src/hydrogen.cc

   1 // Copyright 2013 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/hydrogen.h"
   6
   7 #include <sstream>
   8
   9 #include "src/v8.h"
  10
  11 #include "src/allocation-site-scopes.h"
  12 #include "src/ast-numbering.h"
  13 #include "src/full-codegen/full-codegen.h"
  14 #include "src/hydrogen-bce.h"
  15 #include "src/hydrogen-bch.h"
  16 #include "src/hydrogen-canonicalize.h"
  17 #include "src/hydrogen-check-elimination.h"
  18 #include "src/hydrogen-dce.h"
  19 #include "src/hydrogen-dehoist.h"
  20 #include "src/hydrogen-environment-liveness.h"
  21 #include "src/hydrogen-escape-analysis.h"
  22 #include "src/hydrogen-gvn.h"
  23 #include "src/hydrogen-infer-representation.h"
  24 #include "src/hydrogen-infer-types.h"
  25 #include "src/hydrogen-load-elimination.h"
  26 #include "src/hydrogen-mark-deoptimize.h"
  27 #include "src/hydrogen-mark-unreachable.h"
  28 #include "src/hydrogen-osr.h"
  29 #include "src/hydrogen-range-analysis.h"
  30 #include "src/hydrogen-redundant-phi.h"
  31 #include "src/hydrogen-removable-simulates.h"
  32 #include "src/hydrogen-representation-changes.h"
  33 #include "src/hydrogen-sce.h"
  34 #include "src/hydrogen-store-elimination.h"
  35 #include "src/hydrogen-uint32-analysis.h"
  36 #include "src/ic/call-optimization.h"
  37 #include "src/ic/ic.h"
  38 // GetRootConstructor
  39 #include "src/ic/ic-inl.h"
  40 #include "src/lithium-allocator.h"
  41 #include "src/parser.h"
  42 #include "src/runtime/runtime.h"
  43 #include "src/scopeinfo.h"
  44 #include "src/typing.h"
  45
  46 #if V8_TARGET_ARCH_IA32
  47 #include "src/ia32/lithium-codegen-ia32.h"  // NOLINT
  48 #elif V8_TARGET_ARCH_X64
  49 #include "src/x64/lithium-codegen-x64.h"  // NOLINT
  50 #elif V8_TARGET_ARCH_ARM64
  51 #include "src/arm64/lithium-codegen-arm64.h"  // NOLINT
  52 #elif V8_TARGET_ARCH_ARM
  53 #include "src/arm/lithium-codegen-arm.h"  // NOLINT
  54 #elif V8_TARGET_ARCH_PPC
  55 #include "src/ppc/lithium-codegen-ppc.h"  // NOLINT
  56 #elif V8_TARGET_ARCH_MIPS
  57 #include "src/mips/lithium-codegen-mips.h"  // NOLINT
  58 #elif V8_TARGET_ARCH_MIPS64
  59 #include "src/mips64/lithium-codegen-mips64.h"  // NOLINT
  60 #elif V8_TARGET_ARCH_X87
  61 #include "src/x87/lithium-codegen-x87.h"  // NOLINT
  62 #else
  63 #error Unsupported target architecture.
  64 #endif
  65
  66 namespace v8 {
  67 namespace internal {
  68
  69 HBasicBlock::HBasicBlock(HGraph* graph)
  70     : block_id_(graph->GetNextBlockID()),
  71       graph_(graph),
  72       phis_(4, graph->zone()),
  73       first_(NULL),
  74       last_(NULL),
  75       end_(NULL),
  76       loop_information_(NULL),
  77       predecessors_(2, graph->zone()),
  78       dominator_(NULL),
  79       dominated_blocks_(4, graph->zone()),
  80       last_environment_(NULL),
  81       argument_count_(-1),
  82       first_instruction_index_(-1),
  83       last_instruction_index_(-1),
  84       deleted_phis_(4, graph->zone()),
  85       parent_loop_header_(NULL),
  86       inlined_entry_block_(NULL),
  87       is_inline_return_target_(false),
  88       is_reachable_(true),
  89       dominates_loop_successors_(false),
  90       is_osr_entry_(false),
  91       is_ordered_(false) { }
  92
  93
  94 Isolate* HBasicBlock::isolate() const {
  95   return graph_->isolate();
  96 }
  97
  98
  99 void HBasicBlock::MarkUnreachable() {
 100   is_reachable_ = false;
 101 }
 102
 103
 104 void HBasicBlock::AttachLoopInformation() {
 105   DCHECK(!IsLoopHeader());
 106   loop_information_ = new(zone()) HLoopInformation(this, zone());
 107 }
 108
 109
 110 void HBasicBlock::DetachLoopInformation() {
 111   DCHECK(IsLoopHeader());
 112   loop_information_ = NULL;
 113 }
 114
 115
 116 void HBasicBlock::AddPhi(HPhi* phi) {
 117   DCHECK(!IsStartBlock());
 118   phis_.Add(phi, zone());
 119   phi->SetBlock(this);
 120 }
 121
 122
 123 void HBasicBlock::RemovePhi(HPhi* phi) {
 124   DCHECK(phi->block() == this);
 125   DCHECK(phis_.Contains(phi));
 126   phi->Kill();
 127   phis_.RemoveElement(phi);
 128   phi->SetBlock(NULL);
 129 }
 130
 131
 132 void HBasicBlock::AddInstruction(HInstruction* instr, SourcePosition position) {
 133   DCHECK(!IsStartBlock() || !IsFinished());
 134   DCHECK(!instr->IsLinked());
 135   DCHECK(!IsFinished());
 136
 137   if (!position.IsUnknown()) {
 138     instr->set_position(position);
 139   }
 140   if (first_ == NULL) {
 141     DCHECK(last_environment() != NULL);
 142     DCHECK(!last_environment()->ast_id().IsNone());
 143     HBlockEntry* entry = new(zone()) HBlockEntry();
 144     entry->InitializeAsFirst(this);
 145     if (!position.IsUnknown()) {
 146       entry->set_position(position);
 147     } else {
 148       DCHECK(!FLAG_hydrogen_track_positions ||
 149              !graph()->info()->IsOptimizing() || instr->IsAbnormalExit());
 150     }
 151     first_ = last_ = entry;
 152   }
 153   instr->InsertAfter(last_);
 154 }
 155
 156
 157 HPhi* HBasicBlock::AddNewPhi(int merged_index) {
 158   if (graph()->IsInsideNoSideEffectsScope()) {
 159     merged_index = HPhi::kInvalidMergedIndex;
 160   }
 161   HPhi* phi = new(zone()) HPhi(merged_index, zone());
 162   AddPhi(phi);
 163   return phi;
 164 }
 165
 166
 167 HSimulate* HBasicBlock::CreateSimulate(BailoutId ast_id,
 168                                        RemovableSimulate removable) {
 169   DCHECK(HasEnvironment());
 170   HEnvironment* environment = last_environment();
 171   DCHECK(ast_id.IsNone() ||
 172          ast_id == BailoutId::StubEntry() ||
 173          environment->closure()->shared()->VerifyBailoutId(ast_id));
 174
 175   int push_count = environment->push_count();
 176   int pop_count = environment->pop_count();
 177
 178   HSimulate* instr =
 179       new(zone()) HSimulate(ast_id, pop_count, zone(), removable);
 180 #ifdef DEBUG
 181   instr->set_closure(environment->closure());
 182 #endif
 183   // Order of pushed values: newest (top of stack) first. This allows
 184   // HSimulate::MergeWith() to easily append additional pushed values
 185   // that are older (from further down the stack).
 186   for (int i = 0; i < push_count; ++i) {
 187     instr->AddPushedValue(environment->ExpressionStackAt(i));
 188   }
 189   for (GrowableBitVector::Iterator it(environment->assigned_variables(),
 190                                       zone());
 191        !it.Done();
 192        it.Advance()) {
 193     int index = it.Current();
 194     instr->AddAssignedValue(index, environment->Lookup(index));
 195   }
 196   environment->ClearHistory();
 197   return instr;
 198 }
 199
 200
 201 void HBasicBlock::Finish(HControlInstruction* end, SourcePosition position) {
 202   DCHECK(!IsFinished());
 203   AddInstruction(end, position);
 204   end_ = end;
 205   for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 206     it.Current()->RegisterPredecessor(this);
 207   }
 208 }
 209
 210
 211 void HBasicBlock::Goto(HBasicBlock* block, SourcePosition position,
 212                        FunctionState* state, bool add_simulate) {
 213   bool drop_extra = state != NULL &&
 214       state->inlining_kind() == NORMAL_RETURN;
 215
 216   if (block->IsInlineReturnTarget()) {
 217     HEnvironment* env = last_environment();
 218     int argument_count = env->arguments_environment()->parameter_count();
 219     AddInstruction(new(zone())
 220                    HLeaveInlined(state->entry(), argument_count),
 221                    position);
 222     UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 223   }
 224
 225   if (add_simulate) AddNewSimulate(BailoutId::None(), position);
 226   HGoto* instr = new(zone()) HGoto(block);
 227   Finish(instr, position);
 228 }
 229
 230
 231 void HBasicBlock::AddLeaveInlined(HValue* return_value, FunctionState* state,
 232                                   SourcePosition position) {
 233   HBasicBlock* target = state->function_return();
 234   bool drop_extra = state->inlining_kind() == NORMAL_RETURN;
 235
 236   DCHECK(target->IsInlineReturnTarget());
 237   DCHECK(return_value != NULL);
 238   HEnvironment* env = last_environment();
 239   int argument_count = env->arguments_environment()->parameter_count();
 240   AddInstruction(new(zone()) HLeaveInlined(state->entry(), argument_count),
 241                  position);
 242   UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 243   last_environment()->Push(return_value);
 244   AddNewSimulate(BailoutId::None(), position);
 245   HGoto* instr = new(zone()) HGoto(target);
 246   Finish(instr, position);
 247 }
 248
 249
 250 void HBasicBlock::SetInitialEnvironment(HEnvironment* env) {
 251   DCHECK(!HasEnvironment());
 252   DCHECK(first() == NULL);
 253   UpdateEnvironment(env);
 254 }
 255
 256
 257 void HBasicBlock::UpdateEnvironment(HEnvironment* env) {
 258   last_environment_ = env;
 259   graph()->update_maximum_environment_size(env->first_expression_index());
 260 }
 261
 262
 263 void HBasicBlock::SetJoinId(BailoutId ast_id) {
 264   int length = predecessors_.length();
 265   DCHECK(length > 0);
 266   for (int i = 0; i < length; i++) {
 267     HBasicBlock* predecessor = predecessors_[i];
 268     DCHECK(predecessor->end()->IsGoto());
 269     HSimulate* simulate = HSimulate::cast(predecessor->end()->previous());
 270     DCHECK(i != 0 ||
 271            (predecessor->last_environment()->closure().is_null() ||
 272             predecessor->last_environment()->closure()->shared()
 273               ->VerifyBailoutId(ast_id)));
 274     simulate->set_ast_id(ast_id);
 275     predecessor->last_environment()->set_ast_id(ast_id);
 276   }
 277 }
 278
 279
 280 bool HBasicBlock::Dominates(HBasicBlock* other) const {
 281   HBasicBlock* current = other->dominator();
 282   while (current != NULL) {
 283     if (current == this) return true;
 284     current = current->dominator();
 285   }
 286   return false;
 287 }
 288
 289
 290 bool HBasicBlock::EqualToOrDominates(HBasicBlock* other) const {
 291   if (this == other) return true;
 292   return Dominates(other);
 293 }
 294
 295
 296 int HBasicBlock::LoopNestingDepth() const {
 297   const HBasicBlock* current = this;
 298   int result  = (current->IsLoopHeader()) ? 1 : 0;
 299   while (current->parent_loop_header() != NULL) {
 300     current = current->parent_loop_header();
 301     result++;
 302   }
 303   return result;
 304 }
 305
 306
 307 void HBasicBlock::PostProcessLoopHeader(IterationStatement* stmt) {
 308   DCHECK(IsLoopHeader());
 309
 310   SetJoinId(stmt->EntryId());
 311   if (predecessors()->length() == 1) {
 312     // This is a degenerated loop.
 313     DetachLoopInformation();
 314     return;
 315   }
 316
 317   // Only the first entry into the loop is from outside the loop. All other
 318   // entries must be back edges.
 319   for (int i = 1; i < predecessors()->length(); ++i) {
 320     loop_information()->RegisterBackEdge(predecessors()->at(i));
 321   }
 322 }
 323
 324
 325 void HBasicBlock::MarkSuccEdgeUnreachable(int succ) {
 326   DCHECK(IsFinished());
 327   HBasicBlock* succ_block = end()->SuccessorAt(succ);
 328
 329   DCHECK(succ_block->predecessors()->length() == 1);
 330   succ_block->MarkUnreachable();
 331 }
 332
 333
 334 void HBasicBlock::RegisterPredecessor(HBasicBlock* pred) {
 335   if (HasPredecessor()) {
 336     // Only loop header blocks can have a predecessor added after
 337     // instructions have been added to the block (they have phis for all
 338     // values in the environment, these phis may be eliminated later).
 339     DCHECK(IsLoopHeader() || first_ == NULL);
 340     HEnvironment* incoming_env = pred->last_environment();
 341     if (IsLoopHeader()) {
 342       DCHECK_EQ(phis()->length(), incoming_env->length());
 343       for (int i = 0; i < phis_.length(); ++i) {
 344         phis_[i]->AddInput(incoming_env->values()->at(i));
 345       }
 346     } else {
 347       last_environment()->AddIncomingEdge(this, pred->last_environment());
 348     }
 349   } else if (!HasEnvironment() && !IsFinished()) {
 350     DCHECK(!IsLoopHeader());
 351     SetInitialEnvironment(pred->last_environment()->Copy());
 352   }
 353
 354   predecessors_.Add(pred, zone());
 355 }
 356
 357
 358 void HBasicBlock::AddDominatedBlock(HBasicBlock* block) {
 359   DCHECK(!dominated_blocks_.Contains(block));
 360   // Keep the list of dominated blocks sorted such that if there is two
 361   // succeeding block in this list, the predecessor is before the successor.
 362   int index = 0;
 363   while (index < dominated_blocks_.length() &&
 364          dominated_blocks_[index]->block_id() < block->block_id()) {
 365     ++index;
 366   }
 367   dominated_blocks_.InsertAt(index, block, zone());
 368 }
 369
 370
 371 void HBasicBlock::AssignCommonDominator(HBasicBlock* other) {
 372   if (dominator_ == NULL) {
 373     dominator_ = other;
 374     other->AddDominatedBlock(this);
 375   } else if (other->dominator() != NULL) {
 376     HBasicBlock* first = dominator_;
 377     HBasicBlock* second = other;
 378
 379     while (first != second) {
 380       if (first->block_id() > second->block_id()) {
 381         first = first->dominator();
 382       } else {
 383         second = second->dominator();
 384       }
 385       DCHECK(first != NULL && second != NULL);
 386     }
 387
 388     if (dominator_ != first) {
 389       DCHECK(dominator_->dominated_blocks_.Contains(this));
 390       dominator_->dominated_blocks_.RemoveElement(this);
 391       dominator_ = first;
 392       first->AddDominatedBlock(this);
 393     }
 394   }
 395 }
 396
 397
 398 void HBasicBlock::AssignLoopSuccessorDominators() {
 399   // Mark blocks that dominate all subsequent reachable blocks inside their
 400   // loop. Exploit the fact that blocks are sorted in reverse post order. When
 401   // the loop is visited in increasing block id order, if the number of
 402   // non-loop-exiting successor edges at the dominator_candidate block doesn't
 403   // exceed the number of previously encountered predecessor edges, there is no
 404   // path from the loop header to any block with higher id that doesn't go
 405   // through the dominator_candidate block. In this case, the
 406   // dominator_candidate block is guaranteed to dominate all blocks reachable
 407   // from it with higher ids.
 408   HBasicBlock* last = loop_information()->GetLastBackEdge();
 409   int outstanding_successors = 1;  // one edge from the pre-header
 410   // Header always dominates everything.
 411   MarkAsLoopSuccessorDominator();
 412   for (int j = block_id(); j <= last->block_id(); ++j) {
 413     HBasicBlock* dominator_candidate = graph_->blocks()->at(j);
 414     for (HPredecessorIterator it(dominator_candidate); !it.Done();
 415          it.Advance()) {
 416       HBasicBlock* predecessor = it.Current();
 417       // Don't count back edges.
 418       if (predecessor->block_id() < dominator_candidate->block_id()) {
 419         outstanding_successors--;
 420       }
 421     }
 422
 423     // If more successors than predecessors have been seen in the loop up to
 424     // now, it's not possible to guarantee that the current block dominates
 425     // all of the blocks with higher IDs. In this case, assume conservatively
 426     // that those paths through loop that don't go through the current block
 427     // contain all of the loop's dependencies. Also be careful to record
 428     // dominator information about the current loop that's being processed,
 429     // and not nested loops, which will be processed when
 430     // AssignLoopSuccessorDominators gets called on their header.
 431     DCHECK(outstanding_successors >= 0);
 432     HBasicBlock* parent_loop_header = dominator_candidate->parent_loop_header();
 433     if (outstanding_successors == 0 &&
 434         (parent_loop_header == this && !dominator_candidate->IsLoopHeader())) {
 435       dominator_candidate->MarkAsLoopSuccessorDominator();
 436     }
 437     HControlInstruction* end = dominator_candidate->end();
 438     for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 439       HBasicBlock* successor = it.Current();
 440       // Only count successors that remain inside the loop and don't loop back
 441       // to a loop header.
 442       if (successor->block_id() > dominator_candidate->block_id() &&
 443           successor->block_id() <= last->block_id()) {
 444         // Backwards edges must land on loop headers.
 445         DCHECK(successor->block_id() > dominator_candidate->block_id() ||
 446                successor->IsLoopHeader());
 447         outstanding_successors++;
 448       }
 449     }
 450   }
 451 }
 452
 453
 454 int HBasicBlock::PredecessorIndexOf(HBasicBlock* predecessor) const {
 455   for (int i = 0; i < predecessors_.length(); ++i) {
 456     if (predecessors_[i] == predecessor) return i;
 457   }
 458   UNREACHABLE();
 459   return -1;
 460 }
 461
 462
 463 #ifdef DEBUG
 464 void HBasicBlock::Verify() {
 465   // Check that every block is finished.
 466   DCHECK(IsFinished());
 467   DCHECK(block_id() >= 0);
 468
 469   // Check that the incoming edges are in edge split form.
 470   if (predecessors_.length() > 1) {
 471     for (int i = 0; i < predecessors_.length(); ++i) {
 472       DCHECK(predecessors_[i]->end()->SecondSuccessor() == NULL);
 473     }
 474   }
 475 }
 476 #endif
 477
 478
 479 void HLoopInformation::RegisterBackEdge(HBasicBlock* block) {
 480   this->back_edges_.Add(block, block->zone());
 481   AddBlock(block);
 482 }
 483
 484
 485 HBasicBlock* HLoopInformation::GetLastBackEdge() const {
 486   int max_id = -1;
 487   HBasicBlock* result = NULL;
 488   for (int i = 0; i < back_edges_.length(); ++i) {
 489     HBasicBlock* cur = back_edges_[i];
 490     if (cur->block_id() > max_id) {
 491       max_id = cur->block_id();
 492       result = cur;
 493     }
 494   }
 495   return result;
 496 }
 497
 498
 499 void HLoopInformation::AddBlock(HBasicBlock* block) {
 500   if (block == loop_header()) return;
 501   if (block->parent_loop_header() == loop_header()) return;
 502   if (block->parent_loop_header() != NULL) {
 503     AddBlock(block->parent_loop_header());
 504   } else {
 505     block->set_parent_loop_header(loop_header());
 506     blocks_.Add(block, block->zone());
 507     for (int i = 0; i < block->predecessors()->length(); ++i) {
 508       AddBlock(block->predecessors()->at(i));
 509     }
 510   }
 511 }
 512
 513
 514 #ifdef DEBUG
 515
 516 // Checks reachability of the blocks in this graph and stores a bit in
 517 // the BitVector "reachable()" for every block that can be reached
 518 // from the start block of the graph. If "dont_visit" is non-null, the given
 519 // block is treated as if it would not be part of the graph. "visited_count()"
 520 // returns the number of reachable blocks.
 521 class ReachabilityAnalyzer BASE_EMBEDDED {
 522  public:
 523   ReachabilityAnalyzer(HBasicBlock* entry_block,
 524                        int block_count,
 525                        HBasicBlock* dont_visit)
 526       : visited_count_(0),
 527         stack_(16, entry_block->zone()),
 528         reachable_(block_count, entry_block->zone()),
 529         dont_visit_(dont_visit) {
 530     PushBlock(entry_block);
 531     Analyze();
 532   }
 533
 534   int visited_count() const { return visited_count_; }
 535   const BitVector* reachable() const { return &reachable_; }
 536
 537  private:
 538   void PushBlock(HBasicBlock* block) {
 539     if (block != NULL && block != dont_visit_ &&
 540         !reachable_.Contains(block->block_id())) {
 541       reachable_.Add(block->block_id());
 542       stack_.Add(block, block->zone());
 543       visited_count_++;
 544     }
 545   }
 546
 547   void Analyze() {
 548     while (!stack_.is_empty()) {
 549       HControlInstruction* end = stack_.RemoveLast()->end();
 550       for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 551         PushBlock(it.Current());
 552       }
 553     }
 554   }
 555
 556   int visited_count_;
 557   ZoneList<HBasicBlock*> stack_;
 558   BitVector reachable_;
 559   HBasicBlock* dont_visit_;
 560 };
 561
 562
 563 void HGraph::Verify(bool do_full_verify) const {
 564   Heap::RelocationLock relocation_lock(isolate()->heap());
 565   AllowHandleDereference allow_deref;
 566   AllowDeferredHandleDereference allow_deferred_deref;
 567   for (int i = 0; i < blocks_.length(); i++) {
 568     HBasicBlock* block = blocks_.at(i);
 569
 570     block->Verify();
 571
 572     // Check that every block contains at least one node and that only the last
 573     // node is a control instruction.
 574     HInstruction* current = block->first();
 575     DCHECK(current != NULL && current->IsBlockEntry());
 576     while (current != NULL) {
 577       DCHECK((current->next() == NULL) == current->IsControlInstruction());
 578       DCHECK(current->block() == block);
 579       current->Verify();
 580       current = current->next();
 581     }
 582
 583     // Check that successors are correctly set.
 584     HBasicBlock* first = block->end()->FirstSuccessor();
 585     HBasicBlock* second = block->end()->SecondSuccessor();
 586     DCHECK(second == NULL || first != NULL);
 587
 588     // Check that the predecessor array is correct.
 589     if (first != NULL) {
 590       DCHECK(first->predecessors()->Contains(block));
 591       if (second != NULL) {
 592         DCHECK(second->predecessors()->Contains(block));
 593       }
 594     }
 595
 596     // Check that phis have correct arguments.
 597     for (int j = 0; j < block->phis()->length(); j++) {
 598       HPhi* phi = block->phis()->at(j);
 599       phi->Verify();
 600     }
 601
 602     // Check that all join blocks have predecessors that end with an
 603     // unconditional goto and agree on their environment node id.
 604     if (block->predecessors()->length() >= 2) {
 605       BailoutId id =
 606           block->predecessors()->first()->last_environment()->ast_id();
 607       for (int k = 0; k < block->predecessors()->length(); k++) {
 608         HBasicBlock* predecessor = block->predecessors()->at(k);
 609         DCHECK(predecessor->end()->IsGoto() ||
 610                predecessor->end()->IsDeoptimize());
 611         DCHECK(predecessor->last_environment()->ast_id() == id);
 612       }
 613     }
 614   }
 615
 616   // Check special property of first block to have no predecessors.
 617   DCHECK(blocks_.at(0)->predecessors()->is_empty());
 618
 619   if (do_full_verify) {
 620     // Check that the graph is fully connected.
 621     ReachabilityAnalyzer analyzer(entry_block_, blocks_.length(), NULL);
 622     DCHECK(analyzer.visited_count() == blocks_.length());
 623
 624     // Check that entry block dominator is NULL.
 625     DCHECK(entry_block_->dominator() == NULL);
 626
 627     // Check dominators.
 628     for (int i = 0; i < blocks_.length(); ++i) {
 629       HBasicBlock* block = blocks_.at(i);
 630       if (block->dominator() == NULL) {
 631         // Only start block may have no dominator assigned to.
 632         DCHECK(i == 0);
 633       } else {
 634         // Assert that block is unreachable if dominator must not be visited.
 635         ReachabilityAnalyzer dominator_analyzer(entry_block_,
 636                                                 blocks_.length(),
 637                                                 block->dominator());
 638         DCHECK(!dominator_analyzer.reachable()->Contains(block->block_id()));
 639       }
 640     }
 641   }
 642 }
 643
 644 #endif
 645
 646
 647 HConstant* HGraph::GetConstant(SetOncePointer<HConstant>* pointer,
 648                                int32_t value) {
 649   if (!pointer->is_set()) {
 650     // Can't pass GetInvalidContext() to HConstant::New, because that will
 651     // recursively call GetConstant
 652     HConstant* constant = HConstant::New(isolate(), zone(), NULL, value);
 653     constant->InsertAfter(entry_block()->first());
 654     pointer->set(constant);
 655     return constant;
 656   }
 657   return ReinsertConstantIfNecessary(pointer->get());
 658 }
 659
 660
 661 HConstant* HGraph::ReinsertConstantIfNecessary(HConstant* constant) {
 662   if (!constant->IsLinked()) {
 663     // The constant was removed from the graph. Reinsert.
 664     constant->ClearFlag(HValue::kIsDead);
 665     constant->InsertAfter(entry_block()->first());
 666   }
 667   return constant;
 668 }
 669
 670
 671 HConstant* HGraph::GetConstant0() {
 672   return GetConstant(&constant_0_, 0);
 673 }
 674
 675
 676 HConstant* HGraph::GetConstant1() {
 677   return GetConstant(&constant_1_, 1);
 678 }
 679
 680
 681 HConstant* HGraph::GetConstantMinus1() {
 682   return GetConstant(&constant_minus1_, -1);
 683 }
 684
 685
 686 HConstant* HGraph::GetConstantBool(bool value) {
 687   return value ? GetConstantTrue() : GetConstantFalse();
 688 }
 689
 690
 691 #define DEFINE_GET_CONSTANT(Name, name, type, htype, boolean_value)            \
 692 HConstant* HGraph::GetConstant##Name() {                                       \
 693   if (!constant_##name##_.is_set()) {                                          \
 694     HConstant* constant = new(zone()) HConstant(                               \
 695         Unique<Object>::CreateImmovable(isolate()->factory()->name##_value()), \
 696         Unique<Map>::CreateImmovable(isolate()->factory()->type##_map()),      \
 697         false,                                                                 \
 698         Representation::Tagged(),                                              \
 699         htype,                                                                 \
 700         true,                                                                  \
 701         boolean_value,                                                         \
 702         false,                                                                 \
 703         ODDBALL_TYPE);                                                         \
 704     constant->InsertAfter(entry_block()->first());                             \
 705     constant_##name##_.set(constant);                                          \
 706   }                                                                            \
 707   return ReinsertConstantIfNecessary(constant_##name##_.get());                \
 708 }
 709
 710
 711 DEFINE_GET_CONSTANT(Undefined, undefined, undefined, HType::Undefined(), false)
 712 DEFINE_GET_CONSTANT(True, true, boolean, HType::Boolean(), true)
 713 DEFINE_GET_CONSTANT(False, false, boolean, HType::Boolean(), false)
 714 DEFINE_GET_CONSTANT(Hole, the_hole, the_hole, HType::None(), false)
 715 DEFINE_GET_CONSTANT(Null, null, null, HType::Null(), false)
 716
 717
 718 #undef DEFINE_GET_CONSTANT
 719
 720 #define DEFINE_IS_CONSTANT(Name, name)                                         \
 721 bool HGraph::IsConstant##Name(HConstant* constant) {                           \
 722   return constant_##name##_.is_set() && constant == constant_##name##_.get();  \
 723 }
 724 DEFINE_IS_CONSTANT(Undefined, undefined)
 725 DEFINE_IS_CONSTANT(0, 0)
 726 DEFINE_IS_CONSTANT(1, 1)
 727 DEFINE_IS_CONSTANT(Minus1, minus1)
 728 DEFINE_IS_CONSTANT(True, true)
 729 DEFINE_IS_CONSTANT(False, false)
 730 DEFINE_IS_CONSTANT(Hole, the_hole)
 731 DEFINE_IS_CONSTANT(Null, null)
 732
 733 #undef DEFINE_IS_CONSTANT
 734
 735
 736 HConstant* HGraph::GetInvalidContext() {
 737   return GetConstant(&constant_invalid_context_, 0xFFFFC0C7);
 738 }
 739
 740
 741 bool HGraph::IsStandardConstant(HConstant* constant) {
 742   if (IsConstantUndefined(constant)) return true;
 743   if (IsConstant0(constant)) return true;
 744   if (IsConstant1(constant)) return true;
 745   if (IsConstantMinus1(constant)) return true;
 746   if (IsConstantTrue(constant)) return true;
 747   if (IsConstantFalse(constant)) return true;
 748   if (IsConstantHole(constant)) return true;
 749   if (IsConstantNull(constant)) return true;
 750   return false;
 751 }
 752
 753
 754 HGraphBuilder::IfBuilder::IfBuilder() : builder_(NULL), needs_compare_(true) {}
 755
 756
 757 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder)
 758     : needs_compare_(true) {
 759   Initialize(builder);
 760 }
 761
 762
 763 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder,
 764                                     HIfContinuation* continuation)
 765     : needs_compare_(false), first_true_block_(NULL), first_false_block_(NULL) {
 766   InitializeDontCreateBlocks(builder);
 767   continuation->Continue(&first_true_block_, &first_false_block_);
 768 }
 769
 770
 771 void HGraphBuilder::IfBuilder::InitializeDontCreateBlocks(
 772     HGraphBuilder* builder) {
 773   builder_ = builder;
 774   finished_ = false;
 775   did_then_ = false;
 776   did_else_ = false;
 777   did_else_if_ = false;
 778   did_and_ = false;
 779   did_or_ = false;
 780   captured_ = false;
 781   pending_merge_block_ = false;
 782   split_edge_merge_block_ = NULL;
 783   merge_at_join_blocks_ = NULL;
 784   normal_merge_at_join_block_count_ = 0;
 785   deopt_merge_at_join_block_count_ = 0;
 786 }
 787
 788
 789 void HGraphBuilder::IfBuilder::Initialize(HGraphBuilder* builder) {
 790   InitializeDontCreateBlocks(builder);
 791   HEnvironment* env = builder->environment();
 792   first_true_block_ = builder->CreateBasicBlock(env->Copy());
 793   first_false_block_ = builder->CreateBasicBlock(env->Copy());
 794 }
 795
 796
 797 HControlInstruction* HGraphBuilder::IfBuilder::AddCompare(
 798     HControlInstruction* compare) {
 799   DCHECK(did_then_ == did_else_);
 800   if (did_else_) {
 801     // Handle if-then-elseif
 802     did_else_if_ = true;
 803     did_else_ = false;
 804     did_then_ = false;
 805     did_and_ = false;
 806     did_or_ = false;
 807     pending_merge_block_ = false;
 808     split_edge_merge_block_ = NULL;
 809     HEnvironment* env = builder()->environment();
 810     first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 811     first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 812   }
 813   if (split_edge_merge_block_ != NULL) {
 814     HEnvironment* env = first_false_block_->last_environment();
 815     HBasicBlock* split_edge = builder()->CreateBasicBlock(env->Copy());
 816     if (did_or_) {
 817       compare->SetSuccessorAt(0, split_edge);
 818       compare->SetSuccessorAt(1, first_false_block_);
 819     } else {
 820       compare->SetSuccessorAt(0, first_true_block_);
 821       compare->SetSuccessorAt(1, split_edge);
 822     }
 823     builder()->GotoNoSimulate(split_edge, split_edge_merge_block_);
 824   } else {
 825     compare->SetSuccessorAt(0, first_true_block_);
 826     compare->SetSuccessorAt(1, first_false_block_);
 827   }
 828   builder()->FinishCurrentBlock(compare);
 829   needs_compare_ = false;
 830   return compare;
 831 }
 832
 833
 834 void HGraphBuilder::IfBuilder::Or() {
 835   DCHECK(!needs_compare_);
 836   DCHECK(!did_and_);
 837   did_or_ = true;
 838   HEnvironment* env = first_false_block_->last_environment();
 839   if (split_edge_merge_block_ == NULL) {
 840     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 841     builder()->GotoNoSimulate(first_true_block_, split_edge_merge_block_);
 842     first_true_block_ = split_edge_merge_block_;
 843   }
 844   builder()->set_current_block(first_false_block_);
 845   first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 846 }
 847
 848
 849 void HGraphBuilder::IfBuilder::And() {
 850   DCHECK(!needs_compare_);
 851   DCHECK(!did_or_);
 852   did_and_ = true;
 853   HEnvironment* env = first_false_block_->last_environment();
 854   if (split_edge_merge_block_ == NULL) {
 855     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 856     builder()->GotoNoSimulate(first_false_block_, split_edge_merge_block_);
 857     first_false_block_ = split_edge_merge_block_;
 858   }
 859   builder()->set_current_block(first_true_block_);
 860   first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 861 }
 862
 863
 864 void HGraphBuilder::IfBuilder::CaptureContinuation(
 865     HIfContinuation* continuation) {
 866   DCHECK(!did_else_if_);
 867   DCHECK(!finished_);
 868   DCHECK(!captured_);
 869
 870   HBasicBlock* true_block = NULL;
 871   HBasicBlock* false_block = NULL;
 872   Finish(&true_block, &false_block);
 873   DCHECK(true_block != NULL);
 874   DCHECK(false_block != NULL);
 875   continuation->Capture(true_block, false_block);
 876   captured_ = true;
 877   builder()->set_current_block(NULL);
 878   End();
 879 }
 880
 881
 882 void HGraphBuilder::IfBuilder::JoinContinuation(HIfContinuation* continuation) {
 883   DCHECK(!did_else_if_);
 884   DCHECK(!finished_);
 885   DCHECK(!captured_);
 886   HBasicBlock* true_block = NULL;
 887   HBasicBlock* false_block = NULL;
 888   Finish(&true_block, &false_block);
 889   merge_at_join_blocks_ = NULL;
 890   if (true_block != NULL && !true_block->IsFinished()) {
 891     DCHECK(continuation->IsTrueReachable());
 892     builder()->GotoNoSimulate(true_block, continuation->true_branch());
 893   }
 894   if (false_block != NULL && !false_block->IsFinished()) {
 895     DCHECK(continuation->IsFalseReachable());
 896     builder()->GotoNoSimulate(false_block, continuation->false_branch());
 897   }
 898   captured_ = true;
 899   End();
 900 }
 901
 902
 903 void HGraphBuilder::IfBuilder::Then() {
 904   DCHECK(!captured_);
 905   DCHECK(!finished_);
 906   did_then_ = true;
 907   if (needs_compare_) {
 908     // Handle if's without any expressions, they jump directly to the "else"
 909     // branch. However, we must pretend that the "then" branch is reachable,
 910     // so that the graph builder visits it and sees any live range extending
 911     // constructs within it.
 912     HConstant* constant_false = builder()->graph()->GetConstantFalse();
 913     ToBooleanStub::Types boolean_type = ToBooleanStub::Types();
 914     boolean_type.Add(ToBooleanStub::BOOLEAN);
 915     HBranch* branch = builder()->New<HBranch>(
 916         constant_false, boolean_type, first_true_block_, first_false_block_);
 917     builder()->FinishCurrentBlock(branch);
 918   }
 919   builder()->set_current_block(first_true_block_);
 920   pending_merge_block_ = true;
 921 }
 922
 923
 924 void HGraphBuilder::IfBuilder::Else() {
 925   DCHECK(did_then_);
 926   DCHECK(!captured_);
 927   DCHECK(!finished_);
 928   AddMergeAtJoinBlock(false);
 929   builder()->set_current_block(first_false_block_);
 930   pending_merge_block_ = true;
 931   did_else_ = true;
 932 }
 933
 934
 935 void HGraphBuilder::IfBuilder::Deopt(Deoptimizer::DeoptReason reason) {
 936   DCHECK(did_then_);
 937   builder()->Add<HDeoptimize>(reason, Deoptimizer::EAGER);
 938   AddMergeAtJoinBlock(true);
 939 }
 940
 941
 942 void HGraphBuilder::IfBuilder::Return(HValue* value) {
 943   HValue* parameter_count = builder()->graph()->GetConstantMinus1();
 944   builder()->FinishExitCurrentBlock(
 945       builder()->New<HReturn>(value, parameter_count));
 946   AddMergeAtJoinBlock(false);
 947 }
 948
 949
 950 void HGraphBuilder::IfBuilder::AddMergeAtJoinBlock(bool deopt) {
 951   if (!pending_merge_block_) return;
 952   HBasicBlock* block = builder()->current_block();
 953   DCHECK(block == NULL || !block->IsFinished());
 954   MergeAtJoinBlock* record = new (builder()->zone())
 955       MergeAtJoinBlock(block, deopt, merge_at_join_blocks_);
 956   merge_at_join_blocks_ = record;
 957   if (block != NULL) {
 958     DCHECK(block->end() == NULL);
 959     if (deopt) {
 960       normal_merge_at_join_block_count_++;
 961     } else {
 962       deopt_merge_at_join_block_count_++;
 963     }
 964   }
 965   builder()->set_current_block(NULL);
 966   pending_merge_block_ = false;
 967 }
 968
 969
 970 void HGraphBuilder::IfBuilder::Finish() {
 971   DCHECK(!finished_);
 972   if (!did_then_) {
 973     Then();
 974   }
 975   AddMergeAtJoinBlock(false);
 976   if (!did_else_) {
 977     Else();
 978     AddMergeAtJoinBlock(false);
 979   }
 980   finished_ = true;
 981 }
 982
 983
 984 void HGraphBuilder::IfBuilder::Finish(HBasicBlock** then_continuation,
 985                                       HBasicBlock** else_continuation) {
 986   Finish();
 987
 988   MergeAtJoinBlock* else_record = merge_at_join_blocks_;
 989   if (else_continuation != NULL) {
 990     *else_continuation = else_record->block_;
 991   }
 992   MergeAtJoinBlock* then_record = else_record->next_;
 993   if (then_continuation != NULL) {
 994     *then_continuation = then_record->block_;
 995   }
 996   DCHECK(then_record->next_ == NULL);
 997 }
 998
 999
1000 void HGraphBuilder::IfBuilder::EndUnreachable() {
1001   if (captured_) return;
1002   Finish();
1003   builder()->set_current_block(nullptr);
1004 }
1005
1006
1007 void HGraphBuilder::IfBuilder::End() {
1008   if (captured_) return;
1009   Finish();
1010
1011   int total_merged_blocks = normal_merge_at_join_block_count_ +
1012     deopt_merge_at_join_block_count_;
1013   DCHECK(total_merged_blocks >= 1);
1014   HBasicBlock* merge_block =
1015       total_merged_blocks == 1 ? NULL : builder()->graph()->CreateBasicBlock();
1016
1017   // Merge non-deopt blocks first to ensure environment has right size for
1018   // padding.
1019   MergeAtJoinBlock* current = merge_at_join_blocks_;
1020   while (current != NULL) {
1021     if (!current->deopt_ && current->block_ != NULL) {
1022       // If there is only one block that makes it through to the end of the
1023       // if, then just set it as the current block and continue rather then
1024       // creating an unnecessary merge block.
1025       if (total_merged_blocks == 1) {
1026         builder()->set_current_block(current->block_);
1027         return;
1028       }
1029       builder()->GotoNoSimulate(current->block_, merge_block);
1030     }
1031     current = current->next_;
1032   }
1033
1034   // Merge deopt blocks, padding when necessary.
1035   current = merge_at_join_blocks_;
1036   while (current != NULL) {
1037     if (current->deopt_ && current->block_ != NULL) {
1038       current->block_->FinishExit(
1039           HAbnormalExit::New(builder()->isolate(), builder()->zone(), NULL),
1040           SourcePosition::Unknown());
1041     }
1042     current = current->next_;
1043   }
1044   builder()->set_current_block(merge_block);
1045 }
1046
1047
1048 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder) {
1049   Initialize(builder, NULL, kWhileTrue, NULL);
1050 }
1051
1052
1053 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1054                                         LoopBuilder::Direction direction) {
1055   Initialize(builder, context, direction, builder->graph()->GetConstant1());
1056 }
1057
1058
1059 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1060                                         LoopBuilder::Direction direction,
1061                                         HValue* increment_amount) {
1062   Initialize(builder, context, direction, increment_amount);
1063   increment_amount_ = increment_amount;
1064 }
1065
1066
1067 void HGraphBuilder::LoopBuilder::Initialize(HGraphBuilder* builder,
1068                                             HValue* context,
1069                                             Direction direction,
1070                                             HValue* increment_amount) {
1071   builder_ = builder;
1072   context_ = context;
1073   direction_ = direction;
1074   increment_amount_ = increment_amount;
1075
1076   finished_ = false;
1077   header_block_ = builder->CreateLoopHeaderBlock();
1078   body_block_ = NULL;
1079   exit_block_ = NULL;
1080   exit_trampoline_block_ = NULL;
1081 }
1082
1083
1084 HValue* HGraphBuilder::LoopBuilder::BeginBody(
1085     HValue* initial,
1086     HValue* terminating,
1087     Token::Value token) {
1088   DCHECK(direction_ != kWhileTrue);
1089   HEnvironment* env = builder_->environment();
1090   phi_ = header_block_->AddNewPhi(env->values()->length());
1091   phi_->AddInput(initial);
1092   env->Push(initial);
1093   builder_->GotoNoSimulate(header_block_);
1094
1095   HEnvironment* body_env = env->Copy();
1096   HEnvironment* exit_env = env->Copy();
1097   // Remove the phi from the expression stack
1098   body_env->Pop();
1099   exit_env->Pop();
1100   body_block_ = builder_->CreateBasicBlock(body_env);
1101   exit_block_ = builder_->CreateBasicBlock(exit_env);
1102
1103   builder_->set_current_block(header_block_);
1104   env->Pop();
1105   builder_->FinishCurrentBlock(builder_->New<HCompareNumericAndBranch>(
1106           phi_, terminating, token, body_block_, exit_block_));
1107
1108   builder_->set_current_block(body_block_);
1109   if (direction_ == kPreIncrement || direction_ == kPreDecrement) {
1110     Isolate* isolate = builder_->isolate();
1111     HValue* one = builder_->graph()->GetConstant1();
1112     if (direction_ == kPreIncrement) {
1113       increment_ = HAdd::New(isolate, zone(), context_, phi_, one);
1114     } else {
1115       increment_ = HSub::New(isolate, zone(), context_, phi_, one);
1116     }
1117     increment_->ClearFlag(HValue::kCanOverflow);
1118     builder_->AddInstruction(increment_);
1119     return increment_;
1120   } else {
1121     return phi_;
1122   }
1123 }
1124
1125
1126 void HGraphBuilder::LoopBuilder::BeginBody(int drop_count) {
1127   DCHECK(direction_ == kWhileTrue);
1128   HEnvironment* env = builder_->environment();
1129   builder_->GotoNoSimulate(header_block_);
1130   builder_->set_current_block(header_block_);
1131   env->Drop(drop_count);
1132 }
1133
1134
1135 void HGraphBuilder::LoopBuilder::Break() {
1136   if (exit_trampoline_block_ == NULL) {
1137     // Its the first time we saw a break.
1138     if (direction_ == kWhileTrue) {
1139       HEnvironment* env = builder_->environment()->Copy();
1140       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1141     } else {
1142       HEnvironment* env = exit_block_->last_environment()->Copy();
1143       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1144       builder_->GotoNoSimulate(exit_block_, exit_trampoline_block_);
1145     }
1146   }
1147
1148   builder_->GotoNoSimulate(exit_trampoline_block_);
1149   builder_->set_current_block(NULL);
1150 }
1151
1152
1153 void HGraphBuilder::LoopBuilder::EndBody() {
1154   DCHECK(!finished_);
1155
1156   if (direction_ == kPostIncrement || direction_ == kPostDecrement) {
1157     Isolate* isolate = builder_->isolate();
1158     if (direction_ == kPostIncrement) {
1159       increment_ =
1160           HAdd::New(isolate, zone(), context_, phi_, increment_amount_);
1161     } else {
1162       increment_ =
1163           HSub::New(isolate, zone(), context_, phi_, increment_amount_);
1164     }
1165     increment_->ClearFlag(HValue::kCanOverflow);
1166     builder_->AddInstruction(increment_);
1167   }
1168
1169   if (direction_ != kWhileTrue) {
1170     // Push the new increment value on the expression stack to merge into
1171     // the phi.
1172     builder_->environment()->Push(increment_);
1173   }
1174   HBasicBlock* last_block = builder_->current_block();
1175   builder_->GotoNoSimulate(last_block, header_block_);
1176   header_block_->loop_information()->RegisterBackEdge(last_block);
1177
1178   if (exit_trampoline_block_ != NULL) {
1179     builder_->set_current_block(exit_trampoline_block_);
1180   } else {
1181     builder_->set_current_block(exit_block_);
1182   }
1183   finished_ = true;
1184 }
1185
1186
1187 HGraph* HGraphBuilder::CreateGraph() {
1188   graph_ = new(zone()) HGraph(info_);
1189   if (FLAG_hydrogen_stats) isolate()->GetHStatistics()->Initialize(info_);
1190   CompilationPhase phase("H_Block building", info_);
1191   set_current_block(graph()->entry_block());
1192   if (!BuildGraph()) return NULL;
1193   graph()->FinalizeUniqueness();
1194   return graph_;
1195 }
1196
1197
1198 HInstruction* HGraphBuilder::AddInstruction(HInstruction* instr) {
1199   DCHECK(current_block() != NULL);
1200   DCHECK(!FLAG_hydrogen_track_positions ||
1201          !position_.IsUnknown() ||
1202          !info_->IsOptimizing());
1203   current_block()->AddInstruction(instr, source_position());
1204   if (graph()->IsInsideNoSideEffectsScope()) {
1205     instr->SetFlag(HValue::kHasNoObservableSideEffects);
1206   }
1207   return instr;
1208 }
1209
1210
1211 void HGraphBuilder::FinishCurrentBlock(HControlInstruction* last) {
1212   DCHECK(!FLAG_hydrogen_track_positions ||
1213          !info_->IsOptimizing() ||
1214          !position_.IsUnknown());
1215   current_block()->Finish(last, source_position());
1216   if (last->IsReturn() || last->IsAbnormalExit()) {
1217     set_current_block(NULL);
1218   }
1219 }
1220
1221
1222 void HGraphBuilder::FinishExitCurrentBlock(HControlInstruction* instruction) {
1223   DCHECK(!FLAG_hydrogen_track_positions || !info_->IsOptimizing() ||
1224          !position_.IsUnknown());
1225   current_block()->FinishExit(instruction, source_position());
1226   if (instruction->IsReturn() || instruction->IsAbnormalExit()) {
1227     set_current_block(NULL);
1228   }
1229 }
1230
1231
1232 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
1233   if (FLAG_native_code_counters && counter->Enabled()) {
1234     HValue* reference = Add<HConstant>(ExternalReference(counter));
1235     HValue* old_value =
1236         Add<HLoadNamedField>(reference, nullptr, HObjectAccess::ForCounter());
1237     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
1238     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
1239     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
1240                           new_value, STORE_TO_INITIALIZED_ENTRY);
1241   }
1242 }
1243
1244
1245 void HGraphBuilder::AddSimulate(BailoutId id,
1246                                 RemovableSimulate removable) {
1247   DCHECK(current_block() != NULL);
1248   DCHECK(!graph()->IsInsideNoSideEffectsScope());
1249   current_block()->AddNewSimulate(id, source_position(), removable);
1250 }
1251
1252
1253 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
1254   HBasicBlock* b = graph()->CreateBasicBlock();
1255   b->SetInitialEnvironment(env);
1256   return b;
1257 }
1258
1259
1260 HBasicBlock* HGraphBuilder::CreateLoopHeaderBlock() {
1261   HBasicBlock* header = graph()->CreateBasicBlock();
1262   HEnvironment* entry_env = environment()->CopyAsLoopHeader(header);
1263   header->SetInitialEnvironment(entry_env);
1264   header->AttachLoopInformation();
1265   return header;
1266 }
1267
1268
1269 HValue* HGraphBuilder::BuildGetElementsKind(HValue* object) {
1270   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
1271
1272   HValue* bit_field2 =
1273       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
1274   return BuildDecodeField<Map::ElementsKindBits>(bit_field2);
1275 }
1276
1277
1278 HValue* HGraphBuilder::BuildCheckHeapObject(HValue* obj) {
1279   if (obj->type().IsHeapObject()) return obj;
1280   return Add<HCheckHeapObject>(obj);
1281 }
1282
1283
1284 void HGraphBuilder::FinishExitWithHardDeoptimization(
1285     Deoptimizer::DeoptReason reason) {
1286   Add<HDeoptimize>(reason, Deoptimizer::EAGER);
1287   FinishExitCurrentBlock(New<HAbnormalExit>());
1288 }
1289
1290
1291 HValue* HGraphBuilder::BuildCheckString(HValue* string) {
1292   if (!string->type().IsString()) {
1293     DCHECK(!string->IsConstant() ||
1294            !HConstant::cast(string)->HasStringValue());
1295     BuildCheckHeapObject(string);
1296     return Add<HCheckInstanceType>(string, HCheckInstanceType::IS_STRING);
1297   }
1298   return string;
1299 }
1300
1301
1302 HValue* HGraphBuilder::BuildWrapReceiver(HValue* object, HValue* function) {
1303   if (object->type().IsJSObject()) return object;
1304   if (function->IsConstant() &&
1305       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
1306     Handle<JSFunction> f = Handle<JSFunction>::cast(
1307         HConstant::cast(function)->handle(isolate()));
1308     SharedFunctionInfo* shared = f->shared();
1309     if (is_strict(shared->language_mode()) || shared->native()) return object;
1310   }
1311   return Add<HWrapReceiver>(object, function);
1312 }
1313
1314
1315 HValue* HGraphBuilder::BuildCheckAndGrowElementsCapacity(
1316     HValue* object, HValue* elements, ElementsKind kind, HValue* length,
1317     HValue* capacity, HValue* key) {
1318   HValue* max_gap = Add<HConstant>(static_cast<int32_t>(JSObject::kMaxGap));
1319   HValue* max_capacity = AddUncasted<HAdd>(capacity, max_gap);
1320   Add<HBoundsCheck>(key, max_capacity);
1321
1322   HValue* new_capacity = BuildNewElementsCapacity(key);
1323   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind, kind,
1324                                                    length, new_capacity);
1325   return new_elements;
1326 }
1327
1328
1329 HValue* HGraphBuilder::BuildCheckForCapacityGrow(
1330     HValue* object,
1331     HValue* elements,
1332     ElementsKind kind,
1333     HValue* length,
1334     HValue* key,
1335     bool is_js_array,
1336     PropertyAccessType access_type) {
1337   IfBuilder length_checker(this);
1338
1339   Token::Value token = IsHoleyElementsKind(kind) ? Token::GTE : Token::EQ;
1340   length_checker.If<HCompareNumericAndBranch>(key, length, token);
1341
1342   length_checker.Then();
1343
1344   HValue* current_capacity = AddLoadFixedArrayLength(elements);
1345
1346   if (top_info()->IsStub()) {
1347     IfBuilder capacity_checker(this);
1348     capacity_checker.If<HCompareNumericAndBranch>(key, current_capacity,
1349                                                   Token::GTE);
1350     capacity_checker.Then();
1351     HValue* new_elements = BuildCheckAndGrowElementsCapacity(
1352         object, elements, kind, length, current_capacity, key);
1353     environment()->Push(new_elements);
1354     capacity_checker.Else();
1355     environment()->Push(elements);
1356     capacity_checker.End();
1357   } else {
1358     HValue* result = Add<HMaybeGrowElements>(
1359         object, elements, key, current_capacity, is_js_array, kind);
1360     environment()->Push(result);
1361   }
1362
1363   if (is_js_array) {
1364     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
1365     new_length->ClearFlag(HValue::kCanOverflow);
1366
1367     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
1368                           new_length);
1369   }
1370
1371   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
1372     HValue* checked_elements = environment()->Top();
1373
1374     // Write zero to ensure that the new element is initialized with some smi.
1375     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
1376   }
1377
1378   length_checker.Else();
1379   Add<HBoundsCheck>(key, length);
1380
1381   environment()->Push(elements);
1382   length_checker.End();
1383
1384   return environment()->Pop();
1385 }
1386
1387
1388 HValue* HGraphBuilder::BuildCopyElementsOnWrite(HValue* object,
1389                                                 HValue* elements,
1390                                                 ElementsKind kind,
1391                                                 HValue* length) {
1392   Factory* factory = isolate()->factory();
1393
1394   IfBuilder cow_checker(this);
1395
1396   cow_checker.If<HCompareMap>(elements, factory->fixed_cow_array_map());
1397   cow_checker.Then();
1398
1399   HValue* capacity = AddLoadFixedArrayLength(elements);
1400
1401   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
1402                                                    kind, length, capacity);
1403
1404   environment()->Push(new_elements);
1405
1406   cow_checker.Else();
1407
1408   environment()->Push(elements);
1409
1410   cow_checker.End();
1411
1412   return environment()->Pop();
1413 }
1414
1415
1416 void HGraphBuilder::BuildTransitionElementsKind(HValue* object,
1417                                                 HValue* map,
1418                                                 ElementsKind from_kind,
1419                                                 ElementsKind to_kind,
1420                                                 bool is_jsarray) {
1421   DCHECK(!IsFastHoleyElementsKind(from_kind) ||
1422          IsFastHoleyElementsKind(to_kind));
1423
1424   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
1425     Add<HTrapAllocationMemento>(object);
1426   }
1427
1428   if (!IsSimpleMapChangeTransition(from_kind, to_kind)) {
1429     HInstruction* elements = AddLoadElements(object);
1430
1431     HInstruction* empty_fixed_array = Add<HConstant>(
1432         isolate()->factory()->empty_fixed_array());
1433
1434     IfBuilder if_builder(this);
1435
1436     if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
1437
1438     if_builder.Then();
1439
1440     HInstruction* elements_length = AddLoadFixedArrayLength(elements);
1441
1442     HInstruction* array_length =
1443         is_jsarray
1444             ? Add<HLoadNamedField>(object, nullptr,
1445                                    HObjectAccess::ForArrayLength(from_kind))
1446             : elements_length;
1447
1448     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
1449                               array_length, elements_length);
1450
1451     if_builder.End();
1452   }
1453
1454   Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
1455 }
1456
1457
1458 void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
1459                                        int bit_field_mask) {
1460   // Check that the object isn't a smi.
1461   Add<HCheckHeapObject>(receiver);
1462
1463   // Get the map of the receiver.
1464   HValue* map =
1465       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1466
1467   // Check the instance type and if an access check is needed, this can be
1468   // done with a single load, since both bytes are adjacent in the map.
1469   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
1470   HValue* instance_type_and_bit_field =
1471       Add<HLoadNamedField>(map, nullptr, access);
1472
1473   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
1474   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
1475                                              instance_type_and_bit_field,
1476                                              mask);
1477   HValue* sub_result = AddUncasted<HSub>(and_result,
1478                                          Add<HConstant>(JS_OBJECT_TYPE));
1479   Add<HBoundsCheck>(sub_result,
1480                     Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
1481 }
1482
1483
1484 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
1485                                          HIfContinuation* join_continuation) {
1486   // The sometimes unintuitively backward ordering of the ifs below is
1487   // convoluted, but necessary.  All of the paths must guarantee that the
1488   // if-true of the continuation returns a smi element index and the if-false of
1489   // the continuation returns either a symbol or a unique string key. All other
1490   // object types cause a deopt to fall back to the runtime.
1491
1492   IfBuilder key_smi_if(this);
1493   key_smi_if.If<HIsSmiAndBranch>(key);
1494   key_smi_if.Then();
1495   {
1496     Push(key);  // Nothing to do, just continue to true of continuation.
1497   }
1498   key_smi_if.Else();
1499   {
1500     HValue* map = Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForMap());
1501     HValue* instance_type =
1502         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1503
1504     // Non-unique string, check for a string with a hash code that is actually
1505     // an index.
1506     STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
1507     IfBuilder not_string_or_name_if(this);
1508     not_string_or_name_if.If<HCompareNumericAndBranch>(
1509         instance_type,
1510         Add<HConstant>(LAST_UNIQUE_NAME_TYPE),
1511         Token::GT);
1512
1513     not_string_or_name_if.Then();
1514     {
1515       // Non-smi, non-Name, non-String: Try to convert to smi in case of
1516       // HeapNumber.
1517       // TODO(danno): This could call some variant of ToString
1518       Push(AddUncasted<HForceRepresentation>(key, Representation::Smi()));
1519     }
1520     not_string_or_name_if.Else();
1521     {
1522       // String or Name: check explicitly for Name, they can short-circuit
1523       // directly to unique non-index key path.
1524       IfBuilder not_symbol_if(this);
1525       not_symbol_if.If<HCompareNumericAndBranch>(
1526           instance_type,
1527           Add<HConstant>(SYMBOL_TYPE),
1528           Token::NE);
1529
1530       not_symbol_if.Then();
1531       {
1532         // String: check whether the String is a String of an index. If it is,
1533         // extract the index value from the hash.
1534         HValue* hash = Add<HLoadNamedField>(key, nullptr,
1535                                             HObjectAccess::ForNameHashField());
1536         HValue* not_index_mask = Add<HConstant>(static_cast<int>(
1537             String::kContainsCachedArrayIndexMask));
1538
1539         HValue* not_index_test = AddUncasted<HBitwise>(
1540             Token::BIT_AND, hash, not_index_mask);
1541
1542         IfBuilder string_index_if(this);
1543         string_index_if.If<HCompareNumericAndBranch>(not_index_test,
1544                                                      graph()->GetConstant0(),
1545                                                      Token::EQ);
1546         string_index_if.Then();
1547         {
1548           // String with index in hash: extract string and merge to index path.
1549           Push(BuildDecodeField<String::ArrayIndexValueBits>(hash));
1550         }
1551         string_index_if.Else();
1552         {
1553           // Key is a non-index String, check for uniqueness/internalization.
1554           // If it's not internalized yet, internalize it now.
1555           HValue* not_internalized_bit = AddUncasted<HBitwise>(
1556               Token::BIT_AND,
1557               instance_type,
1558               Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1559
1560           IfBuilder internalized(this);
1561           internalized.If<HCompareNumericAndBranch>(not_internalized_bit,
1562                                                     graph()->GetConstant0(),
1563                                                     Token::EQ);
1564           internalized.Then();
1565           Push(key);
1566
1567           internalized.Else();
1568           Add<HPushArguments>(key);
1569           HValue* intern_key = Add<HCallRuntime>(
1570               isolate()->factory()->empty_string(),
1571               Runtime::FunctionForId(Runtime::kInternalizeString), 1);
1572           Push(intern_key);
1573
1574           internalized.End();
1575           // Key guaranteed to be a unique string
1576         }
1577         string_index_if.JoinContinuation(join_continuation);
1578       }
1579       not_symbol_if.Else();
1580       {
1581         Push(key);  // Key is symbol
1582       }
1583       not_symbol_if.JoinContinuation(join_continuation);
1584     }
1585     not_string_or_name_if.JoinContinuation(join_continuation);
1586   }
1587   key_smi_if.JoinContinuation(join_continuation);
1588 }
1589
1590
1591 void HGraphBuilder::BuildNonGlobalObjectCheck(HValue* receiver) {
1592   // Get the the instance type of the receiver, and make sure that it is
1593   // not one of the global object types.
1594   HValue* map =
1595       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1596   HValue* instance_type =
1597       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1598   STATIC_ASSERT(JS_BUILTINS_OBJECT_TYPE == JS_GLOBAL_OBJECT_TYPE + 1);
1599   HValue* min_global_type = Add<HConstant>(JS_GLOBAL_OBJECT_TYPE);
1600   HValue* max_global_type = Add<HConstant>(JS_BUILTINS_OBJECT_TYPE);
1601
1602   IfBuilder if_global_object(this);
1603   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1604                                                 max_global_type,
1605                                                 Token::LTE);
1606   if_global_object.And();
1607   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1608                                                 min_global_type,
1609                                                 Token::GTE);
1610   if_global_object.ThenDeopt(Deoptimizer::kReceiverWasAGlobalObject);
1611   if_global_object.End();
1612 }
1613
1614
1615 void HGraphBuilder::BuildTestForDictionaryProperties(
1616     HValue* object,
1617     HIfContinuation* continuation) {
1618   HValue* properties = Add<HLoadNamedField>(
1619       object, nullptr, HObjectAccess::ForPropertiesPointer());
1620   HValue* properties_map =
1621       Add<HLoadNamedField>(properties, nullptr, HObjectAccess::ForMap());
1622   HValue* hash_map = Add<HLoadRoot>(Heap::kHashTableMapRootIndex);
1623   IfBuilder builder(this);
1624   builder.If<HCompareObjectEqAndBranch>(properties_map, hash_map);
1625   builder.CaptureContinuation(continuation);
1626 }
1627
1628
1629 HValue* HGraphBuilder::BuildKeyedLookupCacheHash(HValue* object,
1630                                                  HValue* key) {
1631   // Load the map of the receiver, compute the keyed lookup cache hash
1632   // based on 32 bits of the map pointer and the string hash.
1633   HValue* object_map =
1634       Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMapAsInteger32());
1635   HValue* shifted_map = AddUncasted<HShr>(
1636       object_map, Add<HConstant>(KeyedLookupCache::kMapHashShift));
1637   HValue* string_hash =
1638       Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForStringHashField());
1639   HValue* shifted_hash = AddUncasted<HShr>(
1640       string_hash, Add<HConstant>(String::kHashShift));
1641   HValue* xor_result = AddUncasted<HBitwise>(Token::BIT_XOR, shifted_map,
1642                                              shifted_hash);
1643   int mask = (KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask);
1644   return AddUncasted<HBitwise>(Token::BIT_AND, xor_result,
1645                                Add<HConstant>(mask));
1646 }
1647
1648
1649 HValue* HGraphBuilder::BuildElementIndexHash(HValue* index) {
1650   int32_t seed_value = static_cast<uint32_t>(isolate()->heap()->HashSeed());
1651   HValue* seed = Add<HConstant>(seed_value);
1652   HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, index, seed);
1653
1654   // hash = ~hash + (hash << 15);
1655   HValue* shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(15));
1656   HValue* not_hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash,
1657                                            graph()->GetConstantMinus1());
1658   hash = AddUncasted<HAdd>(shifted_hash, not_hash);
1659
1660   // hash = hash ^ (hash >> 12);
1661   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(12));
1662   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1663
1664   // hash = hash + (hash << 2);
1665   shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(2));
1666   hash = AddUncasted<HAdd>(hash, shifted_hash);
1667
1668   // hash = hash ^ (hash >> 4);
1669   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(4));
1670   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1671
1672   // hash = hash * 2057;
1673   hash = AddUncasted<HMul>(hash, Add<HConstant>(2057));
1674   hash->ClearFlag(HValue::kCanOverflow);
1675
1676   // hash = hash ^ (hash >> 16);
1677   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
1678   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1679 }
1680
1681
1682 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(
1683     HValue* receiver, HValue* elements, HValue* key, HValue* hash,
1684     LanguageMode language_mode) {
1685   HValue* capacity =
1686       Add<HLoadKeyed>(elements, Add<HConstant>(NameDictionary::kCapacityIndex),
1687                       nullptr, FAST_ELEMENTS);
1688
1689   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
1690   mask->ChangeRepresentation(Representation::Integer32());
1691   mask->ClearFlag(HValue::kCanOverflow);
1692
1693   HValue* entry = hash;
1694   HValue* count = graph()->GetConstant1();
1695   Push(entry);
1696   Push(count);
1697
1698   HIfContinuation return_or_loop_continuation(graph()->CreateBasicBlock(),
1699                                               graph()->CreateBasicBlock());
1700   HIfContinuation found_key_match_continuation(graph()->CreateBasicBlock(),
1701                                                graph()->CreateBasicBlock());
1702   LoopBuilder probe_loop(this);
1703   probe_loop.BeginBody(2);  // Drop entry, count from last environment to
1704                             // appease live range building without simulates.
1705
1706   count = Pop();
1707   entry = Pop();
1708   entry = AddUncasted<HBitwise>(Token::BIT_AND, entry, mask);
1709   int entry_size = SeededNumberDictionary::kEntrySize;
1710   HValue* base_index = AddUncasted<HMul>(entry, Add<HConstant>(entry_size));
1711   base_index->ClearFlag(HValue::kCanOverflow);
1712   int start_offset = SeededNumberDictionary::kElementsStartIndex;
1713   HValue* key_index =
1714       AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset));
1715   key_index->ClearFlag(HValue::kCanOverflow);
1716
1717   HValue* candidate_key =
1718       Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
1719   IfBuilder if_undefined(this);
1720   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
1721                                              graph()->GetConstantUndefined());
1722   if_undefined.Then();
1723   {
1724     // element == undefined means "not found". Call the runtime.
1725     // TODO(jkummerow): walk the prototype chain instead.
1726     Add<HPushArguments>(receiver, key);
1727     Push(Add<HCallRuntime>(
1728         isolate()->factory()->empty_string(),
1729         Runtime::FunctionForId(is_strong(language_mode)
1730                                    ? Runtime::kKeyedGetPropertyStrong
1731                                    : Runtime::kKeyedGetProperty),
1732         2));
1733   }
1734   if_undefined.Else();
1735   {
1736     IfBuilder if_match(this);
1737     if_match.If<HCompareObjectEqAndBranch>(candidate_key, key);
1738     if_match.Then();
1739     if_match.Else();
1740
1741     // Update non-internalized string in the dictionary with internalized key?
1742     IfBuilder if_update_with_internalized(this);
1743     HValue* smi_check =
1744         if_update_with_internalized.IfNot<HIsSmiAndBranch>(candidate_key);
1745     if_update_with_internalized.And();
1746     HValue* map = AddLoadMap(candidate_key, smi_check);
1747     HValue* instance_type =
1748         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1749     HValue* not_internalized_bit = AddUncasted<HBitwise>(
1750         Token::BIT_AND, instance_type,
1751         Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1752     if_update_with_internalized.If<HCompareNumericAndBranch>(
1753         not_internalized_bit, graph()->GetConstant0(), Token::NE);
1754     if_update_with_internalized.And();
1755     if_update_with_internalized.IfNot<HCompareObjectEqAndBranch>(
1756         candidate_key, graph()->GetConstantHole());
1757     if_update_with_internalized.AndIf<HStringCompareAndBranch>(candidate_key,
1758                                                                key, Token::EQ);
1759     if_update_with_internalized.Then();
1760     // Replace a key that is a non-internalized string by the equivalent
1761     // internalized string for faster further lookups.
1762     Add<HStoreKeyed>(elements, key_index, key, FAST_ELEMENTS);
1763     if_update_with_internalized.Else();
1764
1765     if_update_with_internalized.JoinContinuation(&found_key_match_continuation);
1766     if_match.JoinContinuation(&found_key_match_continuation);
1767
1768     IfBuilder found_key_match(this, &found_key_match_continuation);
1769     found_key_match.Then();
1770     // Key at current probe matches. Relevant bits in the |details| field must
1771     // be zero, otherwise the dictionary element requires special handling.
1772     HValue* details_index =
1773         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 2));
1774     details_index->ClearFlag(HValue::kCanOverflow);
1775     HValue* details =
1776         Add<HLoadKeyed>(elements, details_index, nullptr, FAST_ELEMENTS);
1777     int details_mask = PropertyDetails::TypeField::kMask;
1778     details = AddUncasted<HBitwise>(Token::BIT_AND, details,
1779                                     Add<HConstant>(details_mask));
1780     IfBuilder details_compare(this);
1781     details_compare.If<HCompareNumericAndBranch>(
1782         details, graph()->GetConstant0(), Token::EQ);
1783     details_compare.Then();
1784     HValue* result_index =
1785         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
1786     result_index->ClearFlag(HValue::kCanOverflow);
1787     Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
1788     details_compare.Else();
1789     Add<HPushArguments>(receiver, key);
1790     Push(Add<HCallRuntime>(
1791         isolate()->factory()->empty_string(),
1792         Runtime::FunctionForId(is_strong(language_mode)
1793                                    ? Runtime::kKeyedGetPropertyStrong
1794                                    : Runtime::kKeyedGetProperty),
1795         2));
1796     details_compare.End();
1797
1798     found_key_match.Else();
1799     found_key_match.JoinContinuation(&return_or_loop_continuation);
1800   }
1801   if_undefined.JoinContinuation(&return_or_loop_continuation);
1802
1803   IfBuilder return_or_loop(this, &return_or_loop_continuation);
1804   return_or_loop.Then();
1805   probe_loop.Break();
1806
1807   return_or_loop.Else();
1808   entry = AddUncasted<HAdd>(entry, count);
1809   entry->ClearFlag(HValue::kCanOverflow);
1810   count = AddUncasted<HAdd>(count, graph()->GetConstant1());
1811   count->ClearFlag(HValue::kCanOverflow);
1812   Push(entry);
1813   Push(count);
1814
1815   probe_loop.EndBody();
1816
1817   return_or_loop.End();
1818
1819   return Pop();
1820 }
1821
1822
1823 HValue* HGraphBuilder::BuildRegExpConstructResult(HValue* length,
1824                                                   HValue* index,
1825                                                   HValue* input) {
1826   NoObservableSideEffectsScope scope(this);
1827   HConstant* max_length = Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1828   Add<HBoundsCheck>(length, max_length);
1829
1830   // Generate size calculation code here in order to make it dominate
1831   // the JSRegExpResult allocation.
1832   ElementsKind elements_kind = FAST_ELEMENTS;
1833   HValue* size = BuildCalculateElementsSize(elements_kind, length);
1834
1835   // Allocate the JSRegExpResult and the FixedArray in one step.
1836   HValue* result = Add<HAllocate>(
1837       Add<HConstant>(JSRegExpResult::kSize), HType::JSArray(),
1838       NOT_TENURED, JS_ARRAY_TYPE);
1839
1840   // Initialize the JSRegExpResult header.
1841   HValue* global_object = Add<HLoadNamedField>(
1842       context(), nullptr,
1843       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1844   HValue* native_context = Add<HLoadNamedField>(
1845       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
1846   Add<HStoreNamedField>(
1847       result, HObjectAccess::ForMap(),
1848       Add<HLoadNamedField>(
1849           native_context, nullptr,
1850           HObjectAccess::ForContextSlot(Context::REGEXP_RESULT_MAP_INDEX)));
1851   HConstant* empty_fixed_array =
1852       Add<HConstant>(isolate()->factory()->empty_fixed_array());
1853   Add<HStoreNamedField>(
1854       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
1855       empty_fixed_array);
1856   Add<HStoreNamedField>(
1857       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1858       empty_fixed_array);
1859   Add<HStoreNamedField>(
1860       result, HObjectAccess::ForJSArrayOffset(JSArray::kLengthOffset), length);
1861
1862   // Initialize the additional fields.
1863   Add<HStoreNamedField>(
1864       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kIndexOffset),
1865       index);
1866   Add<HStoreNamedField>(
1867       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kInputOffset),
1868       input);
1869
1870   // Allocate and initialize the elements header.
1871   HAllocate* elements = BuildAllocateElements(elements_kind, size);
1872   BuildInitializeElementsHeader(elements, elements_kind, length);
1873
1874   if (!elements->has_size_upper_bound()) {
1875     HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
1876         elements_kind, max_length->Integer32Value());
1877     elements->set_size_upper_bound(size_in_bytes_upper_bound);
1878   }
1879
1880   Add<HStoreNamedField>(
1881       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1882       elements);
1883
1884   // Initialize the elements contents with undefined.
1885   BuildFillElementsWithValue(
1886       elements, elements_kind, graph()->GetConstant0(), length,
1887       graph()->GetConstantUndefined());
1888
1889   return result;
1890 }
1891
1892
1893 HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
1894   NoObservableSideEffectsScope scope(this);
1895
1896   // Convert constant numbers at compile time.
1897   if (object->IsConstant() && HConstant::cast(object)->HasNumberValue()) {
1898     Handle<Object> number = HConstant::cast(object)->handle(isolate());
1899     Handle<String> result = isolate()->factory()->NumberToString(number);
1900     return Add<HConstant>(result);
1901   }
1902
1903   // Create a joinable continuation.
1904   HIfContinuation found(graph()->CreateBasicBlock(),
1905                         graph()->CreateBasicBlock());
1906
1907   // Load the number string cache.
1908   HValue* number_string_cache =
1909       Add<HLoadRoot>(Heap::kNumberStringCacheRootIndex);
1910
1911   // Make the hash mask from the length of the number string cache. It
1912   // contains two elements (number and string) for each cache entry.
1913   HValue* mask = AddLoadFixedArrayLength(number_string_cache);
1914   mask->set_type(HType::Smi());
1915   mask = AddUncasted<HSar>(mask, graph()->GetConstant1());
1916   mask = AddUncasted<HSub>(mask, graph()->GetConstant1());
1917
1918   // Check whether object is a smi.
1919   IfBuilder if_objectissmi(this);
1920   if_objectissmi.If<HIsSmiAndBranch>(object);
1921   if_objectissmi.Then();
1922   {
1923     // Compute hash for smi similar to smi_get_hash().
1924     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
1925
1926     // Load the key.
1927     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1928     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1929                                   FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1930
1931     // Check if object == key.
1932     IfBuilder if_objectiskey(this);
1933     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
1934     if_objectiskey.Then();
1935     {
1936       // Make the key_index available.
1937       Push(key_index);
1938     }
1939     if_objectiskey.JoinContinuation(&found);
1940   }
1941   if_objectissmi.Else();
1942   {
1943     if (type->Is(Type::SignedSmall())) {
1944       if_objectissmi.Deopt(Deoptimizer::kExpectedSmi);
1945     } else {
1946       // Check if the object is a heap number.
1947       IfBuilder if_objectisnumber(this);
1948       HValue* objectisnumber = if_objectisnumber.If<HCompareMap>(
1949           object, isolate()->factory()->heap_number_map());
1950       if_objectisnumber.Then();
1951       {
1952         // Compute hash for heap number similar to double_get_hash().
1953         HValue* low = Add<HLoadNamedField>(
1954             object, objectisnumber,
1955             HObjectAccess::ForHeapNumberValueLowestBits());
1956         HValue* high = Add<HLoadNamedField>(
1957             object, objectisnumber,
1958             HObjectAccess::ForHeapNumberValueHighestBits());
1959         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
1960         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
1961
1962         // Load the key.
1963         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1964         HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1965                                       FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1966
1967         // Check if the key is a heap number and compare it with the object.
1968         IfBuilder if_keyisnotsmi(this);
1969         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
1970         if_keyisnotsmi.Then();
1971         {
1972           IfBuilder if_keyisheapnumber(this);
1973           if_keyisheapnumber.If<HCompareMap>(
1974               key, isolate()->factory()->heap_number_map());
1975           if_keyisheapnumber.Then();
1976           {
1977             // Check if values of key and object match.
1978             IfBuilder if_keyeqobject(this);
1979             if_keyeqobject.If<HCompareNumericAndBranch>(
1980                 Add<HLoadNamedField>(key, keyisnotsmi,
1981                                      HObjectAccess::ForHeapNumberValue()),
1982                 Add<HLoadNamedField>(object, objectisnumber,
1983                                      HObjectAccess::ForHeapNumberValue()),
1984                 Token::EQ);
1985             if_keyeqobject.Then();
1986             {
1987               // Make the key_index available.
1988               Push(key_index);
1989             }
1990             if_keyeqobject.JoinContinuation(&found);
1991           }
1992           if_keyisheapnumber.JoinContinuation(&found);
1993         }
1994         if_keyisnotsmi.JoinContinuation(&found);
1995       }
1996       if_objectisnumber.Else();
1997       {
1998         if (type->Is(Type::Number())) {
1999           if_objectisnumber.Deopt(Deoptimizer::kExpectedHeapNumber);
2000         }
2001       }
2002       if_objectisnumber.JoinContinuation(&found);
2003     }
2004   }
2005   if_objectissmi.JoinContinuation(&found);
2006
2007   // Check for cache hit.
2008   IfBuilder if_found(this, &found);
2009   if_found.Then();
2010   {
2011     // Count number to string operation in native code.
2012     AddIncrementCounter(isolate()->counters()->number_to_string_native());
2013
2014     // Load the value in case of cache hit.
2015     HValue* key_index = Pop();
2016     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
2017     Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
2018                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
2019   }
2020   if_found.Else();
2021   {
2022     // Cache miss, fallback to runtime.
2023     Add<HPushArguments>(object);
2024     Push(Add<HCallRuntime>(
2025             isolate()->factory()->empty_string(),
2026             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
2027             1));
2028   }
2029   if_found.End();
2030
2031   return Pop();
2032 }
2033
2034
2035 HValue* HGraphBuilder::BuildToObject(HValue* receiver) {
2036   NoObservableSideEffectsScope scope(this);
2037
2038   // Create a joinable continuation.
2039   HIfContinuation wrap(graph()->CreateBasicBlock(),
2040                        graph()->CreateBasicBlock());
2041
2042   // Determine the proper global constructor function required to wrap
2043   // {receiver} into a JSValue, unless {receiver} is already a {JSReceiver}, in
2044   // which case we just return it.  Deopts to Runtime::kToObject if {receiver}
2045   // is undefined or null.
2046   IfBuilder receiver_is_smi(this);
2047   receiver_is_smi.If<HIsSmiAndBranch>(receiver);
2048   receiver_is_smi.Then();
2049   {
2050     // Use global Number function.
2051     Push(Add<HConstant>(Context::NUMBER_FUNCTION_INDEX));
2052   }
2053   receiver_is_smi.Else();
2054   {
2055     // Determine {receiver} map and instance type.
2056     HValue* receiver_map =
2057         Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
2058     HValue* receiver_instance_type = Add<HLoadNamedField>(
2059         receiver_map, nullptr, HObjectAccess::ForMapInstanceType());
2060
2061     // First check whether {receiver} is already a spec object (fast case).
2062     IfBuilder receiver_is_not_spec_object(this);
2063     receiver_is_not_spec_object.If<HCompareNumericAndBranch>(
2064         receiver_instance_type, Add<HConstant>(FIRST_SPEC_OBJECT_TYPE),
2065         Token::LT);
2066     receiver_is_not_spec_object.Then();
2067     {
2068       // Load the constructor function index from the {receiver} map.
2069       HValue* constructor_function_index = Add<HLoadNamedField>(
2070           receiver_map, nullptr,
2071           HObjectAccess::ForMapInObjectPropertiesOrConstructorFunctionIndex());
2072
2073       // Check if {receiver} has a constructor (null and undefined have no
2074       // constructors, so we deoptimize to the runtime to throw an exception).
2075       IfBuilder constructor_function_index_is_invalid(this);
2076       constructor_function_index_is_invalid.If<HCompareNumericAndBranch>(
2077           constructor_function_index,
2078           Add<HConstant>(Map::kNoConstructorFunctionIndex), Token::EQ);
2079       constructor_function_index_is_invalid.ThenDeopt(
2080           Deoptimizer::kUndefinedOrNullInToObject);
2081       constructor_function_index_is_invalid.End();
2082
2083       // Use the global constructor function.
2084       Push(constructor_function_index);
2085     }
2086     receiver_is_not_spec_object.JoinContinuation(&wrap);
2087   }
2088   receiver_is_smi.JoinContinuation(&wrap);
2089
2090   // Wrap the receiver if necessary.
2091   IfBuilder if_wrap(this, &wrap);
2092   if_wrap.Then();
2093   {
2094     // Grab the constructor function index.
2095     HValue* constructor_index = Pop();
2096
2097     // Load native context.
2098     HValue* native_context = BuildGetNativeContext();
2099
2100     // Determine the initial map for the global constructor.
2101     HValue* constructor = Add<HLoadKeyed>(native_context, constructor_index,
2102                                           nullptr, FAST_ELEMENTS);
2103     HValue* constructor_initial_map = Add<HLoadNamedField>(
2104         constructor, nullptr, HObjectAccess::ForPrototypeOrInitialMap());
2105     // Allocate and initialize a JSValue wrapper.
2106     HValue* value =
2107         BuildAllocate(Add<HConstant>(JSValue::kSize), HType::JSObject(),
2108                       JS_VALUE_TYPE, HAllocationMode());
2109     Add<HStoreNamedField>(value, HObjectAccess::ForMap(),
2110                           constructor_initial_map);
2111     HValue* empty_fixed_array = Add<HLoadRoot>(Heap::kEmptyFixedArrayRootIndex);
2112     Add<HStoreNamedField>(value, HObjectAccess::ForPropertiesPointer(),
2113                           empty_fixed_array);
2114     Add<HStoreNamedField>(value, HObjectAccess::ForElementsPointer(),
2115                           empty_fixed_array);
2116     Add<HStoreNamedField>(value, HObjectAccess::ForObservableJSObjectOffset(
2117                                      JSValue::kValueOffset),
2118                           receiver);
2119     Push(value);
2120   }
2121   if_wrap.Else();
2122   { Push(receiver); }
2123   if_wrap.End();
2124   return Pop();
2125 }
2126
2127
2128 HAllocate* HGraphBuilder::BuildAllocate(
2129     HValue* object_size,
2130     HType type,
2131     InstanceType instance_type,
2132     HAllocationMode allocation_mode) {
2133   // Compute the effective allocation size.
2134   HValue* size = object_size;
2135   if (allocation_mode.CreateAllocationMementos()) {
2136     size = AddUncasted<HAdd>(size, Add<HConstant>(AllocationMemento::kSize));
2137     size->ClearFlag(HValue::kCanOverflow);
2138   }
2139
2140   // Perform the actual allocation.
2141   HAllocate* object = Add<HAllocate>(
2142       size, type, allocation_mode.GetPretenureMode(),
2143       instance_type, allocation_mode.feedback_site());
2144
2145   // Setup the allocation memento.
2146   if (allocation_mode.CreateAllocationMementos()) {
2147     BuildCreateAllocationMemento(
2148         object, object_size, allocation_mode.current_site());
2149   }
2150
2151   return object;
2152 }
2153
2154
2155 HValue* HGraphBuilder::BuildAddStringLengths(HValue* left_length,
2156                                              HValue* right_length) {
2157   // Compute the combined string length and check against max string length.
2158   HValue* length = AddUncasted<HAdd>(left_length, right_length);
2159   // Check that length <= kMaxLength <=> length < MaxLength + 1.
2160   HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
2161   Add<HBoundsCheck>(length, max_length);
2162   return length;
2163 }
2164
2165
2166 HValue* HGraphBuilder::BuildCreateConsString(
2167     HValue* length,
2168     HValue* left,
2169     HValue* right,
2170     HAllocationMode allocation_mode) {
2171   // Determine the string instance types.
2172   HInstruction* left_instance_type = AddLoadStringInstanceType(left);
2173   HInstruction* right_instance_type = AddLoadStringInstanceType(right);
2174
2175   // Allocate the cons string object. HAllocate does not care whether we
2176   // pass CONS_STRING_TYPE or CONS_ONE_BYTE_STRING_TYPE here, so we just use
2177   // CONS_STRING_TYPE here. Below we decide whether the cons string is
2178   // one-byte or two-byte and set the appropriate map.
2179   DCHECK(HAllocate::CompatibleInstanceTypes(CONS_STRING_TYPE,
2180                                             CONS_ONE_BYTE_STRING_TYPE));
2181   HAllocate* result = BuildAllocate(Add<HConstant>(ConsString::kSize),
2182                                     HType::String(), CONS_STRING_TYPE,
2183                                     allocation_mode);
2184
2185   // Compute intersection and difference of instance types.
2186   HValue* anded_instance_types = AddUncasted<HBitwise>(
2187       Token::BIT_AND, left_instance_type, right_instance_type);
2188   HValue* xored_instance_types = AddUncasted<HBitwise>(
2189       Token::BIT_XOR, left_instance_type, right_instance_type);
2190
2191   // We create a one-byte cons string if
2192   // 1. both strings are one-byte, or
2193   // 2. at least one of the strings is two-byte, but happens to contain only
2194   //    one-byte characters.
2195   // To do this, we check
2196   // 1. if both strings are one-byte, or if the one-byte data hint is set in
2197   //    both strings, or
2198   // 2. if one of the strings has the one-byte data hint set and the other
2199   //    string is one-byte.
2200   IfBuilder if_onebyte(this);
2201   STATIC_ASSERT(kOneByteStringTag != 0);
2202   STATIC_ASSERT(kOneByteDataHintMask != 0);
2203   if_onebyte.If<HCompareNumericAndBranch>(
2204       AddUncasted<HBitwise>(
2205           Token::BIT_AND, anded_instance_types,
2206           Add<HConstant>(static_cast<int32_t>(
2207                   kStringEncodingMask | kOneByteDataHintMask))),
2208       graph()->GetConstant0(), Token::NE);
2209   if_onebyte.Or();
2210   STATIC_ASSERT(kOneByteStringTag != 0 &&
2211                 kOneByteDataHintTag != 0 &&
2212                 kOneByteDataHintTag != kOneByteStringTag);
2213   if_onebyte.If<HCompareNumericAndBranch>(
2214       AddUncasted<HBitwise>(
2215           Token::BIT_AND, xored_instance_types,
2216           Add<HConstant>(static_cast<int32_t>(
2217                   kOneByteStringTag | kOneByteDataHintTag))),
2218       Add<HConstant>(static_cast<int32_t>(
2219               kOneByteStringTag | kOneByteDataHintTag)), Token::EQ);
2220   if_onebyte.Then();
2221   {
2222     // We can safely skip the write barrier for storing the map here.
2223     Add<HStoreNamedField>(
2224         result, HObjectAccess::ForMap(),
2225         Add<HConstant>(isolate()->factory()->cons_one_byte_string_map()));
2226   }
2227   if_onebyte.Else();
2228   {
2229     // We can safely skip the write barrier for storing the map here.
2230     Add<HStoreNamedField>(
2231         result, HObjectAccess::ForMap(),
2232         Add<HConstant>(isolate()->factory()->cons_string_map()));
2233   }
2234   if_onebyte.End();
2235
2236   // Initialize the cons string fields.
2237   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2238                         Add<HConstant>(String::kEmptyHashField));
2239   Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2240   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
2241   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
2242
2243   // Count the native string addition.
2244   AddIncrementCounter(isolate()->counters()->string_add_native());
2245
2246   return result;
2247 }
2248
2249
2250 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
2251                                             HValue* src_offset,
2252                                             String::Encoding src_encoding,
2253                                             HValue* dst,
2254                                             HValue* dst_offset,
2255                                             String::Encoding dst_encoding,
2256                                             HValue* length) {
2257   DCHECK(dst_encoding != String::ONE_BYTE_ENCODING ||
2258          src_encoding == String::ONE_BYTE_ENCODING);
2259   LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
2260   HValue* index = loop.BeginBody(graph()->GetConstant0(), length, Token::LT);
2261   {
2262     HValue* src_index = AddUncasted<HAdd>(src_offset, index);
2263     HValue* value =
2264         AddUncasted<HSeqStringGetChar>(src_encoding, src, src_index);
2265     HValue* dst_index = AddUncasted<HAdd>(dst_offset, index);
2266     Add<HSeqStringSetChar>(dst_encoding, dst, dst_index, value);
2267   }
2268   loop.EndBody();
2269 }
2270
2271
2272 HValue* HGraphBuilder::BuildObjectSizeAlignment(
2273     HValue* unaligned_size, int header_size) {
2274   DCHECK((header_size & kObjectAlignmentMask) == 0);
2275   HValue* size = AddUncasted<HAdd>(
2276       unaligned_size, Add<HConstant>(static_cast<int32_t>(
2277           header_size + kObjectAlignmentMask)));
2278   size->ClearFlag(HValue::kCanOverflow);
2279   return AddUncasted<HBitwise>(
2280       Token::BIT_AND, size, Add<HConstant>(static_cast<int32_t>(
2281           ~kObjectAlignmentMask)));
2282 }
2283
2284
2285 HValue* HGraphBuilder::BuildUncheckedStringAdd(
2286     HValue* left,
2287     HValue* right,
2288     HAllocationMode allocation_mode) {
2289   // Determine the string lengths.
2290   HValue* left_length = AddLoadStringLength(left);
2291   HValue* right_length = AddLoadStringLength(right);
2292
2293   // Compute the combined string length.
2294   HValue* length = BuildAddStringLengths(left_length, right_length);
2295
2296   // Do some manual constant folding here.
2297   if (left_length->IsConstant()) {
2298     HConstant* c_left_length = HConstant::cast(left_length);
2299     DCHECK_NE(0, c_left_length->Integer32Value());
2300     if (c_left_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2301       // The right string contains at least one character.
2302       return BuildCreateConsString(length, left, right, allocation_mode);
2303     }
2304   } else if (right_length->IsConstant()) {
2305     HConstant* c_right_length = HConstant::cast(right_length);
2306     DCHECK_NE(0, c_right_length->Integer32Value());
2307     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2308       // The left string contains at least one character.
2309       return BuildCreateConsString(length, left, right, allocation_mode);
2310     }
2311   }
2312
2313   // Check if we should create a cons string.
2314   IfBuilder if_createcons(this);
2315   if_createcons.If<HCompareNumericAndBranch>(
2316       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
2317   if_createcons.Then();
2318   {
2319     // Create a cons string.
2320     Push(BuildCreateConsString(length, left, right, allocation_mode));
2321   }
2322   if_createcons.Else();
2323   {
2324     // Determine the string instance types.
2325     HValue* left_instance_type = AddLoadStringInstanceType(left);
2326     HValue* right_instance_type = AddLoadStringInstanceType(right);
2327
2328     // Compute union and difference of instance types.
2329     HValue* ored_instance_types = AddUncasted<HBitwise>(
2330         Token::BIT_OR, left_instance_type, right_instance_type);
2331     HValue* xored_instance_types = AddUncasted<HBitwise>(
2332         Token::BIT_XOR, left_instance_type, right_instance_type);
2333
2334     // Check if both strings have the same encoding and both are
2335     // sequential.
2336     IfBuilder if_sameencodingandsequential(this);
2337     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2338         AddUncasted<HBitwise>(
2339             Token::BIT_AND, xored_instance_types,
2340             Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2341         graph()->GetConstant0(), Token::EQ);
2342     if_sameencodingandsequential.And();
2343     STATIC_ASSERT(kSeqStringTag == 0);
2344     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2345         AddUncasted<HBitwise>(
2346             Token::BIT_AND, ored_instance_types,
2347             Add<HConstant>(static_cast<int32_t>(kStringRepresentationMask))),
2348         graph()->GetConstant0(), Token::EQ);
2349     if_sameencodingandsequential.Then();
2350     {
2351       HConstant* string_map =
2352           Add<HConstant>(isolate()->factory()->string_map());
2353       HConstant* one_byte_string_map =
2354           Add<HConstant>(isolate()->factory()->one_byte_string_map());
2355
2356       // Determine map and size depending on whether result is one-byte string.
2357       IfBuilder if_onebyte(this);
2358       STATIC_ASSERT(kOneByteStringTag != 0);
2359       if_onebyte.If<HCompareNumericAndBranch>(
2360           AddUncasted<HBitwise>(
2361               Token::BIT_AND, ored_instance_types,
2362               Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2363           graph()->GetConstant0(), Token::NE);
2364       if_onebyte.Then();
2365       {
2366         // Allocate sequential one-byte string object.
2367         Push(length);
2368         Push(one_byte_string_map);
2369       }
2370       if_onebyte.Else();
2371       {
2372         // Allocate sequential two-byte string object.
2373         HValue* size = AddUncasted<HShl>(length, graph()->GetConstant1());
2374         size->ClearFlag(HValue::kCanOverflow);
2375         size->SetFlag(HValue::kUint32);
2376         Push(size);
2377         Push(string_map);
2378       }
2379       if_onebyte.End();
2380       HValue* map = Pop();
2381
2382       // Calculate the number of bytes needed for the characters in the
2383       // string while observing object alignment.
2384       STATIC_ASSERT((SeqString::kHeaderSize & kObjectAlignmentMask) == 0);
2385       HValue* size = BuildObjectSizeAlignment(Pop(), SeqString::kHeaderSize);
2386
2387       // Allocate the string object. HAllocate does not care whether we pass
2388       // STRING_TYPE or ONE_BYTE_STRING_TYPE here, so we just use STRING_TYPE.
2389       HAllocate* result = BuildAllocate(
2390           size, HType::String(), STRING_TYPE, allocation_mode);
2391       Add<HStoreNamedField>(result, HObjectAccess::ForMap(), map);
2392
2393       // Initialize the string fields.
2394       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2395                             Add<HConstant>(String::kEmptyHashField));
2396       Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2397
2398       // Copy characters to the result string.
2399       IfBuilder if_twobyte(this);
2400       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
2401       if_twobyte.Then();
2402       {
2403         // Copy characters from the left string.
2404         BuildCopySeqStringChars(
2405             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2406             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2407             left_length);
2408
2409         // Copy characters from the right string.
2410         BuildCopySeqStringChars(
2411             right, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2412             result, left_length, String::TWO_BYTE_ENCODING,
2413             right_length);
2414       }
2415       if_twobyte.Else();
2416       {
2417         // Copy characters from the left string.
2418         BuildCopySeqStringChars(
2419             left, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2420             result, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2421             left_length);
2422
2423         // Copy characters from the right string.
2424         BuildCopySeqStringChars(
2425             right, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2426             result, left_length, String::ONE_BYTE_ENCODING,
2427             right_length);
2428       }
2429       if_twobyte.End();
2430
2431       // Count the native string addition.
2432       AddIncrementCounter(isolate()->counters()->string_add_native());
2433
2434       // Return the sequential string.
2435       Push(result);
2436     }
2437     if_sameencodingandsequential.Else();
2438     {
2439       // Fallback to the runtime to add the two strings.
2440       Add<HPushArguments>(left, right);
2441       Push(Add<HCallRuntime>(isolate()->factory()->empty_string(),
2442                              Runtime::FunctionForId(Runtime::kStringAdd), 2));
2443     }
2444     if_sameencodingandsequential.End();
2445   }
2446   if_createcons.End();
2447
2448   return Pop();
2449 }
2450
2451
2452 HValue* HGraphBuilder::BuildStringAdd(
2453     HValue* left,
2454     HValue* right,
2455     HAllocationMode allocation_mode) {
2456   NoObservableSideEffectsScope no_effects(this);
2457
2458   // Determine string lengths.
2459   HValue* left_length = AddLoadStringLength(left);
2460   HValue* right_length = AddLoadStringLength(right);
2461
2462   // Check if left string is empty.
2463   IfBuilder if_leftempty(this);
2464   if_leftempty.If<HCompareNumericAndBranch>(
2465       left_length, graph()->GetConstant0(), Token::EQ);
2466   if_leftempty.Then();
2467   {
2468     // Count the native string addition.
2469     AddIncrementCounter(isolate()->counters()->string_add_native());
2470
2471     // Just return the right string.
2472     Push(right);
2473   }
2474   if_leftempty.Else();
2475   {
2476     // Check if right string is empty.
2477     IfBuilder if_rightempty(this);
2478     if_rightempty.If<HCompareNumericAndBranch>(
2479         right_length, graph()->GetConstant0(), Token::EQ);
2480     if_rightempty.Then();
2481     {
2482       // Count the native string addition.
2483       AddIncrementCounter(isolate()->counters()->string_add_native());
2484
2485       // Just return the left string.
2486       Push(left);
2487     }
2488     if_rightempty.Else();
2489     {
2490       // Add the two non-empty strings.
2491       Push(BuildUncheckedStringAdd(left, right, allocation_mode));
2492     }
2493     if_rightempty.End();
2494   }
2495   if_leftempty.End();
2496
2497   return Pop();
2498 }
2499
2500
2501 HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
2502     HValue* checked_object,
2503     HValue* key,
2504     HValue* val,
2505     bool is_js_array,
2506     ElementsKind elements_kind,
2507     PropertyAccessType access_type,
2508     LoadKeyedHoleMode load_mode,
2509     KeyedAccessStoreMode store_mode) {
2510   DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
2511          checked_object->IsCheckMaps());
2512   DCHECK(!IsFixedTypedArrayElementsKind(elements_kind) || !is_js_array);
2513   // No GVNFlag is necessary for ElementsKind if there is an explicit dependency
2514   // on a HElementsTransition instruction. The flag can also be removed if the
2515   // map to check has FAST_HOLEY_ELEMENTS, since there can be no further
2516   // ElementsKind transitions. Finally, the dependency can be removed for stores
2517   // for FAST_ELEMENTS, since a transition to HOLEY elements won't change the
2518   // generated store code.
2519   if ((elements_kind == FAST_HOLEY_ELEMENTS) ||
2520       (elements_kind == FAST_ELEMENTS && access_type == STORE)) {
2521     checked_object->ClearDependsOnFlag(kElementsKind);
2522   }
2523
2524   bool fast_smi_only_elements = IsFastSmiElementsKind(elements_kind);
2525   bool fast_elements = IsFastObjectElementsKind(elements_kind);
2526   HValue* elements = AddLoadElements(checked_object);
2527   if (access_type == STORE && (fast_elements || fast_smi_only_elements) &&
2528       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
2529     HCheckMaps* check_cow_map = Add<HCheckMaps>(
2530         elements, isolate()->factory()->fixed_array_map());
2531     check_cow_map->ClearDependsOnFlag(kElementsKind);
2532   }
2533   HInstruction* length = NULL;
2534   if (is_js_array) {
2535     length = Add<HLoadNamedField>(
2536         checked_object->ActualValue(), checked_object,
2537         HObjectAccess::ForArrayLength(elements_kind));
2538   } else {
2539     length = AddLoadFixedArrayLength(elements);
2540   }
2541   length->set_type(HType::Smi());
2542   HValue* checked_key = NULL;
2543   if (IsFixedTypedArrayElementsKind(elements_kind)) {
2544     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
2545
2546     HValue* external_pointer = Add<HLoadNamedField>(
2547         elements, nullptr,
2548         HObjectAccess::ForFixedTypedArrayBaseExternalPointer());
2549     HValue* base_pointer = Add<HLoadNamedField>(
2550         elements, nullptr, HObjectAccess::ForFixedTypedArrayBaseBasePointer());
2551     HValue* backing_store = AddUncasted<HAdd>(
2552         external_pointer, base_pointer, Strength::WEAK, AddOfExternalAndTagged);
2553
2554     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
2555       NoObservableSideEffectsScope no_effects(this);
2556       IfBuilder length_checker(this);
2557       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
2558       length_checker.Then();
2559       IfBuilder negative_checker(this);
2560       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
2561           key, graph()->GetConstant0(), Token::GTE);
2562       negative_checker.Then();
2563       HInstruction* result = AddElementAccess(
2564           backing_store, key, val, bounds_check, elements_kind, access_type);
2565       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
2566       negative_checker.End();
2567       length_checker.End();
2568       return result;
2569     } else {
2570       DCHECK(store_mode == STANDARD_STORE);
2571       checked_key = Add<HBoundsCheck>(key, length);
2572       return AddElementAccess(
2573           backing_store, checked_key, val,
2574           checked_object, elements_kind, access_type);
2575     }
2576   }
2577   DCHECK(fast_smi_only_elements ||
2578          fast_elements ||
2579          IsFastDoubleElementsKind(elements_kind));
2580
2581   // In case val is stored into a fast smi array, assure that the value is a smi
2582   // before manipulating the backing store. Otherwise the actual store may
2583   // deopt, leaving the backing store in an invalid state.
2584   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
2585       !val->type().IsSmi()) {
2586     val = AddUncasted<HForceRepresentation>(val, Representation::Smi());
2587   }
2588
2589   if (IsGrowStoreMode(store_mode)) {
2590     NoObservableSideEffectsScope no_effects(this);
2591     Representation representation = HStoreKeyed::RequiredValueRepresentation(
2592         elements_kind, STORE_TO_INITIALIZED_ENTRY);
2593     val = AddUncasted<HForceRepresentation>(val, representation);
2594     elements = BuildCheckForCapacityGrow(checked_object, elements,
2595                                          elements_kind, length, key,
2596                                          is_js_array, access_type);
2597     checked_key = key;
2598   } else {
2599     checked_key = Add<HBoundsCheck>(key, length);
2600
2601     if (access_type == STORE && (fast_elements || fast_smi_only_elements)) {
2602       if (store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
2603         NoObservableSideEffectsScope no_effects(this);
2604         elements = BuildCopyElementsOnWrite(checked_object, elements,
2605                                             elements_kind, length);
2606       } else {
2607         HCheckMaps* check_cow_map = Add<HCheckMaps>(
2608             elements, isolate()->factory()->fixed_array_map());
2609         check_cow_map->ClearDependsOnFlag(kElementsKind);
2610       }
2611     }
2612   }
2613   return AddElementAccess(elements, checked_key, val, checked_object,
2614                           elements_kind, access_type, load_mode);
2615 }
2616
2617
2618 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
2619     JSArrayBuilder* array_builder,
2620     HValue* length_argument) {
2621   if (length_argument->IsConstant() &&
2622       HConstant::cast(length_argument)->HasSmiValue()) {
2623     int array_length = HConstant::cast(length_argument)->Integer32Value();
2624     if (array_length == 0) {
2625       return array_builder->AllocateEmptyArray();
2626     } else {
2627       return array_builder->AllocateArray(length_argument,
2628                                           array_length,
2629                                           length_argument);
2630     }
2631   }
2632
2633   HValue* constant_zero = graph()->GetConstant0();
2634   HConstant* max_alloc_length =
2635       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
2636   HInstruction* checked_length = Add<HBoundsCheck>(length_argument,
2637                                                    max_alloc_length);
2638   IfBuilder if_builder(this);
2639   if_builder.If<HCompareNumericAndBranch>(checked_length, constant_zero,
2640                                           Token::EQ);
2641   if_builder.Then();
2642   const int initial_capacity = JSArray::kPreallocatedArrayElements;
2643   HConstant* initial_capacity_node = Add<HConstant>(initial_capacity);
2644   Push(initial_capacity_node);  // capacity
2645   Push(constant_zero);          // length
2646   if_builder.Else();
2647   if (!(top_info()->IsStub()) &&
2648       IsFastPackedElementsKind(array_builder->kind())) {
2649     // We'll come back later with better (holey) feedback.
2650     if_builder.Deopt(
2651         Deoptimizer::kHoleyArrayDespitePackedElements_kindFeedback);
2652   } else {
2653     Push(checked_length);         // capacity
2654     Push(checked_length);         // length
2655   }
2656   if_builder.End();
2657
2658   // Figure out total size
2659   HValue* length = Pop();
2660   HValue* capacity = Pop();
2661   return array_builder->AllocateArray(capacity, max_alloc_length, length);
2662 }
2663
2664
2665 HValue* HGraphBuilder::BuildCalculateElementsSize(ElementsKind kind,
2666                                                   HValue* capacity) {
2667   int elements_size = IsFastDoubleElementsKind(kind)
2668       ? kDoubleSize
2669       : kPointerSize;
2670
2671   HConstant* elements_size_value = Add<HConstant>(elements_size);
2672   HInstruction* mul =
2673       HMul::NewImul(isolate(), zone(), context(), capacity->ActualValue(),
2674                     elements_size_value);
2675   AddInstruction(mul);
2676   mul->ClearFlag(HValue::kCanOverflow);
2677
2678   STATIC_ASSERT(FixedDoubleArray::kHeaderSize == FixedArray::kHeaderSize);
2679
2680   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
2681   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
2682   total_size->ClearFlag(HValue::kCanOverflow);
2683   return total_size;
2684 }
2685
2686
2687 HAllocate* HGraphBuilder::AllocateJSArrayObject(AllocationSiteMode mode) {
2688   int base_size = JSArray::kSize;
2689   if (mode == TRACK_ALLOCATION_SITE) {
2690     base_size += AllocationMemento::kSize;
2691   }
2692   HConstant* size_in_bytes = Add<HConstant>(base_size);
2693   return Add<HAllocate>(
2694       size_in_bytes, HType::JSArray(), NOT_TENURED, JS_OBJECT_TYPE);
2695 }
2696
2697
2698 HConstant* HGraphBuilder::EstablishElementsAllocationSize(
2699     ElementsKind kind,
2700     int capacity) {
2701   int base_size = IsFastDoubleElementsKind(kind)
2702       ? FixedDoubleArray::SizeFor(capacity)
2703       : FixedArray::SizeFor(capacity);
2704
2705   return Add<HConstant>(base_size);
2706 }
2707
2708
2709 HAllocate* HGraphBuilder::BuildAllocateElements(ElementsKind kind,
2710                                                 HValue* size_in_bytes) {
2711   InstanceType instance_type = IsFastDoubleElementsKind(kind)
2712       ? FIXED_DOUBLE_ARRAY_TYPE
2713       : FIXED_ARRAY_TYPE;
2714
2715   return Add<HAllocate>(size_in_bytes, HType::HeapObject(), NOT_TENURED,
2716                         instance_type);
2717 }
2718
2719
2720 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
2721                                                   ElementsKind kind,
2722                                                   HValue* capacity) {
2723   Factory* factory = isolate()->factory();
2724   Handle<Map> map = IsFastDoubleElementsKind(kind)
2725       ? factory->fixed_double_array_map()
2726       : factory->fixed_array_map();
2727
2728   Add<HStoreNamedField>(elements, HObjectAccess::ForMap(), Add<HConstant>(map));
2729   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
2730                         capacity);
2731 }
2732
2733
2734 HValue* HGraphBuilder::BuildAllocateAndInitializeArray(ElementsKind kind,
2735                                                        HValue* capacity) {
2736   // The HForceRepresentation is to prevent possible deopt on int-smi
2737   // conversion after allocation but before the new object fields are set.
2738   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
2739   HValue* size_in_bytes = BuildCalculateElementsSize(kind, capacity);
2740   HValue* new_array = BuildAllocateElements(kind, size_in_bytes);
2741   BuildInitializeElementsHeader(new_array, kind, capacity);
2742   return new_array;
2743 }
2744
2745
2746 void HGraphBuilder::BuildJSArrayHeader(HValue* array,
2747                                        HValue* array_map,
2748                                        HValue* elements,
2749                                        AllocationSiteMode mode,
2750                                        ElementsKind elements_kind,
2751                                        HValue* allocation_site_payload,
2752                                        HValue* length_field) {
2753   Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
2754
2755   HConstant* empty_fixed_array =
2756     Add<HConstant>(isolate()->factory()->empty_fixed_array());
2757
2758   Add<HStoreNamedField>(
2759       array, HObjectAccess::ForPropertiesPointer(), empty_fixed_array);
2760
2761   Add<HStoreNamedField>(
2762       array, HObjectAccess::ForElementsPointer(),
2763       elements != NULL ? elements : empty_fixed_array);
2764
2765   Add<HStoreNamedField>(
2766       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
2767
2768   if (mode == TRACK_ALLOCATION_SITE) {
2769     BuildCreateAllocationMemento(
2770         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
2771   }
2772 }
2773
2774
2775 HInstruction* HGraphBuilder::AddElementAccess(
2776     HValue* elements,
2777     HValue* checked_key,
2778     HValue* val,
2779     HValue* dependency,
2780     ElementsKind elements_kind,
2781     PropertyAccessType access_type,
2782     LoadKeyedHoleMode load_mode) {
2783   if (access_type == STORE) {
2784     DCHECK(val != NULL);
2785     if (elements_kind == UINT8_CLAMPED_ELEMENTS) {
2786       val = Add<HClampToUint8>(val);
2787     }
2788     return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
2789                             STORE_TO_INITIALIZED_ENTRY);
2790   }
2791
2792   DCHECK(access_type == LOAD);
2793   DCHECK(val == NULL);
2794   HLoadKeyed* load = Add<HLoadKeyed>(
2795       elements, checked_key, dependency, elements_kind, load_mode);
2796   if (elements_kind == UINT32_ELEMENTS) {
2797     graph()->RecordUint32Instruction(load);
2798   }
2799   return load;
2800 }
2801
2802
2803 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
2804                                            HValue* dependency) {
2805   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
2806 }
2807
2808
2809 HLoadNamedField* HGraphBuilder::AddLoadElements(HValue* object,
2810                                                 HValue* dependency) {
2811   return Add<HLoadNamedField>(
2812       object, dependency, HObjectAccess::ForElementsPointer());
2813 }
2814
2815
2816 HLoadNamedField* HGraphBuilder::AddLoadFixedArrayLength(
2817     HValue* array,
2818     HValue* dependency) {
2819   return Add<HLoadNamedField>(
2820       array, dependency, HObjectAccess::ForFixedArrayLength());
2821 }
2822
2823
2824 HLoadNamedField* HGraphBuilder::AddLoadArrayLength(HValue* array,
2825                                                    ElementsKind kind,
2826                                                    HValue* dependency) {
2827   return Add<HLoadNamedField>(
2828       array, dependency, HObjectAccess::ForArrayLength(kind));
2829 }
2830
2831
2832 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* old_capacity) {
2833   HValue* half_old_capacity = AddUncasted<HShr>(old_capacity,
2834                                                 graph_->GetConstant1());
2835
2836   HValue* new_capacity = AddUncasted<HAdd>(half_old_capacity, old_capacity);
2837   new_capacity->ClearFlag(HValue::kCanOverflow);
2838
2839   HValue* min_growth = Add<HConstant>(16);
2840
2841   new_capacity = AddUncasted<HAdd>(new_capacity, min_growth);
2842   new_capacity->ClearFlag(HValue::kCanOverflow);
2843
2844   return new_capacity;
2845 }
2846
2847
2848 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
2849                                                  HValue* elements,
2850                                                  ElementsKind kind,
2851                                                  ElementsKind new_kind,
2852                                                  HValue* length,
2853                                                  HValue* new_capacity) {
2854   Add<HBoundsCheck>(new_capacity, Add<HConstant>(
2855           (Page::kMaxRegularHeapObjectSize - FixedArray::kHeaderSize) >>
2856           ElementsKindToShiftSize(new_kind)));
2857
2858   HValue* new_elements =
2859       BuildAllocateAndInitializeArray(new_kind, new_capacity);
2860
2861   BuildCopyElements(elements, kind, new_elements,
2862                     new_kind, length, new_capacity);
2863
2864   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
2865                         new_elements);
2866
2867   return new_elements;
2868 }
2869
2870
2871 void HGraphBuilder::BuildFillElementsWithValue(HValue* elements,
2872                                                ElementsKind elements_kind,
2873                                                HValue* from,
2874                                                HValue* to,
2875                                                HValue* value) {
2876   if (to == NULL) {
2877     to = AddLoadFixedArrayLength(elements);
2878   }
2879
2880   // Special loop unfolding case
2881   STATIC_ASSERT(JSArray::kPreallocatedArrayElements <=
2882                 kElementLoopUnrollThreshold);
2883   int initial_capacity = -1;
2884   if (from->IsInteger32Constant() && to->IsInteger32Constant()) {
2885     int constant_from = from->GetInteger32Constant();
2886     int constant_to = to->GetInteger32Constant();
2887
2888     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
2889       initial_capacity = constant_to;
2890     }
2891   }
2892
2893   if (initial_capacity >= 0) {
2894     for (int i = 0; i < initial_capacity; i++) {
2895       HInstruction* key = Add<HConstant>(i);
2896       Add<HStoreKeyed>(elements, key, value, elements_kind);
2897     }
2898   } else {
2899     // Carefully loop backwards so that the "from" remains live through the loop
2900     // rather than the to. This often corresponds to keeping length live rather
2901     // then capacity, which helps register allocation, since length is used more
2902     // other than capacity after filling with holes.
2903     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2904
2905     HValue* key = builder.BeginBody(to, from, Token::GT);
2906
2907     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
2908     adjusted_key->ClearFlag(HValue::kCanOverflow);
2909
2910     Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
2911
2912     builder.EndBody();
2913   }
2914 }
2915
2916
2917 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
2918                                               ElementsKind elements_kind,
2919                                               HValue* from,
2920                                               HValue* to) {
2921   // Fast elements kinds need to be initialized in case statements below cause a
2922   // garbage collection.
2923
2924   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
2925                      ? graph()->GetConstantHole()
2926                      : Add<HConstant>(HConstant::kHoleNaN);
2927
2928   // Since we're about to store a hole value, the store instruction below must
2929   // assume an elements kind that supports heap object values.
2930   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
2931     elements_kind = FAST_HOLEY_ELEMENTS;
2932   }
2933
2934   BuildFillElementsWithValue(elements, elements_kind, from, to, hole);
2935 }
2936
2937
2938 void HGraphBuilder::BuildCopyProperties(HValue* from_properties,
2939                                         HValue* to_properties, HValue* length,
2940                                         HValue* capacity) {
2941   ElementsKind kind = FAST_ELEMENTS;
2942
2943   BuildFillElementsWithValue(to_properties, kind, length, capacity,
2944                              graph()->GetConstantUndefined());
2945
2946   LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2947
2948   HValue* key = builder.BeginBody(length, graph()->GetConstant0(), Token::GT);
2949
2950   key = AddUncasted<HSub>(key, graph()->GetConstant1());
2951   key->ClearFlag(HValue::kCanOverflow);
2952
2953   HValue* element = Add<HLoadKeyed>(from_properties, key, nullptr, kind);
2954
2955   Add<HStoreKeyed>(to_properties, key, element, kind);
2956
2957   builder.EndBody();
2958 }
2959
2960
2961 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
2962                                       ElementsKind from_elements_kind,
2963                                       HValue* to_elements,
2964                                       ElementsKind to_elements_kind,
2965                                       HValue* length,
2966                                       HValue* capacity) {
2967   int constant_capacity = -1;
2968   if (capacity != NULL &&
2969       capacity->IsConstant() &&
2970       HConstant::cast(capacity)->HasInteger32Value()) {
2971     int constant_candidate = HConstant::cast(capacity)->Integer32Value();
2972     if (constant_candidate <= kElementLoopUnrollThreshold) {
2973       constant_capacity = constant_candidate;
2974     }
2975   }
2976
2977   bool pre_fill_with_holes =
2978     IsFastDoubleElementsKind(from_elements_kind) &&
2979     IsFastObjectElementsKind(to_elements_kind);
2980   if (pre_fill_with_holes) {
2981     // If the copy might trigger a GC, make sure that the FixedArray is
2982     // pre-initialized with holes to make sure that it's always in a
2983     // consistent state.
2984     BuildFillElementsWithHole(to_elements, to_elements_kind,
2985                               graph()->GetConstant0(), NULL);
2986   }
2987
2988   if (constant_capacity != -1) {
2989     // Unroll the loop for small elements kinds.
2990     for (int i = 0; i < constant_capacity; i++) {
2991       HValue* key_constant = Add<HConstant>(i);
2992       HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
2993                                             nullptr, from_elements_kind);
2994       Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
2995     }
2996   } else {
2997     if (!pre_fill_with_holes &&
2998         (capacity == NULL || !length->Equals(capacity))) {
2999       BuildFillElementsWithHole(to_elements, to_elements_kind,
3000                                 length, NULL);
3001     }
3002
3003     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
3004
3005     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
3006                                     Token::GT);
3007
3008     key = AddUncasted<HSub>(key, graph()->GetConstant1());
3009     key->ClearFlag(HValue::kCanOverflow);
3010
3011     HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr,
3012                                       from_elements_kind, ALLOW_RETURN_HOLE);
3013
3014     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
3015                          IsFastSmiElementsKind(to_elements_kind))
3016       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
3017
3018     if (IsHoleyElementsKind(from_elements_kind) &&
3019         from_elements_kind != to_elements_kind) {
3020       IfBuilder if_hole(this);
3021       if_hole.If<HCompareHoleAndBranch>(element);
3022       if_hole.Then();
3023       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
3024                                      ? Add<HConstant>(HConstant::kHoleNaN)
3025                                      : graph()->GetConstantHole();
3026       Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
3027       if_hole.Else();
3028       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3029       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3030       if_hole.End();
3031     } else {
3032       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
3033       store->SetFlag(HValue::kAllowUndefinedAsNaN);
3034     }
3035
3036     builder.EndBody();
3037   }
3038
3039   Counters* counters = isolate()->counters();
3040   AddIncrementCounter(counters->inlined_copied_elements());
3041 }
3042
3043
3044 HValue* HGraphBuilder::BuildCloneShallowArrayCow(HValue* boilerplate,
3045                                                  HValue* allocation_site,
3046                                                  AllocationSiteMode mode,
3047                                                  ElementsKind kind) {
3048   HAllocate* array = AllocateJSArrayObject(mode);
3049
3050   HValue* map = AddLoadMap(boilerplate);
3051   HValue* elements = AddLoadElements(boilerplate);
3052   HValue* length = AddLoadArrayLength(boilerplate, kind);
3053
3054   BuildJSArrayHeader(array,
3055                      map,
3056                      elements,
3057                      mode,
3058                      FAST_ELEMENTS,
3059                      allocation_site,
3060                      length);
3061   return array;
3062 }
3063
3064
3065 HValue* HGraphBuilder::BuildCloneShallowArrayEmpty(HValue* boilerplate,
3066                                                    HValue* allocation_site,
3067                                                    AllocationSiteMode mode) {
3068   HAllocate* array = AllocateJSArrayObject(mode);
3069
3070   HValue* map = AddLoadMap(boilerplate);
3071
3072   BuildJSArrayHeader(array,
3073                      map,
3074                      NULL,  // set elements to empty fixed array
3075                      mode,
3076                      FAST_ELEMENTS,
3077                      allocation_site,
3078                      graph()->GetConstant0());
3079   return array;
3080 }
3081
3082
3083 HValue* HGraphBuilder::BuildCloneShallowArrayNonEmpty(HValue* boilerplate,
3084                                                       HValue* allocation_site,
3085                                                       AllocationSiteMode mode,
3086                                                       ElementsKind kind) {
3087   HValue* boilerplate_elements = AddLoadElements(boilerplate);
3088   HValue* capacity = AddLoadFixedArrayLength(boilerplate_elements);
3089
3090   // Generate size calculation code here in order to make it dominate
3091   // the JSArray allocation.
3092   HValue* elements_size = BuildCalculateElementsSize(kind, capacity);
3093
3094   // Create empty JSArray object for now, store elimination should remove
3095   // redundant initialization of elements and length fields and at the same
3096   // time the object will be fully prepared for GC if it happens during
3097   // elements allocation.
3098   HValue* result = BuildCloneShallowArrayEmpty(
3099       boilerplate, allocation_site, mode);
3100
3101   HAllocate* elements = BuildAllocateElements(kind, elements_size);
3102
3103   // This function implicitly relies on the fact that the
3104   // FastCloneShallowArrayStub is called only for literals shorter than
3105   // JSObject::kInitialMaxFastElementArray.
3106   // Can't add HBoundsCheck here because otherwise the stub will eager a frame.
3107   HConstant* size_upper_bound = EstablishElementsAllocationSize(
3108       kind, JSObject::kInitialMaxFastElementArray);
3109   elements->set_size_upper_bound(size_upper_bound);
3110
3111   Add<HStoreNamedField>(result, HObjectAccess::ForElementsPointer(), elements);
3112
3113   // The allocation for the cloned array above causes register pressure on
3114   // machines with low register counts. Force a reload of the boilerplate
3115   // elements here to free up a register for the allocation to avoid unnecessary
3116   // spillage.
3117   boilerplate_elements = AddLoadElements(boilerplate);
3118   boilerplate_elements->SetFlag(HValue::kCantBeReplaced);
3119
3120   // Copy the elements array header.
3121   for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
3122     HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
3123     Add<HStoreNamedField>(
3124         elements, access,
3125         Add<HLoadNamedField>(boilerplate_elements, nullptr, access));
3126   }
3127
3128   // And the result of the length
3129   HValue* length = AddLoadArrayLength(boilerplate, kind);
3130   Add<HStoreNamedField>(result, HObjectAccess::ForArrayLength(kind), length);
3131
3132   BuildCopyElements(boilerplate_elements, kind, elements,
3133                     kind, length, NULL);
3134   return result;
3135 }
3136
3137
3138 void HGraphBuilder::BuildCompareNil(HValue* value, Type* type,
3139                                     HIfContinuation* continuation,
3140                                     MapEmbedding map_embedding) {
3141   IfBuilder if_nil(this);
3142   bool some_case_handled = false;
3143   bool some_case_missing = false;
3144
3145   if (type->Maybe(Type::Null())) {
3146     if (some_case_handled) if_nil.Or();
3147     if_nil.If<HCompareObjectEqAndBranch>(value, graph()->GetConstantNull());
3148     some_case_handled = true;
3149   } else {
3150     some_case_missing = true;
3151   }
3152
3153   if (type->Maybe(Type::Undefined())) {
3154     if (some_case_handled) if_nil.Or();
3155     if_nil.If<HCompareObjectEqAndBranch>(value,
3156                                          graph()->GetConstantUndefined());
3157     some_case_handled = true;
3158   } else {
3159     some_case_missing = true;
3160   }
3161
3162   if (type->Maybe(Type::Undetectable())) {
3163     if (some_case_handled) if_nil.Or();
3164     if_nil.If<HIsUndetectableAndBranch>(value);
3165     some_case_handled = true;
3166   } else {
3167     some_case_missing = true;
3168   }
3169
3170   if (some_case_missing) {
3171     if_nil.Then();
3172     if_nil.Else();
3173     if (type->NumClasses() == 1) {
3174       BuildCheckHeapObject(value);
3175       // For ICs, the map checked below is a sentinel map that gets replaced by
3176       // the monomorphic map when the code is used as a template to generate a
3177       // new IC. For optimized functions, there is no sentinel map, the map
3178       // emitted below is the actual monomorphic map.
3179       if (map_embedding == kEmbedMapsViaWeakCells) {
3180         HValue* cell =
3181             Add<HConstant>(Map::WeakCellForMap(type->Classes().Current()));
3182         HValue* expected_map = Add<HLoadNamedField>(
3183             cell, nullptr, HObjectAccess::ForWeakCellValue());
3184         HValue* map =
3185             Add<HLoadNamedField>(value, nullptr, HObjectAccess::ForMap());
3186         IfBuilder map_check(this);
3187         map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
3188         map_check.ThenDeopt(Deoptimizer::kUnknownMap);
3189         map_check.End();
3190       } else {
3191         DCHECK(map_embedding == kEmbedMapsDirectly);
3192         Add<HCheckMaps>(value, type->Classes().Current());
3193       }
3194     } else {
3195       if_nil.Deopt(Deoptimizer::kTooManyUndetectableTypes);
3196     }
3197   }
3198
3199   if_nil.CaptureContinuation(continuation);
3200 }
3201
3202
3203 void HGraphBuilder::BuildCreateAllocationMemento(
3204     HValue* previous_object,
3205     HValue* previous_object_size,
3206     HValue* allocation_site) {
3207   DCHECK(allocation_site != NULL);
3208   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
3209       previous_object, previous_object_size, HType::HeapObject());
3210   AddStoreMapConstant(
3211       allocation_memento, isolate()->factory()->allocation_memento_map());
3212   Add<HStoreNamedField>(
3213       allocation_memento,
3214       HObjectAccess::ForAllocationMementoSite(),
3215       allocation_site);
3216   if (FLAG_allocation_site_pretenuring) {
3217     HValue* memento_create_count =
3218         Add<HLoadNamedField>(allocation_site, nullptr,
3219                              HObjectAccess::ForAllocationSiteOffset(
3220                                  AllocationSite::kPretenureCreateCountOffset));
3221     memento_create_count = AddUncasted<HAdd>(
3222         memento_create_count, graph()->GetConstant1());
3223     // This smi value is reset to zero after every gc, overflow isn't a problem
3224     // since the counter is bounded by the new space size.
3225     memento_create_count->ClearFlag(HValue::kCanOverflow);
3226     Add<HStoreNamedField>(
3227         allocation_site, HObjectAccess::ForAllocationSiteOffset(
3228             AllocationSite::kPretenureCreateCountOffset), memento_create_count);
3229   }
3230 }
3231
3232
3233 HInstruction* HGraphBuilder::BuildGetNativeContext() {
3234   // Get the global object, then the native context
3235   HValue* global_object = Add<HLoadNamedField>(
3236       context(), nullptr,
3237       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3238   return Add<HLoadNamedField>(global_object, nullptr,
3239                               HObjectAccess::ForObservableJSObjectOffset(
3240                                   GlobalObject::kNativeContextOffset));
3241 }
3242
3243
3244 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
3245   // Get the global object, then the native context
3246   HInstruction* context = Add<HLoadNamedField>(
3247       closure, nullptr, HObjectAccess::ForFunctionContextPointer());
3248   HInstruction* global_object = Add<HLoadNamedField>(
3249       context, nullptr,
3250       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3251   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3252       GlobalObject::kNativeContextOffset);
3253   return Add<HLoadNamedField>(global_object, nullptr, access);
3254 }
3255
3256
3257 HInstruction* HGraphBuilder::BuildGetScriptContext(int context_index) {
3258   HValue* native_context = BuildGetNativeContext();
3259   HValue* script_context_table = Add<HLoadNamedField>(
3260       native_context, nullptr,
3261       HObjectAccess::ForContextSlot(Context::SCRIPT_CONTEXT_TABLE_INDEX));
3262   return Add<HLoadNamedField>(script_context_table, nullptr,
3263                               HObjectAccess::ForScriptContext(context_index));
3264 }
3265
3266
3267 HValue* HGraphBuilder::BuildGetParentContext(HValue* depth, int depth_value) {
3268   HValue* script_context = context();
3269   if (depth != NULL) {
3270     HValue* zero = graph()->GetConstant0();
3271
3272     Push(script_context);
3273     Push(depth);
3274
3275     LoopBuilder loop(this);
3276     loop.BeginBody(2);  // Drop script_context and depth from last environment
3277                         // to appease live range building without simulates.
3278     depth = Pop();
3279     script_context = Pop();
3280
3281     script_context = Add<HLoadNamedField>(
3282         script_context, nullptr,
3283         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3284     depth = AddUncasted<HSub>(depth, graph()->GetConstant1());
3285     depth->ClearFlag(HValue::kCanOverflow);
3286
3287     IfBuilder if_break(this);
3288     if_break.If<HCompareNumericAndBranch, HValue*>(depth, zero, Token::EQ);
3289     if_break.Then();
3290     {
3291       Push(script_context);  // The result.
3292       loop.Break();
3293     }
3294     if_break.Else();
3295     {
3296       Push(script_context);
3297       Push(depth);
3298     }
3299     loop.EndBody();
3300     if_break.End();
3301
3302     script_context = Pop();
3303   } else if (depth_value > 0) {
3304     // Unroll the above loop.
3305     for (int i = 0; i < depth_value; i++) {
3306       script_context = Add<HLoadNamedField>(
3307           script_context, nullptr,
3308           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3309     }
3310   }
3311   return script_context;
3312 }
3313
3314
3315 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
3316   HInstruction* native_context = BuildGetNativeContext();
3317   HInstruction* index =
3318       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
3319   return Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3320 }
3321
3322
3323 HValue* HGraphBuilder::BuildArrayBufferViewFieldAccessor(HValue* object,
3324                                                          HValue* checked_object,
3325                                                          FieldIndex index) {
3326   NoObservableSideEffectsScope scope(this);
3327   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3328       index.offset(), Representation::Tagged());
3329   HInstruction* buffer = Add<HLoadNamedField>(
3330       object, checked_object, HObjectAccess::ForJSArrayBufferViewBuffer());
3331   HInstruction* field = Add<HLoadNamedField>(object, checked_object, access);
3332
3333   HInstruction* flags = Add<HLoadNamedField>(
3334       buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
3335   HValue* was_neutered_mask =
3336       Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
3337   HValue* was_neutered_test =
3338       AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
3339
3340   IfBuilder if_was_neutered(this);
3341   if_was_neutered.If<HCompareNumericAndBranch>(
3342       was_neutered_test, graph()->GetConstant0(), Token::NE);
3343   if_was_neutered.Then();
3344   Push(graph()->GetConstant0());
3345   if_was_neutered.Else();
3346   Push(field);
3347   if_was_neutered.End();
3348
3349   return Pop();
3350 }
3351
3352
3353 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3354     ElementsKind kind,
3355     HValue* allocation_site_payload,
3356     HValue* constructor_function,
3357     AllocationSiteOverrideMode override_mode) :
3358         builder_(builder),
3359         kind_(kind),
3360         allocation_site_payload_(allocation_site_payload),
3361         constructor_function_(constructor_function) {
3362   DCHECK(!allocation_site_payload->IsConstant() ||
3363          HConstant::cast(allocation_site_payload)->handle(
3364              builder_->isolate())->IsAllocationSite());
3365   mode_ = override_mode == DISABLE_ALLOCATION_SITES
3366       ? DONT_TRACK_ALLOCATION_SITE
3367       : AllocationSite::GetMode(kind);
3368 }
3369
3370
3371 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3372                                               ElementsKind kind,
3373                                               HValue* constructor_function) :
3374     builder_(builder),
3375     kind_(kind),
3376     mode_(DONT_TRACK_ALLOCATION_SITE),
3377     allocation_site_payload_(NULL),
3378     constructor_function_(constructor_function) {
3379 }
3380
3381
3382 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode() {
3383   if (!builder()->top_info()->IsStub()) {
3384     // A constant map is fine.
3385     Handle<Map> map(builder()->isolate()->get_initial_js_array_map(kind_),
3386                     builder()->isolate());
3387     return builder()->Add<HConstant>(map);
3388   }
3389
3390   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
3391     // No need for a context lookup if the kind_ matches the initial
3392     // map, because we can just load the map in that case.
3393     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3394     return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3395                                            access);
3396   }
3397
3398   // TODO(mvstanton): we should always have a constructor function if we
3399   // are creating a stub.
3400   HInstruction* native_context = constructor_function_ != NULL
3401       ? builder()->BuildGetNativeContext(constructor_function_)
3402       : builder()->BuildGetNativeContext();
3403
3404   HInstruction* index = builder()->Add<HConstant>(
3405       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
3406
3407   HInstruction* map_array =
3408       builder()->Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3409
3410   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
3411
3412   return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr,
3413                                     FAST_ELEMENTS);
3414 }
3415
3416
3417 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
3418   // Find the map near the constructor function
3419   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3420   return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3421                                          access);
3422 }
3423
3424
3425 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
3426   HConstant* capacity = builder()->Add<HConstant>(initial_capacity());
3427   return AllocateArray(capacity,
3428                        capacity,
3429                        builder()->graph()->GetConstant0());
3430 }
3431
3432
3433 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3434     HValue* capacity,
3435     HConstant* capacity_upper_bound,
3436     HValue* length_field,
3437     FillMode fill_mode) {
3438   return AllocateArray(capacity,
3439                        capacity_upper_bound->GetInteger32Constant(),
3440                        length_field,
3441                        fill_mode);
3442 }
3443
3444
3445 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3446     HValue* capacity,
3447     int capacity_upper_bound,
3448     HValue* length_field,
3449     FillMode fill_mode) {
3450   HConstant* elememts_size_upper_bound = capacity->IsInteger32Constant()
3451       ? HConstant::cast(capacity)
3452       : builder()->EstablishElementsAllocationSize(kind_, capacity_upper_bound);
3453
3454   HAllocate* array = AllocateArray(capacity, length_field, fill_mode);
3455   if (!elements_location_->has_size_upper_bound()) {
3456     elements_location_->set_size_upper_bound(elememts_size_upper_bound);
3457   }
3458   return array;
3459 }
3460
3461
3462 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3463     HValue* capacity,
3464     HValue* length_field,
3465     FillMode fill_mode) {
3466   // These HForceRepresentations are because we store these as fields in the
3467   // objects we construct, and an int32-to-smi HChange could deopt. Accept
3468   // the deopt possibility now, before allocation occurs.
3469   capacity =
3470       builder()->AddUncasted<HForceRepresentation>(capacity,
3471                                                    Representation::Smi());
3472   length_field =
3473       builder()->AddUncasted<HForceRepresentation>(length_field,
3474                                                    Representation::Smi());
3475
3476   // Generate size calculation code here in order to make it dominate
3477   // the JSArray allocation.
3478   HValue* elements_size =
3479       builder()->BuildCalculateElementsSize(kind_, capacity);
3480
3481   // Allocate (dealing with failure appropriately)
3482   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
3483
3484   // Fill in the fields: map, properties, length
3485   HValue* map;
3486   if (allocation_site_payload_ == NULL) {
3487     map = EmitInternalMapCode();
3488   } else {
3489     map = EmitMapCode();
3490   }
3491
3492   builder()->BuildJSArrayHeader(array_object,
3493                                 map,
3494                                 NULL,  // set elements to empty fixed array
3495                                 mode_,
3496                                 kind_,
3497                                 allocation_site_payload_,
3498                                 length_field);
3499
3500   // Allocate and initialize the elements
3501   elements_location_ = builder()->BuildAllocateElements(kind_, elements_size);
3502
3503   builder()->BuildInitializeElementsHeader(elements_location_, kind_, capacity);
3504
3505   // Set the elements
3506   builder()->Add<HStoreNamedField>(
3507       array_object, HObjectAccess::ForElementsPointer(), elements_location_);
3508
3509   if (fill_mode == FILL_WITH_HOLE) {
3510     builder()->BuildFillElementsWithHole(elements_location_, kind_,
3511                                          graph()->GetConstant0(), capacity);
3512   }
3513
3514   return array_object;
3515 }
3516
3517
3518 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
3519   HValue* global_object = Add<HLoadNamedField>(
3520       context(), nullptr,
3521       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3522   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3523       GlobalObject::kBuiltinsOffset);
3524   HValue* builtins = Add<HLoadNamedField>(global_object, nullptr, access);
3525   HObjectAccess function_access = HObjectAccess::ForObservableJSObjectOffset(
3526           JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
3527   return Add<HLoadNamedField>(builtins, nullptr, function_access);
3528 }
3529
3530
3531 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
3532     : HGraphBuilder(info),
3533       function_state_(NULL),
3534       initial_function_state_(this, info, NORMAL_RETURN, 0),
3535       ast_context_(NULL),
3536       break_scope_(NULL),
3537       inlined_count_(0),
3538       globals_(10, info->zone()),
3539       osr_(new(info->zone()) HOsrBuilder(this)) {
3540   // This is not initialized in the initializer list because the
3541   // constructor for the initial state relies on function_state_ == NULL
3542   // to know it's the initial state.
3543   function_state_ = &initial_function_state_;
3544   InitializeAstVisitor(info->isolate(), info->zone());
3545   if (top_info()->is_tracking_positions()) {
3546     SetSourcePosition(info->shared_info()->start_position());
3547   }
3548 }
3549
3550
3551 HBasicBlock* HOptimizedGraphBuilder::CreateJoin(HBasicBlock* first,
3552                                                 HBasicBlock* second,
3553                                                 BailoutId join_id) {
3554   if (first == NULL) {
3555     return second;
3556   } else if (second == NULL) {
3557     return first;
3558   } else {
3559     HBasicBlock* join_block = graph()->CreateBasicBlock();
3560     Goto(first, join_block);
3561     Goto(second, join_block);
3562     join_block->SetJoinId(join_id);
3563     return join_block;
3564   }
3565 }
3566
3567
3568 HBasicBlock* HOptimizedGraphBuilder::JoinContinue(IterationStatement* statement,
3569                                                   HBasicBlock* exit_block,
3570                                                   HBasicBlock* continue_block) {
3571   if (continue_block != NULL) {
3572     if (exit_block != NULL) Goto(exit_block, continue_block);
3573     continue_block->SetJoinId(statement->ContinueId());
3574     return continue_block;
3575   }
3576   return exit_block;
3577 }
3578
3579
3580 HBasicBlock* HOptimizedGraphBuilder::CreateLoop(IterationStatement* statement,
3581                                                 HBasicBlock* loop_entry,
3582                                                 HBasicBlock* body_exit,
3583                                                 HBasicBlock* loop_successor,
3584                                                 HBasicBlock* break_block) {
3585   if (body_exit != NULL) Goto(body_exit, loop_entry);
3586   loop_entry->PostProcessLoopHeader(statement);
3587   if (break_block != NULL) {
3588     if (loop_successor != NULL) Goto(loop_successor, break_block);
3589     break_block->SetJoinId(statement->ExitId());
3590     return break_block;
3591   }
3592   return loop_successor;
3593 }
3594
3595
3596 // Build a new loop header block and set it as the current block.
3597 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry() {
3598   HBasicBlock* loop_entry = CreateLoopHeaderBlock();
3599   Goto(loop_entry);
3600   set_current_block(loop_entry);
3601   return loop_entry;
3602 }
3603
3604
3605 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry(
3606     IterationStatement* statement) {
3607   HBasicBlock* loop_entry = osr()->HasOsrEntryAt(statement)
3608       ? osr()->BuildOsrLoopEntry(statement)
3609       : BuildLoopEntry();
3610   return loop_entry;
3611 }
3612
3613
3614 void HBasicBlock::FinishExit(HControlInstruction* instruction,
3615                              SourcePosition position) {
3616   Finish(instruction, position);
3617   ClearEnvironment();
3618 }
3619
3620
3621 std::ostream& operator<<(std::ostream& os, const HBasicBlock& b) {
3622   return os << "B" << b.block_id();
3623 }
3624
3625
3626 HGraph::HGraph(CompilationInfo* info)
3627     : isolate_(info->isolate()),
3628       next_block_id_(0),
3629       entry_block_(NULL),
3630       blocks_(8, info->zone()),
3631       values_(16, info->zone()),
3632       phi_list_(NULL),
3633       uint32_instructions_(NULL),
3634       osr_(NULL),
3635       info_(info),
3636       zone_(info->zone()),
3637       is_recursive_(false),
3638       use_optimistic_licm_(false),
3639       depends_on_empty_array_proto_elements_(false),
3640       type_change_checksum_(0),
3641       maximum_environment_size_(0),
3642       no_side_effects_scope_count_(0),
3643       disallow_adding_new_values_(false) {
3644   if (info->IsStub()) {
3645     CallInterfaceDescriptor descriptor =
3646         info->code_stub()->GetCallInterfaceDescriptor();
3647     start_environment_ =
3648         new (zone_) HEnvironment(zone_, descriptor.GetRegisterParameterCount());
3649   } else {
3650     if (info->is_tracking_positions()) {
3651       info->TraceInlinedFunction(info->shared_info(), SourcePosition::Unknown(),
3652                                  InlinedFunctionInfo::kNoParentId);
3653     }
3654     start_environment_ =
3655         new(zone_) HEnvironment(NULL, info->scope(), info->closure(), zone_);
3656   }
3657   start_environment_->set_ast_id(BailoutId::FunctionEntry());
3658   entry_block_ = CreateBasicBlock();
3659   entry_block_->SetInitialEnvironment(start_environment_);
3660 }
3661
3662
3663 HBasicBlock* HGraph::CreateBasicBlock() {
3664   HBasicBlock* result = new(zone()) HBasicBlock(this);
3665   blocks_.Add(result, zone());
3666   return result;
3667 }
3668
3669
3670 void HGraph::FinalizeUniqueness() {
3671   DisallowHeapAllocation no_gc;
3672   for (int i = 0; i < blocks()->length(); ++i) {
3673     for (HInstructionIterator it(blocks()->at(i)); !it.Done(); it.Advance()) {
3674       it.Current()->FinalizeUniqueness();
3675     }
3676   }
3677 }
3678
3679
3680 int HGraph::SourcePositionToScriptPosition(SourcePosition pos) {
3681   return (FLAG_hydrogen_track_positions && !pos.IsUnknown())
3682              ? info()->start_position_for(pos.inlining_id()) + pos.position()
3683              : pos.raw();
3684 }
3685
3686
3687 // Block ordering was implemented with two mutually recursive methods,
3688 // HGraph::Postorder and HGraph::PostorderLoopBlocks.
3689 // The recursion could lead to stack overflow so the algorithm has been
3690 // implemented iteratively.
3691 // At a high level the algorithm looks like this:
3692 //
3693 // Postorder(block, loop_header) : {
3694 //   if (block has already been visited or is of another loop) return;
3695 //   mark block as visited;
3696 //   if (block is a loop header) {
3697 //     VisitLoopMembers(block, loop_header);
3698 //     VisitSuccessorsOfLoopHeader(block);
3699 //   } else {
3700 //     VisitSuccessors(block)
3701 //   }
3702 //   put block in result list;
3703 // }
3704 //
3705 // VisitLoopMembers(block, outer_loop_header) {
3706 //   foreach (block b in block loop members) {
3707 //     VisitSuccessorsOfLoopMember(b, outer_loop_header);
3708 //     if (b is loop header) VisitLoopMembers(b);
3709 //   }
3710 // }
3711 //
3712 // VisitSuccessorsOfLoopMember(block, outer_loop_header) {
3713 //   foreach (block b in block successors) Postorder(b, outer_loop_header)
3714 // }
3715 //
3716 // VisitSuccessorsOfLoopHeader(block) {
3717 //   foreach (block b in block successors) Postorder(b, block)
3718 // }
3719 //
3720 // VisitSuccessors(block, loop_header) {
3721 //   foreach (block b in block successors) Postorder(b, loop_header)
3722 // }
3723 //
3724 // The ordering is started calling Postorder(entry, NULL).
3725 //
3726 // Each instance of PostorderProcessor represents the "stack frame" of the
3727 // recursion, and particularly keeps the state of the loop (iteration) of the
3728 // "Visit..." function it represents.
3729 // To recycle memory we keep all the frames in a double linked list but
3730 // this means that we cannot use constructors to initialize the frames.
3731 //
3732 class PostorderProcessor : public ZoneObject {
3733  public:
3734   // Back link (towards the stack bottom).
3735   PostorderProcessor* parent() {return father_; }
3736   // Forward link (towards the stack top).
3737   PostorderProcessor* child() {return child_; }
3738   HBasicBlock* block() { return block_; }
3739   HLoopInformation* loop() { return loop_; }
3740   HBasicBlock* loop_header() { return loop_header_; }
3741
3742   static PostorderProcessor* CreateEntryProcessor(Zone* zone,
3743                                                   HBasicBlock* block) {
3744     PostorderProcessor* result = new(zone) PostorderProcessor(NULL);
3745     return result->SetupSuccessors(zone, block, NULL);
3746   }
3747
3748   PostorderProcessor* PerformStep(Zone* zone,
3749                                   ZoneList<HBasicBlock*>* order) {
3750     PostorderProcessor* next =
3751         PerformNonBacktrackingStep(zone, order);
3752     if (next != NULL) {
3753       return next;
3754     } else {
3755       return Backtrack(zone, order);
3756     }
3757   }
3758
3759  private:
3760   explicit PostorderProcessor(PostorderProcessor* father)
3761       : father_(father), child_(NULL), successor_iterator(NULL) { }
3762
3763   // Each enum value states the cycle whose state is kept by this instance.
3764   enum LoopKind {
3765     NONE,
3766     SUCCESSORS,
3767     SUCCESSORS_OF_LOOP_HEADER,
3768     LOOP_MEMBERS,
3769     SUCCESSORS_OF_LOOP_MEMBER
3770   };
3771
3772   // Each "Setup..." method is like a constructor for a cycle state.
3773   PostorderProcessor* SetupSuccessors(Zone* zone,
3774                                       HBasicBlock* block,
3775                                       HBasicBlock* loop_header) {
3776     if (block == NULL || block->IsOrdered() ||
3777         block->parent_loop_header() != loop_header) {
3778       kind_ = NONE;
3779       block_ = NULL;
3780       loop_ = NULL;
3781       loop_header_ = NULL;
3782       return this;
3783     } else {
3784       block_ = block;
3785       loop_ = NULL;
3786       block->MarkAsOrdered();
3787
3788       if (block->IsLoopHeader()) {
3789         kind_ = SUCCESSORS_OF_LOOP_HEADER;
3790         loop_header_ = block;
3791         InitializeSuccessors();
3792         PostorderProcessor* result = Push(zone);
3793         return result->SetupLoopMembers(zone, block, block->loop_information(),
3794                                         loop_header);
3795       } else {
3796         DCHECK(block->IsFinished());
3797         kind_ = SUCCESSORS;
3798         loop_header_ = loop_header;
3799         InitializeSuccessors();
3800         return this;
3801       }
3802     }
3803   }
3804
3805   PostorderProcessor* SetupLoopMembers(Zone* zone,
3806                                        HBasicBlock* block,
3807                                        HLoopInformation* loop,
3808                                        HBasicBlock* loop_header) {
3809     kind_ = LOOP_MEMBERS;
3810     block_ = block;
3811     loop_ = loop;
3812     loop_header_ = loop_header;
3813     InitializeLoopMembers();
3814     return this;
3815   }
3816
3817   PostorderProcessor* SetupSuccessorsOfLoopMember(
3818       HBasicBlock* block,
3819       HLoopInformation* loop,
3820       HBasicBlock* loop_header) {
3821     kind_ = SUCCESSORS_OF_LOOP_MEMBER;
3822     block_ = block;
3823     loop_ = loop;
3824     loop_header_ = loop_header;
3825     InitializeSuccessors();
3826     return this;
3827   }
3828
3829   // This method "allocates" a new stack frame.
3830   PostorderProcessor* Push(Zone* zone) {
3831     if (child_ == NULL) {
3832       child_ = new(zone) PostorderProcessor(this);
3833     }
3834     return child_;
3835   }
3836
3837   void ClosePostorder(ZoneList<HBasicBlock*>* order, Zone* zone) {
3838     DCHECK(block_->end()->FirstSuccessor() == NULL ||
3839            order->Contains(block_->end()->FirstSuccessor()) ||
3840            block_->end()->FirstSuccessor()->IsLoopHeader());
3841     DCHECK(block_->end()->SecondSuccessor() == NULL ||
3842            order->Contains(block_->end()->SecondSuccessor()) ||
3843            block_->end()->SecondSuccessor()->IsLoopHeader());
3844     order->Add(block_, zone);
3845   }
3846
3847   // This method is the basic block to walk up the stack.
3848   PostorderProcessor* Pop(Zone* zone,
3849                           ZoneList<HBasicBlock*>* order) {
3850     switch (kind_) {
3851       case SUCCESSORS:
3852       case SUCCESSORS_OF_LOOP_HEADER:
3853         ClosePostorder(order, zone);
3854         return father_;
3855       case LOOP_MEMBERS:
3856         return father_;
3857       case SUCCESSORS_OF_LOOP_MEMBER:
3858         if (block()->IsLoopHeader() && block() != loop_->loop_header()) {
3859           // In this case we need to perform a LOOP_MEMBERS cycle so we
3860           // initialize it and return this instead of father.
3861           return SetupLoopMembers(zone, block(),
3862                                   block()->loop_information(), loop_header_);
3863         } else {
3864           return father_;
3865         }
3866       case NONE:
3867         return father_;
3868     }
3869     UNREACHABLE();
3870     return NULL;
3871   }
3872
3873   // Walks up the stack.
3874   PostorderProcessor* Backtrack(Zone* zone,
3875                                 ZoneList<HBasicBlock*>* order) {
3876     PostorderProcessor* parent = Pop(zone, order);
3877     while (parent != NULL) {
3878       PostorderProcessor* next =
3879           parent->PerformNonBacktrackingStep(zone, order);
3880       if (next != NULL) {
3881         return next;
3882       } else {
3883         parent = parent->Pop(zone, order);
3884       }
3885     }
3886     return NULL;
3887   }
3888
3889   PostorderProcessor* PerformNonBacktrackingStep(
3890       Zone* zone,
3891       ZoneList<HBasicBlock*>* order) {
3892     HBasicBlock* next_block;
3893     switch (kind_) {
3894       case SUCCESSORS:
3895         next_block = AdvanceSuccessors();
3896         if (next_block != NULL) {
3897           PostorderProcessor* result = Push(zone);
3898           return result->SetupSuccessors(zone, next_block, loop_header_);
3899         }
3900         break;
3901       case SUCCESSORS_OF_LOOP_HEADER:
3902         next_block = AdvanceSuccessors();
3903         if (next_block != NULL) {
3904           PostorderProcessor* result = Push(zone);
3905           return result->SetupSuccessors(zone, next_block, block());
3906         }
3907         break;
3908       case LOOP_MEMBERS:
3909         next_block = AdvanceLoopMembers();
3910         if (next_block != NULL) {
3911           PostorderProcessor* result = Push(zone);
3912           return result->SetupSuccessorsOfLoopMember(next_block,
3913                                                      loop_, loop_header_);
3914         }
3915         break;
3916       case SUCCESSORS_OF_LOOP_MEMBER:
3917         next_block = AdvanceSuccessors();
3918         if (next_block != NULL) {
3919           PostorderProcessor* result = Push(zone);
3920           return result->SetupSuccessors(zone, next_block, loop_header_);
3921         }
3922         break;
3923       case NONE:
3924         return NULL;
3925     }
3926     return NULL;
3927   }
3928
3929   // The following two methods implement a "foreach b in successors" cycle.
3930   void InitializeSuccessors() {
3931     loop_index = 0;
3932     loop_length = 0;
3933     successor_iterator = HSuccessorIterator(block_->end());
3934   }
3935
3936   HBasicBlock* AdvanceSuccessors() {
3937     if (!successor_iterator.Done()) {
3938       HBasicBlock* result = successor_iterator.Current();
3939       successor_iterator.Advance();
3940       return result;
3941     }
3942     return NULL;
3943   }
3944
3945   // The following two methods implement a "foreach b in loop members" cycle.
3946   void InitializeLoopMembers() {
3947     loop_index = 0;
3948     loop_length = loop_->blocks()->length();
3949   }
3950
3951   HBasicBlock* AdvanceLoopMembers() {
3952     if (loop_index < loop_length) {
3953       HBasicBlock* result = loop_->blocks()->at(loop_index);
3954       loop_index++;
3955       return result;
3956     } else {
3957       return NULL;
3958     }
3959   }
3960
3961   LoopKind kind_;
3962   PostorderProcessor* father_;
3963   PostorderProcessor* child_;
3964   HLoopInformation* loop_;
3965   HBasicBlock* block_;
3966   HBasicBlock* loop_header_;
3967   int loop_index;
3968   int loop_length;
3969   HSuccessorIterator successor_iterator;
3970 };
3971
3972
3973 void HGraph::OrderBlocks() {
3974   CompilationPhase phase("H_Block ordering", info());
3975
3976 #ifdef DEBUG
3977   // Initially the blocks must not be ordered.
3978   for (int i = 0; i < blocks_.length(); ++i) {
3979     DCHECK(!blocks_[i]->IsOrdered());
3980   }
3981 #endif
3982
3983   PostorderProcessor* postorder =
3984       PostorderProcessor::CreateEntryProcessor(zone(), blocks_[0]);
3985   blocks_.Rewind(0);
3986   while (postorder) {
3987     postorder = postorder->PerformStep(zone(), &blocks_);
3988   }
3989
3990 #ifdef DEBUG
3991   // Now all blocks must be marked as ordered.
3992   for (int i = 0; i < blocks_.length(); ++i) {
3993     DCHECK(blocks_[i]->IsOrdered());
3994   }
3995 #endif
3996
3997   // Reverse block list and assign block IDs.
3998   for (int i = 0, j = blocks_.length(); --j >= i; ++i) {
3999     HBasicBlock* bi = blocks_[i];
4000     HBasicBlock* bj = blocks_[j];
4001     bi->set_block_id(j);
4002     bj->set_block_id(i);
4003     blocks_[i] = bj;
4004     blocks_[j] = bi;
4005   }
4006 }
4007
4008
4009 void HGraph::AssignDominators() {
4010   HPhase phase("H_Assign dominators", this);
4011   for (int i = 0; i < blocks_.length(); ++i) {
4012     HBasicBlock* block = blocks_[i];
4013     if (block->IsLoopHeader()) {
4014       // Only the first predecessor of a loop header is from outside the loop.
4015       // All others are back edges, and thus cannot dominate the loop header.
4016       block->AssignCommonDominator(block->predecessors()->first());
4017       block->AssignLoopSuccessorDominators();
4018     } else {
4019       for (int j = blocks_[i]->predecessors()->length() - 1; j >= 0; --j) {
4020         blocks_[i]->AssignCommonDominator(blocks_[i]->predecessors()->at(j));
4021       }
4022     }
4023   }
4024 }
4025
4026
4027 bool HGraph::CheckArgumentsPhiUses() {
4028   int block_count = blocks_.length();
4029   for (int i = 0; i < block_count; ++i) {
4030     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4031       HPhi* phi = blocks_[i]->phis()->at(j);
4032       // We don't support phi uses of arguments for now.
4033       if (phi->CheckFlag(HValue::kIsArguments)) return false;
4034     }
4035   }
4036   return true;
4037 }
4038
4039
4040 bool HGraph::CheckConstPhiUses() {
4041   int block_count = blocks_.length();
4042   for (int i = 0; i < block_count; ++i) {
4043     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4044       HPhi* phi = blocks_[i]->phis()->at(j);
4045       // Check for the hole value (from an uninitialized const).
4046       for (int k = 0; k < phi->OperandCount(); k++) {
4047         if (phi->OperandAt(k) == GetConstantHole()) return false;
4048       }
4049     }
4050   }
4051   return true;
4052 }
4053
4054
4055 void HGraph::CollectPhis() {
4056   int block_count = blocks_.length();
4057   phi_list_ = new(zone()) ZoneList<HPhi*>(block_count, zone());
4058   for (int i = 0; i < block_count; ++i) {
4059     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
4060       HPhi* phi = blocks_[i]->phis()->at(j);
4061       phi_list_->Add(phi, zone());
4062     }
4063   }
4064 }
4065
4066
4067 // Implementation of utility class to encapsulate the translation state for
4068 // a (possibly inlined) function.
4069 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
4070                              CompilationInfo* info, InliningKind inlining_kind,
4071                              int inlining_id)
4072     : owner_(owner),
4073       compilation_info_(info),
4074       call_context_(NULL),
4075       inlining_kind_(inlining_kind),
4076       function_return_(NULL),
4077       test_context_(NULL),
4078       entry_(NULL),
4079       arguments_object_(NULL),
4080       arguments_elements_(NULL),
4081       inlining_id_(inlining_id),
4082       outer_source_position_(SourcePosition::Unknown()),
4083       outer_(owner->function_state()) {
4084   if (outer_ != NULL) {
4085     // State for an inline function.
4086     if (owner->ast_context()->IsTest()) {
4087       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
4088       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
4089       if_true->MarkAsInlineReturnTarget(owner->current_block());
4090       if_false->MarkAsInlineReturnTarget(owner->current_block());
4091       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
4092       Expression* cond = outer_test_context->condition();
4093       // The AstContext constructor pushed on the context stack.  This newed
4094       // instance is the reason that AstContext can't be BASE_EMBEDDED.
4095       test_context_ = new TestContext(owner, cond, if_true, if_false);
4096     } else {
4097       function_return_ = owner->graph()->CreateBasicBlock();
4098       function_return()->MarkAsInlineReturnTarget(owner->current_block());
4099     }
4100     // Set this after possibly allocating a new TestContext above.
4101     call_context_ = owner->ast_context();
4102   }
4103
4104   // Push on the state stack.
4105   owner->set_function_state(this);
4106
4107   if (compilation_info_->is_tracking_positions()) {
4108     outer_source_position_ = owner->source_position();
4109     owner->EnterInlinedSource(
4110       info->shared_info()->start_position(),
4111       inlining_id);
4112     owner->SetSourcePosition(info->shared_info()->start_position());
4113   }
4114 }
4115
4116
4117 FunctionState::~FunctionState() {
4118   delete test_context_;
4119   owner_->set_function_state(outer_);
4120
4121   if (compilation_info_->is_tracking_positions()) {
4122     owner_->set_source_position(outer_source_position_);
4123     owner_->EnterInlinedSource(
4124       outer_->compilation_info()->shared_info()->start_position(),
4125       outer_->inlining_id());
4126   }
4127 }
4128
4129
4130 // Implementation of utility classes to represent an expression's context in
4131 // the AST.
4132 AstContext::AstContext(HOptimizedGraphBuilder* owner, Expression::Context kind)
4133     : owner_(owner),
4134       kind_(kind),
4135       outer_(owner->ast_context()),
4136       typeof_mode_(NOT_INSIDE_TYPEOF) {
4137   owner->set_ast_context(this);  // Push.
4138 #ifdef DEBUG
4139   DCHECK(owner->environment()->frame_type() == JS_FUNCTION);
4140   original_length_ = owner->environment()->length();
4141 #endif
4142 }
4143
4144
4145 AstContext::~AstContext() {
4146   owner_->set_ast_context(outer_);  // Pop.
4147 }
4148
4149
4150 EffectContext::~EffectContext() {
4151   DCHECK(owner()->HasStackOverflow() ||
4152          owner()->current_block() == NULL ||
4153          (owner()->environment()->length() == original_length_ &&
4154           owner()->environment()->frame_type() == JS_FUNCTION));
4155 }
4156
4157
4158 ValueContext::~ValueContext() {
4159   DCHECK(owner()->HasStackOverflow() ||
4160          owner()->current_block() == NULL ||
4161          (owner()->environment()->length() == original_length_ + 1 &&
4162           owner()->environment()->frame_type() == JS_FUNCTION));
4163 }
4164
4165
4166 void EffectContext::ReturnValue(HValue* value) {
4167   // The value is simply ignored.
4168 }
4169
4170
4171 void ValueContext::ReturnValue(HValue* value) {
4172   // The value is tracked in the bailout environment, and communicated
4173   // through the environment as the result of the expression.
4174   if (value->CheckFlag(HValue::kIsArguments)) {
4175     if (flag_ == ARGUMENTS_FAKED) {
4176       value = owner()->graph()->GetConstantUndefined();
4177     } else if (!arguments_allowed()) {
4178       owner()->Bailout(kBadValueContextForArgumentsValue);
4179     }
4180   }
4181   owner()->Push(value);
4182 }
4183
4184
4185 void TestContext::ReturnValue(HValue* value) {
4186   BuildBranch(value);
4187 }
4188
4189
4190 void EffectContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4191   DCHECK(!instr->IsControlInstruction());
4192   owner()->AddInstruction(instr);
4193   if (instr->HasObservableSideEffects()) {
4194     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4195   }
4196 }
4197
4198
4199 void EffectContext::ReturnControl(HControlInstruction* instr,
4200                                   BailoutId ast_id) {
4201   DCHECK(!instr->HasObservableSideEffects());
4202   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4203   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4204   instr->SetSuccessorAt(0, empty_true);
4205   instr->SetSuccessorAt(1, empty_false);
4206   owner()->FinishCurrentBlock(instr);
4207   HBasicBlock* join = owner()->CreateJoin(empty_true, empty_false, ast_id);
4208   owner()->set_current_block(join);
4209 }
4210
4211
4212 void EffectContext::ReturnContinuation(HIfContinuation* continuation,
4213                                        BailoutId ast_id) {
4214   HBasicBlock* true_branch = NULL;
4215   HBasicBlock* false_branch = NULL;
4216   continuation->Continue(&true_branch, &false_branch);
4217   if (!continuation->IsTrueReachable()) {
4218     owner()->set_current_block(false_branch);
4219   } else if (!continuation->IsFalseReachable()) {
4220     owner()->set_current_block(true_branch);
4221   } else {
4222     HBasicBlock* join = owner()->CreateJoin(true_branch, false_branch, ast_id);
4223     owner()->set_current_block(join);
4224   }
4225 }
4226
4227
4228 void ValueContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4229   DCHECK(!instr->IsControlInstruction());
4230   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4231     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4232   }
4233   owner()->AddInstruction(instr);
4234   owner()->Push(instr);
4235   if (instr->HasObservableSideEffects()) {
4236     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4237   }
4238 }
4239
4240
4241 void ValueContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4242   DCHECK(!instr->HasObservableSideEffects());
4243   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4244     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4245   }
4246   HBasicBlock* materialize_false = owner()->graph()->CreateBasicBlock();
4247   HBasicBlock* materialize_true = owner()->graph()->CreateBasicBlock();
4248   instr->SetSuccessorAt(0, materialize_true);
4249   instr->SetSuccessorAt(1, materialize_false);
4250   owner()->FinishCurrentBlock(instr);
4251   owner()->set_current_block(materialize_true);
4252   owner()->Push(owner()->graph()->GetConstantTrue());
4253   owner()->set_current_block(materialize_false);
4254   owner()->Push(owner()->graph()->GetConstantFalse());
4255   HBasicBlock* join =
4256     owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4257   owner()->set_current_block(join);
4258 }
4259
4260
4261 void ValueContext::ReturnContinuation(HIfContinuation* continuation,
4262                                       BailoutId ast_id) {
4263   HBasicBlock* materialize_true = NULL;
4264   HBasicBlock* materialize_false = NULL;
4265   continuation->Continue(&materialize_true, &materialize_false);
4266   if (continuation->IsTrueReachable()) {
4267     owner()->set_current_block(materialize_true);
4268     owner()->Push(owner()->graph()->GetConstantTrue());
4269     owner()->set_current_block(materialize_true);
4270   }
4271   if (continuation->IsFalseReachable()) {
4272     owner()->set_current_block(materialize_false);
4273     owner()->Push(owner()->graph()->GetConstantFalse());
4274     owner()->set_current_block(materialize_false);
4275   }
4276   if (continuation->TrueAndFalseReachable()) {
4277     HBasicBlock* join =
4278         owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4279     owner()->set_current_block(join);
4280   }
4281 }
4282
4283
4284 void TestContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4285   DCHECK(!instr->IsControlInstruction());
4286   HOptimizedGraphBuilder* builder = owner();
4287   builder->AddInstruction(instr);
4288   // We expect a simulate after every expression with side effects, though
4289   // this one isn't actually needed (and wouldn't work if it were targeted).
4290   if (instr->HasObservableSideEffects()) {
4291     builder->Push(instr);
4292     builder->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4293     builder->Pop();
4294   }
4295   BuildBranch(instr);
4296 }
4297
4298
4299 void TestContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4300   DCHECK(!instr->HasObservableSideEffects());
4301   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4302   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4303   instr->SetSuccessorAt(0, empty_true);
4304   instr->SetSuccessorAt(1, empty_false);
4305   owner()->FinishCurrentBlock(instr);
4306   owner()->Goto(empty_true, if_true(), owner()->function_state());
4307   owner()->Goto(empty_false, if_false(), owner()->function_state());
4308   owner()->set_current_block(NULL);
4309 }
4310
4311
4312 void TestContext::ReturnContinuation(HIfContinuation* continuation,
4313                                      BailoutId ast_id) {
4314   HBasicBlock* true_branch = NULL;
4315   HBasicBlock* false_branch = NULL;
4316   continuation->Continue(&true_branch, &false_branch);
4317   if (continuation->IsTrueReachable()) {
4318     owner()->Goto(true_branch, if_true(), owner()->function_state());
4319   }
4320   if (continuation->IsFalseReachable()) {
4321     owner()->Goto(false_branch, if_false(), owner()->function_state());
4322   }
4323   owner()->set_current_block(NULL);
4324 }
4325
4326
4327 void TestContext::BuildBranch(HValue* value) {
4328   // We expect the graph to be in edge-split form: there is no edge that
4329   // connects a branch node to a join node.  We conservatively ensure that
4330   // property by always adding an empty block on the outgoing edges of this
4331   // branch.
4332   HOptimizedGraphBuilder* builder = owner();
4333   if (value != NULL && value->CheckFlag(HValue::kIsArguments)) {
4334     builder->Bailout(kArgumentsObjectValueInATestContext);
4335   }
4336   ToBooleanStub::Types expected(condition()->to_boolean_types());
4337   ReturnControl(owner()->New<HBranch>(value, expected), BailoutId::None());
4338 }
4339
4340
4341 // HOptimizedGraphBuilder infrastructure for bailing out and checking bailouts.
4342 #define CHECK_BAILOUT(call)                     \
4343   do {                                          \
4344     call;                                       \
4345     if (HasStackOverflow()) return;             \
4346   } while (false)
4347
4348
4349 #define CHECK_ALIVE(call)                                       \
4350   do {                                                          \
4351     call;                                                       \
4352     if (HasStackOverflow() || current_block() == NULL) return;  \
4353   } while (false)
4354
4355
4356 #define CHECK_ALIVE_OR_RETURN(call, value)                            \
4357   do {                                                                \
4358     call;                                                             \
4359     if (HasStackOverflow() || current_block() == NULL) return value;  \
4360   } while (false)
4361
4362
4363 void HOptimizedGraphBuilder::Bailout(BailoutReason reason) {
4364   current_info()->AbortOptimization(reason);
4365   SetStackOverflow();
4366 }
4367
4368
4369 void HOptimizedGraphBuilder::VisitForEffect(Expression* expr) {
4370   EffectContext for_effect(this);
4371   Visit(expr);
4372 }
4373
4374
4375 void HOptimizedGraphBuilder::VisitForValue(Expression* expr,
4376                                            ArgumentsAllowedFlag flag) {
4377   ValueContext for_value(this, flag);
4378   Visit(expr);
4379 }
4380
4381
4382 void HOptimizedGraphBuilder::VisitForTypeOf(Expression* expr) {
4383   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
4384   for_value.set_typeof_mode(INSIDE_TYPEOF);
4385   Visit(expr);
4386 }
4387
4388
4389 void HOptimizedGraphBuilder::VisitForControl(Expression* expr,
4390                                              HBasicBlock* true_block,
4391                                              HBasicBlock* false_block) {
4392   TestContext for_test(this, expr, true_block, false_block);
4393   Visit(expr);
4394 }
4395
4396
4397 void HOptimizedGraphBuilder::VisitExpressions(
4398     ZoneList<Expression*>* exprs) {
4399   for (int i = 0; i < exprs->length(); ++i) {
4400     CHECK_ALIVE(VisitForValue(exprs->at(i)));
4401   }
4402 }
4403
4404
4405 void HOptimizedGraphBuilder::VisitExpressions(ZoneList<Expression*>* exprs,
4406                                               ArgumentsAllowedFlag flag) {
4407   for (int i = 0; i < exprs->length(); ++i) {
4408     CHECK_ALIVE(VisitForValue(exprs->at(i), flag));
4409   }
4410 }
4411
4412
4413 bool HOptimizedGraphBuilder::BuildGraph() {
4414   if (IsSubclassConstructor(current_info()->function()->kind())) {
4415     Bailout(kSuperReference);
4416     return false;
4417   }
4418
4419   int slots = current_info()->num_heap_slots() - Context::MIN_CONTEXT_SLOTS;
4420   if (current_info()->scope()->is_script_scope() && slots > 0) {
4421     Bailout(kScriptContext);
4422     return false;
4423   }
4424
4425   Scope* scope = current_info()->scope();
4426   SetUpScope(scope);
4427
4428   // Add an edge to the body entry.  This is warty: the graph's start
4429   // environment will be used by the Lithium translation as the initial
4430   // environment on graph entry, but it has now been mutated by the
4431   // Hydrogen translation of the instructions in the start block.  This
4432   // environment uses values which have not been defined yet.  These
4433   // Hydrogen instructions will then be replayed by the Lithium
4434   // translation, so they cannot have an environment effect.  The edge to
4435   // the body's entry block (along with some special logic for the start
4436   // block in HInstruction::InsertAfter) seals the start block from
4437   // getting unwanted instructions inserted.
4438   //
4439   // TODO(kmillikin): Fix this.  Stop mutating the initial environment.
4440   // Make the Hydrogen instructions in the initial block into Hydrogen
4441   // values (but not instructions), present in the initial environment and
4442   // not replayed by the Lithium translation.
4443   HEnvironment* initial_env = environment()->CopyWithoutHistory();
4444   HBasicBlock* body_entry = CreateBasicBlock(initial_env);
4445   Goto(body_entry);
4446   body_entry->SetJoinId(BailoutId::FunctionEntry());
4447   set_current_block(body_entry);
4448
4449   VisitDeclarations(scope->declarations());
4450   Add<HSimulate>(BailoutId::Declarations());
4451
4452   Add<HStackCheck>(HStackCheck::kFunctionEntry);
4453
4454   VisitStatements(current_info()->function()->body());
4455   if (HasStackOverflow()) return false;
4456
4457   if (current_block() != NULL) {
4458     Add<HReturn>(graph()->GetConstantUndefined());
4459     set_current_block(NULL);
4460   }
4461
4462   // If the checksum of the number of type info changes is the same as the
4463   // last time this function was compiled, then this recompile is likely not
4464   // due to missing/inadequate type feedback, but rather too aggressive
4465   // optimization. Disable optimistic LICM in that case.
4466   Handle<Code> unoptimized_code(current_info()->shared_info()->code());
4467   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
4468   Handle<TypeFeedbackInfo> type_info(
4469       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
4470   int checksum = type_info->own_type_change_checksum();
4471   int composite_checksum = graph()->update_type_change_checksum(checksum);
4472   graph()->set_use_optimistic_licm(
4473       !type_info->matches_inlined_type_change_checksum(composite_checksum));
4474   type_info->set_inlined_type_change_checksum(composite_checksum);
4475
4476   // Perform any necessary OSR-specific cleanups or changes to the graph.
4477   osr()->FinishGraph();
4478
4479   return true;
4480 }
4481
4482
4483 bool HGraph::Optimize(BailoutReason* bailout_reason) {
4484   OrderBlocks();
4485   AssignDominators();
4486
4487   // We need to create a HConstant "zero" now so that GVN will fold every
4488   // zero-valued constant in the graph together.
4489   // The constant is needed to make idef-based bounds check work: the pass
4490   // evaluates relations with "zero" and that zero cannot be created after GVN.
4491   GetConstant0();
4492
4493 #ifdef DEBUG
4494   // Do a full verify after building the graph and computing dominators.
4495   Verify(true);
4496 #endif
4497
4498   if (FLAG_analyze_environment_liveness && maximum_environment_size() != 0) {
4499     Run<HEnvironmentLivenessAnalysisPhase>();
4500   }
4501
4502   if (!CheckConstPhiUses()) {
4503     *bailout_reason = kUnsupportedPhiUseOfConstVariable;
4504     return false;
4505   }
4506   Run<HRedundantPhiEliminationPhase>();
4507   if (!CheckArgumentsPhiUses()) {
4508     *bailout_reason = kUnsupportedPhiUseOfArguments;
4509     return false;
4510   }
4511
4512   // Find and mark unreachable code to simplify optimizations, especially gvn,
4513   // where unreachable code could unnecessarily defeat LICM.
4514   Run<HMarkUnreachableBlocksPhase>();
4515
4516   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4517   if (FLAG_use_escape_analysis) Run<HEscapeAnalysisPhase>();
4518
4519   if (FLAG_load_elimination) Run<HLoadEliminationPhase>();
4520
4521   CollectPhis();
4522
4523   if (has_osr()) osr()->FinishOsrValues();
4524
4525   Run<HInferRepresentationPhase>();
4526
4527   // Remove HSimulate instructions that have turned out not to be needed
4528   // after all by folding them into the following HSimulate.
4529   // This must happen after inferring representations.
4530   Run<HMergeRemovableSimulatesPhase>();
4531
4532   Run<HMarkDeoptimizeOnUndefinedPhase>();
4533   Run<HRepresentationChangesPhase>();
4534
4535   Run<HInferTypesPhase>();
4536
4537   // Must be performed before canonicalization to ensure that Canonicalize
4538   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
4539   // zero.
4540   Run<HUint32AnalysisPhase>();
4541
4542   if (FLAG_use_canonicalizing) Run<HCanonicalizePhase>();
4543
4544   if (FLAG_use_gvn) Run<HGlobalValueNumberingPhase>();
4545
4546   if (FLAG_check_elimination) Run<HCheckEliminationPhase>();
4547
4548   if (FLAG_store_elimination) Run<HStoreEliminationPhase>();
4549
4550   Run<HRangeAnalysisPhase>();
4551
4552   Run<HComputeChangeUndefinedToNaN>();
4553
4554   // Eliminate redundant stack checks on backwards branches.
4555   Run<HStackCheckEliminationPhase>();
4556
4557   if (FLAG_array_bounds_checks_elimination) Run<HBoundsCheckEliminationPhase>();
4558   if (FLAG_array_bounds_checks_hoisting) Run<HBoundsCheckHoistingPhase>();
4559   if (FLAG_array_index_dehoisting) Run<HDehoistIndexComputationsPhase>();
4560   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4561
4562   RestoreActualValues();
4563
4564   // Find unreachable code a second time, GVN and other optimizations may have
4565   // made blocks unreachable that were previously reachable.
4566   Run<HMarkUnreachableBlocksPhase>();
4567
4568   return true;
4569 }
4570
4571
4572 void HGraph::RestoreActualValues() {
4573   HPhase phase("H_Restore actual values", this);
4574
4575   for (int block_index = 0; block_index < blocks()->length(); block_index++) {
4576     HBasicBlock* block = blocks()->at(block_index);
4577
4578 #ifdef DEBUG
4579     for (int i = 0; i < block->phis()->length(); i++) {
4580       HPhi* phi = block->phis()->at(i);
4581       DCHECK(phi->ActualValue() == phi);
4582     }
4583 #endif
4584
4585     for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
4586       HInstruction* instruction = it.Current();
4587       if (instruction->ActualValue() == instruction) continue;
4588       if (instruction->CheckFlag(HValue::kIsDead)) {
4589         // The instruction was marked as deleted but left in the graph
4590         // as a control flow dependency point for subsequent
4591         // instructions.
4592         instruction->DeleteAndReplaceWith(instruction->ActualValue());
4593       } else {
4594         DCHECK(instruction->IsInformativeDefinition());
4595         if (instruction->IsPurelyInformativeDefinition()) {
4596           instruction->DeleteAndReplaceWith(instruction->RedefinedOperand());
4597         } else {
4598           instruction->ReplaceAllUsesWith(instruction->ActualValue());
4599         }
4600       }
4601     }
4602   }
4603 }
4604
4605
4606 void HOptimizedGraphBuilder::PushArgumentsFromEnvironment(int count) {
4607   ZoneList<HValue*> arguments(count, zone());
4608   for (int i = 0; i < count; ++i) {
4609     arguments.Add(Pop(), zone());
4610   }
4611
4612   HPushArguments* push_args = New<HPushArguments>();
4613   while (!arguments.is_empty()) {
4614     push_args->AddInput(arguments.RemoveLast());
4615   }
4616   AddInstruction(push_args);
4617 }
4618
4619
4620 template <class Instruction>
4621 HInstruction* HOptimizedGraphBuilder::PreProcessCall(Instruction* call) {
4622   PushArgumentsFromEnvironment(call->argument_count());
4623   return call;
4624 }
4625
4626
4627 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
4628   // First special is HContext.
4629   HInstruction* context = Add<HContext>();
4630   environment()->BindContext(context);
4631
4632   // Create an arguments object containing the initial parameters.  Set the
4633   // initial values of parameters including "this" having parameter index 0.
4634   DCHECK_EQ(scope->num_parameters() + 1, environment()->parameter_count());
4635   HArgumentsObject* arguments_object =
4636       New<HArgumentsObject>(environment()->parameter_count());
4637   for (int i = 0; i < environment()->parameter_count(); ++i) {
4638     HInstruction* parameter = Add<HParameter>(i);
4639     arguments_object->AddArgument(parameter, zone());
4640     environment()->Bind(i, parameter);
4641   }
4642   AddInstruction(arguments_object);
4643   graph()->SetArgumentsObject(arguments_object);
4644
4645   HConstant* undefined_constant = graph()->GetConstantUndefined();
4646   // Initialize specials and locals to undefined.
4647   for (int i = environment()->parameter_count() + 1;
4648        i < environment()->length();
4649        ++i) {
4650     environment()->Bind(i, undefined_constant);
4651   }
4652
4653   // Handle the arguments and arguments shadow variables specially (they do
4654   // not have declarations).
4655   if (scope->arguments() != NULL) {
4656     environment()->Bind(scope->arguments(),
4657                         graph()->GetArgumentsObject());
4658   }
4659
4660   int rest_index;
4661   Variable* rest = scope->rest_parameter(&rest_index);
4662   if (rest) {
4663     return Bailout(kRestParameter);
4664   }
4665
4666   if (scope->this_function_var() != nullptr ||
4667       scope->new_target_var() != nullptr) {
4668     return Bailout(kSuperReference);
4669   }
4670 }
4671
4672
4673 void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>* statements) {
4674   for (int i = 0; i < statements->length(); i++) {
4675     Statement* stmt = statements->at(i);
4676     CHECK_ALIVE(Visit(stmt));
4677     if (stmt->IsJump()) break;
4678   }
4679 }
4680
4681
4682 void HOptimizedGraphBuilder::VisitBlock(Block* stmt) {
4683   DCHECK(!HasStackOverflow());
4684   DCHECK(current_block() != NULL);
4685   DCHECK(current_block()->HasPredecessor());
4686
4687   Scope* outer_scope = scope();
4688   Scope* scope = stmt->scope();
4689   BreakAndContinueInfo break_info(stmt, outer_scope);
4690
4691   { BreakAndContinueScope push(&break_info, this);
4692     if (scope != NULL) {
4693       if (scope->ContextLocalCount() > 0) {
4694         // Load the function object.
4695         Scope* declaration_scope = scope->DeclarationScope();
4696         HInstruction* function;
4697         HValue* outer_context = environment()->context();
4698         if (declaration_scope->is_script_scope() ||
4699             declaration_scope->is_eval_scope()) {
4700           function = new (zone())
4701               HLoadContextSlot(outer_context, Context::CLOSURE_INDEX,
4702                                HLoadContextSlot::kNoCheck);
4703         } else {
4704           function = New<HThisFunction>();
4705         }
4706         AddInstruction(function);
4707         // Allocate a block context and store it to the stack frame.
4708         HInstruction* inner_context = Add<HAllocateBlockContext>(
4709             outer_context, function, scope->GetScopeInfo(isolate()));
4710         HInstruction* instr = Add<HStoreFrameContext>(inner_context);
4711         set_scope(scope);
4712         environment()->BindContext(inner_context);
4713         if (instr->HasObservableSideEffects()) {
4714           AddSimulate(stmt->EntryId(), REMOVABLE_SIMULATE);
4715         }
4716       }
4717       VisitDeclarations(scope->declarations());
4718       AddSimulate(stmt->DeclsId(), REMOVABLE_SIMULATE);
4719     }
4720     CHECK_BAILOUT(VisitStatements(stmt->statements()));
4721   }
4722   set_scope(outer_scope);
4723   if (scope != NULL && current_block() != NULL &&
4724       scope->ContextLocalCount() > 0) {
4725     HValue* inner_context = environment()->context();
4726     HValue* outer_context = Add<HLoadNamedField>(
4727         inner_context, nullptr,
4728         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4729
4730     HInstruction* instr = Add<HStoreFrameContext>(outer_context);
4731     environment()->BindContext(outer_context);
4732     if (instr->HasObservableSideEffects()) {
4733       AddSimulate(stmt->ExitId(), REMOVABLE_SIMULATE);
4734     }
4735   }
4736   HBasicBlock* break_block = break_info.break_block();
4737   if (break_block != NULL) {
4738     if (current_block() != NULL) Goto(break_block);
4739     break_block->SetJoinId(stmt->ExitId());
4740     set_current_block(break_block);
4741   }
4742 }
4743
4744
4745 void HOptimizedGraphBuilder::VisitExpressionStatement(
4746     ExpressionStatement* stmt) {
4747   DCHECK(!HasStackOverflow());
4748   DCHECK(current_block() != NULL);
4749   DCHECK(current_block()->HasPredecessor());
4750   VisitForEffect(stmt->expression());
4751 }
4752
4753
4754 void HOptimizedGraphBuilder::VisitEmptyStatement(EmptyStatement* stmt) {
4755   DCHECK(!HasStackOverflow());
4756   DCHECK(current_block() != NULL);
4757   DCHECK(current_block()->HasPredecessor());
4758 }
4759
4760
4761 void HOptimizedGraphBuilder::VisitIfStatement(IfStatement* stmt) {
4762   DCHECK(!HasStackOverflow());
4763   DCHECK(current_block() != NULL);
4764   DCHECK(current_block()->HasPredecessor());
4765   if (stmt->condition()->ToBooleanIsTrue()) {
4766     Add<HSimulate>(stmt->ThenId());
4767     Visit(stmt->then_statement());
4768   } else if (stmt->condition()->ToBooleanIsFalse()) {
4769     Add<HSimulate>(stmt->ElseId());
4770     Visit(stmt->else_statement());
4771   } else {
4772     HBasicBlock* cond_true = graph()->CreateBasicBlock();
4773     HBasicBlock* cond_false = graph()->CreateBasicBlock();
4774     CHECK_BAILOUT(VisitForControl(stmt->condition(), cond_true, cond_false));
4775
4776     if (cond_true->HasPredecessor()) {
4777       cond_true->SetJoinId(stmt->ThenId());
4778       set_current_block(cond_true);
4779       CHECK_BAILOUT(Visit(stmt->then_statement()));
4780       cond_true = current_block();
4781     } else {
4782       cond_true = NULL;
4783     }
4784
4785     if (cond_false->HasPredecessor()) {
4786       cond_false->SetJoinId(stmt->ElseId());
4787       set_current_block(cond_false);
4788       CHECK_BAILOUT(Visit(stmt->else_statement()));
4789       cond_false = current_block();
4790     } else {
4791       cond_false = NULL;
4792     }
4793
4794     HBasicBlock* join = CreateJoin(cond_true, cond_false, stmt->IfId());
4795     set_current_block(join);
4796   }
4797 }
4798
4799
4800 HBasicBlock* HOptimizedGraphBuilder::BreakAndContinueScope::Get(
4801     BreakableStatement* stmt,
4802     BreakType type,
4803     Scope** scope,
4804     int* drop_extra) {
4805   *drop_extra = 0;
4806   BreakAndContinueScope* current = this;
4807   while (current != NULL && current->info()->target() != stmt) {
4808     *drop_extra += current->info()->drop_extra();
4809     current = current->next();
4810   }
4811   DCHECK(current != NULL);  // Always found (unless stack is malformed).
4812   *scope = current->info()->scope();
4813
4814   if (type == BREAK) {
4815     *drop_extra += current->info()->drop_extra();
4816   }
4817
4818   HBasicBlock* block = NULL;
4819   switch (type) {
4820     case BREAK:
4821       block = current->info()->break_block();
4822       if (block == NULL) {
4823         block = current->owner()->graph()->CreateBasicBlock();
4824         current->info()->set_break_block(block);
4825       }
4826       break;
4827
4828     case CONTINUE:
4829       block = current->info()->continue_block();
4830       if (block == NULL) {
4831         block = current->owner()->graph()->CreateBasicBlock();
4832         current->info()->set_continue_block(block);
4833       }
4834       break;
4835   }
4836
4837   return block;
4838 }
4839
4840
4841 void HOptimizedGraphBuilder::VisitContinueStatement(
4842     ContinueStatement* stmt) {
4843   DCHECK(!HasStackOverflow());
4844   DCHECK(current_block() != NULL);
4845   DCHECK(current_block()->HasPredecessor());
4846   Scope* outer_scope = NULL;
4847   Scope* inner_scope = scope();
4848   int drop_extra = 0;
4849   HBasicBlock* continue_block = break_scope()->Get(
4850       stmt->target(), BreakAndContinueScope::CONTINUE,
4851       &outer_scope, &drop_extra);
4852   HValue* context = environment()->context();
4853   Drop(drop_extra);
4854   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4855   if (context_pop_count > 0) {
4856     while (context_pop_count-- > 0) {
4857       HInstruction* context_instruction = Add<HLoadNamedField>(
4858           context, nullptr,
4859           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4860       context = context_instruction;
4861     }
4862     HInstruction* instr = Add<HStoreFrameContext>(context);
4863     if (instr->HasObservableSideEffects()) {
4864       AddSimulate(stmt->target()->EntryId(), REMOVABLE_SIMULATE);
4865     }
4866     environment()->BindContext(context);
4867   }
4868
4869   Goto(continue_block);
4870   set_current_block(NULL);
4871 }
4872
4873
4874 void HOptimizedGraphBuilder::VisitBreakStatement(BreakStatement* stmt) {
4875   DCHECK(!HasStackOverflow());
4876   DCHECK(current_block() != NULL);
4877   DCHECK(current_block()->HasPredecessor());
4878   Scope* outer_scope = NULL;
4879   Scope* inner_scope = scope();
4880   int drop_extra = 0;
4881   HBasicBlock* break_block = break_scope()->Get(
4882       stmt->target(), BreakAndContinueScope::BREAK,
4883       &outer_scope, &drop_extra);
4884   HValue* context = environment()->context();
4885   Drop(drop_extra);
4886   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4887   if (context_pop_count > 0) {
4888     while (context_pop_count-- > 0) {
4889       HInstruction* context_instruction = Add<HLoadNamedField>(
4890           context, nullptr,
4891           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4892       context = context_instruction;
4893     }
4894     HInstruction* instr = Add<HStoreFrameContext>(context);
4895     if (instr->HasObservableSideEffects()) {
4896       AddSimulate(stmt->target()->ExitId(), REMOVABLE_SIMULATE);
4897     }
4898     environment()->BindContext(context);
4899   }
4900   Goto(break_block);
4901   set_current_block(NULL);
4902 }
4903
4904
4905 void HOptimizedGraphBuilder::VisitReturnStatement(ReturnStatement* stmt) {
4906   DCHECK(!HasStackOverflow());
4907   DCHECK(current_block() != NULL);
4908   DCHECK(current_block()->HasPredecessor());
4909   FunctionState* state = function_state();
4910   AstContext* context = call_context();
4911   if (context == NULL) {
4912     // Not an inlined return, so an actual one.
4913     CHECK_ALIVE(VisitForValue(stmt->expression()));
4914     HValue* result = environment()->Pop();
4915     Add<HReturn>(result);
4916   } else if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
4917     // Return from an inlined construct call. In a test context the return value
4918     // will always evaluate to true, in a value context the return value needs
4919     // to be a JSObject.
4920     if (context->IsTest()) {
4921       TestContext* test = TestContext::cast(context);
4922       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4923       Goto(test->if_true(), state);
4924     } else if (context->IsEffect()) {
4925       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4926       Goto(function_return(), state);
4927     } else {
4928       DCHECK(context->IsValue());
4929       CHECK_ALIVE(VisitForValue(stmt->expression()));
4930       HValue* return_value = Pop();
4931       HValue* receiver = environment()->arguments_environment()->Lookup(0);
4932       HHasInstanceTypeAndBranch* typecheck =
4933           New<HHasInstanceTypeAndBranch>(return_value,
4934                                          FIRST_SPEC_OBJECT_TYPE,
4935                                          LAST_SPEC_OBJECT_TYPE);
4936       HBasicBlock* if_spec_object = graph()->CreateBasicBlock();
4937       HBasicBlock* not_spec_object = graph()->CreateBasicBlock();
4938       typecheck->SetSuccessorAt(0, if_spec_object);
4939       typecheck->SetSuccessorAt(1, not_spec_object);
4940       FinishCurrentBlock(typecheck);
4941       AddLeaveInlined(if_spec_object, return_value, state);
4942       AddLeaveInlined(not_spec_object, receiver, state);
4943     }
4944   } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
4945     // Return from an inlined setter call. The returned value is never used, the
4946     // value of an assignment is always the value of the RHS of the assignment.
4947     CHECK_ALIVE(VisitForEffect(stmt->expression()));
4948     if (context->IsTest()) {
4949       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4950       context->ReturnValue(rhs);
4951     } else if (context->IsEffect()) {
4952       Goto(function_return(), state);
4953     } else {
4954       DCHECK(context->IsValue());
4955       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4956       AddLeaveInlined(rhs, state);
4957     }
4958   } else {
4959     // Return from a normal inlined function. Visit the subexpression in the
4960     // expression context of the call.
4961     if (context->IsTest()) {
4962       TestContext* test = TestContext::cast(context);
4963       VisitForControl(stmt->expression(), test->if_true(), test->if_false());
4964     } else if (context->IsEffect()) {
4965       // Visit in value context and ignore the result. This is needed to keep
4966       // environment in sync with full-codegen since some visitors (e.g.
4967       // VisitCountOperation) use the operand stack differently depending on
4968       // context.
4969       CHECK_ALIVE(VisitForValue(stmt->expression()));
4970       Pop();
4971       Goto(function_return(), state);
4972     } else {
4973       DCHECK(context->IsValue());
4974       CHECK_ALIVE(VisitForValue(stmt->expression()));
4975       AddLeaveInlined(Pop(), state);
4976     }
4977   }
4978   set_current_block(NULL);
4979 }
4980
4981
4982 void HOptimizedGraphBuilder::VisitWithStatement(WithStatement* stmt) {
4983   DCHECK(!HasStackOverflow());
4984   DCHECK(current_block() != NULL);
4985   DCHECK(current_block()->HasPredecessor());
4986   return Bailout(kWithStatement);
4987 }
4988
4989
4990 void HOptimizedGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
4991   DCHECK(!HasStackOverflow());
4992   DCHECK(current_block() != NULL);
4993   DCHECK(current_block()->HasPredecessor());
4994
4995   ZoneList<CaseClause*>* clauses = stmt->cases();
4996   int clause_count = clauses->length();
4997   ZoneList<HBasicBlock*> body_blocks(clause_count, zone());
4998
4999   CHECK_ALIVE(VisitForValue(stmt->tag()));
5000   Add<HSimulate>(stmt->EntryId());
5001   HValue* tag_value = Top();
5002   Type* tag_type = stmt->tag()->bounds().lower;
5003
5004   // 1. Build all the tests, with dangling true branches
5005   BailoutId default_id = BailoutId::None();
5006   for (int i = 0; i < clause_count; ++i) {
5007     CaseClause* clause = clauses->at(i);
5008     if (clause->is_default()) {
5009       body_blocks.Add(NULL, zone());
5010       if (default_id.IsNone()) default_id = clause->EntryId();
5011       continue;
5012     }
5013
5014     // Generate a compare and branch.
5015     CHECK_ALIVE(VisitForValue(clause->label()));
5016     HValue* label_value = Pop();
5017
5018     Type* label_type = clause->label()->bounds().lower;
5019     Type* combined_type = clause->compare_type();
5020     HControlInstruction* compare = BuildCompareInstruction(
5021         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
5022         combined_type,
5023         ScriptPositionToSourcePosition(stmt->tag()->position()),
5024         ScriptPositionToSourcePosition(clause->label()->position()),
5025         PUSH_BEFORE_SIMULATE, clause->id());
5026
5027     HBasicBlock* next_test_block = graph()->CreateBasicBlock();
5028     HBasicBlock* body_block = graph()->CreateBasicBlock();
5029     body_blocks.Add(body_block, zone());
5030     compare->SetSuccessorAt(0, body_block);
5031     compare->SetSuccessorAt(1, next_test_block);
5032     FinishCurrentBlock(compare);
5033
5034     set_current_block(body_block);
5035     Drop(1);  // tag_value
5036
5037     set_current_block(next_test_block);
5038   }
5039
5040   // Save the current block to use for the default or to join with the
5041   // exit.
5042   HBasicBlock* last_block = current_block();
5043   Drop(1);  // tag_value
5044
5045   // 2. Loop over the clauses and the linked list of tests in lockstep,
5046   // translating the clause bodies.
5047   HBasicBlock* fall_through_block = NULL;
5048
5049   BreakAndContinueInfo break_info(stmt, scope());
5050   { BreakAndContinueScope push(&break_info, this);
5051     for (int i = 0; i < clause_count; ++i) {
5052       CaseClause* clause = clauses->at(i);
5053
5054       // Identify the block where normal (non-fall-through) control flow
5055       // goes to.
5056       HBasicBlock* normal_block = NULL;
5057       if (clause->is_default()) {
5058         if (last_block == NULL) continue;
5059         normal_block = last_block;
5060         last_block = NULL;  // Cleared to indicate we've handled it.
5061       } else {
5062         normal_block = body_blocks[i];
5063       }
5064
5065       if (fall_through_block == NULL) {
5066         set_current_block(normal_block);
5067       } else {
5068         HBasicBlock* join = CreateJoin(fall_through_block,
5069                                        normal_block,
5070                                        clause->EntryId());
5071         set_current_block(join);
5072       }
5073
5074       CHECK_BAILOUT(VisitStatements(clause->statements()));
5075       fall_through_block = current_block();
5076     }
5077   }
5078
5079   // Create an up-to-3-way join.  Use the break block if it exists since
5080   // it's already a join block.
5081   HBasicBlock* break_block = break_info.break_block();
5082   if (break_block == NULL) {
5083     set_current_block(CreateJoin(fall_through_block,
5084                                  last_block,
5085                                  stmt->ExitId()));
5086   } else {
5087     if (fall_through_block != NULL) Goto(fall_through_block, break_block);
5088     if (last_block != NULL) Goto(last_block, break_block);
5089     break_block->SetJoinId(stmt->ExitId());
5090     set_current_block(break_block);
5091   }
5092 }
5093
5094
5095 void HOptimizedGraphBuilder::VisitLoopBody(IterationStatement* stmt,
5096                                            HBasicBlock* loop_entry) {
5097   Add<HSimulate>(stmt->StackCheckId());
5098   HStackCheck* stack_check =
5099       HStackCheck::cast(Add<HStackCheck>(HStackCheck::kBackwardsBranch));
5100   DCHECK(loop_entry->IsLoopHeader());
5101   loop_entry->loop_information()->set_stack_check(stack_check);
5102   CHECK_BAILOUT(Visit(stmt->body()));
5103 }
5104
5105
5106 void HOptimizedGraphBuilder::VisitDoWhileStatement(DoWhileStatement* stmt) {
5107   DCHECK(!HasStackOverflow());
5108   DCHECK(current_block() != NULL);
5109   DCHECK(current_block()->HasPredecessor());
5110   DCHECK(current_block() != NULL);
5111   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5112
5113   BreakAndContinueInfo break_info(stmt, scope());
5114   {
5115     BreakAndContinueScope push(&break_info, this);
5116     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5117   }
5118   HBasicBlock* body_exit =
5119       JoinContinue(stmt, current_block(), break_info.continue_block());
5120   HBasicBlock* loop_successor = NULL;
5121   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
5122     set_current_block(body_exit);
5123     loop_successor = graph()->CreateBasicBlock();
5124     if (stmt->cond()->ToBooleanIsFalse()) {
5125       loop_entry->loop_information()->stack_check()->Eliminate();
5126       Goto(loop_successor);
5127       body_exit = NULL;
5128     } else {
5129       // The block for a true condition, the actual predecessor block of the
5130       // back edge.
5131       body_exit = graph()->CreateBasicBlock();
5132       CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
5133     }
5134     if (body_exit != NULL && body_exit->HasPredecessor()) {
5135       body_exit->SetJoinId(stmt->BackEdgeId());
5136     } else {
5137       body_exit = NULL;
5138     }
5139     if (loop_successor->HasPredecessor()) {
5140       loop_successor->SetJoinId(stmt->ExitId());
5141     } else {
5142       loop_successor = NULL;
5143     }
5144   }
5145   HBasicBlock* loop_exit = CreateLoop(stmt,
5146                                       loop_entry,
5147                                       body_exit,
5148                                       loop_successor,
5149                                       break_info.break_block());
5150   set_current_block(loop_exit);
5151 }
5152
5153
5154 void HOptimizedGraphBuilder::VisitWhileStatement(WhileStatement* stmt) {
5155   DCHECK(!HasStackOverflow());
5156   DCHECK(current_block() != NULL);
5157   DCHECK(current_block()->HasPredecessor());
5158   DCHECK(current_block() != NULL);
5159   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5160
5161   // If the condition is constant true, do not generate a branch.
5162   HBasicBlock* loop_successor = NULL;
5163   if (!stmt->cond()->ToBooleanIsTrue()) {
5164     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5165     loop_successor = graph()->CreateBasicBlock();
5166     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5167     if (body_entry->HasPredecessor()) {
5168       body_entry->SetJoinId(stmt->BodyId());
5169       set_current_block(body_entry);
5170     }
5171     if (loop_successor->HasPredecessor()) {
5172       loop_successor->SetJoinId(stmt->ExitId());
5173     } else {
5174       loop_successor = NULL;
5175     }
5176   }
5177
5178   BreakAndContinueInfo break_info(stmt, scope());
5179   if (current_block() != NULL) {
5180     BreakAndContinueScope push(&break_info, this);
5181     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5182   }
5183   HBasicBlock* body_exit =
5184       JoinContinue(stmt, current_block(), break_info.continue_block());
5185   HBasicBlock* loop_exit = CreateLoop(stmt,
5186                                       loop_entry,
5187                                       body_exit,
5188                                       loop_successor,
5189                                       break_info.break_block());
5190   set_current_block(loop_exit);
5191 }
5192
5193
5194 void HOptimizedGraphBuilder::VisitForStatement(ForStatement* stmt) {
5195   DCHECK(!HasStackOverflow());
5196   DCHECK(current_block() != NULL);
5197   DCHECK(current_block()->HasPredecessor());
5198   if (stmt->init() != NULL) {
5199     CHECK_ALIVE(Visit(stmt->init()));
5200   }
5201   DCHECK(current_block() != NULL);
5202   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5203
5204   HBasicBlock* loop_successor = NULL;
5205   if (stmt->cond() != NULL) {
5206     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5207     loop_successor = graph()->CreateBasicBlock();
5208     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5209     if (body_entry->HasPredecessor()) {
5210       body_entry->SetJoinId(stmt->BodyId());
5211       set_current_block(body_entry);
5212     }
5213     if (loop_successor->HasPredecessor()) {
5214       loop_successor->SetJoinId(stmt->ExitId());
5215     } else {
5216       loop_successor = NULL;
5217     }
5218   }
5219
5220   BreakAndContinueInfo break_info(stmt, scope());
5221   if (current_block() != NULL) {
5222     BreakAndContinueScope push(&break_info, this);
5223     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5224   }
5225   HBasicBlock* body_exit =
5226       JoinContinue(stmt, current_block(), break_info.continue_block());
5227
5228   if (stmt->next() != NULL && body_exit != NULL) {
5229     set_current_block(body_exit);
5230     CHECK_BAILOUT(Visit(stmt->next()));
5231     body_exit = current_block();
5232   }
5233
5234   HBasicBlock* loop_exit = CreateLoop(stmt,
5235                                       loop_entry,
5236                                       body_exit,
5237                                       loop_successor,
5238                                       break_info.break_block());
5239   set_current_block(loop_exit);
5240 }
5241
5242
5243 void HOptimizedGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
5244   DCHECK(!HasStackOverflow());
5245   DCHECK(current_block() != NULL);
5246   DCHECK(current_block()->HasPredecessor());
5247
5248   if (!FLAG_optimize_for_in) {
5249     return Bailout(kForInStatementOptimizationIsDisabled);
5250   }
5251
5252   if (!stmt->each()->IsVariableProxy() ||
5253       !stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
5254     return Bailout(kForInStatementWithNonLocalEachVariable);
5255   }
5256
5257   Variable* each_var = stmt->each()->AsVariableProxy()->var();
5258
5259   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
5260   HValue* enumerable = Top();  // Leave enumerable at the top.
5261
5262   IfBuilder if_undefined_or_null(this);
5263   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5264       enumerable, graph()->GetConstantUndefined());
5265   if_undefined_or_null.Or();
5266   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5267       enumerable, graph()->GetConstantNull());
5268   if_undefined_or_null.ThenDeopt(Deoptimizer::kUndefinedOrNullInForIn);
5269   if_undefined_or_null.End();
5270   BuildForInBody(stmt, each_var, enumerable);
5271 }
5272
5273
5274 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
5275                                             Variable* each_var,
5276                                             HValue* enumerable) {
5277   HInstruction* map;
5278   HInstruction* array;
5279   HInstruction* enum_length;
5280   bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
5281   if (fast) {
5282     map = Add<HForInPrepareMap>(enumerable);
5283     Add<HSimulate>(stmt->PrepareId());
5284
5285     array = Add<HForInCacheArray>(enumerable, map,
5286                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
5287     enum_length = Add<HMapEnumLength>(map);
5288
5289     HInstruction* index_cache = Add<HForInCacheArray>(
5290         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
5291     HForInCacheArray::cast(array)
5292         ->set_index_cache(HForInCacheArray::cast(index_cache));
5293   } else {
5294     Add<HSimulate>(stmt->PrepareId());
5295     {
5296       NoObservableSideEffectsScope no_effects(this);
5297       BuildJSObjectCheck(enumerable, 0);
5298     }
5299     Add<HSimulate>(stmt->ToObjectId());
5300
5301     map = graph()->GetConstant1();
5302     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
5303     Add<HPushArguments>(enumerable);
5304     array = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5305                               Runtime::FunctionForId(function_id), 1);
5306     Push(array);
5307     Add<HSimulate>(stmt->EnumId());
5308     Drop(1);
5309     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
5310     HValue* check = Add<HCheckMaps>(array, array_map);
5311     enum_length = AddLoadFixedArrayLength(array, check);
5312   }
5313
5314   HInstruction* start_index = Add<HConstant>(0);
5315
5316   Push(map);
5317   Push(array);
5318   Push(enum_length);
5319   Push(start_index);
5320
5321   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5322
5323   // Reload the values to ensure we have up-to-date values inside of the loop.
5324   // This is relevant especially for OSR where the values don't come from the
5325   // computation above, but from the OSR entry block.
5326   enumerable = environment()->ExpressionStackAt(4);
5327   HValue* index = environment()->ExpressionStackAt(0);
5328   HValue* limit = environment()->ExpressionStackAt(1);
5329
5330   // Check that we still have more keys.
5331   HCompareNumericAndBranch* compare_index =
5332       New<HCompareNumericAndBranch>(index, limit, Token::LT);
5333   compare_index->set_observed_input_representation(
5334       Representation::Smi(), Representation::Smi());
5335
5336   HBasicBlock* loop_body = graph()->CreateBasicBlock();
5337   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
5338
5339   compare_index->SetSuccessorAt(0, loop_body);
5340   compare_index->SetSuccessorAt(1, loop_successor);
5341   FinishCurrentBlock(compare_index);
5342
5343   set_current_block(loop_successor);
5344   Drop(5);
5345
5346   set_current_block(loop_body);
5347
5348   HValue* key =
5349       Add<HLoadKeyed>(environment()->ExpressionStackAt(2),  // Enum cache.
5350                       index, index, FAST_ELEMENTS);
5351
5352   if (fast) {
5353     // Check if the expected map still matches that of the enumerable.
5354     // If not just deoptimize.
5355     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
5356     Bind(each_var, key);
5357   } else {
5358     Add<HPushArguments>(enumerable, key);
5359     Runtime::FunctionId function_id = Runtime::kForInFilter;
5360     key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5361                             Runtime::FunctionForId(function_id), 2);
5362     Push(key);
5363     Add<HSimulate>(stmt->FilterId());
5364     key = Pop();
5365     Bind(each_var, key);
5366     IfBuilder if_undefined(this);
5367     if_undefined.If<HCompareObjectEqAndBranch>(key,
5368                                                graph()->GetConstantUndefined());
5369     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
5370     if_undefined.End();
5371     Add<HSimulate>(stmt->AssignmentId());
5372   }
5373
5374   BreakAndContinueInfo break_info(stmt, scope(), 5);
5375   {
5376     BreakAndContinueScope push(&break_info, this);
5377     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5378   }
5379
5380   HBasicBlock* body_exit =
5381       JoinContinue(stmt, current_block(), break_info.continue_block());
5382
5383   if (body_exit != NULL) {
5384     set_current_block(body_exit);
5385
5386     HValue* current_index = Pop();
5387     Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
5388     body_exit = current_block();
5389   }
5390
5391   HBasicBlock* loop_exit = CreateLoop(stmt,
5392                                       loop_entry,
5393                                       body_exit,
5394                                       loop_successor,
5395                                       break_info.break_block());
5396
5397   set_current_block(loop_exit);
5398 }
5399
5400
5401 void HOptimizedGraphBuilder::VisitForOfStatement(ForOfStatement* stmt) {
5402   DCHECK(!HasStackOverflow());
5403   DCHECK(current_block() != NULL);
5404   DCHECK(current_block()->HasPredecessor());
5405   return Bailout(kForOfStatement);
5406 }
5407
5408
5409 void HOptimizedGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
5410   DCHECK(!HasStackOverflow());
5411   DCHECK(current_block() != NULL);
5412   DCHECK(current_block()->HasPredecessor());
5413   return Bailout(kTryCatchStatement);
5414 }
5415
5416
5417 void HOptimizedGraphBuilder::VisitTryFinallyStatement(
5418     TryFinallyStatement* stmt) {
5419   DCHECK(!HasStackOverflow());
5420   DCHECK(current_block() != NULL);
5421   DCHECK(current_block()->HasPredecessor());
5422   return Bailout(kTryFinallyStatement);
5423 }
5424
5425
5426 void HOptimizedGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
5427   DCHECK(!HasStackOverflow());
5428   DCHECK(current_block() != NULL);
5429   DCHECK(current_block()->HasPredecessor());
5430   return Bailout(kDebuggerStatement);
5431 }
5432
5433
5434 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
5435   UNREACHABLE();
5436 }
5437
5438
5439 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
5440   DCHECK(!HasStackOverflow());
5441   DCHECK(current_block() != NULL);
5442   DCHECK(current_block()->HasPredecessor());
5443   Handle<SharedFunctionInfo> shared_info = Compiler::GetSharedFunctionInfo(
5444       expr, current_info()->script(), top_info());
5445   // We also have a stack overflow if the recursive compilation did.
5446   if (HasStackOverflow()) return;
5447   HFunctionLiteral* instr =
5448       New<HFunctionLiteral>(shared_info, expr->pretenure());
5449   return ast_context()->ReturnInstruction(instr, expr->id());
5450 }
5451
5452
5453 void HOptimizedGraphBuilder::VisitClassLiteral(ClassLiteral* lit) {
5454   DCHECK(!HasStackOverflow());
5455   DCHECK(current_block() != NULL);
5456   DCHECK(current_block()->HasPredecessor());
5457   return Bailout(kClassLiteral);
5458 }
5459
5460
5461 void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
5462     NativeFunctionLiteral* expr) {
5463   DCHECK(!HasStackOverflow());
5464   DCHECK(current_block() != NULL);
5465   DCHECK(current_block()->HasPredecessor());
5466   return Bailout(kNativeFunctionLiteral);
5467 }
5468
5469
5470 void HOptimizedGraphBuilder::VisitConditional(Conditional* expr) {
5471   DCHECK(!HasStackOverflow());
5472   DCHECK(current_block() != NULL);
5473   DCHECK(current_block()->HasPredecessor());
5474   HBasicBlock* cond_true = graph()->CreateBasicBlock();
5475   HBasicBlock* cond_false = graph()->CreateBasicBlock();
5476   CHECK_BAILOUT(VisitForControl(expr->condition(), cond_true, cond_false));
5477
5478   // Visit the true and false subexpressions in the same AST context as the
5479   // whole expression.
5480   if (cond_true->HasPredecessor()) {
5481     cond_true->SetJoinId(expr->ThenId());
5482     set_current_block(cond_true);
5483     CHECK_BAILOUT(Visit(expr->then_expression()));
5484     cond_true = current_block();
5485   } else {
5486     cond_true = NULL;
5487   }
5488
5489   if (cond_false->HasPredecessor()) {
5490     cond_false->SetJoinId(expr->ElseId());
5491     set_current_block(cond_false);
5492     CHECK_BAILOUT(Visit(expr->else_expression()));
5493     cond_false = current_block();
5494   } else {
5495     cond_false = NULL;
5496   }
5497
5498   if (!ast_context()->IsTest()) {
5499     HBasicBlock* join = CreateJoin(cond_true, cond_false, expr->id());
5500     set_current_block(join);
5501     if (join != NULL && !ast_context()->IsEffect()) {
5502       return ast_context()->ReturnValue(Pop());
5503     }
5504   }
5505 }
5506
5507
5508 HOptimizedGraphBuilder::GlobalPropertyAccess
5509 HOptimizedGraphBuilder::LookupGlobalProperty(Variable* var, LookupIterator* it,
5510                                              PropertyAccessType access_type) {
5511   if (var->is_this() || !current_info()->has_global_object()) {
5512     return kUseGeneric;
5513   }
5514
5515   switch (it->state()) {
5516     case LookupIterator::ACCESSOR:
5517     case LookupIterator::ACCESS_CHECK:
5518     case LookupIterator::INTERCEPTOR:
5519     case LookupIterator::INTEGER_INDEXED_EXOTIC:
5520     case LookupIterator::NOT_FOUND:
5521       return kUseGeneric;
5522     case LookupIterator::DATA:
5523       if (access_type == STORE && it->IsReadOnly()) return kUseGeneric;
5524       return kUseCell;
5525     case LookupIterator::JSPROXY:
5526     case LookupIterator::TRANSITION:
5527       UNREACHABLE();
5528   }
5529   UNREACHABLE();
5530   return kUseGeneric;
5531 }
5532
5533
5534 HValue* HOptimizedGraphBuilder::BuildContextChainWalk(Variable* var) {
5535   DCHECK(var->IsContextSlot());
5536   HValue* context = environment()->context();
5537   int length = scope()->ContextChainLength(var->scope());
5538   while (length-- > 0) {
5539     context = Add<HLoadNamedField>(
5540         context, nullptr,
5541         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
5542   }
5543   return context;
5544 }
5545
5546
5547 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
5548   DCHECK(!HasStackOverflow());
5549   DCHECK(current_block() != NULL);
5550   DCHECK(current_block()->HasPredecessor());
5551   Variable* variable = expr->var();
5552   switch (variable->location()) {
5553     case VariableLocation::GLOBAL:
5554     case VariableLocation::UNALLOCATED: {
5555       if (IsLexicalVariableMode(variable->mode())) {
5556         // TODO(rossberg): should this be an DCHECK?
5557         return Bailout(kReferenceToGlobalLexicalVariable);
5558       }
5559       // Handle known global constants like 'undefined' specially to avoid a
5560       // load from a global cell for them.
5561       Handle<Object> constant_value =
5562           isolate()->factory()->GlobalConstantFor(variable->name());
5563       if (!constant_value.is_null()) {
5564         HConstant* instr = New<HConstant>(constant_value);
5565         return ast_context()->ReturnInstruction(instr, expr->id());
5566       }
5567
5568       Handle<GlobalObject> global(current_info()->global_object());
5569
5570       // Lookup in script contexts.
5571       {
5572         Handle<ScriptContextTable> script_contexts(
5573             global->native_context()->script_context_table());
5574         ScriptContextTable::LookupResult lookup;
5575         if (ScriptContextTable::Lookup(script_contexts, variable->name(),
5576                                        &lookup)) {
5577           Handle<Context> script_context = ScriptContextTable::GetContext(
5578               script_contexts, lookup.context_index);
5579           Handle<Object> current_value =
5580               FixedArray::get(script_context, lookup.slot_index);
5581
5582           // If the values is not the hole, it will stay initialized,
5583           // so no need to generate a check.
5584           if (*current_value == *isolate()->factory()->the_hole_value()) {
5585             return Bailout(kReferenceToUninitializedVariable);
5586           }
5587           HInstruction* result = New<HLoadNamedField>(
5588               Add<HConstant>(script_context), nullptr,
5589               HObjectAccess::ForContextSlot(lookup.slot_index));
5590           return ast_context()->ReturnInstruction(result, expr->id());
5591         }
5592       }
5593
5594       LookupIterator it(global, variable->name(), LookupIterator::OWN);
5595       GlobalPropertyAccess type = LookupGlobalProperty(variable, &it, LOAD);
5596
5597       if (type == kUseCell) {
5598         Handle<PropertyCell> cell = it.GetPropertyCell();
5599         top_info()->dependencies()->AssumePropertyCell(cell);
5600         auto cell_type = it.property_details().cell_type();
5601         if (cell_type == PropertyCellType::kConstant ||
5602             cell_type == PropertyCellType::kUndefined) {
5603           Handle<Object> constant_object(cell->value(), isolate());
5604           if (constant_object->IsConsString()) {
5605             constant_object =
5606                 String::Flatten(Handle<String>::cast(constant_object));
5607           }
5608           HConstant* constant = New<HConstant>(constant_object);
5609           return ast_context()->ReturnInstruction(constant, expr->id());
5610         } else {
5611           auto access = HObjectAccess::ForPropertyCellValue();
5612           UniqueSet<Map>* field_maps = nullptr;
5613           if (cell_type == PropertyCellType::kConstantType) {
5614             switch (cell->GetConstantType()) {
5615               case PropertyCellConstantType::kSmi:
5616                 access = access.WithRepresentation(Representation::Smi());
5617                 break;
5618               case PropertyCellConstantType::kStableMap: {
5619                 // Check that the map really is stable. The heap object could
5620                 // have mutated without the cell updating state. In that case,
5621                 // make no promises about the loaded value except that it's a
5622                 // heap object.
5623                 access =
5624                     access.WithRepresentation(Representation::HeapObject());
5625                 Handle<Map> map(HeapObject::cast(cell->value())->map());
5626                 if (map->is_stable()) {
5627                   field_maps = new (zone())
5628                       UniqueSet<Map>(Unique<Map>::CreateImmovable(map), zone());
5629                 }
5630                 break;
5631               }
5632             }
5633           }
5634           HConstant* cell_constant = Add<HConstant>(cell);
5635           HLoadNamedField* instr;
5636           if (field_maps == nullptr) {
5637             instr = New<HLoadNamedField>(cell_constant, nullptr, access);
5638           } else {
5639             instr = New<HLoadNamedField>(cell_constant, nullptr, access,
5640                                          field_maps, HType::HeapObject());
5641           }
5642           instr->ClearDependsOnFlag(kInobjectFields);
5643           instr->SetDependsOnFlag(kGlobalVars);
5644           return ast_context()->ReturnInstruction(instr, expr->id());
5645         }
5646       } else if (variable->IsGlobalSlot()) {
5647         DCHECK(variable->index() > 0);
5648         DCHECK(variable->IsStaticGlobalObjectProperty());
5649         int slot_index = variable->index();
5650         int depth = scope()->ContextChainLength(variable->scope());
5651
5652         HLoadGlobalViaContext* instr =
5653             New<HLoadGlobalViaContext>(depth, slot_index);
5654         return ast_context()->ReturnInstruction(instr, expr->id());
5655
5656       } else {
5657         HValue* global_object = Add<HLoadNamedField>(
5658             context(), nullptr,
5659             HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
5660         HLoadGlobalGeneric* instr = New<HLoadGlobalGeneric>(
5661             global_object, variable->name(), ast_context()->typeof_mode());
5662         instr->SetVectorAndSlot(handle(current_feedback_vector(), isolate()),
5663                                 expr->VariableFeedbackSlot());
5664         return ast_context()->ReturnInstruction(instr, expr->id());
5665       }
5666     }
5667
5668     case VariableLocation::PARAMETER:
5669     case VariableLocation::LOCAL: {
5670       HValue* value = LookupAndMakeLive(variable);
5671       if (value == graph()->GetConstantHole()) {
5672         DCHECK(IsDeclaredVariableMode(variable->mode()) &&
5673                variable->mode() != VAR);
5674         return Bailout(kReferenceToUninitializedVariable);
5675       }
5676       return ast_context()->ReturnValue(value);
5677     }
5678
5679     case VariableLocation::CONTEXT: {
5680       HValue* context = BuildContextChainWalk(variable);
5681       HLoadContextSlot::Mode mode;
5682       switch (variable->mode()) {
5683         case LET:
5684         case CONST:
5685           mode = HLoadContextSlot::kCheckDeoptimize;
5686           break;
5687         case CONST_LEGACY:
5688           mode = HLoadContextSlot::kCheckReturnUndefined;
5689           break;
5690         default:
5691           mode = HLoadContextSlot::kNoCheck;
5692           break;
5693       }
5694       HLoadContextSlot* instr =
5695           new(zone()) HLoadContextSlot(context, variable->index(), mode);
5696       return ast_context()->ReturnInstruction(instr, expr->id());
5697     }
5698
5699     case VariableLocation::LOOKUP:
5700       return Bailout(kReferenceToAVariableWhichRequiresDynamicLookup);
5701   }
5702 }
5703
5704
5705 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
5706   DCHECK(!HasStackOverflow());
5707   DCHECK(current_block() != NULL);
5708   DCHECK(current_block()->HasPredecessor());
5709   HConstant* instr = New<HConstant>(expr->value());
5710   return ast_context()->ReturnInstruction(instr, expr->id());
5711 }
5712
5713
5714 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
5715   DCHECK(!HasStackOverflow());
5716   DCHECK(current_block() != NULL);
5717   DCHECK(current_block()->HasPredecessor());
5718   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5719   Handle<FixedArray> literals(closure->literals());
5720   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
5721                                               expr->pattern(),
5722                                               expr->flags(),
5723                                               expr->literal_index());
5724   return ast_context()->ReturnInstruction(instr, expr->id());
5725 }
5726
5727
5728 static bool CanInlinePropertyAccess(Handle<Map> map) {
5729   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
5730   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
5731   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
5732          !map->has_named_interceptor() &&
5733          // TODO(verwaest): Whitelist contexts to which we have access.
5734          !map->is_access_check_needed();
5735 }
5736
5737
5738 // Determines whether the given array or object literal boilerplate satisfies
5739 // all limits to be considered for fast deep-copying and computes the total
5740 // size of all objects that are part of the graph.
5741 static bool IsFastLiteral(Handle<JSObject> boilerplate,
5742                           int max_depth,
5743                           int* max_properties) {
5744   if (boilerplate->map()->is_deprecated() &&
5745       !JSObject::TryMigrateInstance(boilerplate)) {
5746     return false;
5747   }
5748
5749   DCHECK(max_depth >= 0 && *max_properties >= 0);
5750   if (max_depth == 0) return false;
5751
5752   Isolate* isolate = boilerplate->GetIsolate();
5753   Handle<FixedArrayBase> elements(boilerplate->elements());
5754   if (elements->length() > 0 &&
5755       elements->map() != isolate->heap()->fixed_cow_array_map()) {
5756     if (boilerplate->HasFastSmiOrObjectElements()) {
5757       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
5758       int length = elements->length();
5759       for (int i = 0; i < length; i++) {
5760         if ((*max_properties)-- == 0) return false;
5761         Handle<Object> value(fast_elements->get(i), isolate);
5762         if (value->IsJSObject()) {
5763           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5764           if (!IsFastLiteral(value_object,
5765                              max_depth - 1,
5766                              max_properties)) {
5767             return false;
5768           }
5769         }
5770       }
5771     } else if (!boilerplate->HasFastDoubleElements()) {
5772       return false;
5773     }
5774   }
5775
5776   Handle<FixedArray> properties(boilerplate->properties());
5777   if (properties->length() > 0) {
5778     return false;
5779   } else {
5780     Handle<DescriptorArray> descriptors(
5781         boilerplate->map()->instance_descriptors());
5782     int limit = boilerplate->map()->NumberOfOwnDescriptors();
5783     for (int i = 0; i < limit; i++) {
5784       PropertyDetails details = descriptors->GetDetails(i);
5785       if (details.type() != DATA) continue;
5786       if ((*max_properties)-- == 0) return false;
5787       FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
5788       if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
5789       Handle<Object> value(boilerplate->RawFastPropertyAt(field_index),
5790                            isolate);
5791       if (value->IsJSObject()) {
5792         Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5793         if (!IsFastLiteral(value_object,
5794                            max_depth - 1,
5795                            max_properties)) {
5796           return false;
5797         }
5798       }
5799     }
5800   }
5801   return true;
5802 }
5803
5804
5805 void HOptimizedGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
5806   DCHECK(!HasStackOverflow());
5807   DCHECK(current_block() != NULL);
5808   DCHECK(current_block()->HasPredecessor());
5809
5810   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5811   HInstruction* literal;
5812
5813   // Check whether to use fast or slow deep-copying for boilerplate.
5814   int max_properties = kMaxFastLiteralProperties;
5815   Handle<Object> literals_cell(closure->literals()->get(expr->literal_index()),
5816                                isolate());
5817   Handle<AllocationSite> site;
5818   Handle<JSObject> boilerplate;
5819   if (!literals_cell->IsUndefined()) {
5820     // Retrieve the boilerplate
5821     site = Handle<AllocationSite>::cast(literals_cell);
5822     boilerplate = Handle<JSObject>(JSObject::cast(site->transition_info()),
5823                                    isolate());
5824   }
5825
5826   if (!boilerplate.is_null() &&
5827       IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
5828     AllocationSiteUsageContext site_context(isolate(), site, false);
5829     site_context.EnterNewScope();
5830     literal = BuildFastLiteral(boilerplate, &site_context);
5831     site_context.ExitScope(site, boilerplate);
5832   } else {
5833     NoObservableSideEffectsScope no_effects(this);
5834     Handle<FixedArray> closure_literals(closure->literals(), isolate());
5835     Handle<FixedArray> constant_properties = expr->constant_properties();
5836     int literal_index = expr->literal_index();
5837     int flags = expr->ComputeFlags(true);
5838
5839     Add<HPushArguments>(Add<HConstant>(closure_literals),
5840                         Add<HConstant>(literal_index),
5841                         Add<HConstant>(constant_properties),
5842                         Add<HConstant>(flags));
5843
5844     Runtime::FunctionId function_id = Runtime::kCreateObjectLiteral;
5845     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5846                                 Runtime::FunctionForId(function_id),
5847                                 4);
5848   }
5849
5850   // The object is expected in the bailout environment during computation
5851   // of the property values and is the value of the entire expression.
5852   Push(literal);
5853   int store_slot_index = 0;
5854   for (int i = 0; i < expr->properties()->length(); i++) {
5855     ObjectLiteral::Property* property = expr->properties()->at(i);
5856     if (property->is_computed_name()) return Bailout(kComputedPropertyName);
5857     if (property->IsCompileTimeValue()) continue;
5858
5859     Literal* key = property->key()->AsLiteral();
5860     Expression* value = property->value();
5861
5862     switch (property->kind()) {
5863       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
5864         DCHECK(!CompileTimeValue::IsCompileTimeValue(value));
5865         // Fall through.
5866       case ObjectLiteral::Property::COMPUTED:
5867         // It is safe to use [[Put]] here because the boilerplate already
5868         // contains computed properties with an uninitialized value.
5869         if (key->value()->IsInternalizedString()) {
5870           if (property->emit_store()) {
5871             CHECK_ALIVE(VisitForValue(value));
5872             HValue* value = Pop();
5873
5874             Handle<Map> map = property->GetReceiverType();
5875             Handle<String> name = key->AsPropertyName();
5876             HValue* store;
5877             FeedbackVectorICSlot slot = expr->GetNthSlot(store_slot_index++);
5878             if (map.is_null()) {
5879               // If we don't know the monomorphic type, do a generic store.
5880               CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot, literal,
5881                                                     name, value));
5882             } else {
5883               PropertyAccessInfo info(this, STORE, map, name);
5884               if (info.CanAccessMonomorphic()) {
5885                 HValue* checked_literal = Add<HCheckMaps>(literal, map);
5886                 DCHECK(!info.IsAccessorConstant());
5887                 store = BuildMonomorphicAccess(
5888                     &info, literal, checked_literal, value,
5889                     BailoutId::None(), BailoutId::None());
5890               } else {
5891                 CHECK_ALIVE(store = BuildNamedGeneric(STORE, NULL, slot,
5892                                                       literal, name, value));
5893               }
5894             }
5895             if (store->IsInstruction()) {
5896               AddInstruction(HInstruction::cast(store));
5897             }
5898             DCHECK(store->HasObservableSideEffects());
5899             Add<HSimulate>(key->id(), REMOVABLE_SIMULATE);
5900
5901             // Add [[HomeObject]] to function literals.
5902             if (FunctionLiteral::NeedsHomeObject(property->value())) {
5903               Handle<Symbol> sym = isolate()->factory()->home_object_symbol();
5904               HInstruction* store_home = BuildNamedGeneric(
5905                   STORE, NULL, expr->GetNthSlot(store_slot_index++), value, sym,
5906                   literal);
5907               AddInstruction(store_home);
5908               DCHECK(store_home->HasObservableSideEffects());
5909               Add<HSimulate>(property->value()->id(), REMOVABLE_SIMULATE);
5910             }
5911           } else {
5912             CHECK_ALIVE(VisitForEffect(value));
5913           }
5914           break;
5915         }
5916         // Fall through.
5917       case ObjectLiteral::Property::PROTOTYPE:
5918       case ObjectLiteral::Property::SETTER:
5919       case ObjectLiteral::Property::GETTER:
5920         return Bailout(kObjectLiteralWithComplexProperty);
5921       default: UNREACHABLE();
5922     }
5923   }
5924
5925   // Crankshaft may not consume all the slots because it doesn't emit accessors.
5926   DCHECK(!FLAG_vector_stores || store_slot_index <= expr->slot_count());
5927
5928   if (expr->has_function()) {
5929     // Return the result of the transformation to fast properties
5930     // instead of the original since this operation changes the map
5931     // of the object. This makes sure that the original object won't
5932     // be used by other optimized code before it is transformed
5933     // (e.g. because of code motion).
5934     HToFastProperties* result = Add<HToFastProperties>(Pop());
5935     return ast_context()->ReturnValue(result);
5936   } else {
5937     return ast_context()->ReturnValue(Pop());
5938   }
5939 }
5940
5941
5942 void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
5943   DCHECK(!HasStackOverflow());
5944   DCHECK(current_block() != NULL);
5945   DCHECK(current_block()->HasPredecessor());
5946   expr->BuildConstantElements(isolate());
5947   ZoneList<Expression*>* subexprs = expr->values();
5948   int length = subexprs->length();
5949   HInstruction* literal;
5950
5951   Handle<AllocationSite> site;
5952   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
5953   bool uninitialized = false;
5954   Handle<Object> literals_cell(literals->get(expr->literal_index()),
5955                                isolate());
5956   Handle<JSObject> boilerplate_object;
5957   if (literals_cell->IsUndefined()) {
5958     uninitialized = true;
5959     Handle<Object> raw_boilerplate;
5960     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
5961         isolate(), raw_boilerplate,
5962         Runtime::CreateArrayLiteralBoilerplate(
5963             isolate(), literals, expr->constant_elements(),
5964             is_strong(function_language_mode())),
5965         Bailout(kArrayBoilerplateCreationFailed));
5966
5967     boilerplate_object = Handle<JSObject>::cast(raw_boilerplate);
5968     AllocationSiteCreationContext creation_context(isolate());
5969     site = creation_context.EnterNewScope();
5970     if (JSObject::DeepWalk(boilerplate_object, &creation_context).is_null()) {
5971       return Bailout(kArrayBoilerplateCreationFailed);
5972     }
5973     creation_context.ExitScope(site, boilerplate_object);
5974     literals->set(expr->literal_index(), *site);
5975
5976     if (boilerplate_object->elements()->map() ==
5977         isolate()->heap()->fixed_cow_array_map()) {
5978       isolate()->counters()->cow_arrays_created_runtime()->Increment();
5979     }
5980   } else {
5981     DCHECK(literals_cell->IsAllocationSite());
5982     site = Handle<AllocationSite>::cast(literals_cell);
5983     boilerplate_object = Handle<JSObject>(
5984         JSObject::cast(site->transition_info()), isolate());
5985   }
5986
5987   DCHECK(!boilerplate_object.is_null());
5988   DCHECK(site->SitePointsToLiteral());
5989
5990   ElementsKind boilerplate_elements_kind =
5991       boilerplate_object->GetElementsKind();
5992
5993   // Check whether to use fast or slow deep-copying for boilerplate.
5994   int max_properties = kMaxFastLiteralProperties;
5995   if (IsFastLiteral(boilerplate_object,
5996                     kMaxFastLiteralDepth,
5997                     &max_properties)) {
5998     AllocationSiteUsageContext site_context(isolate(), site, false);
5999     site_context.EnterNewScope();
6000     literal = BuildFastLiteral(boilerplate_object, &site_context);
6001     site_context.ExitScope(site, boilerplate_object);
6002   } else {
6003     NoObservableSideEffectsScope no_effects(this);
6004     // Boilerplate already exists and constant elements are never accessed,
6005     // pass an empty fixed array to the runtime function instead.
6006     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
6007     int literal_index = expr->literal_index();
6008     int flags = expr->ComputeFlags(true);
6009
6010     Add<HPushArguments>(Add<HConstant>(literals),
6011                         Add<HConstant>(literal_index),
6012                         Add<HConstant>(constants),
6013                         Add<HConstant>(flags));
6014
6015     Runtime::FunctionId function_id = Runtime::kCreateArrayLiteral;
6016     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
6017                                 Runtime::FunctionForId(function_id),
6018                                 4);
6019
6020     // Register to deopt if the boilerplate ElementsKind changes.
6021     top_info()->dependencies()->AssumeTransitionStable(site);
6022   }
6023
6024   // The array is expected in the bailout environment during computation
6025   // of the property values and is the value of the entire expression.
6026   Push(literal);
6027   // The literal index is on the stack, too.
6028   Push(Add<HConstant>(expr->literal_index()));
6029
6030   HInstruction* elements = NULL;
6031
6032   for (int i = 0; i < length; i++) {
6033     Expression* subexpr = subexprs->at(i);
6034     if (subexpr->IsSpread()) {
6035       return Bailout(kSpread);
6036     }
6037
6038     // If the subexpression is a literal or a simple materialized literal it
6039     // is already set in the cloned array.
6040     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
6041
6042     CHECK_ALIVE(VisitForValue(subexpr));
6043     HValue* value = Pop();
6044     if (!Smi::IsValid(i)) return Bailout(kNonSmiKeyInArrayLiteral);
6045
6046     elements = AddLoadElements(literal);
6047
6048     HValue* key = Add<HConstant>(i);
6049
6050     switch (boilerplate_elements_kind) {
6051       case FAST_SMI_ELEMENTS:
6052       case FAST_HOLEY_SMI_ELEMENTS:
6053       case FAST_ELEMENTS:
6054       case FAST_HOLEY_ELEMENTS:
6055       case FAST_DOUBLE_ELEMENTS:
6056       case FAST_HOLEY_DOUBLE_ELEMENTS: {
6057         HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
6058                                               boilerplate_elements_kind);
6059         instr->SetUninitialized(uninitialized);
6060         break;
6061       }
6062       default:
6063         UNREACHABLE();
6064         break;
6065     }
6066
6067     Add<HSimulate>(expr->GetIdForElement(i));
6068   }
6069
6070   Drop(1);  // array literal index
6071   return ast_context()->ReturnValue(Pop());
6072 }
6073
6074
6075 HCheckMaps* HOptimizedGraphBuilder::AddCheckMap(HValue* object,
6076                                                 Handle<Map> map) {
6077   BuildCheckHeapObject(object);
6078   return Add<HCheckMaps>(object, map);
6079 }
6080
6081
6082 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
6083     PropertyAccessInfo* info,
6084     HValue* checked_object) {
6085   // See if this is a load for an immutable property
6086   if (checked_object->ActualValue()->IsConstant()) {
6087     Handle<Object> object(
6088         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
6089
6090     if (object->IsJSObject()) {
6091       LookupIterator it(object, info->name(),
6092                         LookupIterator::OWN_SKIP_INTERCEPTOR);
6093       Handle<Object> value = JSReceiver::GetDataProperty(&it);
6094       if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
6095         return New<HConstant>(value);
6096       }
6097     }
6098   }
6099
6100   HObjectAccess access = info->access();
6101   if (access.representation().IsDouble() &&
6102       (!FLAG_unbox_double_fields || !access.IsInobject())) {
6103     // Load the heap number.
6104     checked_object = Add<HLoadNamedField>(
6105         checked_object, nullptr,
6106         access.WithRepresentation(Representation::Tagged()));
6107     // Load the double value from it.
6108     access = HObjectAccess::ForHeapNumberValue();
6109   }
6110
6111   SmallMapList* map_list = info->field_maps();
6112   if (map_list->length() == 0) {
6113     return New<HLoadNamedField>(checked_object, checked_object, access);
6114   }
6115
6116   UniqueSet<Map>* maps = new(zone()) UniqueSet<Map>(map_list->length(), zone());
6117   for (int i = 0; i < map_list->length(); ++i) {
6118     maps->Add(Unique<Map>::CreateImmovable(map_list->at(i)), zone());
6119   }
6120   return New<HLoadNamedField>(
6121       checked_object, checked_object, access, maps, info->field_type());
6122 }
6123
6124
6125 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
6126     PropertyAccessInfo* info,
6127     HValue* checked_object,
6128     HValue* value) {
6129   bool transition_to_field = info->IsTransition();
6130   // TODO(verwaest): Move this logic into PropertyAccessInfo.
6131   HObjectAccess field_access = info->access();
6132
6133   HStoreNamedField *instr;
6134   if (field_access.representation().IsDouble() &&
6135       (!FLAG_unbox_double_fields || !field_access.IsInobject())) {
6136     HObjectAccess heap_number_access =
6137         field_access.WithRepresentation(Representation::Tagged());
6138     if (transition_to_field) {
6139       // The store requires a mutable HeapNumber to be allocated.
6140       NoObservableSideEffectsScope no_side_effects(this);
6141       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
6142
6143       // TODO(hpayer): Allocation site pretenuring support.
6144       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
6145           HType::HeapObject(),
6146           NOT_TENURED,
6147           MUTABLE_HEAP_NUMBER_TYPE);
6148       AddStoreMapConstant(
6149           heap_number, isolate()->factory()->mutable_heap_number_map());
6150       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
6151                             value);
6152       instr = New<HStoreNamedField>(checked_object->ActualValue(),
6153                                     heap_number_access,
6154                                     heap_number);
6155     } else {
6156       // Already holds a HeapNumber; load the box and write its value field.
6157       HInstruction* heap_number =
6158           Add<HLoadNamedField>(checked_object, nullptr, heap_number_access);
6159       instr = New<HStoreNamedField>(heap_number,
6160                                     HObjectAccess::ForHeapNumberValue(),
6161                                     value, STORE_TO_INITIALIZED_ENTRY);
6162     }
6163   } else {
6164     if (field_access.representation().IsHeapObject()) {
6165       BuildCheckHeapObject(value);
6166     }
6167
6168     if (!info->field_maps()->is_empty()) {
6169       DCHECK(field_access.representation().IsHeapObject());
6170       value = Add<HCheckMaps>(value, info->field_maps());
6171     }
6172
6173     // This is a normal store.
6174     instr = New<HStoreNamedField>(
6175         checked_object->ActualValue(), field_access, value,
6176         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
6177   }
6178
6179   if (transition_to_field) {
6180     Handle<Map> transition(info->transition());
6181     DCHECK(!transition->is_deprecated());
6182     instr->SetTransition(Add<HConstant>(transition));
6183   }
6184   return instr;
6185 }
6186
6187
6188 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
6189     PropertyAccessInfo* info) {
6190   if (!CanInlinePropertyAccess(map_)) return false;
6191
6192   // Currently only handle Type::Number as a polymorphic case.
6193   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6194   // instruction.
6195   if (IsNumberType()) return false;
6196
6197   // Values are only compatible for monomorphic load if they all behave the same
6198   // regarding value wrappers.
6199   if (IsValueWrapped() != info->IsValueWrapped()) return false;
6200
6201   if (!LookupDescriptor()) return false;
6202
6203   if (!IsFound()) {
6204     return (!info->IsFound() || info->has_holder()) &&
6205            map()->prototype() == info->map()->prototype();
6206   }
6207
6208   // Mismatch if the other access info found the property in the prototype
6209   // chain.
6210   if (info->has_holder()) return false;
6211
6212   if (IsAccessorConstant()) {
6213     return accessor_.is_identical_to(info->accessor_) &&
6214         api_holder_.is_identical_to(info->api_holder_);
6215   }
6216
6217   if (IsDataConstant()) {
6218     return constant_.is_identical_to(info->constant_);
6219   }
6220
6221   DCHECK(IsData());
6222   if (!info->IsData()) return false;
6223
6224   Representation r = access_.representation();
6225   if (IsLoad()) {
6226     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
6227   } else {
6228     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
6229   }
6230   if (info->access_.offset() != access_.offset()) return false;
6231   if (info->access_.IsInobject() != access_.IsInobject()) return false;
6232   if (IsLoad()) {
6233     if (field_maps_.is_empty()) {
6234       info->field_maps_.Clear();
6235     } else if (!info->field_maps_.is_empty()) {
6236       for (int i = 0; i < field_maps_.length(); ++i) {
6237         info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
6238       }
6239       info->field_maps_.Sort();
6240     }
6241   } else {
6242     // We can only merge stores that agree on their field maps. The comparison
6243     // below is safe, since we keep the field maps sorted.
6244     if (field_maps_.length() != info->field_maps_.length()) return false;
6245     for (int i = 0; i < field_maps_.length(); ++i) {
6246       if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
6247         return false;
6248       }
6249     }
6250   }
6251   info->GeneralizeRepresentation(r);
6252   info->field_type_ = info->field_type_.Combine(field_type_);
6253   return true;
6254 }
6255
6256
6257 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
6258   if (!map_->IsJSObjectMap()) return true;
6259   LookupDescriptor(*map_, *name_);
6260   return LoadResult(map_);
6261 }
6262
6263
6264 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
6265   if (!IsLoad() && IsProperty() && IsReadOnly()) {
6266     return false;
6267   }
6268
6269   if (IsData()) {
6270     // Construct the object field access.
6271     int index = GetLocalFieldIndexFromMap(map);
6272     access_ = HObjectAccess::ForField(map, index, representation(), name_);
6273
6274     // Load field map for heap objects.
6275     return LoadFieldMaps(map);
6276   } else if (IsAccessorConstant()) {
6277     Handle<Object> accessors = GetAccessorsFromMap(map);
6278     if (!accessors->IsAccessorPair()) return false;
6279     Object* raw_accessor =
6280         IsLoad() ? Handle<AccessorPair>::cast(accessors)->getter()
6281                  : Handle<AccessorPair>::cast(accessors)->setter();
6282     if (!raw_accessor->IsJSFunction()) return false;
6283     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
6284     if (accessor->shared()->IsApiFunction()) {
6285       CallOptimization call_optimization(accessor);
6286       if (call_optimization.is_simple_api_call()) {
6287         CallOptimization::HolderLookup holder_lookup;
6288         api_holder_ =
6289             call_optimization.LookupHolderOfExpectedType(map_, &holder_lookup);
6290       }
6291     }
6292     accessor_ = accessor;
6293   } else if (IsDataConstant()) {
6294     constant_ = GetConstantFromMap(map);
6295   }
6296
6297   return true;
6298 }
6299
6300
6301 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
6302     Handle<Map> map) {
6303   // Clear any previously collected field maps/type.
6304   field_maps_.Clear();
6305   field_type_ = HType::Tagged();
6306
6307   // Figure out the field type from the accessor map.
6308   Handle<HeapType> field_type = GetFieldTypeFromMap(map);
6309
6310   // Collect the (stable) maps from the field type.
6311   int num_field_maps = field_type->NumClasses();
6312   if (num_field_maps > 0) {
6313     DCHECK(access_.representation().IsHeapObject());
6314     field_maps_.Reserve(num_field_maps, zone());
6315     HeapType::Iterator<Map> it = field_type->Classes();
6316     while (!it.Done()) {
6317       Handle<Map> field_map = it.Current();
6318       if (!field_map->is_stable()) {
6319         field_maps_.Clear();
6320         break;
6321       }
6322       field_maps_.Add(field_map, zone());
6323       it.Advance();
6324     }
6325   }
6326
6327   if (field_maps_.is_empty()) {
6328     // Store is not safe if the field map was cleared.
6329     return IsLoad() || !field_type->Is(HeapType::None());
6330   }
6331
6332   field_maps_.Sort();
6333   DCHECK_EQ(num_field_maps, field_maps_.length());
6334
6335   // Determine field HType from field HeapType.
6336   field_type_ = HType::FromType<HeapType>(field_type);
6337   DCHECK(field_type_.IsHeapObject());
6338
6339   // Add dependency on the map that introduced the field.
6340   top_info()->dependencies()->AssumeFieldType(GetFieldOwnerFromMap(map));
6341   return true;
6342 }
6343
6344
6345 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
6346   Handle<Map> map = this->map();
6347
6348   while (map->prototype()->IsJSObject()) {
6349     holder_ = handle(JSObject::cast(map->prototype()));
6350     if (holder_->map()->is_deprecated()) {
6351       JSObject::TryMigrateInstance(holder_);
6352     }
6353     map = Handle<Map>(holder_->map());
6354     if (!CanInlinePropertyAccess(map)) {
6355       NotFound();
6356       return false;
6357     }
6358     LookupDescriptor(*map, *name_);
6359     if (IsFound()) return LoadResult(map);
6360   }
6361
6362   NotFound();
6363   return !map->prototype()->IsJSReceiver();
6364 }
6365
6366
6367 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsIntegerIndexedExotic() {
6368   InstanceType instance_type = map_->instance_type();
6369   return instance_type == JS_TYPED_ARRAY_TYPE &&
6370          IsSpecialIndex(isolate()->unicode_cache(), *name_);
6371 }
6372
6373
6374 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
6375   if (!CanInlinePropertyAccess(map_)) return false;
6376   if (IsJSObjectFieldAccessor()) return IsLoad();
6377   if (IsJSArrayBufferViewFieldAccessor()) return IsLoad();
6378   if (map_->function_with_prototype() && !map_->has_non_instance_prototype() &&
6379       name_.is_identical_to(isolate()->factory()->prototype_string())) {
6380     return IsLoad();
6381   }
6382   if (!LookupDescriptor()) return false;
6383   if (IsFound()) return IsLoad() || !IsReadOnly();
6384   if (IsIntegerIndexedExotic()) return false;
6385   if (!LookupInPrototypes()) return false;
6386   if (IsLoad()) return true;
6387
6388   if (IsAccessorConstant()) return true;
6389   LookupTransition(*map_, *name_, NONE);
6390   if (IsTransitionToData() && map_->unused_property_fields() > 0) {
6391     // Construct the object field access.
6392     int descriptor = transition()->LastAdded();
6393     int index =
6394         transition()->instance_descriptors()->GetFieldIndex(descriptor) -
6395         map_->GetInObjectProperties();
6396     PropertyDetails details =
6397         transition()->instance_descriptors()->GetDetails(descriptor);
6398     Representation representation = details.representation();
6399     access_ = HObjectAccess::ForField(map_, index, representation, name_);
6400
6401     // Load field map for heap objects.
6402     return LoadFieldMaps(transition());
6403   }
6404   return false;
6405 }
6406
6407
6408 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
6409     SmallMapList* maps) {
6410   DCHECK(map_.is_identical_to(maps->first()));
6411   if (!CanAccessMonomorphic()) return false;
6412   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6413   if (maps->length() > kMaxLoadPolymorphism) return false;
6414   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6415   if (GetJSObjectFieldAccess(&access)) {
6416     for (int i = 1; i < maps->length(); ++i) {
6417       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6418       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6419       if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
6420       if (!access.Equals(test_access)) return false;
6421     }
6422     return true;
6423   }
6424   if (GetJSArrayBufferViewFieldAccess(&access)) {
6425     for (int i = 1; i < maps->length(); ++i) {
6426       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6427       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6428       if (!test_info.GetJSArrayBufferViewFieldAccess(&test_access)) {
6429         return false;
6430       }
6431       if (!access.Equals(test_access)) return false;
6432     }
6433     return true;
6434   }
6435
6436   // Currently only handle numbers as a polymorphic case.
6437   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6438   // instruction.
6439   if (IsNumberType()) return false;
6440
6441   // Multiple maps cannot transition to the same target map.
6442   DCHECK(!IsLoad() || !IsTransition());
6443   if (IsTransition() && maps->length() > 1) return false;
6444
6445   for (int i = 1; i < maps->length(); ++i) {
6446     PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6447     if (!test_info.IsCompatible(this)) return false;
6448   }
6449
6450   return true;
6451 }
6452
6453
6454 Handle<Map> HOptimizedGraphBuilder::PropertyAccessInfo::map() {
6455   JSFunction* ctor = IC::GetRootConstructor(
6456       *map_, current_info()->closure()->context()->native_context());
6457   if (ctor != NULL) return handle(ctor->initial_map());
6458   return map_;
6459 }
6460
6461
6462 static bool NeedsWrapping(Handle<Map> map, Handle<JSFunction> target) {
6463   return !map->IsJSObjectMap() &&
6464          is_sloppy(target->shared()->language_mode()) &&
6465          !target->shared()->native();
6466 }
6467
6468
6469 bool HOptimizedGraphBuilder::PropertyAccessInfo::NeedsWrappingFor(
6470     Handle<JSFunction> target) const {
6471   return NeedsWrapping(map_, target);
6472 }
6473
6474
6475 HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
6476     PropertyAccessInfo* info, HValue* object, HValue* checked_object,
6477     HValue* value, BailoutId ast_id, BailoutId return_id,
6478     bool can_inline_accessor) {
6479   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6480   if (info->GetJSObjectFieldAccess(&access)) {
6481     DCHECK(info->IsLoad());
6482     return New<HLoadNamedField>(object, checked_object, access);
6483   }
6484
6485   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
6486     DCHECK(info->IsLoad());
6487     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
6488     return New<HLoadNamedField>(object, checked_object, access);
6489   }
6490
6491   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
6492       info->map()->function_with_prototype()) {
6493     DCHECK(!info->map()->has_non_instance_prototype());
6494     return New<HLoadFunctionPrototype>(checked_object);
6495   }
6496
6497   HValue* checked_holder = checked_object;
6498   if (info->has_holder()) {
6499     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
6500     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
6501   }
6502
6503   if (!info->IsFound()) {
6504     DCHECK(info->IsLoad());
6505     if (is_strong(function_language_mode())) {
6506       return New<HCallRuntime>(
6507           isolate()->factory()->empty_string(),
6508           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
6509           0);
6510     } else {
6511       return graph()->GetConstantUndefined();
6512     }
6513   }
6514
6515   if (info->IsData()) {
6516     if (info->IsLoad()) {
6517       return BuildLoadNamedField(info, checked_holder);
6518     } else {
6519       return BuildStoreNamedField(info, checked_object, value);
6520     }
6521   }
6522
6523   if (info->IsTransition()) {
6524     DCHECK(!info->IsLoad());
6525     return BuildStoreNamedField(info, checked_object, value);
6526   }
6527
6528   if (info->IsAccessorConstant()) {
6529     Push(checked_object);
6530     int argument_count = 1;
6531     if (!info->IsLoad()) {
6532       argument_count = 2;
6533       Push(value);
6534     }
6535
6536     if (info->NeedsWrappingFor(info->accessor())) {
6537       HValue* function = Add<HConstant>(info->accessor());
6538       PushArgumentsFromEnvironment(argument_count);
6539       return New<HCallFunction>(function, argument_count, WRAP_AND_CALL);
6540     } else if (FLAG_inline_accessors && can_inline_accessor) {
6541       bool success = info->IsLoad()
6542           ? TryInlineGetter(info->accessor(), info->map(), ast_id, return_id)
6543           : TryInlineSetter(
6544               info->accessor(), info->map(), ast_id, return_id, value);
6545       if (success || HasStackOverflow()) return NULL;
6546     }
6547
6548     PushArgumentsFromEnvironment(argument_count);
6549     return BuildCallConstantFunction(info->accessor(), argument_count);
6550   }
6551
6552   DCHECK(info->IsDataConstant());
6553   if (info->IsLoad()) {
6554     return New<HConstant>(info->constant());
6555   } else {
6556     return New<HCheckValue>(value, Handle<JSFunction>::cast(info->constant()));
6557   }
6558 }
6559
6560
6561 void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
6562     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
6563     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* value,
6564     SmallMapList* maps, Handle<String> name) {
6565   // Something did not match; must use a polymorphic load.
6566   int count = 0;
6567   HBasicBlock* join = NULL;
6568   HBasicBlock* number_block = NULL;
6569   bool handled_string = false;
6570
6571   bool handle_smi = false;
6572   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6573   int i;
6574   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6575     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6576     if (info.IsStringType()) {
6577       if (handled_string) continue;
6578       handled_string = true;
6579     }
6580     if (info.CanAccessMonomorphic()) {
6581       count++;
6582       if (info.IsNumberType()) {
6583         handle_smi = true;
6584         break;
6585       }
6586     }
6587   }
6588
6589   if (i < maps->length()) {
6590     count = -1;
6591     maps->Clear();
6592   } else {
6593     count = 0;
6594   }
6595   HControlInstruction* smi_check = NULL;
6596   handled_string = false;
6597
6598   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6599     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6600     if (info.IsStringType()) {
6601       if (handled_string) continue;
6602       handled_string = true;
6603     }
6604     if (!info.CanAccessMonomorphic()) continue;
6605
6606     if (count == 0) {
6607       join = graph()->CreateBasicBlock();
6608       if (handle_smi) {
6609         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
6610         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
6611         number_block = graph()->CreateBasicBlock();
6612         smi_check = New<HIsSmiAndBranch>(
6613             object, empty_smi_block, not_smi_block);
6614         FinishCurrentBlock(smi_check);
6615         GotoNoSimulate(empty_smi_block, number_block);
6616         set_current_block(not_smi_block);
6617       } else {
6618         BuildCheckHeapObject(object);
6619       }
6620     }
6621     ++count;
6622     HBasicBlock* if_true = graph()->CreateBasicBlock();
6623     HBasicBlock* if_false = graph()->CreateBasicBlock();
6624     HUnaryControlInstruction* compare;
6625
6626     HValue* dependency;
6627     if (info.IsNumberType()) {
6628       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
6629       compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
6630       dependency = smi_check;
6631     } else if (info.IsStringType()) {
6632       compare = New<HIsStringAndBranch>(object, if_true, if_false);
6633       dependency = compare;
6634     } else {
6635       compare = New<HCompareMap>(object, info.map(), if_true, if_false);
6636       dependency = compare;
6637     }
6638     FinishCurrentBlock(compare);
6639
6640     if (info.IsNumberType()) {
6641       GotoNoSimulate(if_true, number_block);
6642       if_true = number_block;
6643     }
6644
6645     set_current_block(if_true);
6646
6647     HValue* access =
6648         BuildMonomorphicAccess(&info, object, dependency, value, ast_id,
6649                                return_id, FLAG_polymorphic_inlining);
6650
6651     HValue* result = NULL;
6652     switch (access_type) {
6653       case LOAD:
6654         result = access;
6655         break;
6656       case STORE:
6657         result = value;
6658         break;
6659     }
6660
6661     if (access == NULL) {
6662       if (HasStackOverflow()) return;
6663     } else {
6664       if (access->IsInstruction()) {
6665         HInstruction* instr = HInstruction::cast(access);
6666         if (!instr->IsLinked()) AddInstruction(instr);
6667       }
6668       if (!ast_context()->IsEffect()) Push(result);
6669     }
6670
6671     if (current_block() != NULL) Goto(join);
6672     set_current_block(if_false);
6673   }
6674
6675   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
6676   // know about and do not want to handle ones we've never seen.  Otherwise
6677   // use a generic IC.
6678   if (count == maps->length() && FLAG_deoptimize_uncommon_cases) {
6679     FinishExitWithHardDeoptimization(
6680         Deoptimizer::kUnknownMapInPolymorphicAccess);
6681   } else {
6682     HInstruction* instr =
6683         BuildNamedGeneric(access_type, expr, slot, object, name, value);
6684     AddInstruction(instr);
6685     if (!ast_context()->IsEffect()) Push(access_type == LOAD ? instr : value);
6686
6687     if (join != NULL) {
6688       Goto(join);
6689     } else {
6690       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6691       if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6692       return;
6693     }
6694   }
6695
6696   DCHECK(join != NULL);
6697   if (join->HasPredecessor()) {
6698     join->SetJoinId(ast_id);
6699     set_current_block(join);
6700     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6701   } else {
6702     set_current_block(NULL);
6703   }
6704 }
6705
6706
6707 static bool ComputeReceiverTypes(Expression* expr,
6708                                  HValue* receiver,
6709                                  SmallMapList** t,
6710                                  Zone* zone) {
6711   SmallMapList* maps = expr->GetReceiverTypes();
6712   *t = maps;
6713   bool monomorphic = expr->IsMonomorphic();
6714   if (maps != NULL && receiver->HasMonomorphicJSObjectType()) {
6715     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
6716     maps->FilterForPossibleTransitions(root_map);
6717     monomorphic = maps->length() == 1;
6718   }
6719   return monomorphic && CanInlinePropertyAccess(maps->first());
6720 }
6721
6722
6723 static bool AreStringTypes(SmallMapList* maps) {
6724   for (int i = 0; i < maps->length(); i++) {
6725     if (maps->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
6726   }
6727   return true;
6728 }
6729
6730
6731 void HOptimizedGraphBuilder::BuildStore(Expression* expr, Property* prop,
6732                                         FeedbackVectorICSlot slot,
6733                                         BailoutId ast_id, BailoutId return_id,
6734                                         bool is_uninitialized) {
6735   if (!prop->key()->IsPropertyName()) {
6736     // Keyed store.
6737     HValue* value = Pop();
6738     HValue* key = Pop();
6739     HValue* object = Pop();
6740     bool has_side_effects = false;
6741     HValue* result =
6742         HandleKeyedElementAccess(object, key, value, expr, slot, ast_id,
6743                                  return_id, STORE, &has_side_effects);
6744     if (has_side_effects) {
6745       if (!ast_context()->IsEffect()) Push(value);
6746       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6747       if (!ast_context()->IsEffect()) Drop(1);
6748     }
6749     if (result == NULL) return;
6750     return ast_context()->ReturnValue(value);
6751   }
6752
6753   // Named store.
6754   HValue* value = Pop();
6755   HValue* object = Pop();
6756
6757   Literal* key = prop->key()->AsLiteral();
6758   Handle<String> name = Handle<String>::cast(key->value());
6759   DCHECK(!name.is_null());
6760
6761   HValue* access = BuildNamedAccess(STORE, ast_id, return_id, expr, slot,
6762                                     object, name, value, is_uninitialized);
6763   if (access == NULL) return;
6764
6765   if (!ast_context()->IsEffect()) Push(value);
6766   if (access->IsInstruction()) AddInstruction(HInstruction::cast(access));
6767   if (access->HasObservableSideEffects()) {
6768     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6769   }
6770   if (!ast_context()->IsEffect()) Drop(1);
6771   return ast_context()->ReturnValue(value);
6772 }
6773
6774
6775 void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
6776   Property* prop = expr->target()->AsProperty();
6777   DCHECK(prop != NULL);
6778   CHECK_ALIVE(VisitForValue(prop->obj()));
6779   if (!prop->key()->IsPropertyName()) {
6780     CHECK_ALIVE(VisitForValue(prop->key()));
6781   }
6782   CHECK_ALIVE(VisitForValue(expr->value()));
6783   BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
6784              expr->AssignmentId(), expr->IsUninitialized());
6785 }
6786
6787
6788 // Because not every expression has a position and there is not common
6789 // superclass of Assignment and CountOperation, we cannot just pass the
6790 // owning expression instead of position and ast_id separately.
6791 void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
6792     Variable* var, HValue* value, FeedbackVectorICSlot ic_slot,
6793     BailoutId ast_id) {
6794   Handle<GlobalObject> global(current_info()->global_object());
6795
6796   // Lookup in script contexts.
6797   {
6798     Handle<ScriptContextTable> script_contexts(
6799         global->native_context()->script_context_table());
6800     ScriptContextTable::LookupResult lookup;
6801     if (ScriptContextTable::Lookup(script_contexts, var->name(), &lookup)) {
6802       if (lookup.mode == CONST) {
6803         return Bailout(kNonInitializerAssignmentToConst);
6804       }
6805       Handle<Context> script_context =
6806           ScriptContextTable::GetContext(script_contexts, lookup.context_index);
6807
6808       Handle<Object> current_value =
6809           FixedArray::get(script_context, lookup.slot_index);
6810
6811       // If the values is not the hole, it will stay initialized,
6812       // so no need to generate a check.
6813       if (*current_value == *isolate()->factory()->the_hole_value()) {
6814         return Bailout(kReferenceToUninitializedVariable);
6815       }
6816
6817       HStoreNamedField* instr = Add<HStoreNamedField>(
6818           Add<HConstant>(script_context),
6819           HObjectAccess::ForContextSlot(lookup.slot_index), value);
6820       USE(instr);
6821       DCHECK(instr->HasObservableSideEffects());
6822       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6823       return;
6824     }
6825   }
6826
6827   LookupIterator it(global, var->name(), LookupIterator::OWN);
6828   GlobalPropertyAccess type = LookupGlobalProperty(var, &it, STORE);
6829   if (type == kUseCell) {
6830     Handle<PropertyCell> cell = it.GetPropertyCell();
6831     top_info()->dependencies()->AssumePropertyCell(cell);
6832     auto cell_type = it.property_details().cell_type();
6833     if (cell_type == PropertyCellType::kConstant ||
6834         cell_type == PropertyCellType::kUndefined) {
6835       Handle<Object> constant(cell->value(), isolate());
6836       if (value->IsConstant()) {
6837         HConstant* c_value = HConstant::cast(value);
6838         if (!constant.is_identical_to(c_value->handle(isolate()))) {
6839           Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6840                            Deoptimizer::EAGER);
6841         }
6842       } else {
6843         HValue* c_constant = Add<HConstant>(constant);
6844         IfBuilder builder(this);
6845         if (constant->IsNumber()) {
6846           builder.If<HCompareNumericAndBranch>(value, c_constant, Token::EQ);
6847         } else {
6848           builder.If<HCompareObjectEqAndBranch>(value, c_constant);
6849         }
6850         builder.Then();
6851         builder.Else();
6852         Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6853                          Deoptimizer::EAGER);
6854         builder.End();
6855       }
6856     }
6857     HConstant* cell_constant = Add<HConstant>(cell);
6858     auto access = HObjectAccess::ForPropertyCellValue();
6859     if (cell_type == PropertyCellType::kConstantType) {
6860       switch (cell->GetConstantType()) {
6861         case PropertyCellConstantType::kSmi:
6862           access = access.WithRepresentation(Representation::Smi());
6863           break;
6864         case PropertyCellConstantType::kStableMap: {
6865           // The map may no longer be stable, deopt if it's ever different from
6866           // what is currently there, which will allow for restablization.
6867           Handle<Map> map(HeapObject::cast(cell->value())->map());
6868           Add<HCheckHeapObject>(value);
6869           value = Add<HCheckMaps>(value, map);
6870           access = access.WithRepresentation(Representation::HeapObject());
6871           break;
6872         }
6873       }
6874     }
6875     HInstruction* instr = Add<HStoreNamedField>(cell_constant, access, value);
6876     instr->ClearChangesFlag(kInobjectFields);
6877     instr->SetChangesFlag(kGlobalVars);
6878     if (instr->HasObservableSideEffects()) {
6879       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6880     }
6881   } else if (var->IsGlobalSlot()) {
6882     DCHECK(var->index() > 0);
6883     DCHECK(var->IsStaticGlobalObjectProperty());
6884     int slot_index = var->index();
6885     int depth = scope()->ContextChainLength(var->scope());
6886
6887     HStoreGlobalViaContext* instr = Add<HStoreGlobalViaContext>(
6888         value, depth, slot_index, function_language_mode());
6889     USE(instr);
6890     DCHECK(instr->HasObservableSideEffects());
6891     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6892
6893   } else {
6894     HValue* global_object = Add<HLoadNamedField>(
6895         context(), nullptr,
6896         HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
6897     HStoreNamedGeneric* instr =
6898         Add<HStoreNamedGeneric>(global_object, var->name(), value,
6899                                 function_language_mode(), PREMONOMORPHIC);
6900     if (FLAG_vector_stores) {
6901       Handle<TypeFeedbackVector> vector =
6902           handle(current_feedback_vector(), isolate());
6903       instr->SetVectorAndSlot(vector, ic_slot);
6904     }
6905     USE(instr);
6906     DCHECK(instr->HasObservableSideEffects());
6907     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6908   }
6909 }
6910
6911
6912 void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
6913   Expression* target = expr->target();
6914   VariableProxy* proxy = target->AsVariableProxy();
6915   Property* prop = target->AsProperty();
6916   DCHECK(proxy == NULL || prop == NULL);
6917
6918   // We have a second position recorded in the FullCodeGenerator to have
6919   // type feedback for the binary operation.
6920   BinaryOperation* operation = expr->binary_operation();
6921
6922   if (proxy != NULL) {
6923     Variable* var = proxy->var();
6924     if (var->mode() == LET)  {
6925       return Bailout(kUnsupportedLetCompoundAssignment);
6926     }
6927
6928     CHECK_ALIVE(VisitForValue(operation));
6929
6930     switch (var->location()) {
6931       case VariableLocation::GLOBAL:
6932       case VariableLocation::UNALLOCATED:
6933         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
6934                                        expr->AssignmentId());
6935         break;
6936
6937       case VariableLocation::PARAMETER:
6938       case VariableLocation::LOCAL:
6939         if (var->mode() == CONST_LEGACY)  {
6940           return Bailout(kUnsupportedConstCompoundAssignment);
6941         }
6942         if (var->mode() == CONST) {
6943           return Bailout(kNonInitializerAssignmentToConst);
6944         }
6945         BindIfLive(var, Top());
6946         break;
6947
6948       case VariableLocation::CONTEXT: {
6949         // Bail out if we try to mutate a parameter value in a function
6950         // using the arguments object.  We do not (yet) correctly handle the
6951         // arguments property of the function.
6952         if (current_info()->scope()->arguments() != NULL) {
6953           // Parameters will be allocated to context slots.  We have no
6954           // direct way to detect that the variable is a parameter so we do
6955           // a linear search of the parameter variables.
6956           int count = current_info()->scope()->num_parameters();
6957           for (int i = 0; i < count; ++i) {
6958             if (var == current_info()->scope()->parameter(i)) {
6959               Bailout(kAssignmentToParameterFunctionUsesArgumentsObject);
6960             }
6961           }
6962         }
6963
6964         HStoreContextSlot::Mode mode;
6965
6966         switch (var->mode()) {
6967           case LET:
6968             mode = HStoreContextSlot::kCheckDeoptimize;
6969             break;
6970           case CONST:
6971             return Bailout(kNonInitializerAssignmentToConst);
6972           case CONST_LEGACY:
6973             return ast_context()->ReturnValue(Pop());
6974           default:
6975             mode = HStoreContextSlot::kNoCheck;
6976         }
6977
6978         HValue* context = BuildContextChainWalk(var);
6979         HStoreContextSlot* instr = Add<HStoreContextSlot>(
6980             context, var->index(), mode, Top());
6981         if (instr->HasObservableSideEffects()) {
6982           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
6983         }
6984         break;
6985       }
6986
6987       case VariableLocation::LOOKUP:
6988         return Bailout(kCompoundAssignmentToLookupSlot);
6989     }
6990     return ast_context()->ReturnValue(Pop());
6991
6992   } else if (prop != NULL) {
6993     CHECK_ALIVE(VisitForValue(prop->obj()));
6994     HValue* object = Top();
6995     HValue* key = NULL;
6996     if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
6997       CHECK_ALIVE(VisitForValue(prop->key()));
6998       key = Top();
6999     }
7000
7001     CHECK_ALIVE(PushLoad(prop, object, key));
7002
7003     CHECK_ALIVE(VisitForValue(expr->value()));
7004     HValue* right = Pop();
7005     HValue* left = Pop();
7006
7007     Push(BuildBinaryOperation(operation, left, right, PUSH_BEFORE_SIMULATE));
7008
7009     BuildStore(expr, prop, expr->AssignmentSlot(), expr->id(),
7010                expr->AssignmentId(), expr->IsUninitialized());
7011   } else {
7012     return Bailout(kInvalidLhsInCompoundAssignment);
7013   }
7014 }
7015
7016
7017 void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
7018   DCHECK(!HasStackOverflow());
7019   DCHECK(current_block() != NULL);
7020   DCHECK(current_block()->HasPredecessor());
7021   VariableProxy* proxy = expr->target()->AsVariableProxy();
7022   Property* prop = expr->target()->AsProperty();
7023   DCHECK(proxy == NULL || prop == NULL);
7024
7025   if (expr->is_compound()) {
7026     HandleCompoundAssignment(expr);
7027     return;
7028   }
7029
7030   if (prop != NULL) {
7031     HandlePropertyAssignment(expr);
7032   } else if (proxy != NULL) {
7033     Variable* var = proxy->var();
7034
7035     if (var->mode() == CONST) {
7036       if (expr->op() != Token::INIT_CONST) {
7037         return Bailout(kNonInitializerAssignmentToConst);
7038       }
7039     } else if (var->mode() == CONST_LEGACY) {
7040       if (expr->op() != Token::INIT_CONST_LEGACY) {
7041         CHECK_ALIVE(VisitForValue(expr->value()));
7042         return ast_context()->ReturnValue(Pop());
7043       }
7044
7045       if (var->IsStackAllocated()) {
7046         // We insert a use of the old value to detect unsupported uses of const
7047         // variables (e.g. initialization inside a loop).
7048         HValue* old_value = environment()->Lookup(var);
7049         Add<HUseConst>(old_value);
7050       }
7051     }
7052
7053     if (proxy->IsArguments()) return Bailout(kAssignmentToArguments);
7054
7055     // Handle the assignment.
7056     switch (var->location()) {
7057       case VariableLocation::GLOBAL:
7058       case VariableLocation::UNALLOCATED:
7059         CHECK_ALIVE(VisitForValue(expr->value()));
7060         HandleGlobalVariableAssignment(var, Top(), expr->AssignmentSlot(),
7061                                        expr->AssignmentId());
7062         return ast_context()->ReturnValue(Pop());
7063
7064       case VariableLocation::PARAMETER:
7065       case VariableLocation::LOCAL: {
7066         // Perform an initialization check for let declared variables
7067         // or parameters.
7068         if (var->mode() == LET && expr->op() == Token::ASSIGN) {
7069           HValue* env_value = environment()->Lookup(var);
7070           if (env_value == graph()->GetConstantHole()) {
7071             return Bailout(kAssignmentToLetVariableBeforeInitialization);
7072           }
7073         }
7074         // We do not allow the arguments object to occur in a context where it
7075         // may escape, but assignments to stack-allocated locals are
7076         // permitted.
7077         CHECK_ALIVE(VisitForValue(expr->value(), ARGUMENTS_ALLOWED));
7078         HValue* value = Pop();
7079         BindIfLive(var, value);
7080         return ast_context()->ReturnValue(value);
7081       }
7082
7083       case VariableLocation::CONTEXT: {
7084         // Bail out if we try to mutate a parameter value in a function using
7085         // the arguments object.  We do not (yet) correctly handle the
7086         // arguments property of the function.
7087         if (current_info()->scope()->arguments() != NULL) {
7088           // Parameters will rewrite to context slots.  We have no direct way
7089           // to detect that the variable is a parameter.
7090           int count = current_info()->scope()->num_parameters();
7091           for (int i = 0; i < count; ++i) {
7092             if (var == current_info()->scope()->parameter(i)) {
7093               return Bailout(kAssignmentToParameterInArgumentsObject);
7094             }
7095           }
7096         }
7097
7098         CHECK_ALIVE(VisitForValue(expr->value()));
7099         HStoreContextSlot::Mode mode;
7100         if (expr->op() == Token::ASSIGN) {
7101           switch (var->mode()) {
7102             case LET:
7103               mode = HStoreContextSlot::kCheckDeoptimize;
7104               break;
7105             case CONST:
7106               // This case is checked statically so no need to
7107               // perform checks here
7108               UNREACHABLE();
7109             case CONST_LEGACY:
7110               return ast_context()->ReturnValue(Pop());
7111             default:
7112               mode = HStoreContextSlot::kNoCheck;
7113           }
7114         } else if (expr->op() == Token::INIT_VAR ||
7115                    expr->op() == Token::INIT_LET ||
7116                    expr->op() == Token::INIT_CONST) {
7117           mode = HStoreContextSlot::kNoCheck;
7118         } else {
7119           DCHECK(expr->op() == Token::INIT_CONST_LEGACY);
7120
7121           mode = HStoreContextSlot::kCheckIgnoreAssignment;
7122         }
7123
7124         HValue* context = BuildContextChainWalk(var);
7125         HStoreContextSlot* instr = Add<HStoreContextSlot>(
7126             context, var->index(), mode, Top());
7127         if (instr->HasObservableSideEffects()) {
7128           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
7129         }
7130         return ast_context()->ReturnValue(Pop());
7131       }
7132
7133       case VariableLocation::LOOKUP:
7134         return Bailout(kAssignmentToLOOKUPVariable);
7135     }
7136   } else {
7137     return Bailout(kInvalidLeftHandSideInAssignment);
7138   }
7139 }
7140
7141
7142 void HOptimizedGraphBuilder::VisitYield(Yield* expr) {
7143   // Generators are not optimized, so we should never get here.
7144   UNREACHABLE();
7145 }
7146
7147
7148 void HOptimizedGraphBuilder::VisitThrow(Throw* expr) {
7149   DCHECK(!HasStackOverflow());
7150   DCHECK(current_block() != NULL);
7151   DCHECK(current_block()->HasPredecessor());
7152   if (!ast_context()->IsEffect()) {
7153     // The parser turns invalid left-hand sides in assignments into throw
7154     // statements, which may not be in effect contexts. We might still try
7155     // to optimize such functions; bail out now if we do.
7156     return Bailout(kInvalidLeftHandSideInAssignment);
7157   }
7158   CHECK_ALIVE(VisitForValue(expr->exception()));
7159
7160   HValue* value = environment()->Pop();
7161   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
7162   Add<HPushArguments>(value);
7163   Add<HCallRuntime>(isolate()->factory()->empty_string(),
7164                     Runtime::FunctionForId(Runtime::kThrow), 1);
7165   Add<HSimulate>(expr->id());
7166
7167   // If the throw definitely exits the function, we can finish with a dummy
7168   // control flow at this point.  This is not the case if the throw is inside
7169   // an inlined function which may be replaced.
7170   if (call_context() == NULL) {
7171     FinishExitCurrentBlock(New<HAbnormalExit>());
7172   }
7173 }
7174
7175
7176 HInstruction* HGraphBuilder::AddLoadStringInstanceType(HValue* string) {
7177   if (string->IsConstant()) {
7178     HConstant* c_string = HConstant::cast(string);
7179     if (c_string->HasStringValue()) {
7180       return Add<HConstant>(c_string->StringValue()->map()->instance_type());
7181     }
7182   }
7183   return Add<HLoadNamedField>(
7184       Add<HLoadNamedField>(string, nullptr, HObjectAccess::ForMap()), nullptr,
7185       HObjectAccess::ForMapInstanceType());
7186 }
7187
7188
7189 HInstruction* HGraphBuilder::AddLoadStringLength(HValue* string) {
7190   return AddInstruction(BuildLoadStringLength(string));
7191 }
7192
7193
7194 HInstruction* HGraphBuilder::BuildLoadStringLength(HValue* string) {
7195   if (string->IsConstant()) {
7196     HConstant* c_string = HConstant::cast(string);
7197     if (c_string->HasStringValue()) {
7198       return New<HConstant>(c_string->StringValue()->length());
7199     }
7200   }
7201   return New<HLoadNamedField>(string, nullptr,
7202                               HObjectAccess::ForStringLength());
7203 }
7204
7205
7206 HInstruction* HOptimizedGraphBuilder::BuildNamedGeneric(
7207     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7208     HValue* object, Handle<Name> name, HValue* value, bool is_uninitialized) {
7209   if (is_uninitialized) {
7210     Add<HDeoptimize>(
7211         Deoptimizer::kInsufficientTypeFeedbackForGenericNamedAccess,
7212         Deoptimizer::SOFT);
7213   }
7214   if (access_type == LOAD) {
7215     Handle<TypeFeedbackVector> vector =
7216         handle(current_feedback_vector(), isolate());
7217
7218     if (!expr->AsProperty()->key()->IsPropertyName()) {
7219       // It's possible that a keyed load of a constant string was converted
7220       // to a named load. Here, at the last minute, we need to make sure to
7221       // use a generic Keyed Load if we are using the type vector, because
7222       // it has to share information with full code.
7223       HConstant* key = Add<HConstant>(name);
7224       HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7225           object, key, function_language_mode(), PREMONOMORPHIC);
7226       result->SetVectorAndSlot(vector, slot);
7227       return result;
7228     }
7229
7230     HLoadNamedGeneric* result = New<HLoadNamedGeneric>(
7231         object, name, function_language_mode(), PREMONOMORPHIC);
7232     result->SetVectorAndSlot(vector, slot);
7233     return result;
7234   } else {
7235     if (FLAG_vector_stores &&
7236         current_feedback_vector()->GetKind(slot) == Code::KEYED_STORE_IC) {
7237       // It's possible that a keyed store of a constant string was converted
7238       // to a named store. Here, at the last minute, we need to make sure to
7239       // use a generic Keyed Store if we are using the type vector, because
7240       // it has to share information with full code.
7241       HConstant* key = Add<HConstant>(name);
7242       HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7243           object, key, value, function_language_mode(), PREMONOMORPHIC);
7244       Handle<TypeFeedbackVector> vector =
7245           handle(current_feedback_vector(), isolate());
7246       result->SetVectorAndSlot(vector, slot);
7247       return result;
7248     }
7249
7250     HStoreNamedGeneric* result = New<HStoreNamedGeneric>(
7251         object, name, value, function_language_mode(), PREMONOMORPHIC);
7252     if (FLAG_vector_stores) {
7253       Handle<TypeFeedbackVector> vector =
7254           handle(current_feedback_vector(), isolate());
7255       result->SetVectorAndSlot(vector, slot);
7256     }
7257     return result;
7258   }
7259 }
7260
7261
7262 HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
7263     PropertyAccessType access_type, Expression* expr, FeedbackVectorICSlot slot,
7264     HValue* object, HValue* key, HValue* value) {
7265   if (access_type == LOAD) {
7266     InlineCacheState initial_state = expr->AsProperty()->GetInlineCacheState();
7267     HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7268         object, key, function_language_mode(), initial_state);
7269     // HLoadKeyedGeneric with vector ics benefits from being encoded as
7270     // MEGAMORPHIC because the vector/slot combo becomes unnecessary.
7271     if (initial_state != MEGAMORPHIC) {
7272       // We need to pass vector information.
7273       Handle<TypeFeedbackVector> vector =
7274           handle(current_feedback_vector(), isolate());
7275       result->SetVectorAndSlot(vector, slot);
7276     }
7277     return result;
7278   } else {
7279     HStoreKeyedGeneric* result = New<HStoreKeyedGeneric>(
7280         object, key, value, function_language_mode(), PREMONOMORPHIC);
7281     if (FLAG_vector_stores) {
7282       Handle<TypeFeedbackVector> vector =
7283           handle(current_feedback_vector(), isolate());
7284       result->SetVectorAndSlot(vector, slot);
7285     }
7286     return result;
7287   }
7288 }
7289
7290
7291 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
7292   // Loads from a "stock" fast holey double arrays can elide the hole check.
7293   // Loads from a "stock" fast holey array can convert the hole to undefined
7294   // with impunity.
7295   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
7296   bool holey_double_elements =
7297       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
7298   bool holey_elements =
7299       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
7300   if ((holey_double_elements || holey_elements) &&
7301       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
7302     load_mode =
7303         holey_double_elements ? ALLOW_RETURN_HOLE : CONVERT_HOLE_TO_UNDEFINED;
7304
7305     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
7306     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
7307     BuildCheckPrototypeMaps(prototype, object_prototype);
7308     graph()->MarkDependsOnEmptyArrayProtoElements();
7309   }
7310   return load_mode;
7311 }
7312
7313
7314 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
7315     HValue* object,
7316     HValue* key,
7317     HValue* val,
7318     HValue* dependency,
7319     Handle<Map> map,
7320     PropertyAccessType access_type,
7321     KeyedAccessStoreMode store_mode) {
7322   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
7323
7324   if (access_type == STORE && map->prototype()->IsJSObject()) {
7325     // monomorphic stores need a prototype chain check because shape
7326     // changes could allow callbacks on elements in the chain that
7327     // aren't compatible with monomorphic keyed stores.
7328     PrototypeIterator iter(map);
7329     JSObject* holder = NULL;
7330     while (!iter.IsAtEnd()) {
7331       holder = JSObject::cast(*PrototypeIterator::GetCurrent(iter));
7332       iter.Advance();
7333     }
7334     DCHECK(holder && holder->IsJSObject());
7335
7336     BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
7337                             Handle<JSObject>(holder));
7338   }
7339
7340   LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7341   return BuildUncheckedMonomorphicElementAccess(
7342       checked_object, key, val,
7343       map->instance_type() == JS_ARRAY_TYPE,
7344       map->elements_kind(), access_type,
7345       load_mode, store_mode);
7346 }
7347
7348
7349 static bool CanInlineElementAccess(Handle<Map> map) {
7350   return map->IsJSObjectMap() && !map->has_dictionary_elements() &&
7351          !map->has_sloppy_arguments_elements() &&
7352          !map->has_indexed_interceptor() && !map->is_access_check_needed();
7353 }
7354
7355
7356 HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
7357     HValue* object,
7358     HValue* key,
7359     HValue* val,
7360     SmallMapList* maps) {
7361   // For polymorphic loads of similar elements kinds (i.e. all tagged or all
7362   // double), always use the "worst case" code without a transition.  This is
7363   // much faster than transitioning the elements to the worst case, trading a
7364   // HTransitionElements for a HCheckMaps, and avoiding mutation of the array.
7365   bool has_double_maps = false;
7366   bool has_smi_or_object_maps = false;
7367   bool has_js_array_access = false;
7368   bool has_non_js_array_access = false;
7369   bool has_seen_holey_elements = false;
7370   Handle<Map> most_general_consolidated_map;
7371   for (int i = 0; i < maps->length(); ++i) {
7372     Handle<Map> map = maps->at(i);
7373     if (!CanInlineElementAccess(map)) return NULL;
7374     // Don't allow mixing of JSArrays with JSObjects.
7375     if (map->instance_type() == JS_ARRAY_TYPE) {
7376       if (has_non_js_array_access) return NULL;
7377       has_js_array_access = true;
7378     } else if (has_js_array_access) {
7379       return NULL;
7380     } else {
7381       has_non_js_array_access = true;
7382     }
7383     // Don't allow mixed, incompatible elements kinds.
7384     if (map->has_fast_double_elements()) {
7385       if (has_smi_or_object_maps) return NULL;
7386       has_double_maps = true;
7387     } else if (map->has_fast_smi_or_object_elements()) {
7388       if (has_double_maps) return NULL;
7389       has_smi_or_object_maps = true;
7390     } else {
7391       return NULL;
7392     }
7393     // Remember if we've ever seen holey elements.
7394     if (IsHoleyElementsKind(map->elements_kind())) {
7395       has_seen_holey_elements = true;
7396     }
7397     // Remember the most general elements kind, the code for its load will
7398     // properly handle all of the more specific cases.
7399     if ((i == 0) || IsMoreGeneralElementsKindTransition(
7400             most_general_consolidated_map->elements_kind(),
7401             map->elements_kind())) {
7402       most_general_consolidated_map = map;
7403     }
7404   }
7405   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
7406
7407   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
7408   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
7409   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
7410   ElementsKind consolidated_elements_kind = has_seen_holey_elements
7411       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
7412       : most_general_consolidated_map->elements_kind();
7413   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
7414       checked_object, key, val,
7415       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
7416       consolidated_elements_kind,
7417       LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
7418   return instr;
7419 }
7420
7421
7422 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
7423     Expression* expr, FeedbackVectorICSlot slot, HValue* object, HValue* key,
7424     HValue* val, SmallMapList* maps, PropertyAccessType access_type,
7425     KeyedAccessStoreMode store_mode, bool* has_side_effects) {
7426   *has_side_effects = false;
7427   BuildCheckHeapObject(object);
7428
7429   if (access_type == LOAD) {
7430     HInstruction* consolidated_load =
7431         TryBuildConsolidatedElementLoad(object, key, val, maps);
7432     if (consolidated_load != NULL) {
7433       *has_side_effects |= consolidated_load->HasObservableSideEffects();
7434       return consolidated_load;
7435     }
7436   }
7437
7438   // Elements_kind transition support.
7439   MapHandleList transition_target(maps->length());
7440   // Collect possible transition targets.
7441   MapHandleList possible_transitioned_maps(maps->length());
7442   for (int i = 0; i < maps->length(); ++i) {
7443     Handle<Map> map = maps->at(i);
7444     // Loads from strings or loads with a mix of string and non-string maps
7445     // shouldn't be handled polymorphically.
7446     DCHECK(access_type != LOAD || !map->IsStringMap());
7447     ElementsKind elements_kind = map->elements_kind();
7448     if (CanInlineElementAccess(map) && IsFastElementsKind(elements_kind) &&
7449         elements_kind != GetInitialFastElementsKind()) {
7450       possible_transitioned_maps.Add(map);
7451     }
7452     if (IsSloppyArgumentsElements(elements_kind)) {
7453       HInstruction* result =
7454           BuildKeyedGeneric(access_type, expr, slot, object, key, val);
7455       *has_side_effects = result->HasObservableSideEffects();
7456       return AddInstruction(result);
7457     }
7458   }
7459   // Get transition target for each map (NULL == no transition).
7460   for (int i = 0; i < maps->length(); ++i) {
7461     Handle<Map> map = maps->at(i);
7462     Handle<Map> transitioned_map =
7463         Map::FindTransitionedMap(map, &possible_transitioned_maps);
7464     transition_target.Add(transitioned_map);
7465   }
7466
7467   MapHandleList untransitionable_maps(maps->length());
7468   HTransitionElementsKind* transition = NULL;
7469   for (int i = 0; i < maps->length(); ++i) {
7470     Handle<Map> map = maps->at(i);
7471     DCHECK(map->IsMap());
7472     if (!transition_target.at(i).is_null()) {
7473       DCHECK(Map::IsValidElementsTransition(
7474           map->elements_kind(),
7475           transition_target.at(i)->elements_kind()));
7476       transition = Add<HTransitionElementsKind>(object, map,
7477                                                 transition_target.at(i));
7478     } else {
7479       untransitionable_maps.Add(map);
7480     }
7481   }
7482
7483   // If only one map is left after transitioning, handle this case
7484   // monomorphically.
7485   DCHECK(untransitionable_maps.length() >= 1);
7486   if (untransitionable_maps.length() == 1) {
7487     Handle<Map> untransitionable_map = untransitionable_maps[0];
7488     HInstruction* instr = NULL;
7489     if (!CanInlineElementAccess(untransitionable_map)) {
7490       instr = AddInstruction(
7491           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7492     } else {
7493       instr = BuildMonomorphicElementAccess(
7494           object, key, val, transition, untransitionable_map, access_type,
7495           store_mode);
7496     }
7497     *has_side_effects |= instr->HasObservableSideEffects();
7498     return access_type == STORE ? val : instr;
7499   }
7500
7501   HBasicBlock* join = graph()->CreateBasicBlock();
7502
7503   for (int i = 0; i < untransitionable_maps.length(); ++i) {
7504     Handle<Map> map = untransitionable_maps[i];
7505     ElementsKind elements_kind = map->elements_kind();
7506     HBasicBlock* this_map = graph()->CreateBasicBlock();
7507     HBasicBlock* other_map = graph()->CreateBasicBlock();
7508     HCompareMap* mapcompare =
7509         New<HCompareMap>(object, map, this_map, other_map);
7510     FinishCurrentBlock(mapcompare);
7511
7512     set_current_block(this_map);
7513     HInstruction* access = NULL;
7514     if (!CanInlineElementAccess(map)) {
7515       access = AddInstruction(
7516           BuildKeyedGeneric(access_type, expr, slot, object, key, val));
7517     } else {
7518       DCHECK(IsFastElementsKind(elements_kind) ||
7519              IsFixedTypedArrayElementsKind(elements_kind));
7520       LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7521       // Happily, mapcompare is a checked object.
7522       access = BuildUncheckedMonomorphicElementAccess(
7523           mapcompare, key, val,
7524           map->instance_type() == JS_ARRAY_TYPE,
7525           elements_kind, access_type,
7526           load_mode,
7527           store_mode);
7528     }
7529     *has_side_effects |= access->HasObservableSideEffects();
7530     // The caller will use has_side_effects and add a correct Simulate.
7531     access->SetFlag(HValue::kHasNoObservableSideEffects);
7532     if (access_type == LOAD) {
7533       Push(access);
7534     }
7535     NoObservableSideEffectsScope scope(this);
7536     GotoNoSimulate(join);
7537     set_current_block(other_map);
7538   }
7539
7540   // Ensure that we visited at least one map above that goes to join. This is
7541   // necessary because FinishExitWithHardDeoptimization does an AbnormalExit
7542   // rather than joining the join block. If this becomes an issue, insert a
7543   // generic access in the case length() == 0.
7544   DCHECK(join->predecessors()->length() > 0);
7545   // Deopt if none of the cases matched.
7546   NoObservableSideEffectsScope scope(this);
7547   FinishExitWithHardDeoptimization(
7548       Deoptimizer::kUnknownMapInPolymorphicElementAccess);
7549   set_current_block(join);
7550   return access_type == STORE ? val : Pop();
7551 }
7552
7553
7554 HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
7555     HValue* obj, HValue* key, HValue* val, Expression* expr,
7556     FeedbackVectorICSlot slot, BailoutId ast_id, BailoutId return_id,
7557     PropertyAccessType access_type, bool* has_side_effects) {
7558   if (key->ActualValue()->IsConstant()) {
7559     Handle<Object> constant =
7560         HConstant::cast(key->ActualValue())->handle(isolate());
7561     uint32_t array_index;
7562     if (constant->IsString() &&
7563         !Handle<String>::cast(constant)->AsArrayIndex(&array_index)) {
7564       if (!constant->IsUniqueName()) {
7565         constant = isolate()->factory()->InternalizeString(
7566             Handle<String>::cast(constant));
7567       }
7568       HValue* access =
7569           BuildNamedAccess(access_type, ast_id, return_id, expr, slot, obj,
7570                            Handle<String>::cast(constant), val, false);
7571       if (access == NULL || access->IsPhi() ||
7572           HInstruction::cast(access)->IsLinked()) {
7573         *has_side_effects = false;
7574       } else {
7575         HInstruction* instr = HInstruction::cast(access);
7576         AddInstruction(instr);
7577         *has_side_effects = instr->HasObservableSideEffects();
7578       }
7579       return access;
7580     }
7581   }
7582
7583   DCHECK(!expr->IsPropertyName());
7584   HInstruction* instr = NULL;
7585
7586   SmallMapList* maps;
7587   bool monomorphic = ComputeReceiverTypes(expr, obj, &maps, zone());
7588
7589   bool force_generic = false;
7590   if (expr->GetKeyType() == PROPERTY) {
7591     // Non-Generic accesses assume that elements are being accessed, and will
7592     // deopt for non-index keys, which the IC knows will occur.
7593     // TODO(jkummerow): Consider adding proper support for property accesses.
7594     force_generic = true;
7595     monomorphic = false;
7596   } else if (access_type == STORE &&
7597              (monomorphic || (maps != NULL && !maps->is_empty()))) {
7598     // Stores can't be mono/polymorphic if their prototype chain has dictionary
7599     // elements. However a receiver map that has dictionary elements itself
7600     // should be left to normal mono/poly behavior (the other maps may benefit
7601     // from highly optimized stores).
7602     for (int i = 0; i < maps->length(); i++) {
7603       Handle<Map> current_map = maps->at(i);
7604       if (current_map->DictionaryElementsInPrototypeChainOnly()) {
7605         force_generic = true;
7606         monomorphic = false;
7607         break;
7608       }
7609     }
7610   } else if (access_type == LOAD && !monomorphic &&
7611              (maps != NULL && !maps->is_empty())) {
7612     // Polymorphic loads have to go generic if any of the maps are strings.
7613     // If some, but not all of the maps are strings, we should go generic
7614     // because polymorphic access wants to key on ElementsKind and isn't
7615     // compatible with strings.
7616     for (int i = 0; i < maps->length(); i++) {
7617       Handle<Map> current_map = maps->at(i);
7618       if (current_map->IsStringMap()) {
7619         force_generic = true;
7620         break;
7621       }
7622     }
7623   }
7624
7625   if (monomorphic) {
7626     Handle<Map> map = maps->first();
7627     if (!CanInlineElementAccess(map)) {
7628       instr = AddInstruction(
7629           BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7630     } else {
7631       BuildCheckHeapObject(obj);
7632       instr = BuildMonomorphicElementAccess(
7633           obj, key, val, NULL, map, access_type, expr->GetStoreMode());
7634     }
7635   } else if (!force_generic && (maps != NULL && !maps->is_empty())) {
7636     return HandlePolymorphicElementAccess(expr, slot, obj, key, val, maps,
7637                                           access_type, expr->GetStoreMode(),
7638                                           has_side_effects);
7639   } else {
7640     if (access_type == STORE) {
7641       if (expr->IsAssignment() &&
7642           expr->AsAssignment()->HasNoTypeInformation()) {
7643         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedStore,
7644                          Deoptimizer::SOFT);
7645       }
7646     } else {
7647       if (expr->AsProperty()->HasNoTypeInformation()) {
7648         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedLoad,
7649                          Deoptimizer::SOFT);
7650       }
7651     }
7652     instr = AddInstruction(
7653         BuildKeyedGeneric(access_type, expr, slot, obj, key, val));
7654   }
7655   *has_side_effects = instr->HasObservableSideEffects();
7656   return instr;
7657 }
7658
7659
7660 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
7661   // Outermost function already has arguments on the stack.
7662   if (function_state()->outer() == NULL) return;
7663
7664   if (function_state()->arguments_pushed()) return;
7665
7666   // Push arguments when entering inlined function.
7667   HEnterInlined* entry = function_state()->entry();
7668   entry->set_arguments_pushed();
7669
7670   HArgumentsObject* arguments = entry->arguments_object();
7671   const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
7672
7673   HInstruction* insert_after = entry;
7674   for (int i = 0; i < arguments_values->length(); i++) {
7675     HValue* argument = arguments_values->at(i);
7676     HInstruction* push_argument = New<HPushArguments>(argument);
7677     push_argument->InsertAfter(insert_after);
7678     insert_after = push_argument;
7679   }
7680
7681   HArgumentsElements* arguments_elements = New<HArgumentsElements>(true);
7682   arguments_elements->ClearFlag(HValue::kUseGVN);
7683   arguments_elements->InsertAfter(insert_after);
7684   function_state()->set_arguments_elements(arguments_elements);
7685 }
7686
7687
7688 bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
7689   VariableProxy* proxy = expr->obj()->AsVariableProxy();
7690   if (proxy == NULL) return false;
7691   if (!proxy->var()->IsStackAllocated()) return false;
7692   if (!environment()->Lookup(proxy->var())->CheckFlag(HValue::kIsArguments)) {
7693     return false;
7694   }
7695
7696   HInstruction* result = NULL;
7697   if (expr->key()->IsPropertyName()) {
7698     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7699     if (!String::Equals(name, isolate()->factory()->length_string())) {
7700       return false;
7701     }
7702
7703     if (function_state()->outer() == NULL) {
7704       HInstruction* elements = Add<HArgumentsElements>(false);
7705       result = New<HArgumentsLength>(elements);
7706     } else {
7707       // Number of arguments without receiver.
7708       int argument_count = environment()->
7709           arguments_environment()->parameter_count() - 1;
7710       result = New<HConstant>(argument_count);
7711     }
7712   } else {
7713     Push(graph()->GetArgumentsObject());
7714     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);
7715     HValue* key = Pop();
7716     Drop(1);  // Arguments object.
7717     if (function_state()->outer() == NULL) {
7718       HInstruction* elements = Add<HArgumentsElements>(false);
7719       HInstruction* length = Add<HArgumentsLength>(elements);
7720       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7721       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7722     } else {
7723       EnsureArgumentsArePushedForAccess();
7724
7725       // Number of arguments without receiver.
7726       HInstruction* elements = function_state()->arguments_elements();
7727       int argument_count = environment()->
7728           arguments_environment()->parameter_count() - 1;
7729       HInstruction* length = Add<HConstant>(argument_count);
7730       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7731       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7732     }
7733   }
7734   ast_context()->ReturnInstruction(result, expr->id());
7735   return true;
7736 }
7737
7738
7739 HValue* HOptimizedGraphBuilder::BuildNamedAccess(
7740     PropertyAccessType access, BailoutId ast_id, BailoutId return_id,
7741     Expression* expr, FeedbackVectorICSlot slot, HValue* object,
7742     Handle<String> name, HValue* value, bool is_uninitialized) {
7743   SmallMapList* maps;
7744   ComputeReceiverTypes(expr, object, &maps, zone());
7745   DCHECK(maps != NULL);
7746
7747   if (maps->length() > 0) {
7748     PropertyAccessInfo info(this, access, maps->first(), name);
7749     if (!info.CanAccessAsMonomorphic(maps)) {
7750       HandlePolymorphicNamedFieldAccess(access, expr, slot, ast_id, return_id,
7751                                         object, value, maps, name);
7752       return NULL;
7753     }
7754
7755     HValue* checked_object;
7756     // Type::Number() is only supported by polymorphic load/call handling.
7757     DCHECK(!info.IsNumberType());
7758     BuildCheckHeapObject(object);
7759     if (AreStringTypes(maps)) {
7760       checked_object =
7761           Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
7762     } else {
7763       checked_object = Add<HCheckMaps>(object, maps);
7764     }
7765     return BuildMonomorphicAccess(
7766         &info, object, checked_object, value, ast_id, return_id);
7767   }
7768
7769   return BuildNamedGeneric(access, expr, slot, object, name, value,
7770                            is_uninitialized);
7771 }
7772
7773
7774 void HOptimizedGraphBuilder::PushLoad(Property* expr,
7775                                       HValue* object,
7776                                       HValue* key) {
7777   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
7778   Push(object);
7779   if (key != NULL) Push(key);
7780   BuildLoad(expr, expr->LoadId());
7781 }
7782
7783
7784 void HOptimizedGraphBuilder::BuildLoad(Property* expr,
7785                                        BailoutId ast_id) {
7786   HInstruction* instr = NULL;
7787   if (expr->IsStringAccess()) {
7788     HValue* index = Pop();
7789     HValue* string = Pop();
7790     HInstruction* char_code = BuildStringCharCodeAt(string, index);
7791     AddInstruction(char_code);
7792     instr = NewUncasted<HStringCharFromCode>(char_code);
7793
7794   } else if (expr->key()->IsPropertyName()) {
7795     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7796     HValue* object = Pop();
7797
7798     HValue* value = BuildNamedAccess(LOAD, ast_id, expr->LoadId(), expr,
7799                                      expr->PropertyFeedbackSlot(), object, name,
7800                                      NULL, expr->IsUninitialized());
7801     if (value == NULL) return;
7802     if (value->IsPhi()) return ast_context()->ReturnValue(value);
7803     instr = HInstruction::cast(value);
7804     if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
7805
7806   } else {
7807     HValue* key = Pop();
7808     HValue* obj = Pop();
7809
7810     bool has_side_effects = false;
7811     HValue* load = HandleKeyedElementAccess(
7812         obj, key, NULL, expr, expr->PropertyFeedbackSlot(), ast_id,
7813         expr->LoadId(), LOAD, &has_side_effects);
7814     if (has_side_effects) {
7815       if (ast_context()->IsEffect()) {
7816         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7817       } else {
7818         Push(load);
7819         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7820         Drop(1);
7821       }
7822     }
7823     if (load == NULL) return;
7824     return ast_context()->ReturnValue(load);
7825   }
7826   return ast_context()->ReturnInstruction(instr, ast_id);
7827 }
7828
7829
7830 void HOptimizedGraphBuilder::VisitProperty(Property* expr) {
7831   DCHECK(!HasStackOverflow());
7832   DCHECK(current_block() != NULL);
7833   DCHECK(current_block()->HasPredecessor());
7834
7835   if (TryArgumentsAccess(expr)) return;
7836
7837   CHECK_ALIVE(VisitForValue(expr->obj()));
7838   if (!expr->key()->IsPropertyName() || expr->IsStringAccess()) {
7839     CHECK_ALIVE(VisitForValue(expr->key()));
7840   }
7841
7842   BuildLoad(expr, expr->id());
7843 }
7844
7845
7846 HInstruction* HGraphBuilder::BuildConstantMapCheck(Handle<JSObject> constant) {
7847   HCheckMaps* check = Add<HCheckMaps>(
7848       Add<HConstant>(constant), handle(constant->map()));
7849   check->ClearDependsOnFlag(kElementsKind);
7850   return check;
7851 }
7852
7853
7854 HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
7855                                                      Handle<JSObject> holder) {
7856   PrototypeIterator iter(isolate(), prototype,
7857                          PrototypeIterator::START_AT_RECEIVER);
7858   while (holder.is_null() ||
7859          !PrototypeIterator::GetCurrent(iter).is_identical_to(holder)) {
7860     BuildConstantMapCheck(
7861         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7862     iter.Advance();
7863     if (iter.IsAtEnd()) {
7864       return NULL;
7865     }
7866   }
7867   return BuildConstantMapCheck(
7868       Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7869 }
7870
7871
7872 void HOptimizedGraphBuilder::AddCheckPrototypeMaps(Handle<JSObject> holder,
7873                                                    Handle<Map> receiver_map) {
7874   if (!holder.is_null()) {
7875     Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
7876     BuildCheckPrototypeMaps(prototype, holder);
7877   }
7878 }
7879
7880
7881 HInstruction* HOptimizedGraphBuilder::NewPlainFunctionCall(
7882     HValue* fun, int argument_count, bool pass_argument_count) {
7883   return New<HCallJSFunction>(fun, argument_count, pass_argument_count);
7884 }
7885
7886
7887 HInstruction* HOptimizedGraphBuilder::NewArgumentAdaptorCall(
7888     HValue* fun, HValue* context,
7889     int argument_count, HValue* expected_param_count) {
7890   ArgumentAdaptorDescriptor descriptor(isolate());
7891   HValue* arity = Add<HConstant>(argument_count - 1);
7892
7893   HValue* op_vals[] = { context, fun, arity, expected_param_count };
7894
7895   Handle<Code> adaptor =
7896       isolate()->builtins()->ArgumentsAdaptorTrampoline();
7897   HConstant* adaptor_value = Add<HConstant>(adaptor);
7898
7899   return New<HCallWithDescriptor>(adaptor_value, argument_count, descriptor,
7900                                   Vector<HValue*>(op_vals, arraysize(op_vals)));
7901 }
7902
7903
7904 HInstruction* HOptimizedGraphBuilder::BuildCallConstantFunction(
7905     Handle<JSFunction> jsfun, int argument_count) {
7906   HValue* target = Add<HConstant>(jsfun);
7907   // For constant functions, we try to avoid calling the
7908   // argument adaptor and instead call the function directly
7909   int formal_parameter_count =
7910       jsfun->shared()->internal_formal_parameter_count();
7911   bool dont_adapt_arguments =
7912       (formal_parameter_count ==
7913        SharedFunctionInfo::kDontAdaptArgumentsSentinel);
7914   int arity = argument_count - 1;
7915   bool can_invoke_directly =
7916       dont_adapt_arguments || formal_parameter_count == arity;
7917   if (can_invoke_directly) {
7918     if (jsfun.is_identical_to(current_info()->closure())) {
7919       graph()->MarkRecursive();
7920     }
7921     return NewPlainFunctionCall(target, argument_count, dont_adapt_arguments);
7922   } else {
7923     HValue* param_count_value = Add<HConstant>(formal_parameter_count);
7924     HValue* context = Add<HLoadNamedField>(
7925         target, nullptr, HObjectAccess::ForFunctionContextPointer());
7926     return NewArgumentAdaptorCall(target, context,
7927         argument_count, param_count_value);
7928   }
7929   UNREACHABLE();
7930   return NULL;
7931 }
7932
7933
7934 class FunctionSorter {
7935  public:
7936   explicit FunctionSorter(int index = 0, int ticks = 0, int size = 0)
7937       : index_(index), ticks_(ticks), size_(size) {}
7938
7939   int index() const { return index_; }
7940   int ticks() const { return ticks_; }
7941   int size() const { return size_; }
7942
7943  private:
7944   int index_;
7945   int ticks_;
7946   int size_;
7947 };
7948
7949
7950 inline bool operator<(const FunctionSorter& lhs, const FunctionSorter& rhs) {
7951   int diff = lhs.ticks() - rhs.ticks();
7952   if (diff != 0) return diff > 0;
7953   return lhs.size() < rhs.size();
7954 }
7955
7956
7957 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(Call* expr,
7958                                                         HValue* receiver,
7959                                                         SmallMapList* maps,
7960                                                         Handle<String> name) {
7961   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
7962   FunctionSorter order[kMaxCallPolymorphism];
7963
7964   bool handle_smi = false;
7965   bool handled_string = false;
7966   int ordered_functions = 0;
7967
7968   int i;
7969   for (i = 0; i < maps->length() && ordered_functions < kMaxCallPolymorphism;
7970        ++i) {
7971     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
7972     if (info.CanAccessMonomorphic() && info.IsDataConstant() &&
7973         info.constant()->IsJSFunction()) {
7974       if (info.IsStringType()) {
7975         if (handled_string) continue;
7976         handled_string = true;
7977       }
7978       Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7979       if (info.IsNumberType()) {
7980         handle_smi = true;
7981       }
7982       expr->set_target(target);
7983       order[ordered_functions++] = FunctionSorter(
7984           i, target->shared()->profiler_ticks(), InliningAstSize(target));
7985     }
7986   }
7987
7988   std::sort(order, order + ordered_functions);
7989
7990   if (i < maps->length()) {
7991     maps->Clear();
7992     ordered_functions = -1;
7993   }
7994
7995   HBasicBlock* number_block = NULL;
7996   HBasicBlock* join = NULL;
7997   handled_string = false;
7998   int count = 0;
7999
8000   for (int fn = 0; fn < ordered_functions; ++fn) {
8001     int i = order[fn].index();
8002     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
8003     if (info.IsStringType()) {
8004       if (handled_string) continue;
8005       handled_string = true;
8006     }
8007     // Reloads the target.
8008     info.CanAccessMonomorphic();
8009     Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
8010
8011     expr->set_target(target);
8012     if (count == 0) {
8013       // Only needed once.
8014       join = graph()->CreateBasicBlock();
8015       if (handle_smi) {
8016         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
8017         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
8018         number_block = graph()->CreateBasicBlock();
8019         FinishCurrentBlock(New<HIsSmiAndBranch>(
8020                 receiver, empty_smi_block, not_smi_block));
8021         GotoNoSimulate(empty_smi_block, number_block);
8022         set_current_block(not_smi_block);
8023       } else {
8024         BuildCheckHeapObject(receiver);
8025       }
8026     }
8027     ++count;
8028     HBasicBlock* if_true = graph()->CreateBasicBlock();
8029     HBasicBlock* if_false = graph()->CreateBasicBlock();
8030     HUnaryControlInstruction* compare;
8031
8032     Handle<Map> map = info.map();
8033     if (info.IsNumberType()) {
8034       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
8035       compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
8036     } else if (info.IsStringType()) {
8037       compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
8038     } else {
8039       compare = New<HCompareMap>(receiver, map, if_true, if_false);
8040     }
8041     FinishCurrentBlock(compare);
8042
8043     if (info.IsNumberType()) {
8044       GotoNoSimulate(if_true, number_block);
8045       if_true = number_block;
8046     }
8047
8048     set_current_block(if_true);
8049
8050     AddCheckPrototypeMaps(info.holder(), map);
8051
8052     HValue* function = Add<HConstant>(expr->target());
8053     environment()->SetExpressionStackAt(0, function);
8054     Push(receiver);
8055     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8056     bool needs_wrapping = info.NeedsWrappingFor(target);
8057     bool try_inline = FLAG_polymorphic_inlining && !needs_wrapping;
8058     if (FLAG_trace_inlining && try_inline) {
8059       Handle<JSFunction> caller = current_info()->closure();
8060       base::SmartArrayPointer<char> caller_name =
8061           caller->shared()->DebugName()->ToCString();
8062       PrintF("Trying to inline the polymorphic call to %s from %s\n",
8063              name->ToCString().get(),
8064              caller_name.get());
8065     }
8066     if (try_inline && TryInlineCall(expr)) {
8067       // Trying to inline will signal that we should bailout from the
8068       // entire compilation by setting stack overflow on the visitor.
8069       if (HasStackOverflow()) return;
8070     } else {
8071       // Since HWrapReceiver currently cannot actually wrap numbers and strings,
8072       // use the regular CallFunctionStub for method calls to wrap the receiver.
8073       // TODO(verwaest): Support creation of value wrappers directly in
8074       // HWrapReceiver.
8075       HInstruction* call = needs_wrapping
8076           ? NewUncasted<HCallFunction>(
8077               function, argument_count, WRAP_AND_CALL)
8078           : BuildCallConstantFunction(target, argument_count);
8079       PushArgumentsFromEnvironment(argument_count);
8080       AddInstruction(call);
8081       Drop(1);  // Drop the function.
8082       if (!ast_context()->IsEffect()) Push(call);
8083     }
8084
8085     if (current_block() != NULL) Goto(join);
8086     set_current_block(if_false);
8087   }
8088
8089   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
8090   // know about and do not want to handle ones we've never seen.  Otherwise
8091   // use a generic IC.
8092   if (ordered_functions == maps->length() && FLAG_deoptimize_uncommon_cases) {
8093     FinishExitWithHardDeoptimization(Deoptimizer::kUnknownMapInPolymorphicCall);
8094   } else {
8095     Property* prop = expr->expression()->AsProperty();
8096     HInstruction* function =
8097         BuildNamedGeneric(LOAD, prop, prop->PropertyFeedbackSlot(), receiver,
8098                           name, NULL, prop->IsUninitialized());
8099     AddInstruction(function);
8100     Push(function);
8101     AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
8102
8103     environment()->SetExpressionStackAt(1, function);
8104     environment()->SetExpressionStackAt(0, receiver);
8105     CHECK_ALIVE(VisitExpressions(expr->arguments()));
8106
8107     CallFunctionFlags flags = receiver->type().IsJSObject()
8108         ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
8109     HInstruction* call = New<HCallFunction>(
8110         function, argument_count, flags);
8111
8112     PushArgumentsFromEnvironment(argument_count);
8113
8114     Drop(1);  // Function.
8115
8116     if (join != NULL) {
8117       AddInstruction(call);
8118       if (!ast_context()->IsEffect()) Push(call);
8119       Goto(join);
8120     } else {
8121       return ast_context()->ReturnInstruction(call, expr->id());
8122     }
8123   }
8124
8125   // We assume that control flow is always live after an expression.  So
8126   // even without predecessors to the join block, we set it as the exit
8127   // block and continue by adding instructions there.
8128   DCHECK(join != NULL);
8129   if (join->HasPredecessor()) {
8130     set_current_block(join);
8131     join->SetJoinId(expr->id());
8132     if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
8133   } else {
8134     set_current_block(NULL);
8135   }
8136 }
8137
8138
8139 void HOptimizedGraphBuilder::TraceInline(Handle<JSFunction> target,
8140                                          Handle<JSFunction> caller,
8141                                          const char* reason) {
8142   if (FLAG_trace_inlining) {
8143     base::SmartArrayPointer<char> target_name =
8144         target->shared()->DebugName()->ToCString();
8145     base::SmartArrayPointer<char> caller_name =
8146         caller->shared()->DebugName()->ToCString();
8147     if (reason == NULL) {
8148       PrintF("Inlined %s called from %s.\n", target_name.get(),
8149              caller_name.get());
8150     } else {
8151       PrintF("Did not inline %s called from %s (%s).\n",
8152              target_name.get(), caller_name.get(), reason);
8153     }
8154   }
8155 }
8156
8157
8158 static const int kNotInlinable = 1000000000;
8159
8160
8161 int HOptimizedGraphBuilder::InliningAstSize(Handle<JSFunction> target) {
8162   if (!FLAG_use_inlining) return kNotInlinable;
8163
8164   // Precondition: call is monomorphic and we have found a target with the
8165   // appropriate arity.
8166   Handle<JSFunction> caller = current_info()->closure();
8167   Handle<SharedFunctionInfo> target_shared(target->shared());
8168
8169   // Always inline functions that force inlining.
8170   if (target_shared->force_inline()) {
8171     return 0;
8172   }
8173   if (target->IsBuiltin()) {
8174     return kNotInlinable;
8175   }
8176
8177   if (target_shared->IsApiFunction()) {
8178     TraceInline(target, caller, "target is api function");
8179     return kNotInlinable;
8180   }
8181
8182   // Do a quick check on source code length to avoid parsing large
8183   // inlining candidates.
8184   if (target_shared->SourceSize() >
8185       Min(FLAG_max_inlined_source_size, kUnlimitedMaxInlinedSourceSize)) {
8186     TraceInline(target, caller, "target text too big");
8187     return kNotInlinable;
8188   }
8189
8190   // Target must be inlineable.
8191   if (!target_shared->IsInlineable()) {
8192     TraceInline(target, caller, "target not inlineable");
8193     return kNotInlinable;
8194   }
8195   if (target_shared->disable_optimization_reason() != kNoReason) {
8196     TraceInline(target, caller, "target contains unsupported syntax [early]");
8197     return kNotInlinable;
8198   }
8199
8200   int nodes_added = target_shared->ast_node_count();
8201   return nodes_added;
8202 }
8203
8204
8205 bool HOptimizedGraphBuilder::TryInline(Handle<JSFunction> target,
8206                                        int arguments_count,
8207                                        HValue* implicit_return_value,
8208                                        BailoutId ast_id, BailoutId return_id,
8209                                        InliningKind inlining_kind) {
8210   if (target->context()->native_context() !=
8211       top_info()->closure()->context()->native_context()) {
8212     return false;
8213   }
8214   int nodes_added = InliningAstSize(target);
8215   if (nodes_added == kNotInlinable) return false;
8216
8217   Handle<JSFunction> caller = current_info()->closure();
8218
8219   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8220     TraceInline(target, caller, "target AST is too large [early]");
8221     return false;
8222   }
8223
8224   // Don't inline deeper than the maximum number of inlining levels.
8225   HEnvironment* env = environment();
8226   int current_level = 1;
8227   while (env->outer() != NULL) {
8228     if (current_level == FLAG_max_inlining_levels) {
8229       TraceInline(target, caller, "inline depth limit reached");
8230       return false;
8231     }
8232     if (env->outer()->frame_type() == JS_FUNCTION) {
8233       current_level++;
8234     }
8235     env = env->outer();
8236   }
8237
8238   // Don't inline recursive functions.
8239   for (FunctionState* state = function_state();
8240        state != NULL;
8241        state = state->outer()) {
8242     if (*state->compilation_info()->closure() == *target) {
8243       TraceInline(target, caller, "target is recursive");
8244       return false;
8245     }
8246   }
8247
8248   // We don't want to add more than a certain number of nodes from inlining.
8249   // Always inline small methods (<= 10 nodes).
8250   if (inlined_count_ > Min(FLAG_max_inlined_nodes_cumulative,
8251                            kUnlimitedMaxInlinedNodesCumulative)) {
8252     TraceInline(target, caller, "cumulative AST node limit reached");
8253     return false;
8254   }
8255
8256   // Parse and allocate variables.
8257   // Use the same AstValueFactory for creating strings in the sub-compilation
8258   // step, but don't transfer ownership to target_info.
8259   ParseInfo parse_info(zone(), target);
8260   parse_info.set_ast_value_factory(
8261       top_info()->parse_info()->ast_value_factory());
8262   parse_info.set_ast_value_factory_owned(false);
8263
8264   CompilationInfo target_info(&parse_info);
8265   Handle<SharedFunctionInfo> target_shared(target->shared());
8266   if (target_shared->HasDebugInfo()) {
8267     TraceInline(target, caller, "target is being debugged");
8268     return false;
8269   }
8270   if (!Compiler::ParseAndAnalyze(target_info.parse_info())) {
8271     if (target_info.isolate()->has_pending_exception()) {
8272       // Parse or scope error, never optimize this function.
8273       SetStackOverflow();
8274       target_shared->DisableOptimization(kParseScopeError);
8275     }
8276     TraceInline(target, caller, "parse failure");
8277     return false;
8278   }
8279
8280   if (target_info.scope()->num_heap_slots() > 0) {
8281     TraceInline(target, caller, "target has context-allocated variables");
8282     return false;
8283   }
8284   FunctionLiteral* function = target_info.function();
8285
8286   // The following conditions must be checked again after re-parsing, because
8287   // earlier the information might not have been complete due to lazy parsing.
8288   nodes_added = function->ast_node_count();
8289   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8290     TraceInline(target, caller, "target AST is too large [late]");
8291     return false;
8292   }
8293   if (function->dont_optimize()) {
8294     TraceInline(target, caller, "target contains unsupported syntax [late]");
8295     return false;
8296   }
8297
8298   // If the function uses the arguments object check that inlining of functions
8299   // with arguments object is enabled and the arguments-variable is
8300   // stack allocated.
8301   if (function->scope()->arguments() != NULL) {
8302     if (!FLAG_inline_arguments) {
8303       TraceInline(target, caller, "target uses arguments object");
8304       return false;
8305     }
8306   }
8307
8308   // All declarations must be inlineable.
8309   ZoneList<Declaration*>* decls = target_info.scope()->declarations();
8310   int decl_count = decls->length();
8311   for (int i = 0; i < decl_count; ++i) {
8312     if (!decls->at(i)->IsInlineable()) {
8313       TraceInline(target, caller, "target has non-trivial declaration");
8314       return false;
8315     }
8316   }
8317
8318   // Generate the deoptimization data for the unoptimized version of
8319   // the target function if we don't already have it.
8320   if (!Compiler::EnsureDeoptimizationSupport(&target_info)) {
8321     TraceInline(target, caller, "could not generate deoptimization info");
8322     return false;
8323   }
8324
8325   // In strong mode it is an error to call a function with too few arguments.
8326   // In that case do not inline because then the arity check would be skipped.
8327   if (is_strong(function->language_mode()) &&
8328       arguments_count < function->parameter_count()) {
8329     TraceInline(target, caller,
8330                 "too few arguments passed to a strong function");
8331     return false;
8332   }
8333
8334   // ----------------------------------------------------------------
8335   // After this point, we've made a decision to inline this function (so
8336   // TryInline should always return true).
8337
8338   // Type-check the inlined function.
8339   DCHECK(target_shared->has_deoptimization_support());
8340   AstTyper::Run(&target_info);
8341
8342   int inlining_id = 0;
8343   if (top_info()->is_tracking_positions()) {
8344     inlining_id = top_info()->TraceInlinedFunction(
8345         target_shared, source_position(), function_state()->inlining_id());
8346   }
8347
8348   // Save the pending call context. Set up new one for the inlined function.
8349   // The function state is new-allocated because we need to delete it
8350   // in two different places.
8351   FunctionState* target_state =
8352       new FunctionState(this, &target_info, inlining_kind, inlining_id);
8353
8354   HConstant* undefined = graph()->GetConstantUndefined();
8355
8356   HEnvironment* inner_env =
8357       environment()->CopyForInlining(target,
8358                                      arguments_count,
8359                                      function,
8360                                      undefined,
8361                                      function_state()->inlining_kind());
8362
8363   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
8364   inner_env->BindContext(context);
8365
8366   // Create a dematerialized arguments object for the function, also copy the
8367   // current arguments values to use them for materialization.
8368   HEnvironment* arguments_env = inner_env->arguments_environment();
8369   int parameter_count = arguments_env->parameter_count();
8370   HArgumentsObject* arguments_object = Add<HArgumentsObject>(parameter_count);
8371   for (int i = 0; i < parameter_count; i++) {
8372     arguments_object->AddArgument(arguments_env->Lookup(i), zone());
8373   }
8374
8375   // If the function uses arguments object then bind bind one.
8376   if (function->scope()->arguments() != NULL) {
8377     DCHECK(function->scope()->arguments()->IsStackAllocated());
8378     inner_env->Bind(function->scope()->arguments(), arguments_object);
8379   }
8380
8381   // Capture the state before invoking the inlined function for deopt in the
8382   // inlined function. This simulate has no bailout-id since it's not directly
8383   // reachable for deopt, and is only used to capture the state. If the simulate
8384   // becomes reachable by merging, the ast id of the simulate merged into it is
8385   // adopted.
8386   Add<HSimulate>(BailoutId::None());
8387
8388   current_block()->UpdateEnvironment(inner_env);
8389   Scope* saved_scope = scope();
8390   set_scope(target_info.scope());
8391   HEnterInlined* enter_inlined =
8392       Add<HEnterInlined>(return_id, target, context, arguments_count, function,
8393                          function_state()->inlining_kind(),
8394                          function->scope()->arguments(), arguments_object);
8395   if (top_info()->is_tracking_positions()) {
8396     enter_inlined->set_inlining_id(inlining_id);
8397   }
8398   function_state()->set_entry(enter_inlined);
8399
8400   VisitDeclarations(target_info.scope()->declarations());
8401   VisitStatements(function->body());
8402   set_scope(saved_scope);
8403   if (HasStackOverflow()) {
8404     // Bail out if the inline function did, as we cannot residualize a call
8405     // instead, but do not disable optimization for the outer function.
8406     TraceInline(target, caller, "inline graph construction failed");
8407     target_shared->DisableOptimization(kInliningBailedOut);
8408     current_info()->RetryOptimization(kInliningBailedOut);
8409     delete target_state;
8410     return true;
8411   }
8412
8413   // Update inlined nodes count.
8414   inlined_count_ += nodes_added;
8415
8416   Handle<Code> unoptimized_code(target_shared->code());
8417   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
8418   Handle<TypeFeedbackInfo> type_info(
8419       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
8420   graph()->update_type_change_checksum(type_info->own_type_change_checksum());
8421
8422   TraceInline(target, caller, NULL);
8423
8424   if (current_block() != NULL) {
8425     FunctionState* state = function_state();
8426     if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
8427       // Falling off the end of an inlined construct call. In a test context the
8428       // return value will always evaluate to true, in a value context the
8429       // return value is the newly allocated receiver.
8430       if (call_context()->IsTest()) {
8431         Goto(inlined_test_context()->if_true(), state);
8432       } else if (call_context()->IsEffect()) {
8433         Goto(function_return(), state);
8434       } else {
8435         DCHECK(call_context()->IsValue());
8436         AddLeaveInlined(implicit_return_value, state);
8437       }
8438     } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
8439       // Falling off the end of an inlined setter call. The returned value is
8440       // never used, the value of an assignment is always the value of the RHS
8441       // of the assignment.
8442       if (call_context()->IsTest()) {
8443         inlined_test_context()->ReturnValue(implicit_return_value);
8444       } else if (call_context()->IsEffect()) {
8445         Goto(function_return(), state);
8446       } else {
8447         DCHECK(call_context()->IsValue());
8448         AddLeaveInlined(implicit_return_value, state);
8449       }
8450     } else {
8451       // Falling off the end of a normal inlined function. This basically means
8452       // returning undefined.
8453       if (call_context()->IsTest()) {
8454         Goto(inlined_test_context()->if_false(), state);
8455       } else if (call_context()->IsEffect()) {
8456         Goto(function_return(), state);
8457       } else {
8458         DCHECK(call_context()->IsValue());
8459         AddLeaveInlined(undefined, state);
8460       }
8461     }
8462   }
8463
8464   // Fix up the function exits.
8465   if (inlined_test_context() != NULL) {
8466     HBasicBlock* if_true = inlined_test_context()->if_true();
8467     HBasicBlock* if_false = inlined_test_context()->if_false();
8468
8469     HEnterInlined* entry = function_state()->entry();
8470
8471     // Pop the return test context from the expression context stack.
8472     DCHECK(ast_context() == inlined_test_context());
8473     ClearInlinedTestContext();
8474     delete target_state;
8475
8476     // Forward to the real test context.
8477     if (if_true->HasPredecessor()) {
8478       entry->RegisterReturnTarget(if_true, zone());
8479       if_true->SetJoinId(ast_id);
8480       HBasicBlock* true_target = TestContext::cast(ast_context())->if_true();
8481       Goto(if_true, true_target, function_state());
8482     }
8483     if (if_false->HasPredecessor()) {
8484       entry->RegisterReturnTarget(if_false, zone());
8485       if_false->SetJoinId(ast_id);
8486       HBasicBlock* false_target = TestContext::cast(ast_context())->if_false();
8487       Goto(if_false, false_target, function_state());
8488     }
8489     set_current_block(NULL);
8490     return true;
8491
8492   } else if (function_return()->HasPredecessor()) {
8493     function_state()->entry()->RegisterReturnTarget(function_return(), zone());
8494     function_return()->SetJoinId(ast_id);
8495     set_current_block(function_return());
8496   } else {
8497     set_current_block(NULL);
8498   }
8499   delete target_state;
8500   return true;
8501 }
8502
8503
8504 bool HOptimizedGraphBuilder::TryInlineCall(Call* expr) {
8505   return TryInline(expr->target(), expr->arguments()->length(), NULL,
8506                    expr->id(), expr->ReturnId(), NORMAL_RETURN);
8507 }
8508
8509
8510 bool HOptimizedGraphBuilder::TryInlineConstruct(CallNew* expr,
8511                                                 HValue* implicit_return_value) {
8512   return TryInline(expr->target(), expr->arguments()->length(),
8513                    implicit_return_value, expr->id(), expr->ReturnId(),
8514                    CONSTRUCT_CALL_RETURN);
8515 }
8516
8517
8518 bool HOptimizedGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
8519                                              Handle<Map> receiver_map,
8520                                              BailoutId ast_id,
8521                                              BailoutId return_id) {
8522   if (TryInlineApiGetter(getter, receiver_map, ast_id)) return true;
8523   return TryInline(getter, 0, NULL, ast_id, return_id, GETTER_CALL_RETURN);
8524 }
8525
8526
8527 bool HOptimizedGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
8528                                              Handle<Map> receiver_map,
8529                                              BailoutId id,
8530                                              BailoutId assignment_id,
8531                                              HValue* implicit_return_value) {
8532   if (TryInlineApiSetter(setter, receiver_map, id)) return true;
8533   return TryInline(setter, 1, implicit_return_value, id, assignment_id,
8534                    SETTER_CALL_RETURN);
8535 }
8536
8537
8538 bool HOptimizedGraphBuilder::TryInlineIndirectCall(Handle<JSFunction> function,
8539                                                    Call* expr,
8540                                                    int arguments_count) {
8541   return TryInline(function, arguments_count, NULL, expr->id(),
8542                    expr->ReturnId(), NORMAL_RETURN);
8543 }
8544
8545
8546 bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
8547   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8548   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8549   switch (id) {
8550     case kMathExp:
8551       if (!FLAG_fast_math) break;
8552       // Fall through if FLAG_fast_math.
8553     case kMathRound:
8554     case kMathFround:
8555     case kMathFloor:
8556     case kMathAbs:
8557     case kMathSqrt:
8558     case kMathLog:
8559     case kMathClz32:
8560       if (expr->arguments()->length() == 1) {
8561         HValue* argument = Pop();
8562         Drop(2);  // Receiver and function.
8563         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8564         ast_context()->ReturnInstruction(op, expr->id());
8565         return true;
8566       }
8567       break;
8568     case kMathImul:
8569       if (expr->arguments()->length() == 2) {
8570         HValue* right = Pop();
8571         HValue* left = Pop();
8572         Drop(2);  // Receiver and function.
8573         HInstruction* op =
8574             HMul::NewImul(isolate(), zone(), context(), left, right);
8575         ast_context()->ReturnInstruction(op, expr->id());
8576         return true;
8577       }
8578       break;
8579     default:
8580       // Not supported for inlining yet.
8581       break;
8582   }
8583   return false;
8584 }
8585
8586
8587 // static
8588 bool HOptimizedGraphBuilder::IsReadOnlyLengthDescriptor(
8589     Handle<Map> jsarray_map) {
8590   DCHECK(!jsarray_map->is_dictionary_map());
8591   Isolate* isolate = jsarray_map->GetIsolate();
8592   Handle<Name> length_string = isolate->factory()->length_string();
8593   DescriptorArray* descriptors = jsarray_map->instance_descriptors();
8594   int number = descriptors->SearchWithCache(*length_string, *jsarray_map);
8595   DCHECK_NE(DescriptorArray::kNotFound, number);
8596   return descriptors->GetDetails(number).IsReadOnly();
8597 }
8598
8599
8600 // static
8601 bool HOptimizedGraphBuilder::CanInlineArrayResizeOperation(
8602     Handle<Map> receiver_map) {
8603   return !receiver_map.is_null() &&
8604          receiver_map->instance_type() == JS_ARRAY_TYPE &&
8605          IsFastElementsKind(receiver_map->elements_kind()) &&
8606          !receiver_map->is_dictionary_map() &&
8607          !IsReadOnlyLengthDescriptor(receiver_map) &&
8608          !receiver_map->is_observed() && receiver_map->is_extensible();
8609 }
8610
8611
8612 bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
8613     Call* expr, Handle<JSFunction> function, Handle<Map> receiver_map,
8614     int args_count_no_receiver) {
8615   if (!function->shared()->HasBuiltinFunctionId()) return false;
8616   BuiltinFunctionId id = function->shared()->builtin_function_id();
8617   int argument_count = args_count_no_receiver + 1;  // Plus receiver.
8618
8619   if (receiver_map.is_null()) {
8620     HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
8621     if (receiver->IsConstant() &&
8622         HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
8623       receiver_map =
8624           handle(Handle<HeapObject>::cast(
8625                      HConstant::cast(receiver)->handle(isolate()))->map());
8626     }
8627   }
8628   // Try to inline calls like Math.* as operations in the calling function.
8629   switch (id) {
8630     case kStringCharCodeAt:
8631     case kStringCharAt:
8632       if (argument_count == 2) {
8633         HValue* index = Pop();
8634         HValue* string = Pop();
8635         Drop(1);  // Function.
8636         HInstruction* char_code =
8637             BuildStringCharCodeAt(string, index);
8638         if (id == kStringCharCodeAt) {
8639           ast_context()->ReturnInstruction(char_code, expr->id());
8640           return true;
8641         }
8642         AddInstruction(char_code);
8643         HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
8644         ast_context()->ReturnInstruction(result, expr->id());
8645         return true;
8646       }
8647       break;
8648     case kStringFromCharCode:
8649       if (argument_count == 2) {
8650         HValue* argument = Pop();
8651         Drop(2);  // Receiver and function.
8652         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
8653         ast_context()->ReturnInstruction(result, expr->id());
8654         return true;
8655       }
8656       break;
8657     case kMathExp:
8658       if (!FLAG_fast_math) break;
8659       // Fall through if FLAG_fast_math.
8660     case kMathRound:
8661     case kMathFround:
8662     case kMathFloor:
8663     case kMathAbs:
8664     case kMathSqrt:
8665     case kMathLog:
8666     case kMathClz32:
8667       if (argument_count == 2) {
8668         HValue* argument = Pop();
8669         Drop(2);  // Receiver and function.
8670         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8671         ast_context()->ReturnInstruction(op, expr->id());
8672         return true;
8673       }
8674       break;
8675     case kMathPow:
8676       if (argument_count == 3) {
8677         HValue* right = Pop();
8678         HValue* left = Pop();
8679         Drop(2);  // Receiver and function.
8680         HInstruction* result = NULL;
8681         // Use sqrt() if exponent is 0.5 or -0.5.
8682         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
8683           double exponent = HConstant::cast(right)->DoubleValue();
8684           if (exponent == 0.5) {
8685             result = NewUncasted<HUnaryMathOperation>(left, kMathPowHalf);
8686           } else if (exponent == -0.5) {
8687             HValue* one = graph()->GetConstant1();
8688             HInstruction* sqrt = AddUncasted<HUnaryMathOperation>(
8689                 left, kMathPowHalf);
8690             // MathPowHalf doesn't have side effects so there's no need for
8691             // an environment simulation here.
8692             DCHECK(!sqrt->HasObservableSideEffects());
8693             result = NewUncasted<HDiv>(one, sqrt);
8694           } else if (exponent == 2.0) {
8695             result = NewUncasted<HMul>(left, left);
8696           }
8697         }
8698
8699         if (result == NULL) {
8700           result = NewUncasted<HPower>(left, right);
8701         }
8702         ast_context()->ReturnInstruction(result, expr->id());
8703         return true;
8704       }
8705       break;
8706     case kMathMax:
8707     case kMathMin:
8708       if (argument_count == 3) {
8709         HValue* right = Pop();
8710         HValue* left = Pop();
8711         Drop(2);  // Receiver and function.
8712         HMathMinMax::Operation op = (id == kMathMin) ? HMathMinMax::kMathMin
8713                                                      : HMathMinMax::kMathMax;
8714         HInstruction* result = NewUncasted<HMathMinMax>(left, right, op);
8715         ast_context()->ReturnInstruction(result, expr->id());
8716         return true;
8717       }
8718       break;
8719     case kMathImul:
8720       if (argument_count == 3) {
8721         HValue* right = Pop();
8722         HValue* left = Pop();
8723         Drop(2);  // Receiver and function.
8724         HInstruction* result =
8725             HMul::NewImul(isolate(), zone(), context(), left, right);
8726         ast_context()->ReturnInstruction(result, expr->id());
8727         return true;
8728       }
8729       break;
8730     case kArrayPop: {
8731       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8732       ElementsKind elements_kind = receiver_map->elements_kind();
8733
8734       Drop(args_count_no_receiver);
8735       HValue* result;
8736       HValue* reduced_length;
8737       HValue* receiver = Pop();
8738
8739       HValue* checked_object = AddCheckMap(receiver, receiver_map);
8740       HValue* length =
8741           Add<HLoadNamedField>(checked_object, nullptr,
8742                                HObjectAccess::ForArrayLength(elements_kind));
8743
8744       Drop(1);  // Function.
8745
8746       { NoObservableSideEffectsScope scope(this);
8747         IfBuilder length_checker(this);
8748
8749         HValue* bounds_check = length_checker.If<HCompareNumericAndBranch>(
8750             length, graph()->GetConstant0(), Token::EQ);
8751         length_checker.Then();
8752
8753         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8754
8755         length_checker.Else();
8756         HValue* elements = AddLoadElements(checked_object);
8757         // Ensure that we aren't popping from a copy-on-write array.
8758         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8759           elements = BuildCopyElementsOnWrite(checked_object, elements,
8760                                               elements_kind, length);
8761         }
8762         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
8763         result = AddElementAccess(elements, reduced_length, NULL,
8764                                   bounds_check, elements_kind, LOAD);
8765         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
8766                            ? graph()->GetConstantHole()
8767                            : Add<HConstant>(HConstant::kHoleNaN);
8768         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8769           elements_kind = FAST_HOLEY_ELEMENTS;
8770         }
8771         AddElementAccess(
8772             elements, reduced_length, hole, bounds_check, elements_kind, STORE);
8773         Add<HStoreNamedField>(
8774             checked_object, HObjectAccess::ForArrayLength(elements_kind),
8775             reduced_length, STORE_TO_INITIALIZED_ENTRY);
8776
8777         if (!ast_context()->IsEffect()) Push(result);
8778
8779         length_checker.End();
8780       }
8781       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8782       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8783       if (!ast_context()->IsEffect()) Drop(1);
8784
8785       ast_context()->ReturnValue(result);
8786       return true;
8787     }
8788     case kArrayPush: {
8789       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8790       ElementsKind elements_kind = receiver_map->elements_kind();
8791
8792       // If there may be elements accessors in the prototype chain, the fast
8793       // inlined version can't be used.
8794       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8795       // If there currently can be no elements accessors on the prototype chain,
8796       // it doesn't mean that there won't be any later. Install a full prototype
8797       // chain check to trap element accessors being installed on the prototype
8798       // chain, which would cause elements to go to dictionary mode and result
8799       // in a map change.
8800       Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
8801       BuildCheckPrototypeMaps(prototype, Handle<JSObject>());
8802
8803       // Protect against adding elements to the Array prototype, which needs to
8804       // route through appropriate bottlenecks.
8805       if (isolate()->IsFastArrayConstructorPrototypeChainIntact() &&
8806           !prototype->IsJSArray()) {
8807         return false;
8808       }
8809
8810       const int argc = args_count_no_receiver;
8811       if (argc != 1) return false;
8812
8813       HValue* value_to_push = Pop();
8814       HValue* array = Pop();
8815       Drop(1);  // Drop function.
8816
8817       HInstruction* new_size = NULL;
8818       HValue* length = NULL;
8819
8820       {
8821         NoObservableSideEffectsScope scope(this);
8822
8823         length = Add<HLoadNamedField>(
8824             array, nullptr, HObjectAccess::ForArrayLength(elements_kind));
8825
8826         new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
8827
8828         bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
8829         HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
8830         BuildUncheckedMonomorphicElementAccess(
8831             checked_array, length, value_to_push, is_array, elements_kind,
8832             STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
8833
8834         if (!ast_context()->IsEffect()) Push(new_size);
8835         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8836         if (!ast_context()->IsEffect()) Drop(1);
8837       }
8838
8839       ast_context()->ReturnValue(new_size);
8840       return true;
8841     }
8842     case kArrayShift: {
8843       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8844       ElementsKind kind = receiver_map->elements_kind();
8845
8846       // If there may be elements accessors in the prototype chain, the fast
8847       // inlined version can't be used.
8848       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8849
8850       // If there currently can be no elements accessors on the prototype chain,
8851       // it doesn't mean that there won't be any later. Install a full prototype
8852       // chain check to trap element accessors being installed on the prototype
8853       // chain, which would cause elements to go to dictionary mode and result
8854       // in a map change.
8855       BuildCheckPrototypeMaps(
8856           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8857           Handle<JSObject>::null());
8858
8859       // Threshold for fast inlined Array.shift().
8860       HConstant* inline_threshold = Add<HConstant>(static_cast<int32_t>(16));
8861
8862       Drop(args_count_no_receiver);
8863       HValue* receiver = Pop();
8864       HValue* function = Pop();
8865       HValue* result;
8866
8867       {
8868         NoObservableSideEffectsScope scope(this);
8869
8870         HValue* length = Add<HLoadNamedField>(
8871             receiver, nullptr, HObjectAccess::ForArrayLength(kind));
8872
8873         IfBuilder if_lengthiszero(this);
8874         HValue* lengthiszero = if_lengthiszero.If<HCompareNumericAndBranch>(
8875             length, graph()->GetConstant0(), Token::EQ);
8876         if_lengthiszero.Then();
8877         {
8878           if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8879         }
8880         if_lengthiszero.Else();
8881         {
8882           HValue* elements = AddLoadElements(receiver);
8883
8884           // Check if we can use the fast inlined Array.shift().
8885           IfBuilder if_inline(this);
8886           if_inline.If<HCompareNumericAndBranch>(
8887               length, inline_threshold, Token::LTE);
8888           if (IsFastSmiOrObjectElementsKind(kind)) {
8889             // We cannot handle copy-on-write backing stores here.
8890             if_inline.AndIf<HCompareMap>(
8891                 elements, isolate()->factory()->fixed_array_map());
8892           }
8893           if_inline.Then();
8894           {
8895             // Remember the result.
8896             if (!ast_context()->IsEffect()) {
8897               Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
8898                                     lengthiszero, kind, LOAD));
8899             }
8900
8901             // Compute the new length.
8902             HValue* new_length = AddUncasted<HSub>(
8903                 length, graph()->GetConstant1());
8904             new_length->ClearFlag(HValue::kCanOverflow);
8905
8906             // Copy the remaining elements.
8907             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
8908             {
8909               HValue* new_key = loop.BeginBody(
8910                   graph()->GetConstant0(), new_length, Token::LT);
8911               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
8912               key->ClearFlag(HValue::kCanOverflow);
8913               ElementsKind copy_kind =
8914                   kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
8915               HValue* element = AddUncasted<HLoadKeyed>(
8916                   elements, key, lengthiszero, copy_kind, ALLOW_RETURN_HOLE);
8917               HStoreKeyed* store =
8918                   Add<HStoreKeyed>(elements, new_key, element, copy_kind);
8919               store->SetFlag(HValue::kAllowUndefinedAsNaN);
8920             }
8921             loop.EndBody();
8922
8923             // Put a hole at the end.
8924             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
8925                                ? graph()->GetConstantHole()
8926                                : Add<HConstant>(HConstant::kHoleNaN);
8927             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
8928             Add<HStoreKeyed>(
8929                 elements, new_length, hole, kind, INITIALIZING_STORE);
8930
8931             // Remember new length.
8932             Add<HStoreNamedField>(
8933                 receiver, HObjectAccess::ForArrayLength(kind),
8934                 new_length, STORE_TO_INITIALIZED_ENTRY);
8935           }
8936           if_inline.Else();
8937           {
8938             Add<HPushArguments>(receiver);
8939             result = Add<HCallJSFunction>(function, 1, true);
8940             if (!ast_context()->IsEffect()) Push(result);
8941           }
8942           if_inline.End();
8943         }
8944         if_lengthiszero.End();
8945       }
8946       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8947       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8948       if (!ast_context()->IsEffect()) Drop(1);
8949       ast_context()->ReturnValue(result);
8950       return true;
8951     }
8952     case kArrayIndexOf:
8953     case kArrayLastIndexOf: {
8954       if (receiver_map.is_null()) return false;
8955       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8956       ElementsKind kind = receiver_map->elements_kind();
8957       if (!IsFastElementsKind(kind)) return false;
8958       if (receiver_map->is_observed()) return false;
8959       if (argument_count != 2) return false;
8960       if (!receiver_map->is_extensible()) return false;
8961
8962       // If there may be elements accessors in the prototype chain, the fast
8963       // inlined version can't be used.
8964       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8965
8966       // If there currently can be no elements accessors on the prototype chain,
8967       // it doesn't mean that there won't be any later. Install a full prototype
8968       // chain check to trap element accessors being installed on the prototype
8969       // chain, which would cause elements to go to dictionary mode and result
8970       // in a map change.
8971       BuildCheckPrototypeMaps(
8972           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8973           Handle<JSObject>::null());
8974
8975       HValue* search_element = Pop();
8976       HValue* receiver = Pop();
8977       Drop(1);  // Drop function.
8978
8979       ArrayIndexOfMode mode = (id == kArrayIndexOf)
8980           ? kFirstIndexOf : kLastIndexOf;
8981       HValue* index = BuildArrayIndexOf(receiver, search_element, kind, mode);
8982
8983       if (!ast_context()->IsEffect()) Push(index);
8984       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8985       if (!ast_context()->IsEffect()) Drop(1);
8986       ast_context()->ReturnValue(index);
8987       return true;
8988     }
8989     default:
8990       // Not yet supported for inlining.
8991       break;
8992   }
8993   return false;
8994 }
8995
8996
8997 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
8998                                                       HValue* receiver) {
8999   Handle<JSFunction> function = expr->target();
9000   int argc = expr->arguments()->length();
9001   SmallMapList receiver_maps;
9002   return TryInlineApiCall(function,
9003                           receiver,
9004                           &receiver_maps,
9005                           argc,
9006                           expr->id(),
9007                           kCallApiFunction);
9008 }
9009
9010
9011 bool HOptimizedGraphBuilder::TryInlineApiMethodCall(
9012     Call* expr,
9013     HValue* receiver,
9014     SmallMapList* receiver_maps) {
9015   Handle<JSFunction> function = expr->target();
9016   int argc = expr->arguments()->length();
9017   return TryInlineApiCall(function,
9018                           receiver,
9019                           receiver_maps,
9020                           argc,
9021                           expr->id(),
9022                           kCallApiMethod);
9023 }
9024
9025
9026 bool HOptimizedGraphBuilder::TryInlineApiGetter(Handle<JSFunction> function,
9027                                                 Handle<Map> receiver_map,
9028                                                 BailoutId ast_id) {
9029   SmallMapList receiver_maps(1, zone());
9030   receiver_maps.Add(receiver_map, zone());
9031   return TryInlineApiCall(function,
9032                           NULL,  // Receiver is on expression stack.
9033                           &receiver_maps,
9034                           0,
9035                           ast_id,
9036                           kCallApiGetter);
9037 }
9038
9039
9040 bool HOptimizedGraphBuilder::TryInlineApiSetter(Handle<JSFunction> function,
9041                                                 Handle<Map> receiver_map,
9042                                                 BailoutId ast_id) {
9043   SmallMapList receiver_maps(1, zone());
9044   receiver_maps.Add(receiver_map, zone());
9045   return TryInlineApiCall(function,
9046                           NULL,  // Receiver is on expression stack.
9047                           &receiver_maps,
9048                           1,
9049                           ast_id,
9050                           kCallApiSetter);
9051 }
9052
9053
9054 bool HOptimizedGraphBuilder::TryInlineApiCall(Handle<JSFunction> function,
9055                                                HValue* receiver,
9056                                                SmallMapList* receiver_maps,
9057                                                int argc,
9058                                                BailoutId ast_id,
9059                                                ApiCallType call_type) {
9060   if (function->context()->native_context() !=
9061       top_info()->closure()->context()->native_context()) {
9062     return false;
9063   }
9064   CallOptimization optimization(function);
9065   if (!optimization.is_simple_api_call()) return false;
9066   Handle<Map> holder_map;
9067   for (int i = 0; i < receiver_maps->length(); ++i) {
9068     auto map = receiver_maps->at(i);
9069     // Don't inline calls to receivers requiring accesschecks.
9070     if (map->is_access_check_needed()) return false;
9071   }
9072   if (call_type == kCallApiFunction) {
9073     // Cannot embed a direct reference to the global proxy map
9074     // as it maybe dropped on deserialization.
9075     CHECK(!isolate()->serializer_enabled());
9076     DCHECK_EQ(0, receiver_maps->length());
9077     receiver_maps->Add(handle(function->global_proxy()->map()), zone());
9078   }
9079   CallOptimization::HolderLookup holder_lookup =
9080       CallOptimization::kHolderNotFound;
9081   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
9082       receiver_maps->first(), &holder_lookup);
9083   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
9084
9085   if (FLAG_trace_inlining) {
9086     PrintF("Inlining api function ");
9087     function->ShortPrint();
9088     PrintF("\n");
9089   }
9090
9091   bool is_function = false;
9092   bool is_store = false;
9093   switch (call_type) {
9094     case kCallApiFunction:
9095     case kCallApiMethod:
9096       // Need to check that none of the receiver maps could have changed.
9097       Add<HCheckMaps>(receiver, receiver_maps);
9098       // Need to ensure the chain between receiver and api_holder is intact.
9099       if (holder_lookup == CallOptimization::kHolderFound) {
9100         AddCheckPrototypeMaps(api_holder, receiver_maps->first());
9101       } else {
9102         DCHECK_EQ(holder_lookup, CallOptimization::kHolderIsReceiver);
9103       }
9104       // Includes receiver.
9105       PushArgumentsFromEnvironment(argc + 1);
9106       is_function = true;
9107       break;
9108     case kCallApiGetter:
9109       // Receiver and prototype chain cannot have changed.
9110       DCHECK_EQ(0, argc);
9111       DCHECK_NULL(receiver);
9112       // Receiver is on expression stack.
9113       receiver = Pop();
9114       Add<HPushArguments>(receiver);
9115       break;
9116     case kCallApiSetter:
9117       {
9118         is_store = true;
9119         // Receiver and prototype chain cannot have changed.
9120         DCHECK_EQ(1, argc);
9121         DCHECK_NULL(receiver);
9122         // Receiver and value are on expression stack.
9123         HValue* value = Pop();
9124         receiver = Pop();
9125         Add<HPushArguments>(receiver, value);
9126         break;
9127      }
9128   }
9129
9130   HValue* holder = NULL;
9131   switch (holder_lookup) {
9132     case CallOptimization::kHolderFound:
9133       holder = Add<HConstant>(api_holder);
9134       break;
9135     case CallOptimization::kHolderIsReceiver:
9136       holder = receiver;
9137       break;
9138     case CallOptimization::kHolderNotFound:
9139       UNREACHABLE();
9140       break;
9141   }
9142   Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
9143   Handle<Object> call_data_obj(api_call_info->data(), isolate());
9144   bool call_data_undefined = call_data_obj->IsUndefined();
9145   HValue* call_data = Add<HConstant>(call_data_obj);
9146   ApiFunction fun(v8::ToCData<Address>(api_call_info->callback()));
9147   ExternalReference ref = ExternalReference(&fun,
9148                                             ExternalReference::DIRECT_API_CALL,
9149                                             isolate());
9150   HValue* api_function_address = Add<HConstant>(ExternalReference(ref));
9151
9152   HValue* op_vals[] = {context(), Add<HConstant>(function), call_data, holder,
9153                        api_function_address, nullptr};
9154
9155   HInstruction* call = nullptr;
9156   if (!is_function) {
9157     CallApiAccessorStub stub(isolate(), is_store, call_data_undefined);
9158     Handle<Code> code = stub.GetCode();
9159     HConstant* code_value = Add<HConstant>(code);
9160     ApiAccessorDescriptor descriptor(isolate());
9161     call = New<HCallWithDescriptor>(
9162         code_value, argc + 1, descriptor,
9163         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9164   } else if (argc <= CallApiFunctionWithFixedArgsStub::kMaxFixedArgs) {
9165     CallApiFunctionWithFixedArgsStub stub(isolate(), argc, call_data_undefined);
9166     Handle<Code> code = stub.GetCode();
9167     HConstant* code_value = Add<HConstant>(code);
9168     ApiFunctionWithFixedArgsDescriptor descriptor(isolate());
9169     call = New<HCallWithDescriptor>(
9170         code_value, argc + 1, descriptor,
9171         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9172     Drop(1);  // Drop function.
9173   } else {
9174     op_vals[arraysize(op_vals) - 1] = Add<HConstant>(argc);
9175     CallApiFunctionStub stub(isolate(), call_data_undefined);
9176     Handle<Code> code = stub.GetCode();
9177     HConstant* code_value = Add<HConstant>(code);
9178     ApiFunctionDescriptor descriptor(isolate());
9179     call =
9180         New<HCallWithDescriptor>(code_value, argc + 1, descriptor,
9181                                  Vector<HValue*>(op_vals, arraysize(op_vals)));
9182     Drop(1);  // Drop function.
9183   }
9184
9185   ast_context()->ReturnInstruction(call, ast_id);
9186   return true;
9187 }
9188
9189
9190 void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
9191                                                 int arguments_count) {
9192   Handle<JSFunction> known_function;
9193   int args_count_no_receiver = arguments_count - 1;
9194   if (function->IsConstant() &&
9195       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9196     known_function =
9197         Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
9198     if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
9199                                    args_count_no_receiver)) {
9200       if (FLAG_trace_inlining) {
9201         PrintF("Inlining builtin ");
9202         known_function->ShortPrint();
9203         PrintF("\n");
9204       }
9205       return;
9206     }
9207
9208     if (TryInlineIndirectCall(known_function, expr, args_count_no_receiver)) {
9209       return;
9210     }
9211   }
9212
9213   PushArgumentsFromEnvironment(arguments_count);
9214   HInvokeFunction* call =
9215       New<HInvokeFunction>(function, known_function, arguments_count);
9216   Drop(1);  // Function
9217   ast_context()->ReturnInstruction(call, expr->id());
9218 }
9219
9220
9221 bool HOptimizedGraphBuilder::TryIndirectCall(Call* expr) {
9222   DCHECK(expr->expression()->IsProperty());
9223
9224   if (!expr->IsMonomorphic()) {
9225     return false;
9226   }
9227   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9228   if (function_map->instance_type() != JS_FUNCTION_TYPE ||
9229       !expr->target()->shared()->HasBuiltinFunctionId()) {
9230     return false;
9231   }
9232
9233   switch (expr->target()->shared()->builtin_function_id()) {
9234     case kFunctionCall: {
9235       if (expr->arguments()->length() == 0) return false;
9236       BuildFunctionCall(expr);
9237       return true;
9238     }
9239     case kFunctionApply: {
9240       // For .apply, only the pattern f.apply(receiver, arguments)
9241       // is supported.
9242       if (current_info()->scope()->arguments() == NULL) return false;
9243
9244       if (!CanBeFunctionApplyArguments(expr)) return false;
9245
9246       BuildFunctionApply(expr);
9247       return true;
9248     }
9249     default: { return false; }
9250   }
9251   UNREACHABLE();
9252 }
9253
9254
9255 void HOptimizedGraphBuilder::BuildFunctionApply(Call* expr) {
9256   ZoneList<Expression*>* args = expr->arguments();
9257   CHECK_ALIVE(VisitForValue(args->at(0)));
9258   HValue* receiver = Pop();  // receiver
9259   HValue* function = Pop();  // f
9260   Drop(1);  // apply
9261
9262   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9263   HValue* checked_function = AddCheckMap(function, function_map);
9264
9265   if (function_state()->outer() == NULL) {
9266     HInstruction* elements = Add<HArgumentsElements>(false);
9267     HInstruction* length = Add<HArgumentsLength>(elements);
9268     HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
9269     HInstruction* result = New<HApplyArguments>(function,
9270                                                 wrapped_receiver,
9271                                                 length,
9272                                                 elements);
9273     ast_context()->ReturnInstruction(result, expr->id());
9274   } else {
9275     // We are inside inlined function and we know exactly what is inside
9276     // arguments object. But we need to be able to materialize at deopt.
9277     DCHECK_EQ(environment()->arguments_environment()->parameter_count(),
9278               function_state()->entry()->arguments_object()->arguments_count());
9279     HArgumentsObject* args = function_state()->entry()->arguments_object();
9280     const ZoneList<HValue*>* arguments_values = args->arguments_values();
9281     int arguments_count = arguments_values->length();
9282     Push(function);
9283     Push(BuildWrapReceiver(receiver, checked_function));
9284     for (int i = 1; i < arguments_count; i++) {
9285       Push(arguments_values->at(i));
9286     }
9287     HandleIndirectCall(expr, function, arguments_count);
9288   }
9289 }
9290
9291
9292 // f.call(...)
9293 void HOptimizedGraphBuilder::BuildFunctionCall(Call* expr) {
9294   HValue* function = Top();  // f
9295   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9296   HValue* checked_function = AddCheckMap(function, function_map);
9297
9298   // f and call are on the stack in the unoptimized code
9299   // during evaluation of the arguments.
9300   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9301
9302   int args_length = expr->arguments()->length();
9303   int receiver_index = args_length - 1;
9304   // Patch the receiver.
9305   HValue* receiver = BuildWrapReceiver(
9306       environment()->ExpressionStackAt(receiver_index), checked_function);
9307   environment()->SetExpressionStackAt(receiver_index, receiver);
9308
9309   // Call must not be on the stack from now on.
9310   int call_index = args_length + 1;
9311   environment()->RemoveExpressionStackAt(call_index);
9312
9313   HandleIndirectCall(expr, function, args_length);
9314 }
9315
9316
9317 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
9318                                                     Handle<JSFunction> target) {
9319   SharedFunctionInfo* shared = target->shared();
9320   if (is_sloppy(shared->language_mode()) && !shared->native()) {
9321     // Cannot embed a direct reference to the global proxy
9322     // as is it dropped on deserialization.
9323     CHECK(!isolate()->serializer_enabled());
9324     Handle<JSObject> global_proxy(target->context()->global_proxy());
9325     return Add<HConstant>(global_proxy);
9326   }
9327   return graph()->GetConstantUndefined();
9328 }
9329
9330
9331 void HOptimizedGraphBuilder::BuildArrayCall(Expression* expression,
9332                                             int arguments_count,
9333                                             HValue* function,
9334                                             Handle<AllocationSite> site) {
9335   Add<HCheckValue>(function, array_function());
9336
9337   if (IsCallArrayInlineable(arguments_count, site)) {
9338     BuildInlinedCallArray(expression, arguments_count, site);
9339     return;
9340   }
9341
9342   HInstruction* call = PreProcessCall(New<HCallNewArray>(
9343       function, arguments_count + 1, site->GetElementsKind(), site));
9344   if (expression->IsCall()) {
9345     Drop(1);
9346   }
9347   ast_context()->ReturnInstruction(call, expression->id());
9348 }
9349
9350
9351 HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
9352                                                   HValue* search_element,
9353                                                   ElementsKind kind,
9354                                                   ArrayIndexOfMode mode) {
9355   DCHECK(IsFastElementsKind(kind));
9356
9357   NoObservableSideEffectsScope no_effects(this);
9358
9359   HValue* elements = AddLoadElements(receiver);
9360   HValue* length = AddLoadArrayLength(receiver, kind);
9361
9362   HValue* initial;
9363   HValue* terminating;
9364   Token::Value token;
9365   LoopBuilder::Direction direction;
9366   if (mode == kFirstIndexOf) {
9367     initial = graph()->GetConstant0();
9368     terminating = length;
9369     token = Token::LT;
9370     direction = LoopBuilder::kPostIncrement;
9371   } else {
9372     DCHECK_EQ(kLastIndexOf, mode);
9373     initial = length;
9374     terminating = graph()->GetConstant0();
9375     token = Token::GT;
9376     direction = LoopBuilder::kPreDecrement;
9377   }
9378
9379   Push(graph()->GetConstantMinus1());
9380   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
9381     // Make sure that we can actually compare numbers correctly below, see
9382     // https://code.google.com/p/chromium/issues/detail?id=407946 for details.
9383     search_element = AddUncasted<HForceRepresentation>(
9384         search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
9385                                                     : Representation::Double());
9386
9387     LoopBuilder loop(this, context(), direction);
9388     {
9389       HValue* index = loop.BeginBody(initial, terminating, token);
9390       HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr, kind,
9391                                                 ALLOW_RETURN_HOLE);
9392       IfBuilder if_issame(this);
9393       if_issame.If<HCompareNumericAndBranch>(element, search_element,
9394                                              Token::EQ_STRICT);
9395       if_issame.Then();
9396       {
9397         Drop(1);
9398         Push(index);
9399         loop.Break();
9400       }
9401       if_issame.End();
9402     }
9403     loop.EndBody();
9404   } else {
9405     IfBuilder if_isstring(this);
9406     if_isstring.If<HIsStringAndBranch>(search_element);
9407     if_isstring.Then();
9408     {
9409       LoopBuilder loop(this, context(), direction);
9410       {
9411         HValue* index = loop.BeginBody(initial, terminating, token);
9412         HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9413                                                   kind, ALLOW_RETURN_HOLE);
9414         IfBuilder if_issame(this);
9415         if_issame.If<HIsStringAndBranch>(element);
9416         if_issame.AndIf<HStringCompareAndBranch>(
9417             element, search_element, Token::EQ_STRICT);
9418         if_issame.Then();
9419         {
9420           Drop(1);
9421           Push(index);
9422           loop.Break();
9423         }
9424         if_issame.End();
9425       }
9426       loop.EndBody();
9427     }
9428     if_isstring.Else();
9429     {
9430       IfBuilder if_isnumber(this);
9431       if_isnumber.If<HIsSmiAndBranch>(search_element);
9432       if_isnumber.OrIf<HCompareMap>(
9433           search_element, isolate()->factory()->heap_number_map());
9434       if_isnumber.Then();
9435       {
9436         HValue* search_number =
9437             AddUncasted<HForceRepresentation>(search_element,
9438                                               Representation::Double());
9439         LoopBuilder loop(this, context(), direction);
9440         {
9441           HValue* index = loop.BeginBody(initial, terminating, token);
9442           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9443                                                     kind, ALLOW_RETURN_HOLE);
9444
9445           IfBuilder if_element_isnumber(this);
9446           if_element_isnumber.If<HIsSmiAndBranch>(element);
9447           if_element_isnumber.OrIf<HCompareMap>(
9448               element, isolate()->factory()->heap_number_map());
9449           if_element_isnumber.Then();
9450           {
9451             HValue* number =
9452                 AddUncasted<HForceRepresentation>(element,
9453                                                   Representation::Double());
9454             IfBuilder if_issame(this);
9455             if_issame.If<HCompareNumericAndBranch>(
9456                 number, search_number, Token::EQ_STRICT);
9457             if_issame.Then();
9458             {
9459               Drop(1);
9460               Push(index);
9461               loop.Break();
9462             }
9463             if_issame.End();
9464           }
9465           if_element_isnumber.End();
9466         }
9467         loop.EndBody();
9468       }
9469       if_isnumber.Else();
9470       {
9471         LoopBuilder loop(this, context(), direction);
9472         {
9473           HValue* index = loop.BeginBody(initial, terminating, token);
9474           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9475                                                     kind, ALLOW_RETURN_HOLE);
9476           IfBuilder if_issame(this);
9477           if_issame.If<HCompareObjectEqAndBranch>(
9478               element, search_element);
9479           if_issame.Then();
9480           {
9481             Drop(1);
9482             Push(index);
9483             loop.Break();
9484           }
9485           if_issame.End();
9486         }
9487         loop.EndBody();
9488       }
9489       if_isnumber.End();
9490     }
9491     if_isstring.End();
9492   }
9493
9494   return Pop();
9495 }
9496
9497
9498 bool HOptimizedGraphBuilder::TryHandleArrayCall(Call* expr, HValue* function) {
9499   if (!array_function().is_identical_to(expr->target())) {
9500     return false;
9501   }
9502
9503   Handle<AllocationSite> site = expr->allocation_site();
9504   if (site.is_null()) return false;
9505
9506   BuildArrayCall(expr,
9507                  expr->arguments()->length(),
9508                  function,
9509                  site);
9510   return true;
9511 }
9512
9513
9514 bool HOptimizedGraphBuilder::TryHandleArrayCallNew(CallNew* expr,
9515                                                    HValue* function) {
9516   if (!array_function().is_identical_to(expr->target())) {
9517     return false;
9518   }
9519
9520   Handle<AllocationSite> site = expr->allocation_site();
9521   if (site.is_null()) return false;
9522
9523   BuildArrayCall(expr, expr->arguments()->length(), function, site);
9524   return true;
9525 }
9526
9527
9528 bool HOptimizedGraphBuilder::CanBeFunctionApplyArguments(Call* expr) {
9529   ZoneList<Expression*>* args = expr->arguments();
9530   if (args->length() != 2) return false;
9531   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
9532   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
9533   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
9534   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
9535   return true;
9536 }
9537
9538
9539 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
9540   DCHECK(!HasStackOverflow());
9541   DCHECK(current_block() != NULL);
9542   DCHECK(current_block()->HasPredecessor());
9543   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9544   Expression* callee = expr->expression();
9545   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
9546   HInstruction* call = NULL;
9547
9548   Property* prop = callee->AsProperty();
9549   if (prop != NULL) {
9550     CHECK_ALIVE(VisitForValue(prop->obj()));
9551     HValue* receiver = Top();
9552
9553     SmallMapList* maps;
9554     ComputeReceiverTypes(expr, receiver, &maps, zone());
9555
9556     if (prop->key()->IsPropertyName() && maps->length() > 0) {
9557       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
9558       PropertyAccessInfo info(this, LOAD, maps->first(), name);
9559       if (!info.CanAccessAsMonomorphic(maps)) {
9560         HandlePolymorphicCallNamed(expr, receiver, maps, name);
9561         return;
9562       }
9563     }
9564     HValue* key = NULL;
9565     if (!prop->key()->IsPropertyName()) {
9566       CHECK_ALIVE(VisitForValue(prop->key()));
9567       key = Pop();
9568     }
9569
9570     CHECK_ALIVE(PushLoad(prop, receiver, key));
9571     HValue* function = Pop();
9572
9573     if (function->IsConstant() &&
9574         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9575       // Push the function under the receiver.
9576       environment()->SetExpressionStackAt(0, function);
9577       Push(receiver);
9578
9579       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
9580           HConstant::cast(function)->handle(isolate()));
9581       expr->set_target(known_function);
9582
9583       if (TryIndirectCall(expr)) return;
9584       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9585
9586       Handle<Map> map = maps->length() == 1 ? maps->first() : Handle<Map>();
9587       if (TryInlineBuiltinMethodCall(expr, known_function, map,
9588                                      expr->arguments()->length())) {
9589         if (FLAG_trace_inlining) {
9590           PrintF("Inlining builtin ");
9591           known_function->ShortPrint();
9592           PrintF("\n");
9593         }
9594         return;
9595       }
9596       if (TryInlineApiMethodCall(expr, receiver, maps)) return;
9597
9598       // Wrap the receiver if necessary.
9599       if (NeedsWrapping(maps->first(), known_function)) {
9600         // Since HWrapReceiver currently cannot actually wrap numbers and
9601         // strings, use the regular CallFunctionStub for method calls to wrap
9602         // the receiver.
9603         // TODO(verwaest): Support creation of value wrappers directly in
9604         // HWrapReceiver.
9605         call = New<HCallFunction>(
9606             function, argument_count, WRAP_AND_CALL);
9607       } else if (TryInlineCall(expr)) {
9608         return;
9609       } else {
9610         call = BuildCallConstantFunction(known_function, argument_count);
9611       }
9612
9613     } else {
9614       ArgumentsAllowedFlag arguments_flag = ARGUMENTS_NOT_ALLOWED;
9615       if (CanBeFunctionApplyArguments(expr) && expr->is_uninitialized()) {
9616         // We have to use EAGER deoptimization here because Deoptimizer::SOFT
9617         // gets ignored by the always-opt flag, which leads to incorrect code.
9618         Add<HDeoptimize>(
9619             Deoptimizer::kInsufficientTypeFeedbackForCallWithArguments,
9620             Deoptimizer::EAGER);
9621         arguments_flag = ARGUMENTS_FAKED;
9622       }
9623
9624       // Push the function under the receiver.
9625       environment()->SetExpressionStackAt(0, function);
9626       Push(receiver);
9627
9628       CHECK_ALIVE(VisitExpressions(expr->arguments(), arguments_flag));
9629       CallFunctionFlags flags = receiver->type().IsJSObject()
9630           ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
9631       call = New<HCallFunction>(function, argument_count, flags);
9632     }
9633     PushArgumentsFromEnvironment(argument_count);
9634
9635   } else {
9636     VariableProxy* proxy = expr->expression()->AsVariableProxy();
9637     if (proxy != NULL && proxy->var()->is_possibly_eval(isolate())) {
9638       return Bailout(kPossibleDirectCallToEval);
9639     }
9640
9641     // The function is on the stack in the unoptimized code during
9642     // evaluation of the arguments.
9643     CHECK_ALIVE(VisitForValue(expr->expression()));
9644     HValue* function = Top();
9645     if (function->IsConstant() &&
9646         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9647       Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9648       Handle<JSFunction> target = Handle<JSFunction>::cast(constant);
9649       expr->SetKnownGlobalTarget(target);
9650     }
9651
9652     // Placeholder for the receiver.
9653     Push(graph()->GetConstantUndefined());
9654     CHECK_ALIVE(VisitExpressions(expr->arguments()));
9655
9656     if (expr->IsMonomorphic()) {
9657       Add<HCheckValue>(function, expr->target());
9658
9659       // Patch the global object on the stack by the expected receiver.
9660       HValue* receiver = ImplicitReceiverFor(function, expr->target());
9661       const int receiver_index = argument_count - 1;
9662       environment()->SetExpressionStackAt(receiver_index, receiver);
9663
9664       if (TryInlineBuiltinFunctionCall(expr)) {
9665         if (FLAG_trace_inlining) {
9666           PrintF("Inlining builtin ");
9667           expr->target()->ShortPrint();
9668           PrintF("\n");
9669         }
9670         return;
9671       }
9672       if (TryInlineApiFunctionCall(expr, receiver)) return;
9673       if (TryHandleArrayCall(expr, function)) return;
9674       if (TryInlineCall(expr)) return;
9675
9676       PushArgumentsFromEnvironment(argument_count);
9677       call = BuildCallConstantFunction(expr->target(), argument_count);
9678     } else {
9679       PushArgumentsFromEnvironment(argument_count);
9680       HCallFunction* call_function =
9681           New<HCallFunction>(function, argument_count);
9682       call = call_function;
9683       if (expr->is_uninitialized() &&
9684           expr->IsUsingCallFeedbackICSlot(isolate())) {
9685         // We've never seen this call before, so let's have Crankshaft learn
9686         // through the type vector.
9687         Handle<TypeFeedbackVector> vector =
9688             handle(current_feedback_vector(), isolate());
9689         FeedbackVectorICSlot slot = expr->CallFeedbackICSlot();
9690         call_function->SetVectorAndSlot(vector, slot);
9691       }
9692     }
9693   }
9694
9695   Drop(1);  // Drop the function.
9696   return ast_context()->ReturnInstruction(call, expr->id());
9697 }
9698
9699
9700 void HOptimizedGraphBuilder::BuildInlinedCallArray(
9701     Expression* expression,
9702     int argument_count,
9703     Handle<AllocationSite> site) {
9704   DCHECK(!site.is_null());
9705   DCHECK(argument_count >= 0 && argument_count <= 1);
9706   NoObservableSideEffectsScope no_effects(this);
9707
9708   // We should at least have the constructor on the expression stack.
9709   HValue* constructor = environment()->ExpressionStackAt(argument_count);
9710
9711   // Register on the site for deoptimization if the transition feedback changes.
9712   top_info()->dependencies()->AssumeTransitionStable(site);
9713   ElementsKind kind = site->GetElementsKind();
9714   HInstruction* site_instruction = Add<HConstant>(site);
9715
9716   // In the single constant argument case, we may have to adjust elements kind
9717   // to avoid creating a packed non-empty array.
9718   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
9719     HValue* argument = environment()->Top();
9720     if (argument->IsConstant()) {
9721       HConstant* constant_argument = HConstant::cast(argument);
9722       DCHECK(constant_argument->HasSmiValue());
9723       int constant_array_size = constant_argument->Integer32Value();
9724       if (constant_array_size != 0) {
9725         kind = GetHoleyElementsKind(kind);
9726       }
9727     }
9728   }
9729
9730   // Build the array.
9731   JSArrayBuilder array_builder(this,
9732                                kind,
9733                                site_instruction,
9734                                constructor,
9735                                DISABLE_ALLOCATION_SITES);
9736   HValue* new_object = argument_count == 0
9737       ? array_builder.AllocateEmptyArray()
9738       : BuildAllocateArrayFromLength(&array_builder, Top());
9739
9740   int args_to_drop = argument_count + (expression->IsCall() ? 2 : 1);
9741   Drop(args_to_drop);
9742   ast_context()->ReturnValue(new_object);
9743 }
9744
9745
9746 // Checks whether allocation using the given constructor can be inlined.
9747 static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
9748   return constructor->has_initial_map() &&
9749          constructor->initial_map()->instance_type() == JS_OBJECT_TYPE &&
9750          constructor->initial_map()->instance_size() <
9751              HAllocate::kMaxInlineSize;
9752 }
9753
9754
9755 bool HOptimizedGraphBuilder::IsCallArrayInlineable(
9756     int argument_count,
9757     Handle<AllocationSite> site) {
9758   Handle<JSFunction> caller = current_info()->closure();
9759   Handle<JSFunction> target = array_function();
9760   // We should have the function plus array arguments on the environment stack.
9761   DCHECK(environment()->length() >= (argument_count + 1));
9762   DCHECK(!site.is_null());
9763
9764   bool inline_ok = false;
9765   if (site->CanInlineCall()) {
9766     // We also want to avoid inlining in certain 1 argument scenarios.
9767     if (argument_count == 1) {
9768       HValue* argument = Top();
9769       if (argument->IsConstant()) {
9770         // Do not inline if the constant length argument is not a smi or
9771         // outside the valid range for unrolled loop initialization.
9772         HConstant* constant_argument = HConstant::cast(argument);
9773         if (constant_argument->HasSmiValue()) {
9774           int value = constant_argument->Integer32Value();
9775           inline_ok = value >= 0 && value <= kElementLoopUnrollThreshold;
9776           if (!inline_ok) {
9777             TraceInline(target, caller,
9778                         "Constant length outside of valid inlining range.");
9779           }
9780         }
9781       } else {
9782         TraceInline(target, caller,
9783                     "Dont inline [new] Array(n) where n isn't constant.");
9784       }
9785     } else if (argument_count == 0) {
9786       inline_ok = true;
9787     } else {
9788       TraceInline(target, caller, "Too many arguments to inline.");
9789     }
9790   } else {
9791     TraceInline(target, caller, "AllocationSite requested no inlining.");
9792   }
9793
9794   if (inline_ok) {
9795     TraceInline(target, caller, NULL);
9796   }
9797   return inline_ok;
9798 }
9799
9800
9801 void HOptimizedGraphBuilder::VisitCallNew(CallNew* expr) {
9802   DCHECK(!HasStackOverflow());
9803   DCHECK(current_block() != NULL);
9804   DCHECK(current_block()->HasPredecessor());
9805   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9806   int argument_count = expr->arguments()->length() + 1;  // Plus constructor.
9807   Factory* factory = isolate()->factory();
9808
9809   // The constructor function is on the stack in the unoptimized code
9810   // during evaluation of the arguments.
9811   CHECK_ALIVE(VisitForValue(expr->expression()));
9812   HValue* function = Top();
9813   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9814
9815   if (function->IsConstant() &&
9816       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9817     Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9818     expr->SetKnownGlobalTarget(Handle<JSFunction>::cast(constant));
9819   }
9820
9821   if (FLAG_inline_construct &&
9822       expr->IsMonomorphic() &&
9823       IsAllocationInlineable(expr->target())) {
9824     Handle<JSFunction> constructor = expr->target();
9825     HValue* check = Add<HCheckValue>(function, constructor);
9826
9827     // Force completion of inobject slack tracking before generating
9828     // allocation code to finalize instance size.
9829     if (constructor->IsInobjectSlackTrackingInProgress()) {
9830       constructor->CompleteInobjectSlackTracking();
9831     }
9832
9833     // Calculate instance size from initial map of constructor.
9834     DCHECK(constructor->has_initial_map());
9835     Handle<Map> initial_map(constructor->initial_map());
9836     int instance_size = initial_map->instance_size();
9837
9838     // Allocate an instance of the implicit receiver object.
9839     HValue* size_in_bytes = Add<HConstant>(instance_size);
9840     HAllocationMode allocation_mode;
9841     if (FLAG_pretenuring_call_new) {
9842       if (FLAG_allocation_site_pretenuring) {
9843         // Try to use pretenuring feedback.
9844         Handle<AllocationSite> allocation_site = expr->allocation_site();
9845         allocation_mode = HAllocationMode(allocation_site);
9846         // Take a dependency on allocation site.
9847         top_info()->dependencies()->AssumeTenuringDecision(allocation_site);
9848       }
9849     }
9850
9851     HAllocate* receiver = BuildAllocate(
9852         size_in_bytes, HType::JSObject(), JS_OBJECT_TYPE, allocation_mode);
9853     receiver->set_known_initial_map(initial_map);
9854
9855     // Initialize map and fields of the newly allocated object.
9856     { NoObservableSideEffectsScope no_effects(this);
9857       DCHECK(initial_map->instance_type() == JS_OBJECT_TYPE);
9858       Add<HStoreNamedField>(receiver,
9859           HObjectAccess::ForMapAndOffset(initial_map, JSObject::kMapOffset),
9860           Add<HConstant>(initial_map));
9861       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
9862       Add<HStoreNamedField>(receiver,
9863           HObjectAccess::ForMapAndOffset(initial_map,
9864                                          JSObject::kPropertiesOffset),
9865           empty_fixed_array);
9866       Add<HStoreNamedField>(receiver,
9867           HObjectAccess::ForMapAndOffset(initial_map,
9868                                          JSObject::kElementsOffset),
9869           empty_fixed_array);
9870       BuildInitializeInobjectProperties(receiver, initial_map);
9871     }
9872
9873     // Replace the constructor function with a newly allocated receiver using
9874     // the index of the receiver from the top of the expression stack.
9875     const int receiver_index = argument_count - 1;
9876     DCHECK(environment()->ExpressionStackAt(receiver_index) == function);
9877     environment()->SetExpressionStackAt(receiver_index, receiver);
9878
9879     if (TryInlineConstruct(expr, receiver)) {
9880       // Inlining worked, add a dependency on the initial map to make sure that
9881       // this code is deoptimized whenever the initial map of the constructor
9882       // changes.
9883       top_info()->dependencies()->AssumeInitialMapCantChange(initial_map);
9884       return;
9885     }
9886
9887     // TODO(mstarzinger): For now we remove the previous HAllocate and all
9888     // corresponding instructions and instead add HPushArguments for the
9889     // arguments in case inlining failed.  What we actually should do is for
9890     // inlining to try to build a subgraph without mutating the parent graph.
9891     HInstruction* instr = current_block()->last();
9892     do {
9893       HInstruction* prev_instr = instr->previous();
9894       instr->DeleteAndReplaceWith(NULL);
9895       instr = prev_instr;
9896     } while (instr != check);
9897     environment()->SetExpressionStackAt(receiver_index, function);
9898     HInstruction* call =
9899       PreProcessCall(New<HCallNew>(function, argument_count));
9900     return ast_context()->ReturnInstruction(call, expr->id());
9901   } else {
9902     // The constructor function is both an operand to the instruction and an
9903     // argument to the construct call.
9904     if (TryHandleArrayCallNew(expr, function)) return;
9905
9906     HInstruction* call =
9907         PreProcessCall(New<HCallNew>(function, argument_count));
9908     return ast_context()->ReturnInstruction(call, expr->id());
9909   }
9910 }
9911
9912
9913 void HOptimizedGraphBuilder::BuildInitializeInobjectProperties(
9914     HValue* receiver, Handle<Map> initial_map) {
9915   if (initial_map->GetInObjectProperties() != 0) {
9916     HConstant* undefined = graph()->GetConstantUndefined();
9917     for (int i = 0; i < initial_map->GetInObjectProperties(); i++) {
9918       int property_offset = initial_map->GetInObjectPropertyOffset(i);
9919       Add<HStoreNamedField>(receiver, HObjectAccess::ForMapAndOffset(
9920                                           initial_map, property_offset),
9921                             undefined);
9922     }
9923   }
9924 }
9925
9926
9927 HValue* HGraphBuilder::BuildAllocateEmptyArrayBuffer(HValue* byte_length) {
9928   // We HForceRepresentation here to avoid allocations during an *-to-tagged
9929   // HChange that could cause GC while the array buffer object is not fully
9930   // initialized.
9931   HObjectAccess byte_length_access(HObjectAccess::ForJSArrayBufferByteLength());
9932   byte_length = AddUncasted<HForceRepresentation>(
9933       byte_length, byte_length_access.representation());
9934   HAllocate* result =
9935       BuildAllocate(Add<HConstant>(JSArrayBuffer::kSizeWithInternalFields),
9936                     HType::JSObject(), JS_ARRAY_BUFFER_TYPE, HAllocationMode());
9937
9938   HValue* global_object = Add<HLoadNamedField>(
9939       context(), nullptr,
9940       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
9941   HValue* native_context = Add<HLoadNamedField>(
9942       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
9943   Add<HStoreNamedField>(
9944       result, HObjectAccess::ForMap(),
9945       Add<HLoadNamedField>(
9946           native_context, nullptr,
9947           HObjectAccess::ForContextSlot(Context::ARRAY_BUFFER_MAP_INDEX)));
9948
9949   HConstant* empty_fixed_array =
9950       Add<HConstant>(isolate()->factory()->empty_fixed_array());
9951   Add<HStoreNamedField>(
9952       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
9953       empty_fixed_array);
9954   Add<HStoreNamedField>(
9955       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
9956       empty_fixed_array);
9957   Add<HStoreNamedField>(
9958       result, HObjectAccess::ForJSArrayBufferBackingStore().WithRepresentation(
9959                   Representation::Smi()),
9960       graph()->GetConstant0());
9961   Add<HStoreNamedField>(result, byte_length_access, byte_length);
9962   Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBitFieldSlot(),
9963                         graph()->GetConstant0());
9964   Add<HStoreNamedField>(
9965       result, HObjectAccess::ForJSArrayBufferBitField(),
9966       Add<HConstant>((1 << JSArrayBuffer::IsExternal::kShift) |
9967                      (1 << JSArrayBuffer::IsNeuterable::kShift)));
9968
9969   for (int field = 0; field < v8::ArrayBuffer::kInternalFieldCount; ++field) {
9970     Add<HStoreNamedField>(
9971         result,
9972         HObjectAccess::ForObservableJSObjectOffset(
9973             JSArrayBuffer::kSize + field * kPointerSize, Representation::Smi()),
9974         graph()->GetConstant0());
9975   }
9976
9977   return result;
9978 }
9979
9980
9981 template <class ViewClass>
9982 void HGraphBuilder::BuildArrayBufferViewInitialization(
9983     HValue* obj,
9984     HValue* buffer,
9985     HValue* byte_offset,
9986     HValue* byte_length) {
9987
9988   for (int offset = ViewClass::kSize;
9989        offset < ViewClass::kSizeWithInternalFields;
9990        offset += kPointerSize) {
9991     Add<HStoreNamedField>(obj,
9992         HObjectAccess::ForObservableJSObjectOffset(offset),
9993         graph()->GetConstant0());
9994   }
9995
9996   Add<HStoreNamedField>(
9997       obj,
9998       HObjectAccess::ForJSArrayBufferViewByteOffset(),
9999       byte_offset);
10000   Add<HStoreNamedField>(
10001       obj,
10002       HObjectAccess::ForJSArrayBufferViewByteLength(),
10003       byte_length);
10004   Add<HStoreNamedField>(obj, HObjectAccess::ForJSArrayBufferViewBuffer(),
10005                         buffer);
10006 }
10007
10008
10009 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
10010     CallRuntime* expr) {
10011   ZoneList<Expression*>* arguments = expr->arguments();
10012
10013   DCHECK(arguments->length()== 4);
10014   CHECK_ALIVE(VisitForValue(arguments->at(0)));
10015   HValue* obj = Pop();
10016
10017   CHECK_ALIVE(VisitForValue(arguments->at(1)));
10018   HValue* buffer = Pop();
10019
10020   CHECK_ALIVE(VisitForValue(arguments->at(2)));
10021   HValue* byte_offset = Pop();
10022
10023   CHECK_ALIVE(VisitForValue(arguments->at(3)));
10024   HValue* byte_length = Pop();
10025
10026   {
10027     NoObservableSideEffectsScope scope(this);
10028     BuildArrayBufferViewInitialization<JSDataView>(
10029         obj, buffer, byte_offset, byte_length);
10030   }
10031 }
10032
10033
10034 static Handle<Map> TypedArrayMap(Isolate* isolate,
10035                                  ExternalArrayType array_type,
10036                                  ElementsKind target_kind) {
10037   Handle<Context> native_context = isolate->native_context();
10038   Handle<JSFunction> fun;
10039   switch (array_type) {
10040 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
10041     case kExternal##Type##Array:                                              \
10042       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
10043       break;
10044
10045     TYPED_ARRAYS(TYPED_ARRAY_CASE)
10046 #undef TYPED_ARRAY_CASE
10047   }
10048   Handle<Map> map(fun->initial_map());
10049   return Map::AsElementsKind(map, target_kind);
10050 }
10051
10052
10053 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
10054     ExternalArrayType array_type,
10055     bool is_zero_byte_offset,
10056     HValue* buffer, HValue* byte_offset, HValue* length) {
10057   Handle<Map> external_array_map(
10058       isolate()->heap()->MapForFixedTypedArray(array_type));
10059
10060   // The HForceRepresentation is to prevent possible deopt on int-smi
10061   // conversion after allocation but before the new object fields are set.
10062   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10063   HValue* elements = Add<HAllocate>(
10064       Add<HConstant>(FixedTypedArrayBase::kHeaderSize), HType::HeapObject(),
10065       NOT_TENURED, external_array_map->instance_type());
10066
10067   AddStoreMapConstant(elements, external_array_map);
10068   Add<HStoreNamedField>(elements,
10069       HObjectAccess::ForFixedArrayLength(), length);
10070
10071   HValue* backing_store = Add<HLoadNamedField>(
10072       buffer, nullptr, HObjectAccess::ForJSArrayBufferBackingStore());
10073
10074   HValue* typed_array_start;
10075   if (is_zero_byte_offset) {
10076     typed_array_start = backing_store;
10077   } else {
10078     HInstruction* external_pointer =
10079         AddUncasted<HAdd>(backing_store, byte_offset);
10080     // Arguments are checked prior to call to TypedArrayInitialize,
10081     // including byte_offset.
10082     external_pointer->ClearFlag(HValue::kCanOverflow);
10083     typed_array_start = external_pointer;
10084   }
10085
10086   Add<HStoreNamedField>(elements,
10087                         HObjectAccess::ForFixedTypedArrayBaseBasePointer(),
10088                         graph()->GetConstant0());
10089   Add<HStoreNamedField>(elements,
10090                         HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10091                         typed_array_start);
10092
10093   return elements;
10094 }
10095
10096
10097 HValue* HOptimizedGraphBuilder::BuildAllocateFixedTypedArray(
10098     ExternalArrayType array_type, size_t element_size,
10099     ElementsKind fixed_elements_kind, HValue* byte_length, HValue* length,
10100     bool initialize) {
10101   STATIC_ASSERT(
10102       (FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask) == 0);
10103   HValue* total_size;
10104
10105   // if fixed array's elements are not aligned to object's alignment,
10106   // we need to align the whole array to object alignment.
10107   if (element_size % kObjectAlignment != 0) {
10108     total_size = BuildObjectSizeAlignment(
10109         byte_length, FixedTypedArrayBase::kHeaderSize);
10110   } else {
10111     total_size = AddUncasted<HAdd>(byte_length,
10112         Add<HConstant>(FixedTypedArrayBase::kHeaderSize));
10113     total_size->ClearFlag(HValue::kCanOverflow);
10114   }
10115
10116   // The HForceRepresentation is to prevent possible deopt on int-smi
10117   // conversion after allocation but before the new object fields are set.
10118   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10119   Handle<Map> fixed_typed_array_map(
10120       isolate()->heap()->MapForFixedTypedArray(array_type));
10121   HAllocate* elements =
10122       Add<HAllocate>(total_size, HType::HeapObject(), NOT_TENURED,
10123                      fixed_typed_array_map->instance_type());
10124
10125 #ifndef V8_HOST_ARCH_64_BIT
10126   if (array_type == kExternalFloat64Array) {
10127     elements->MakeDoubleAligned();
10128   }
10129 #endif
10130
10131   AddStoreMapConstant(elements, fixed_typed_array_map);
10132
10133   Add<HStoreNamedField>(elements,
10134       HObjectAccess::ForFixedArrayLength(),
10135       length);
10136   Add<HStoreNamedField>(
10137       elements, HObjectAccess::ForFixedTypedArrayBaseBasePointer(), elements);
10138
10139   Add<HStoreNamedField>(
10140       elements, HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10141       Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()));
10142
10143   HValue* filler = Add<HConstant>(static_cast<int32_t>(0));
10144
10145   if (initialize) {
10146     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
10147
10148     HValue* backing_store = AddUncasted<HAdd>(
10149         Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()),
10150         elements, Strength::WEAK, AddOfExternalAndTagged);
10151
10152     HValue* key = builder.BeginBody(
10153         Add<HConstant>(static_cast<int32_t>(0)),
10154         length, Token::LT);
10155     Add<HStoreKeyed>(backing_store, key, filler, fixed_elements_kind);
10156
10157     builder.EndBody();
10158   }
10159   return elements;
10160 }
10161
10162
10163 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
10164     CallRuntime* expr) {
10165   ZoneList<Expression*>* arguments = expr->arguments();
10166
10167   static const int kObjectArg = 0;
10168   static const int kArrayIdArg = 1;
10169   static const int kBufferArg = 2;
10170   static const int kByteOffsetArg = 3;
10171   static const int kByteLengthArg = 4;
10172   static const int kInitializeArg = 5;
10173   static const int kArgsLength = 6;
10174   DCHECK(arguments->length() == kArgsLength);
10175
10176
10177   CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
10178   HValue* obj = Pop();
10179
10180   if (!arguments->at(kArrayIdArg)->IsLiteral()) {
10181     // This should never happen in real use, but can happen when fuzzing.
10182     // Just bail out.
10183     Bailout(kNeedSmiLiteral);
10184     return;
10185   }
10186   Handle<Object> value =
10187       static_cast<Literal*>(arguments->at(kArrayIdArg))->value();
10188   if (!value->IsSmi()) {
10189     // This should never happen in real use, but can happen when fuzzing.
10190     // Just bail out.
10191     Bailout(kNeedSmiLiteral);
10192     return;
10193   }
10194   int array_id = Smi::cast(*value)->value();
10195
10196   HValue* buffer;
10197   if (!arguments->at(kBufferArg)->IsNullLiteral()) {
10198     CHECK_ALIVE(VisitForValue(arguments->at(kBufferArg)));
10199     buffer = Pop();
10200   } else {
10201     buffer = NULL;
10202   }
10203
10204   HValue* byte_offset;
10205   bool is_zero_byte_offset;
10206
10207   if (arguments->at(kByteOffsetArg)->IsLiteral()
10208       && Smi::FromInt(0) ==
10209       *static_cast<Literal*>(arguments->at(kByteOffsetArg))->value()) {
10210     byte_offset = Add<HConstant>(static_cast<int32_t>(0));
10211     is_zero_byte_offset = true;
10212   } else {
10213     CHECK_ALIVE(VisitForValue(arguments->at(kByteOffsetArg)));
10214     byte_offset = Pop();
10215     is_zero_byte_offset = false;
10216     DCHECK(buffer != NULL);
10217   }
10218
10219   CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
10220   HValue* byte_length = Pop();
10221
10222   CHECK(arguments->at(kInitializeArg)->IsLiteral());
10223   bool initialize = static_cast<Literal*>(arguments->at(kInitializeArg))
10224                         ->value()
10225                         ->BooleanValue();
10226
10227   NoObservableSideEffectsScope scope(this);
10228   IfBuilder byte_offset_smi(this);
10229
10230   if (!is_zero_byte_offset) {
10231     byte_offset_smi.If<HIsSmiAndBranch>(byte_offset);
10232     byte_offset_smi.Then();
10233   }
10234
10235   ExternalArrayType array_type =
10236       kExternalInt8Array;  // Bogus initialization.
10237   size_t element_size = 1;  // Bogus initialization.
10238   ElementsKind fixed_elements_kind =  // Bogus initialization.
10239       INT8_ELEMENTS;
10240   Runtime::ArrayIdToTypeAndSize(array_id,
10241       &array_type,
10242       &fixed_elements_kind,
10243       &element_size);
10244
10245
10246   { //  byte_offset is Smi.
10247     HValue* allocated_buffer = buffer;
10248     if (buffer == NULL) {
10249       allocated_buffer = BuildAllocateEmptyArrayBuffer(byte_length);
10250     }
10251     BuildArrayBufferViewInitialization<JSTypedArray>(obj, allocated_buffer,
10252                                                      byte_offset, byte_length);
10253
10254
10255     HInstruction* length = AddUncasted<HDiv>(byte_length,
10256         Add<HConstant>(static_cast<int32_t>(element_size)));
10257
10258     Add<HStoreNamedField>(obj,
10259         HObjectAccess::ForJSTypedArrayLength(),
10260         length);
10261
10262     HValue* elements;
10263     if (buffer != NULL) {
10264       elements = BuildAllocateExternalElements(
10265           array_type, is_zero_byte_offset, buffer, byte_offset, length);
10266       Handle<Map> obj_map =
10267           TypedArrayMap(isolate(), array_type, fixed_elements_kind);
10268       AddStoreMapConstant(obj, obj_map);
10269     } else {
10270       DCHECK(is_zero_byte_offset);
10271       elements = BuildAllocateFixedTypedArray(array_type, element_size,
10272                                               fixed_elements_kind, byte_length,
10273                                               length, initialize);
10274     }
10275     Add<HStoreNamedField>(
10276         obj, HObjectAccess::ForElementsPointer(), elements);
10277   }
10278
10279   if (!is_zero_byte_offset) {
10280     byte_offset_smi.Else();
10281     { //  byte_offset is not Smi.
10282       Push(obj);
10283       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
10284       Push(buffer);
10285       Push(byte_offset);
10286       Push(byte_length);
10287       CHECK_ALIVE(VisitForValue(arguments->at(kInitializeArg)));
10288       PushArgumentsFromEnvironment(kArgsLength);
10289       Add<HCallRuntime>(expr->name(), expr->function(), kArgsLength);
10290     }
10291   }
10292   byte_offset_smi.End();
10293 }
10294
10295
10296 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
10297   DCHECK(expr->arguments()->length() == 0);
10298   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
10299   return ast_context()->ReturnInstruction(max_smi, expr->id());
10300 }
10301
10302
10303 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
10304     CallRuntime* expr) {
10305   DCHECK(expr->arguments()->length() == 0);
10306   HConstant* result = New<HConstant>(static_cast<int32_t>(
10307         FLAG_typed_array_max_size_in_heap));
10308   return ast_context()->ReturnInstruction(result, expr->id());
10309 }
10310
10311
10312 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
10313     CallRuntime* expr) {
10314   DCHECK(expr->arguments()->length() == 1);
10315   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10316   HValue* buffer = Pop();
10317   HInstruction* result = New<HLoadNamedField>(
10318       buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
10319   return ast_context()->ReturnInstruction(result, expr->id());
10320 }
10321
10322
10323 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
10324     CallRuntime* expr) {
10325   NoObservableSideEffectsScope scope(this);
10326   DCHECK(expr->arguments()->length() == 1);
10327   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10328   HValue* view = Pop();
10329
10330   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10331       view, nullptr,
10332       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteLengthOffset)));
10333 }
10334
10335
10336 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
10337     CallRuntime* expr) {
10338   NoObservableSideEffectsScope scope(this);
10339   DCHECK(expr->arguments()->length() == 1);
10340   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10341   HValue* view = Pop();
10342
10343   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10344       view, nullptr,
10345       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset)));
10346 }
10347
10348
10349 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
10350     CallRuntime* expr) {
10351   NoObservableSideEffectsScope scope(this);
10352   DCHECK(expr->arguments()->length() == 1);
10353   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10354   HValue* view = Pop();
10355
10356   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10357       view, nullptr,
10358       FieldIndex::ForInObjectOffset(JSTypedArray::kLengthOffset)));
10359 }
10360
10361
10362 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
10363   DCHECK(!HasStackOverflow());
10364   DCHECK(current_block() != NULL);
10365   DCHECK(current_block()->HasPredecessor());
10366   if (expr->is_jsruntime()) {
10367     return Bailout(kCallToAJavaScriptRuntimeFunction);
10368   }
10369
10370   const Runtime::Function* function = expr->function();
10371   DCHECK(function != NULL);
10372   switch (function->function_id) {
10373 #define CALL_INTRINSIC_GENERATOR(Name) \
10374   case Runtime::kInline##Name:         \
10375     return Generate##Name(expr);
10376
10377     FOR_EACH_HYDROGEN_INTRINSIC(CALL_INTRINSIC_GENERATOR)
10378 #undef CALL_INTRINSIC_GENERATOR
10379     default: {
10380       Handle<String> name = expr->name();
10381       int argument_count = expr->arguments()->length();
10382       CHECK_ALIVE(VisitExpressions(expr->arguments()));
10383       PushArgumentsFromEnvironment(argument_count);
10384       HCallRuntime* call = New<HCallRuntime>(name, function, argument_count);
10385       return ast_context()->ReturnInstruction(call, expr->id());
10386     }
10387   }
10388 }
10389
10390
10391 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
10392   DCHECK(!HasStackOverflow());
10393   DCHECK(current_block() != NULL);
10394   DCHECK(current_block()->HasPredecessor());
10395   switch (expr->op()) {
10396     case Token::DELETE: return VisitDelete(expr);
10397     case Token::VOID: return VisitVoid(expr);
10398     case Token::TYPEOF: return VisitTypeof(expr);
10399     case Token::NOT: return VisitNot(expr);
10400     default: UNREACHABLE();
10401   }
10402 }
10403
10404
10405 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
10406   Property* prop = expr->expression()->AsProperty();
10407   VariableProxy* proxy = expr->expression()->AsVariableProxy();
10408   if (prop != NULL) {
10409     CHECK_ALIVE(VisitForValue(prop->obj()));
10410     CHECK_ALIVE(VisitForValue(prop->key()));
10411     HValue* key = Pop();
10412     HValue* obj = Pop();
10413     HValue* function = AddLoadJSBuiltin(Builtins::DELETE);
10414     Add<HPushArguments>(obj, key, Add<HConstant>(function_language_mode()));
10415     // TODO(olivf) InvokeFunction produces a check for the parameter count,
10416     // even though we are certain to pass the correct number of arguments here.
10417     HInstruction* instr = New<HInvokeFunction>(function, 3);
10418     return ast_context()->ReturnInstruction(instr, expr->id());
10419   } else if (proxy != NULL) {
10420     Variable* var = proxy->var();
10421     if (var->IsUnallocatedOrGlobalSlot()) {
10422       Bailout(kDeleteWithGlobalVariable);
10423     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
10424       // Result of deleting non-global variables is false.  'this' is not really
10425       // a variable, though we implement it as one.  The subexpression does not
10426       // have side effects.
10427       HValue* value = var->HasThisName(isolate()) ? graph()->GetConstantTrue()
10428                                                   : graph()->GetConstantFalse();
10429       return ast_context()->ReturnValue(value);
10430     } else {
10431       Bailout(kDeleteWithNonGlobalVariable);
10432     }
10433   } else {
10434     // Result of deleting non-property, non-variable reference is true.
10435     // Evaluate the subexpression for side effects.
10436     CHECK_ALIVE(VisitForEffect(expr->expression()));
10437     return ast_context()->ReturnValue(graph()->GetConstantTrue());
10438   }
10439 }
10440
10441
10442 void HOptimizedGraphBuilder::VisitVoid(UnaryOperation* expr) {
10443   CHECK_ALIVE(VisitForEffect(expr->expression()));
10444   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
10445 }
10446
10447
10448 void HOptimizedGraphBuilder::VisitTypeof(UnaryOperation* expr) {
10449   CHECK_ALIVE(VisitForTypeOf(expr->expression()));
10450   HValue* value = Pop();
10451   HInstruction* instr = New<HTypeof>(value);
10452   return ast_context()->ReturnInstruction(instr, expr->id());
10453 }
10454
10455
10456 void HOptimizedGraphBuilder::VisitNot(UnaryOperation* expr) {
10457   if (ast_context()->IsTest()) {
10458     TestContext* context = TestContext::cast(ast_context());
10459     VisitForControl(expr->expression(),
10460                     context->if_false(),
10461                     context->if_true());
10462     return;
10463   }
10464
10465   if (ast_context()->IsEffect()) {
10466     VisitForEffect(expr->expression());
10467     return;
10468   }
10469
10470   DCHECK(ast_context()->IsValue());
10471   HBasicBlock* materialize_false = graph()->CreateBasicBlock();
10472   HBasicBlock* materialize_true = graph()->CreateBasicBlock();
10473   CHECK_BAILOUT(VisitForControl(expr->expression(),
10474                                 materialize_false,
10475                                 materialize_true));
10476
10477   if (materialize_false->HasPredecessor()) {
10478     materialize_false->SetJoinId(expr->MaterializeFalseId());
10479     set_current_block(materialize_false);
10480     Push(graph()->GetConstantFalse());
10481   } else {
10482     materialize_false = NULL;
10483   }
10484
10485   if (materialize_true->HasPredecessor()) {
10486     materialize_true->SetJoinId(expr->MaterializeTrueId());
10487     set_current_block(materialize_true);
10488     Push(graph()->GetConstantTrue());
10489   } else {
10490     materialize_true = NULL;
10491   }
10492
10493   HBasicBlock* join =
10494     CreateJoin(materialize_false, materialize_true, expr->id());
10495   set_current_block(join);
10496   if (join != NULL) return ast_context()->ReturnValue(Pop());
10497 }
10498
10499
10500 static Representation RepresentationFor(Type* type) {
10501   DisallowHeapAllocation no_allocation;
10502   if (type->Is(Type::None())) return Representation::None();
10503   if (type->Is(Type::SignedSmall())) return Representation::Smi();
10504   if (type->Is(Type::Signed32())) return Representation::Integer32();
10505   if (type->Is(Type::Number())) return Representation::Double();
10506   return Representation::Tagged();
10507 }
10508
10509
10510 HInstruction* HOptimizedGraphBuilder::BuildIncrement(
10511     bool returns_original_input,
10512     CountOperation* expr) {
10513   // The input to the count operation is on top of the expression stack.
10514   Representation rep = RepresentationFor(expr->type());
10515   if (rep.IsNone() || rep.IsTagged()) {
10516     rep = Representation::Smi();
10517   }
10518
10519   if (returns_original_input && !is_strong(function_language_mode())) {
10520     // We need an explicit HValue representing ToNumber(input).  The
10521     // actual HChange instruction we need is (sometimes) added in a later
10522     // phase, so it is not available now to be used as an input to HAdd and
10523     // as the return value.
10524     HInstruction* number_input = AddUncasted<HForceRepresentation>(Pop(), rep);
10525     if (!rep.IsDouble()) {
10526       number_input->SetFlag(HInstruction::kFlexibleRepresentation);
10527       number_input->SetFlag(HInstruction::kCannotBeTagged);
10528     }
10529     Push(number_input);
10530   }
10531
10532   // The addition has no side effects, so we do not need
10533   // to simulate the expression stack after this instruction.
10534   // Any later failures deopt to the load of the input or earlier.
10535   HConstant* delta = (expr->op() == Token::INC)
10536       ? graph()->GetConstant1()
10537       : graph()->GetConstantMinus1();
10538   HInstruction* instr =
10539       AddUncasted<HAdd>(Top(), delta, strength(function_language_mode()));
10540   if (instr->IsAdd()) {
10541     HAdd* add = HAdd::cast(instr);
10542     add->set_observed_input_representation(1, rep);
10543     add->set_observed_input_representation(2, Representation::Smi());
10544   }
10545   if (!is_strong(function_language_mode())) {
10546     instr->ClearAllSideEffects();
10547   } else {
10548     Add<HSimulate>(expr->ToNumberId(), REMOVABLE_SIMULATE);
10549   }
10550   instr->SetFlag(HInstruction::kCannotBeTagged);
10551   return instr;
10552 }
10553
10554
10555 void HOptimizedGraphBuilder::BuildStoreForEffect(
10556     Expression* expr, Property* prop, FeedbackVectorICSlot slot,
10557     BailoutId ast_id, BailoutId return_id, HValue* object, HValue* key,
10558     HValue* value) {
10559   EffectContext for_effect(this);
10560   Push(object);
10561   if (key != NULL) Push(key);
10562   Push(value);
10563   BuildStore(expr, prop, slot, ast_id, return_id);
10564 }
10565
10566
10567 void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
10568   DCHECK(!HasStackOverflow());
10569   DCHECK(current_block() != NULL);
10570   DCHECK(current_block()->HasPredecessor());
10571   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
10572   Expression* target = expr->expression();
10573   VariableProxy* proxy = target->AsVariableProxy();
10574   Property* prop = target->AsProperty();
10575   if (proxy == NULL && prop == NULL) {
10576     return Bailout(kInvalidLhsInCountOperation);
10577   }
10578
10579   // Match the full code generator stack by simulating an extra stack
10580   // element for postfix operations in a non-effect context.  The return
10581   // value is ToNumber(input).
10582   bool returns_original_input =
10583       expr->is_postfix() && !ast_context()->IsEffect();
10584   HValue* input = NULL;  // ToNumber(original_input).
10585   HValue* after = NULL;  // The result after incrementing or decrementing.
10586
10587   if (proxy != NULL) {
10588     Variable* var = proxy->var();
10589     if (var->mode() == CONST_LEGACY)  {
10590       return Bailout(kUnsupportedCountOperationWithConst);
10591     }
10592     if (var->mode() == CONST) {
10593       return Bailout(kNonInitializerAssignmentToConst);
10594     }
10595     // Argument of the count operation is a variable, not a property.
10596     DCHECK(prop == NULL);
10597     CHECK_ALIVE(VisitForValue(target));
10598
10599     after = BuildIncrement(returns_original_input, expr);
10600     input = returns_original_input ? Top() : Pop();
10601     Push(after);
10602
10603     switch (var->location()) {
10604       case VariableLocation::GLOBAL:
10605       case VariableLocation::UNALLOCATED:
10606         HandleGlobalVariableAssignment(var, after, expr->CountSlot(),
10607                                        expr->AssignmentId());
10608         break;
10609
10610       case VariableLocation::PARAMETER:
10611       case VariableLocation::LOCAL:
10612         BindIfLive(var, after);
10613         break;
10614
10615       case VariableLocation::CONTEXT: {
10616         // Bail out if we try to mutate a parameter value in a function
10617         // using the arguments object.  We do not (yet) correctly handle the
10618         // arguments property of the function.
10619         if (current_info()->scope()->arguments() != NULL) {
10620           // Parameters will rewrite to context slots.  We have no direct
10621           // way to detect that the variable is a parameter so we use a
10622           // linear search of the parameter list.
10623           int count = current_info()->scope()->num_parameters();
10624           for (int i = 0; i < count; ++i) {
10625             if (var == current_info()->scope()->parameter(i)) {
10626               return Bailout(kAssignmentToParameterInArgumentsObject);
10627             }
10628           }
10629         }
10630
10631         HValue* context = BuildContextChainWalk(var);
10632         HStoreContextSlot::Mode mode = IsLexicalVariableMode(var->mode())
10633             ? HStoreContextSlot::kCheckDeoptimize : HStoreContextSlot::kNoCheck;
10634         HStoreContextSlot* instr = Add<HStoreContextSlot>(context, var->index(),
10635                                                           mode, after);
10636         if (instr->HasObservableSideEffects()) {
10637           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
10638         }
10639         break;
10640       }
10641
10642       case VariableLocation::LOOKUP:
10643         return Bailout(kLookupVariableInCountOperation);
10644     }
10645
10646     Drop(returns_original_input ? 2 : 1);
10647     return ast_context()->ReturnValue(expr->is_postfix() ? input : after);
10648   }
10649
10650   // Argument of the count operation is a property.
10651   DCHECK(prop != NULL);
10652   if (returns_original_input) Push(graph()->GetConstantUndefined());
10653
10654   CHECK_ALIVE(VisitForValue(prop->obj()));
10655   HValue* object = Top();
10656
10657   HValue* key = NULL;
10658   if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
10659     CHECK_ALIVE(VisitForValue(prop->key()));
10660     key = Top();
10661   }
10662
10663   CHECK_ALIVE(PushLoad(prop, object, key));
10664
10665   after = BuildIncrement(returns_original_input, expr);
10666
10667   if (returns_original_input) {
10668     input = Pop();
10669     // Drop object and key to push it again in the effect context below.
10670     Drop(key == NULL ? 1 : 2);
10671     environment()->SetExpressionStackAt(0, input);
10672     CHECK_ALIVE(BuildStoreForEffect(expr, prop, expr->CountSlot(), expr->id(),
10673                                     expr->AssignmentId(), object, key, after));
10674     return ast_context()->ReturnValue(Pop());
10675   }
10676
10677   environment()->SetExpressionStackAt(0, after);
10678   return BuildStore(expr, prop, expr->CountSlot(), expr->id(),
10679                     expr->AssignmentId());
10680 }
10681
10682
10683 HInstruction* HOptimizedGraphBuilder::BuildStringCharCodeAt(
10684     HValue* string,
10685     HValue* index) {
10686   if (string->IsConstant() && index->IsConstant()) {
10687     HConstant* c_string = HConstant::cast(string);
10688     HConstant* c_index = HConstant::cast(index);
10689     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
10690       int32_t i = c_index->NumberValueAsInteger32();
10691       Handle<String> s = c_string->StringValue();
10692       if (i < 0 || i >= s->length()) {
10693         return New<HConstant>(std::numeric_limits<double>::quiet_NaN());
10694       }
10695       return New<HConstant>(s->Get(i));
10696     }
10697   }
10698   string = BuildCheckString(string);
10699   index = Add<HBoundsCheck>(index, AddLoadStringLength(string));
10700   return New<HStringCharCodeAt>(string, index);
10701 }
10702
10703
10704 // Checks if the given shift amounts have following forms:
10705 // (N1) and (N2) with N1 + N2 = 32; (sa) and (32 - sa).
10706 static bool ShiftAmountsAllowReplaceByRotate(HValue* sa,
10707                                              HValue* const32_minus_sa) {
10708   if (sa->IsConstant() && const32_minus_sa->IsConstant()) {
10709     const HConstant* c1 = HConstant::cast(sa);
10710     const HConstant* c2 = HConstant::cast(const32_minus_sa);
10711     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
10712         (c1->Integer32Value() + c2->Integer32Value() == 32);
10713   }
10714   if (!const32_minus_sa->IsSub()) return false;
10715   HSub* sub = HSub::cast(const32_minus_sa);
10716   return sub->left()->EqualsInteger32Constant(32) && sub->right() == sa;
10717 }
10718
10719
10720 // Checks if the left and the right are shift instructions with the oposite
10721 // directions that can be replaced by one rotate right instruction or not.
10722 // Returns the operand and the shift amount for the rotate instruction in the
10723 // former case.
10724 bool HGraphBuilder::MatchRotateRight(HValue* left,
10725                                      HValue* right,
10726                                      HValue** operand,
10727                                      HValue** shift_amount) {
10728   HShl* shl;
10729   HShr* shr;
10730   if (left->IsShl() && right->IsShr()) {
10731     shl = HShl::cast(left);
10732     shr = HShr::cast(right);
10733   } else if (left->IsShr() && right->IsShl()) {
10734     shl = HShl::cast(right);
10735     shr = HShr::cast(left);
10736   } else {
10737     return false;
10738   }
10739   if (shl->left() != shr->left()) return false;
10740
10741   if (!ShiftAmountsAllowReplaceByRotate(shl->right(), shr->right()) &&
10742       !ShiftAmountsAllowReplaceByRotate(shr->right(), shl->right())) {
10743     return false;
10744   }
10745   *operand = shr->left();
10746   *shift_amount = shr->right();
10747   return true;
10748 }
10749
10750
10751 bool CanBeZero(HValue* right) {
10752   if (right->IsConstant()) {
10753     HConstant* right_const = HConstant::cast(right);
10754     if (right_const->HasInteger32Value() &&
10755        (right_const->Integer32Value() & 0x1f) != 0) {
10756       return false;
10757     }
10758   }
10759   return true;
10760 }
10761
10762
10763 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
10764                                          Type* expected) {
10765   if (expected->Is(Type::SignedSmall())) {
10766     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
10767   }
10768   if (expected->Is(Type::Signed32())) {
10769     return AddUncasted<HForceRepresentation>(number,
10770                                              Representation::Integer32());
10771   }
10772   return number;
10773 }
10774
10775
10776 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
10777   if (value->IsConstant()) {
10778     HConstant* constant = HConstant::cast(value);
10779     Maybe<HConstant*> number =
10780         constant->CopyToTruncatedNumber(isolate(), zone());
10781     if (number.IsJust()) {
10782       *expected = Type::Number(zone());
10783       return AddInstruction(number.FromJust());
10784     }
10785   }
10786
10787   // We put temporary values on the stack, which don't correspond to anything
10788   // in baseline code. Since nothing is observable we avoid recording those
10789   // pushes with a NoObservableSideEffectsScope.
10790   NoObservableSideEffectsScope no_effects(this);
10791
10792   Type* expected_type = *expected;
10793
10794   // Separate the number type from the rest.
10795   Type* expected_obj =
10796       Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
10797   Type* expected_number =
10798       Type::Intersect(expected_type, Type::Number(zone()), zone());
10799
10800   // We expect to get a number.
10801   // (We need to check first, since Type::None->Is(Type::Any()) == true.
10802   if (expected_obj->Is(Type::None())) {
10803     DCHECK(!expected_number->Is(Type::None(zone())));
10804     return value;
10805   }
10806
10807   if (expected_obj->Is(Type::Undefined(zone()))) {
10808     // This is already done by HChange.
10809     *expected = Type::Union(expected_number, Type::Number(zone()), zone());
10810     return value;
10811   }
10812
10813   return value;
10814 }
10815
10816
10817 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
10818     BinaryOperation* expr,
10819     HValue* left,
10820     HValue* right,
10821     PushBeforeSimulateBehavior push_sim_result) {
10822   Type* left_type = expr->left()->bounds().lower;
10823   Type* right_type = expr->right()->bounds().lower;
10824   Type* result_type = expr->bounds().lower;
10825   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
10826   Handle<AllocationSite> allocation_site = expr->allocation_site();
10827
10828   HAllocationMode allocation_mode;
10829   if (FLAG_allocation_site_pretenuring && !allocation_site.is_null()) {
10830     allocation_mode = HAllocationMode(allocation_site);
10831   }
10832   HValue* result = HGraphBuilder::BuildBinaryOperation(
10833       expr->op(), left, right, left_type, right_type, result_type,
10834       fixed_right_arg, allocation_mode, strength(function_language_mode()),
10835       expr->id());
10836   // Add a simulate after instructions with observable side effects, and
10837   // after phis, which are the result of BuildBinaryOperation when we
10838   // inlined some complex subgraph.
10839   if (result->HasObservableSideEffects() || result->IsPhi()) {
10840     if (push_sim_result == PUSH_BEFORE_SIMULATE) {
10841       Push(result);
10842       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10843       Drop(1);
10844     } else {
10845       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10846     }
10847   }
10848   return result;
10849 }
10850
10851
10852 HValue* HGraphBuilder::BuildBinaryOperation(
10853     Token::Value op, HValue* left, HValue* right, Type* left_type,
10854     Type* right_type, Type* result_type, Maybe<int> fixed_right_arg,
10855     HAllocationMode allocation_mode, Strength strength, BailoutId opt_id) {
10856   bool maybe_string_add = false;
10857   if (op == Token::ADD) {
10858     // If we are adding constant string with something for which we don't have
10859     // a feedback yet, assume that it's also going to be a string and don't
10860     // generate deopt instructions.
10861     if (!left_type->IsInhabited() && right->IsConstant() &&
10862         HConstant::cast(right)->HasStringValue()) {
10863       left_type = Type::String();
10864     }
10865
10866     if (!right_type->IsInhabited() && left->IsConstant() &&
10867         HConstant::cast(left)->HasStringValue()) {
10868       right_type = Type::String();
10869     }
10870
10871     maybe_string_add = (left_type->Maybe(Type::String()) ||
10872                         left_type->Maybe(Type::Receiver()) ||
10873                         right_type->Maybe(Type::String()) ||
10874                         right_type->Maybe(Type::Receiver()));
10875   }
10876
10877   Representation left_rep = RepresentationFor(left_type);
10878   Representation right_rep = RepresentationFor(right_type);
10879
10880   if (!left_type->IsInhabited()) {
10881     Add<HDeoptimize>(
10882         Deoptimizer::kInsufficientTypeFeedbackForLHSOfBinaryOperation,
10883         Deoptimizer::SOFT);
10884     left_type = Type::Any(zone());
10885     left_rep = RepresentationFor(left_type);
10886     maybe_string_add = op == Token::ADD;
10887   }
10888
10889   if (!right_type->IsInhabited()) {
10890     Add<HDeoptimize>(
10891         Deoptimizer::kInsufficientTypeFeedbackForRHSOfBinaryOperation,
10892         Deoptimizer::SOFT);
10893     right_type = Type::Any(zone());
10894     right_rep = RepresentationFor(right_type);
10895     maybe_string_add = op == Token::ADD;
10896   }
10897
10898   if (!maybe_string_add && !is_strong(strength)) {
10899     left = TruncateToNumber(left, &left_type);
10900     right = TruncateToNumber(right, &right_type);
10901   }
10902
10903   // Special case for string addition here.
10904   if (op == Token::ADD &&
10905       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
10906     // Validate type feedback for left argument.
10907     if (left_type->Is(Type::String())) {
10908       left = BuildCheckString(left);
10909     }
10910
10911     // Validate type feedback for right argument.
10912     if (right_type->Is(Type::String())) {
10913       right = BuildCheckString(right);
10914     }
10915
10916     // Convert left argument as necessary.
10917     if (left_type->Is(Type::Number()) && !is_strong(strength)) {
10918       DCHECK(right_type->Is(Type::String()));
10919       left = BuildNumberToString(left, left_type);
10920     } else if (!left_type->Is(Type::String())) {
10921       DCHECK(right_type->Is(Type::String()));
10922       HValue* function = AddLoadJSBuiltin(
10923           is_strong(strength) ? Builtins::STRING_ADD_RIGHT_STRONG
10924                               : Builtins::STRING_ADD_RIGHT);
10925       Add<HPushArguments>(left, right);
10926       return AddUncasted<HInvokeFunction>(function, 2);
10927     }
10928
10929     // Convert right argument as necessary.
10930     if (right_type->Is(Type::Number()) && !is_strong(strength)) {
10931       DCHECK(left_type->Is(Type::String()));
10932       right = BuildNumberToString(right, right_type);
10933     } else if (!right_type->Is(Type::String())) {
10934       DCHECK(left_type->Is(Type::String()));
10935       HValue* function = AddLoadJSBuiltin(is_strong(strength)
10936                                               ? Builtins::STRING_ADD_LEFT_STRONG
10937                                               : Builtins::STRING_ADD_LEFT);
10938       Add<HPushArguments>(left, right);
10939       return AddUncasted<HInvokeFunction>(function, 2);
10940     }
10941
10942     // Fast paths for empty constant strings.
10943     Handle<String> left_string =
10944         left->IsConstant() && HConstant::cast(left)->HasStringValue()
10945             ? HConstant::cast(left)->StringValue()
10946             : Handle<String>();
10947     Handle<String> right_string =
10948         right->IsConstant() && HConstant::cast(right)->HasStringValue()
10949             ? HConstant::cast(right)->StringValue()
10950             : Handle<String>();
10951     if (!left_string.is_null() && left_string->length() == 0) return right;
10952     if (!right_string.is_null() && right_string->length() == 0) return left;
10953     if (!left_string.is_null() && !right_string.is_null()) {
10954       return AddUncasted<HStringAdd>(
10955           left, right, strength, allocation_mode.GetPretenureMode(),
10956           STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10957     }
10958
10959     // Register the dependent code with the allocation site.
10960     if (!allocation_mode.feedback_site().is_null()) {
10961       DCHECK(!graph()->info()->IsStub());
10962       Handle<AllocationSite> site(allocation_mode.feedback_site());
10963       top_info()->dependencies()->AssumeTenuringDecision(site);
10964     }
10965
10966     // Inline the string addition into the stub when creating allocation
10967     // mementos to gather allocation site feedback, or if we can statically
10968     // infer that we're going to create a cons string.
10969     if ((graph()->info()->IsStub() &&
10970          allocation_mode.CreateAllocationMementos()) ||
10971         (left->IsConstant() &&
10972          HConstant::cast(left)->HasStringValue() &&
10973          HConstant::cast(left)->StringValue()->length() + 1 >=
10974            ConsString::kMinLength) ||
10975         (right->IsConstant() &&
10976          HConstant::cast(right)->HasStringValue() &&
10977          HConstant::cast(right)->StringValue()->length() + 1 >=
10978            ConsString::kMinLength)) {
10979       return BuildStringAdd(left, right, allocation_mode);
10980     }
10981
10982     // Fallback to using the string add stub.
10983     return AddUncasted<HStringAdd>(
10984         left, right, strength, allocation_mode.GetPretenureMode(),
10985         STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10986   }
10987
10988   if (graph()->info()->IsStub()) {
10989     left = EnforceNumberType(left, left_type);
10990     right = EnforceNumberType(right, right_type);
10991   }
10992
10993   Representation result_rep = RepresentationFor(result_type);
10994
10995   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
10996                           (right_rep.IsTagged() && !right_rep.IsSmi());
10997
10998   HInstruction* instr = NULL;
10999   // Only the stub is allowed to call into the runtime, since otherwise we would
11000   // inline several instructions (including the two pushes) for every tagged
11001   // operation in optimized code, which is more expensive, than a stub call.
11002   if (graph()->info()->IsStub() && is_non_primitive) {
11003     HValue* function =
11004         AddLoadJSBuiltin(BinaryOpIC::TokenToJSBuiltin(op, strength));
11005     Add<HPushArguments>(left, right);
11006     instr = AddUncasted<HInvokeFunction>(function, 2);
11007   } else {
11008     if (is_strong(strength) && Token::IsBitOp(op)) {
11009       // TODO(conradw): This is not efficient, but is necessary to prevent
11010       // conversion of oddball values to numbers in strong mode. It would be
11011       // better to prevent the conversion rather than adding a runtime check.
11012       IfBuilder if_builder(this);
11013       if_builder.If<HHasInstanceTypeAndBranch>(left, ODDBALL_TYPE);
11014       if_builder.OrIf<HHasInstanceTypeAndBranch>(right, ODDBALL_TYPE);
11015       if_builder.Then();
11016       Add<HCallRuntime>(
11017           isolate()->factory()->empty_string(),
11018           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
11019           0);
11020       if (!graph()->info()->IsStub()) {
11021         Add<HSimulate>(opt_id, REMOVABLE_SIMULATE);
11022       }
11023       if_builder.End();
11024     }
11025     switch (op) {
11026       case Token::ADD:
11027         instr = AddUncasted<HAdd>(left, right, strength);
11028         break;
11029       case Token::SUB:
11030         instr = AddUncasted<HSub>(left, right, strength);
11031         break;
11032       case Token::MUL:
11033         instr = AddUncasted<HMul>(left, right, strength);
11034         break;
11035       case Token::MOD: {
11036         if (fixed_right_arg.IsJust() &&
11037             !right->EqualsInteger32Constant(fixed_right_arg.FromJust())) {
11038           HConstant* fixed_right =
11039               Add<HConstant>(static_cast<int>(fixed_right_arg.FromJust()));
11040           IfBuilder if_same(this);
11041           if_same.If<HCompareNumericAndBranch>(right, fixed_right, Token::EQ);
11042           if_same.Then();
11043           if_same.ElseDeopt(Deoptimizer::kUnexpectedRHSOfBinaryOperation);
11044           right = fixed_right;
11045         }
11046         instr = AddUncasted<HMod>(left, right, strength);
11047         break;
11048       }
11049       case Token::DIV:
11050         instr = AddUncasted<HDiv>(left, right, strength);
11051         break;
11052       case Token::BIT_XOR:
11053       case Token::BIT_AND:
11054         instr = AddUncasted<HBitwise>(op, left, right, strength);
11055         break;
11056       case Token::BIT_OR: {
11057         HValue* operand, *shift_amount;
11058         if (left_type->Is(Type::Signed32()) &&
11059             right_type->Is(Type::Signed32()) &&
11060             MatchRotateRight(left, right, &operand, &shift_amount)) {
11061           instr = AddUncasted<HRor>(operand, shift_amount, strength);
11062         } else {
11063           instr = AddUncasted<HBitwise>(op, left, right, strength);
11064         }
11065         break;
11066       }
11067       case Token::SAR:
11068         instr = AddUncasted<HSar>(left, right, strength);
11069         break;
11070       case Token::SHR:
11071         instr = AddUncasted<HShr>(left, right, strength);
11072         if (instr->IsShr() && CanBeZero(right)) {
11073           graph()->RecordUint32Instruction(instr);
11074         }
11075         break;
11076       case Token::SHL:
11077         instr = AddUncasted<HShl>(left, right, strength);
11078         break;
11079       default:
11080         UNREACHABLE();
11081     }
11082   }
11083
11084   if (instr->IsBinaryOperation()) {
11085     HBinaryOperation* binop = HBinaryOperation::cast(instr);
11086     binop->set_observed_input_representation(1, left_rep);
11087     binop->set_observed_input_representation(2, right_rep);
11088     binop->initialize_output_representation(result_rep);
11089     if (graph()->info()->IsStub()) {
11090       // Stub should not call into stub.
11091       instr->SetFlag(HValue::kCannotBeTagged);
11092       // And should truncate on HForceRepresentation already.
11093       if (left->IsForceRepresentation()) {
11094         left->CopyFlag(HValue::kTruncatingToSmi, instr);
11095         left->CopyFlag(HValue::kTruncatingToInt32, instr);
11096       }
11097       if (right->IsForceRepresentation()) {
11098         right->CopyFlag(HValue::kTruncatingToSmi, instr);
11099         right->CopyFlag(HValue::kTruncatingToInt32, instr);
11100       }
11101     }
11102   }
11103   return instr;
11104 }
11105
11106
11107 // Check for the form (%_ClassOf(foo) === 'BarClass').
11108 static bool IsClassOfTest(CompareOperation* expr) {
11109   if (expr->op() != Token::EQ_STRICT) return false;
11110   CallRuntime* call = expr->left()->AsCallRuntime();
11111   if (call == NULL) return false;
11112   Literal* literal = expr->right()->AsLiteral();
11113   if (literal == NULL) return false;
11114   if (!literal->value()->IsString()) return false;
11115   if (!call->name()->IsOneByteEqualTo(STATIC_CHAR_VECTOR("_ClassOf"))) {
11116     return false;
11117   }
11118   DCHECK(call->arguments()->length() == 1);
11119   return true;
11120 }
11121
11122
11123 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
11124   DCHECK(!HasStackOverflow());
11125   DCHECK(current_block() != NULL);
11126   DCHECK(current_block()->HasPredecessor());
11127   switch (expr->op()) {
11128     case Token::COMMA:
11129       return VisitComma(expr);
11130     case Token::OR:
11131     case Token::AND:
11132       return VisitLogicalExpression(expr);
11133     default:
11134       return VisitArithmeticExpression(expr);
11135   }
11136 }
11137
11138
11139 void HOptimizedGraphBuilder::VisitComma(BinaryOperation* expr) {
11140   CHECK_ALIVE(VisitForEffect(expr->left()));
11141   // Visit the right subexpression in the same AST context as the entire
11142   // expression.
11143   Visit(expr->right());
11144 }
11145
11146
11147 void HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
11148   bool is_logical_and = expr->op() == Token::AND;
11149   if (ast_context()->IsTest()) {
11150     TestContext* context = TestContext::cast(ast_context());
11151     // Translate left subexpression.
11152     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11153     if (is_logical_and) {
11154       CHECK_BAILOUT(VisitForControl(expr->left(),
11155                                     eval_right,
11156                                     context->if_false()));
11157     } else {
11158       CHECK_BAILOUT(VisitForControl(expr->left(),
11159                                     context->if_true(),
11160                                     eval_right));
11161     }
11162
11163     // Translate right subexpression by visiting it in the same AST
11164     // context as the entire expression.
11165     if (eval_right->HasPredecessor()) {
11166       eval_right->SetJoinId(expr->RightId());
11167       set_current_block(eval_right);
11168       Visit(expr->right());
11169     }
11170
11171   } else if (ast_context()->IsValue()) {
11172     CHECK_ALIVE(VisitForValue(expr->left()));
11173     DCHECK(current_block() != NULL);
11174     HValue* left_value = Top();
11175
11176     // Short-circuit left values that always evaluate to the same boolean value.
11177     if (expr->left()->ToBooleanIsTrue() || expr->left()->ToBooleanIsFalse()) {
11178       // l (evals true)  && r -> r
11179       // l (evals true)  || r -> l
11180       // l (evals false) && r -> l
11181       // l (evals false) || r -> r
11182       if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
11183         Drop(1);
11184         CHECK_ALIVE(VisitForValue(expr->right()));
11185       }
11186       return ast_context()->ReturnValue(Pop());
11187     }
11188
11189     // We need an extra block to maintain edge-split form.
11190     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11191     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11192     ToBooleanStub::Types expected(expr->left()->to_boolean_types());
11193     HBranch* test = is_logical_and
11194         ? New<HBranch>(left_value, expected, eval_right, empty_block)
11195         : New<HBranch>(left_value, expected, empty_block, eval_right);
11196     FinishCurrentBlock(test);
11197
11198     set_current_block(eval_right);
11199     Drop(1);  // Value of the left subexpression.
11200     CHECK_BAILOUT(VisitForValue(expr->right()));
11201
11202     HBasicBlock* join_block =
11203       CreateJoin(empty_block, current_block(), expr->id());
11204     set_current_block(join_block);
11205     return ast_context()->ReturnValue(Pop());
11206
11207   } else {
11208     DCHECK(ast_context()->IsEffect());
11209     // In an effect context, we don't need the value of the left subexpression,
11210     // only its control flow and side effects.  We need an extra block to
11211     // maintain edge-split form.
11212     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11213     HBasicBlock* right_block = graph()->CreateBasicBlock();
11214     if (is_logical_and) {
11215       CHECK_BAILOUT(VisitForControl(expr->left(), right_block, empty_block));
11216     } else {
11217       CHECK_BAILOUT(VisitForControl(expr->left(), empty_block, right_block));
11218     }
11219
11220     // TODO(kmillikin): Find a way to fix this.  It's ugly that there are
11221     // actually two empty blocks (one here and one inserted by
11222     // TestContext::BuildBranch, and that they both have an HSimulate though the
11223     // second one is not a merge node, and that we really have no good AST ID to
11224     // put on that first HSimulate.
11225
11226     if (empty_block->HasPredecessor()) {
11227       empty_block->SetJoinId(expr->id());
11228     } else {
11229       empty_block = NULL;
11230     }
11231
11232     if (right_block->HasPredecessor()) {
11233       right_block->SetJoinId(expr->RightId());
11234       set_current_block(right_block);
11235       CHECK_BAILOUT(VisitForEffect(expr->right()));
11236       right_block = current_block();
11237     } else {
11238       right_block = NULL;
11239     }
11240
11241     HBasicBlock* join_block =
11242       CreateJoin(empty_block, right_block, expr->id());
11243     set_current_block(join_block);
11244     // We did not materialize any value in the predecessor environments,
11245     // so there is no need to handle it here.
11246   }
11247 }
11248
11249
11250 void HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
11251   CHECK_ALIVE(VisitForValue(expr->left()));
11252   CHECK_ALIVE(VisitForValue(expr->right()));
11253   SetSourcePosition(expr->position());
11254   HValue* right = Pop();
11255   HValue* left = Pop();
11256   HValue* result =
11257       BuildBinaryOperation(expr, left, right,
11258           ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11259                                     : PUSH_BEFORE_SIMULATE);
11260   if (top_info()->is_tracking_positions() && result->IsBinaryOperation()) {
11261     HBinaryOperation::cast(result)->SetOperandPositions(
11262         zone(),
11263         ScriptPositionToSourcePosition(expr->left()->position()),
11264         ScriptPositionToSourcePosition(expr->right()->position()));
11265   }
11266   return ast_context()->ReturnValue(result);
11267 }
11268
11269
11270 void HOptimizedGraphBuilder::HandleLiteralCompareTypeof(CompareOperation* expr,
11271                                                         Expression* sub_expr,
11272                                                         Handle<String> check) {
11273   CHECK_ALIVE(VisitForTypeOf(sub_expr));
11274   SetSourcePosition(expr->position());
11275   HValue* value = Pop();
11276   HTypeofIsAndBranch* instr = New<HTypeofIsAndBranch>(value, check);
11277   return ast_context()->ReturnControl(instr, expr->id());
11278 }
11279
11280
11281 static bool IsLiteralCompareBool(Isolate* isolate,
11282                                  HValue* left,
11283                                  Token::Value op,
11284                                  HValue* right) {
11285   return op == Token::EQ_STRICT &&
11286       ((left->IsConstant() &&
11287           HConstant::cast(left)->handle(isolate)->IsBoolean()) ||
11288        (right->IsConstant() &&
11289            HConstant::cast(right)->handle(isolate)->IsBoolean()));
11290 }
11291
11292
11293 void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
11294   DCHECK(!HasStackOverflow());
11295   DCHECK(current_block() != NULL);
11296   DCHECK(current_block()->HasPredecessor());
11297
11298   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11299
11300   // Check for a few fast cases. The AST visiting behavior must be in sync
11301   // with the full codegen: We don't push both left and right values onto
11302   // the expression stack when one side is a special-case literal.
11303   Expression* sub_expr = NULL;
11304   Handle<String> check;
11305   if (expr->IsLiteralCompareTypeof(&sub_expr, &check)) {
11306     return HandleLiteralCompareTypeof(expr, sub_expr, check);
11307   }
11308   if (expr->IsLiteralCompareUndefined(&sub_expr, isolate())) {
11309     return HandleLiteralCompareNil(expr, sub_expr, kUndefinedValue);
11310   }
11311   if (expr->IsLiteralCompareNull(&sub_expr)) {
11312     return HandleLiteralCompareNil(expr, sub_expr, kNullValue);
11313   }
11314
11315   if (IsClassOfTest(expr)) {
11316     CallRuntime* call = expr->left()->AsCallRuntime();
11317     DCHECK(call->arguments()->length() == 1);
11318     CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11319     HValue* value = Pop();
11320     Literal* literal = expr->right()->AsLiteral();
11321     Handle<String> rhs = Handle<String>::cast(literal->value());
11322     HClassOfTestAndBranch* instr = New<HClassOfTestAndBranch>(value, rhs);
11323     return ast_context()->ReturnControl(instr, expr->id());
11324   }
11325
11326   Type* left_type = expr->left()->bounds().lower;
11327   Type* right_type = expr->right()->bounds().lower;
11328   Type* combined_type = expr->combined_type();
11329
11330   CHECK_ALIVE(VisitForValue(expr->left()));
11331   CHECK_ALIVE(VisitForValue(expr->right()));
11332
11333   HValue* right = Pop();
11334   HValue* left = Pop();
11335   Token::Value op = expr->op();
11336
11337   if (IsLiteralCompareBool(isolate(), left, op, right)) {
11338     HCompareObjectEqAndBranch* result =
11339         New<HCompareObjectEqAndBranch>(left, right);
11340     return ast_context()->ReturnControl(result, expr->id());
11341   }
11342
11343   if (op == Token::INSTANCEOF) {
11344     // Check to see if the rhs of the instanceof is a known function.
11345     if (right->IsConstant() &&
11346         HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
11347       Handle<Object> function = HConstant::cast(right)->handle(isolate());
11348       Handle<JSFunction> target = Handle<JSFunction>::cast(function);
11349       HInstanceOfKnownGlobal* result =
11350           New<HInstanceOfKnownGlobal>(left, target);
11351       return ast_context()->ReturnInstruction(result, expr->id());
11352     }
11353
11354     HInstanceOf* result = New<HInstanceOf>(left, right);
11355     return ast_context()->ReturnInstruction(result, expr->id());
11356
11357   } else if (op == Token::IN) {
11358     HValue* function = AddLoadJSBuiltin(Builtins::IN);
11359     Add<HPushArguments>(left, right);
11360     // TODO(olivf) InvokeFunction produces a check for the parameter count,
11361     // even though we are certain to pass the correct number of arguments here.
11362     HInstruction* result = New<HInvokeFunction>(function, 2);
11363     return ast_context()->ReturnInstruction(result, expr->id());
11364   }
11365
11366   PushBeforeSimulateBehavior push_behavior =
11367     ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11368                               : PUSH_BEFORE_SIMULATE;
11369   HControlInstruction* compare = BuildCompareInstruction(
11370       op, left, right, left_type, right_type, combined_type,
11371       ScriptPositionToSourcePosition(expr->left()->position()),
11372       ScriptPositionToSourcePosition(expr->right()->position()),
11373       push_behavior, expr->id());
11374   if (compare == NULL) return;  // Bailed out.
11375   return ast_context()->ReturnControl(compare, expr->id());
11376 }
11377
11378
11379 HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
11380     Token::Value op, HValue* left, HValue* right, Type* left_type,
11381     Type* right_type, Type* combined_type, SourcePosition left_position,
11382     SourcePosition right_position, PushBeforeSimulateBehavior push_sim_result,
11383     BailoutId bailout_id) {
11384   // Cases handled below depend on collected type feedback. They should
11385   // soft deoptimize when there is no type feedback.
11386   if (!combined_type->IsInhabited()) {
11387     Add<HDeoptimize>(
11388         Deoptimizer::kInsufficientTypeFeedbackForCombinedTypeOfBinaryOperation,
11389         Deoptimizer::SOFT);
11390     combined_type = left_type = right_type = Type::Any(zone());
11391   }
11392
11393   Representation left_rep = RepresentationFor(left_type);
11394   Representation right_rep = RepresentationFor(right_type);
11395   Representation combined_rep = RepresentationFor(combined_type);
11396
11397   if (combined_type->Is(Type::Receiver())) {
11398     if (Token::IsEqualityOp(op)) {
11399       // HCompareObjectEqAndBranch can only deal with object, so
11400       // exclude numbers.
11401       if ((left->IsConstant() &&
11402            HConstant::cast(left)->HasNumberValue()) ||
11403           (right->IsConstant() &&
11404            HConstant::cast(right)->HasNumberValue())) {
11405         Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11406                          Deoptimizer::SOFT);
11407         // The caller expects a branch instruction, so make it happy.
11408         return New<HBranch>(graph()->GetConstantTrue());
11409       }
11410       // Can we get away with map check and not instance type check?
11411       HValue* operand_to_check =
11412           left->block()->block_id() < right->block()->block_id() ? left : right;
11413       if (combined_type->IsClass()) {
11414         Handle<Map> map = combined_type->AsClass()->Map();
11415         AddCheckMap(operand_to_check, map);
11416         HCompareObjectEqAndBranch* result =
11417             New<HCompareObjectEqAndBranch>(left, right);
11418         if (top_info()->is_tracking_positions()) {
11419           result->set_operand_position(zone(), 0, left_position);
11420           result->set_operand_position(zone(), 1, right_position);
11421         }
11422         return result;
11423       } else {
11424         BuildCheckHeapObject(operand_to_check);
11425         Add<HCheckInstanceType>(operand_to_check,
11426                                 HCheckInstanceType::IS_SPEC_OBJECT);
11427         HCompareObjectEqAndBranch* result =
11428             New<HCompareObjectEqAndBranch>(left, right);
11429         return result;
11430       }
11431     } else {
11432       Bailout(kUnsupportedNonPrimitiveCompare);
11433       return NULL;
11434     }
11435   } else if (combined_type->Is(Type::InternalizedString()) &&
11436              Token::IsEqualityOp(op)) {
11437     // If we have a constant argument, it should be consistent with the type
11438     // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
11439     if ((left->IsConstant() &&
11440          !HConstant::cast(left)->HasInternalizedStringValue()) ||
11441         (right->IsConstant() &&
11442          !HConstant::cast(right)->HasInternalizedStringValue())) {
11443       Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11444                        Deoptimizer::SOFT);
11445       // The caller expects a branch instruction, so make it happy.
11446       return New<HBranch>(graph()->GetConstantTrue());
11447     }
11448     BuildCheckHeapObject(left);
11449     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
11450     BuildCheckHeapObject(right);
11451     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
11452     HCompareObjectEqAndBranch* result =
11453         New<HCompareObjectEqAndBranch>(left, right);
11454     return result;
11455   } else if (combined_type->Is(Type::String())) {
11456     BuildCheckHeapObject(left);
11457     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
11458     BuildCheckHeapObject(right);
11459     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
11460     HStringCompareAndBranch* result =
11461         New<HStringCompareAndBranch>(left, right, op);
11462     return result;
11463   } else {
11464     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
11465       HCompareGeneric* result = Add<HCompareGeneric>(
11466           left, right, op, strength(function_language_mode()));
11467       result->set_observed_input_representation(1, left_rep);
11468       result->set_observed_input_representation(2, right_rep);
11469       if (result->HasObservableSideEffects()) {
11470         if (push_sim_result == PUSH_BEFORE_SIMULATE) {
11471           Push(result);
11472           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11473           Drop(1);
11474         } else {
11475           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11476         }
11477       }
11478       // TODO(jkummerow): Can we make this more efficient?
11479       HBranch* branch = New<HBranch>(result);
11480       return branch;
11481     } else {
11482       HCompareNumericAndBranch* result = New<HCompareNumericAndBranch>(
11483           left, right, op, strength(function_language_mode()));
11484       result->set_observed_input_representation(left_rep, right_rep);
11485       if (top_info()->is_tracking_positions()) {
11486         result->SetOperandPositions(zone(), left_position, right_position);
11487       }
11488       return result;
11489     }
11490   }
11491 }
11492
11493
11494 void HOptimizedGraphBuilder::HandleLiteralCompareNil(CompareOperation* expr,
11495                                                      Expression* sub_expr,
11496                                                      NilValue nil) {
11497   DCHECK(!HasStackOverflow());
11498   DCHECK(current_block() != NULL);
11499   DCHECK(current_block()->HasPredecessor());
11500   DCHECK(expr->op() == Token::EQ || expr->op() == Token::EQ_STRICT);
11501   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11502   CHECK_ALIVE(VisitForValue(sub_expr));
11503   HValue* value = Pop();
11504   if (expr->op() == Token::EQ_STRICT) {
11505     HConstant* nil_constant = nil == kNullValue
11506         ? graph()->GetConstantNull()
11507         : graph()->GetConstantUndefined();
11508     HCompareObjectEqAndBranch* instr =
11509         New<HCompareObjectEqAndBranch>(value, nil_constant);
11510     return ast_context()->ReturnControl(instr, expr->id());
11511   } else {
11512     DCHECK_EQ(Token::EQ, expr->op());
11513     Type* type = expr->combined_type()->Is(Type::None())
11514         ? Type::Any(zone()) : expr->combined_type();
11515     HIfContinuation continuation;
11516     BuildCompareNil(value, type, &continuation);
11517     return ast_context()->ReturnContinuation(&continuation, expr->id());
11518   }
11519 }
11520
11521
11522 void HOptimizedGraphBuilder::VisitSpread(Spread* expr) { UNREACHABLE(); }
11523
11524
11525 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
11526   // If we share optimized code between different closures, the
11527   // this-function is not a constant, except inside an inlined body.
11528   if (function_state()->outer() != NULL) {
11529       return New<HConstant>(
11530           function_state()->compilation_info()->closure());
11531   } else {
11532       return New<HThisFunction>();
11533   }
11534 }
11535
11536
11537 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
11538     Handle<JSObject> boilerplate_object,
11539     AllocationSiteUsageContext* site_context) {
11540   NoObservableSideEffectsScope no_effects(this);
11541   Handle<Map> initial_map(boilerplate_object->map());
11542   InstanceType instance_type = initial_map->instance_type();
11543   DCHECK(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
11544
11545   HType type = instance_type == JS_ARRAY_TYPE
11546       ? HType::JSArray() : HType::JSObject();
11547   HValue* object_size_constant = Add<HConstant>(initial_map->instance_size());
11548
11549   PretenureFlag pretenure_flag = NOT_TENURED;
11550   Handle<AllocationSite> top_site(*site_context->top(), isolate());
11551   if (FLAG_allocation_site_pretenuring) {
11552     pretenure_flag = top_site->GetPretenureMode();
11553   }
11554
11555   Handle<AllocationSite> current_site(*site_context->current(), isolate());
11556   if (*top_site == *current_site) {
11557     // We install a dependency for pretenuring only on the outermost literal.
11558     top_info()->dependencies()->AssumeTenuringDecision(top_site);
11559   }
11560   top_info()->dependencies()->AssumeTransitionStable(current_site);
11561
11562   HInstruction* object = Add<HAllocate>(
11563       object_size_constant, type, pretenure_flag, instance_type, top_site);
11564
11565   // If allocation folding reaches Page::kMaxRegularHeapObjectSize the
11566   // elements array may not get folded into the object. Hence, we set the
11567   // elements pointer to empty fixed array and let store elimination remove
11568   // this store in the folding case.
11569   HConstant* empty_fixed_array = Add<HConstant>(
11570       isolate()->factory()->empty_fixed_array());
11571   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11572       empty_fixed_array);
11573
11574   BuildEmitObjectHeader(boilerplate_object, object);
11575
11576   // Similarly to the elements pointer, there is no guarantee that all
11577   // property allocations can get folded, so pre-initialize all in-object
11578   // properties to a safe value.
11579   BuildInitializeInobjectProperties(object, initial_map);
11580
11581   Handle<FixedArrayBase> elements(boilerplate_object->elements());
11582   int elements_size = (elements->length() > 0 &&
11583       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
11584           elements->Size() : 0;
11585
11586   if (pretenure_flag == TENURED &&
11587       elements->map() == isolate()->heap()->fixed_cow_array_map() &&
11588       isolate()->heap()->InNewSpace(*elements)) {
11589     // If we would like to pretenure a fixed cow array, we must ensure that the
11590     // array is already in old space, otherwise we'll create too many old-to-
11591     // new-space pointers (overflowing the store buffer).
11592     elements = Handle<FixedArrayBase>(
11593         isolate()->factory()->CopyAndTenureFixedCOWArray(
11594             Handle<FixedArray>::cast(elements)));
11595     boilerplate_object->set_elements(*elements);
11596   }
11597
11598   HInstruction* object_elements = NULL;
11599   if (elements_size > 0) {
11600     HValue* object_elements_size = Add<HConstant>(elements_size);
11601     InstanceType instance_type = boilerplate_object->HasFastDoubleElements()
11602         ? FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
11603     object_elements = Add<HAllocate>(object_elements_size, HType::HeapObject(),
11604                                      pretenure_flag, instance_type, top_site);
11605     BuildEmitElements(boilerplate_object, elements, object_elements,
11606                       site_context);
11607     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11608                           object_elements);
11609   } else {
11610     Handle<Object> elements_field =
11611         Handle<Object>(boilerplate_object->elements(), isolate());
11612     HInstruction* object_elements_cow = Add<HConstant>(elements_field);
11613     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11614                           object_elements_cow);
11615   }
11616
11617   // Copy in-object properties.
11618   if (initial_map->NumberOfFields() != 0 ||
11619       initial_map->unused_property_fields() > 0) {
11620     BuildEmitInObjectProperties(boilerplate_object, object, site_context,
11621                                 pretenure_flag);
11622   }
11623   return object;
11624 }
11625
11626
11627 void HOptimizedGraphBuilder::BuildEmitObjectHeader(
11628     Handle<JSObject> boilerplate_object,
11629     HInstruction* object) {
11630   DCHECK(boilerplate_object->properties()->length() == 0);
11631
11632   Handle<Map> boilerplate_object_map(boilerplate_object->map());
11633   AddStoreMapConstant(object, boilerplate_object_map);
11634
11635   Handle<Object> properties_field =
11636       Handle<Object>(boilerplate_object->properties(), isolate());
11637   DCHECK(*properties_field == isolate()->heap()->empty_fixed_array());
11638   HInstruction* properties = Add<HConstant>(properties_field);
11639   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
11640   Add<HStoreNamedField>(object, access, properties);
11641
11642   if (boilerplate_object->IsJSArray()) {
11643     Handle<JSArray> boilerplate_array =
11644         Handle<JSArray>::cast(boilerplate_object);
11645     Handle<Object> length_field =
11646         Handle<Object>(boilerplate_array->length(), isolate());
11647     HInstruction* length = Add<HConstant>(length_field);
11648
11649     DCHECK(boilerplate_array->length()->IsSmi());
11650     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
11651         boilerplate_array->GetElementsKind()), length);
11652   }
11653 }
11654
11655
11656 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
11657     Handle<JSObject> boilerplate_object,
11658     HInstruction* object,
11659     AllocationSiteUsageContext* site_context,
11660     PretenureFlag pretenure_flag) {
11661   Handle<Map> boilerplate_map(boilerplate_object->map());
11662   Handle<DescriptorArray> descriptors(boilerplate_map->instance_descriptors());
11663   int limit = boilerplate_map->NumberOfOwnDescriptors();
11664
11665   int copied_fields = 0;
11666   for (int i = 0; i < limit; i++) {
11667     PropertyDetails details = descriptors->GetDetails(i);
11668     if (details.type() != DATA) continue;
11669     copied_fields++;
11670     FieldIndex field_index = FieldIndex::ForDescriptor(*boilerplate_map, i);
11671
11672
11673     int property_offset = field_index.offset();
11674     Handle<Name> name(descriptors->GetKey(i));
11675
11676     // The access for the store depends on the type of the boilerplate.
11677     HObjectAccess access = boilerplate_object->IsJSArray() ?
11678         HObjectAccess::ForJSArrayOffset(property_offset) :
11679         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11680
11681     if (boilerplate_object->IsUnboxedDoubleField(field_index)) {
11682       CHECK(!boilerplate_object->IsJSArray());
11683       double value = boilerplate_object->RawFastDoublePropertyAt(field_index);
11684       access = access.WithRepresentation(Representation::Double());
11685       Add<HStoreNamedField>(object, access, Add<HConstant>(value));
11686       continue;
11687     }
11688     Handle<Object> value(boilerplate_object->RawFastPropertyAt(field_index),
11689                          isolate());
11690
11691     if (value->IsJSObject()) {
11692       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11693       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11694       HInstruction* result =
11695           BuildFastLiteral(value_object, site_context);
11696       site_context->ExitScope(current_site, value_object);
11697       Add<HStoreNamedField>(object, access, result);
11698     } else {
11699       Representation representation = details.representation();
11700       HInstruction* value_instruction;
11701
11702       if (representation.IsDouble()) {
11703         // Allocate a HeapNumber box and store the value into it.
11704         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
11705         HInstruction* double_box =
11706             Add<HAllocate>(heap_number_constant, HType::HeapObject(),
11707                 pretenure_flag, MUTABLE_HEAP_NUMBER_TYPE);
11708         AddStoreMapConstant(double_box,
11709             isolate()->factory()->mutable_heap_number_map());
11710         // Unwrap the mutable heap number from the boilerplate.
11711         HValue* double_value =
11712             Add<HConstant>(Handle<HeapNumber>::cast(value)->value());
11713         Add<HStoreNamedField>(
11714             double_box, HObjectAccess::ForHeapNumberValue(), double_value);
11715         value_instruction = double_box;
11716       } else if (representation.IsSmi()) {
11717         value_instruction = value->IsUninitialized()
11718             ? graph()->GetConstant0()
11719             : Add<HConstant>(value);
11720         // Ensure that value is stored as smi.
11721         access = access.WithRepresentation(representation);
11722       } else {
11723         value_instruction = Add<HConstant>(value);
11724       }
11725
11726       Add<HStoreNamedField>(object, access, value_instruction);
11727     }
11728   }
11729
11730   int inobject_properties = boilerplate_object->map()->GetInObjectProperties();
11731   HInstruction* value_instruction =
11732       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
11733   for (int i = copied_fields; i < inobject_properties; i++) {
11734     DCHECK(boilerplate_object->IsJSObject());
11735     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
11736     HObjectAccess access =
11737         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11738     Add<HStoreNamedField>(object, access, value_instruction);
11739   }
11740 }
11741
11742
11743 void HOptimizedGraphBuilder::BuildEmitElements(
11744     Handle<JSObject> boilerplate_object,
11745     Handle<FixedArrayBase> elements,
11746     HValue* object_elements,
11747     AllocationSiteUsageContext* site_context) {
11748   ElementsKind kind = boilerplate_object->map()->elements_kind();
11749   int elements_length = elements->length();
11750   HValue* object_elements_length = Add<HConstant>(elements_length);
11751   BuildInitializeElementsHeader(object_elements, kind, object_elements_length);
11752
11753   // Copy elements backing store content.
11754   if (elements->IsFixedDoubleArray()) {
11755     BuildEmitFixedDoubleArray(elements, kind, object_elements);
11756   } else if (elements->IsFixedArray()) {
11757     BuildEmitFixedArray(elements, kind, object_elements,
11758                         site_context);
11759   } else {
11760     UNREACHABLE();
11761   }
11762 }
11763
11764
11765 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
11766     Handle<FixedArrayBase> elements,
11767     ElementsKind kind,
11768     HValue* object_elements) {
11769   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11770   int elements_length = elements->length();
11771   for (int i = 0; i < elements_length; i++) {
11772     HValue* key_constant = Add<HConstant>(i);
11773     HInstruction* value_instruction = Add<HLoadKeyed>(
11774         boilerplate_elements, key_constant, nullptr, kind, ALLOW_RETURN_HOLE);
11775     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
11776                                            value_instruction, kind);
11777     store->SetFlag(HValue::kAllowUndefinedAsNaN);
11778   }
11779 }
11780
11781
11782 void HOptimizedGraphBuilder::BuildEmitFixedArray(
11783     Handle<FixedArrayBase> elements,
11784     ElementsKind kind,
11785     HValue* object_elements,
11786     AllocationSiteUsageContext* site_context) {
11787   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11788   int elements_length = elements->length();
11789   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
11790   for (int i = 0; i < elements_length; i++) {
11791     Handle<Object> value(fast_elements->get(i), isolate());
11792     HValue* key_constant = Add<HConstant>(i);
11793     if (value->IsJSObject()) {
11794       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11795       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11796       HInstruction* result =
11797           BuildFastLiteral(value_object, site_context);
11798       site_context->ExitScope(current_site, value_object);
11799       Add<HStoreKeyed>(object_elements, key_constant, result, kind);
11800     } else {
11801       ElementsKind copy_kind =
11802           kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
11803       HInstruction* value_instruction =
11804           Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr,
11805                           copy_kind, ALLOW_RETURN_HOLE);
11806       Add<HStoreKeyed>(object_elements, key_constant, value_instruction,
11807                        copy_kind);
11808     }
11809   }
11810 }
11811
11812
11813 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
11814   DCHECK(!HasStackOverflow());
11815   DCHECK(current_block() != NULL);
11816   DCHECK(current_block()->HasPredecessor());
11817   HInstruction* instr = BuildThisFunction();
11818   return ast_context()->ReturnInstruction(instr, expr->id());
11819 }
11820
11821
11822 void HOptimizedGraphBuilder::VisitSuperPropertyReference(
11823     SuperPropertyReference* expr) {
11824   DCHECK(!HasStackOverflow());
11825   DCHECK(current_block() != NULL);
11826   DCHECK(current_block()->HasPredecessor());
11827   return Bailout(kSuperReference);
11828 }
11829
11830
11831 void HOptimizedGraphBuilder::VisitSuperCallReference(SuperCallReference* expr) {
11832   DCHECK(!HasStackOverflow());
11833   DCHECK(current_block() != NULL);
11834   DCHECK(current_block()->HasPredecessor());
11835   return Bailout(kSuperReference);
11836 }
11837
11838
11839 void HOptimizedGraphBuilder::VisitDeclarations(
11840     ZoneList<Declaration*>* declarations) {
11841   DCHECK(globals_.is_empty());
11842   AstVisitor::VisitDeclarations(declarations);
11843   if (!globals_.is_empty()) {
11844     Handle<FixedArray> array =
11845        isolate()->factory()->NewFixedArray(globals_.length(), TENURED);
11846     for (int i = 0; i < globals_.length(); ++i) array->set(i, *globals_.at(i));
11847     int flags =
11848         DeclareGlobalsEvalFlag::encode(current_info()->is_eval()) |
11849         DeclareGlobalsNativeFlag::encode(current_info()->is_native()) |
11850         DeclareGlobalsLanguageMode::encode(current_info()->language_mode());
11851     Add<HDeclareGlobals>(array, flags);
11852     globals_.Rewind(0);
11853   }
11854 }
11855
11856
11857 void HOptimizedGraphBuilder::VisitVariableDeclaration(
11858     VariableDeclaration* declaration) {
11859   VariableProxy* proxy = declaration->proxy();
11860   VariableMode mode = declaration->mode();
11861   Variable* variable = proxy->var();
11862   bool hole_init = mode == LET || mode == CONST || mode == CONST_LEGACY;
11863   switch (variable->location()) {
11864     case VariableLocation::GLOBAL:
11865     case VariableLocation::UNALLOCATED:
11866       globals_.Add(variable->name(), zone());
11867       globals_.Add(variable->binding_needs_init()
11868                        ? isolate()->factory()->the_hole_value()
11869                        : isolate()->factory()->undefined_value(), zone());
11870       return;
11871     case VariableLocation::PARAMETER:
11872     case VariableLocation::LOCAL:
11873       if (hole_init) {
11874         HValue* value = graph()->GetConstantHole();
11875         environment()->Bind(variable, value);
11876       }
11877       break;
11878     case VariableLocation::CONTEXT:
11879       if (hole_init) {
11880         HValue* value = graph()->GetConstantHole();
11881         HValue* context = environment()->context();
11882         HStoreContextSlot* store = Add<HStoreContextSlot>(
11883             context, variable->index(), HStoreContextSlot::kNoCheck, value);
11884         if (store->HasObservableSideEffects()) {
11885           Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11886         }
11887       }
11888       break;
11889     case VariableLocation::LOOKUP:
11890       return Bailout(kUnsupportedLookupSlotInDeclaration);
11891   }
11892 }
11893
11894
11895 void HOptimizedGraphBuilder::VisitFunctionDeclaration(
11896     FunctionDeclaration* declaration) {
11897   VariableProxy* proxy = declaration->proxy();
11898   Variable* variable = proxy->var();
11899   switch (variable->location()) {
11900     case VariableLocation::GLOBAL:
11901     case VariableLocation::UNALLOCATED: {
11902       globals_.Add(variable->name(), zone());
11903       Handle<SharedFunctionInfo> function = Compiler::GetSharedFunctionInfo(
11904           declaration->fun(), current_info()->script(), top_info());
11905       // Check for stack-overflow exception.
11906       if (function.is_null()) return SetStackOverflow();
11907       globals_.Add(function, zone());
11908       return;
11909     }
11910     case VariableLocation::PARAMETER:
11911     case VariableLocation::LOCAL: {
11912       CHECK_ALIVE(VisitForValue(declaration->fun()));
11913       HValue* value = Pop();
11914       BindIfLive(variable, value);
11915       break;
11916     }
11917     case VariableLocation::CONTEXT: {
11918       CHECK_ALIVE(VisitForValue(declaration->fun()));
11919       HValue* value = Pop();
11920       HValue* context = environment()->context();
11921       HStoreContextSlot* store = Add<HStoreContextSlot>(
11922           context, variable->index(), HStoreContextSlot::kNoCheck, value);
11923       if (store->HasObservableSideEffects()) {
11924         Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11925       }
11926       break;
11927     }
11928     case VariableLocation::LOOKUP:
11929       return Bailout(kUnsupportedLookupSlotInDeclaration);
11930   }
11931 }
11932
11933
11934 void HOptimizedGraphBuilder::VisitImportDeclaration(
11935     ImportDeclaration* declaration) {
11936   UNREACHABLE();
11937 }
11938
11939
11940 void HOptimizedGraphBuilder::VisitExportDeclaration(
11941     ExportDeclaration* declaration) {
11942   UNREACHABLE();
11943 }
11944
11945
11946 // Generators for inline runtime functions.
11947 // Support for types.
11948 void HOptimizedGraphBuilder::GenerateIsSmi(CallRuntime* call) {
11949   DCHECK(call->arguments()->length() == 1);
11950   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11951   HValue* value = Pop();
11952   HIsSmiAndBranch* result = New<HIsSmiAndBranch>(value);
11953   return ast_context()->ReturnControl(result, call->id());
11954 }
11955
11956
11957 void HOptimizedGraphBuilder::GenerateIsSpecObject(CallRuntime* call) {
11958   DCHECK(call->arguments()->length() == 1);
11959   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11960   HValue* value = Pop();
11961   HHasInstanceTypeAndBranch* result =
11962       New<HHasInstanceTypeAndBranch>(value,
11963                                      FIRST_SPEC_OBJECT_TYPE,
11964                                      LAST_SPEC_OBJECT_TYPE);
11965   return ast_context()->ReturnControl(result, call->id());
11966 }
11967
11968
11969 void HOptimizedGraphBuilder::GenerateIsFunction(CallRuntime* call) {
11970   DCHECK(call->arguments()->length() == 1);
11971   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11972   HValue* value = Pop();
11973   HHasInstanceTypeAndBranch* result =
11974       New<HHasInstanceTypeAndBranch>(value, JS_FUNCTION_TYPE);
11975   return ast_context()->ReturnControl(result, call->id());
11976 }
11977
11978
11979 void HOptimizedGraphBuilder::GenerateIsMinusZero(CallRuntime* call) {
11980   DCHECK(call->arguments()->length() == 1);
11981   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11982   HValue* value = Pop();
11983   HCompareMinusZeroAndBranch* result = New<HCompareMinusZeroAndBranch>(value);
11984   return ast_context()->ReturnControl(result, call->id());
11985 }
11986
11987
11988 void HOptimizedGraphBuilder::GenerateHasCachedArrayIndex(CallRuntime* call) {
11989   DCHECK(call->arguments()->length() == 1);
11990   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11991   HValue* value = Pop();
11992   HHasCachedArrayIndexAndBranch* result =
11993       New<HHasCachedArrayIndexAndBranch>(value);
11994   return ast_context()->ReturnControl(result, call->id());
11995 }
11996
11997
11998 void HOptimizedGraphBuilder::GenerateIsArray(CallRuntime* call) {
11999   DCHECK(call->arguments()->length() == 1);
12000   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12001   HValue* value = Pop();
12002   HHasInstanceTypeAndBranch* result =
12003       New<HHasInstanceTypeAndBranch>(value, JS_ARRAY_TYPE);
12004   return ast_context()->ReturnControl(result, call->id());
12005 }
12006
12007
12008 void HOptimizedGraphBuilder::GenerateIsTypedArray(CallRuntime* call) {
12009   DCHECK(call->arguments()->length() == 1);
12010   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12011   HValue* value = Pop();
12012   HHasInstanceTypeAndBranch* result =
12013       New<HHasInstanceTypeAndBranch>(value, JS_TYPED_ARRAY_TYPE);
12014   return ast_context()->ReturnControl(result, call->id());
12015 }
12016
12017
12018 void HOptimizedGraphBuilder::GenerateIsRegExp(CallRuntime* call) {
12019   DCHECK(call->arguments()->length() == 1);
12020   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12021   HValue* value = Pop();
12022   HHasInstanceTypeAndBranch* result =
12023       New<HHasInstanceTypeAndBranch>(value, JS_REGEXP_TYPE);
12024   return ast_context()->ReturnControl(result, call->id());
12025 }
12026
12027
12028 void HOptimizedGraphBuilder::GenerateIsObject(CallRuntime* call) {
12029   DCHECK(call->arguments()->length() == 1);
12030   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12031   HValue* value = Pop();
12032   HIsObjectAndBranch* result = New<HIsObjectAndBranch>(value);
12033   return ast_context()->ReturnControl(result, call->id());
12034 }
12035
12036
12037 void HOptimizedGraphBuilder::GenerateToObject(CallRuntime* call) {
12038   DCHECK_EQ(1, call->arguments()->length());
12039   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12040   HValue* value = Pop();
12041   HValue* result = BuildToObject(value);
12042   return ast_context()->ReturnValue(result);
12043 }
12044
12045
12046 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
12047   DCHECK(call->arguments()->length() == 1);
12048   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12049   HValue* value = Pop();
12050   HIfContinuation continuation;
12051   IfBuilder if_proxy(this);
12052
12053   HValue* smicheck = if_proxy.IfNot<HIsSmiAndBranch>(value);
12054   if_proxy.And();
12055   HValue* map = Add<HLoadNamedField>(value, smicheck, HObjectAccess::ForMap());
12056   HValue* instance_type =
12057       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
12058   if_proxy.If<HCompareNumericAndBranch>(
12059       instance_type, Add<HConstant>(FIRST_JS_PROXY_TYPE), Token::GTE);
12060   if_proxy.And();
12061   if_proxy.If<HCompareNumericAndBranch>(
12062       instance_type, Add<HConstant>(LAST_JS_PROXY_TYPE), Token::LTE);
12063
12064   if_proxy.CaptureContinuation(&continuation);
12065   return ast_context()->ReturnContinuation(&continuation, call->id());
12066 }
12067
12068
12069 void HOptimizedGraphBuilder::GenerateHasFastPackedElements(CallRuntime* call) {
12070   DCHECK(call->arguments()->length() == 1);
12071   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12072   HValue* object = Pop();
12073   HIfContinuation continuation(graph()->CreateBasicBlock(),
12074                                graph()->CreateBasicBlock());
12075   IfBuilder if_not_smi(this);
12076   if_not_smi.IfNot<HIsSmiAndBranch>(object);
12077   if_not_smi.Then();
12078   {
12079     NoObservableSideEffectsScope no_effects(this);
12080
12081     IfBuilder if_fast_packed(this);
12082     HValue* elements_kind = BuildGetElementsKind(object);
12083     if_fast_packed.If<HCompareNumericAndBranch>(
12084         elements_kind, Add<HConstant>(FAST_SMI_ELEMENTS), Token::EQ);
12085     if_fast_packed.Or();
12086     if_fast_packed.If<HCompareNumericAndBranch>(
12087         elements_kind, Add<HConstant>(FAST_ELEMENTS), Token::EQ);
12088     if_fast_packed.Or();
12089     if_fast_packed.If<HCompareNumericAndBranch>(
12090         elements_kind, Add<HConstant>(FAST_DOUBLE_ELEMENTS), Token::EQ);
12091     if_fast_packed.JoinContinuation(&continuation);
12092   }
12093   if_not_smi.JoinContinuation(&continuation);
12094   return ast_context()->ReturnContinuation(&continuation, call->id());
12095 }
12096
12097
12098 void HOptimizedGraphBuilder::GenerateIsUndetectableObject(CallRuntime* call) {
12099   DCHECK(call->arguments()->length() == 1);
12100   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12101   HValue* value = Pop();
12102   HIsUndetectableAndBranch* result = New<HIsUndetectableAndBranch>(value);
12103   return ast_context()->ReturnControl(result, call->id());
12104 }
12105
12106
12107 // Support for construct call checks.
12108 void HOptimizedGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
12109   DCHECK(call->arguments()->length() == 0);
12110   if (function_state()->outer() != NULL) {
12111     // We are generating graph for inlined function.
12112     HValue* value = function_state()->inlining_kind() == CONSTRUCT_CALL_RETURN
12113         ? graph()->GetConstantTrue()
12114         : graph()->GetConstantFalse();
12115     return ast_context()->ReturnValue(value);
12116   } else {
12117     return ast_context()->ReturnControl(New<HIsConstructCallAndBranch>(),
12118                                         call->id());
12119   }
12120 }
12121
12122
12123 // Support for arguments.length and arguments[?].
12124 void HOptimizedGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
12125   DCHECK(call->arguments()->length() == 0);
12126   HInstruction* result = NULL;
12127   if (function_state()->outer() == NULL) {
12128     HInstruction* elements = Add<HArgumentsElements>(false);
12129     result = New<HArgumentsLength>(elements);
12130   } else {
12131     // Number of arguments without receiver.
12132     int argument_count = environment()->
12133         arguments_environment()->parameter_count() - 1;
12134     result = New<HConstant>(argument_count);
12135   }
12136   return ast_context()->ReturnInstruction(result, call->id());
12137 }
12138
12139
12140 void HOptimizedGraphBuilder::GenerateArguments(CallRuntime* call) {
12141   DCHECK(call->arguments()->length() == 1);
12142   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12143   HValue* index = Pop();
12144   HInstruction* result = NULL;
12145   if (function_state()->outer() == NULL) {
12146     HInstruction* elements = Add<HArgumentsElements>(false);
12147     HInstruction* length = Add<HArgumentsLength>(elements);
12148     HInstruction* checked_index = Add<HBoundsCheck>(index, length);
12149     result = New<HAccessArgumentsAt>(elements, length, checked_index);
12150   } else {
12151     EnsureArgumentsArePushedForAccess();
12152
12153     // Number of arguments without receiver.
12154     HInstruction* elements = function_state()->arguments_elements();
12155     int argument_count = environment()->
12156         arguments_environment()->parameter_count() - 1;
12157     HInstruction* length = Add<HConstant>(argument_count);
12158     HInstruction* checked_key = Add<HBoundsCheck>(index, length);
12159     result = New<HAccessArgumentsAt>(elements, length, checked_key);
12160   }
12161   return ast_context()->ReturnInstruction(result, call->id());
12162 }
12163
12164
12165 void HOptimizedGraphBuilder::GenerateValueOf(CallRuntime* call) {
12166   DCHECK(call->arguments()->length() == 1);
12167   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12168   HValue* object = Pop();
12169
12170   IfBuilder if_objectisvalue(this);
12171   HValue* objectisvalue = if_objectisvalue.If<HHasInstanceTypeAndBranch>(
12172       object, JS_VALUE_TYPE);
12173   if_objectisvalue.Then();
12174   {
12175     // Return the actual value.
12176     Push(Add<HLoadNamedField>(
12177             object, objectisvalue,
12178             HObjectAccess::ForObservableJSObjectOffset(
12179                 JSValue::kValueOffset)));
12180     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12181   }
12182   if_objectisvalue.Else();
12183   {
12184     // If the object is not a value return the object.
12185     Push(object);
12186     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12187   }
12188   if_objectisvalue.End();
12189   return ast_context()->ReturnValue(Pop());
12190 }
12191
12192
12193 void HOptimizedGraphBuilder::GenerateJSValueGetValue(CallRuntime* call) {
12194   DCHECK(call->arguments()->length() == 1);
12195   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12196   HValue* value = Pop();
12197   HInstruction* result = Add<HLoadNamedField>(
12198       value, nullptr,
12199       HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset));
12200   return ast_context()->ReturnInstruction(result, call->id());
12201 }
12202
12203
12204 void HOptimizedGraphBuilder::GenerateIsDate(CallRuntime* call) {
12205   DCHECK_EQ(1, call->arguments()->length());
12206   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12207   HValue* value = Pop();
12208   HHasInstanceTypeAndBranch* result =
12209       New<HHasInstanceTypeAndBranch>(value, JS_DATE_TYPE);
12210   return ast_context()->ReturnControl(result, call->id());
12211 }
12212
12213
12214 void HOptimizedGraphBuilder::GenerateThrowNotDateError(CallRuntime* call) {
12215   DCHECK_EQ(0, call->arguments()->length());
12216   Add<HDeoptimize>(Deoptimizer::kNotADateObject, Deoptimizer::EAGER);
12217   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12218   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12219 }
12220
12221
12222 void HOptimizedGraphBuilder::GenerateDateField(CallRuntime* call) {
12223   DCHECK(call->arguments()->length() == 2);
12224   DCHECK_NOT_NULL(call->arguments()->at(1)->AsLiteral());
12225   Smi* index = Smi::cast(*(call->arguments()->at(1)->AsLiteral()->value()));
12226   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12227   HValue* date = Pop();
12228   HDateField* result = New<HDateField>(date, index);
12229   return ast_context()->ReturnInstruction(result, call->id());
12230 }
12231
12232
12233 void HOptimizedGraphBuilder::GenerateOneByteSeqStringSetChar(
12234     CallRuntime* call) {
12235   DCHECK(call->arguments()->length() == 3);
12236   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12237   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12238   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12239   HValue* string = Pop();
12240   HValue* value = Pop();
12241   HValue* index = Pop();
12242   Add<HSeqStringSetChar>(String::ONE_BYTE_ENCODING, string,
12243                          index, value);
12244   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12245   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12246 }
12247
12248
12249 void HOptimizedGraphBuilder::GenerateTwoByteSeqStringSetChar(
12250     CallRuntime* call) {
12251   DCHECK(call->arguments()->length() == 3);
12252   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12253   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12254   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12255   HValue* string = Pop();
12256   HValue* value = Pop();
12257   HValue* index = Pop();
12258   Add<HSeqStringSetChar>(String::TWO_BYTE_ENCODING, string,
12259                          index, value);
12260   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12261   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12262 }
12263
12264
12265 void HOptimizedGraphBuilder::GenerateSetValueOf(CallRuntime* call) {
12266   DCHECK(call->arguments()->length() == 2);
12267   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12268   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12269   HValue* value = Pop();
12270   HValue* object = Pop();
12271
12272   // Check if object is a JSValue.
12273   IfBuilder if_objectisvalue(this);
12274   if_objectisvalue.If<HHasInstanceTypeAndBranch>(object, JS_VALUE_TYPE);
12275   if_objectisvalue.Then();
12276   {
12277     // Create in-object property store to kValueOffset.
12278     Add<HStoreNamedField>(object,
12279         HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset),
12280         value);
12281     if (!ast_context()->IsEffect()) {
12282       Push(value);
12283     }
12284     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12285   }
12286   if_objectisvalue.Else();
12287   {
12288     // Nothing to do in this case.
12289     if (!ast_context()->IsEffect()) {
12290       Push(value);
12291     }
12292     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12293   }
12294   if_objectisvalue.End();
12295   if (!ast_context()->IsEffect()) {
12296     Drop(1);
12297   }
12298   return ast_context()->ReturnValue(value);
12299 }
12300
12301
12302 // Fast support for charCodeAt(n).
12303 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
12304   DCHECK(call->arguments()->length() == 2);
12305   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12306   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12307   HValue* index = Pop();
12308   HValue* string = Pop();
12309   HInstruction* result = BuildStringCharCodeAt(string, index);
12310   return ast_context()->ReturnInstruction(result, call->id());
12311 }
12312
12313
12314 // Fast support for string.charAt(n) and string[n].
12315 void HOptimizedGraphBuilder::GenerateStringCharFromCode(CallRuntime* call) {
12316   DCHECK(call->arguments()->length() == 1);
12317   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12318   HValue* char_code = Pop();
12319   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12320   return ast_context()->ReturnInstruction(result, call->id());
12321 }
12322
12323
12324 // Fast support for string.charAt(n) and string[n].
12325 void HOptimizedGraphBuilder::GenerateStringCharAt(CallRuntime* call) {
12326   DCHECK(call->arguments()->length() == 2);
12327   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12328   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12329   HValue* index = Pop();
12330   HValue* string = Pop();
12331   HInstruction* char_code = BuildStringCharCodeAt(string, index);
12332   AddInstruction(char_code);
12333   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12334   return ast_context()->ReturnInstruction(result, call->id());
12335 }
12336
12337
12338 // Fast support for object equality testing.
12339 void HOptimizedGraphBuilder::GenerateObjectEquals(CallRuntime* call) {
12340   DCHECK(call->arguments()->length() == 2);
12341   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12342   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12343   HValue* right = Pop();
12344   HValue* left = Pop();
12345   HCompareObjectEqAndBranch* result =
12346       New<HCompareObjectEqAndBranch>(left, right);
12347   return ast_context()->ReturnControl(result, call->id());
12348 }
12349
12350
12351 // Fast support for StringAdd.
12352 void HOptimizedGraphBuilder::GenerateStringAdd(CallRuntime* call) {
12353   DCHECK_EQ(2, call->arguments()->length());
12354   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12355   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12356   HValue* right = Pop();
12357   HValue* left = Pop();
12358   HInstruction* result =
12359       NewUncasted<HStringAdd>(left, right, strength(function_language_mode()));
12360   return ast_context()->ReturnInstruction(result, call->id());
12361 }
12362
12363
12364 // Fast support for SubString.
12365 void HOptimizedGraphBuilder::GenerateSubString(CallRuntime* call) {
12366   DCHECK_EQ(3, call->arguments()->length());
12367   CHECK_ALIVE(VisitExpressions(call->arguments()));
12368   PushArgumentsFromEnvironment(call->arguments()->length());
12369   HCallStub* result = New<HCallStub>(CodeStub::SubString, 3);
12370   return ast_context()->ReturnInstruction(result, call->id());
12371 }
12372
12373
12374 // Fast support for StringCompare.
12375 void HOptimizedGraphBuilder::GenerateStringCompare(CallRuntime* call) {
12376   DCHECK_EQ(2, call->arguments()->length());
12377   CHECK_ALIVE(VisitExpressions(call->arguments()));
12378   PushArgumentsFromEnvironment(call->arguments()->length());
12379   HCallStub* result = New<HCallStub>(CodeStub::StringCompare, 2);
12380   return ast_context()->ReturnInstruction(result, call->id());
12381 }
12382
12383
12384 void HOptimizedGraphBuilder::GenerateStringGetLength(CallRuntime* call) {
12385   DCHECK(call->arguments()->length() == 1);
12386   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12387   HValue* string = Pop();
12388   HInstruction* result = BuildLoadStringLength(string);
12389   return ast_context()->ReturnInstruction(result, call->id());
12390 }
12391
12392
12393 // Support for direct calls from JavaScript to native RegExp code.
12394 void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
12395   DCHECK_EQ(4, call->arguments()->length());
12396   CHECK_ALIVE(VisitExpressions(call->arguments()));
12397   PushArgumentsFromEnvironment(call->arguments()->length());
12398   HCallStub* result = New<HCallStub>(CodeStub::RegExpExec, 4);
12399   return ast_context()->ReturnInstruction(result, call->id());
12400 }
12401
12402
12403 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
12404   DCHECK_EQ(1, call->arguments()->length());
12405   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12406   HValue* value = Pop();
12407   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::LOW);
12408   return ast_context()->ReturnInstruction(result, call->id());
12409 }
12410
12411
12412 void HOptimizedGraphBuilder::GenerateDoubleHi(CallRuntime* call) {
12413   DCHECK_EQ(1, call->arguments()->length());
12414   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12415   HValue* value = Pop();
12416   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::HIGH);
12417   return ast_context()->ReturnInstruction(result, call->id());
12418 }
12419
12420
12421 void HOptimizedGraphBuilder::GenerateConstructDouble(CallRuntime* call) {
12422   DCHECK_EQ(2, call->arguments()->length());
12423   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12424   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12425   HValue* lo = Pop();
12426   HValue* hi = Pop();
12427   HInstruction* result = NewUncasted<HConstructDouble>(hi, lo);
12428   return ast_context()->ReturnInstruction(result, call->id());
12429 }
12430
12431
12432 // Construct a RegExp exec result with two in-object properties.
12433 void HOptimizedGraphBuilder::GenerateRegExpConstructResult(CallRuntime* call) {
12434   DCHECK_EQ(3, call->arguments()->length());
12435   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12436   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12437   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12438   HValue* input = Pop();
12439   HValue* index = Pop();
12440   HValue* length = Pop();
12441   HValue* result = BuildRegExpConstructResult(length, index, input);
12442   return ast_context()->ReturnValue(result);
12443 }
12444
12445
12446 // Fast support for number to string.
12447 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
12448   DCHECK_EQ(1, call->arguments()->length());
12449   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12450   HValue* number = Pop();
12451   HValue* result = BuildNumberToString(number, Type::Any(zone()));
12452   return ast_context()->ReturnValue(result);
12453 }
12454
12455
12456 // Fast call for custom callbacks.
12457 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
12458   // 1 ~ The function to call is not itself an argument to the call.
12459   int arg_count = call->arguments()->length() - 1;
12460   DCHECK(arg_count >= 1);  // There's always at least a receiver.
12461
12462   CHECK_ALIVE(VisitExpressions(call->arguments()));
12463   // The function is the last argument
12464   HValue* function = Pop();
12465   // Push the arguments to the stack
12466   PushArgumentsFromEnvironment(arg_count);
12467
12468   IfBuilder if_is_jsfunction(this);
12469   if_is_jsfunction.If<HHasInstanceTypeAndBranch>(function, JS_FUNCTION_TYPE);
12470
12471   if_is_jsfunction.Then();
12472   {
12473     HInstruction* invoke_result =
12474         Add<HInvokeFunction>(function, arg_count);
12475     if (!ast_context()->IsEffect()) {
12476       Push(invoke_result);
12477     }
12478     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12479   }
12480
12481   if_is_jsfunction.Else();
12482   {
12483     HInstruction* call_result =
12484         Add<HCallFunction>(function, arg_count);
12485     if (!ast_context()->IsEffect()) {
12486       Push(call_result);
12487     }
12488     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12489   }
12490   if_is_jsfunction.End();
12491
12492   if (ast_context()->IsEffect()) {
12493     // EffectContext::ReturnValue ignores the value, so we can just pass
12494     // 'undefined' (as we do not have the call result anymore).
12495     return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12496   } else {
12497     return ast_context()->ReturnValue(Pop());
12498   }
12499 }
12500
12501
12502 // Fast call to math functions.
12503 void HOptimizedGraphBuilder::GenerateMathPow(CallRuntime* call) {
12504   DCHECK_EQ(2, call->arguments()->length());
12505   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12506   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12507   HValue* right = Pop();
12508   HValue* left = Pop();
12509   HInstruction* result = NewUncasted<HPower>(left, right);
12510   return ast_context()->ReturnInstruction(result, call->id());
12511 }
12512
12513
12514 void HOptimizedGraphBuilder::GenerateMathClz32(CallRuntime* call) {
12515   DCHECK(call->arguments()->length() == 1);
12516   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12517   HValue* value = Pop();
12518   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathClz32);
12519   return ast_context()->ReturnInstruction(result, call->id());
12520 }
12521
12522
12523 void HOptimizedGraphBuilder::GenerateMathFloor(CallRuntime* call) {
12524   DCHECK(call->arguments()->length() == 1);
12525   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12526   HValue* value = Pop();
12527   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathFloor);
12528   return ast_context()->ReturnInstruction(result, call->id());
12529 }
12530
12531
12532 void HOptimizedGraphBuilder::GenerateMathLogRT(CallRuntime* call) {
12533   DCHECK(call->arguments()->length() == 1);
12534   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12535   HValue* value = Pop();
12536   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathLog);
12537   return ast_context()->ReturnInstruction(result, call->id());
12538 }
12539
12540
12541 void HOptimizedGraphBuilder::GenerateMathSqrt(CallRuntime* call) {
12542   DCHECK(call->arguments()->length() == 1);
12543   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12544   HValue* value = Pop();
12545   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathSqrt);
12546   return ast_context()->ReturnInstruction(result, call->id());
12547 }
12548
12549
12550 void HOptimizedGraphBuilder::GenerateLikely(CallRuntime* call) {
12551   DCHECK(call->arguments()->length() == 1);
12552   Visit(call->arguments()->at(0));
12553 }
12554
12555
12556 void HOptimizedGraphBuilder::GenerateUnlikely(CallRuntime* call) {
12557   return GenerateLikely(call);
12558 }
12559
12560
12561 void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
12562   DCHECK(call->arguments()->length() == 2);
12563   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12564   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12565   HValue* index = Pop();
12566   HValue* object = Pop();
12567   HInstruction* result = New<HLoadKeyed>(
12568       object, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
12569   return ast_context()->ReturnInstruction(result, call->id());
12570 }
12571
12572
12573 void HOptimizedGraphBuilder::GenerateFixedArraySet(CallRuntime* call) {
12574   DCHECK(call->arguments()->length() == 3);
12575   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12576   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12577   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12578   HValue* value = Pop();
12579   HValue* index = Pop();
12580   HValue* object = Pop();
12581   NoObservableSideEffectsScope no_effects(this);
12582   Add<HStoreKeyed>(object, index, value, FAST_HOLEY_ELEMENTS);
12583   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12584 }
12585
12586
12587 void HOptimizedGraphBuilder::GenerateTheHole(CallRuntime* call) {
12588   DCHECK(call->arguments()->length() == 0);
12589   return ast_context()->ReturnValue(graph()->GetConstantHole());
12590 }
12591
12592
12593 void HOptimizedGraphBuilder::GenerateJSCollectionGetTable(CallRuntime* call) {
12594   DCHECK(call->arguments()->length() == 1);
12595   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12596   HValue* receiver = Pop();
12597   HInstruction* result = New<HLoadNamedField>(
12598       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12599   return ast_context()->ReturnInstruction(result, call->id());
12600 }
12601
12602
12603 void HOptimizedGraphBuilder::GenerateStringGetRawHashField(CallRuntime* call) {
12604   DCHECK(call->arguments()->length() == 1);
12605   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12606   HValue* object = Pop();
12607   HInstruction* result = New<HLoadNamedField>(
12608       object, nullptr, HObjectAccess::ForStringHashField());
12609   return ast_context()->ReturnInstruction(result, call->id());
12610 }
12611
12612
12613 template <typename CollectionType>
12614 HValue* HOptimizedGraphBuilder::BuildAllocateOrderedHashTable() {
12615   static const int kCapacity = CollectionType::kMinCapacity;
12616   static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
12617   static const int kFixedArrayLength = CollectionType::kHashTableStartIndex +
12618                                        kBucketCount +
12619                                        (kCapacity * CollectionType::kEntrySize);
12620   static const int kSizeInBytes =
12621       FixedArray::kHeaderSize + (kFixedArrayLength * kPointerSize);
12622
12623   // Allocate the table and add the proper map.
12624   HValue* table =
12625       Add<HAllocate>(Add<HConstant>(kSizeInBytes), HType::HeapObject(),
12626                      NOT_TENURED, FIXED_ARRAY_TYPE);
12627   AddStoreMapConstant(table, isolate()->factory()->ordered_hash_table_map());
12628
12629   // Initialize the FixedArray...
12630   HValue* length = Add<HConstant>(kFixedArrayLength);
12631   Add<HStoreNamedField>(table, HObjectAccess::ForFixedArrayLength(), length);
12632
12633   // ...and the OrderedHashTable fields.
12634   Add<HStoreNamedField>(
12635       table,
12636       HObjectAccess::ForOrderedHashTableNumberOfBuckets<CollectionType>(),
12637       Add<HConstant>(kBucketCount));
12638   Add<HStoreNamedField>(
12639       table,
12640       HObjectAccess::ForOrderedHashTableNumberOfElements<CollectionType>(),
12641       graph()->GetConstant0());
12642   Add<HStoreNamedField>(
12643       table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12644                  CollectionType>(),
12645       graph()->GetConstant0());
12646
12647   // Fill the buckets with kNotFound.
12648   HValue* not_found = Add<HConstant>(CollectionType::kNotFound);
12649   for (int i = 0; i < kBucketCount; ++i) {
12650     Add<HStoreNamedField>(
12651         table, HObjectAccess::ForOrderedHashTableBucket<CollectionType>(i),
12652         not_found);
12653   }
12654
12655   // Fill the data table with undefined.
12656   HValue* undefined = graph()->GetConstantUndefined();
12657   for (int i = 0; i < (kCapacity * CollectionType::kEntrySize); ++i) {
12658     Add<HStoreNamedField>(table,
12659                           HObjectAccess::ForOrderedHashTableDataTableIndex<
12660                               CollectionType, kBucketCount>(i),
12661                           undefined);
12662   }
12663
12664   return table;
12665 }
12666
12667
12668 void HOptimizedGraphBuilder::GenerateSetInitialize(CallRuntime* call) {
12669   DCHECK(call->arguments()->length() == 1);
12670   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12671   HValue* receiver = Pop();
12672
12673   NoObservableSideEffectsScope no_effects(this);
12674   HValue* table = BuildAllocateOrderedHashTable<OrderedHashSet>();
12675   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12676   return ast_context()->ReturnValue(receiver);
12677 }
12678
12679
12680 void HOptimizedGraphBuilder::GenerateMapInitialize(CallRuntime* call) {
12681   DCHECK(call->arguments()->length() == 1);
12682   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12683   HValue* receiver = Pop();
12684
12685   NoObservableSideEffectsScope no_effects(this);
12686   HValue* table = BuildAllocateOrderedHashTable<OrderedHashMap>();
12687   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12688   return ast_context()->ReturnValue(receiver);
12689 }
12690
12691
12692 template <typename CollectionType>
12693 void HOptimizedGraphBuilder::BuildOrderedHashTableClear(HValue* receiver) {
12694   HValue* old_table = Add<HLoadNamedField>(
12695       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12696   HValue* new_table = BuildAllocateOrderedHashTable<CollectionType>();
12697   Add<HStoreNamedField>(
12698       old_table, HObjectAccess::ForOrderedHashTableNextTable<CollectionType>(),
12699       new_table);
12700   Add<HStoreNamedField>(
12701       old_table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12702                      CollectionType>(),
12703       Add<HConstant>(CollectionType::kClearedTableSentinel));
12704   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(),
12705                         new_table);
12706 }
12707
12708
12709 void HOptimizedGraphBuilder::GenerateSetClear(CallRuntime* call) {
12710   DCHECK(call->arguments()->length() == 1);
12711   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12712   HValue* receiver = Pop();
12713
12714   NoObservableSideEffectsScope no_effects(this);
12715   BuildOrderedHashTableClear<OrderedHashSet>(receiver);
12716   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12717 }
12718
12719
12720 void HOptimizedGraphBuilder::GenerateMapClear(CallRuntime* call) {
12721   DCHECK(call->arguments()->length() == 1);
12722   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12723   HValue* receiver = Pop();
12724
12725   NoObservableSideEffectsScope no_effects(this);
12726   BuildOrderedHashTableClear<OrderedHashMap>(receiver);
12727   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12728 }
12729
12730
12731 void HOptimizedGraphBuilder::GenerateGetCachedArrayIndex(CallRuntime* call) {
12732   DCHECK(call->arguments()->length() == 1);
12733   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12734   HValue* value = Pop();
12735   HGetCachedArrayIndex* result = New<HGetCachedArrayIndex>(value);
12736   return ast_context()->ReturnInstruction(result, call->id());
12737 }
12738
12739
12740 void HOptimizedGraphBuilder::GenerateFastOneByteArrayJoin(CallRuntime* call) {
12741   // Simply returning undefined here would be semantically correct and even
12742   // avoid the bailout. Nevertheless, some ancient benchmarks like SunSpider's
12743   // string-fasta would tank, because fullcode contains an optimized version.
12744   // Obviously the fullcode => Crankshaft => bailout => fullcode dance is
12745   // faster... *sigh*
12746   return Bailout(kInlinedRuntimeFunctionFastOneByteArrayJoin);
12747 }
12748
12749
12750 void HOptimizedGraphBuilder::GenerateDebugBreakInOptimizedCode(
12751     CallRuntime* call) {
12752   Add<HDebugBreak>();
12753   return ast_context()->ReturnValue(graph()->GetConstant0());
12754 }
12755
12756
12757 void HOptimizedGraphBuilder::GenerateDebugIsActive(CallRuntime* call) {
12758   DCHECK(call->arguments()->length() == 0);
12759   HValue* ref =
12760       Add<HConstant>(ExternalReference::debug_is_active_address(isolate()));
12761   HValue* value =
12762       Add<HLoadNamedField>(ref, nullptr, HObjectAccess::ForExternalUInteger8());
12763   return ast_context()->ReturnValue(value);
12764 }
12765
12766
12767 void HOptimizedGraphBuilder::GenerateGetPrototype(CallRuntime* call) {
12768   DCHECK(call->arguments()->length() == 1);
12769   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12770   HValue* object = Pop();
12771
12772   NoObservableSideEffectsScope no_effects(this);
12773
12774   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
12775   HValue* bit_field =
12776       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField());
12777   HValue* is_access_check_needed_mask =
12778       Add<HConstant>(1 << Map::kIsAccessCheckNeeded);
12779   HValue* is_access_check_needed_test = AddUncasted<HBitwise>(
12780       Token::BIT_AND, bit_field, is_access_check_needed_mask);
12781
12782   HValue* proto =
12783       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForPrototype());
12784   HValue* proto_map =
12785       Add<HLoadNamedField>(proto, nullptr, HObjectAccess::ForMap());
12786   HValue* proto_bit_field =
12787       Add<HLoadNamedField>(proto_map, nullptr, HObjectAccess::ForMapBitField());
12788   HValue* is_hidden_prototype_mask =
12789       Add<HConstant>(1 << Map::kIsHiddenPrototype);
12790   HValue* is_hidden_prototype_test = AddUncasted<HBitwise>(
12791       Token::BIT_AND, proto_bit_field, is_hidden_prototype_mask);
12792
12793   {
12794     IfBuilder needs_runtime(this);
12795     needs_runtime.If<HCompareNumericAndBranch>(
12796         is_access_check_needed_test, graph()->GetConstant0(), Token::NE);
12797     needs_runtime.OrIf<HCompareNumericAndBranch>(
12798         is_hidden_prototype_test, graph()->GetConstant0(), Token::NE);
12799
12800     needs_runtime.Then();
12801     {
12802       Add<HPushArguments>(object);
12803       Push(Add<HCallRuntime>(
12804           call->name(), Runtime::FunctionForId(Runtime::kGetPrototype), 1));
12805     }
12806
12807     needs_runtime.Else();
12808     Push(proto);
12809   }
12810   return ast_context()->ReturnValue(Pop());
12811 }
12812
12813
12814 #undef CHECK_BAILOUT
12815 #undef CHECK_ALIVE
12816
12817
12818 HEnvironment::HEnvironment(HEnvironment* outer,
12819                            Scope* scope,
12820                            Handle<JSFunction> closure,
12821                            Zone* zone)
12822     : closure_(closure),
12823       values_(0, zone),
12824       frame_type_(JS_FUNCTION),
12825       parameter_count_(0),
12826       specials_count_(1),
12827       local_count_(0),
12828       outer_(outer),
12829       entry_(NULL),
12830       pop_count_(0),
12831       push_count_(0),
12832       ast_id_(BailoutId::None()),
12833       zone_(zone) {
12834   Scope* declaration_scope = scope->DeclarationScope();
12835   Initialize(declaration_scope->num_parameters() + 1,
12836              declaration_scope->num_stack_slots(), 0);
12837 }
12838
12839
12840 HEnvironment::HEnvironment(Zone* zone, int parameter_count)
12841     : values_(0, zone),
12842       frame_type_(STUB),
12843       parameter_count_(parameter_count),
12844       specials_count_(1),
12845       local_count_(0),
12846       outer_(NULL),
12847       entry_(NULL),
12848       pop_count_(0),
12849       push_count_(0),
12850       ast_id_(BailoutId::None()),
12851       zone_(zone) {
12852   Initialize(parameter_count, 0, 0);
12853 }
12854
12855
12856 HEnvironment::HEnvironment(const HEnvironment* other, Zone* zone)
12857     : values_(0, zone),
12858       frame_type_(JS_FUNCTION),
12859       parameter_count_(0),
12860       specials_count_(0),
12861       local_count_(0),
12862       outer_(NULL),
12863       entry_(NULL),
12864       pop_count_(0),
12865       push_count_(0),
12866       ast_id_(other->ast_id()),
12867       zone_(zone) {
12868   Initialize(other);
12869 }
12870
12871
12872 HEnvironment::HEnvironment(HEnvironment* outer,
12873                            Handle<JSFunction> closure,
12874                            FrameType frame_type,
12875                            int arguments,
12876                            Zone* zone)
12877     : closure_(closure),
12878       values_(arguments, zone),
12879       frame_type_(frame_type),
12880       parameter_count_(arguments),
12881       specials_count_(0),
12882       local_count_(0),
12883       outer_(outer),
12884       entry_(NULL),
12885       pop_count_(0),
12886       push_count_(0),
12887       ast_id_(BailoutId::None()),
12888       zone_(zone) {
12889 }
12890
12891
12892 void HEnvironment::Initialize(int parameter_count,
12893                               int local_count,
12894                               int stack_height) {
12895   parameter_count_ = parameter_count;
12896   local_count_ = local_count;
12897
12898   // Avoid reallocating the temporaries' backing store on the first Push.
12899   int total = parameter_count + specials_count_ + local_count + stack_height;
12900   values_.Initialize(total + 4, zone());
12901   for (int i = 0; i < total; ++i) values_.Add(NULL, zone());
12902 }
12903
12904
12905 void HEnvironment::Initialize(const HEnvironment* other) {
12906   closure_ = other->closure();
12907   values_.AddAll(other->values_, zone());
12908   assigned_variables_.Union(other->assigned_variables_, zone());
12909   frame_type_ = other->frame_type_;
12910   parameter_count_ = other->parameter_count_;
12911   local_count_ = other->local_count_;
12912   if (other->outer_ != NULL) outer_ = other->outer_->Copy();  // Deep copy.
12913   entry_ = other->entry_;
12914   pop_count_ = other->pop_count_;
12915   push_count_ = other->push_count_;
12916   specials_count_ = other->specials_count_;
12917   ast_id_ = other->ast_id_;
12918 }
12919
12920
12921 void HEnvironment::AddIncomingEdge(HBasicBlock* block, HEnvironment* other) {
12922   DCHECK(!block->IsLoopHeader());
12923   DCHECK(values_.length() == other->values_.length());
12924
12925   int length = values_.length();
12926   for (int i = 0; i < length; ++i) {
12927     HValue* value = values_[i];
12928     if (value != NULL && value->IsPhi() && value->block() == block) {
12929       // There is already a phi for the i'th value.
12930       HPhi* phi = HPhi::cast(value);
12931       // Assert index is correct and that we haven't missed an incoming edge.
12932       DCHECK(phi->merged_index() == i || !phi->HasMergedIndex());
12933       DCHECK(phi->OperandCount() == block->predecessors()->length());
12934       phi->AddInput(other->values_[i]);
12935     } else if (values_[i] != other->values_[i]) {
12936       // There is a fresh value on the incoming edge, a phi is needed.
12937       DCHECK(values_[i] != NULL && other->values_[i] != NULL);
12938       HPhi* phi = block->AddNewPhi(i);
12939       HValue* old_value = values_[i];
12940       for (int j = 0; j < block->predecessors()->length(); j++) {
12941         phi->AddInput(old_value);
12942       }
12943       phi->AddInput(other->values_[i]);
12944       this->values_[i] = phi;
12945     }
12946   }
12947 }
12948
12949
12950 void HEnvironment::Bind(int index, HValue* value) {
12951   DCHECK(value != NULL);
12952   assigned_variables_.Add(index, zone());
12953   values_[index] = value;
12954 }
12955
12956
12957 bool HEnvironment::HasExpressionAt(int index) const {
12958   return index >= parameter_count_ + specials_count_ + local_count_;
12959 }
12960
12961
12962 bool HEnvironment::ExpressionStackIsEmpty() const {
12963   DCHECK(length() >= first_expression_index());
12964   return length() == first_expression_index();
12965 }
12966
12967
12968 void HEnvironment::SetExpressionStackAt(int index_from_top, HValue* value) {
12969   int count = index_from_top + 1;
12970   int index = values_.length() - count;
12971   DCHECK(HasExpressionAt(index));
12972   // The push count must include at least the element in question or else
12973   // the new value will not be included in this environment's history.
12974   if (push_count_ < count) {
12975     // This is the same effect as popping then re-pushing 'count' elements.
12976     pop_count_ += (count - push_count_);
12977     push_count_ = count;
12978   }
12979   values_[index] = value;
12980 }
12981
12982
12983 HValue* HEnvironment::RemoveExpressionStackAt(int index_from_top) {
12984   int count = index_from_top + 1;
12985   int index = values_.length() - count;
12986   DCHECK(HasExpressionAt(index));
12987   // Simulate popping 'count' elements and then
12988   // pushing 'count - 1' elements back.
12989   pop_count_ += Max(count - push_count_, 0);
12990   push_count_ = Max(push_count_ - count, 0) + (count - 1);
12991   return values_.Remove(index);
12992 }
12993
12994
12995 void HEnvironment::Drop(int count) {
12996   for (int i = 0; i < count; ++i) {
12997     Pop();
12998   }
12999 }
13000
13001
13002 HEnvironment* HEnvironment::Copy() const {
13003   return new(zone()) HEnvironment(this, zone());
13004 }
13005
13006
13007 HEnvironment* HEnvironment::CopyWithoutHistory() const {
13008   HEnvironment* result = Copy();
13009   result->ClearHistory();
13010   return result;
13011 }
13012
13013
13014 HEnvironment* HEnvironment::CopyAsLoopHeader(HBasicBlock* loop_header) const {
13015   HEnvironment* new_env = Copy();
13016   for (int i = 0; i < values_.length(); ++i) {
13017     HPhi* phi = loop_header->AddNewPhi(i);
13018     phi->AddInput(values_[i]);
13019     new_env->values_[i] = phi;
13020   }
13021   new_env->ClearHistory();
13022   return new_env;
13023 }
13024
13025
13026 HEnvironment* HEnvironment::CreateStubEnvironment(HEnvironment* outer,
13027                                                   Handle<JSFunction> target,
13028                                                   FrameType frame_type,
13029                                                   int arguments) const {
13030   HEnvironment* new_env =
13031       new(zone()) HEnvironment(outer, target, frame_type,
13032                                arguments + 1, zone());
13033   for (int i = 0; i <= arguments; ++i) {  // Include receiver.
13034     new_env->Push(ExpressionStackAt(arguments - i));
13035   }
13036   new_env->ClearHistory();
13037   return new_env;
13038 }
13039
13040
13041 HEnvironment* HEnvironment::CopyForInlining(
13042     Handle<JSFunction> target,
13043     int arguments,
13044     FunctionLiteral* function,
13045     HConstant* undefined,
13046     InliningKind inlining_kind) const {
13047   DCHECK(frame_type() == JS_FUNCTION);
13048
13049   // Outer environment is a copy of this one without the arguments.
13050   int arity = function->scope()->num_parameters();
13051
13052   HEnvironment* outer = Copy();
13053   outer->Drop(arguments + 1);  // Including receiver.
13054   outer->ClearHistory();
13055
13056   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
13057     // Create artificial constructor stub environment.  The receiver should
13058     // actually be the constructor function, but we pass the newly allocated
13059     // object instead, DoComputeConstructStubFrame() relies on that.
13060     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
13061   } else if (inlining_kind == GETTER_CALL_RETURN) {
13062     // We need an additional StackFrame::INTERNAL frame for restoring the
13063     // correct context.
13064     outer = CreateStubEnvironment(outer, target, JS_GETTER, arguments);
13065   } else if (inlining_kind == SETTER_CALL_RETURN) {
13066     // We need an additional StackFrame::INTERNAL frame for temporarily saving
13067     // the argument of the setter, see StoreStubCompiler::CompileStoreViaSetter.
13068     outer = CreateStubEnvironment(outer, target, JS_SETTER, arguments);
13069   }
13070
13071   if (arity != arguments) {
13072     // Create artificial arguments adaptation environment.
13073     outer = CreateStubEnvironment(outer, target, ARGUMENTS_ADAPTOR, arguments);
13074   }
13075
13076   HEnvironment* inner =
13077       new(zone()) HEnvironment(outer, function->scope(), target, zone());
13078   // Get the argument values from the original environment.
13079   for (int i = 0; i <= arity; ++i) {  // Include receiver.
13080     HValue* push = (i <= arguments) ?
13081         ExpressionStackAt(arguments - i) : undefined;
13082     inner->SetValueAt(i, push);
13083   }
13084   inner->SetValueAt(arity + 1, context());
13085   for (int i = arity + 2; i < inner->length(); ++i) {
13086     inner->SetValueAt(i, undefined);
13087   }
13088
13089   inner->set_ast_id(BailoutId::FunctionEntry());
13090   return inner;
13091 }
13092
13093
13094 std::ostream& operator<<(std::ostream& os, const HEnvironment& env) {
13095   for (int i = 0; i < env.length(); i++) {
13096     if (i == 0) os << "parameters\n";
13097     if (i == env.parameter_count()) os << "specials\n";
13098     if (i == env.parameter_count() + env.specials_count()) os << "locals\n";
13099     if (i == env.parameter_count() + env.specials_count() + env.local_count()) {
13100       os << "expressions\n";
13101     }
13102     HValue* val = env.values()->at(i);
13103     os << i << ": ";
13104     if (val != NULL) {
13105       os << val;
13106     } else {
13107       os << "NULL";
13108     }
13109     os << "\n";
13110   }
13111   return os << "\n";
13112 }
13113
13114
13115 void HTracer::TraceCompilation(CompilationInfo* info) {
13116   Tag tag(this, "compilation");
13117   if (info->IsOptimizing()) {
13118     Handle<String> name = info->function()->debug_name();
13119     PrintStringProperty("name", name->ToCString().get());
13120     PrintIndent();
13121     trace_.Add("method \"%s:%d\"\n",
13122                name->ToCString().get(),
13123                info->optimization_id());
13124   } else {
13125     CodeStub::Major major_key = info->code_stub()->MajorKey();
13126     PrintStringProperty("name", CodeStub::MajorName(major_key, false));
13127     PrintStringProperty("method", "stub");
13128   }
13129   PrintLongProperty("date",
13130                     static_cast<int64_t>(base::OS::TimeCurrentMillis()));
13131 }
13132
13133
13134 void HTracer::TraceLithium(const char* name, LChunk* chunk) {
13135   DCHECK(!chunk->isolate()->concurrent_recompilation_enabled());
13136   AllowHandleDereference allow_deref;
13137   AllowDeferredHandleDereference allow_deferred_deref;
13138   Trace(name, chunk->graph(), chunk);
13139 }
13140
13141
13142 void HTracer::TraceHydrogen(const char* name, HGraph* graph) {
13143   DCHECK(!graph->isolate()->concurrent_recompilation_enabled());
13144   AllowHandleDereference allow_deref;
13145   AllowDeferredHandleDereference allow_deferred_deref;
13146   Trace(name, graph, NULL);
13147 }
13148
13149
13150 void HTracer::Trace(const char* name, HGraph* graph, LChunk* chunk) {
13151   Tag tag(this, "cfg");
13152   PrintStringProperty("name", name);
13153   const ZoneList<HBasicBlock*>* blocks = graph->blocks();
13154   for (int i = 0; i < blocks->length(); i++) {
13155     HBasicBlock* current = blocks->at(i);
13156     Tag block_tag(this, "block");
13157     PrintBlockProperty("name", current->block_id());
13158     PrintIntProperty("from_bci", -1);
13159     PrintIntProperty("to_bci", -1);
13160
13161     if (!current->predecessors()->is_empty()) {
13162       PrintIndent();
13163       trace_.Add("predecessors");
13164       for (int j = 0; j < current->predecessors()->length(); ++j) {
13165         trace_.Add(" \"B%d\"", current->predecessors()->at(j)->block_id());
13166       }
13167       trace_.Add("\n");
13168     } else {
13169       PrintEmptyProperty("predecessors");
13170     }
13171
13172     if (current->end()->SuccessorCount() == 0) {
13173       PrintEmptyProperty("successors");
13174     } else  {
13175       PrintIndent();
13176       trace_.Add("successors");
13177       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
13178         trace_.Add(" \"B%d\"", it.Current()->block_id());
13179       }
13180       trace_.Add("\n");
13181     }
13182
13183     PrintEmptyProperty("xhandlers");
13184
13185     {
13186       PrintIndent();
13187       trace_.Add("flags");
13188       if (current->IsLoopSuccessorDominator()) {
13189         trace_.Add(" \"dom-loop-succ\"");
13190       }
13191       if (current->IsUnreachable()) {
13192         trace_.Add(" \"dead\"");
13193       }
13194       if (current->is_osr_entry()) {
13195         trace_.Add(" \"osr\"");
13196       }
13197       trace_.Add("\n");
13198     }
13199
13200     if (current->dominator() != NULL) {
13201       PrintBlockProperty("dominator", current->dominator()->block_id());
13202     }
13203
13204     PrintIntProperty("loop_depth", current->LoopNestingDepth());
13205
13206     if (chunk != NULL) {
13207       int first_index = current->first_instruction_index();
13208       int last_index = current->last_instruction_index();
13209       PrintIntProperty(
13210           "first_lir_id",
13211           LifetimePosition::FromInstructionIndex(first_index).Value());
13212       PrintIntProperty(
13213           "last_lir_id",
13214           LifetimePosition::FromInstructionIndex(last_index).Value());
13215     }
13216
13217     {
13218       Tag states_tag(this, "states");
13219       Tag locals_tag(this, "locals");
13220       int total = current->phis()->length();
13221       PrintIntProperty("size", current->phis()->length());
13222       PrintStringProperty("method", "None");
13223       for (int j = 0; j < total; ++j) {
13224         HPhi* phi = current->phis()->at(j);
13225         PrintIndent();
13226         std::ostringstream os;
13227         os << phi->merged_index() << " " << NameOf(phi) << " " << *phi << "\n";
13228         trace_.Add(os.str().c_str());
13229       }
13230     }
13231
13232     {
13233       Tag HIR_tag(this, "HIR");
13234       for (HInstructionIterator it(current); !it.Done(); it.Advance()) {
13235         HInstruction* instruction = it.Current();
13236         int uses = instruction->UseCount();
13237         PrintIndent();
13238         std::ostringstream os;
13239         os << "0 " << uses << " " << NameOf(instruction) << " " << *instruction;
13240         if (graph->info()->is_tracking_positions() &&
13241             instruction->has_position() && instruction->position().raw() != 0) {
13242           const SourcePosition pos = instruction->position();
13243           os << " pos:";
13244           if (pos.inlining_id() != 0) os << pos.inlining_id() << "_";
13245           os << pos.position();
13246         }
13247         os << " <|@\n";
13248         trace_.Add(os.str().c_str());
13249       }
13250     }
13251
13252
13253     if (chunk != NULL) {
13254       Tag LIR_tag(this, "LIR");
13255       int first_index = current->first_instruction_index();
13256       int last_index = current->last_instruction_index();
13257       if (first_index != -1 && last_index != -1) {
13258         const ZoneList<LInstruction*>* instructions = chunk->instructions();
13259         for (int i = first_index; i <= last_index; ++i) {
13260           LInstruction* linstr = instructions->at(i);
13261           if (linstr != NULL) {
13262             PrintIndent();
13263             trace_.Add("%d ",
13264                        LifetimePosition::FromInstructionIndex(i).Value());
13265             linstr->PrintTo(&trace_);
13266             std::ostringstream os;
13267             os << " [hir:" << NameOf(linstr->hydrogen_value()) << "] <|@\n";
13268             trace_.Add(os.str().c_str());
13269           }
13270         }
13271       }
13272     }
13273   }
13274 }
13275
13276
13277 void HTracer::TraceLiveRanges(const char* name, LAllocator* allocator) {
13278   Tag tag(this, "intervals");
13279   PrintStringProperty("name", name);
13280
13281   const Vector<LiveRange*>* fixed_d = allocator->fixed_double_live_ranges();
13282   for (int i = 0; i < fixed_d->length(); ++i) {
13283     TraceLiveRange(fixed_d->at(i), "fixed", allocator->zone());
13284   }
13285
13286   const Vector<LiveRange*>* fixed = allocator->fixed_live_ranges();
13287   for (int i = 0; i < fixed->length(); ++i) {
13288     TraceLiveRange(fixed->at(i), "fixed", allocator->zone());
13289   }
13290
13291   const ZoneList<LiveRange*>* live_ranges = allocator->live_ranges();
13292   for (int i = 0; i < live_ranges->length(); ++i) {
13293     TraceLiveRange(live_ranges->at(i), "object", allocator->zone());
13294   }
13295 }
13296
13297
13298 void HTracer::TraceLiveRange(LiveRange* range, const char* type,
13299                              Zone* zone) {
13300   if (range != NULL && !range->IsEmpty()) {
13301     PrintIndent();
13302     trace_.Add("%d %s", range->id(), type);
13303     if (range->HasRegisterAssigned()) {
13304       LOperand* op = range->CreateAssignedOperand(zone);
13305       int assigned_reg = op->index();
13306       if (op->IsDoubleRegister()) {
13307         trace_.Add(" \"%s\"",
13308                    DoubleRegister::AllocationIndexToString(assigned_reg));
13309       } else {
13310         DCHECK(op->IsRegister());
13311         trace_.Add(" \"%s\"", Register::AllocationIndexToString(assigned_reg));
13312       }
13313     } else if (range->IsSpilled()) {
13314       LOperand* op = range->TopLevel()->GetSpillOperand();
13315       if (op->IsDoubleStackSlot()) {
13316         trace_.Add(" \"double_stack:%d\"", op->index());
13317       } else {
13318         DCHECK(op->IsStackSlot());
13319         trace_.Add(" \"stack:%d\"", op->index());
13320       }
13321     }
13322     int parent_index = -1;
13323     if (range->IsChild()) {
13324       parent_index = range->parent()->id();
13325     } else {
13326       parent_index = range->id();
13327     }
13328     LOperand* op = range->FirstHint();
13329     int hint_index = -1;
13330     if (op != NULL && op->IsUnallocated()) {
13331       hint_index = LUnallocated::cast(op)->virtual_register();
13332     }
13333     trace_.Add(" %d %d", parent_index, hint_index);
13334     UseInterval* cur_interval = range->first_interval();
13335     while (cur_interval != NULL && range->Covers(cur_interval->start())) {
13336       trace_.Add(" [%d, %d[",
13337                  cur_interval->start().Value(),
13338                  cur_interval->end().Value());
13339       cur_interval = cur_interval->next();
13340     }
13341
13342     UsePosition* current_pos = range->first_pos();
13343     while (current_pos != NULL) {
13344       if (current_pos->RegisterIsBeneficial() || FLAG_trace_all_uses) {
13345         trace_.Add(" %d M", current_pos->pos().Value());
13346       }
13347       current_pos = current_pos->next();
13348     }
13349
13350     trace_.Add(" \"\"\n");
13351   }
13352 }
13353
13354
13355 void HTracer::FlushToFile() {
13356   AppendChars(filename_.start(), trace_.ToCString().get(), trace_.length(),
13357               false);
13358   trace_.Reset();
13359 }
13360
13361
13362 void HStatistics::Initialize(CompilationInfo* info) {
13363   if (info->shared_info().is_null()) return;
13364   source_size_ += info->shared_info()->SourceSize();
13365 }
13366
13367
13368 void HStatistics::Print() {
13369   PrintF(
13370       "\n"
13371       "----------------------------------------"
13372       "----------------------------------------\n"
13373       "--- Hydrogen timing results:\n"
13374       "----------------------------------------"
13375       "----------------------------------------\n");
13376   base::TimeDelta sum;
13377   for (int i = 0; i < times_.length(); ++i) {
13378     sum += times_[i];
13379   }
13380
13381   for (int i = 0; i < names_.length(); ++i) {
13382     PrintF("%33s", names_[i]);
13383     double ms = times_[i].InMillisecondsF();
13384     double percent = times_[i].PercentOf(sum);
13385     PrintF(" %8.3f ms / %4.1f %% ", ms, percent);
13386
13387     size_t size = sizes_[i];
13388     double size_percent = static_cast<double>(size) * 100 / total_size_;
13389     PrintF(" %9zu bytes / %4.1f %%\n", size, size_percent);
13390   }
13391
13392   PrintF(
13393       "----------------------------------------"
13394       "----------------------------------------\n");
13395   base::TimeDelta total = create_graph_ + optimize_graph_ + generate_code_;
13396   PrintF("%33s %8.3f ms / %4.1f %% \n", "Create graph",
13397          create_graph_.InMillisecondsF(), create_graph_.PercentOf(total));
13398   PrintF("%33s %8.3f ms / %4.1f %% \n", "Optimize graph",
13399          optimize_graph_.InMillisecondsF(), optimize_graph_.PercentOf(total));
13400   PrintF("%33s %8.3f ms / %4.1f %% \n", "Generate and install code",
13401          generate_code_.InMillisecondsF(), generate_code_.PercentOf(total));
13402   PrintF(
13403       "----------------------------------------"
13404       "----------------------------------------\n");
13405   PrintF("%33s %8.3f ms           %9zu bytes\n", "Total",
13406          total.InMillisecondsF(), total_size_);
13407   PrintF("%33s     (%.1f times slower than full code gen)\n", "",
13408          total.TimesOf(full_code_gen_));
13409
13410   double source_size_in_kb = static_cast<double>(source_size_) / 1024;
13411   double normalized_time =  source_size_in_kb > 0
13412       ? total.InMillisecondsF() / source_size_in_kb
13413       : 0;
13414   double normalized_size_in_kb =
13415       source_size_in_kb > 0
13416           ? static_cast<double>(total_size_) / 1024 / source_size_in_kb
13417           : 0;
13418   PrintF("%33s %8.3f ms           %7.3f kB allocated\n",
13419          "Average per kB source", normalized_time, normalized_size_in_kb);
13420 }
13421
13422
13423 void HStatistics::SaveTiming(const char* name, base::TimeDelta time,
13424                              size_t size) {
13425   total_size_ += size;
13426   for (int i = 0; i < names_.length(); ++i) {
13427     if (strcmp(names_[i], name) == 0) {
13428       times_[i] += time;
13429       sizes_[i] += size;
13430       return;
13431     }
13432   }
13433   names_.Add(name);
13434   times_.Add(time);
13435   sizes_.Add(size);
13436 }
13437
13438
13439 HPhase::~HPhase() {
13440   if (ShouldProduceTraceOutput()) {
13441     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
13442   }
13443
13444 #ifdef DEBUG
13445   graph_->Verify(false);  // No full verify.
13446 #endif
13447 }
13448
13449 }  // namespace internal
13450 }  // namespace v8