, value);
12311   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12312   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12313 }
12314
12315
12316 void HOptimizedGraphBuilder::GenerateSetValueOf(CallRuntime* call) {
12317   DCHECK(call->arguments()->length() == 2);
12318   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12319   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12320   HValue* value = Pop();
12321   HValue* object = Pop();
12322
12323   // Check if object is a JSValue.
12324   IfBuilder if_objectisvalue(this);
12325   if_objectisvalue.If<HHasInstanceTypeAndBranch>(object, JS_VALUE_TYPE);
12326   if_objectisvalue.Then();
12327   {
12328     // Create in-object property store to kValueOffset.
12329     Add<HStoreNamedField>(object,
12330         HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset),
12331         value);
12332     if (!ast_context()->IsEffect()) {
12333       Push(value);
12334     }
12335     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12336   }
12337   if_objectisvalue.Else();
12338   {
12339     // Nothing to do in this case.
12340     if (!ast_context()->IsEffect()) {
12341       Push(value);
12342     }
12343     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12344   }
12345   if_objectisvalue.End();
12346   if (!ast_context()->IsEffect()) {
12347     Drop(1);
12348   }
12349   return ast_context()->ReturnValue(value);
12350 }
12351
12352
12353 // Fast support for charCodeAt(n).
12354 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
12355   DCHECK(call->arguments()->length() == 2);
12356   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12357   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12358   HValue* index = Pop();
12359   HValue* string = Pop();
12360   HInstruction* result = BuildStringCharCodeAt(string, index);
12361   return ast_context()->ReturnInstruction(result, call->id());
12362 }
12363
12364
12365 // Fast support for string.charAt(n) and string[n].
12366 void HOptimizedGraphBuilder::GenerateStringCharFromCode(CallRuntime* call) {
12367   DCHECK(call->arguments()->length() == 1);
12368   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12369   HValue* char_code = Pop();
12370   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12371   return ast_context()->ReturnInstruction(result, call->id());
12372 }
12373
12374
12375 // Fast support for string.charAt(n) and string[n].
12376 void HOptimizedGraphBuilder::GenerateStringCharAt(CallRuntime* call) {
12377   DCHECK(call->arguments()->length() == 2);
12378   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12379   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12380   HValue* index = Pop();
12381   HValue* string = Pop();
12382   HInstruction* char_code = BuildStringCharCodeAt(string, index);
12383   AddInstruction(char_code);
12384   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12385   return ast_context()->ReturnInstruction(result, call->id());
12386 }
12387
12388
12389 // Fast support for object equality testing.
12390 void HOptimizedGraphBuilder::GenerateObjectEquals(CallRuntime* call) {
12391   DCHECK(call->arguments()->length() == 2);
12392   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12393   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12394   HValue* right = Pop();
12395   HValue* left = Pop();
12396   HCompareObjectEqAndBranch* result =
12397       New<HCompareObjectEqAndBranch>(left, right);
12398   return ast_context()->ReturnControl(result, call->id());
12399 }
12400
12401
12402 // Fast support for StringAdd.
12403 void HOptimizedGraphBuilder::GenerateStringAdd(CallRuntime* call) {
12404   DCHECK_EQ(2, call->arguments()->length());
12405   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12406   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12407   HValue* right = Pop();
12408   HValue* left = Pop();
12409   HInstruction* result =
12410       NewUncasted<HStringAdd>(left, right, strength(function_language_mode()));
12411   return ast_context()->ReturnInstruction(result, call->id());
12412 }
12413
12414
12415 // Fast support for SubString.
12416 void HOptimizedGraphBuilder::GenerateSubString(CallRuntime* call) {
12417   DCHECK_EQ(3, call->arguments()->length());
12418   CHECK_ALIVE(VisitExpressions(call->arguments()));
12419   PushArgumentsFromEnvironment(call->arguments()->length());
12420   HCallStub* result = New<HCallStub>(CodeStub::SubString, 3);
12421   return ast_context()->ReturnInstruction(result, call->id());
12422 }
12423
12424
12425 // Fast support for StringCompare.
12426 void HOptimizedGraphBuilder::GenerateStringCompare(CallRuntime* call) {
12427   DCHECK_EQ(2, call->arguments()->length());
12428   CHECK_ALIVE(VisitExpressions(call->arguments()));
12429   PushArgumentsFromEnvironment(call->arguments()->length());
12430   HCallStub* result = New<HCallStub>(CodeStub::StringCompare, 2);
12431   return ast_context()->ReturnInstruction(result, call->id());
12432 }
12433
12434
12435 void HOptimizedGraphBuilder::GenerateStringGetLength(CallRuntime* call) {
12436   DCHECK(call->arguments()->length() == 1);
12437   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12438   HValue* string = Pop();
12439   HInstruction* result = BuildLoadStringLength(string);
12440   return ast_context()->ReturnInstruction(result, call->id());
12441 }
12442
12443
12444 // Support for direct calls from JavaScript to native RegExp code.
12445 void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
12446   DCHECK_EQ(4, call->arguments()->length());
12447   CHECK_ALIVE(VisitExpressions(call->arguments()));
12448   PushArgumentsFromEnvironment(call->arguments()->length());
12449   HCallStub* result = New<HCallStub>(CodeStub::RegExpExec, 4);
12450   return ast_context()->ReturnInstruction(result, call->id());
12451 }
12452
12453
12454 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
12455   DCHECK_EQ(1, call->arguments()->length());
12456   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12457   HValue* value = Pop();
12458   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::LOW);
12459   return ast_context()->ReturnInstruction(result, call->id());
12460 }
12461
12462
12463 void HOptimizedGraphBuilder::GenerateDoubleHi(CallRuntime* call) {
12464   DCHECK_EQ(1, call->arguments()->length());
12465   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12466   HValue* value = Pop();
12467   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::HIGH);
12468   return ast_context()->ReturnInstruction(result, call->id());
12469 }
12470
12471
12472 void HOptimizedGraphBuilder::GenerateConstructDouble(CallRuntime* call) {
12473   DCHECK_EQ(2, call->arguments()->length());
12474   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12475   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12476   HValue* lo = Pop();
12477   HValue* hi = Pop();
12478   HInstruction* result = NewUncasted<HConstructDouble>(hi, lo);
12479   return ast_context()->ReturnInstruction(result, call->id());
12480 }
12481
12482
12483 // Construct a RegExp exec result with two in-object properties.
12484 void HOptimizedGraphBuilder::GenerateRegExpConstructResult(CallRuntime* call) {
12485   DCHECK_EQ(3, call->arguments()->length());
12486   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12487   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12488   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12489   HValue* input = Pop();
12490   HValue* index = Pop();
12491   HValue* length = Pop();
12492   HValue* result = BuildRegExpConstructResult(length, index, input);
12493   return ast_context()->ReturnValue(result);
12494 }
12495
12496
12497 // Fast support for number to string.
12498 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
12499   DCHECK_EQ(1, call->arguments()->length());
12500   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12501   HValue* number = Pop();
12502   HValue* result = BuildNumberToString(number, Type::Any(zone()));
12503   return ast_context()->ReturnValue(result);
12504 }
12505
12506
12507 // Fast call for custom callbacks.
12508 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
12509   // 1 ~ The function to call is not itself an argument to the call.
12510   int arg_count = call->arguments()->length() - 1;
12511   DCHECK(arg_count >= 1);  // There's always at least a receiver.
12512
12513   CHECK_ALIVE(VisitExpressions(call->arguments()));
12514   // The function is the last argument
12515   HValue* function = Pop();
12516   // Push the arguments to the stack
12517   PushArgumentsFromEnvironment(arg_count);
12518
12519   IfBuilder if_is_jsfunction(this);
12520   if_is_jsfunction.If<HHasInstanceTypeAndBranch>(function, JS_FUNCTION_TYPE);
12521
12522   if_is_jsfunction.Then();
12523   {
12524     HInstruction* invoke_result =
12525         Add<HInvokeFunction>(function, arg_count);
12526     if (!ast_context()->IsEffect()) {
12527       Push(invoke_result);
12528     }
12529     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12530   }
12531
12532   if_is_jsfunction.Else();
12533   {
12534     HInstruction* call_result =
12535         Add<HCallFunction>(function, arg_count);
12536     if (!ast_context()->IsEffect()) {
12537       Push(call_result);
12538     }
12539     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12540   }
12541   if_is_jsfunction.End();
12542
12543   if (ast_context()->IsEffect()) {
12544     // EffectContext::ReturnValue ignores the value, so we can just pass
12545     // 'undefined' (as we do not have the call result anymore).
12546     return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12547   } else {
12548     return ast_context()->ReturnValue(Pop());
12549   }
12550 }
12551
12552
12553 // Fast call to math functions.
12554 void HOptimizedGraphBuilder::GenerateMathPow(CallRuntime* call) {
12555   DCHECK_EQ(2, call->arguments()->length());
12556   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12557   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12558   HValue* right = Pop();
12559   HValue* left = Pop();
12560   HInstruction* result = NewUncasted<HPower>(left, right);
12561   return ast_context()->ReturnInstruction(result, call->id());
12562 }
12563
12564
12565 void HOptimizedGraphBuilder::GenerateMathClz32(CallRuntime* call) {
12566   DCHECK(call->arguments()->length() == 1);
12567   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12568   HValue* value = Pop();
12569   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathClz32);
12570   return ast_context()->ReturnInstruction(result, call->id());
12571 }
12572
12573
12574 void HOptimizedGraphBuilder::GenerateMathFloor(CallRuntime* call) {
12575   DCHECK(call->arguments()->length() == 1);
12576   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12577   HValue* value = Pop();
12578   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathFloor);
12579   return ast_context()->ReturnInstruction(result, call->id());
12580 }
12581
12582
12583 void HOptimizedGraphBuilder::GenerateMathLogRT(CallRuntime* call) {
12584   DCHECK(call->arguments()->length() == 1);
12585   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12586   HValue* value = Pop();
12587   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathLog);
12588   return ast_context()->ReturnInstruction(result, call->id());
12589 }
12590
12591
12592 void HOptimizedGraphBuilder::GenerateMathSqrt(CallRuntime* call) {
12593   DCHECK(call->arguments()->length() == 1);
12594   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12595   HValue* value = Pop();
12596   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathSqrt);
12597   return ast_context()->ReturnInstruction(result, call->id());
12598 }
12599
12600
12601 void HOptimizedGraphBuilder::GenerateLikely(CallRuntime* call) {
12602   DCHECK(call->arguments()->length() == 1);
12603   Visit(call->arguments()->at(0));
12604 }
12605
12606
12607 void HOptimizedGraphBuilder::GenerateUnlikely(CallRuntime* call) {
12608   return GenerateLikely(call);
12609 }
12610
12611
12612 void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
12613   DCHECK(call->arguments()->length() == 2);
12614   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12615   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12616   HValue* index = Pop();
12617   HValue* object = Pop();
12618   HInstruction* result = New<HLoadKeyed>(
12619       object, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
12620   return ast_context()->ReturnInstruction(result, call->id());
12621 }
12622
12623
12624 void HOptimizedGraphBuilder::GenerateFixedArraySet(CallRuntime* call) {
12625   DCHECK(call->arguments()->length() == 3);
12626   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12627   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12628   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12629   HValue* value = Pop();
12630   HValue* index = Pop();
12631   HValue* object = Pop();
12632   NoObservableSideEffectsScope no_effects(this);
12633   Add<HStoreKeyed>(object, index, value, FAST_HOLEY_ELEMENTS);
12634   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12635 }
12636
12637
12638 void HOptimizedGraphBuilder::GenerateTheHole(CallRuntime* call) {
12639   DCHECK(call->arguments()->length() == 0);
12640   return ast_context()->ReturnValue(graph()->GetConstantHole());
12641 }
12642
12643
12644 void HOptimizedGraphBuilder::GenerateJSCollectionGetTable(CallRuntime* call) {
12645   DCHECK(call->arguments()->length() == 1);
12646   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12647   HValue* receiver = Pop();
12648   HInstruction* result = New<HLoadNamedField>(
12649       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12650   return ast_context()->ReturnInstruction(result, call->id());
12651 }
12652
12653
12654 void HOptimizedGraphBuilder::GenerateStringGetRawHashField(CallRuntime* call) {
12655   DCHECK(call->arguments()->length() == 1);
12656   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12657   HValue* object = Pop();
12658   HInstruction* result = New<HLoadNamedField>(
12659       object, nullptr, HObjectAccess::ForStringHashField());
12660   return ast_context()->ReturnInstruction(result, call->id());
12661 }
12662
12663
12664 template <typename CollectionType>
12665 HValue* HOptimizedGraphBuilder::BuildAllocateOrderedHashTable() {
12666   static const int kCapacity = CollectionType::kMinCapacity;
12667   static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
12668   static const int kFixedArrayLength = CollectionType::kHashTableStartIndex +
12669                                        kBucketCount +
12670                                        (kCapacity * CollectionType::kEntrySize);
12671   static const int kSizeInBytes =
12672       FixedArray::kHeaderSize + (kFixedArrayLength * kPointerSize);
12673
12674   // Allocate the table and add the proper map.
12675   HValue* table =
12676       Add<HAllocate>(Add<HConstant>(kSizeInBytes), HType::HeapObject(),
12677                      NOT_TENURED, FIXED_ARRAY_TYPE);
12678   AddStoreMapConstant(table, isolate()->factory()->ordered_hash_table_map());
12679
12680   // Initialize the FixedArray...
12681   HValue* length = Add<HConstant>(kFixedArrayLength);
12682   Add<HStoreNamedField>(table, HObjectAccess::ForFixedArrayLength(), length);
12683
12684   // ...and the OrderedHashTable fields.
12685   Add<HStoreNamedField>(
12686       table,
12687       HObjectAccess::ForOrderedHashTableNumberOfBuckets<CollectionType>(),
12688       Add<HConstant>(kBucketCount));
12689   Add<HStoreNamedField>(
12690       table,
12691       HObjectAccess::ForOrderedHashTableNumberOfElements<CollectionType>(),
12692       graph()->GetConstant0());
12693   Add<HStoreNamedField>(
12694       table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12695                  CollectionType>(),
12696       graph()->GetConstant0());
12697
12698   // Fill the buckets with kNotFound.
12699   HValue* not_found = Add<HConstant>(CollectionType::kNotFound);
12700   for (int i = 0; i < kBucketCount; ++i) {
12701     Add<HStoreNamedField>(
12702         table, HObjectAccess::ForOrderedHashTableBucket<CollectionType>(i),
12703         not_found);
12704   }
12705
12706   // Fill the data table with undefined.
12707   HValue* undefined = graph()->GetConstantUndefined();
12708   for (int i = 0; i < (kCapacity * CollectionType::kEntrySize); ++i) {
12709     Add<HStoreNamedField>(table,
12710                           HObjectAccess::ForOrderedHashTableDataTableIndex<
12711                               CollectionType, kBucketCount>(i),
12712                           undefined);
12713   }
12714
12715   return table;
12716 }
12717
12718
12719 void HOptimizedGraphBuilder::GenerateSetInitialize(CallRuntime* call) {
12720   DCHECK(call->arguments()->length() == 1);
12721   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12722   HValue* receiver = Pop();
12723
12724   NoObservableSideEffectsScope no_effects(this);
12725   HValue* table = BuildAllocateOrderedHashTable<OrderedHashSet>();
12726   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12727   return ast_context()->ReturnValue(receiver);
12728 }
12729
12730
12731 void HOptimizedGraphBuilder::GenerateMapInitialize(CallRuntime* call) {
12732   DCHECK(call->arguments()->length() == 1);
12733   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12734   HValue* receiver = Pop();
12735
12736   NoObservableSideEffectsScope no_effects(this);
12737   HValue* table = BuildAllocateOrderedHashTable<OrderedHashMap>();
12738   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12739   return ast_context()->ReturnValue(receiver);
12740 }
12741
12742
12743 template <typename CollectionType>
12744 void HOptimizedGraphBuilder::BuildOrderedHashTableClear(HValue* receiver) {
12745   HValue* old_table = Add<HLoadNamedField>(
12746       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12747   HValue* new_table = BuildAllocateOrderedHashTable<CollectionType>();
12748   Add<HStoreNamedField>(
12749       old_table, HObjectAccess::ForOrderedHashTableNextTable<CollectionType>(),
12750       new_table);
12751   Add<HStoreNamedField>(
12752       old_table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12753                      CollectionType>(),
12754       Add<HConstant>(CollectionType::kClearedTableSentinel));
12755   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(),
12756                         new_table);
12757 }
12758
12759
12760 void HOptimizedGraphBuilder::GenerateSetClear(CallRuntime* call) {
12761   DCHECK(call->arguments()->length() == 1);
12762   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12763   HValue* receiver = Pop();
12764
12765   NoObservableSideEffectsScope no_effects(this);
12766   BuildOrderedHashTableClear<OrderedHashSet>(receiver);
12767   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12768 }
12769
12770
12771 void HOptimizedGraphBuilder::GenerateMapClear(CallRuntime* call) {
12772   DCHECK(call->arguments()->length() == 1);
12773   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12774   HValue* receiver = Pop();
12775
12776   NoObservableSideEffectsScope no_effects(this);
12777   BuildOrderedHashTableClear<OrderedHashMap>(receiver);
12778   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12779 }
12780
12781
12782 void HOptimizedGraphBuilder::GenerateGetCachedArrayIndex(CallRuntime* call) {
12783   DCHECK(call->arguments()->length() == 1);
12784   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12785   HValue* value = Pop();
12786   HGetCachedArrayIndex* result = New<HGetCachedArrayIndex>(value);
12787   return ast_context()->ReturnInstruction(result, call->id());
12788 }
12789
12790
12791 void HOptimizedGraphBuilder::GenerateFastOneByteArrayJoin(CallRuntime* call) {
12792   // Simply returning undefined here would be semantically correct and even
12793   // avoid the bailout. Nevertheless, some ancient benchmarks like SunSpider's
12794   // string-fasta would tank, because fullcode contains an optimized version.
12795   // Obviously the fullcode => Crankshaft => bailout => fullcode dance is
12796   // faster... *sigh*
12797   return Bailout(kInlinedRuntimeFunctionFastOneByteArrayJoin);
12798 }
12799
12800
12801 void HOptimizedGraphBuilder::GenerateDebugBreakInOptimizedCode(
12802     CallRuntime* call) {
12803   Add<HDebugBreak>();
12804   return ast_context()->ReturnValue(graph()->GetConstant0());
12805 }
12806
12807
12808 void HOptimizedGraphBuilder::GenerateDebugIsActive(CallRuntime* call) {
12809   DCHECK(call->arguments()->length() == 0);
12810   HValue* ref =
12811       Add<HConstant>(ExternalReference::debug_is_active_address(isolate()));
12812   HValue* value =
12813       Add<HLoadNamedField>(ref, nullptr, HObjectAccess::ForExternalUInteger8());
12814   return ast_context()->ReturnValue(value);
12815 }
12816
12817
12818 void HOptimizedGraphBuilder::GenerateGetPrototype(CallRuntime* call) {
12819   DCHECK(call->arguments()->length() == 1);
12820   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12821   HValue* object = Pop();
12822
12823   NoObservableSideEffectsScope no_effects(this);
12824
12825   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
12826   HValue* bit_field =
12827       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField());
12828   HValue* is_access_check_needed_mask =
12829       Add<HConstant>(1 << Map::kIsAccessCheckNeeded);
12830   HValue* is_access_check_needed_test = AddUncasted<HBitwise>(
12831       Token::BIT_AND, bit_field, is_access_check_needed_mask);
12832
12833   HValue* proto =
12834       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForPrototype());
12835   HValue* proto_map =
12836       Add<HLoadNamedField>(proto, nullptr, HObjectAccess::ForMap());
12837   HValue* proto_bit_field =
12838       Add<HLoadNamedField>(proto_map, nullptr, HObjectAccess::ForMapBitField());
12839   HValue* is_hidden_prototype_mask =
12840       Add<HConstant>(1 << Map::kIsHiddenPrototype);
12841   HValue* is_hidden_prototype_test = AddUncasted<HBitwise>(
12842       Token::BIT_AND, proto_bit_field, is_hidden_prototype_mask);
12843
12844   {
12845     IfBuilder needs_runtime(this);
12846     needs_runtime.If<HCompareNumericAndBranch>(
12847         is_access_check_needed_test, graph()->GetConstant0(), Token::NE);
12848     needs_runtime.OrIf<HCompareNumericAndBranch>(
12849         is_hidden_prototype_test, graph()->GetConstant0(), Token::NE);
12850
12851     needs_runtime.Then();
12852     {
12853       Add<HPushArguments>(object);
12854       Push(Add<HCallRuntime>(
12855           call->name(), Runtime::FunctionForId(Runtime::kGetPrototype), 1));
12856     }
12857
12858     needs_runtime.Else();
12859     Push(proto);
12860   }
12861   return ast_context()->ReturnValue(Pop());
12862 }
12863
12864
12865 #undef CHECK_BAILOUT
12866 #undef CHECK_ALIVE
12867
12868
12869 HEnvironment::HEnvironment(HEnvironment* outer,
12870                            Scope* scope,
12871                            Handle<JSFunction> closure,
12872                            Zone* zone)
12873     : closure_(closure),
12874       values_(0, zone),
12875       frame_type_(JS_FUNCTION),
12876       parameter_count_(0),
12877       specials_count_(1),
12878       local_count_(0),
12879       outer_(outer),
12880       entry_(NULL),
12881       pop_count_(0),
12882       push_count_(0),
12883       ast_id_(BailoutId::None()),
12884       zone_(zone) {
12885   Scope* declaration_scope = scope->DeclarationScope();
12886   Initialize(declaration_scope->num_parameters() + 1,
12887              declaration_scope->num_stack_slots(), 0);
12888 }
12889
12890
12891 HEnvironment::HEnvironment(Zone* zone, int parameter_count)
12892     : values_(0, zone),
12893       frame_type_(STUB),
12894       parameter_count_(parameter_count),
12895       specials_count_(1),
12896       local_count_(0),
12897       outer_(NULL),
12898       entry_(NULL),
12899       pop_count_(0),
12900       push_count_(0),
12901       ast_id_(BailoutId::None()),
12902       zone_(zone) {
12903   Initialize(parameter_count, 0, 0);
12904 }
12905
12906
12907 HEnvironment::HEnvironment(const HEnvironment* other, Zone* zone)
12908     : values_(0, zone),
12909       frame_type_(JS_FUNCTION),
12910       parameter_count_(0),
12911       specials_count_(0),
12912       local_count_(0),
12913       outer_(NULL),
12914       entry_(NULL),
12915       pop_count_(0),
12916       push_count_(0),
12917       ast_id_(other->ast_id()),
12918       zone_(zone) {
12919   Initialize(other);
12920 }
12921
12922
12923 HEnvironment::HEnvironment(HEnvironment* outer,
12924                            Handle<JSFunction> closure,
12925                            FrameType frame_type,
12926                            int arguments,
12927                            Zone* zone)
12928     : closure_(closure),
12929       values_(arguments, zone),
12930       frame_type_(frame_type),
12931       parameter_count_(arguments),
12932       specials_count_(0),
12933       local_count_(0),
12934       outer_(outer),
12935       entry_(NULL),
12936       pop_count_(0),
12937       push_count_(0),
12938       ast_id_(BailoutId::None()),
12939       zone_(zone) {
12940 }
12941
12942
12943 void HEnvironment::Initialize(int parameter_count,
12944                               int local_count,
12945                               int stack_height) {
12946   parameter_count_ = parameter_count;
12947   local_count_ = local_count;
12948
12949   // Avoid reallocating the temporaries' backing store on the first Push.
12950   int total = parameter_count + specials_count_ + local_count + stack_height;
12951   values_.Initialize(total + 4, zone());
12952   for (int i = 0; i < total; ++i) values_.Add(NULL, zone());
12953 }
12954
12955
12956 void HEnvironment::Initialize(const HEnvironment* other) {
12957   closure_ = other->closure();
12958   values_.AddAll(other->values_, zone());
12959   assigned_variables_.Union(other->assigned_variables_, zone());
12960   frame_type_ = other->frame_type_;
12961   parameter_count_ = other->parameter_count_;
12962   local_count_ = other->local_count_;
12963   if (other->outer_ != NULL) outer_ = other->outer_->Copy();  // Deep copy.
12964   entry_ = other->entry_;
12965   pop_count_ = other->pop_count_;
12966   push_count_ = other->push_count_;
12967   specials_count_ = other->specials_count_;
12968   ast_id_ = other->ast_id_;
12969 }
12970
12971
12972 void HEnvironment::AddIncomingEdge(HBasicBlock* block, HEnvironment* other) {
12973   DCHECK(!block->IsLoopHeader());
12974   DCHECK(values_.length() == other->values_.length());
12975
12976   int length = values_.length();
12977   for (int i = 0; i < length; ++i) {
12978     HValue* value = values_[i];
12979     if (value != NULL && value->IsPhi() && value->block() == block) {
12980       // There is already a phi for the i'th value.
12981       HPhi* phi = HPhi::cast(value);
12982       // Assert index is correct and that we haven't missed an incoming edge.
12983       DCHECK(phi->merged_index() == i || !phi->HasMergedIndex());
12984       DCHECK(phi->OperandCount() == block->predecessors()->length());
12985       phi->AddInput(other->values_[i]);
12986     } else if (values_[i] != other->values_[i]) {
12987       // There is a fresh value on the incoming edge, a phi is needed.
12988       DCHECK(values_[i] != NULL && other->values_[i] != NULL);
12989       HPhi* phi = block->AddNewPhi(i);
12990       HValue* old_value = values_[i];
12991       for (int j = 0; j < block->predecessors()->length(); j++) {
12992         phi->AddInput(old_value);
12993       }
12994       phi->AddInput(other->values_[i]);
12995       this->values_[i] = phi;
12996     }
12997   }
12998 }
12999
13000
13001 void HEnvironment::Bind(int index, HValue* value) {
13002   DCHECK(value != NULL);
13003   assigned_variables_.Add(index, zone());
13004   values_[index] = value;
13005 }
13006
13007
13008 bool HEnvironment::HasExpressionAt(int index) const {
13009   return index >= parameter_count_ + specials_count_ + local_count_;
13010 }
13011
13012
13013 bool HEnvironment::ExpressionStackIsEmpty() const {
13014   DCHECK(length() >= first_expression_index());
13015   return length() == first_expression_index();
13016 }
13017
13018
13019 void HEnvironment::SetExpressionStackAt(int index_from_top, HValue* value) {
13020   int count = index_from_top + 1;
13021   int index = values_.length() - count;
13022   DCHECK(HasExpressionAt(index));
13023   // The push count must include at least the element in question or else
13024   // the new value will not be included in this environment's history.
13025   if (push_count_ < count) {
13026     // This is the same effect as popping then re-pushing 'count' elements.
13027     pop_count_ += (count - push_count_);
13028     push_count_ = count;
13029   }
13030   values_[index] = value;
13031 }
13032
13033
13034 HValue* HEnvironment::RemoveExpressionStackAt(int index_from_top) {
13035   int count = index_from_top + 1;
13036   int index = values_.length() - count;
13037   DCHECK(HasExpressionAt(index));
13038   // Simulate popping 'count' elements and then
13039   // pushing 'count - 1' elements back.
13040   pop_count_ += Max(count - push_count_, 0);
13041   push_count_ = Max(push_count_ - count, 0) + (count - 1);
13042   return values_.Remove(index);
13043 }
13044
13045
13046 void HEnvironment::Drop(int count) {
13047   for (int i = 0; i < count; ++i) {
13048     Pop();
13049   }
13050 }
13051
13052
13053 HEnvironment* HEnvironment::Copy() const {
13054   return new(zone()) HEnvironment(this, zone());
13055 }
13056
13057
13058 HEnvironment* HEnvironment::CopyWithoutHistory() const {
13059   HEnvironment* result = Copy();
13060   result->ClearHistory();
13061   return result;
13062 }
13063
13064
13065 HEnvironment* HEnvironment::CopyAsLoopHeader(HBasicBlock* loop_header) const {
13066   HEnvironment* new_env = Copy();
13067   for (int i = 0; i < values_.length(); ++i) {
13068     HPhi* phi = loop_header->AddNewPhi(i);
13069     phi->AddInput(values_[i]);
13070     new_env->values_[i] = phi;
13071   }
13072   new_env->ClearHistory();
13073   return new_env;
13074 }
13075
13076
13077 HEnvironment* HEnvironment::CreateStubEnvironment(HEnvironment* outer,
13078                                                   Handle<JSFunction> target,
13079                                                   FrameType frame_type,
13080                                                   int arguments) const {
13081   HEnvironment* new_env =
13082       new(zone()) HEnvironment(outer, target, frame_type,
13083                                arguments + 1, zone());
13084   for (int i = 0; i <= arguments; ++i) {  // Include receiver.
13085     new_env->Push(ExpressionStackAt(arguments - i));
13086   }
13087   new_env->ClearHistory();
13088   return new_env;
13089 }
13090
13091
13092 HEnvironment* HEnvironment::CopyForInlining(
13093     Handle<JSFunction> target,
13094     int arguments,
13095     FunctionLiteral* function,
13096     HConstant* undefined,
13097     InliningKind inlining_kind) const {
13098   DCHECK(frame_type() == JS_FUNCTION);
13099
13100   // Outer environment is a copy of this one without the arguments.
13101   int arity = function->scope()->num_parameters();
13102
13103   HEnvironment* outer = Copy();
13104   outer->Drop(arguments + 1);  // Including receiver.
13105   outer->ClearHistory();
13106
13107   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
13108     // Create artificial constructor stub environment.  The receiver should
13109     // actually be the constructor function, but we pass the newly allocated
13110     // object instead, DoComputeConstructStubFrame() relies on that.
13111     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
13112   } else if (inlining_kind == GETTER_CALL_RETURN) {
13113     // We need an additional StackFrame::INTERNAL frame for restoring the
13114     // correct context.
13115     outer = CreateStubEnvironment(outer, target, JS_GETTER, arguments);
13116   } else if (inlining_kind == SETTER_CALL_RETURN) {
13117     // We need an additional StackFrame::INTERNAL frame for temporarily saving
13118     // the argument of the setter, see StoreStubCompiler::CompileStoreViaSetter.
13119     outer = CreateStubEnvironment(outer, target, JS_SETTER, arguments);
13120   }
13121
13122   if (arity != arguments) {
13123     // Create artificial arguments adaptation environment.
13124     outer = CreateStubEnvironment(outer, target, ARGUMENTS_ADAPTOR, arguments);
13125   }
13126
13127   HEnvironment* inner =
13128       new(zone()) HEnvironment(outer, function->scope(), target, zone());
13129   // Get the argument values from the original environment.
13130   for (int i = 0; i <= arity; ++i) {  // Include receiver.
13131     HValue* push = (i <= arguments) ?
13132         ExpressionStackAt(arguments - i) : undefined;
13133     inner->SetValueAt(i, push);
13134   }
13135   inner->SetValueAt(arity + 1, context());
13136   for (int i = arity + 2; i < inner->length(); ++i) {
13137     inner->SetValueAt(i, undefined);
13138   }
13139
13140   inner->set_ast_id(BailoutId::FunctionEntry());
13141   return inner;
13142 }
13143
13144
13145 std::ostream& operator<<(std::ostream& os, const HEnvironment& env) {
13146   for (int i = 0; i < env.length(); i++) {
13147     if (i == 0) os << "parameters\n";
13148     if (i == env.parameter_count()) os << "specials\n";
13149     if (i == env.parameter_count() + env.specials_count()) os << "locals\n";
13150     if (i == env.parameter_count() + env.specials_count() + env.local_count()) {
13151       os << "expressions\n";
13152     }
13153     HValue* val = env.values()->at(i);
13154     os << i << ": ";
13155     if (val != NULL) {
13156       os << val;
13157     } else {
13158       os << "NULL";
13159     }
13160     os << "\n";
13161   }
13162   return os << "\n";
13163 }
13164
13165
13166 void HTracer::TraceCompilation(CompilationInfo* info) {
13167   Tag tag(this, "compilation");
13168   if (info->IsOptimizing()) {
13169     Handle<String> name = info->function()->debug_name();
13170     PrintStringProperty("name", name->ToCString().get());
13171     PrintIndent();
13172     trace_.Add("method \"%s:%d\"\n",
13173                name->ToCString().get(),
13174                info->optimization_id());
13175   } else {
13176     CodeStub::Major major_key = info->code_stub()->MajorKey();
13177     PrintStringProperty("name", CodeStub::MajorName(major_key, false));
13178     PrintStringProperty("method", "stub");
13179   }
13180   PrintLongProperty("date",
13181                     static_cast<int64_t>(base::OS::TimeCurrentMillis()));
13182 }
13183
13184
13185 void HTracer::TraceLithium(const char* name, LChunk* chunk) {
13186   DCHECK(!chunk->isolate()->concurrent_recompilation_enabled());
13187   AllowHandleDereference allow_deref;
13188   AllowDeferredHandleDereference allow_deferred_deref;
13189   Trace(name, chunk->graph(), chunk);
13190 }
13191
13192
13193 void HTracer::TraceHydrogen(const char* name, HGraph* graph) {
13194   DCHECK(!graph->isolate()->concurrent_recompilation_enabled());
13195   AllowHandleDereference allow_deref;
13196   AllowDeferredHandleDereference allow_deferred_deref;
13197   Trace(name, graph, NULL);
13198 }
13199
13200
13201 void HTracer::Trace(const char* name, HGraph* graph, LChunk* chunk) {
13202   Tag tag(this, "cfg");
13203   PrintStringProperty("name", name);
13204   const ZoneList<HBasicBlock*>* blocks = graph->blocks();
13205   for (int i = 0; i < blocks->length(); i++) {
13206     HBasicBlock* current = blocks->at(i);
13207     Tag block_tag(this, "block");
13208     PrintBlockProperty("name", current->block_id());
13209     PrintIntProperty("from_bci", -1);
13210     PrintIntProperty("to_bci", -1);
13211
13212     if (!current->predecessors()->is_empty()) {
13213       PrintIndent();
13214       trace_.Add("predecessors");
13215       for (int j = 0; j < current->predecessors()->length(); ++j) {
13216         trace_.Add(" \"B%d\"", current->predecessors()->at(j)->block_id());
13217       }
13218       trace_.Add("\n");
13219     } else {
13220       PrintEmptyProperty("predecessors");
13221     }
13222
13223     if (current->end()->SuccessorCount() == 0) {
13224       PrintEmptyProperty("successors");
13225     } else  {
13226       PrintIndent();
13227       trace_.Add("successors");
13228       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
13229         trace_.Add(" \"B%d\"", it.Current()->block_id());
13230       }
13231       trace_.Add("\n");
13232     }
13233
13234     PrintEmptyProperty("xhandlers");
13235
13236     {
13237       PrintIndent();
13238       trace_.Add("flags");
13239       if (current->IsLoopSuccessorDominator()) {
13240         trace_.Add(" \"dom-loop-succ\"");
13241       }
13242       if (current->IsUnreachable()) {
13243         trace_.Add(" \"dead\"");
13244       }
13245       if (current->is_osr_entry()) {
13246         trace_.Add(" \"osr\"");
13247       }
13248       trace_.Add("\n");
13249     }
13250
13251     if (current->dominator() != NULL) {
13252       PrintBlockProperty("dominator", current->dominator()->block_id());
13253     }
13254
13255     PrintIntProperty("loop_depth", current->LoopNestingDepth());
13256
13257     if (chunk != NULL) {
13258       int first_index = current->first_instruction_index();
13259       int last_index = current->last_instruction_index();
13260       PrintIntProperty(
13261           "first_lir_id",
13262           LifetimePosition::FromInstructionIndex(first_index).Value());
13263       PrintIntProperty(
13264           "last_lir_id",
13265           LifetimePosition::FromInstructionIndex(last_index).Value());
13266     }
13267
13268     {
13269       Tag states_tag(this, "states");
13270       Tag locals_tag(this, "locals");
13271       int total = current->phis()->length();
13272       PrintIntProperty("size", current->phis()->length());
13273       PrintStringProperty("method", "None");
13274       for (int j = 0; j < total; ++j) {
13275         HPhi* phi = current->phis()->at(j);
13276         PrintIndent();
13277         std::ostringstream os;
13278         os << phi->merged_index() << " " << NameOf(phi) << " " << *phi << "\n";
13279         trace_.Add(os.str().c_str());
13280       }
13281     }
13282
13283     {
13284       Tag HIR_tag(this, "HIR");
13285       for (HInstructionIterator it(current); !it.Done(); it.Advance()) {
13286         HInstruction* instruction = it.Current();
13287         int uses = instruction->UseCount();
13288         PrintIndent();
13289         std::ostringstream os;
13290         os << "0 " << uses << " " << NameOf(instruction) << " " << *instruction;
13291         if (graph->info()->is_tracking_positions() &&
13292             instruction->has_position() && instruction->position().raw() != 0) {
13293           const SourcePosition pos = instruction->position();
13294           os << " pos:";
13295           if (pos.inlining_id() != 0) os << pos.inlining_id() << "_";
13296           os << pos.position();
13297         }
13298         os << " <|@\n";
13299         trace_.Add(os.str().c_str());
13300       }
13301     }
13302
13303
13304     if (chunk != NULL) {
13305       Tag LIR_tag(this, "LIR");
13306       int first_index = current->first_instruction_index();
13307       int last_index = current->last_instruction_index();
13308       if (first_index != -1 && last_index != -1) {
13309         const ZoneList<LInstruction*>* instructions = chunk->instructions();
13310         for (int i = first_index; i <= last_index; ++i) {
13311           LInstruction* linstr = instructions->at(i);
13312           if (linstr != NULL) {
13313             PrintIndent();
13314             trace_.Add("%d ",
13315                        LifetimePosition::FromInstructionIndex(i).Value());
13316             linstr->PrintTo(&trace_);
13317             std::ostringstream os;
13318             os << " [hir:" << NameOf(linstr->hydrogen_value()) << "] <|@\n";
13319             trace_.Add(os.str().c_str());
13320           }
13321         }
13322       }
13323     }
13324   }
13325 }
13326
13327
13328 void HTracer::TraceLiveRanges(const char* name, LAllocator* allocator) {
13329   Tag tag(this, "intervals");
13330   PrintStringProperty("name", name);
13331
13332   const Vector<LiveRange*>* fixed_d = allocator->fixed_double_live_ranges();
13333   for (int i = 0; i < fixed_d->length(); ++i) {
13334     TraceLiveRange(fixed_d->at(i), "fixed", allocator->zone());
13335   }
13336
13337   const Vector<LiveRange*>* fixed = allocator->fixed_live_ranges();
13338   for (int i = 0; i < fixed->length(); ++i) {
13339     TraceLiveRange(fixed->at(i), "fixed", allocator->zone());
13340   }
13341
13342   const ZoneList<LiveRange*>* live_ranges = allocator->live_ranges();
13343   for (int i = 0; i < live_ranges->length(); ++i) {
13344     TraceLiveRange(live_ranges->at(i), "object", allocator->zone());
13345   }
13346 }
13347
13348
13349 void HTracer::TraceLiveRange(LiveRange* range, const char* type,
13350                              Zone* zone) {
13351   if (range != NULL && !range->IsEmpty()) {
13352     PrintIndent();
13353     trace_.Add("%d %s", range->id(), type);
13354     if (range->HasRegisterAssigned()) {
13355       LOperand* op = range->CreateAssignedOperand(zone);
13356       int assigned_reg = op->index();
13357       if (op->IsDoubleRegister()) {
13358         trace_.Add(" \"%s\"",
13359                    DoubleRegister::AllocationIndexToString(assigned_reg));
13360       } else {
13361         DCHECK(op->IsRegister());
13362         trace_.Add(" \"%s\"", Register::AllocationIndexToString(assigned_reg));
13363       }
13364     } else if (range->IsSpilled()) {
13365       LOperand* op = range->TopLevel()->GetSpillOperand();
13366       if (op->IsDoubleStackSlot()) {
13367         trace_.Add(" \"double_stack:%d\"", op->index());
13368       } else {
13369         DCHECK(op->IsStackSlot());
13370         trace_.Add(" \"stack:%d\"", op->index());
13371       }
13372     }
13373     int parent_index = -1;
13374     if (range->IsChild()) {
13375       parent_index = range->parent()->id();
13376     } else {
13377       parent_index = range->id();
13378     }
13379     LOperand* op = range->FirstHint();
13380     int hint_index = -1;
13381     if (op != NULL && op->IsUnallocated()) {
13382       hint_index = LUnallocated::cast(op)->virtual_register();
13383     }
13384     trace_.Add(" %d %d", parent_index, hint_index);
13385     UseInterval* cur_interval = range->first_interval();
13386     while (cur_interval != NULL && range->Covers(cur_interval->start())) {
13387       trace_.Add(" [%d, %d[",
13388                  cur_interval->start().Value(),
13389                  cur_interval->end().Value());
13390       cur_interval = cur_interval->next();
13391     }
13392
13393     UsePosition* current_pos = range->first_pos();
13394     while (current_pos != NULL) {
13395       if (current_pos->RegisterIsBeneficial() || FLAG_trace_all_uses) {
13396         trace_.Add(" %d M", current_pos->pos().Value());
13397       }
13398       current_pos = current_pos->next();
13399     }
13400
13401     trace_.Add(" \"\"\n");
13402   }
13403 }
13404
13405
13406 void HTracer::FlushToFile() {
13407   AppendChars(filename_.start(), trace_.ToCString().get(), trace_.length(),
13408               false);
13409   trace_.Reset();
13410 }
13411
13412
13413 void HStatistics::Initialize(CompilationInfo* info) {
13414   if (info->shared_info().is_null()) return;
13415   source_size_ += info->shared_info()->SourceSize();
13416 }
13417
13418
13419 void HStatistics::Print() {
13420   PrintF(
13421       "\n"
13422       "----------------------------------------"
13423       "----------------------------------------\n"
13424       "--- Hydrogen timing results:\n"
13425       "----------------------------------------"
13426       "----------------------------------------\n");
13427   base::TimeDelta sum;
13428   for (int i = 0; i < times_.length(); ++i) {
13429     sum += times_[i];
13430   }
13431
13432   for (int i = 0; i < names_.length(); ++i) {
13433     PrintF("%33s", names_[i]);
13434     double ms = times_[i].InMillisecondsF();
13435     double percent = times_[i].PercentOf(sum);
13436     PrintF(" %8.3f ms / %4.1f %% ", ms, percent);
13437
13438     size_t size = sizes_[i];
13439     double size_percent = static_cast<double>(size) * 100 / total_size_;
13440     PrintF(" %9zu bytes / %4.1f %%\n", size, size_percent);
13441   }
13442
13443   PrintF(
13444       "----------------------------------------"
13445       "----------------------------------------\n");
13446   base::TimeDelta total = create_graph_ + optimize_graph_ + generate_code_;
13447   PrintF("%33s %8.3f ms / %4.1f %% \n", "Create graph",
13448          create_graph_.InMillisecondsF(), create_graph_.PercentOf(total));
13449   PrintF("%33s %8.3f ms / %4.1f %% \n", "Optimize graph",
13450          optimize_graph_.InMillisecondsF(), optimize_graph_.PercentOf(total));
13451   PrintF("%33s %8.3f ms / %4.1f %% \n", "Generate and install code",
13452          generate_code_.InMillisecondsF(), generate_code_.PercentOf(total));
13453   PrintF(
13454       "----------------------------------------"
13455       "----------------------------------------\n");
13456   PrintF("%33s %8.3f ms           %9zu bytes\n", "Total",
13457          total.InMillisecondsF(), total_size_);
13458   PrintF("%33s     (%.1f times slower than full code gen)\n", "",
13459          total.TimesOf(full_code_gen_));
13460
13461   double source_size_in_kb = static_cast<double>(source_size_) / 1024;
13462   double normalized_time =  source_size_in_kb > 0
13463       ? total.InMillisecondsF() / source_size_in_kb
13464       : 0;
13465   double normalized_size_in_kb =
13466       source_size_in_kb > 0
13467           ? static_cast<double>(total_size_) / 1024 / source_size_in_kb
13468           : 0;
13469   PrintF("%33s %8.3f ms           %7.3f kB allocated\n",
13470          "Average per kB source", normalized_time, normalized_size_in_kb);
13471 }
13472
13473
13474 void HStatistics::SaveTiming(const char* name, base::TimeDelta time,
13475                              size_t size) {
13476   total_size_ += size;
13477   for (int i = 0; i < names_.length(); ++i) {
13478     if (strcmp(names_[i], name) == 0) {
13479       times_[i] += time;
13480       sizes_[i] += size;
13481       return;
13482     }
13483   }
13484   names_.Add(name);
13485   times_.Add(time);
13486   sizes_.Add(size);
13487 }
13488
13489
13490 HPhase::~HPhase() {
13491   if (ShouldProduceTraceOutput()) {
13492     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
13493   }
13494
13495 #ifdef DEBUG
13496   graph_->Verify(false);  // No full verify.
13497 #endif
13498 }
13499
13500 }  // namespace internal
13501 }  // namespace v8