src/hydrogen.cc

   1 // Copyright 2013 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/hydrogen.h"
   6
   7 #include <sstream>
   8
   9 #include "src/v8.h"
  10
  11 #include "src/allocation-site-scopes.h"
  12 #include "src/ast-numbering.h"
  13 #include "src/full-codegen/full-codegen.h"
  14 #include "src/hydrogen-bce.h"
  15 #include "src/hydrogen-bch.h"
  16 #include "src/hydrogen-canonicalize.h"
  17 #include "src/hydrogen-check-elimination.h"
  18 #include "src/hydrogen-dce.h"
  19 #include "src/hydrogen-dehoist.h"
  20 #include "src/hydrogen-environment-liveness.h"
  21 #include "src/hydrogen-escape-analysis.h"
  22 #include "src/hydrogen-gvn.h"
  23 #include "src/hydrogen-infer-representation.h"
  24 #include "src/hydrogen-infer-types.h"
  25 #include "src/hydrogen-load-elimination.h"
  26 #include "src/hydrogen-mark-deoptimize.h"
  27 #include "src/hydrogen-mark-unreachable.h"
  28 #include "src/hydrogen-osr.h"
  29 #include "src/hydrogen-range-analysis.h"
  30 #include "src/hydrogen-redundant-phi.h"
  31 #include "src/hydrogen-removable-simulates.h"
  32 #include "src/hydrogen-representation-changes.h"
  33 #include "src/hydrogen-sce.h"
  34 #include "src/hydrogen-store-elimination.h"
  35 #include "src/hydrogen-uint32-analysis.h"
  36 #include "src/ic/call-optimization.h"
  37 #include "src/ic/ic.h"
  38 // GetRootConstructor
  39 #include "src/ic/ic-inl.h"
  40 #include "src/lithium-allocator.h"
  41 #include "src/parser.h"
  42 #include "src/runtime/runtime.h"
  43 #include "src/scopeinfo.h"
  44 #include "src/typing.h"
  45
  46 #if V8_TARGET_ARCH_IA32
  47 #include "src/ia32/lithium-codegen-ia32.h"  // NOLINT
  48 #elif V8_TARGET_ARCH_X64
  49 #include "src/x64/lithium-codegen-x64.h"  // NOLINT
  50 #elif V8_TARGET_ARCH_ARM64
  51 #include "src/arm64/lithium-codegen-arm64.h"  // NOLINT
  52 #elif V8_TARGET_ARCH_ARM
  53 #include "src/arm/lithium-codegen-arm.h"  // NOLINT
  54 #elif V8_TARGET_ARCH_PPC
  55 #include "src/ppc/lithium-codegen-ppc.h"  // NOLINT
  56 #elif V8_TARGET_ARCH_MIPS
  57 #include "src/mips/lithium-codegen-mips.h"  // NOLINT
  58 #elif V8_TARGET_ARCH_MIPS64
  59 #include "src/mips64/lithium-codegen-mips64.h"  // NOLINT
  60 #elif V8_TARGET_ARCH_X87
  61 #include "src/x87/lithium-codegen-x87.h"  // NOLINT
  62 #else
  63 #error Unsupported target architecture.
  64 #endif
  65
  66 namespace v8 {
  67 namespace internal {
  68
  69 HBasicBlock::HBasicBlock(HGraph* graph)
  70     : block_id_(graph->GetNextBlockID()),
  71       graph_(graph),
  72       phis_(4, graph->zone()),
  73       first_(NULL),
  74       last_(NULL),
  75       end_(NULL),
  76       loop_information_(NULL),
  77       predecessors_(2, graph->zone()),
  78       dominator_(NULL),
  79       dominated_blocks_(4, graph->zone()),
  80       last_environment_(NULL),
  81       argument_count_(-1),
  82       first_instruction_index_(-1),
  83       last_instruction_index_(-1),
  84       deleted_phis_(4, graph->zone()),
  85       parent_loop_header_(NULL),
  86       inlined_entry_block_(NULL),
  87       is_inline_return_target_(false),
  88       is_reachable_(true),
  89       dominates_loop_successors_(false),
  90       is_osr_entry_(false),
  91       is_ordered_(false) { }
  92
  93
  94 Isolate* HBasicBlock::isolate() const {
  95   return graph_->isolate();
  96 }
  97
  98
  99 void HBasicBlock::MarkUnreachable() {
 100   is_reachable_ = false;
 101 }
 102
 103
 104 void HBasicBlock::AttachLoopInformation() {
 105   DCHECK(!IsLoopHeader());
 106   loop_information_ = new(zone()) HLoopInformation(this, zone());
 107 }
 108
 109
 110 void HBasicBlock::DetachLoopInformation() {
 111   DCHECK(IsLoopHeader());
 112   loop_information_ = NULL;
 113 }
 114
 115
 116 void HBasicBlock::AddPhi(HPhi* phi) {
 117   DCHECK(!IsStartBlock());
 118   phis_.Add(phi, zone());
 119   phi->SetBlock(this);
 120 }
 121
 122
 123 void HBasicBlock::RemovePhi(HPhi* phi) {
 124   DCHECK(phi->block() == this);
 125   DCHECK(phis_.Contains(phi));
 126   phi->Kill();
 127   phis_.RemoveElement(phi);
 128   phi->SetBlock(NULL);
 129 }
 130
 131
 132 void HBasicBlock::AddInstruction(HInstruction* instr, SourcePosition position) {
 133   DCHECK(!IsStartBlock() || !IsFinished());
 134   DCHECK(!instr->IsLinked());
 135   DCHECK(!IsFinished());
 136
 137   if (!position.IsUnknown()) {
 138     instr->set_position(position);
 139   }
 140   if (first_ == NULL) {
 141     DCHECK(last_environment() != NULL);
 142     DCHECK(!last_environment()->ast_id().IsNone());
 143     HBlockEntry* entry = new(zone()) HBlockEntry();
 144     entry->InitializeAsFirst(this);
 145     if (!position.IsUnknown()) {
 146       entry->set_position(position);
 147     } else {
 148       DCHECK(!FLAG_hydrogen_track_positions ||
 149              !graph()->info()->IsOptimizing() || instr->IsAbnormalExit());
 150     }
 151     first_ = last_ = entry;
 152   }
 153   instr->InsertAfter(last_);
 154 }
 155
 156
 157 HPhi* HBasicBlock::AddNewPhi(int merged_index) {
 158   if (graph()->IsInsideNoSideEffectsScope()) {
 159     merged_index = HPhi::kInvalidMergedIndex;
 160   }
 161   HPhi* phi = new(zone()) HPhi(merged_index, zone());
 162   AddPhi(phi);
 163   return phi;
 164 }
 165
 166
 167 HSimulate* HBasicBlock::CreateSimulate(BailoutId ast_id,
 168                                        RemovableSimulate removable) {
 169   DCHECK(HasEnvironment());
 170   HEnvironment* environment = last_environment();
 171   DCHECK(ast_id.IsNone() ||
 172          ast_id == BailoutId::StubEntry() ||
 173          environment->closure()->shared()->VerifyBailoutId(ast_id));
 174
 175   int push_count = environment->push_count();
 176   int pop_count = environment->pop_count();
 177
 178   HSimulate* instr =
 179       new(zone()) HSimulate(ast_id, pop_count, zone(), removable);
 180 #ifdef DEBUG
 181   instr->set_closure(environment->closure());
 182 #endif
 183   // Order of pushed values: newest (top of stack) first. This allows
 184   // HSimulate::MergeWith() to easily append additional pushed values
 185   // that are older (from further down the stack).
 186   for (int i = 0; i < push_count; ++i) {
 187     instr->AddPushedValue(environment->ExpressionStackAt(i));
 188   }
 189   for (GrowableBitVector::Iterator it(environment->assigned_variables(),
 190                                       zone());
 191        !it.Done();
 192        it.Advance()) {
 193     int index = it.Current();
 194     instr->AddAssignedValue(index, environment->Lookup(index));
 195   }
 196   environment->ClearHistory();
 197   return instr;
 198 }
 199
 200
 201 void HBasicBlock::Finish(HControlInstruction* end, SourcePosition position) {
 202   DCHECK(!IsFinished());
 203   AddInstruction(end, position);
 204   end_ = end;
 205   for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 206     it.Current()->RegisterPredecessor(this);
 207   }
 208 }
 209
 210
 211 void HBasicBlock::Goto(HBasicBlock* block, SourcePosition position,
 212                        FunctionState* state, bool add_simulate) {
 213   bool drop_extra = state != NULL &&
 214       state->inlining_kind() == NORMAL_RETURN;
 215
 216   if (block->IsInlineReturnTarget()) {
 217     HEnvironment* env = last_environment();
 218     int argument_count = env->arguments_environment()->parameter_count();
 219     AddInstruction(new(zone())
 220                    HLeaveInlined(state->entry(), argument_count),
 221                    position);
 222     UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 223   }
 224
 225   if (add_simulate) AddNewSimulate(BailoutId::None(), position);
 226   HGoto* instr = new(zone()) HGoto(block);
 227   Finish(instr, position);
 228 }
 229
 230
 231 void HBasicBlock::AddLeaveInlined(HValue* return_value, FunctionState* state,
 232                                   SourcePosition position) {
 233   HBasicBlock* target = state->function_return();
 234   bool drop_extra = state->inlining_kind() == NORMAL_RETURN;
 235
 236   DCHECK(target->IsInlineReturnTarget());
 237   DCHECK(return_value != NULL);
 238   HEnvironment* env = last_environment();
 239   int argument_count = env->arguments_environment()->parameter_count();
 240   AddInstruction(new(zone()) HLeaveInlined(state->entry(), argument_count),
 241                  position);
 242   UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 243   last_environment()->Push(return_value);
 244   AddNewSimulate(BailoutId::None(), position);
 245   HGoto* instr = new(zone()) HGoto(target);
 246   Finish(instr, position);
 247 }
 248
 249
 250 void HBasicBlock::SetInitialEnvironment(HEnvironment* env) {
 251   DCHECK(!HasEnvironment());
 252   DCHECK(first() == NULL);
 253   UpdateEnvironment(env);
 254 }
 255
 256
 257 void HBasicBlock::UpdateEnvironment(HEnvironment* env) {
 258   last_environment_ = env;
 259   graph()->update_maximum_environment_size(env->first_expression_index());
 260 }
 261
 262
 263 void HBasicBlock::SetJoinId(BailoutId ast_id) {
 264   int length = predecessors_.length();
 265   DCHECK(length > 0);
 266   for (int i = 0; i < length; i++) {
 267     HBasicBlock* predecessor = predecessors_[i];
 268     DCHECK(predecessor->end()->IsGoto());
 269     HSimulate* simulate = HSimulate::cast(predecessor->end()->previous());
 270     DCHECK(i != 0 ||
 271            (predecessor->last_environment()->closure().is_null() ||
 272             predecessor->last_environment()->closure()->shared()
 273               ->VerifyBailoutId(ast_id)));
 274     simulate->set_ast_id(ast_id);
 275     predecessor->last_environment()->set_ast_id(ast_id);
 276   }
 277 }
 278
 279
 280 bool HBasicBlock::Dominates(HBasicBlock* other) const {
 281   HBasicBlock* current = other->dominator();
 282   while (current != NULL) {
 283     if (current == this) return true;
 284     current = current->dominator();
 285   }
 286   return false;
 287 }
 288
 289
 290 bool HBasicBlock::EqualToOrDominates(HBasicBlock* other) const {
 291   if (this == other) return true;
 292   return Dominates(other);
 293 }
 294
 295
 296 int HBasicBlock::LoopNestingDepth() const {
 297   const HBasicBlock* current = this;
 298   int result  = (current->IsLoopHeader()) ? 1 : 0;
 299   while (current->parent_loop_header() != NULL) {
 300     current = current->parent_loop_header();
 301     result++;
 302   }
 303   return result;
 304 }
 305
 306
 307 void HBasicBlock::PostProcessLoopHeader(IterationStatement* stmt) {
 308   DCHECK(IsLoopHeader());
 309
 310   SetJoinId(stmt->EntryId());
 311   if (predecessors()->length() == 1) {
 312     // This is a degenerated loop.
 313     DetachLoopInformation();
 314     return;
 315   }
 316
 317   // Only the first entry into the loop is from outside the loop. All other
 318   // entries must be back edges.
 319   for (int i = 1; i < predecessors()->length(); ++i) {
 320     loop_information()->RegisterBackEdge(predecessors()->at(i));
 321   }
 322 }
 323
 324
 325 void HBasicBlock::MarkSuccEdgeUnreachable(int succ) {
 326   DCHECK(IsFinished());
 327   HBasicBlock* succ_block = end()->SuccessorAt(succ);
 328
 329   DCHECK(succ_block->predecessors()->length() == 1);
 330   succ_block->MarkUnreachable();
 331 }
 332
 333
 334 void HBasicBlock::RegisterPredecessor(HBasicBlock* pred) {
 335   if (HasPredecessor()) {
 336     // Only loop header blocks can have a predecessor added after
 337     // instructions have been added to the block (they have phis for all
 338     // values in the environment, these phis may be eliminated later).
 339     DCHECK(IsLoopHeader() || first_ == NULL);
 340     HEnvironment* incoming_env = pred->last_environment();
 341     if (IsLoopHeader()) {
 342       DCHECK_EQ(phis()->length(), incoming_env->length());
 343       for (int i = 0; i < phis_.length(); ++i) {
 344         phis_[i]->AddInput(incoming_env->values()->at(i));
 345       }
 346     } else {
 347       last_environment()->AddIncomingEdge(this, pred->last_environment());
 348     }
 349   } else if (!HasEnvironment() && !IsFinished()) {
 350     DCHECK(!IsLoopHeader());
 351     SetInitialEnvironment(pred->last_environment()->Copy());
 352   }
 353
 354   predecessors_.Add(pred, zone());
 355 }
 356
 357
 358 void HBasicBlock::AddDominatedBlock(HBasicBlock* block) {
 359   DCHECK(!dominated_blocks_.Contains(block));
 360   // Keep the list of dominated blocks sorted such that if there is two
 361   // succeeding block in this list, the predecessor is before the successor.
 362   int index = 0;
 363   while (index < dominated_blocks_.length() &&
 364          dominated_blocks_[index]->block_id() < block->block_id()) {
 365     ++index;
 366   }
 367   dominated_blocks_.InsertAt(index, block, zone());
 368 }
 369
 370
 371 void HBasicBlock::AssignCommonDominator(HBasicBlock* other) {
 372   if (dominator_ == NULL) {
 373     dominator_ = other;
 374     other->AddDominatedBlock(this);
 375   } else if (other->dominator() != NULL) {
 376     HBasicBlock* first = dominator_;
 377     HBasicBlock* second = other;
 378
 379     while (first != second) {
 380       if (first->block_id() > second->block_id()) {
 381         first = first->dominator();
 382       } else {
 383         second = second->dominator();
 384       }
 385       DCHECK(first != NULL && second != NULL);
 386     }
 387
 388     if (dominator_ != first) {
 389       DCHECK(dominator_->dominated_blocks_.Contains(this));
 390       dominator_->dominated_blocks_.RemoveElement(this);
 391       dominator_ = first;
 392       first->AddDominatedBlock(this);
 393     }
 394   }
 395 }
 396
 397
 398 void HBasicBlock::AssignLoopSuccessorDominators() {
 399   // Mark blocks that dominate all subsequent reachable blocks inside their
 400   // loop. Exploit the fact that blocks are sorted in reverse post order. When
 401   // the loop is visited in increasing block id order, if the number of
 402   // non-loop-exiting successor edges at the dominator_candidate block doesn't
 403   // exceed the number of previously encountered predecessor edges, there is no
 404   // path from the loop header to any block with higher id that doesn't go
 405   // through the dominator_candidate block. In this case, the
 406   // dominator_candidate block is guaranteed to dominate all blocks reachable
 407   // from it with higher ids.
 408   HBasicBlock* last = loop_information()->GetLastBackEdge();
 409   int outstanding_successors = 1;  // one edge from the pre-header
 410   // Header always dominates everything.
 411   MarkAsLoopSuccessorDominator();
 412   for (int j = block_id(); j <= last->block_id(); ++j) {
 413     HBasicBlock* dominator_candidate = graph_->blocks()->at(j);
 414     for (HPredecessorIterator it(dominator_candidate); !it.Done();
 415          it.Advance()) {
 416       HBasicBlock* predecessor = it.Current();
 417       // Don't count back edges.
 418       if (predecessor->block_id() < dominator_candidate->block_id()) {
 419         outstanding_successors--;
 420       }
 421     }
 422
 423     // If more successors than predecessors have been seen in the loop up to
 424     // now, it's not possible to guarantee that the current block dominates
 425     // all of the blocks with higher IDs. In this case, assume conservatively
 426     // that those paths through loop that don't go through the current block
 427     // contain all of the loop's dependencies. Also be careful to record
 428     // dominator information about the current loop that's being processed,
 429     // and not nested loops, which will be processed when
 430     // AssignLoopSuccessorDominators gets called on their header.
 431     DCHECK(outstanding_successors >= 0);
 432     HBasicBlock* parent_loop_header = dominator_candidate->parent_loop_header();
 433     if (outstanding_successors == 0 &&
 434         (parent_loop_header == this && !dominator_candidate->IsLoopHeader())) {
 435       dominator_candidate->MarkAsLoopSuccessorDominator();
 436     }
 437     HControlInstruction* end = dominator_candidate->end();
 438     for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 439       HBasicBlock* successor = it.Current();
 440       // Only count successors that remain inside the loop and don't loop back
 441       // to a loop header.
 442       if (successor->block_id() > dominator_candidate->block_id() &&
 443           successor->block_id() <= last->block_id()) {
 444         // Backwards edges must land on loop headers.
 445         DCHECK(successor->block_id() > dominator_candidate->block_id() ||
 446                successor->IsLoopHeader());
 447         outstanding_successors++;
 448       }
 449     }
 450   }
 451 }
 452
 453
 454 int HBasicBlock::PredecessorIndexOf(HBasicBlock* predecessor) const {
 455   for (int i = 0; i < predecessors_.length(); ++i) {
 456     if (predecessors_[i] == predecessor) return i;
 457   }
 458   UNREACHABLE();
 459   return -1;
 460 }
 461
 462
 463 #ifdef DEBUG
 464 void HBasicBlock::Verify() {
 465   // Check that every block is finished.
 466   DCHECK(IsFinished());
 467   DCHECK(block_id() >= 0);
 468
 469   // Check that the incoming edges are in edge split form.
 470   if (predecessors_.length() > 1) {
 471     for (int i = 0; i < predecessors_.length(); ++i) {
 472       DCHECK(predecessors_[i]->end()->SecondSuccessor() == NULL);
 473     }
 474   }
 475 }
 476 #endif
 477
 478
 479 void HLoopInformation::RegisterBackEdge(HBasicBlock* block) {
 480   this->back_edges_.Add(block, block->zone());
 481   AddBlock(block);
 482 }
 483
 484
 485 HBasicBlock* HLoopInformation::GetLastBackEdge() const {
 486   int max_id = -1;
 487   HBasicBlock* result = NULL;
 488   for (int i = 0; i < back_edges_.length(); ++i) {
 489     HBasicBlock* cur = back_edges_[i];
 490     if (cur->block_id() > max_id) {
 491       max_id = cur->block_id();
 492       result = cur;
 493     }
 494   }
 495   return result;
 496 }
 497
 498
 499 void HLoopInformation::AddBlock(HBasicBlock* block) {
 500   if (block == loop_header()) return;
 501   if (block->parent_loop_header() == loop_header()) return;
 502   if (block->parent_loop_header() != NULL) {
 503     AddBlock(block->parent_loop_header());
 504   } else {
 505     block->set_parent_loop_header(loop_header());
 506     blocks_.Add(block, block->zone());
 507     for (int i = 0; i < block->predecessors()->length(); ++i) {
 508       AddBlock(block->predecessors()->at(i));
 509     }
 510   }
 511 }
 512
 513
 514 #ifdef DEBUG
 515
 516 // Checks reachability of the blocks in this graph and stores a bit in
 517 // the BitVector "reachable()" for every block that can be reached
 518 // from the start block of the graph. If "dont_visit" is non-null, the given
 519 // block is treated as if it would not be part of the graph. "visited_count()"
 520 // returns the number of reachable blocks.
 521 class ReachabilityAnalyzer BASE_EMBEDDED {
 522  public:
 523   ReachabilityAnalyzer(HBasicBlock* entry_block,
 524                        int block_count,
 525                        HBasicBlock* dont_visit)
 526       : visited_count_(0),
 527         stack_(16, entry_block->zone()),
 528         reachable_(block_count, entry_block->zone()),
 529         dont_visit_(dont_visit) {
 530     PushBlock(entry_block);
 531     Analyze();
 532   }
 533
 534   int visited_count() const { return visited_count_; }
 535   const BitVector* reachable() const { return &reachable_; }
 536
 537  private:
 538   void PushBlock(HBasicBlock* block) {
 539     if (block != NULL && block != dont_visit_ &&
 540         !reachable_.Contains(block->block_id())) {
 541       reachable_.Add(block->block_id());
 542       stack_.Add(block, block->zone());
 543       visited_count_++;
 544     }
 545   }
 546
 547   void Analyze() {
 548     while (!stack_.is_empty()) {
 549       HControlInstruction* end = stack_.RemoveLast()->end();
 550       for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 551         PushBlock(it.Current());
 552       }
 553     }
 554   }
 555
 556   int visited_count_;
 557   ZoneList<HBasicBlock*> stack_;
 558   BitVector reachable_;
 559   HBasicBlock* dont_visit_;
 560 };
 561
 562
 563 void HGraph::Verify(bool do_full_verify) const {
 564   Heap::RelocationLock relocation_lock(isolate()->heap());
 565   AllowHandleDereference allow_deref;
 566   AllowDeferredHandleDereference allow_deferred_deref;
 567   for (int i = 0; i < blocks_.length(); i++) {
 568     HBasicBlock* block = blocks_.at(i);
 569
 570     block->Verify();
 571
 572     // Check that every block contains at least one node and that only the last
 573     // node is a control instruction.
 574     HInstruction* current = block->first();
 575     DCHECK(current != NULL && current->IsBlockEntry());
 576     while (current != NULL) {
 577       DCHECK((current->next() == NULL) == current->IsControlInstruction());
 578       DCHECK(current->block() == block);
 579       current->Verify();
 580       current = current->next();
 581     }
 582
 583     // Check that successors are correctly set.
 584     HBasicBlock* first = block->end()->FirstSuccessor();
 585     HBasicBlock* second = block->end()->SecondSuccessor();
 586     DCHECK(second == NULL || first != NULL);
 587
 588     // Check that the predecessor array is correct.
 589     if (first != NULL) {
 590       DCHECK(first->predecessors()->Contains(block));
 591       if (second != NULL) {
 592         DCHECK(second->predecessors()->Contains(block));
 593       }
 594     }
 595
 596     // Check that phis have correct arguments.
 597     for (int j = 0; j < block->phis()->length(); j++) {
 598       HPhi* phi = block->phis()->at(j);
 599       phi->Verify();
 600     }
 601
 602     // Check that all join blocks have predecessors that end with an
 603     // unconditional goto and agree on their environment node id.
 604     if (block->predecessors()->length() >= 2) {
 605       BailoutId id =
 606           block->predecessors()->first()->last_environment()->ast_id();
 607       for (int k = 0; k < block->predecessors()->length(); k++) {
 608         HBasicBlock* predecessor = block->predecessors()->at(k);
 609         DCHECK(predecessor->end()->IsGoto() ||
 610                predecessor->end()->IsDeoptimize());
 611         DCHECK(predecessor->last_environment()->ast_id() == id);
 612       }
 613     }
 614   }
 615
 616   // Check special property of first block to have no predecessors.
 617   DCHECK(blocks_.at(0)->predecessors()->is_empty());
 618
 619   if (do_full_verify) {
 620     // Check that the graph is fully connected.
 621     ReachabilityAnalyzer analyzer(entry_block_, blocks_.length(), NULL);
 622     DCHECK(analyzer.visited_count() == blocks_.length());
 623
 624     // Check that entry block dominator is NULL.
 625     DCHECK(entry_block_->dominator() == NULL);
 626
 627     // Check dominators.
 628     for (int i = 0; i < blocks_.length(); ++i) {
 629       HBasicBlock* block = blocks_.at(i);
 630       if (block->dominator() == NULL) {
 631         // Only start block may have no dominator assigned to.
 632         DCHECK(i == 0);
 633       } else {
 634         // Assert that block is unreachable if dominator must not be visited.
 635         ReachabilityAnalyzer dominator_analyzer(entry_block_,
 636                                                 blocks_.length(),
 637                                                 block->dominator());
 638         DCHECK(!dominator_analyzer.reachable()->Contains(block->block_id()));
 639       }
 640     }
 641   }
 642 }
 643
 644 #endif
 645
 646
 647 HConstant* HGraph::GetConstant(SetOncePointer<HConstant>* pointer,
 648                                int32_t value) {
 649   if (!pointer->is_set()) {
 650     // Can't pass GetInvalidContext() to HConstant::New, because that will
 651     // recursively call GetConstant
 652     HConstant* constant = HConstant::New(isolate(), zone(), NULL, value);
 653     constant->InsertAfter(entry_block()->first());
 654     pointer->set(constant);
 655     return constant;
 656   }
 657   return ReinsertConstantIfNecessary(pointer->get());
 658 }
 659
 660
 661 HConstant* HGraph::ReinsertConstantIfNecessary(HConstant* constant) {
 662   if (!constant->IsLinked()) {
 663     // The constant was removed from the graph. Reinsert.
 664     constant->ClearFlag(HValue::kIsDead);
 665     constant->InsertAfter(entry_block()->first());
 666   }
 667   return constant;
 668 }
 669
 670
 671 HConstant* HGraph::GetConstant0() {
 672   return GetConstant(&constant_0_, 0);
 673 }
 674
 675
 676 HConstant* HGraph::GetConstant1() {
 677   return GetConstant(&constant_1_, 1);
 678 }
 679
 680
 681 HConstant* HGraph::GetConstantMinus1() {
 682   return GetConstant(&constant_minus1_, -1);
 683 }
 684
 685
 686 HConstant* HGraph::GetConstantBool(bool value) {
 687   return value ? GetConstantTrue() : GetConstantFalse();
 688 }
 689
 690
 691 #define DEFINE_GET_CONSTANT(Name, name, type, htype, boolean_value)            \
 692 HConstant* HGraph::GetConstant##Name() {                                       \
 693   if (!constant_##name##_.is_set()) {                                          \
 694     HConstant* constant = new(zone()) HConstant(                               \
 695         Unique<Object>::CreateImmovable(isolate()->factory()->name##_value()), \
 696         Unique<Map>::CreateImmovable(isolate()->factory()->type##_map()),      \
 697         false,                                                                 \
 698         Representation::Tagged(),                                              \
 699         htype,                                                                 \
 700         true,                                                                  \
 701         boolean_value,                                                         \
 702         false,                                                                 \
 703         ODDBALL_TYPE);                                                         \
 704     constant->InsertAfter(entry_block()->first());                             \
 705     constant_##name##_.set(constant);                                          \
 706   }                                                                            \
 707   return ReinsertConstantIfNecessary(constant_##name##_.get());                \
 708 }
 709
 710
 711 DEFINE_GET_CONSTANT(Undefined, undefined, undefined, HType::Undefined(), false)
 712 DEFINE_GET_CONSTANT(True, true, boolean, HType::Boolean(), true)
 713 DEFINE_GET_CONSTANT(False, false, boolean, HType::Boolean(), false)
 714 DEFINE_GET_CONSTANT(Hole, the_hole, the_hole, HType::None(), false)
 715 DEFINE_GET_CONSTANT(Null, null, null, HType::Null(), false)
 716
 717
 718 #undef DEFINE_GET_CONSTANT
 719
 720 #define DEFINE_IS_CONSTANT(Name, name)                                         \
 721 bool HGraph::IsConstant##Name(HConstant* constant) {                           \
 722   return constant_##name##_.is_set() && constant == constant_##name##_.get();  \
 723 }
 724 DEFINE_IS_CONSTANT(Undefined, undefined)
 725 DEFINE_IS_CONSTANT(0, 0)
 726 DEFINE_IS_CONSTANT(1, 1)
 727 DEFINE_IS_CONSTANT(Minus1, minus1)
 728 DEFINE_IS_CONSTANT(True, true)
 729 DEFINE_IS_CONSTANT(False, false)
 730 DEFINE_IS_CONSTANT(Hole, the_hole)
 731 DEFINE_IS_CONSTANT(Null, null)
 732
 733 #undef DEFINE_IS_CONSTANT
 734
 735
 736 HConstant* HGraph::GetInvalidContext() {
 737   return GetConstant(&constant_invalid_context_, 0xFFFFC0C7);
 738 }
 739
 740
 741 bool HGraph::IsStandardConstant(HConstant* constant) {
 742   if (IsConstantUndefined(constant)) return true;
 743   if (IsConstant0(constant)) return true;
 744   if (IsConstant1(constant)) return true;
 745   if (IsConstantMinus1(constant)) return true;
 746   if (IsConstantTrue(constant)) return true;
 747   if (IsConstantFalse(constant)) return true;
 748   if (IsConstantHole(constant)) return true;
 749   if (IsConstantNull(constant)) return true;
 750   return false;
 751 }
 752
 753
 754 HGraphBuilder::IfBuilder::IfBuilder() : builder_(NULL), needs_compare_(true) {}
 755
 756
 757 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder)
 758     : needs_compare_(true) {
 759   Initialize(builder);
 760 }
 761
 762
 763 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder,
 764                                     HIfContinuation* continuation)
 765     : needs_compare_(false), first_true_block_(NULL), first_false_block_(NULL) {
 766   InitializeDontCreateBlocks(builder);
 767   continuation->Continue(&first_true_block_, &first_false_block_);
 768 }
 769
 770
 771 void HGraphBuilder::IfBuilder::InitializeDontCreateBlocks(
 772     HGraphBuilder* builder) {
 773   builder_ = builder;
 774   finished_ = false;
 775   did_then_ = false;
 776   did_else_ = false;
 777   did_else_if_ = false;
 778   did_and_ = false;
 779   did_or_ = false;
 780   captured_ = false;
 781   pending_merge_block_ = false;
 782   split_edge_merge_block_ = NULL;
 783   merge_at_join_blocks_ = NULL;
 784   normal_merge_at_join_block_count_ = 0;
 785   deopt_merge_at_join_block_count_ = 0;
 786 }
 787
 788
 789 void HGraphBuilder::IfBuilder::Initialize(HGraphBuilder* builder) {
 790   InitializeDontCreateBlocks(builder);
 791   HEnvironment* env = builder->environment();
 792   first_true_block_ = builder->CreateBasicBlock(env->Copy());
 793   first_false_block_ = builder->CreateBasicBlock(env->Copy());
 794 }
 795
 796
 797 HControlInstruction* HGraphBuilder::IfBuilder::AddCompare(
 798     HControlInstruction* compare) {
 799   DCHECK(did_then_ == did_else_);
 800   if (did_else_) {
 801     // Handle if-then-elseif
 802     did_else_if_ = true;
 803     did_else_ = false;
 804     did_then_ = false;
 805     did_and_ = false;
 806     did_or_ = false;
 807     pending_merge_block_ = false;
 808     split_edge_merge_block_ = NULL;
 809     HEnvironment* env = builder()->environment();
 810     first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 811     first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 812   }
 813   if (split_edge_merge_block_ != NULL) {
 814     HEnvironment* env = first_false_block_->last_environment();
 815     HBasicBlock* split_edge = builder()->CreateBasicBlock(env->Copy());
 816     if (did_or_) {
 817       compare->SetSuccessorAt(0, split_edge);
 818       compare->SetSuccessorAt(1, first_false_block_);
 819     } else {
 820       compare->SetSuccessorAt(0, first_true_block_);
 821       compare->SetSuccessorAt(1, split_edge);
 822     }
 823     builder()->GotoNoSimulate(split_edge, split_edge_merge_block_);
 824   } else {
 825     compare->SetSuccessorAt(0, first_true_block_);
 826     compare->SetSuccessorAt(1, first_false_block_);
 827   }
 828   builder()->FinishCurrentBlock(compare);
 829   needs_compare_ = false;
 830   return compare;
 831 }
 832
 833
 834 void HGraphBuilder::IfBuilder::Or() {
 835   DCHECK(!needs_compare_);
 836   DCHECK(!did_and_);
 837   did_or_ = true;
 838   HEnvironment* env = first_false_block_->last_environment();
 839   if (split_edge_merge_block_ == NULL) {
 840     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 841     builder()->GotoNoSimulate(first_true_block_, split_edge_merge_block_);
 842     first_true_block_ = split_edge_merge_block_;
 843   }
 844   builder()->set_current_block(first_false_block_);
 845   first_false_block_ = builder()->CreateBasicBlock(env->Copy());
 846 }
 847
 848
 849 void HGraphBuilder::IfBuilder::And() {
 850   DCHECK(!needs_compare_);
 851   DCHECK(!did_or_);
 852   did_and_ = true;
 853   HEnvironment* env = first_false_block_->last_environment();
 854   if (split_edge_merge_block_ == NULL) {
 855     split_edge_merge_block_ = builder()->CreateBasicBlock(env->Copy());
 856     builder()->GotoNoSimulate(first_false_block_, split_edge_merge_block_);
 857     first_false_block_ = split_edge_merge_block_;
 858   }
 859   builder()->set_current_block(first_true_block_);
 860   first_true_block_ = builder()->CreateBasicBlock(env->Copy());
 861 }
 862
 863
 864 void HGraphBuilder::IfBuilder::CaptureContinuation(
 865     HIfContinuation* continuation) {
 866   DCHECK(!did_else_if_);
 867   DCHECK(!finished_);
 868   DCHECK(!captured_);
 869
 870   HBasicBlock* true_block = NULL;
 871   HBasicBlock* false_block = NULL;
 872   Finish(&true_block, &false_block);
 873   DCHECK(true_block != NULL);
 874   DCHECK(false_block != NULL);
 875   continuation->Capture(true_block, false_block);
 876   captured_ = true;
 877   builder()->set_current_block(NULL);
 878   End();
 879 }
 880
 881
 882 void HGraphBuilder::IfBuilder::JoinContinuation(HIfContinuation* continuation) {
 883   DCHECK(!did_else_if_);
 884   DCHECK(!finished_);
 885   DCHECK(!captured_);
 886   HBasicBlock* true_block = NULL;
 887   HBasicBlock* false_block = NULL;
 888   Finish(&true_block, &false_block);
 889   merge_at_join_blocks_ = NULL;
 890   if (true_block != NULL && !true_block->IsFinished()) {
 891     DCHECK(continuation->IsTrueReachable());
 892     builder()->GotoNoSimulate(true_block, continuation->true_branch());
 893   }
 894   if (false_block != NULL && !false_block->IsFinished()) {
 895     DCHECK(continuation->IsFalseReachable());
 896     builder()->GotoNoSimulate(false_block, continuation->false_branch());
 897   }
 898   captured_ = true;
 899   End();
 900 }
 901
 902
 903 void HGraphBuilder::IfBuilder::Then() {
 904   DCHECK(!captured_);
 905   DCHECK(!finished_);
 906   did_then_ = true;
 907   if (needs_compare_) {
 908     // Handle if's without any expressions, they jump directly to the "else"
 909     // branch. However, we must pretend that the "then" branch is reachable,
 910     // so that the graph builder visits it and sees any live range extending
 911     // constructs within it.
 912     HConstant* constant_false = builder()->graph()->GetConstantFalse();
 913     ToBooleanStub::Types boolean_type = ToBooleanStub::Types();
 914     boolean_type.Add(ToBooleanStub::BOOLEAN);
 915     HBranch* branch = builder()->New<HBranch>(
 916         constant_false, boolean_type, first_true_block_, first_false_block_);
 917     builder()->FinishCurrentBlock(branch);
 918   }
 919   builder()->set_current_block(first_true_block_);
 920   pending_merge_block_ = true;
 921 }
 922
 923
 924 void HGraphBuilder::IfBuilder::Else() {
 925   DCHECK(did_then_);
 926   DCHECK(!captured_);
 927   DCHECK(!finished_);
 928   AddMergeAtJoinBlock(false);
 929   builder()->set_current_block(first_false_block_);
 930   pending_merge_block_ = true;
 931   did_else_ = true;
 932 }
 933
 934
 935 void HGraphBuilder::IfBuilder::Deopt(Deoptimizer::DeoptReason reason) {
 936   DCHECK(did_then_);
 937   builder()->Add<HDeoptimize>(reason, Deoptimizer::EAGER);
 938   AddMergeAtJoinBlock(true);
 939 }
 940
 941
 942 void HGraphBuilder::IfBuilder::Return(HValue* value) {
 943   HValue* parameter_count = builder()->graph()->GetConstantMinus1();
 944   builder()->FinishExitCurrentBlock(
 945       builder()->New<HReturn>(value, parameter_count));
 946   AddMergeAtJoinBlock(false);
 947 }
 948
 949
 950 void HGraphBuilder::IfBuilder::AddMergeAtJoinBlock(bool deopt) {
 951   if (!pending_merge_block_) return;
 952   HBasicBlock* block = builder()->current_block();
 953   DCHECK(block == NULL || !block->IsFinished());
 954   MergeAtJoinBlock* record = new (builder()->zone())
 955       MergeAtJoinBlock(block, deopt, merge_at_join_blocks_);
 956   merge_at_join_blocks_ = record;
 957   if (block != NULL) {
 958     DCHECK(block->end() == NULL);
 959     if (deopt) {
 960       normal_merge_at_join_block_count_++;
 961     } else {
 962       deopt_merge_at_join_block_count_++;
 963     }
 964   }
 965   builder()->set_current_block(NULL);
 966   pending_merge_block_ = false;
 967 }
 968
 969
 970 void HGraphBuilder::IfBuilder::Finish() {
 971   DCHECK(!finished_);
 972   if (!did_then_) {
 973     Then();
 974   }
 975   AddMergeAtJoinBlock(false);
 976   if (!did_else_) {
 977     Else();
 978     AddMergeAtJoinBlock(false);
 979   }
 980   finished_ = true;
 981 }
 982
 983
 984 void HGraphBuilder::IfBuilder::Finish(HBasicBlock** then_continuation,
 985                                       HBasicBlock** else_continuation) {
 986   Finish();
 987
 988   MergeAtJoinBlock* else_record = merge_at_join_blocks_;
 989   if (else_continuation != NULL) {
 990     *else_continuation = else_record->block_;
 991   }
 992   MergeAtJoinBlock* then_record = else_record->next_;
 993   if (then_continuation != NULL) {
 994     *then_continuation = then_record->block_;
 995   }
 996   DCHECK(then_record->next_ == NULL);
 997 }
 998
 999
1000 void HGraphBuilder::IfBuilder::EndUnreachable() {
1001   if (captured_) return;
1002   Finish();
1003   builder()->set_current_block(nullptr);
1004 }
1005
1006
1007 void HGraphBuilder::IfBuilder::End() {
1008   if (captured_) return;
1009   Finish();
1010
1011   int total_merged_blocks = normal_merge_at_join_block_count_ +
1012     deopt_merge_at_join_block_count_;
1013   DCHECK(total_merged_blocks >= 1);
1014   HBasicBlock* merge_block =
1015       total_merged_blocks == 1 ? NULL : builder()->graph()->CreateBasicBlock();
1016
1017   // Merge non-deopt blocks first to ensure environment has right size for
1018   // padding.
1019   MergeAtJoinBlock* current = merge_at_join_blocks_;
1020   while (current != NULL) {
1021     if (!current->deopt_ && current->block_ != NULL) {
1022       // If there is only one block that makes it through to the end of the
1023       // if, then just set it as the current block and continue rather then
1024       // creating an unnecessary merge block.
1025       if (total_merged_blocks == 1) {
1026         builder()->set_current_block(current->block_);
1027         return;
1028       }
1029       builder()->GotoNoSimulate(current->block_, merge_block);
1030     }
1031     current = current->next_;
1032   }
1033
1034   // Merge deopt blocks, padding when necessary.
1035   current = merge_at_join_blocks_;
1036   while (current != NULL) {
1037     if (current->deopt_ && current->block_ != NULL) {
1038       current->block_->FinishExit(
1039           HAbnormalExit::New(builder()->isolate(), builder()->zone(), NULL),
1040           SourcePosition::Unknown());
1041     }
1042     current = current->next_;
1043   }
1044   builder()->set_current_block(merge_block);
1045 }
1046
1047
1048 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder) {
1049   Initialize(builder, NULL, kWhileTrue, NULL);
1050 }
1051
1052
1053 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1054                                         LoopBuilder::Direction direction) {
1055   Initialize(builder, context, direction, builder->graph()->GetConstant1());
1056 }
1057
1058
1059 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder, HValue* context,
1060                                         LoopBuilder::Direction direction,
1061                                         HValue* increment_amount) {
1062   Initialize(builder, context, direction, increment_amount);
1063   increment_amount_ = increment_amount;
1064 }
1065
1066
1067 void HGraphBuilder::LoopBuilder::Initialize(HGraphBuilder* builder,
1068                                             HValue* context,
1069                                             Direction direction,
1070                                             HValue* increment_amount) {
1071   builder_ = builder;
1072   context_ = context;
1073   direction_ = direction;
1074   increment_amount_ = increment_amount;
1075
1076   finished_ = false;
1077   header_block_ = builder->CreateLoopHeaderBlock();
1078   body_block_ = NULL;
1079   exit_block_ = NULL;
1080   exit_trampoline_block_ = NULL;
1081 }
1082
1083
1084 HValue* HGraphBuilder::LoopBuilder::BeginBody(
1085     HValue* initial,
1086     HValue* terminating,
1087     Token::Value token) {
1088   DCHECK(direction_ != kWhileTrue);
1089   HEnvironment* env = builder_->environment();
1090   phi_ = header_block_->AddNewPhi(env->values()->length());
1091   phi_->AddInput(initial);
1092   env->Push(initial);
1093   builder_->GotoNoSimulate(header_block_);
1094
1095   HEnvironment* body_env = env->Copy();
1096   HEnvironment* exit_env = env->Copy();
1097   // Remove the phi from the expression stack
1098   body_env->Pop();
1099   exit_env->Pop();
1100   body_block_ = builder_->CreateBasicBlock(body_env);
1101   exit_block_ = builder_->CreateBasicBlock(exit_env);
1102
1103   builder_->set_current_block(header_block_);
1104   env->Pop();
1105   builder_->FinishCurrentBlock(builder_->New<HCompareNumericAndBranch>(
1106           phi_, terminating, token, body_block_, exit_block_));
1107
1108   builder_->set_current_block(body_block_);
1109   if (direction_ == kPreIncrement || direction_ == kPreDecrement) {
1110     Isolate* isolate = builder_->isolate();
1111     HValue* one = builder_->graph()->GetConstant1();
1112     if (direction_ == kPreIncrement) {
1113       increment_ = HAdd::New(isolate, zone(), context_, phi_, one);
1114     } else {
1115       increment_ = HSub::New(isolate, zone(), context_, phi_, one);
1116     }
1117     increment_->ClearFlag(HValue::kCanOverflow);
1118     builder_->AddInstruction(increment_);
1119     return increment_;
1120   } else {
1121     return phi_;
1122   }
1123 }
1124
1125
1126 void HGraphBuilder::LoopBuilder::BeginBody(int drop_count) {
1127   DCHECK(direction_ == kWhileTrue);
1128   HEnvironment* env = builder_->environment();
1129   builder_->GotoNoSimulate(header_block_);
1130   builder_->set_current_block(header_block_);
1131   env->Drop(drop_count);
1132 }
1133
1134
1135 void HGraphBuilder::LoopBuilder::Break() {
1136   if (exit_trampoline_block_ == NULL) {
1137     // Its the first time we saw a break.
1138     if (direction_ == kWhileTrue) {
1139       HEnvironment* env = builder_->environment()->Copy();
1140       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1141     } else {
1142       HEnvironment* env = exit_block_->last_environment()->Copy();
1143       exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1144       builder_->GotoNoSimulate(exit_block_, exit_trampoline_block_);
1145     }
1146   }
1147
1148   builder_->GotoNoSimulate(exit_trampoline_block_);
1149   builder_->set_current_block(NULL);
1150 }
1151
1152
1153 void HGraphBuilder::LoopBuilder::EndBody() {
1154   DCHECK(!finished_);
1155
1156   if (direction_ == kPostIncrement || direction_ == kPostDecrement) {
1157     Isolate* isolate = builder_->isolate();
1158     if (direction_ == kPostIncrement) {
1159       increment_ =
1160           HAdd::New(isolate, zone(), context_, phi_, increment_amount_);
1161     } else {
1162       increment_ =
1163           HSub::New(isolate, zone(), context_, phi_, increment_amount_);
1164     }
1165     increment_->ClearFlag(HValue::kCanOverflow);
1166     builder_->AddInstruction(increment_);
1167   }
1168
1169   if (direction_ != kWhileTrue) {
1170     // Push the new increment value on the expression stack to merge into
1171     // the phi.
1172     builder_->environment()->Push(increment_);
1173   }
1174   HBasicBlock* last_block = builder_->current_block();
1175   builder_->GotoNoSimulate(last_block, header_block_);
1176   header_block_->loop_information()->RegisterBackEdge(last_block);
1177
1178   if (exit_trampoline_block_ != NULL) {
1179     builder_->set_current_block(exit_trampoline_block_);
1180   } else {
1181     builder_->set_current_block(exit_block_);
1182   }
1183   finished_ = true;
1184 }
1185
1186
1187 HGraph* HGraphBuilder::CreateGraph() {
1188   graph_ = new(zone()) HGraph(info_);
1189   if (FLAG_hydrogen_stats) isolate()->GetHStatistics()->Initialize(info_);
1190   CompilationPhase phase("H_Block building", info_);
1191   set_current_block(graph()->entry_block());
1192   if (!BuildGraph()) return NULL;
1193   graph()->FinalizeUniqueness();
1194   return graph_;
1195 }
1196
1197
1198 HInstruction* HGraphBuilder::AddInstruction(HInstruction* instr) {
1199   DCHECK(current_block() != NULL);
1200   DCHECK(!FLAG_hydrogen_track_positions ||
1201          !position_.IsUnknown() ||
1202          !info_->IsOptimizing());
1203   current_block()->AddInstruction(instr, source_position());
1204   if (graph()->IsInsideNoSideEffectsScope()) {
1205     instr->SetFlag(HValue::kHasNoObservableSideEffects);
1206   }
1207   return instr;
1208 }
1209
1210
1211 void HGraphBuilder::FinishCurrentBlock(HControlInstruction* last) {
1212   DCHECK(!FLAG_hydrogen_track_positions ||
1213          !info_->IsOptimizing() ||
1214          !position_.IsUnknown());
1215   current_block()->Finish(last, source_position());
1216   if (last->IsReturn() || last->IsAbnormalExit()) {
1217     set_current_block(NULL);
1218   }
1219 }
1220
1221
1222 void HGraphBuilder::FinishExitCurrentBlock(HControlInstruction* instruction) {
1223   DCHECK(!FLAG_hydrogen_track_positions || !info_->IsOptimizing() ||
1224          !position_.IsUnknown());
1225   current_block()->FinishExit(instruction, source_position());
1226   if (instruction->IsReturn() || instruction->IsAbnormalExit()) {
1227     set_current_block(NULL);
1228   }
1229 }
1230
1231
1232 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
1233   if (FLAG_native_code_counters && counter->Enabled()) {
1234     HValue* reference = Add<HConstant>(ExternalReference(counter));
1235     HValue* old_value =
1236         Add<HLoadNamedField>(reference, nullptr, HObjectAccess::ForCounter());
1237     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
1238     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
1239     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
1240                           new_value, STORE_TO_INITIALIZED_ENTRY);
1241   }
1242 }
1243
1244
1245 void HGraphBuilder::AddSimulate(BailoutId id,
1246                                 RemovableSimulate removable) {
1247   DCHECK(current_block() != NULL);
1248   DCHECK(!graph()->IsInsideNoSideEffectsScope());
1249   current_block()->AddNewSimulate(id, source_position(), removable);
1250 }
1251
1252
1253 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
1254   HBasicBlock* b = graph()->CreateBasicBlock();
1255   b->SetInitialEnvironment(env);
1256   return b;
1257 }
1258
1259
1260 HBasicBlock* HGraphBuilder::CreateLoopHeaderBlock() {
1261   HBasicBlock* header = graph()->CreateBasicBlock();
1262   HEnvironment* entry_env = environment()->CopyAsLoopHeader(header);
1263   header->SetInitialEnvironment(entry_env);
1264   header->AttachLoopInformation();
1265   return header;
1266 }
1267
1268
1269 HValue* HGraphBuilder::BuildGetElementsKind(HValue* object) {
1270   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
1271
1272   HValue* bit_field2 =
1273       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField2());
1274   return BuildDecodeField<Map::ElementsKindBits>(bit_field2);
1275 }
1276
1277
1278 HValue* HGraphBuilder::BuildCheckHeapObject(HValue* obj) {
1279   if (obj->type().IsHeapObject()) return obj;
1280   return Add<HCheckHeapObject>(obj);
1281 }
1282
1283
1284 void HGraphBuilder::FinishExitWithHardDeoptimization(
1285     Deoptimizer::DeoptReason reason) {
1286   Add<HDeoptimize>(reason, Deoptimizer::EAGER);
1287   FinishExitCurrentBlock(New<HAbnormalExit>());
1288 }
1289
1290
1291 HValue* HGraphBuilder::BuildCheckString(HValue* string) {
1292   if (!string->type().IsString()) {
1293     DCHECK(!string->IsConstant() ||
1294            !HConstant::cast(string)->HasStringValue());
1295     BuildCheckHeapObject(string);
1296     return Add<HCheckInstanceType>(string, HCheckInstanceType::IS_STRING);
1297   }
1298   return string;
1299 }
1300
1301
1302 HValue* HGraphBuilder::BuildWrapReceiver(HValue* object, HValue* function) {
1303   if (object->type().IsJSObject()) return object;
1304   if (function->IsConstant() &&
1305       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
1306     Handle<JSFunction> f = Handle<JSFunction>::cast(
1307         HConstant::cast(function)->handle(isolate()));
1308     SharedFunctionInfo* shared = f->shared();
1309     if (is_strict(shared->language_mode()) || shared->native()) return object;
1310   }
1311   return Add<HWrapReceiver>(object, function);
1312 }
1313
1314
1315 HValue* HGraphBuilder::BuildCheckAndGrowElementsCapacity(
1316     HValue* object, HValue* elements, ElementsKind kind, HValue* length,
1317     HValue* capacity, HValue* key) {
1318   HValue* max_gap = Add<HConstant>(static_cast<int32_t>(JSObject::kMaxGap));
1319   HValue* max_capacity = AddUncasted<HAdd>(capacity, max_gap);
1320   Add<HBoundsCheck>(key, max_capacity);
1321
1322   HValue* new_capacity = BuildNewElementsCapacity(key);
1323   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind, kind,
1324                                                    length, new_capacity);
1325   return new_elements;
1326 }
1327
1328
1329 HValue* HGraphBuilder::BuildCheckForCapacityGrow(
1330     HValue* object,
1331     HValue* elements,
1332     ElementsKind kind,
1333     HValue* length,
1334     HValue* key,
1335     bool is_js_array,
1336     PropertyAccessType access_type) {
1337   IfBuilder length_checker(this);
1338
1339   Token::Value token = IsHoleyElementsKind(kind) ? Token::GTE : Token::EQ;
1340   length_checker.If<HCompareNumericAndBranch>(key, length, token);
1341
1342   length_checker.Then();
1343
1344   HValue* current_capacity = AddLoadFixedArrayLength(elements);
1345
1346   if (top_info()->IsStub()) {
1347     IfBuilder capacity_checker(this);
1348     capacity_checker.If<HCompareNumericAndBranch>(key, current_capacity,
1349                                                   Token::GTE);
1350     capacity_checker.Then();
1351     HValue* new_elements = BuildCheckAndGrowElementsCapacity(
1352         object, elements, kind, length, current_capacity, key);
1353     environment()->Push(new_elements);
1354     capacity_checker.Else();
1355     environment()->Push(elements);
1356     capacity_checker.End();
1357   } else {
1358     HValue* result = Add<HMaybeGrowElements>(
1359         object, elements, key, current_capacity, is_js_array, kind);
1360     environment()->Push(result);
1361   }
1362
1363   if (is_js_array) {
1364     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
1365     new_length->ClearFlag(HValue::kCanOverflow);
1366
1367     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
1368                           new_length);
1369   }
1370
1371   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
1372     HValue* checked_elements = environment()->Top();
1373
1374     // Write zero to ensure that the new element is initialized with some smi.
1375     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
1376   }
1377
1378   length_checker.Else();
1379   Add<HBoundsCheck>(key, length);
1380
1381   environment()->Push(elements);
1382   length_checker.End();
1383
1384   return environment()->Pop();
1385 }
1386
1387
1388 HValue* HGraphBuilder::BuildCopyElementsOnWrite(HValue* object,
1389                                                 HValue* elements,
1390                                                 ElementsKind kind,
1391                                                 HValue* length) {
1392   Factory* factory = isolate()->factory();
1393
1394   IfBuilder cow_checker(this);
1395
1396   cow_checker.If<HCompareMap>(elements, factory->fixed_cow_array_map());
1397   cow_checker.Then();
1398
1399   HValue* capacity = AddLoadFixedArrayLength(elements);
1400
1401   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
1402                                                    kind, length, capacity);
1403
1404   environment()->Push(new_elements);
1405
1406   cow_checker.Else();
1407
1408   environment()->Push(elements);
1409
1410   cow_checker.End();
1411
1412   return environment()->Pop();
1413 }
1414
1415
1416 void HGraphBuilder::BuildTransitionElementsKind(HValue* object,
1417                                                 HValue* map,
1418                                                 ElementsKind from_kind,
1419                                                 ElementsKind to_kind,
1420                                                 bool is_jsarray) {
1421   DCHECK(!IsFastHoleyElementsKind(from_kind) ||
1422          IsFastHoleyElementsKind(to_kind));
1423
1424   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
1425     Add<HTrapAllocationMemento>(object);
1426   }
1427
1428   if (!IsSimpleMapChangeTransition(from_kind, to_kind)) {
1429     HInstruction* elements = AddLoadElements(object);
1430
1431     HInstruction* empty_fixed_array = Add<HConstant>(
1432         isolate()->factory()->empty_fixed_array());
1433
1434     IfBuilder if_builder(this);
1435
1436     if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
1437
1438     if_builder.Then();
1439
1440     HInstruction* elements_length = AddLoadFixedArrayLength(elements);
1441
1442     HInstruction* array_length =
1443         is_jsarray
1444             ? Add<HLoadNamedField>(object, nullptr,
1445                                    HObjectAccess::ForArrayLength(from_kind))
1446             : elements_length;
1447
1448     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
1449                               array_length, elements_length);
1450
1451     if_builder.End();
1452   }
1453
1454   Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
1455 }
1456
1457
1458 void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
1459                                        int bit_field_mask) {
1460   // Check that the object isn't a smi.
1461   Add<HCheckHeapObject>(receiver);
1462
1463   // Get the map of the receiver.
1464   HValue* map =
1465       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1466
1467   // Check the instance type and if an access check is needed, this can be
1468   // done with a single load, since both bytes are adjacent in the map.
1469   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
1470   HValue* instance_type_and_bit_field =
1471       Add<HLoadNamedField>(map, nullptr, access);
1472
1473   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
1474   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
1475                                              instance_type_and_bit_field,
1476                                              mask);
1477   HValue* sub_result = AddUncasted<HSub>(and_result,
1478                                          Add<HConstant>(JS_OBJECT_TYPE));
1479   Add<HBoundsCheck>(sub_result,
1480                     Add<HConstant>(LAST_JS_OBJECT_TYPE + 1 - JS_OBJECT_TYPE));
1481 }
1482
1483
1484 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
1485                                          HIfContinuation* join_continuation) {
1486   // The sometimes unintuitively backward ordering of the ifs below is
1487   // convoluted, but necessary.  All of the paths must guarantee that the
1488   // if-true of the continuation returns a smi element index and the if-false of
1489   // the continuation returns either a symbol or a unique string key. All other
1490   // object types cause a deopt to fall back to the runtime.
1491
1492   IfBuilder key_smi_if(this);
1493   key_smi_if.If<HIsSmiAndBranch>(key);
1494   key_smi_if.Then();
1495   {
1496     Push(key);  // Nothing to do, just continue to true of continuation.
1497   }
1498   key_smi_if.Else();
1499   {
1500     HValue* map = Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForMap());
1501     HValue* instance_type =
1502         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1503
1504     // Non-unique string, check for a string with a hash code that is actually
1505     // an index.
1506     STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
1507     IfBuilder not_string_or_name_if(this);
1508     not_string_or_name_if.If<HCompareNumericAndBranch>(
1509         instance_type,
1510         Add<HConstant>(LAST_UNIQUE_NAME_TYPE),
1511         Token::GT);
1512
1513     not_string_or_name_if.Then();
1514     {
1515       // Non-smi, non-Name, non-String: Try to convert to smi in case of
1516       // HeapNumber.
1517       // TODO(danno): This could call some variant of ToString
1518       Push(AddUncasted<HForceRepresentation>(key, Representation::Smi()));
1519     }
1520     not_string_or_name_if.Else();
1521     {
1522       // String or Name: check explicitly for Name, they can short-circuit
1523       // directly to unique non-index key path.
1524       IfBuilder not_symbol_if(this);
1525       not_symbol_if.If<HCompareNumericAndBranch>(
1526           instance_type,
1527           Add<HConstant>(SYMBOL_TYPE),
1528           Token::NE);
1529
1530       not_symbol_if.Then();
1531       {
1532         // String: check whether the String is a String of an index. If it is,
1533         // extract the index value from the hash.
1534         HValue* hash = Add<HLoadNamedField>(key, nullptr,
1535                                             HObjectAccess::ForNameHashField());
1536         HValue* not_index_mask = Add<HConstant>(static_cast<int>(
1537             String::kContainsCachedArrayIndexMask));
1538
1539         HValue* not_index_test = AddUncasted<HBitwise>(
1540             Token::BIT_AND, hash, not_index_mask);
1541
1542         IfBuilder string_index_if(this);
1543         string_index_if.If<HCompareNumericAndBranch>(not_index_test,
1544                                                      graph()->GetConstant0(),
1545                                                      Token::EQ);
1546         string_index_if.Then();
1547         {
1548           // String with index in hash: extract string and merge to index path.
1549           Push(BuildDecodeField<String::ArrayIndexValueBits>(hash));
1550         }
1551         string_index_if.Else();
1552         {
1553           // Key is a non-index String, check for uniqueness/internalization.
1554           // If it's not internalized yet, internalize it now.
1555           HValue* not_internalized_bit = AddUncasted<HBitwise>(
1556               Token::BIT_AND,
1557               instance_type,
1558               Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1559
1560           IfBuilder internalized(this);
1561           internalized.If<HCompareNumericAndBranch>(not_internalized_bit,
1562                                                     graph()->GetConstant0(),
1563                                                     Token::EQ);
1564           internalized.Then();
1565           Push(key);
1566
1567           internalized.Else();
1568           Add<HPushArguments>(key);
1569           HValue* intern_key = Add<HCallRuntime>(
1570               isolate()->factory()->empty_string(),
1571               Runtime::FunctionForId(Runtime::kInternalizeString), 1);
1572           Push(intern_key);
1573
1574           internalized.End();
1575           // Key guaranteed to be a unique string
1576         }
1577         string_index_if.JoinContinuation(join_continuation);
1578       }
1579       not_symbol_if.Else();
1580       {
1581         Push(key);  // Key is symbol
1582       }
1583       not_symbol_if.JoinContinuation(join_continuation);
1584     }
1585     not_string_or_name_if.JoinContinuation(join_continuation);
1586   }
1587   key_smi_if.JoinContinuation(join_continuation);
1588 }
1589
1590
1591 void HGraphBuilder::BuildNonGlobalObjectCheck(HValue* receiver) {
1592   // Get the the instance type of the receiver, and make sure that it is
1593   // not one of the global object types.
1594   HValue* map =
1595       Add<HLoadNamedField>(receiver, nullptr, HObjectAccess::ForMap());
1596   HValue* instance_type =
1597       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1598   STATIC_ASSERT(JS_BUILTINS_OBJECT_TYPE == JS_GLOBAL_OBJECT_TYPE + 1);
1599   HValue* min_global_type = Add<HConstant>(JS_GLOBAL_OBJECT_TYPE);
1600   HValue* max_global_type = Add<HConstant>(JS_BUILTINS_OBJECT_TYPE);
1601
1602   IfBuilder if_global_object(this);
1603   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1604                                                 max_global_type,
1605                                                 Token::LTE);
1606   if_global_object.And();
1607   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1608                                                 min_global_type,
1609                                                 Token::GTE);
1610   if_global_object.ThenDeopt(Deoptimizer::kReceiverWasAGlobalObject);
1611   if_global_object.End();
1612 }
1613
1614
1615 void HGraphBuilder::BuildTestForDictionaryProperties(
1616     HValue* object,
1617     HIfContinuation* continuation) {
1618   HValue* properties = Add<HLoadNamedField>(
1619       object, nullptr, HObjectAccess::ForPropertiesPointer());
1620   HValue* properties_map =
1621       Add<HLoadNamedField>(properties, nullptr, HObjectAccess::ForMap());
1622   HValue* hash_map = Add<HLoadRoot>(Heap::kHashTableMapRootIndex);
1623   IfBuilder builder(this);
1624   builder.If<HCompareObjectEqAndBranch>(properties_map, hash_map);
1625   builder.CaptureContinuation(continuation);
1626 }
1627
1628
1629 HValue* HGraphBuilder::BuildKeyedLookupCacheHash(HValue* object,
1630                                                  HValue* key) {
1631   // Load the map of the receiver, compute the keyed lookup cache hash
1632   // based on 32 bits of the map pointer and the string hash.
1633   HValue* object_map =
1634       Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMapAsInteger32());
1635   HValue* shifted_map = AddUncasted<HShr>(
1636       object_map, Add<HConstant>(KeyedLookupCache::kMapHashShift));
1637   HValue* string_hash =
1638       Add<HLoadNamedField>(key, nullptr, HObjectAccess::ForStringHashField());
1639   HValue* shifted_hash = AddUncasted<HShr>(
1640       string_hash, Add<HConstant>(String::kHashShift));
1641   HValue* xor_result = AddUncasted<HBitwise>(Token::BIT_XOR, shifted_map,
1642                                              shifted_hash);
1643   int mask = (KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask);
1644   return AddUncasted<HBitwise>(Token::BIT_AND, xor_result,
1645                                Add<HConstant>(mask));
1646 }
1647
1648
1649 HValue* HGraphBuilder::BuildElementIndexHash(HValue* index) {
1650   int32_t seed_value = static_cast<uint32_t>(isolate()->heap()->HashSeed());
1651   HValue* seed = Add<HConstant>(seed_value);
1652   HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, index, seed);
1653
1654   // hash = ~hash + (hash << 15);
1655   HValue* shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(15));
1656   HValue* not_hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash,
1657                                            graph()->GetConstantMinus1());
1658   hash = AddUncasted<HAdd>(shifted_hash, not_hash);
1659
1660   // hash = hash ^ (hash >> 12);
1661   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(12));
1662   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1663
1664   // hash = hash + (hash << 2);
1665   shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(2));
1666   hash = AddUncasted<HAdd>(hash, shifted_hash);
1667
1668   // hash = hash ^ (hash >> 4);
1669   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(4));
1670   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1671
1672   // hash = hash * 2057;
1673   hash = AddUncasted<HMul>(hash, Add<HConstant>(2057));
1674   hash->ClearFlag(HValue::kCanOverflow);
1675
1676   // hash = hash ^ (hash >> 16);
1677   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
1678   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1679 }
1680
1681
1682 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(
1683     HValue* receiver, HValue* elements, HValue* key, HValue* hash,
1684     LanguageMode language_mode) {
1685   HValue* capacity =
1686       Add<HLoadKeyed>(elements, Add<HConstant>(NameDictionary::kCapacityIndex),
1687                       nullptr, FAST_ELEMENTS);
1688
1689   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
1690   mask->ChangeRepresentation(Representation::Integer32());
1691   mask->ClearFlag(HValue::kCanOverflow);
1692
1693   HValue* entry = hash;
1694   HValue* count = graph()->GetConstant1();
1695   Push(entry);
1696   Push(count);
1697
1698   HIfContinuation return_or_loop_continuation(graph()->CreateBasicBlock(),
1699                                               graph()->CreateBasicBlock());
1700   HIfContinuation found_key_match_continuation(graph()->CreateBasicBlock(),
1701                                                graph()->CreateBasicBlock());
1702   LoopBuilder probe_loop(this);
1703   probe_loop.BeginBody(2);  // Drop entry, count from last environment to
1704                             // appease live range building without simulates.
1705
1706   count = Pop();
1707   entry = Pop();
1708   entry = AddUncasted<HBitwise>(Token::BIT_AND, entry, mask);
1709   int entry_size = SeededNumberDictionary::kEntrySize;
1710   HValue* base_index = AddUncasted<HMul>(entry, Add<HConstant>(entry_size));
1711   base_index->ClearFlag(HValue::kCanOverflow);
1712   int start_offset = SeededNumberDictionary::kElementsStartIndex;
1713   HValue* key_index =
1714       AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset));
1715   key_index->ClearFlag(HValue::kCanOverflow);
1716
1717   HValue* candidate_key =
1718       Add<HLoadKeyed>(elements, key_index, nullptr, FAST_ELEMENTS);
1719   IfBuilder if_undefined(this);
1720   if_undefined.If<HCompareObjectEqAndBranch>(candidate_key,
1721                                              graph()->GetConstantUndefined());
1722   if_undefined.Then();
1723   {
1724     // element == undefined means "not found". Call the runtime.
1725     // TODO(jkummerow): walk the prototype chain instead.
1726     Add<HPushArguments>(receiver, key);
1727     Push(Add<HCallRuntime>(
1728         isolate()->factory()->empty_string(),
1729         Runtime::FunctionForId(is_strong(language_mode)
1730                                    ? Runtime::kKeyedGetPropertyStrong
1731                                    : Runtime::kKeyedGetProperty),
1732         2));
1733   }
1734   if_undefined.Else();
1735   {
1736     IfBuilder if_match(this);
1737     if_match.If<HCompareObjectEqAndBranch>(candidate_key, key);
1738     if_match.Then();
1739     if_match.Else();
1740
1741     // Update non-internalized string in the dictionary with internalized key?
1742     IfBuilder if_update_with_internalized(this);
1743     HValue* smi_check =
1744         if_update_with_internalized.IfNot<HIsSmiAndBranch>(candidate_key);
1745     if_update_with_internalized.And();
1746     HValue* map = AddLoadMap(candidate_key, smi_check);
1747     HValue* instance_type =
1748         Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
1749     HValue* not_internalized_bit = AddUncasted<HBitwise>(
1750         Token::BIT_AND, instance_type,
1751         Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1752     if_update_with_internalized.If<HCompareNumericAndBranch>(
1753         not_internalized_bit, graph()->GetConstant0(), Token::NE);
1754     if_update_with_internalized.And();
1755     if_update_with_internalized.IfNot<HCompareObjectEqAndBranch>(
1756         candidate_key, graph()->GetConstantHole());
1757     if_update_with_internalized.AndIf<HStringCompareAndBranch>(candidate_key,
1758                                                                key, Token::EQ);
1759     if_update_with_internalized.Then();
1760     // Replace a key that is a non-internalized string by the equivalent
1761     // internalized string for faster further lookups.
1762     Add<HStoreKeyed>(elements, key_index, key, FAST_ELEMENTS);
1763     if_update_with_internalized.Else();
1764
1765     if_update_with_internalized.JoinContinuation(&found_key_match_continuation);
1766     if_match.JoinContinuation(&found_key_match_continuation);
1767
1768     IfBuilder found_key_match(this, &found_key_match_continuation);
1769     found_key_match.Then();
1770     // Key at current probe matches. Relevant bits in the |details| field must
1771     // be zero, otherwise the dictionary element requires special handling.
1772     HValue* details_index =
1773         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 2));
1774     details_index->ClearFlag(HValue::kCanOverflow);
1775     HValue* details =
1776         Add<HLoadKeyed>(elements, details_index, nullptr, FAST_ELEMENTS);
1777     int details_mask = PropertyDetails::TypeField::kMask;
1778     details = AddUncasted<HBitwise>(Token::BIT_AND, details,
1779                                     Add<HConstant>(details_mask));
1780     IfBuilder details_compare(this);
1781     details_compare.If<HCompareNumericAndBranch>(
1782         details, graph()->GetConstant0(), Token::EQ);
1783     details_compare.Then();
1784     HValue* result_index =
1785         AddUncasted<HAdd>(base_index, Add<HConstant>(start_offset + 1));
1786     result_index->ClearFlag(HValue::kCanOverflow);
1787     Push(Add<HLoadKeyed>(elements, result_index, nullptr, FAST_ELEMENTS));
1788     details_compare.Else();
1789     Add<HPushArguments>(receiver, key);
1790     Push(Add<HCallRuntime>(
1791         isolate()->factory()->empty_string(),
1792         Runtime::FunctionForId(is_strong(language_mode)
1793                                    ? Runtime::kKeyedGetPropertyStrong
1794                                    : Runtime::kKeyedGetProperty),
1795         2));
1796     details_compare.End();
1797
1798     found_key_match.Else();
1799     found_key_match.JoinContinuation(&return_or_loop_continuation);
1800   }
1801   if_undefined.JoinContinuation(&return_or_loop_continuation);
1802
1803   IfBuilder return_or_loop(this, &return_or_loop_continuation);
1804   return_or_loop.Then();
1805   probe_loop.Break();
1806
1807   return_or_loop.Else();
1808   entry = AddUncasted<HAdd>(entry, count);
1809   entry->ClearFlag(HValue::kCanOverflow);
1810   count = AddUncasted<HAdd>(count, graph()->GetConstant1());
1811   count->ClearFlag(HValue::kCanOverflow);
1812   Push(entry);
1813   Push(count);
1814
1815   probe_loop.EndBody();
1816
1817   return_or_loop.End();
1818
1819   return Pop();
1820 }
1821
1822
1823 HValue* HGraphBuilder::BuildRegExpConstructResult(HValue* length,
1824                                                   HValue* index,
1825                                                   HValue* input) {
1826   NoObservableSideEffectsScope scope(this);
1827   HConstant* max_length = Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1828   Add<HBoundsCheck>(length, max_length);
1829
1830   // Generate size calculation code here in order to make it dominate
1831   // the JSRegExpResult allocation.
1832   ElementsKind elements_kind = FAST_ELEMENTS;
1833   HValue* size = BuildCalculateElementsSize(elements_kind, length);
1834
1835   // Allocate the JSRegExpResult and the FixedArray in one step.
1836   HValue* result = Add<HAllocate>(
1837       Add<HConstant>(JSRegExpResult::kSize), HType::JSArray(),
1838       NOT_TENURED, JS_ARRAY_TYPE);
1839
1840   // Initialize the JSRegExpResult header.
1841   HValue* global_object = Add<HLoadNamedField>(
1842       context(), nullptr,
1843       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1844   HValue* native_context = Add<HLoadNamedField>(
1845       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
1846   Add<HStoreNamedField>(
1847       result, HObjectAccess::ForMap(),
1848       Add<HLoadNamedField>(
1849           native_context, nullptr,
1850           HObjectAccess::ForContextSlot(Context::REGEXP_RESULT_MAP_INDEX)));
1851   HConstant* empty_fixed_array =
1852       Add<HConstant>(isolate()->factory()->empty_fixed_array());
1853   Add<HStoreNamedField>(
1854       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
1855       empty_fixed_array);
1856   Add<HStoreNamedField>(
1857       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1858       empty_fixed_array);
1859   Add<HStoreNamedField>(
1860       result, HObjectAccess::ForJSArrayOffset(JSArray::kLengthOffset), length);
1861
1862   // Initialize the additional fields.
1863   Add<HStoreNamedField>(
1864       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kIndexOffset),
1865       index);
1866   Add<HStoreNamedField>(
1867       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kInputOffset),
1868       input);
1869
1870   // Allocate and initialize the elements header.
1871   HAllocate* elements = BuildAllocateElements(elements_kind, size);
1872   BuildInitializeElementsHeader(elements, elements_kind, length);
1873
1874   if (!elements->has_size_upper_bound()) {
1875     HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
1876         elements_kind, max_length->Integer32Value());
1877     elements->set_size_upper_bound(size_in_bytes_upper_bound);
1878   }
1879
1880   Add<HStoreNamedField>(
1881       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1882       elements);
1883
1884   // Initialize the elements contents with undefined.
1885   BuildFillElementsWithValue(
1886       elements, elements_kind, graph()->GetConstant0(), length,
1887       graph()->GetConstantUndefined());
1888
1889   return result;
1890 }
1891
1892
1893 HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
1894   NoObservableSideEffectsScope scope(this);
1895
1896   // Convert constant numbers at compile time.
1897   if (object->IsConstant() && HConstant::cast(object)->HasNumberValue()) {
1898     Handle<Object> number = HConstant::cast(object)->handle(isolate());
1899     Handle<String> result = isolate()->factory()->NumberToString(number);
1900     return Add<HConstant>(result);
1901   }
1902
1903   // Create a joinable continuation.
1904   HIfContinuation found(graph()->CreateBasicBlock(),
1905                         graph()->CreateBasicBlock());
1906
1907   // Load the number string cache.
1908   HValue* number_string_cache =
1909       Add<HLoadRoot>(Heap::kNumberStringCacheRootIndex);
1910
1911   // Make the hash mask from the length of the number string cache. It
1912   // contains two elements (number and string) for each cache entry.
1913   HValue* mask = AddLoadFixedArrayLength(number_string_cache);
1914   mask->set_type(HType::Smi());
1915   mask = AddUncasted<HSar>(mask, graph()->GetConstant1());
1916   mask = AddUncasted<HSub>(mask, graph()->GetConstant1());
1917
1918   // Check whether object is a smi.
1919   IfBuilder if_objectissmi(this);
1920   if_objectissmi.If<HIsSmiAndBranch>(object);
1921   if_objectissmi.Then();
1922   {
1923     // Compute hash for smi similar to smi_get_hash().
1924     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
1925
1926     // Load the key.
1927     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1928     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1929                                   FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1930
1931     // Check if object == key.
1932     IfBuilder if_objectiskey(this);
1933     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
1934     if_objectiskey.Then();
1935     {
1936       // Make the key_index available.
1937       Push(key_index);
1938     }
1939     if_objectiskey.JoinContinuation(&found);
1940   }
1941   if_objectissmi.Else();
1942   {
1943     if (type->Is(Type::SignedSmall())) {
1944       if_objectissmi.Deopt(Deoptimizer::kExpectedSmi);
1945     } else {
1946       // Check if the object is a heap number.
1947       IfBuilder if_objectisnumber(this);
1948       HValue* objectisnumber = if_objectisnumber.If<HCompareMap>(
1949           object, isolate()->factory()->heap_number_map());
1950       if_objectisnumber.Then();
1951       {
1952         // Compute hash for heap number similar to double_get_hash().
1953         HValue* low = Add<HLoadNamedField>(
1954             object, objectisnumber,
1955             HObjectAccess::ForHeapNumberValueLowestBits());
1956         HValue* high = Add<HLoadNamedField>(
1957             object, objectisnumber,
1958             HObjectAccess::ForHeapNumberValueHighestBits());
1959         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
1960         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
1961
1962         // Load the key.
1963         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1964         HValue* key = Add<HLoadKeyed>(number_string_cache, key_index, nullptr,
1965                                       FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1966
1967         // Check if the key is a heap number and compare it with the object.
1968         IfBuilder if_keyisnotsmi(this);
1969         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
1970         if_keyisnotsmi.Then();
1971         {
1972           IfBuilder if_keyisheapnumber(this);
1973           if_keyisheapnumber.If<HCompareMap>(
1974               key, isolate()->factory()->heap_number_map());
1975           if_keyisheapnumber.Then();
1976           {
1977             // Check if values of key and object match.
1978             IfBuilder if_keyeqobject(this);
1979             if_keyeqobject.If<HCompareNumericAndBranch>(
1980                 Add<HLoadNamedField>(key, keyisnotsmi,
1981                                      HObjectAccess::ForHeapNumberValue()),
1982                 Add<HLoadNamedField>(object, objectisnumber,
1983                                      HObjectAccess::ForHeapNumberValue()),
1984                 Token::EQ);
1985             if_keyeqobject.Then();
1986             {
1987               // Make the key_index available.
1988               Push(key_index);
1989             }
1990             if_keyeqobject.JoinContinuation(&found);
1991           }
1992           if_keyisheapnumber.JoinContinuation(&found);
1993         }
1994         if_keyisnotsmi.JoinContinuation(&found);
1995       }
1996       if_objectisnumber.Else();
1997       {
1998         if (type->Is(Type::Number())) {
1999           if_objectisnumber.Deopt(Deoptimizer::kExpectedHeapNumber);
2000         }
2001       }
2002       if_objectisnumber.JoinContinuation(&found);
2003     }
2004   }
2005   if_objectissmi.JoinContinuation(&found);
2006
2007   // Check for cache hit.
2008   IfBuilder if_found(this, &found);
2009   if_found.Then();
2010   {
2011     // Count number to string operation in native code.
2012     AddIncrementCounter(isolate()->counters()->number_to_string_native());
2013
2014     // Load the value in case of cache hit.
2015     HValue* key_index = Pop();
2016     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
2017     Push(Add<HLoadKeyed>(number_string_cache, value_index, nullptr,
2018                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
2019   }
2020   if_found.Else();
2021   {
2022     // Cache miss, fallback to runtime.
2023     Add<HPushArguments>(object);
2024     Push(Add<HCallRuntime>(
2025             isolate()->factory()->empty_string(),
2026             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
2027             1));
2028   }
2029   if_found.End();
2030
2031   return Pop();
2032 }
2033
2034
2035 HAllocate* HGraphBuilder::BuildAllocate(
2036     HValue* object_size,
2037     HType type,
2038     InstanceType instance_type,
2039     HAllocationMode allocation_mode) {
2040   // Compute the effective allocation size.
2041   HValue* size = object_size;
2042   if (allocation_mode.CreateAllocationMementos()) {
2043     size = AddUncasted<HAdd>(size, Add<HConstant>(AllocationMemento::kSize));
2044     size->ClearFlag(HValue::kCanOverflow);
2045   }
2046
2047   // Perform the actual allocation.
2048   HAllocate* object = Add<HAllocate>(
2049       size, type, allocation_mode.GetPretenureMode(),
2050       instance_type, allocation_mode.feedback_site());
2051
2052   // Setup the allocation memento.
2053   if (allocation_mode.CreateAllocationMementos()) {
2054     BuildCreateAllocationMemento(
2055         object, object_size, allocation_mode.current_site());
2056   }
2057
2058   return object;
2059 }
2060
2061
2062 HValue* HGraphBuilder::BuildAddStringLengths(HValue* left_length,
2063                                              HValue* right_length) {
2064   // Compute the combined string length and check against max string length.
2065   HValue* length = AddUncasted<HAdd>(left_length, right_length);
2066   // Check that length <= kMaxLength <=> length < MaxLength + 1.
2067   HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
2068   Add<HBoundsCheck>(length, max_length);
2069   return length;
2070 }
2071
2072
2073 HValue* HGraphBuilder::BuildCreateConsString(
2074     HValue* length,
2075     HValue* left,
2076     HValue* right,
2077     HAllocationMode allocation_mode) {
2078   // Determine the string instance types.
2079   HInstruction* left_instance_type = AddLoadStringInstanceType(left);
2080   HInstruction* right_instance_type = AddLoadStringInstanceType(right);
2081
2082   // Allocate the cons string object. HAllocate does not care whether we
2083   // pass CONS_STRING_TYPE or CONS_ONE_BYTE_STRING_TYPE here, so we just use
2084   // CONS_STRING_TYPE here. Below we decide whether the cons string is
2085   // one-byte or two-byte and set the appropriate map.
2086   DCHECK(HAllocate::CompatibleInstanceTypes(CONS_STRING_TYPE,
2087                                             CONS_ONE_BYTE_STRING_TYPE));
2088   HAllocate* result = BuildAllocate(Add<HConstant>(ConsString::kSize),
2089                                     HType::String(), CONS_STRING_TYPE,
2090                                     allocation_mode);
2091
2092   // Compute intersection and difference of instance types.
2093   HValue* anded_instance_types = AddUncasted<HBitwise>(
2094       Token::BIT_AND, left_instance_type, right_instance_type);
2095   HValue* xored_instance_types = AddUncasted<HBitwise>(
2096       Token::BIT_XOR, left_instance_type, right_instance_type);
2097
2098   // We create a one-byte cons string if
2099   // 1. both strings are one-byte, or
2100   // 2. at least one of the strings is two-byte, but happens to contain only
2101   //    one-byte characters.
2102   // To do this, we check
2103   // 1. if both strings are one-byte, or if the one-byte data hint is set in
2104   //    both strings, or
2105   // 2. if one of the strings has the one-byte data hint set and the other
2106   //    string is one-byte.
2107   IfBuilder if_onebyte(this);
2108   STATIC_ASSERT(kOneByteStringTag != 0);
2109   STATIC_ASSERT(kOneByteDataHintMask != 0);
2110   if_onebyte.If<HCompareNumericAndBranch>(
2111       AddUncasted<HBitwise>(
2112           Token::BIT_AND, anded_instance_types,
2113           Add<HConstant>(static_cast<int32_t>(
2114                   kStringEncodingMask | kOneByteDataHintMask))),
2115       graph()->GetConstant0(), Token::NE);
2116   if_onebyte.Or();
2117   STATIC_ASSERT(kOneByteStringTag != 0 &&
2118                 kOneByteDataHintTag != 0 &&
2119                 kOneByteDataHintTag != kOneByteStringTag);
2120   if_onebyte.If<HCompareNumericAndBranch>(
2121       AddUncasted<HBitwise>(
2122           Token::BIT_AND, xored_instance_types,
2123           Add<HConstant>(static_cast<int32_t>(
2124                   kOneByteStringTag | kOneByteDataHintTag))),
2125       Add<HConstant>(static_cast<int32_t>(
2126               kOneByteStringTag | kOneByteDataHintTag)), Token::EQ);
2127   if_onebyte.Then();
2128   {
2129     // We can safely skip the write barrier for storing the map here.
2130     Add<HStoreNamedField>(
2131         result, HObjectAccess::ForMap(),
2132         Add<HConstant>(isolate()->factory()->cons_one_byte_string_map()));
2133   }
2134   if_onebyte.Else();
2135   {
2136     // We can safely skip the write barrier for storing the map here.
2137     Add<HStoreNamedField>(
2138         result, HObjectAccess::ForMap(),
2139         Add<HConstant>(isolate()->factory()->cons_string_map()));
2140   }
2141   if_onebyte.End();
2142
2143   // Initialize the cons string fields.
2144   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2145                         Add<HConstant>(String::kEmptyHashField));
2146   Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2147   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
2148   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
2149
2150   // Count the native string addition.
2151   AddIncrementCounter(isolate()->counters()->string_add_native());
2152
2153   return result;
2154 }
2155
2156
2157 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
2158                                             HValue* src_offset,
2159                                             String::Encoding src_encoding,
2160                                             HValue* dst,
2161                                             HValue* dst_offset,
2162                                             String::Encoding dst_encoding,
2163                                             HValue* length) {
2164   DCHECK(dst_encoding != String::ONE_BYTE_ENCODING ||
2165          src_encoding == String::ONE_BYTE_ENCODING);
2166   LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
2167   HValue* index = loop.BeginBody(graph()->GetConstant0(), length, Token::LT);
2168   {
2169     HValue* src_index = AddUncasted<HAdd>(src_offset, index);
2170     HValue* value =
2171         AddUncasted<HSeqStringGetChar>(src_encoding, src, src_index);
2172     HValue* dst_index = AddUncasted<HAdd>(dst_offset, index);
2173     Add<HSeqStringSetChar>(dst_encoding, dst, dst_index, value);
2174   }
2175   loop.EndBody();
2176 }
2177
2178
2179 HValue* HGraphBuilder::BuildObjectSizeAlignment(
2180     HValue* unaligned_size, int header_size) {
2181   DCHECK((header_size & kObjectAlignmentMask) == 0);
2182   HValue* size = AddUncasted<HAdd>(
2183       unaligned_size, Add<HConstant>(static_cast<int32_t>(
2184           header_size + kObjectAlignmentMask)));
2185   size->ClearFlag(HValue::kCanOverflow);
2186   return AddUncasted<HBitwise>(
2187       Token::BIT_AND, size, Add<HConstant>(static_cast<int32_t>(
2188           ~kObjectAlignmentMask)));
2189 }
2190
2191
2192 HValue* HGraphBuilder::BuildUncheckedStringAdd(
2193     HValue* left,
2194     HValue* right,
2195     HAllocationMode allocation_mode) {
2196   // Determine the string lengths.
2197   HValue* left_length = AddLoadStringLength(left);
2198   HValue* right_length = AddLoadStringLength(right);
2199
2200   // Compute the combined string length.
2201   HValue* length = BuildAddStringLengths(left_length, right_length);
2202
2203   // Do some manual constant folding here.
2204   if (left_length->IsConstant()) {
2205     HConstant* c_left_length = HConstant::cast(left_length);
2206     DCHECK_NE(0, c_left_length->Integer32Value());
2207     if (c_left_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2208       // The right string contains at least one character.
2209       return BuildCreateConsString(length, left, right, allocation_mode);
2210     }
2211   } else if (right_length->IsConstant()) {
2212     HConstant* c_right_length = HConstant::cast(right_length);
2213     DCHECK_NE(0, c_right_length->Integer32Value());
2214     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2215       // The left string contains at least one character.
2216       return BuildCreateConsString(length, left, right, allocation_mode);
2217     }
2218   }
2219
2220   // Check if we should create a cons string.
2221   IfBuilder if_createcons(this);
2222   if_createcons.If<HCompareNumericAndBranch>(
2223       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
2224   if_createcons.Then();
2225   {
2226     // Create a cons string.
2227     Push(BuildCreateConsString(length, left, right, allocation_mode));
2228   }
2229   if_createcons.Else();
2230   {
2231     // Determine the string instance types.
2232     HValue* left_instance_type = AddLoadStringInstanceType(left);
2233     HValue* right_instance_type = AddLoadStringInstanceType(right);
2234
2235     // Compute union and difference of instance types.
2236     HValue* ored_instance_types = AddUncasted<HBitwise>(
2237         Token::BIT_OR, left_instance_type, right_instance_type);
2238     HValue* xored_instance_types = AddUncasted<HBitwise>(
2239         Token::BIT_XOR, left_instance_type, right_instance_type);
2240
2241     // Check if both strings have the same encoding and both are
2242     // sequential.
2243     IfBuilder if_sameencodingandsequential(this);
2244     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2245         AddUncasted<HBitwise>(
2246             Token::BIT_AND, xored_instance_types,
2247             Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2248         graph()->GetConstant0(), Token::EQ);
2249     if_sameencodingandsequential.And();
2250     STATIC_ASSERT(kSeqStringTag == 0);
2251     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2252         AddUncasted<HBitwise>(
2253             Token::BIT_AND, ored_instance_types,
2254             Add<HConstant>(static_cast<int32_t>(kStringRepresentationMask))),
2255         graph()->GetConstant0(), Token::EQ);
2256     if_sameencodingandsequential.Then();
2257     {
2258       HConstant* string_map =
2259           Add<HConstant>(isolate()->factory()->string_map());
2260       HConstant* one_byte_string_map =
2261           Add<HConstant>(isolate()->factory()->one_byte_string_map());
2262
2263       // Determine map and size depending on whether result is one-byte string.
2264       IfBuilder if_onebyte(this);
2265       STATIC_ASSERT(kOneByteStringTag != 0);
2266       if_onebyte.If<HCompareNumericAndBranch>(
2267           AddUncasted<HBitwise>(
2268               Token::BIT_AND, ored_instance_types,
2269               Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2270           graph()->GetConstant0(), Token::NE);
2271       if_onebyte.Then();
2272       {
2273         // Allocate sequential one-byte string object.
2274         Push(length);
2275         Push(one_byte_string_map);
2276       }
2277       if_onebyte.Else();
2278       {
2279         // Allocate sequential two-byte string object.
2280         HValue* size = AddUncasted<HShl>(length, graph()->GetConstant1());
2281         size->ClearFlag(HValue::kCanOverflow);
2282         size->SetFlag(HValue::kUint32);
2283         Push(size);
2284         Push(string_map);
2285       }
2286       if_onebyte.End();
2287       HValue* map = Pop();
2288
2289       // Calculate the number of bytes needed for the characters in the
2290       // string while observing object alignment.
2291       STATIC_ASSERT((SeqString::kHeaderSize & kObjectAlignmentMask) == 0);
2292       HValue* size = BuildObjectSizeAlignment(Pop(), SeqString::kHeaderSize);
2293
2294       // Allocate the string object. HAllocate does not care whether we pass
2295       // STRING_TYPE or ONE_BYTE_STRING_TYPE here, so we just use STRING_TYPE.
2296       HAllocate* result = BuildAllocate(
2297           size, HType::String(), STRING_TYPE, allocation_mode);
2298       Add<HStoreNamedField>(result, HObjectAccess::ForMap(), map);
2299
2300       // Initialize the string fields.
2301       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2302                             Add<HConstant>(String::kEmptyHashField));
2303       Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2304
2305       // Copy characters to the result string.
2306       IfBuilder if_twobyte(this);
2307       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
2308       if_twobyte.Then();
2309       {
2310         // Copy characters from the left string.
2311         BuildCopySeqStringChars(
2312             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2313             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2314             left_length);
2315
2316         // Copy characters from the right string.
2317         BuildCopySeqStringChars(
2318             right, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2319             result, left_length, String::TWO_BYTE_ENCODING,
2320             right_length);
2321       }
2322       if_twobyte.Else();
2323       {
2324         // Copy characters from the left string.
2325         BuildCopySeqStringChars(
2326             left, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2327             result, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2328             left_length);
2329
2330         // Copy characters from the right string.
2331         BuildCopySeqStringChars(
2332             right, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2333             result, left_length, String::ONE_BYTE_ENCODING,
2334             right_length);
2335       }
2336       if_twobyte.End();
2337
2338       // Count the native string addition.
2339       AddIncrementCounter(isolate()->counters()->string_add_native());
2340
2341       // Return the sequential string.
2342       Push(result);
2343     }
2344     if_sameencodingandsequential.Else();
2345     {
2346       // Fallback to the runtime to add the two strings.
2347       Add<HPushArguments>(left, right);
2348       Push(Add<HCallRuntime>(isolate()->factory()->empty_string(),
2349                              Runtime::FunctionForId(Runtime::kStringAddRT), 2));
2350     }
2351     if_sameencodingandsequential.End();
2352   }
2353   if_createcons.End();
2354
2355   return Pop();
2356 }
2357
2358
2359 HValue* HGraphBuilder::BuildStringAdd(
2360     HValue* left,
2361     HValue* right,
2362     HAllocationMode allocation_mode) {
2363   NoObservableSideEffectsScope no_effects(this);
2364
2365   // Determine string lengths.
2366   HValue* left_length = AddLoadStringLength(left);
2367   HValue* right_length = AddLoadStringLength(right);
2368
2369   // Check if left string is empty.
2370   IfBuilder if_leftempty(this);
2371   if_leftempty.If<HCompareNumericAndBranch>(
2372       left_length, graph()->GetConstant0(), Token::EQ);
2373   if_leftempty.Then();
2374   {
2375     // Count the native string addition.
2376     AddIncrementCounter(isolate()->counters()->string_add_native());
2377
2378     // Just return the right string.
2379     Push(right);
2380   }
2381   if_leftempty.Else();
2382   {
2383     // Check if right string is empty.
2384     IfBuilder if_rightempty(this);
2385     if_rightempty.If<HCompareNumericAndBranch>(
2386         right_length, graph()->GetConstant0(), Token::EQ);
2387     if_rightempty.Then();
2388     {
2389       // Count the native string addition.
2390       AddIncrementCounter(isolate()->counters()->string_add_native());
2391
2392       // Just return the left string.
2393       Push(left);
2394     }
2395     if_rightempty.Else();
2396     {
2397       // Add the two non-empty strings.
2398       Push(BuildUncheckedStringAdd(left, right, allocation_mode));
2399     }
2400     if_rightempty.End();
2401   }
2402   if_leftempty.End();
2403
2404   return Pop();
2405 }
2406
2407
2408 HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
2409     HValue* checked_object,
2410     HValue* key,
2411     HValue* val,
2412     bool is_js_array,
2413     ElementsKind elements_kind,
2414     PropertyAccessType access_type,
2415     LoadKeyedHoleMode load_mode,
2416     KeyedAccessStoreMode store_mode) {
2417   DCHECK(top_info()->IsStub() || checked_object->IsCompareMap() ||
2418          checked_object->IsCheckMaps());
2419   DCHECK((!IsExternalArrayElementsKind(elements_kind) &&
2420               !IsFixedTypedArrayElementsKind(elements_kind)) ||
2421          !is_js_array);
2422   // No GVNFlag is necessary for ElementsKind if there is an explicit dependency
2423   // on a HElementsTransition instruction. The flag can also be removed if the
2424   // map to check has FAST_HOLEY_ELEMENTS, since there can be no further
2425   // ElementsKind transitions. Finally, the dependency can be removed for stores
2426   // for FAST_ELEMENTS, since a transition to HOLEY elements won't change the
2427   // generated store code.
2428   if ((elements_kind == FAST_HOLEY_ELEMENTS) ||
2429       (elements_kind == FAST_ELEMENTS && access_type == STORE)) {
2430     checked_object->ClearDependsOnFlag(kElementsKind);
2431   }
2432
2433   bool fast_smi_only_elements = IsFastSmiElementsKind(elements_kind);
2434   bool fast_elements = IsFastObjectElementsKind(elements_kind);
2435   HValue* elements = AddLoadElements(checked_object);
2436   if (access_type == STORE && (fast_elements || fast_smi_only_elements) &&
2437       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
2438     HCheckMaps* check_cow_map = Add<HCheckMaps>(
2439         elements, isolate()->factory()->fixed_array_map());
2440     check_cow_map->ClearDependsOnFlag(kElementsKind);
2441   }
2442   HInstruction* length = NULL;
2443   if (is_js_array) {
2444     length = Add<HLoadNamedField>(
2445         checked_object->ActualValue(), checked_object,
2446         HObjectAccess::ForArrayLength(elements_kind));
2447   } else {
2448     length = AddLoadFixedArrayLength(elements);
2449   }
2450   length->set_type(HType::Smi());
2451   HValue* checked_key = NULL;
2452   if (IsExternalArrayElementsKind(elements_kind) ||
2453       IsFixedTypedArrayElementsKind(elements_kind)) {
2454     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
2455
2456     HValue* backing_store;
2457     if (IsExternalArrayElementsKind(elements_kind)) {
2458       backing_store = Add<HLoadNamedField>(
2459           elements, nullptr, HObjectAccess::ForExternalArrayExternalPointer());
2460     } else {
2461       HValue* external_pointer = Add<HLoadNamedField>(
2462           elements, nullptr,
2463           HObjectAccess::ForFixedTypedArrayBaseExternalPointer());
2464       HValue* base_pointer = Add<HLoadNamedField>(
2465           elements, nullptr,
2466           HObjectAccess::ForFixedTypedArrayBaseBasePointer());
2467       backing_store = AddUncasted<HAdd>(external_pointer, base_pointer,
2468                                         Strength::WEAK, AddOfExternalAndTagged);
2469     }
2470     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
2471       NoObservableSideEffectsScope no_effects(this);
2472       IfBuilder length_checker(this);
2473       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
2474       length_checker.Then();
2475       IfBuilder negative_checker(this);
2476       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
2477           key, graph()->GetConstant0(), Token::GTE);
2478       negative_checker.Then();
2479       HInstruction* result = AddElementAccess(
2480           backing_store, key, val, bounds_check, elements_kind, access_type);
2481       negative_checker.ElseDeopt(Deoptimizer::kNegativeKeyEncountered);
2482       negative_checker.End();
2483       length_checker.End();
2484       return result;
2485     } else {
2486       DCHECK(store_mode == STANDARD_STORE);
2487       checked_key = Add<HBoundsCheck>(key, length);
2488       return AddElementAccess(
2489           backing_store, checked_key, val,
2490           checked_object, elements_kind, access_type);
2491     }
2492   }
2493   DCHECK(fast_smi_only_elements ||
2494          fast_elements ||
2495          IsFastDoubleElementsKind(elements_kind));
2496
2497   // In case val is stored into a fast smi array, assure that the value is a smi
2498   // before manipulating the backing store. Otherwise the actual store may
2499   // deopt, leaving the backing store in an invalid state.
2500   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
2501       !val->type().IsSmi()) {
2502     val = AddUncasted<HForceRepresentation>(val, Representation::Smi());
2503   }
2504
2505   if (IsGrowStoreMode(store_mode)) {
2506     NoObservableSideEffectsScope no_effects(this);
2507     Representation representation = HStoreKeyed::RequiredValueRepresentation(
2508         elements_kind, STORE_TO_INITIALIZED_ENTRY);
2509     val = AddUncasted<HForceRepresentation>(val, representation);
2510     elements = BuildCheckForCapacityGrow(checked_object, elements,
2511                                          elements_kind, length, key,
2512                                          is_js_array, access_type);
2513     checked_key = key;
2514   } else {
2515     checked_key = Add<HBoundsCheck>(key, length);
2516
2517     if (access_type == STORE && (fast_elements || fast_smi_only_elements)) {
2518       if (store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
2519         NoObservableSideEffectsScope no_effects(this);
2520         elements = BuildCopyElementsOnWrite(checked_object, elements,
2521                                             elements_kind, length);
2522       } else {
2523         HCheckMaps* check_cow_map = Add<HCheckMaps>(
2524             elements, isolate()->factory()->fixed_array_map());
2525         check_cow_map->ClearDependsOnFlag(kElementsKind);
2526       }
2527     }
2528   }
2529   return AddElementAccess(elements, checked_key, val, checked_object,
2530                           elements_kind, access_type, load_mode);
2531 }
2532
2533
2534 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
2535     JSArrayBuilder* array_builder,
2536     HValue* length_argument) {
2537   if (length_argument->IsConstant() &&
2538       HConstant::cast(length_argument)->HasSmiValue()) {
2539     int array_length = HConstant::cast(length_argument)->Integer32Value();
2540     if (array_length == 0) {
2541       return array_builder->AllocateEmptyArray();
2542     } else {
2543       return array_builder->AllocateArray(length_argument,
2544                                           array_length,
2545                                           length_argument);
2546     }
2547   }
2548
2549   HValue* constant_zero = graph()->GetConstant0();
2550   HConstant* max_alloc_length =
2551       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
2552   HInstruction* checked_length = Add<HBoundsCheck>(length_argument,
2553                                                    max_alloc_length);
2554   IfBuilder if_builder(this);
2555   if_builder.If<HCompareNumericAndBranch>(checked_length, constant_zero,
2556                                           Token::EQ);
2557   if_builder.Then();
2558   const int initial_capacity = JSArray::kPreallocatedArrayElements;
2559   HConstant* initial_capacity_node = Add<HConstant>(initial_capacity);
2560   Push(initial_capacity_node);  // capacity
2561   Push(constant_zero);          // length
2562   if_builder.Else();
2563   if (!(top_info()->IsStub()) &&
2564       IsFastPackedElementsKind(array_builder->kind())) {
2565     // We'll come back later with better (holey) feedback.
2566     if_builder.Deopt(
2567         Deoptimizer::kHoleyArrayDespitePackedElements_kindFeedback);
2568   } else {
2569     Push(checked_length);         // capacity
2570     Push(checked_length);         // length
2571   }
2572   if_builder.End();
2573
2574   // Figure out total size
2575   HValue* length = Pop();
2576   HValue* capacity = Pop();
2577   return array_builder->AllocateArray(capacity, max_alloc_length, length);
2578 }
2579
2580
2581 HValue* HGraphBuilder::BuildCalculateElementsSize(ElementsKind kind,
2582                                                   HValue* capacity) {
2583   int elements_size = IsFastDoubleElementsKind(kind)
2584       ? kDoubleSize
2585       : kPointerSize;
2586
2587   HConstant* elements_size_value = Add<HConstant>(elements_size);
2588   HInstruction* mul =
2589       HMul::NewImul(isolate(), zone(), context(), capacity->ActualValue(),
2590                     elements_size_value);
2591   AddInstruction(mul);
2592   mul->ClearFlag(HValue::kCanOverflow);
2593
2594   STATIC_ASSERT(FixedDoubleArray::kHeaderSize == FixedArray::kHeaderSize);
2595
2596   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
2597   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
2598   total_size->ClearFlag(HValue::kCanOverflow);
2599   return total_size;
2600 }
2601
2602
2603 HAllocate* HGraphBuilder::AllocateJSArrayObject(AllocationSiteMode mode) {
2604   int base_size = JSArray::kSize;
2605   if (mode == TRACK_ALLOCATION_SITE) {
2606     base_size += AllocationMemento::kSize;
2607   }
2608   HConstant* size_in_bytes = Add<HConstant>(base_size);
2609   return Add<HAllocate>(
2610       size_in_bytes, HType::JSArray(), NOT_TENURED, JS_OBJECT_TYPE);
2611 }
2612
2613
2614 HConstant* HGraphBuilder::EstablishElementsAllocationSize(
2615     ElementsKind kind,
2616     int capacity) {
2617   int base_size = IsFastDoubleElementsKind(kind)
2618       ? FixedDoubleArray::SizeFor(capacity)
2619       : FixedArray::SizeFor(capacity);
2620
2621   return Add<HConstant>(base_size);
2622 }
2623
2624
2625 HAllocate* HGraphBuilder::BuildAllocateElements(ElementsKind kind,
2626                                                 HValue* size_in_bytes) {
2627   InstanceType instance_type = IsFastDoubleElementsKind(kind)
2628       ? FIXED_DOUBLE_ARRAY_TYPE
2629       : FIXED_ARRAY_TYPE;
2630
2631   return Add<HAllocate>(size_in_bytes, HType::HeapObject(), NOT_TENURED,
2632                         instance_type);
2633 }
2634
2635
2636 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
2637                                                   ElementsKind kind,
2638                                                   HValue* capacity) {
2639   Factory* factory = isolate()->factory();
2640   Handle<Map> map = IsFastDoubleElementsKind(kind)
2641       ? factory->fixed_double_array_map()
2642       : factory->fixed_array_map();
2643
2644   Add<HStoreNamedField>(elements, HObjectAccess::ForMap(), Add<HConstant>(map));
2645   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
2646                         capacity);
2647 }
2648
2649
2650 HValue* HGraphBuilder::BuildAllocateAndInitializeArray(ElementsKind kind,
2651                                                        HValue* capacity) {
2652   // The HForceRepresentation is to prevent possible deopt on int-smi
2653   // conversion after allocation but before the new object fields are set.
2654   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
2655   HValue* size_in_bytes = BuildCalculateElementsSize(kind, capacity);
2656   HValue* new_array = BuildAllocateElements(kind, size_in_bytes);
2657   BuildInitializeElementsHeader(new_array, kind, capacity);
2658   return new_array;
2659 }
2660
2661
2662 void HGraphBuilder::BuildJSArrayHeader(HValue* array,
2663                                        HValue* array_map,
2664                                        HValue* elements,
2665                                        AllocationSiteMode mode,
2666                                        ElementsKind elements_kind,
2667                                        HValue* allocation_site_payload,
2668                                        HValue* length_field) {
2669   Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
2670
2671   HConstant* empty_fixed_array =
2672     Add<HConstant>(isolate()->factory()->empty_fixed_array());
2673
2674   Add<HStoreNamedField>(
2675       array, HObjectAccess::ForPropertiesPointer(), empty_fixed_array);
2676
2677   Add<HStoreNamedField>(
2678       array, HObjectAccess::ForElementsPointer(),
2679       elements != NULL ? elements : empty_fixed_array);
2680
2681   Add<HStoreNamedField>(
2682       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
2683
2684   if (mode == TRACK_ALLOCATION_SITE) {
2685     BuildCreateAllocationMemento(
2686         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
2687   }
2688 }
2689
2690
2691 HInstruction* HGraphBuilder::AddElementAccess(
2692     HValue* elements,
2693     HValue* checked_key,
2694     HValue* val,
2695     HValue* dependency,
2696     ElementsKind elements_kind,
2697     PropertyAccessType access_type,
2698     LoadKeyedHoleMode load_mode) {
2699   if (access_type == STORE) {
2700     DCHECK(val != NULL);
2701     if (elements_kind == EXTERNAL_UINT8_CLAMPED_ELEMENTS ||
2702         elements_kind == UINT8_CLAMPED_ELEMENTS) {
2703       val = Add<HClampToUint8>(val);
2704     }
2705     return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
2706                             STORE_TO_INITIALIZED_ENTRY);
2707   }
2708
2709   DCHECK(access_type == LOAD);
2710   DCHECK(val == NULL);
2711   HLoadKeyed* load = Add<HLoadKeyed>(
2712       elements, checked_key, dependency, elements_kind, load_mode);
2713   if (elements_kind == EXTERNAL_UINT32_ELEMENTS ||
2714       elements_kind == UINT32_ELEMENTS) {
2715     graph()->RecordUint32Instruction(load);
2716   }
2717   return load;
2718 }
2719
2720
2721 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
2722                                            HValue* dependency) {
2723   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
2724 }
2725
2726
2727 HLoadNamedField* HGraphBuilder::AddLoadElements(HValue* object,
2728                                                 HValue* dependency) {
2729   return Add<HLoadNamedField>(
2730       object, dependency, HObjectAccess::ForElementsPointer());
2731 }
2732
2733
2734 HLoadNamedField* HGraphBuilder::AddLoadFixedArrayLength(
2735     HValue* array,
2736     HValue* dependency) {
2737   return Add<HLoadNamedField>(
2738       array, dependency, HObjectAccess::ForFixedArrayLength());
2739 }
2740
2741
2742 HLoadNamedField* HGraphBuilder::AddLoadArrayLength(HValue* array,
2743                                                    ElementsKind kind,
2744                                                    HValue* dependency) {
2745   return Add<HLoadNamedField>(
2746       array, dependency, HObjectAccess::ForArrayLength(kind));
2747 }
2748
2749
2750 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* old_capacity) {
2751   HValue* half_old_capacity = AddUncasted<HShr>(old_capacity,
2752                                                 graph_->GetConstant1());
2753
2754   HValue* new_capacity = AddUncasted<HAdd>(half_old_capacity, old_capacity);
2755   new_capacity->ClearFlag(HValue::kCanOverflow);
2756
2757   HValue* min_growth = Add<HConstant>(16);
2758
2759   new_capacity = AddUncasted<HAdd>(new_capacity, min_growth);
2760   new_capacity->ClearFlag(HValue::kCanOverflow);
2761
2762   return new_capacity;
2763 }
2764
2765
2766 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
2767                                                  HValue* elements,
2768                                                  ElementsKind kind,
2769                                                  ElementsKind new_kind,
2770                                                  HValue* length,
2771                                                  HValue* new_capacity) {
2772   Add<HBoundsCheck>(new_capacity, Add<HConstant>(
2773           (Page::kMaxRegularHeapObjectSize - FixedArray::kHeaderSize) >>
2774           ElementsKindToShiftSize(new_kind)));
2775
2776   HValue* new_elements =
2777       BuildAllocateAndInitializeArray(new_kind, new_capacity);
2778
2779   BuildCopyElements(elements, kind, new_elements,
2780                     new_kind, length, new_capacity);
2781
2782   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
2783                         new_elements);
2784
2785   return new_elements;
2786 }
2787
2788
2789 void HGraphBuilder::BuildFillElementsWithValue(HValue* elements,
2790                                                ElementsKind elements_kind,
2791                                                HValue* from,
2792                                                HValue* to,
2793                                                HValue* value) {
2794   if (to == NULL) {
2795     to = AddLoadFixedArrayLength(elements);
2796   }
2797
2798   // Special loop unfolding case
2799   STATIC_ASSERT(JSArray::kPreallocatedArrayElements <=
2800                 kElementLoopUnrollThreshold);
2801   int initial_capacity = -1;
2802   if (from->IsInteger32Constant() && to->IsInteger32Constant()) {
2803     int constant_from = from->GetInteger32Constant();
2804     int constant_to = to->GetInteger32Constant();
2805
2806     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
2807       initial_capacity = constant_to;
2808     }
2809   }
2810
2811   if (initial_capacity >= 0) {
2812     for (int i = 0; i < initial_capacity; i++) {
2813       HInstruction* key = Add<HConstant>(i);
2814       Add<HStoreKeyed>(elements, key, value, elements_kind);
2815     }
2816   } else {
2817     // Carefully loop backwards so that the "from" remains live through the loop
2818     // rather than the to. This often corresponds to keeping length live rather
2819     // then capacity, which helps register allocation, since length is used more
2820     // other than capacity after filling with holes.
2821     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2822
2823     HValue* key = builder.BeginBody(to, from, Token::GT);
2824
2825     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
2826     adjusted_key->ClearFlag(HValue::kCanOverflow);
2827
2828     Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
2829
2830     builder.EndBody();
2831   }
2832 }
2833
2834
2835 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
2836                                               ElementsKind elements_kind,
2837                                               HValue* from,
2838                                               HValue* to) {
2839   // Fast elements kinds need to be initialized in case statements below cause a
2840   // garbage collection.
2841
2842   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
2843                      ? graph()->GetConstantHole()
2844                      : Add<HConstant>(HConstant::kHoleNaN);
2845
2846   // Since we're about to store a hole value, the store instruction below must
2847   // assume an elements kind that supports heap object values.
2848   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
2849     elements_kind = FAST_HOLEY_ELEMENTS;
2850   }
2851
2852   BuildFillElementsWithValue(elements, elements_kind, from, to, hole);
2853 }
2854
2855
2856 void HGraphBuilder::BuildCopyProperties(HValue* from_properties,
2857                                         HValue* to_properties, HValue* length,
2858                                         HValue* capacity) {
2859   ElementsKind kind = FAST_ELEMENTS;
2860
2861   BuildFillElementsWithValue(to_properties, kind, length, capacity,
2862                              graph()->GetConstantUndefined());
2863
2864   LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2865
2866   HValue* key = builder.BeginBody(length, graph()->GetConstant0(), Token::GT);
2867
2868   key = AddUncasted<HSub>(key, graph()->GetConstant1());
2869   key->ClearFlag(HValue::kCanOverflow);
2870
2871   HValue* element = Add<HLoadKeyed>(from_properties, key, nullptr, kind);
2872
2873   Add<HStoreKeyed>(to_properties, key, element, kind);
2874
2875   builder.EndBody();
2876 }
2877
2878
2879 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
2880                                       ElementsKind from_elements_kind,
2881                                       HValue* to_elements,
2882                                       ElementsKind to_elements_kind,
2883                                       HValue* length,
2884                                       HValue* capacity) {
2885   int constant_capacity = -1;
2886   if (capacity != NULL &&
2887       capacity->IsConstant() &&
2888       HConstant::cast(capacity)->HasInteger32Value()) {
2889     int constant_candidate = HConstant::cast(capacity)->Integer32Value();
2890     if (constant_candidate <= kElementLoopUnrollThreshold) {
2891       constant_capacity = constant_candidate;
2892     }
2893   }
2894
2895   bool pre_fill_with_holes =
2896     IsFastDoubleElementsKind(from_elements_kind) &&
2897     IsFastObjectElementsKind(to_elements_kind);
2898   if (pre_fill_with_holes) {
2899     // If the copy might trigger a GC, make sure that the FixedArray is
2900     // pre-initialized with holes to make sure that it's always in a
2901     // consistent state.
2902     BuildFillElementsWithHole(to_elements, to_elements_kind,
2903                               graph()->GetConstant0(), NULL);
2904   }
2905
2906   if (constant_capacity != -1) {
2907     // Unroll the loop for small elements kinds.
2908     for (int i = 0; i < constant_capacity; i++) {
2909       HValue* key_constant = Add<HConstant>(i);
2910       HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
2911                                             nullptr, from_elements_kind);
2912       Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
2913     }
2914   } else {
2915     if (!pre_fill_with_holes &&
2916         (capacity == NULL || !length->Equals(capacity))) {
2917       BuildFillElementsWithHole(to_elements, to_elements_kind,
2918                                 length, NULL);
2919     }
2920
2921     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2922
2923     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
2924                                     Token::GT);
2925
2926     key = AddUncasted<HSub>(key, graph()->GetConstant1());
2927     key->ClearFlag(HValue::kCanOverflow);
2928
2929     HValue* element = Add<HLoadKeyed>(from_elements, key, nullptr,
2930                                       from_elements_kind, ALLOW_RETURN_HOLE);
2931
2932     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
2933                          IsFastSmiElementsKind(to_elements_kind))
2934       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
2935
2936     if (IsHoleyElementsKind(from_elements_kind) &&
2937         from_elements_kind != to_elements_kind) {
2938       IfBuilder if_hole(this);
2939       if_hole.If<HCompareHoleAndBranch>(element);
2940       if_hole.Then();
2941       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
2942                                      ? Add<HConstant>(HConstant::kHoleNaN)
2943                                      : graph()->GetConstantHole();
2944       Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
2945       if_hole.Else();
2946       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
2947       store->SetFlag(HValue::kAllowUndefinedAsNaN);
2948       if_hole.End();
2949     } else {
2950       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
2951       store->SetFlag(HValue::kAllowUndefinedAsNaN);
2952     }
2953
2954     builder.EndBody();
2955   }
2956
2957   Counters* counters = isolate()->counters();
2958   AddIncrementCounter(counters->inlined_copied_elements());
2959 }
2960
2961
2962 HValue* HGraphBuilder::BuildCloneShallowArrayCow(HValue* boilerplate,
2963                                                  HValue* allocation_site,
2964                                                  AllocationSiteMode mode,
2965                                                  ElementsKind kind) {
2966   HAllocate* array = AllocateJSArrayObject(mode);
2967
2968   HValue* map = AddLoadMap(boilerplate);
2969   HValue* elements = AddLoadElements(boilerplate);
2970   HValue* length = AddLoadArrayLength(boilerplate, kind);
2971
2972   BuildJSArrayHeader(array,
2973                      map,
2974                      elements,
2975                      mode,
2976                      FAST_ELEMENTS,
2977                      allocation_site,
2978                      length);
2979   return array;
2980 }
2981
2982
2983 HValue* HGraphBuilder::BuildCloneShallowArrayEmpty(HValue* boilerplate,
2984                                                    HValue* allocation_site,
2985                                                    AllocationSiteMode mode) {
2986   HAllocate* array = AllocateJSArrayObject(mode);
2987
2988   HValue* map = AddLoadMap(boilerplate);
2989
2990   BuildJSArrayHeader(array,
2991                      map,
2992                      NULL,  // set elements to empty fixed array
2993                      mode,
2994                      FAST_ELEMENTS,
2995                      allocation_site,
2996                      graph()->GetConstant0());
2997   return array;
2998 }
2999
3000
3001 HValue* HGraphBuilder::BuildCloneShallowArrayNonEmpty(HValue* boilerplate,
3002                                                       HValue* allocation_site,
3003                                                       AllocationSiteMode mode,
3004                                                       ElementsKind kind) {
3005   HValue* boilerplate_elements = AddLoadElements(boilerplate);
3006   HValue* capacity = AddLoadFixedArrayLength(boilerplate_elements);
3007
3008   // Generate size calculation code here in order to make it dominate
3009   // the JSArray allocation.
3010   HValue* elements_size = BuildCalculateElementsSize(kind, capacity);
3011
3012   // Create empty JSArray object for now, store elimination should remove
3013   // redundant initialization of elements and length fields and at the same
3014   // time the object will be fully prepared for GC if it happens during
3015   // elements allocation.
3016   HValue* result = BuildCloneShallowArrayEmpty(
3017       boilerplate, allocation_site, mode);
3018
3019   HAllocate* elements = BuildAllocateElements(kind, elements_size);
3020
3021   // This function implicitly relies on the fact that the
3022   // FastCloneShallowArrayStub is called only for literals shorter than
3023   // JSObject::kInitialMaxFastElementArray.
3024   // Can't add HBoundsCheck here because otherwise the stub will eager a frame.
3025   HConstant* size_upper_bound = EstablishElementsAllocationSize(
3026       kind, JSObject::kInitialMaxFastElementArray);
3027   elements->set_size_upper_bound(size_upper_bound);
3028
3029   Add<HStoreNamedField>(result, HObjectAccess::ForElementsPointer(), elements);
3030
3031   // The allocation for the cloned array above causes register pressure on
3032   // machines with low register counts. Force a reload of the boilerplate
3033   // elements here to free up a register for the allocation to avoid unnecessary
3034   // spillage.
3035   boilerplate_elements = AddLoadElements(boilerplate);
3036   boilerplate_elements->SetFlag(HValue::kCantBeReplaced);
3037
3038   // Copy the elements array header.
3039   for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
3040     HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
3041     Add<HStoreNamedField>(
3042         elements, access,
3043         Add<HLoadNamedField>(boilerplate_elements, nullptr, access));
3044   }
3045
3046   // And the result of the length
3047   HValue* length = AddLoadArrayLength(boilerplate, kind);
3048   Add<HStoreNamedField>(result, HObjectAccess::ForArrayLength(kind), length);
3049
3050   BuildCopyElements(boilerplate_elements, kind, elements,
3051                     kind, length, NULL);
3052   return result;
3053 }
3054
3055
3056 void HGraphBuilder::BuildCompareNil(HValue* value, Type* type,
3057                                     HIfContinuation* continuation,
3058                                     MapEmbedding map_embedding) {
3059   IfBuilder if_nil(this);
3060   bool some_case_handled = false;
3061   bool some_case_missing = false;
3062
3063   if (type->Maybe(Type::Null())) {
3064     if (some_case_handled) if_nil.Or();
3065     if_nil.If<HCompareObjectEqAndBranch>(value, graph()->GetConstantNull());
3066     some_case_handled = true;
3067   } else {
3068     some_case_missing = true;
3069   }
3070
3071   if (type->Maybe(Type::Undefined())) {
3072     if (some_case_handled) if_nil.Or();
3073     if_nil.If<HCompareObjectEqAndBranch>(value,
3074                                          graph()->GetConstantUndefined());
3075     some_case_handled = true;
3076   } else {
3077     some_case_missing = true;
3078   }
3079
3080   if (type->Maybe(Type::Undetectable())) {
3081     if (some_case_handled) if_nil.Or();
3082     if_nil.If<HIsUndetectableAndBranch>(value);
3083     some_case_handled = true;
3084   } else {
3085     some_case_missing = true;
3086   }
3087
3088   if (some_case_missing) {
3089     if_nil.Then();
3090     if_nil.Else();
3091     if (type->NumClasses() == 1) {
3092       BuildCheckHeapObject(value);
3093       // For ICs, the map checked below is a sentinel map that gets replaced by
3094       // the monomorphic map when the code is used as a template to generate a
3095       // new IC. For optimized functions, there is no sentinel map, the map
3096       // emitted below is the actual monomorphic map.
3097       if (map_embedding == kEmbedMapsViaWeakCells) {
3098         HValue* cell =
3099             Add<HConstant>(Map::WeakCellForMap(type->Classes().Current()));
3100         HValue* expected_map = Add<HLoadNamedField>(
3101             cell, nullptr, HObjectAccess::ForWeakCellValue());
3102         HValue* map =
3103             Add<HLoadNamedField>(value, nullptr, HObjectAccess::ForMap());
3104         IfBuilder map_check(this);
3105         map_check.IfNot<HCompareObjectEqAndBranch>(expected_map, map);
3106         map_check.ThenDeopt(Deoptimizer::kUnknownMap);
3107         map_check.End();
3108       } else {
3109         DCHECK(map_embedding == kEmbedMapsDirectly);
3110         Add<HCheckMaps>(value, type->Classes().Current());
3111       }
3112     } else {
3113       if_nil.Deopt(Deoptimizer::kTooManyUndetectableTypes);
3114     }
3115   }
3116
3117   if_nil.CaptureContinuation(continuation);
3118 }
3119
3120
3121 void HGraphBuilder::BuildCreateAllocationMemento(
3122     HValue* previous_object,
3123     HValue* previous_object_size,
3124     HValue* allocation_site) {
3125   DCHECK(allocation_site != NULL);
3126   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
3127       previous_object, previous_object_size, HType::HeapObject());
3128   AddStoreMapConstant(
3129       allocation_memento, isolate()->factory()->allocation_memento_map());
3130   Add<HStoreNamedField>(
3131       allocation_memento,
3132       HObjectAccess::ForAllocationMementoSite(),
3133       allocation_site);
3134   if (FLAG_allocation_site_pretenuring) {
3135     HValue* memento_create_count =
3136         Add<HLoadNamedField>(allocation_site, nullptr,
3137                              HObjectAccess::ForAllocationSiteOffset(
3138                                  AllocationSite::kPretenureCreateCountOffset));
3139     memento_create_count = AddUncasted<HAdd>(
3140         memento_create_count, graph()->GetConstant1());
3141     // This smi value is reset to zero after every gc, overflow isn't a problem
3142     // since the counter is bounded by the new space size.
3143     memento_create_count->ClearFlag(HValue::kCanOverflow);
3144     Add<HStoreNamedField>(
3145         allocation_site, HObjectAccess::ForAllocationSiteOffset(
3146             AllocationSite::kPretenureCreateCountOffset), memento_create_count);
3147   }
3148 }
3149
3150
3151 HInstruction* HGraphBuilder::BuildGetNativeContext() {
3152   // Get the global object, then the native context
3153   HValue* global_object = Add<HLoadNamedField>(
3154       context(), nullptr,
3155       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3156   return Add<HLoadNamedField>(global_object, nullptr,
3157                               HObjectAccess::ForObservableJSObjectOffset(
3158                                   GlobalObject::kNativeContextOffset));
3159 }
3160
3161
3162 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
3163   // Get the global object, then the native context
3164   HInstruction* context = Add<HLoadNamedField>(
3165       closure, nullptr, HObjectAccess::ForFunctionContextPointer());
3166   HInstruction* global_object = Add<HLoadNamedField>(
3167       context, nullptr,
3168       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3169   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3170       GlobalObject::kNativeContextOffset);
3171   return Add<HLoadNamedField>(global_object, nullptr, access);
3172 }
3173
3174
3175 HInstruction* HGraphBuilder::BuildGetScriptContext(int context_index) {
3176   HValue* native_context = BuildGetNativeContext();
3177   HValue* script_context_table = Add<HLoadNamedField>(
3178       native_context, nullptr,
3179       HObjectAccess::ForContextSlot(Context::SCRIPT_CONTEXT_TABLE_INDEX));
3180   return Add<HLoadNamedField>(script_context_table, nullptr,
3181                               HObjectAccess::ForScriptContext(context_index));
3182 }
3183
3184
3185 HValue* HGraphBuilder::BuildGetParentContext(HValue* depth, int depth_value) {
3186   HValue* script_context = context();
3187   if (depth != NULL) {
3188     HValue* zero = graph()->GetConstant0();
3189
3190     Push(script_context);
3191     Push(depth);
3192
3193     LoopBuilder loop(this);
3194     loop.BeginBody(2);  // Drop script_context and depth from last environment
3195                         // to appease live range building without simulates.
3196     depth = Pop();
3197     script_context = Pop();
3198
3199     script_context = Add<HLoadNamedField>(
3200         script_context, nullptr,
3201         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3202     depth = AddUncasted<HSub>(depth, graph()->GetConstant1());
3203     depth->ClearFlag(HValue::kCanOverflow);
3204
3205     IfBuilder if_break(this);
3206     if_break.If<HCompareNumericAndBranch, HValue*>(depth, zero, Token::EQ);
3207     if_break.Then();
3208     {
3209       Push(script_context);  // The result.
3210       loop.Break();
3211     }
3212     if_break.Else();
3213     {
3214       Push(script_context);
3215       Push(depth);
3216     }
3217     loop.EndBody();
3218     if_break.End();
3219
3220     script_context = Pop();
3221   } else if (depth_value > 0) {
3222     // Unroll the above loop.
3223     for (int i = 0; i < depth_value; i++) {
3224       script_context = Add<HLoadNamedField>(
3225           script_context, nullptr,
3226           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
3227     }
3228   }
3229   return script_context;
3230 }
3231
3232
3233 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
3234   HInstruction* native_context = BuildGetNativeContext();
3235   HInstruction* index =
3236       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
3237   return Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3238 }
3239
3240
3241 HValue* HGraphBuilder::BuildArrayBufferViewFieldAccessor(HValue* object,
3242                                                          HValue* checked_object,
3243                                                          FieldIndex index) {
3244   NoObservableSideEffectsScope scope(this);
3245   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3246       index.offset(), Representation::Tagged());
3247   HInstruction* buffer = Add<HLoadNamedField>(
3248       object, checked_object, HObjectAccess::ForJSArrayBufferViewBuffer());
3249   HInstruction* field = Add<HLoadNamedField>(object, checked_object, access);
3250
3251   HInstruction* flags = Add<HLoadNamedField>(
3252       buffer, nullptr, HObjectAccess::ForJSArrayBufferBitField());
3253   HValue* was_neutered_mask =
3254       Add<HConstant>(1 << JSArrayBuffer::WasNeutered::kShift);
3255   HValue* was_neutered_test =
3256       AddUncasted<HBitwise>(Token::BIT_AND, flags, was_neutered_mask);
3257
3258   IfBuilder if_was_neutered(this);
3259   if_was_neutered.If<HCompareNumericAndBranch>(
3260       was_neutered_test, graph()->GetConstant0(), Token::NE);
3261   if_was_neutered.Then();
3262   Push(graph()->GetConstant0());
3263   if_was_neutered.Else();
3264   Push(field);
3265   if_was_neutered.End();
3266
3267   return Pop();
3268 }
3269
3270
3271 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3272     ElementsKind kind,
3273     HValue* allocation_site_payload,
3274     HValue* constructor_function,
3275     AllocationSiteOverrideMode override_mode) :
3276         builder_(builder),
3277         kind_(kind),
3278         allocation_site_payload_(allocation_site_payload),
3279         constructor_function_(constructor_function) {
3280   DCHECK(!allocation_site_payload->IsConstant() ||
3281          HConstant::cast(allocation_site_payload)->handle(
3282              builder_->isolate())->IsAllocationSite());
3283   mode_ = override_mode == DISABLE_ALLOCATION_SITES
3284       ? DONT_TRACK_ALLOCATION_SITE
3285       : AllocationSite::GetMode(kind);
3286 }
3287
3288
3289 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3290                                               ElementsKind kind,
3291                                               HValue* constructor_function) :
3292     builder_(builder),
3293     kind_(kind),
3294     mode_(DONT_TRACK_ALLOCATION_SITE),
3295     allocation_site_payload_(NULL),
3296     constructor_function_(constructor_function) {
3297 }
3298
3299
3300 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode() {
3301   if (!builder()->top_info()->IsStub()) {
3302     // A constant map is fine.
3303     Handle<Map> map(builder()->isolate()->get_initial_js_array_map(kind_),
3304                     builder()->isolate());
3305     return builder()->Add<HConstant>(map);
3306   }
3307
3308   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
3309     // No need for a context lookup if the kind_ matches the initial
3310     // map, because we can just load the map in that case.
3311     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3312     return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3313                                            access);
3314   }
3315
3316   // TODO(mvstanton): we should always have a constructor function if we
3317   // are creating a stub.
3318   HInstruction* native_context = constructor_function_ != NULL
3319       ? builder()->BuildGetNativeContext(constructor_function_)
3320       : builder()->BuildGetNativeContext();
3321
3322   HInstruction* index = builder()->Add<HConstant>(
3323       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
3324
3325   HInstruction* map_array =
3326       builder()->Add<HLoadKeyed>(native_context, index, nullptr, FAST_ELEMENTS);
3327
3328   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
3329
3330   return builder()->Add<HLoadKeyed>(map_array, kind_index, nullptr,
3331                                     FAST_ELEMENTS);
3332 }
3333
3334
3335 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
3336   // Find the map near the constructor function
3337   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3338   return builder()->Add<HLoadNamedField>(constructor_function_, nullptr,
3339                                          access);
3340 }
3341
3342
3343 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
3344   HConstant* capacity = builder()->Add<HConstant>(initial_capacity());
3345   return AllocateArray(capacity,
3346                        capacity,
3347                        builder()->graph()->GetConstant0());
3348 }
3349
3350
3351 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3352     HValue* capacity,
3353     HConstant* capacity_upper_bound,
3354     HValue* length_field,
3355     FillMode fill_mode) {
3356   return AllocateArray(capacity,
3357                        capacity_upper_bound->GetInteger32Constant(),
3358                        length_field,
3359                        fill_mode);
3360 }
3361
3362
3363 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3364     HValue* capacity,
3365     int capacity_upper_bound,
3366     HValue* length_field,
3367     FillMode fill_mode) {
3368   HConstant* elememts_size_upper_bound = capacity->IsInteger32Constant()
3369       ? HConstant::cast(capacity)
3370       : builder()->EstablishElementsAllocationSize(kind_, capacity_upper_bound);
3371
3372   HAllocate* array = AllocateArray(capacity, length_field, fill_mode);
3373   if (!elements_location_->has_size_upper_bound()) {
3374     elements_location_->set_size_upper_bound(elememts_size_upper_bound);
3375   }
3376   return array;
3377 }
3378
3379
3380 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3381     HValue* capacity,
3382     HValue* length_field,
3383     FillMode fill_mode) {
3384   // These HForceRepresentations are because we store these as fields in the
3385   // objects we construct, and an int32-to-smi HChange could deopt. Accept
3386   // the deopt possibility now, before allocation occurs.
3387   capacity =
3388       builder()->AddUncasted<HForceRepresentation>(capacity,
3389                                                    Representation::Smi());
3390   length_field =
3391       builder()->AddUncasted<HForceRepresentation>(length_field,
3392                                                    Representation::Smi());
3393
3394   // Generate size calculation code here in order to make it dominate
3395   // the JSArray allocation.
3396   HValue* elements_size =
3397       builder()->BuildCalculateElementsSize(kind_, capacity);
3398
3399   // Allocate (dealing with failure appropriately)
3400   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
3401
3402   // Fill in the fields: map, properties, length
3403   HValue* map;
3404   if (allocation_site_payload_ == NULL) {
3405     map = EmitInternalMapCode();
3406   } else {
3407     map = EmitMapCode();
3408   }
3409
3410   builder()->BuildJSArrayHeader(array_object,
3411                                 map,
3412                                 NULL,  // set elements to empty fixed array
3413                                 mode_,
3414                                 kind_,
3415                                 allocation_site_payload_,
3416                                 length_field);
3417
3418   // Allocate and initialize the elements
3419   elements_location_ = builder()->BuildAllocateElements(kind_, elements_size);
3420
3421   builder()->BuildInitializeElementsHeader(elements_location_, kind_, capacity);
3422
3423   // Set the elements
3424   builder()->Add<HStoreNamedField>(
3425       array_object, HObjectAccess::ForElementsPointer(), elements_location_);
3426
3427   if (fill_mode == FILL_WITH_HOLE) {
3428     builder()->BuildFillElementsWithHole(elements_location_, kind_,
3429                                          graph()->GetConstant0(), capacity);
3430   }
3431
3432   return array_object;
3433 }
3434
3435
3436 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
3437   HValue* global_object = Add<HLoadNamedField>(
3438       context(), nullptr,
3439       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3440   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3441       GlobalObject::kBuiltinsOffset);
3442   HValue* builtins = Add<HLoadNamedField>(global_object, nullptr, access);
3443   HObjectAccess function_access = HObjectAccess::ForObservableJSObjectOffset(
3444           JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
3445   return Add<HLoadNamedField>(builtins, nullptr, function_access);
3446 }
3447
3448
3449 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
3450     : HGraphBuilder(info),
3451       function_state_(NULL),
3452       initial_function_state_(this, info, NORMAL_RETURN, 0),
3453       ast_context_(NULL),
3454       break_scope_(NULL),
3455       inlined_count_(0),
3456       globals_(10, info->zone()),
3457       osr_(new(info->zone()) HOsrBuilder(this)) {
3458   // This is not initialized in the initializer list because the
3459   // constructor for the initial state relies on function_state_ == NULL
3460   // to know it's the initial state.
3461   function_state_ = &initial_function_state_;
3462   InitializeAstVisitor(info->isolate(), info->zone());
3463   if (top_info()->is_tracking_positions()) {
3464     SetSourcePosition(info->shared_info()->start_position());
3465   }
3466 }
3467
3468
3469 HBasicBlock* HOptimizedGraphBuilder::CreateJoin(HBasicBlock* first,
3470                                                 HBasicBlock* second,
3471                                                 BailoutId join_id) {
3472   if (first == NULL) {
3473     return second;
3474   } else if (second == NULL) {
3475     return first;
3476   } else {
3477     HBasicBlock* join_block = graph()->CreateBasicBlock();
3478     Goto(first, join_block);
3479     Goto(second, join_block);
3480     join_block->SetJoinId(join_id);
3481     return join_block;
3482   }
3483 }
3484
3485
3486 HBasicBlock* HOptimizedGraphBuilder::JoinContinue(IterationStatement* statement,
3487                                                   HBasicBlock* exit_block,
3488                                                   HBasicBlock* continue_block) {
3489   if (continue_block != NULL) {
3490     if (exit_block != NULL) Goto(exit_block, continue_block);
3491     continue_block->SetJoinId(statement->ContinueId());
3492     return continue_block;
3493   }
3494   return exit_block;
3495 }
3496
3497
3498 HBasicBlock* HOptimizedGraphBuilder::CreateLoop(IterationStatement* statement,
3499                                                 HBasicBlock* loop_entry,
3500                                                 HBasicBlock* body_exit,
3501                                                 HBasicBlock* loop_successor,
3502                                                 HBasicBlock* break_block) {
3503   if (body_exit != NULL) Goto(body_exit, loop_entry);
3504   loop_entry->PostProcessLoopHeader(statement);
3505   if (break_block != NULL) {
3506     if (loop_successor != NULL) Goto(loop_successor, break_block);
3507     break_block->SetJoinId(statement->ExitId());
3508     return break_block;
3509   }
3510   return loop_successor;
3511 }
3512
3513
3514 // Build a new loop header block and set it as the current block.
3515 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry() {
3516   HBasicBlock* loop_entry = CreateLoopHeaderBlock();
3517   Goto(loop_entry);
3518   set_current_block(loop_entry);
3519   return loop_entry;
3520 }
3521
3522
3523 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry(
3524     IterationStatement* statement) {
3525   HBasicBlock* loop_entry = osr()->HasOsrEntryAt(statement)
3526       ? osr()->BuildOsrLoopEntry(statement)
3527       : BuildLoopEntry();
3528   return loop_entry;
3529 }
3530
3531
3532 void HBasicBlock::FinishExit(HControlInstruction* instruction,
3533                              SourcePosition position) {
3534   Finish(instruction, position);
3535   ClearEnvironment();
3536 }
3537
3538
3539 std::ostream& operator<<(std::ostream& os, const HBasicBlock& b) {
3540   return os << "B" << b.block_id();
3541 }
3542
3543
3544 HGraph::HGraph(CompilationInfo* info)
3545     : isolate_(info->isolate()),
3546       next_block_id_(0),
3547       entry_block_(NULL),
3548       blocks_(8, info->zone()),
3549       values_(16, info->zone()),
3550       phi_list_(NULL),
3551       uint32_instructions_(NULL),
3552       osr_(NULL),
3553       info_(info),
3554       zone_(info->zone()),
3555       is_recursive_(false),
3556       use_optimistic_licm_(false),
3557       depends_on_empty_array_proto_elements_(false),
3558       type_change_checksum_(0),
3559       maximum_environment_size_(0),
3560       no_side_effects_scope_count_(0),
3561       disallow_adding_new_values_(false) {
3562   if (info->IsStub()) {
3563     CallInterfaceDescriptor descriptor =
3564         info->code_stub()->GetCallInterfaceDescriptor();
3565     start_environment_ =
3566         new (zone_) HEnvironment(zone_, descriptor.GetRegisterParameterCount());
3567   } else {
3568     if (info->is_tracking_positions()) {
3569       info->TraceInlinedFunction(info->shared_info(), SourcePosition::Unknown(),
3570                                  InlinedFunctionInfo::kNoParentId);
3571     }
3572     start_environment_ =
3573         new(zone_) HEnvironment(NULL, info->scope(), info->closure(), zone_);
3574   }
3575   start_environment_->set_ast_id(BailoutId::FunctionEntry());
3576   entry_block_ = CreateBasicBlock();
3577   entry_block_->SetInitialEnvironment(start_environment_);
3578 }
3579
3580
3581 HBasicBlock* HGraph::CreateBasicBlock() {
3582   HBasicBlock* result = new(zone()) HBasicBlock(this);
3583   blocks_.Add(result, zone());
3584   return result;
3585 }
3586
3587
3588 void HGraph::FinalizeUniqueness() {
3589   DisallowHeapAllocation no_gc;
3590   for (int i = 0; i < blocks()->length(); ++i) {
3591     for (HInstructionIterator it(blocks()->at(i)); !it.Done(); it.Advance()) {
3592       it.Current()->FinalizeUniqueness();
3593     }
3594   }
3595 }
3596
3597
3598 int HGraph::SourcePositionToScriptPosition(SourcePosition pos) {
3599   return (FLAG_hydrogen_track_positions && !pos.IsUnknown())
3600              ? info()->start_position_for(pos.inlining_id()) + pos.position()
3601              : pos.raw();
3602 }
3603
3604
3605 // Block ordering was implemented with two mutually recursive methods,
3606 // HGraph::Postorder and HGraph::PostorderLoopBlocks.
3607 // The recursion could lead to stack overflow so the algorithm has been
3608 // implemented iteratively.
3609 // At a high level the algorithm looks like this:
3610 //
3611 // Postorder(block, loop_header) : {
3612 //   if (block has already been visited or is of another loop) return;
3613 //   mark block as visited;
3614 //   if (block is a loop header) {
3615 //     VisitLoopMembers(block, loop_header);
3616 //     VisitSuccessorsOfLoopHeader(block);
3617 //   } else {
3618 //     VisitSuccessors(block)
3619 //   }
3620 //   put block in result list;
3621 // }
3622 //
3623 // VisitLoopMembers(block, outer_loop_header) {
3624 //   foreach (block b in block loop members) {
3625 //     VisitSuccessorsOfLoopMember(b, outer_loop_header);
3626 //     if (b is loop header) VisitLoopMembers(b);
3627 //   }
3628 // }
3629 //
3630 // VisitSuccessorsOfLoopMember(block, outer_loop_header) {
3631 //   foreach (block b in block successors) Postorder(b, outer_loop_header)
3632 // }
3633 //
3634 // VisitSuccessorsOfLoopHeader(block) {
3635 //   foreach (block b in block successors) Postorder(b, block)
3636 // }
3637 //
3638 // VisitSuccessors(block, loop_header) {
3639 //   foreach (block b in block successors) Postorder(b, loop_header)
3640 // }
3641 //
3642 // The ordering is started calling Postorder(entry, NULL).
3643 //
3644 // Each instance of PostorderProcessor represents the "stack frame" of the
3645 // recursion, and particularly keeps the state of the loop (iteration) of the
3646 // "Visit..." function it represents.
3647 // To recycle memory we keep all the frames in a double linked list but
3648 // this means that we cannot use constructors to initialize the frames.
3649 //
3650 class PostorderProcessor : public ZoneObject {
3651  public:
3652   // Back link (towards the stack bottom).
3653   PostorderProcessor* parent() {return father_; }
3654   // Forward link (towards the stack top).
3655   PostorderProcessor* child() {return child_; }
3656   HBasicBlock* block() { return block_; }
3657   HLoopInformation* loop() { return loop_; }
3658   HBasicBlock* loop_header() { return loop_header_; }
3659
3660   static PostorderProcessor* CreateEntryProcessor(Zone* zone,
3661                                                   HBasicBlock* block) {
3662     PostorderProcessor* result = new(zone) PostorderProcessor(NULL);
3663     return result->SetupSuccessors(zone, block, NULL);
3664   }
3665
3666   PostorderProcessor* PerformStep(Zone* zone,
3667                                   ZoneList<HBasicBlock*>* order) {
3668     PostorderProcessor* next =
3669         PerformNonBacktrackingStep(zone, order);
3670     if (next != NULL) {
3671       return next;
3672     } else {
3673       return Backtrack(zone, order);
3674     }
3675   }
3676
3677  private:
3678   explicit PostorderProcessor(PostorderProcessor* father)
3679       : father_(father), child_(NULL), successor_iterator(NULL) { }
3680
3681   // Each enum value states the cycle whose state is kept by this instance.
3682   enum LoopKind {
3683     NONE,
3684     SUCCESSORS,
3685     SUCCESSORS_OF_LOOP_HEADER,
3686     LOOP_MEMBERS,
3687     SUCCESSORS_OF_LOOP_MEMBER
3688   };
3689
3690   // Each "Setup..." method is like a constructor for a cycle state.
3691   PostorderProcessor* SetupSuccessors(Zone* zone,
3692                                       HBasicBlock* block,
3693                                       HBasicBlock* loop_header) {
3694     if (block == NULL || block->IsOrdered() ||
3695         block->parent_loop_header() != loop_header) {
3696       kind_ = NONE;
3697       block_ = NULL;
3698       loop_ = NULL;
3699       loop_header_ = NULL;
3700       return this;
3701     } else {
3702       block_ = block;
3703       loop_ = NULL;
3704       block->MarkAsOrdered();
3705
3706       if (block->IsLoopHeader()) {
3707         kind_ = SUCCESSORS_OF_LOOP_HEADER;
3708         loop_header_ = block;
3709         InitializeSuccessors();
3710         PostorderProcessor* result = Push(zone);
3711         return result->SetupLoopMembers(zone, block, block->loop_information(),
3712                                         loop_header);
3713       } else {
3714         DCHECK(block->IsFinished());
3715         kind_ = SUCCESSORS;
3716         loop_header_ = loop_header;
3717         InitializeSuccessors();
3718         return this;
3719       }
3720     }
3721   }
3722
3723   PostorderProcessor* SetupLoopMembers(Zone* zone,
3724                                        HBasicBlock* block,
3725                                        HLoopInformation* loop,
3726                                        HBasicBlock* loop_header) {
3727     kind_ = LOOP_MEMBERS;
3728     block_ = block;
3729     loop_ = loop;
3730     loop_header_ = loop_header;
3731     InitializeLoopMembers();
3732     return this;
3733   }
3734
3735   PostorderProcessor* SetupSuccessorsOfLoopMember(
3736       HBasicBlock* block,
3737       HLoopInformation* loop,
3738       HBasicBlock* loop_header) {
3739     kind_ = SUCCESSORS_OF_LOOP_MEMBER;
3740     block_ = block;
3741     loop_ = loop;
3742     loop_header_ = loop_header;
3743     InitializeSuccessors();
3744     return this;
3745   }
3746
3747   // This method "allocates" a new stack frame.
3748   PostorderProcessor* Push(Zone* zone) {
3749     if (child_ == NULL) {
3750       child_ = new(zone) PostorderProcessor(this);
3751     }
3752     return child_;
3753   }
3754
3755   void ClosePostorder(ZoneList<HBasicBlock*>* order, Zone* zone) {
3756     DCHECK(block_->end()->FirstSuccessor() == NULL ||
3757            order->Contains(block_->end()->FirstSuccessor()) ||
3758            block_->end()->FirstSuccessor()->IsLoopHeader());
3759     DCHECK(block_->end()->SecondSuccessor() == NULL ||
3760            order->Contains(block_->end()->SecondSuccessor()) ||
3761            block_->end()->SecondSuccessor()->IsLoopHeader());
3762     order->Add(block_, zone);
3763   }
3764
3765   // This method is the basic block to walk up the stack.
3766   PostorderProcessor* Pop(Zone* zone,
3767                           ZoneList<HBasicBlock*>* order) {
3768     switch (kind_) {
3769       case SUCCESSORS:
3770       case SUCCESSORS_OF_LOOP_HEADER:
3771         ClosePostorder(order, zone);
3772         return father_;
3773       case LOOP_MEMBERS:
3774         return father_;
3775       case SUCCESSORS_OF_LOOP_MEMBER:
3776         if (block()->IsLoopHeader() && block() != loop_->loop_header()) {
3777           // In this case we need to perform a LOOP_MEMBERS cycle so we
3778           // initialize it and return this instead of father.
3779           return SetupLoopMembers(zone, block(),
3780                                   block()->loop_information(), loop_header_);
3781         } else {
3782           return father_;
3783         }
3784       case NONE:
3785         return father_;
3786     }
3787     UNREACHABLE();
3788     return NULL;
3789   }
3790
3791   // Walks up the stack.
3792   PostorderProcessor* Backtrack(Zone* zone,
3793                                 ZoneList<HBasicBlock*>* order) {
3794     PostorderProcessor* parent = Pop(zone, order);
3795     while (parent != NULL) {
3796       PostorderProcessor* next =
3797           parent->PerformNonBacktrackingStep(zone, order);
3798       if (next != NULL) {
3799         return next;
3800       } else {
3801         parent = parent->Pop(zone, order);
3802       }
3803     }
3804     return NULL;
3805   }
3806
3807   PostorderProcessor* PerformNonBacktrackingStep(
3808       Zone* zone,
3809       ZoneList<HBasicBlock*>* order) {
3810     HBasicBlock* next_block;
3811     switch (kind_) {
3812       case SUCCESSORS:
3813         next_block = AdvanceSuccessors();
3814         if (next_block != NULL) {
3815           PostorderProcessor* result = Push(zone);
3816           return result->SetupSuccessors(zone, next_block, loop_header_);
3817         }
3818         break;
3819       case SUCCESSORS_OF_LOOP_HEADER:
3820         next_block = AdvanceSuccessors();
3821         if (next_block != NULL) {
3822           PostorderProcessor* result = Push(zone);
3823           return result->SetupSuccessors(zone, next_block, block());
3824         }
3825         break;
3826       case LOOP_MEMBERS:
3827         next_block = AdvanceLoopMembers();
3828         if (next_block != NULL) {
3829           PostorderProcessor* result = Push(zone);
3830           return result->SetupSuccessorsOfLoopMember(next_block,
3831                                                      loop_, loop_header_);
3832         }
3833         break;
3834       case SUCCESSORS_OF_LOOP_MEMBER:
3835         next_block = AdvanceSuccessors();
3836         if (next_block != NULL) {
3837           PostorderProcessor* result = Push(zone);
3838           return result->SetupSuccessors(zone, next_block, loop_header_);
3839         }
3840         break;
3841       case NONE:
3842         return NULL;
3843     }
3844     return NULL;
3845   }
3846
3847   // The following two methods implement a "foreach b in successors" cycle.
3848   void InitializeSuccessors() {
3849     loop_index = 0;
3850     loop_length = 0;
3851     successor_iterator = HSuccessorIterator(block_->end());
3852   }
3853
3854   HBasicBlock* AdvanceSuccessors() {
3855     if (!successor_iterator.Done()) {
3856       HBasicBlock* result = successor_iterator.Current();
3857       successor_iterator.Advance();
3858       return result;
3859     }
3860     return NULL;
3861   }
3862
3863   // The following two methods implement a "foreach b in loop members" cycle.
3864   void InitializeLoopMembers() {
3865     loop_index = 0;
3866     loop_length = loop_->blocks()->length();
3867   }
3868
3869   HBasicBlock* AdvanceLoopMembers() {
3870     if (loop_index < loop_length) {
3871       HBasicBlock* result = loop_->blocks()->at(loop_index);
3872       loop_index++;
3873       return result;
3874     } else {
3875       return NULL;
3876     }
3877   }
3878
3879   LoopKind kind_;
3880   PostorderProcessor* father_;
3881   PostorderProcessor* child_;
3882   HLoopInformation* loop_;
3883   HBasicBlock* block_;
3884   HBasicBlock* loop_header_;
3885   int loop_index;
3886   int loop_length;
3887   HSuccessorIterator successor_iterator;
3888 };
3889
3890
3891 void HGraph::OrderBlocks() {
3892   CompilationPhase phase("H_Block ordering", info());
3893
3894 #ifdef DEBUG
3895   // Initially the blocks must not be ordered.
3896   for (int i = 0; i < blocks_.length(); ++i) {
3897     DCHECK(!blocks_[i]->IsOrdered());
3898   }
3899 #endif
3900
3901   PostorderProcessor* postorder =
3902       PostorderProcessor::CreateEntryProcessor(zone(), blocks_[0]);
3903   blocks_.Rewind(0);
3904   while (postorder) {
3905     postorder = postorder->PerformStep(zone(), &blocks_);
3906   }
3907
3908 #ifdef DEBUG
3909   // Now all blocks must be marked as ordered.
3910   for (int i = 0; i < blocks_.length(); ++i) {
3911     DCHECK(blocks_[i]->IsOrdered());
3912   }
3913 #endif
3914
3915   // Reverse block list and assign block IDs.
3916   for (int i = 0, j = blocks_.length(); --j >= i; ++i) {
3917     HBasicBlock* bi = blocks_[i];
3918     HBasicBlock* bj = blocks_[j];
3919     bi->set_block_id(j);
3920     bj->set_block_id(i);
3921     blocks_[i] = bj;
3922     blocks_[j] = bi;
3923   }
3924 }
3925
3926
3927 void HGraph::AssignDominators() {
3928   HPhase phase("H_Assign dominators", this);
3929   for (int i = 0; i < blocks_.length(); ++i) {
3930     HBasicBlock* block = blocks_[i];
3931     if (block->IsLoopHeader()) {
3932       // Only the first predecessor of a loop header is from outside the loop.
3933       // All others are back edges, and thus cannot dominate the loop header.
3934       block->AssignCommonDominator(block->predecessors()->first());
3935       block->AssignLoopSuccessorDominators();
3936     } else {
3937       for (int j = blocks_[i]->predecessors()->length() - 1; j >= 0; --j) {
3938         blocks_[i]->AssignCommonDominator(blocks_[i]->predecessors()->at(j));
3939       }
3940     }
3941   }
3942 }
3943
3944
3945 bool HGraph::CheckArgumentsPhiUses() {
3946   int block_count = blocks_.length();
3947   for (int i = 0; i < block_count; ++i) {
3948     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3949       HPhi* phi = blocks_[i]->phis()->at(j);
3950       // We don't support phi uses of arguments for now.
3951       if (phi->CheckFlag(HValue::kIsArguments)) return false;
3952     }
3953   }
3954   return true;
3955 }
3956
3957
3958 bool HGraph::CheckConstPhiUses() {
3959   int block_count = blocks_.length();
3960   for (int i = 0; i < block_count; ++i) {
3961     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3962       HPhi* phi = blocks_[i]->phis()->at(j);
3963       // Check for the hole value (from an uninitialized const).
3964       for (int k = 0; k < phi->OperandCount(); k++) {
3965         if (phi->OperandAt(k) == GetConstantHole()) return false;
3966       }
3967     }
3968   }
3969   return true;
3970 }
3971
3972
3973 void HGraph::CollectPhis() {
3974   int block_count = blocks_.length();
3975   phi_list_ = new(zone()) ZoneList<HPhi*>(block_count, zone());
3976   for (int i = 0; i < block_count; ++i) {
3977     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3978       HPhi* phi = blocks_[i]->phis()->at(j);
3979       phi_list_->Add(phi, zone());
3980     }
3981   }
3982 }
3983
3984
3985 // Implementation of utility class to encapsulate the translation state for
3986 // a (possibly inlined) function.
3987 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
3988                              CompilationInfo* info, InliningKind inlining_kind,
3989                              int inlining_id)
3990     : owner_(owner),
3991       compilation_info_(info),
3992       call_context_(NULL),
3993       inlining_kind_(inlining_kind),
3994       function_return_(NULL),
3995       test_context_(NULL),
3996       entry_(NULL),
3997       arguments_object_(NULL),
3998       arguments_elements_(NULL),
3999       inlining_id_(inlining_id),
4000       outer_source_position_(SourcePosition::Unknown()),
4001       outer_(owner->function_state()) {
4002   if (outer_ != NULL) {
4003     // State for an inline function.
4004     if (owner->ast_context()->IsTest()) {
4005       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
4006       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
4007       if_true->MarkAsInlineReturnTarget(owner->current_block());
4008       if_false->MarkAsInlineReturnTarget(owner->current_block());
4009       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
4010       Expression* cond = outer_test_context->condition();
4011       // The AstContext constructor pushed on the context stack.  This newed
4012       // instance is the reason that AstContext can't be BASE_EMBEDDED.
4013       test_context_ = new TestContext(owner, cond, if_true, if_false);
4014     } else {
4015       function_return_ = owner->graph()->CreateBasicBlock();
4016       function_return()->MarkAsInlineReturnTarget(owner->current_block());
4017     }
4018     // Set this after possibly allocating a new TestContext above.
4019     call_context_ = owner->ast_context();
4020   }
4021
4022   // Push on the state stack.
4023   owner->set_function_state(this);
4024
4025   if (compilation_info_->is_tracking_positions()) {
4026     outer_source_position_ = owner->source_position();
4027     owner->EnterInlinedSource(
4028       info->shared_info()->start_position(),
4029       inlining_id);
4030     owner->SetSourcePosition(info->shared_info()->start_position());
4031   }
4032 }
4033
4034
4035 FunctionState::~FunctionState() {
4036   delete test_context_;
4037   owner_->set_function_state(outer_);
4038
4039   if (compilation_info_->is_tracking_positions()) {
4040     owner_->set_source_position(outer_source_position_);
4041     owner_->EnterInlinedSource(
4042       outer_->compilation_info()->shared_info()->start_position(),
4043       outer_->inlining_id());
4044   }
4045 }
4046
4047
4048 // Implementation of utility classes to represent an expression's context in
4049 // the AST.
4050 AstContext::AstContext(HOptimizedGraphBuilder* owner, Expression::Context kind)
4051     : owner_(owner),
4052       kind_(kind),
4053       outer_(owner->ast_context()),
4054       typeof_mode_(NOT_INSIDE_TYPEOF) {
4055   owner->set_ast_context(this);  // Push.
4056 #ifdef DEBUG
4057   DCHECK(owner->environment()->frame_type() == JS_FUNCTION);
4058   original_length_ = owner->environment()->length();
4059 #endif
4060 }
4061
4062
4063 AstContext::~AstContext() {
4064   owner_->set_ast_context(outer_);  // Pop.
4065 }
4066
4067
4068 EffectContext::~EffectContext() {
4069   DCHECK(owner()->HasStackOverflow() ||
4070          owner()->current_block() == NULL ||
4071          (owner()->environment()->length() == original_length_ &&
4072           owner()->environment()->frame_type() == JS_FUNCTION));
4073 }
4074
4075
4076 ValueContext::~ValueContext() {
4077   DCHECK(owner()->HasStackOverflow() ||
4078          owner()->current_block() == NULL ||
4079          (owner()->environment()->length() == original_length_ + 1 &&
4080           owner()->environment()->frame_type() == JS_FUNCTION));
4081 }
4082
4083
4084 void EffectContext::ReturnValue(HValue* value) {
4085   // The value is simply ignored.
4086 }
4087
4088
4089 void ValueContext::ReturnValue(HValue* value) {
4090   // The value is tracked in the bailout environment, and communicated
4091   // through the environment as the result of the expression.
4092   if (value->CheckFlag(HValue::kIsArguments)) {
4093     if (flag_ == ARGUMENTS_FAKED) {
4094       value = owner()->graph()->GetConstantUndefined();
4095     } else if (!arguments_allowed()) {
4096       owner()->Bailout(kBadValueContextForArgumentsValue);
4097     }
4098   }
4099   owner()->Push(value);
4100 }
4101
4102
4103 void TestContext::ReturnValue(HValue* value) {
4104   BuildBranch(value);
4105 }
4106
4107
4108 void EffectContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4109   DCHECK(!instr->IsControlInstruction());
4110   owner()->AddInstruction(instr);
4111   if (instr->HasObservableSideEffects()) {
4112     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4113   }
4114 }
4115
4116
4117 void EffectContext::ReturnControl(HControlInstruction* instr,
4118                                   BailoutId ast_id) {
4119   DCHECK(!instr->HasObservableSideEffects());
4120   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4121   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4122   instr->SetSuccessorAt(0, empty_true);
4123   instr->SetSuccessorAt(1, empty_false);
4124   owner()->FinishCurrentBlock(instr);
4125   HBasicBlock* join = owner()->CreateJoin(empty_true, empty_false, ast_id);
4126   owner()->set_current_block(join);
4127 }
4128
4129
4130 void EffectContext::ReturnContinuation(HIfContinuation* continuation,
4131                                        BailoutId ast_id) {
4132   HBasicBlock* true_branch = NULL;
4133   HBasicBlock* false_branch = NULL;
4134   continuation->Continue(&true_branch, &false_branch);
4135   if (!continuation->IsTrueReachable()) {
4136     owner()->set_current_block(false_branch);
4137   } else if (!continuation->IsFalseReachable()) {
4138     owner()->set_current_block(true_branch);
4139   } else {
4140     HBasicBlock* join = owner()->CreateJoin(true_branch, false_branch, ast_id);
4141     owner()->set_current_block(join);
4142   }
4143 }
4144
4145
4146 void ValueContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4147   DCHECK(!instr->IsControlInstruction());
4148   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4149     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4150   }
4151   owner()->AddInstruction(instr);
4152   owner()->Push(instr);
4153   if (instr->HasObservableSideEffects()) {
4154     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4155   }
4156 }
4157
4158
4159 void ValueContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4160   DCHECK(!instr->HasObservableSideEffects());
4161   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4162     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4163   }
4164   HBasicBlock* materialize_false = owner()->graph()->CreateBasicBlock();
4165   HBasicBlock* materialize_true = owner()->graph()->CreateBasicBlock();
4166   instr->SetSuccessorAt(0, materialize_true);
4167   instr->SetSuccessorAt(1, materialize_false);
4168   owner()->FinishCurrentBlock(instr);
4169   owner()->set_current_block(materialize_true);
4170   owner()->Push(owner()->graph()->GetConstantTrue());
4171   owner()->set_current_block(materialize_false);
4172   owner()->Push(owner()->graph()->GetConstantFalse());
4173   HBasicBlock* join =
4174     owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4175   owner()->set_current_block(join);
4176 }
4177
4178
4179 void ValueContext::ReturnContinuation(HIfContinuation* continuation,
4180                                       BailoutId ast_id) {
4181   HBasicBlock* materialize_true = NULL;
4182   HBasicBlock* materialize_false = NULL;
4183   continuation->Continue(&materialize_true, &materialize_false);
4184   if (continuation->IsTrueReachable()) {
4185     owner()->set_current_block(materialize_true);
4186     owner()->Push(owner()->graph()->GetConstantTrue());
4187     owner()->set_current_block(materialize_true);
4188   }
4189   if (continuation->IsFalseReachable()) {
4190     owner()->set_current_block(materialize_false);
4191     owner()->Push(owner()->graph()->GetConstantFalse());
4192     owner()->set_current_block(materialize_false);
4193   }
4194   if (continuation->TrueAndFalseReachable()) {
4195     HBasicBlock* join =
4196         owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4197     owner()->set_current_block(join);
4198   }
4199 }
4200
4201
4202 void TestContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4203   DCHECK(!instr->IsControlInstruction());
4204   HOptimizedGraphBuilder* builder = owner();
4205   builder->AddInstruction(instr);
4206   // We expect a simulate after every expression with side effects, though
4207   // this one isn't actually needed (and wouldn't work if it were targeted).
4208   if (instr->HasObservableSideEffects()) {
4209     builder->Push(instr);
4210     builder->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4211     builder->Pop();
4212   }
4213   BuildBranch(instr);
4214 }
4215
4216
4217 void TestContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4218   DCHECK(!instr->HasObservableSideEffects());
4219   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4220   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4221   instr->SetSuccessorAt(0, empty_true);
4222   instr->SetSuccessorAt(1, empty_false);
4223   owner()->FinishCurrentBlock(instr);
4224   owner()->Goto(empty_true, if_true(), owner()->function_state());
4225   owner()->Goto(empty_false, if_false(), owner()->function_state());
4226   owner()->set_current_block(NULL);
4227 }
4228
4229
4230 void TestContext::ReturnContinuation(HIfContinuation* continuation,
4231                                      BailoutId ast_id) {
4232   HBasicBlock* true_branch = NULL;
4233   HBasicBlock* false_branch = NULL;
4234   continuation->Continue(&true_branch, &false_branch);
4235   if (continuation->IsTrueReachable()) {
4236     owner()->Goto(true_branch, if_true(), owner()->function_state());
4237   }
4238   if (continuation->IsFalseReachable()) {
4239     owner()->Goto(false_branch, if_false(), owner()->function_state());
4240   }
4241   owner()->set_current_block(NULL);
4242 }
4243
4244
4245 void TestContext::BuildBranch(HValue* value) {
4246   // We expect the graph to be in edge-split form: there is no edge that
4247   // connects a branch node to a join node.  We conservatively ensure that
4248   // property by always adding an empty block on the outgoing edges of this
4249   // branch.
4250   HOptimizedGraphBuilder* builder = owner();
4251   if (value != NULL && value->CheckFlag(HValue::kIsArguments)) {
4252     builder->Bailout(kArgumentsObjectValueInATestContext);
4253   }
4254   ToBooleanStub::Types expected(condition()->to_boolean_types());
4255   ReturnControl(owner()->New<HBranch>(value, expected), BailoutId::None());
4256 }
4257
4258
4259 // HOptimizedGraphBuilder infrastructure for bailing out and checking bailouts.
4260 #define CHECK_BAILOUT(call)                     \
4261   do {                                          \
4262     call;                                       \
4263     if (HasStackOverflow()) return;             \
4264   } while (false)
4265
4266
4267 #define CHECK_ALIVE(call)                                       \
4268   do {                                                          \
4269     call;                                                       \
4270     if (HasStackOverflow() || current_block() == NULL) return;  \
4271   } while (false)
4272
4273
4274 #define CHECK_ALIVE_OR_RETURN(call, value)                            \
4275   do {                                                                \
4276     call;                                                             \
4277     if (HasStackOverflow() || current_block() == NULL) return value;  \
4278   } while (false)
4279
4280
4281 void HOptimizedGraphBuilder::Bailout(BailoutReason reason) {
4282   current_info()->AbortOptimization(reason);
4283   SetStackOverflow();
4284 }
4285
4286
4287 void HOptimizedGraphBuilder::VisitForEffect(Expression* expr) {
4288   EffectContext for_effect(this);
4289   Visit(expr);
4290 }
4291
4292
4293 void HOptimizedGraphBuilder::VisitForValue(Expression* expr,
4294                                            ArgumentsAllowedFlag flag) {
4295   ValueContext for_value(this, flag);
4296   Visit(expr);
4297 }
4298
4299
4300 void HOptimizedGraphBuilder::VisitForTypeOf(Expression* expr) {
4301   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
4302   for_value.set_typeof_mode(INSIDE_TYPEOF);
4303   Visit(expr);
4304 }
4305
4306
4307 void HOptimizedGraphBuilder::VisitForControl(Expression* expr,
4308                                              HBasicBlock* true_block,
4309                                              HBasicBlock* false_block) {
4310   TestContext for_test(this, expr, true_block, false_block);
4311   Visit(expr);
4312 }
4313
4314
4315 void HOptimizedGraphBuilder::VisitExpressions(
4316     ZoneList<Expression*>* exprs) {
4317   for (int i = 0; i < exprs->length(); ++i) {
4318     CHECK_ALIVE(VisitForValue(exprs->at(i)));
4319   }
4320 }
4321
4322
4323 void HOptimizedGraphBuilder::VisitExpressions(ZoneList<Expression*>* exprs,
4324                                               ArgumentsAllowedFlag flag) {
4325   for (int i = 0; i < exprs->length(); ++i) {
4326     CHECK_ALIVE(VisitForValue(exprs->at(i), flag));
4327   }
4328 }
4329
4330
4331 bool HOptimizedGraphBuilder::BuildGraph() {
4332   if (IsSubclassConstructor(current_info()->function()->kind())) {
4333     Bailout(kSuperReference);
4334     return false;
4335   }
4336
4337   int slots = current_info()->num_heap_slots() - Context::MIN_CONTEXT_SLOTS;
4338   if (current_info()->scope()->is_script_scope() && slots > 0) {
4339     Bailout(kScriptContext);
4340     return false;
4341   }
4342
4343   Scope* scope = current_info()->scope();
4344   SetUpScope(scope);
4345
4346   // Add an edge to the body entry.  This is warty: the graph's start
4347   // environment will be used by the Lithium translation as the initial
4348   // environment on graph entry, but it has now been mutated by the
4349   // Hydrogen translation of the instructions in the start block.  This
4350   // environment uses values which have not been defined yet.  These
4351   // Hydrogen instructions will then be replayed by the Lithium
4352   // translation, so they cannot have an environment effect.  The edge to
4353   // the body's entry block (along with some special logic for the start
4354   // block in HInstruction::InsertAfter) seals the start block from
4355   // getting unwanted instructions inserted.
4356   //
4357   // TODO(kmillikin): Fix this.  Stop mutating the initial environment.
4358   // Make the Hydrogen instructions in the initial block into Hydrogen
4359   // values (but not instructions), present in the initial environment and
4360   // not replayed by the Lithium translation.
4361   HEnvironment* initial_env = environment()->CopyWithoutHistory();
4362   HBasicBlock* body_entry = CreateBasicBlock(initial_env);
4363   Goto(body_entry);
4364   body_entry->SetJoinId(BailoutId::FunctionEntry());
4365   set_current_block(body_entry);
4366
4367   VisitDeclarations(scope->declarations());
4368   Add<HSimulate>(BailoutId::Declarations());
4369
4370   Add<HStackCheck>(HStackCheck::kFunctionEntry);
4371
4372   VisitStatements(current_info()->function()->body());
4373   if (HasStackOverflow()) return false;
4374
4375   if (current_block() != NULL) {
4376     Add<HReturn>(graph()->GetConstantUndefined());
4377     set_current_block(NULL);
4378   }
4379
4380   // If the checksum of the number of type info changes is the same as the
4381   // last time this function was compiled, then this recompile is likely not
4382   // due to missing/inadequate type feedback, but rather too aggressive
4383   // optimization. Disable optimistic LICM in that case.
4384   Handle<Code> unoptimized_code(current_info()->shared_info()->code());
4385   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
4386   Handle<TypeFeedbackInfo> type_info(
4387       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
4388   int checksum = type_info->own_type_change_checksum();
4389   int composite_checksum = graph()->update_type_change_checksum(checksum);
4390   graph()->set_use_optimistic_licm(
4391       !type_info->matches_inlined_type_change_checksum(composite_checksum));
4392   type_info->set_inlined_type_change_checksum(composite_checksum);
4393
4394   // Perform any necessary OSR-specific cleanups or changes to the graph.
4395   osr()->FinishGraph();
4396
4397   return true;
4398 }
4399
4400
4401 bool HGraph::Optimize(BailoutReason* bailout_reason) {
4402   OrderBlocks();
4403   AssignDominators();
4404
4405   // We need to create a HConstant "zero" now so that GVN will fold every
4406   // zero-valued constant in the graph together.
4407   // The constant is needed to make idef-based bounds check work: the pass
4408   // evaluates relations with "zero" and that zero cannot be created after GVN.
4409   GetConstant0();
4410
4411 #ifdef DEBUG
4412   // Do a full verify after building the graph and computing dominators.
4413   Verify(true);
4414 #endif
4415
4416   if (FLAG_analyze_environment_liveness && maximum_environment_size() != 0) {
4417     Run<HEnvironmentLivenessAnalysisPhase>();
4418   }
4419
4420   if (!CheckConstPhiUses()) {
4421     *bailout_reason = kUnsupportedPhiUseOfConstVariable;
4422     return false;
4423   }
4424   Run<HRedundantPhiEliminationPhase>();
4425   if (!CheckArgumentsPhiUses()) {
4426     *bailout_reason = kUnsupportedPhiUseOfArguments;
4427     return false;
4428   }
4429
4430   // Find and mark unreachable code to simplify optimizations, especially gvn,
4431   // where unreachable code could unnecessarily defeat LICM.
4432   Run<HMarkUnreachableBlocksPhase>();
4433
4434   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4435   if (FLAG_use_escape_analysis) Run<HEscapeAnalysisPhase>();
4436
4437   if (FLAG_load_elimination) Run<HLoadEliminationPhase>();
4438
4439   CollectPhis();
4440
4441   if (has_osr()) osr()->FinishOsrValues();
4442
4443   Run<HInferRepresentationPhase>();
4444
4445   // Remove HSimulate instructions that have turned out not to be needed
4446   // after all by folding them into the following HSimulate.
4447   // This must happen after inferring representations.
4448   Run<HMergeRemovableSimulatesPhase>();
4449
4450   Run<HMarkDeoptimizeOnUndefinedPhase>();
4451   Run<HRepresentationChangesPhase>();
4452
4453   Run<HInferTypesPhase>();
4454
4455   // Must be performed before canonicalization to ensure that Canonicalize
4456   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
4457   // zero.
4458   Run<HUint32AnalysisPhase>();
4459
4460   if (FLAG_use_canonicalizing) Run<HCanonicalizePhase>();
4461
4462   if (FLAG_use_gvn) Run<HGlobalValueNumberingPhase>();
4463
4464   if (FLAG_check_elimination) Run<HCheckEliminationPhase>();
4465
4466   if (FLAG_store_elimination) Run<HStoreEliminationPhase>();
4467
4468   Run<HRangeAnalysisPhase>();
4469
4470   Run<HComputeChangeUndefinedToNaN>();
4471
4472   // Eliminate redundant stack checks on backwards branches.
4473   Run<HStackCheckEliminationPhase>();
4474
4475   if (FLAG_array_bounds_checks_elimination) Run<HBoundsCheckEliminationPhase>();
4476   if (FLAG_array_bounds_checks_hoisting) Run<HBoundsCheckHoistingPhase>();
4477   if (FLAG_array_index_dehoisting) Run<HDehoistIndexComputationsPhase>();
4478   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4479
4480   RestoreActualValues();
4481
4482   // Find unreachable code a second time, GVN and other optimizations may have
4483   // made blocks unreachable that were previously reachable.
4484   Run<HMarkUnreachableBlocksPhase>();
4485
4486   return true;
4487 }
4488
4489
4490 void HGraph::RestoreActualValues() {
4491   HPhase phase("H_Restore actual values", this);
4492
4493   for (int block_index = 0; block_index < blocks()->length(); block_index++) {
4494     HBasicBlock* block = blocks()->at(block_index);
4495
4496 #ifdef DEBUG
4497     for (int i = 0; i < block->phis()->length(); i++) {
4498       HPhi* phi = block->phis()->at(i);
4499       DCHECK(phi->ActualValue() == phi);
4500     }
4501 #endif
4502
4503     for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
4504       HInstruction* instruction = it.Current();
4505       if (instruction->ActualValue() == instruction) continue;
4506       if (instruction->CheckFlag(HValue::kIsDead)) {
4507         // The instruction was marked as deleted but left in the graph
4508         // as a control flow dependency point for subsequent
4509         // instructions.
4510         instruction->DeleteAndReplaceWith(instruction->ActualValue());
4511       } else {
4512         DCHECK(instruction->IsInformativeDefinition());
4513         if (instruction->IsPurelyInformativeDefinition()) {
4514           instruction->DeleteAndReplaceWith(instruction->RedefinedOperand());
4515         } else {
4516           instruction->ReplaceAllUsesWith(instruction->ActualValue());
4517         }
4518       }
4519     }
4520   }
4521 }
4522
4523
4524 void HOptimizedGraphBuilder::PushArgumentsFromEnvironment(int count) {
4525   ZoneList<HValue*> arguments(count, zone());
4526   for (int i = 0; i < count; ++i) {
4527     arguments.Add(Pop(), zone());
4528   }
4529
4530   HPushArguments* push_args = New<HPushArguments>();
4531   while (!arguments.is_empty()) {
4532     push_args->AddInput(arguments.RemoveLast());
4533   }
4534   AddInstruction(push_args);
4535 }
4536
4537
4538 template <class Instruction>
4539 HInstruction* HOptimizedGraphBuilder::PreProcessCall(Instruction* call) {
4540   PushArgumentsFromEnvironment(call->argument_count());
4541   return call;
4542 }
4543
4544
4545 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
4546   // First special is HContext.
4547   HInstruction* context = Add<HContext>();
4548   environment()->BindContext(context);
4549
4550   // Create an arguments object containing the initial parameters.  Set the
4551   // initial values of parameters including "this" having parameter index 0.
4552   DCHECK_EQ(scope->num_parameters() + 1, environment()->parameter_count());
4553   HArgumentsObject* arguments_object =
4554       New<HArgumentsObject>(environment()->parameter_count());
4555   for (int i = 0; i < environment()->parameter_count(); ++i) {
4556     HInstruction* parameter = Add<HParameter>(i);
4557     arguments_object->AddArgument(parameter, zone());
4558     environment()->Bind(i, parameter);
4559   }
4560   AddInstruction(arguments_object);
4561   graph()->SetArgumentsObject(arguments_object);
4562
4563   HConstant* undefined_constant = graph()->GetConstantUndefined();
4564   // Initialize specials and locals to undefined.
4565   for (int i = environment()->parameter_count() + 1;
4566        i < environment()->length();
4567        ++i) {
4568     environment()->Bind(i, undefined_constant);
4569   }
4570
4571   // Handle the arguments and arguments shadow variables specially (they do
4572   // not have declarations).
4573   if (scope->arguments() != NULL) {
4574     environment()->Bind(scope->arguments(),
4575                         graph()->GetArgumentsObject());
4576   }
4577
4578   int rest_index;
4579   Variable* rest = scope->rest_parameter(&rest_index);
4580   if (rest) {
4581     return Bailout(kRestParameter);
4582   }
4583
4584   if (scope->this_function_var() != nullptr ||
4585       scope->new_target_var() != nullptr) {
4586     return Bailout(kSuperReference);
4587   }
4588 }
4589
4590
4591 void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>* statements) {
4592   for (int i = 0; i < statements->length(); i++) {
4593     Statement* stmt = statements->at(i);
4594     CHECK_ALIVE(Visit(stmt));
4595     if (stmt->IsJump()) break;
4596   }
4597 }
4598
4599
4600 void HOptimizedGraphBuilder::VisitBlock(Block* stmt) {
4601   DCHECK(!HasStackOverflow());
4602   DCHECK(current_block() != NULL);
4603   DCHECK(current_block()->HasPredecessor());
4604
4605   Scope* outer_scope = scope();
4606   Scope* scope = stmt->scope();
4607   BreakAndContinueInfo break_info(stmt, outer_scope);
4608
4609   { BreakAndContinueScope push(&break_info, this);
4610     if (scope != NULL) {
4611       if (scope->ContextLocalCount() > 0) {
4612         // Load the function object.
4613         Scope* declaration_scope = scope->DeclarationScope();
4614         HInstruction* function;
4615         HValue* outer_context = environment()->context();
4616         if (declaration_scope->is_script_scope() ||
4617             declaration_scope->is_eval_scope()) {
4618           function = new (zone())
4619               HLoadContextSlot(outer_context, Context::CLOSURE_INDEX,
4620                                HLoadContextSlot::kNoCheck);
4621         } else {
4622           function = New<HThisFunction>();
4623         }
4624         AddInstruction(function);
4625         // Allocate a block context and store it to the stack frame.
4626         HInstruction* inner_context = Add<HAllocateBlockContext>(
4627             outer_context, function, scope->GetScopeInfo(isolate()));
4628         HInstruction* instr = Add<HStoreFrameContext>(inner_context);
4629         set_scope(scope);
4630         environment()->BindContext(inner_context);
4631         if (instr->HasObservableSideEffects()) {
4632           AddSimulate(stmt->EntryId(), REMOVABLE_SIMULATE);
4633         }
4634       }
4635       VisitDeclarations(scope->declarations());
4636       AddSimulate(stmt->DeclsId(), REMOVABLE_SIMULATE);
4637     }
4638     CHECK_BAILOUT(VisitStatements(stmt->statements()));
4639   }
4640   set_scope(outer_scope);
4641   if (scope != NULL && current_block() != NULL &&
4642       scope->ContextLocalCount() > 0) {
4643     HValue* inner_context = environment()->context();
4644     HValue* outer_context = Add<HLoadNamedField>(
4645         inner_context, nullptr,
4646         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4647
4648     HInstruction* instr = Add<HStoreFrameContext>(outer_context);
4649     environment()->BindContext(outer_context);
4650     if (instr->HasObservableSideEffects()) {
4651       AddSimulate(stmt->ExitId(), REMOVABLE_SIMULATE);
4652     }
4653   }
4654   HBasicBlock* break_block = break_info.break_block();
4655   if (break_block != NULL) {
4656     if (current_block() != NULL) Goto(break_block);
4657     break_block->SetJoinId(stmt->ExitId());
4658     set_current_block(break_block);
4659   }
4660 }
4661
4662
4663 void HOptimizedGraphBuilder::VisitExpressionStatement(
4664     ExpressionStatement* stmt) {
4665   DCHECK(!HasStackOverflow());
4666   DCHECK(current_block() != NULL);
4667   DCHECK(current_block()->HasPredecessor());
4668   VisitForEffect(stmt->expression());
4669 }
4670
4671
4672 void HOptimizedGraphBuilder::VisitEmptyStatement(EmptyStatement* stmt) {
4673   DCHECK(!HasStackOverflow());
4674   DCHECK(current_block() != NULL);
4675   DCHECK(current_block()->HasPredecessor());
4676 }
4677
4678
4679 void HOptimizedGraphBuilder::VisitIfStatement(IfStatement* stmt) {
4680   DCHECK(!HasStackOverflow());
4681   DCHECK(current_block() != NULL);
4682   DCHECK(current_block()->HasPredecessor());
4683   if (stmt->condition()->ToBooleanIsTrue()) {
4684     Add<HSimulate>(stmt->ThenId());
4685     Visit(stmt->then_statement());
4686   } else if (stmt->condition()->ToBooleanIsFalse()) {
4687     Add<HSimulate>(stmt->ElseId());
4688     Visit(stmt->else_statement());
4689   } else {
4690     HBasicBlock* cond_true = graph()->CreateBasicBlock();
4691     HBasicBlock* cond_false = graph()->CreateBasicBlock();
4692     CHECK_BAILOUT(VisitForControl(stmt->condition(), cond_true, cond_false));
4693
4694     if (cond_true->HasPredecessor()) {
4695       cond_true->SetJoinId(stmt->ThenId());
4696       set_current_block(cond_true);
4697       CHECK_BAILOUT(Visit(stmt->then_statement()));
4698       cond_true = current_block();
4699     } else {
4700       cond_true = NULL;
4701     }
4702
4703     if (cond_false->HasPredecessor()) {
4704       cond_false->SetJoinId(stmt->ElseId());
4705       set_current_block(cond_false);
4706       CHECK_BAILOUT(Visit(stmt->else_statement()));
4707       cond_false = current_block();
4708     } else {
4709       cond_false = NULL;
4710     }
4711
4712     HBasicBlock* join = CreateJoin(cond_true, cond_false, stmt->IfId());
4713     set_current_block(join);
4714   }
4715 }
4716
4717
4718 HBasicBlock* HOptimizedGraphBuilder::BreakAndContinueScope::Get(
4719     BreakableStatement* stmt,
4720     BreakType type,
4721     Scope** scope,
4722     int* drop_extra) {
4723   *drop_extra = 0;
4724   BreakAndContinueScope* current = this;
4725   while (current != NULL && current->info()->target() != stmt) {
4726     *drop_extra += current->info()->drop_extra();
4727     current = current->next();
4728   }
4729   DCHECK(current != NULL);  // Always found (unless stack is malformed).
4730   *scope = current->info()->scope();
4731
4732   if (type == BREAK) {
4733     *drop_extra += current->info()->drop_extra();
4734   }
4735
4736   HBasicBlock* block = NULL;
4737   switch (type) {
4738     case BREAK:
4739       block = current->info()->break_block();
4740       if (block == NULL) {
4741         block = current->owner()->graph()->CreateBasicBlock();
4742         current->info()->set_break_block(block);
4743       }
4744       break;
4745
4746     case CONTINUE:
4747       block = current->info()->continue_block();
4748       if (block == NULL) {
4749         block = current->owner()->graph()->CreateBasicBlock();
4750         current->info()->set_continue_block(block);
4751       }
4752       break;
4753   }
4754
4755   return block;
4756 }
4757
4758
4759 void HOptimizedGraphBuilder::VisitContinueStatement(
4760     ContinueStatement* stmt) {
4761   DCHECK(!HasStackOverflow());
4762   DCHECK(current_block() != NULL);
4763   DCHECK(current_block()->HasPredecessor());
4764   Scope* outer_scope = NULL;
4765   Scope* inner_scope = scope();
4766   int drop_extra = 0;
4767   HBasicBlock* continue_block = break_scope()->Get(
4768       stmt->target(), BreakAndContinueScope::CONTINUE,
4769       &outer_scope, &drop_extra);
4770   HValue* context = environment()->context();
4771   Drop(drop_extra);
4772   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4773   if (context_pop_count > 0) {
4774     while (context_pop_count-- > 0) {
4775       HInstruction* context_instruction = Add<HLoadNamedField>(
4776           context, nullptr,
4777           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4778       context = context_instruction;
4779     }
4780     HInstruction* instr = Add<HStoreFrameContext>(context);
4781     if (instr->HasObservableSideEffects()) {
4782       AddSimulate(stmt->target()->EntryId(), REMOVABLE_SIMULATE);
4783     }
4784     environment()->BindContext(context);
4785   }
4786
4787   Goto(continue_block);
4788   set_current_block(NULL);
4789 }
4790
4791
4792 void HOptimizedGraphBuilder::VisitBreakStatement(BreakStatement* stmt) {
4793   DCHECK(!HasStackOverflow());
4794   DCHECK(current_block() != NULL);
4795   DCHECK(current_block()->HasPredecessor());
4796   Scope* outer_scope = NULL;
4797   Scope* inner_scope = scope();
4798   int drop_extra = 0;
4799   HBasicBlock* break_block = break_scope()->Get(
4800       stmt->target(), BreakAndContinueScope::BREAK,
4801       &outer_scope, &drop_extra);
4802   HValue* context = environment()->context();
4803   Drop(drop_extra);
4804   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4805   if (context_pop_count > 0) {
4806     while (context_pop_count-- > 0) {
4807       HInstruction* context_instruction = Add<HLoadNamedField>(
4808           context, nullptr,
4809           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4810       context = context_instruction;
4811     }
4812     HInstruction* instr = Add<HStoreFrameContext>(context);
4813     if (instr->HasObservableSideEffects()) {
4814       AddSimulate(stmt->target()->ExitId(), REMOVABLE_SIMULATE);
4815     }
4816     environment()->BindContext(context);
4817   }
4818   Goto(break_block);
4819   set_current_block(NULL);
4820 }
4821
4822
4823 void HOptimizedGraphBuilder::VisitReturnStatement(ReturnStatement* stmt) {
4824   DCHECK(!HasStackOverflow());
4825   DCHECK(current_block() != NULL);
4826   DCHECK(current_block()->HasPredecessor());
4827   FunctionState* state = function_state();
4828   AstContext* context = call_context();
4829   if (context == NULL) {
4830     // Not an inlined return, so an actual one.
4831     CHECK_ALIVE(VisitForValue(stmt->expression()));
4832     HValue* result = environment()->Pop();
4833     Add<HReturn>(result);
4834   } else if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
4835     // Return from an inlined construct call. In a test context the return value
4836     // will always evaluate to true, in a value context the return value needs
4837     // to be a JSObject.
4838     if (context->IsTest()) {
4839       TestContext* test = TestContext::cast(context);
4840       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4841       Goto(test->if_true(), state);
4842     } else if (context->IsEffect()) {
4843       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4844       Goto(function_return(), state);
4845     } else {
4846       DCHECK(context->IsValue());
4847       CHECK_ALIVE(VisitForValue(stmt->expression()));
4848       HValue* return_value = Pop();
4849       HValue* receiver = environment()->arguments_environment()->Lookup(0);
4850       HHasInstanceTypeAndBranch* typecheck =
4851           New<HHasInstanceTypeAndBranch>(return_value,
4852                                          FIRST_SPEC_OBJECT_TYPE,
4853                                          LAST_SPEC_OBJECT_TYPE);
4854       HBasicBlock* if_spec_object = graph()->CreateBasicBlock();
4855       HBasicBlock* not_spec_object = graph()->CreateBasicBlock();
4856       typecheck->SetSuccessorAt(0, if_spec_object);
4857       typecheck->SetSuccessorAt(1, not_spec_object);
4858       FinishCurrentBlock(typecheck);
4859       AddLeaveInlined(if_spec_object, return_value, state);
4860       AddLeaveInlined(not_spec_object, receiver, state);
4861     }
4862   } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
4863     // Return from an inlined setter call. The returned value is never used, the
4864     // value of an assignment is always the value of the RHS of the assignment.
4865     CHECK_ALIVE(VisitForEffect(stmt->expression()));
4866     if (context->IsTest()) {
4867       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4868       context->ReturnValue(rhs);
4869     } else if (context->IsEffect()) {
4870       Goto(function_return(), state);
4871     } else {
4872       DCHECK(context->IsValue());
4873       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4874       AddLeaveInlined(rhs, state);
4875     }
4876   } else {
4877     // Return from a normal inlined function. Visit the subexpression in the
4878     // expression context of the call.
4879     if (context->IsTest()) {
4880       TestContext* test = TestContext::cast(context);
4881       VisitForControl(stmt->expression(), test->if_true(), test->if_false());
4882     } else if (context->IsEffect()) {
4883       // Visit in value context and ignore the result. This is needed to keep
4884       // environment in sync with full-codegen since some visitors (e.g.
4885       // VisitCountOperation) use the operand stack differently depending on
4886       // context.
4887       CHECK_ALIVE(VisitForValue(stmt->expression()));
4888       Pop();
4889       Goto(function_return(), state);
4890     } else {
4891       DCHECK(context->IsValue());
4892       CHECK_ALIVE(VisitForValue(stmt->expression()));
4893       AddLeaveInlined(Pop(), state);
4894     }
4895   }
4896   set_current_block(NULL);
4897 }
4898
4899
4900 void HOptimizedGraphBuilder::VisitWithStatement(WithStatement* stmt) {
4901   DCHECK(!HasStackOverflow());
4902   DCHECK(current_block() != NULL);
4903   DCHECK(current_block()->HasPredecessor());
4904   return Bailout(kWithStatement);
4905 }
4906
4907
4908 void HOptimizedGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
4909   DCHECK(!HasStackOverflow());
4910   DCHECK(current_block() != NULL);
4911   DCHECK(current_block()->HasPredecessor());
4912
4913   ZoneList<CaseClause*>* clauses = stmt->cases();
4914   int clause_count = clauses->length();
4915   ZoneList<HBasicBlock*> body_blocks(clause_count, zone());
4916
4917   CHECK_ALIVE(VisitForValue(stmt->tag()));
4918   Add<HSimulate>(stmt->EntryId());
4919   HValue* tag_value = Top();
4920   Type* tag_type = stmt->tag()->bounds().lower;
4921
4922   // 1. Build all the tests, with dangling true branches
4923   BailoutId default_id = BailoutId::None();
4924   for (int i = 0; i < clause_count; ++i) {
4925     CaseClause* clause = clauses->at(i);
4926     if (clause->is_default()) {
4927       body_blocks.Add(NULL, zone());
4928       if (default_id.IsNone()) default_id = clause->EntryId();
4929       continue;
4930     }
4931
4932     // Generate a compare and branch.
4933     CHECK_ALIVE(VisitForValue(clause->label()));
4934     HValue* label_value = Pop();
4935
4936     Type* label_type = clause->label()->bounds().lower;
4937     Type* combined_type = clause->compare_type();
4938     HControlInstruction* compare = BuildCompareInstruction(
4939         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
4940         combined_type,
4941         ScriptPositionToSourcePosition(stmt->tag()->position()),
4942         ScriptPositionToSourcePosition(clause->label()->position()),
4943         PUSH_BEFORE_SIMULATE, clause->id());
4944
4945     HBasicBlock* next_test_block = graph()->CreateBasicBlock();
4946     HBasicBlock* body_block = graph()->CreateBasicBlock();
4947     body_blocks.Add(body_block, zone());
4948     compare->SetSuccessorAt(0, body_block);
4949     compare->SetSuccessorAt(1, next_test_block);
4950     FinishCurrentBlock(compare);
4951
4952     set_current_block(body_block);
4953     Drop(1);  // tag_value
4954
4955     set_current_block(next_test_block);
4956   }
4957
4958   // Save the current block to use for the default or to join with the
4959   // exit.
4960   HBasicBlock* last_block = current_block();
4961   Drop(1);  // tag_value
4962
4963   // 2. Loop over the clauses and the linked list of tests in lockstep,
4964   // translating the clause bodies.
4965   HBasicBlock* fall_through_block = NULL;
4966
4967   BreakAndContinueInfo break_info(stmt, scope());
4968   { BreakAndContinueScope push(&break_info, this);
4969     for (int i = 0; i < clause_count; ++i) {
4970       CaseClause* clause = clauses->at(i);
4971
4972       // Identify the block where normal (non-fall-through) control flow
4973       // goes to.
4974       HBasicBlock* normal_block = NULL;
4975       if (clause->is_default()) {
4976         if (last_block == NULL) continue;
4977         normal_block = last_block;
4978         last_block = NULL;  // Cleared to indicate we've handled it.
4979       } else {
4980         normal_block = body_blocks[i];
4981       }
4982
4983       if (fall_through_block == NULL) {
4984         set_current_block(normal_block);
4985       } else {
4986         HBasicBlock* join = CreateJoin(fall_through_block,
4987                                        normal_block,
4988                                        clause->EntryId());
4989         set_current_block(join);
4990       }
4991
4992       CHECK_BAILOUT(VisitStatements(clause->statements()));
4993       fall_through_block = current_block();
4994     }
4995   }
4996
4997   // Create an up-to-3-way join.  Use the break block if it exists since
4998   // it's already a join block.
4999   HBasicBlock* break_block = break_info.break_block();
5000   if (break_block == NULL) {
5001     set_current_block(CreateJoin(fall_through_block,
5002                                  last_block,
5003                                  stmt->ExitId()));
5004   } else {
5005     if (fall_through_block != NULL) Goto(fall_through_block, break_block);
5006     if (last_block != NULL) Goto(last_block, break_block);
5007     break_block->SetJoinId(stmt->ExitId());
5008     set_current_block(break_block);
5009   }
5010 }
5011
5012
5013 void HOptimizedGraphBuilder::VisitLoopBody(IterationStatement* stmt,
5014                                            HBasicBlock* loop_entry) {
5015   Add<HSimulate>(stmt->StackCheckId());
5016   HStackCheck* stack_check =
5017       HStackCheck::cast(Add<HStackCheck>(HStackCheck::kBackwardsBranch));
5018   DCHECK(loop_entry->IsLoopHeader());
5019   loop_entry->loop_information()->set_stack_check(stack_check);
5020   CHECK_BAILOUT(Visit(stmt->body()));
5021 }
5022
5023
5024 void HOptimizedGraphBuilder::VisitDoWhileStatement(DoWhileStatement* stmt) {
5025   DCHECK(!HasStackOverflow());
5026   DCHECK(current_block() != NULL);
5027   DCHECK(current_block()->HasPredecessor());
5028   DCHECK(current_block() != NULL);
5029   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5030
5031   BreakAndContinueInfo break_info(stmt, scope());
5032   {
5033     BreakAndContinueScope push(&break_info, this);
5034     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5035   }
5036   HBasicBlock* body_exit =
5037       JoinContinue(stmt, current_block(), break_info.continue_block());
5038   HBasicBlock* loop_successor = NULL;
5039   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
5040     set_current_block(body_exit);
5041     loop_successor = graph()->CreateBasicBlock();
5042     if (stmt->cond()->ToBooleanIsFalse()) {
5043       loop_entry->loop_information()->stack_check()->Eliminate();
5044       Goto(loop_successor);
5045       body_exit = NULL;
5046     } else {
5047       // The block for a true condition, the actual predecessor block of the
5048       // back edge.
5049       body_exit = graph()->CreateBasicBlock();
5050       CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
5051     }
5052     if (body_exit != NULL && body_exit->HasPredecessor()) {
5053       body_exit->SetJoinId(stmt->BackEdgeId());
5054     } else {
5055       body_exit = NULL;
5056     }
5057     if (loop_successor->HasPredecessor()) {
5058       loop_successor->SetJoinId(stmt->ExitId());
5059     } else {
5060       loop_successor = NULL;
5061     }
5062   }
5063   HBasicBlock* loop_exit = CreateLoop(stmt,
5064                                       loop_entry,
5065                                       body_exit,
5066                                       loop_successor,
5067                                       break_info.break_block());
5068   set_current_block(loop_exit);
5069 }
5070
5071
5072 void HOptimizedGraphBuilder::VisitWhileStatement(WhileStatement* stmt) {
5073   DCHECK(!HasStackOverflow());
5074   DCHECK(current_block() != NULL);
5075   DCHECK(current_block()->HasPredecessor());
5076   DCHECK(current_block() != NULL);
5077   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5078
5079   // If the condition is constant true, do not generate a branch.
5080   HBasicBlock* loop_successor = NULL;
5081   if (!stmt->cond()->ToBooleanIsTrue()) {
5082     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5083     loop_successor = graph()->CreateBasicBlock();
5084     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5085     if (body_entry->HasPredecessor()) {
5086       body_entry->SetJoinId(stmt->BodyId());
5087       set_current_block(body_entry);
5088     }
5089     if (loop_successor->HasPredecessor()) {
5090       loop_successor->SetJoinId(stmt->ExitId());
5091     } else {
5092       loop_successor = NULL;
5093     }
5094   }
5095
5096   BreakAndContinueInfo break_info(stmt, scope());
5097   if (current_block() != NULL) {
5098     BreakAndContinueScope push(&break_info, this);
5099     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5100   }
5101   HBasicBlock* body_exit =
5102       JoinContinue(stmt, current_block(), break_info.continue_block());
5103   HBasicBlock* loop_exit = CreateLoop(stmt,
5104                                       loop_entry,
5105                                       body_exit,
5106                                       loop_successor,
5107                                       break_info.break_block());
5108   set_current_block(loop_exit);
5109 }
5110
5111
5112 void HOptimizedGraphBuilder::VisitForStatement(ForStatement* stmt) {
5113   DCHECK(!HasStackOverflow());
5114   DCHECK(current_block() != NULL);
5115   DCHECK(current_block()->HasPredecessor());
5116   if (stmt->init() != NULL) {
5117     CHECK_ALIVE(Visit(stmt->init()));
5118   }
5119   DCHECK(current_block() != NULL);
5120   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5121
5122   HBasicBlock* loop_successor = NULL;
5123   if (stmt->cond() != NULL) {
5124     HBasicBlock* body_entry = graph()->CreateBasicBlock();
5125     loop_successor = graph()->CreateBasicBlock();
5126     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
5127     if (body_entry->HasPredecessor()) {
5128       body_entry->SetJoinId(stmt->BodyId());
5129       set_current_block(body_entry);
5130     }
5131     if (loop_successor->HasPredecessor()) {
5132       loop_successor->SetJoinId(stmt->ExitId());
5133     } else {
5134       loop_successor = NULL;
5135     }
5136   }
5137
5138   BreakAndContinueInfo break_info(stmt, scope());
5139   if (current_block() != NULL) {
5140     BreakAndContinueScope push(&break_info, this);
5141     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5142   }
5143   HBasicBlock* body_exit =
5144       JoinContinue(stmt, current_block(), break_info.continue_block());
5145
5146   if (stmt->next() != NULL && body_exit != NULL) {
5147     set_current_block(body_exit);
5148     CHECK_BAILOUT(Visit(stmt->next()));
5149     body_exit = current_block();
5150   }
5151
5152   HBasicBlock* loop_exit = CreateLoop(stmt,
5153                                       loop_entry,
5154                                       body_exit,
5155                                       loop_successor,
5156                                       break_info.break_block());
5157   set_current_block(loop_exit);
5158 }
5159
5160
5161 void HOptimizedGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
5162   DCHECK(!HasStackOverflow());
5163   DCHECK(current_block() != NULL);
5164   DCHECK(current_block()->HasPredecessor());
5165
5166   if (!FLAG_optimize_for_in) {
5167     return Bailout(kForInStatementOptimizationIsDisabled);
5168   }
5169
5170   if (!stmt->each()->IsVariableProxy() ||
5171       !stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
5172     return Bailout(kForInStatementWithNonLocalEachVariable);
5173   }
5174
5175   Variable* each_var = stmt->each()->AsVariableProxy()->var();
5176
5177   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
5178   HValue* enumerable = Top();  // Leave enumerable at the top.
5179
5180   IfBuilder if_undefined_or_null(this);
5181   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5182       enumerable, graph()->GetConstantUndefined());
5183   if_undefined_or_null.Or();
5184   if_undefined_or_null.If<HCompareObjectEqAndBranch>(
5185       enumerable, graph()->GetConstantNull());
5186   if_undefined_or_null.ThenDeopt(Deoptimizer::kUndefinedOrNullInForIn);
5187   if_undefined_or_null.End();
5188   BuildForInBody(stmt, each_var, enumerable);
5189 }
5190
5191
5192 void HOptimizedGraphBuilder::BuildForInBody(ForInStatement* stmt,
5193                                             Variable* each_var,
5194                                             HValue* enumerable) {
5195   HInstruction* map;
5196   HInstruction* array;
5197   HInstruction* enum_length;
5198   bool fast = stmt->for_in_type() == ForInStatement::FAST_FOR_IN;
5199   if (fast) {
5200     map = Add<HForInPrepareMap>(enumerable);
5201     Add<HSimulate>(stmt->PrepareId());
5202
5203     array = Add<HForInCacheArray>(enumerable, map,
5204                                   DescriptorArray::kEnumCacheBridgeCacheIndex);
5205     enum_length = Add<HMapEnumLength>(map);
5206
5207     HInstruction* index_cache = Add<HForInCacheArray>(
5208         enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
5209     HForInCacheArray::cast(array)
5210         ->set_index_cache(HForInCacheArray::cast(index_cache));
5211   } else {
5212     Add<HSimulate>(stmt->PrepareId());
5213     {
5214       NoObservableSideEffectsScope no_effects(this);
5215       BuildJSObjectCheck(enumerable, 0);
5216     }
5217     Add<HSimulate>(stmt->ToObjectId());
5218
5219     map = graph()->GetConstant1();
5220     Runtime::FunctionId function_id = Runtime::kGetPropertyNamesFast;
5221     Add<HPushArguments>(enumerable);
5222     array = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5223                               Runtime::FunctionForId(function_id), 1);
5224     Push(array);
5225     Add<HSimulate>(stmt->EnumId());
5226     Drop(1);
5227     Handle<Map> array_map = isolate()->factory()->fixed_array_map();
5228     HValue* check = Add<HCheckMaps>(array, array_map);
5229     enum_length = AddLoadFixedArrayLength(array, check);
5230   }
5231
5232   HInstruction* start_index = Add<HConstant>(0);
5233
5234   Push(map);
5235   Push(array);
5236   Push(enum_length);
5237   Push(start_index);
5238
5239   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5240
5241   // Reload the values to ensure we have up-to-date values inside of the loop.
5242   // This is relevant especially for OSR where the values don't come from the
5243   // computation above, but from the OSR entry block.
5244   enumerable = environment()->ExpressionStackAt(4);
5245   HValue* index = environment()->ExpressionStackAt(0);
5246   HValue* limit = environment()->ExpressionStackAt(1);
5247
5248   // Check that we still have more keys.
5249   HCompareNumericAndBranch* compare_index =
5250       New<HCompareNumericAndBranch>(index, limit, Token::LT);
5251   compare_index->set_observed_input_representation(
5252       Representation::Smi(), Representation::Smi());
5253
5254   HBasicBlock* loop_body = graph()->CreateBasicBlock();
5255   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
5256
5257   compare_index->SetSuccessorAt(0, loop_body);
5258   compare_index->SetSuccessorAt(1, loop_successor);
5259   FinishCurrentBlock(compare_index);
5260
5261   set_current_block(loop_successor);
5262   Drop(5);
5263
5264   set_current_block(loop_body);
5265
5266   HValue* key =
5267       Add<HLoadKeyed>(environment()->ExpressionStackAt(2),  // Enum cache.
5268                       index, index, FAST_ELEMENTS);
5269
5270   if (fast) {
5271     // Check if the expected map still matches that of the enumerable.
5272     // If not just deoptimize.
5273     Add<HCheckMapValue>(enumerable, environment()->ExpressionStackAt(3));
5274     Bind(each_var, key);
5275   } else {
5276     Add<HPushArguments>(enumerable, key);
5277     Runtime::FunctionId function_id = Runtime::kForInFilter;
5278     key = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5279                             Runtime::FunctionForId(function_id), 2);
5280     Push(key);
5281     Add<HSimulate>(stmt->FilterId());
5282     key = Pop();
5283     Bind(each_var, key);
5284     IfBuilder if_undefined(this);
5285     if_undefined.If<HCompareObjectEqAndBranch>(key,
5286                                                graph()->GetConstantUndefined());
5287     if_undefined.ThenDeopt(Deoptimizer::kUndefined);
5288     if_undefined.End();
5289     Add<HSimulate>(stmt->AssignmentId());
5290   }
5291
5292   BreakAndContinueInfo break_info(stmt, scope(), 5);
5293   {
5294     BreakAndContinueScope push(&break_info, this);
5295     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5296   }
5297
5298   HBasicBlock* body_exit =
5299       JoinContinue(stmt, current_block(), break_info.continue_block());
5300
5301   if (body_exit != NULL) {
5302     set_current_block(body_exit);
5303
5304     HValue* current_index = Pop();
5305     Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
5306     body_exit = current_block();
5307   }
5308
5309   HBasicBlock* loop_exit = CreateLoop(stmt,
5310                                       loop_entry,
5311                                       body_exit,
5312                                       loop_successor,
5313                                       break_info.break_block());
5314
5315   set_current_block(loop_exit);
5316 }
5317
5318
5319 void HOptimizedGraphBuilder::VisitForOfStatement(ForOfStatement* stmt) {
5320   DCHECK(!HasStackOverflow());
5321   DCHECK(current_block() != NULL);
5322   DCHECK(current_block()->HasPredecessor());
5323   return Bailout(kForOfStatement);
5324 }
5325
5326
5327 void HOptimizedGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
5328   DCHECK(!HasStackOverflow());
5329   DCHECK(current_block() != NULL);
5330   DCHECK(current_block()->HasPredecessor());
5331   return Bailout(kTryCatchStatement);
5332 }
5333
5334
5335 void HOptimizedGraphBuilder::VisitTryFinallyStatement(
5336     TryFinallyStatement* stmt) {
5337   DCHECK(!HasStackOverflow());
5338   DCHECK(current_block() != NULL);
5339   DCHECK(current_block()->HasPredecessor());
5340   return Bailout(kTryFinallyStatement);
5341 }
5342
5343
5344 void HOptimizedGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
5345   DCHECK(!HasStackOverflow());
5346   DCHECK(current_block() != NULL);
5347   DCHECK(current_block()->HasPredecessor());
5348   return Bailout(kDebuggerStatement);
5349 }
5350
5351
5352 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
5353   UNREACHABLE();
5354 }
5355
5356
5357 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
5358   DCHECK(!HasStackOverflow());
5359   DCHECK(current_block() != NULL);
5360   DCHECK(current_block()->HasPredecessor());
5361   Handle<SharedFunctionInfo> shared_info = Compiler::GetSharedFunctionInfo(
5362       expr, current_info()->script(), top_info());
5363   // We also have a stack overflow if the recursive compilation did.
5364   if (HasStackOverflow()) return;
5365   HFunctionLiteral* instr =
5366       New<HFunctionLiteral>(shared_info, expr->pretenure());
5367   return ast_context()->ReturnInstruction(instr, expr->id());
5368 }
5369
5370
5371 void HOptimizedGraphBuilder::VisitClassLiteral(ClassLiteral* lit) {
5372   DCHECK(!HasStackOverflow());
5373   DCHECK(current_block() != NULL);
5374   DCHECK(current_block()->HasPredecessor());
5375   return Bailout(kClassLiteral);
5376 }
5377
5378
5379 void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
5380     NativeFunctionLiteral* expr) {
5381   DCHECK(!HasStackOverflow());
5382   DCHECK(current_block() != NULL);
5383   DCHECK(current_block()->HasPredecessor());
5384   return Bailout(kNativeFunctionLiteral);
5385 }
5386
5387
5388 void HOptimizedGraphBuilder::VisitConditional(Conditional* expr) {
5389   DCHECK(!HasStackOverflow());
5390   DCHECK(current_block() != NULL);
5391   DCHECK(current_block()->HasPredecessor());
5392   HBasicBlock* cond_true = graph()->CreateBasicBlock();
5393   HBasicBlock* cond_false = graph()->CreateBasicBlock();
5394   CHECK_BAILOUT(VisitForControl(expr->condition(), cond_true, cond_false));
5395
5396   // Visit the true and false subexpressions in the same AST context as the
5397   // whole expression.
5398   if (cond_true->HasPredecessor()) {
5399     cond_true->SetJoinId(expr->ThenId());
5400     set_current_block(cond_true);
5401     CHECK_BAILOUT(Visit(expr->then_expression()));
5402     cond_true = current_block();
5403   } else {
5404     cond_true = NULL;
5405   }
5406
5407   if (cond_false->HasPredecessor()) {
5408     cond_false->SetJoinId(expr->ElseId());
5409     set_current_block(cond_false);
5410     CHECK_BAILOUT(Visit(expr->else_expression()));
5411     cond_false = current_block();
5412   } else {
5413     cond_false = NULL;
5414   }
5415
5416   if (!ast_context()->IsTest()) {
5417     HBasicBlock* join = CreateJoin(cond_true, cond_false, expr->id());
5418     set_current_block(join);
5419     if (join != NULL && !ast_context()->IsEffect()) {
5420       return ast_context()->ReturnValue(Pop());
5421     }
5422   }
5423 }
5424
5425
5426 HOptimizedGraphBuilder::GlobalPropertyAccess
5427 HOptimizedGraphBuilder::LookupGlobalProperty(Variable* var, LookupIterator* it,
5428                                              PropertyAccessType access_type) {
5429   if (var->is_this() || !current_info()->has_global_object()) {
5430     return kUseGeneric;
5431   }
5432
5433   switch (it->state()) {
5434     case LookupIterator::ACCESSOR:
5435     case LookupIterator::ACCESS_CHECK:
5436     case LookupIterator::INTERCEPTOR:
5437     case LookupIterator::INTEGER_INDEXED_EXOTIC:
5438     case LookupIterator::NOT_FOUND:
5439       return kUseGeneric;
5440     case LookupIterator::DATA:
5441       if (access_type == STORE && it->IsReadOnly()) return kUseGeneric;
5442       return kUseCell;
5443     case LookupIterator::JSPROXY:
5444     case LookupIterator::TRANSITION:
5445       UNREACHABLE();
5446   }
5447   UNREACHABLE();
5448   return kUseGeneric;
5449 }
5450
5451
5452 HValue* HOptimizedGraphBuilder::BuildContextChainWalk(Variable* var) {
5453   DCHECK(var->IsContextSlot());
5454   HValue* context = environment()->context();
5455   int length = scope()->ContextChainLength(var->scope());
5456   while (length-- > 0) {
5457     context = Add<HLoadNamedField>(
5458         context, nullptr,
5459         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
5460   }
5461   return context;
5462 }
5463
5464
5465 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
5466   DCHECK(!HasStackOverflow());
5467   DCHECK(current_block() != NULL);
5468   DCHECK(current_block()->HasPredecessor());
5469   Variable* variable = expr->var();
5470   switch (variable->location()) {
5471     case VariableLocation::GLOBAL:
5472     case VariableLocation::UNALLOCATED: {
5473       if (IsLexicalVariableMode(variable->mode())) {
5474         // TODO(rossberg): should this be an DCHECK?
5475         return Bailout(kReferenceToGlobalLexicalVariable);
5476       }
5477       // Handle known global constants like 'undefined' specially to avoid a
5478       // load from a global cell for them.
5479       Handle<Object> constant_value =
5480           isolate()->factory()->GlobalConstantFor(variable->name());
5481       if (!constant_value.is_null()) {
5482         HConstant* instr = New<HConstant>(constant_value);
5483         return ast_context()->ReturnInstruction(instr, expr->id());
5484       }
5485
5486       Handle<GlobalObject> global(current_info()->global_object());
5487
5488       // Lookup in script contexts.
5489       {
5490         Handle<ScriptContextTable> script_contexts(
5491             global->native_context()->script_context_table());
5492         ScriptContextTable::LookupResult lookup;
5493         if (ScriptContextTable::Lookup(script_contexts, variable->name(),
5494                                        &lookup)) {
5495           Handle<Context> script_context = ScriptContextTable::GetContext(
5496               script_contexts, lookup.context_index);
5497           Handle<Object> current_value =
5498               FixedArray::get(script_context, lookup.slot_index);
5499
5500           // If the values is not the hole, it will stay initialized,
5501           // so no need to generate a check.
5502           if (*current_value == *isolate()->factory()->the_hole_value()) {
5503             return Bailout(kReferenceToUninitializedVariable);
5504           }
5505           HInstruction* result = New<HLoadNamedField>(
5506               Add<HConstant>(script_context), nullptr,
5507               HObjectAccess::ForContextSlot(lookup.slot_index));
5508           return ast_context()->ReturnInstruction(result, expr->id());
5509         }
5510       }
5511
5512       LookupIterator it(global, variable->name(), LookupIterator::OWN);
5513       GlobalPropertyAccess type = LookupGlobalProperty(variable, &it, LOAD);
5514
5515       if (type == kUseCell) {
5516         Handle<PropertyCell> cell = it.GetPropertyCell();
5517         top_info()->dependencies()->AssumePropertyCell(cell);
5518         auto cell_type = it.property_details().cell_type();
5519         if (cell_type == PropertyCellType::kConstant ||
5520             cell_type == PropertyCellType::kUndefined) {
5521           Handle<Object> constant_object(cell->value(), isolate());
5522           if (constant_object->IsConsString()) {
5523             constant_object =
5524                 String::Flatten(Handle<String>::cast(constant_object));
5525           }
5526           HConstant* constant = New<HConstant>(constant_object);
5527           return ast_context()->ReturnInstruction(constant, expr->id());
5528         } else {
5529           auto access = HObjectAccess::ForPropertyCellValue();
5530           UniqueSet<Map>* field_maps = nullptr;
5531           if (cell_type == PropertyCellType::kConstantType) {
5532             switch (cell->GetConstantType()) {
5533               case PropertyCellConstantType::kSmi:
5534                 access = access.WithRepresentation(Representation::Smi());
5535                 break;
5536               case PropertyCellConstantType::kStableMap: {
5537                 // Check that the map really is stable. The heap object could
5538                 // have mutated without the cell updating state. In that case,
5539                 // make no promises about the loaded value except that it's a
5540                 // heap object.
5541                 access =
5542                     access.WithRepresentation(Representation::HeapObject());
5543                 Handle<Map> map(HeapObject::cast(cell->value())->map());
5544                 if (map->is_stable()) {
5545                   field_maps = new (zone())
5546                       UniqueSet<Map>(Unique<Map>::CreateImmovable(map), zone());
5547                 }
5548                 break;
5549               }
5550             }
5551           }
5552           HConstant* cell_constant = Add<HConstant>(cell);
5553           HLoadNamedField* instr;
5554           if (field_maps == nullptr) {
5555             instr = New<HLoadNamedField>(cell_constant, nullptr, access);
5556           } else {
5557             instr = New<HLoadNamedField>(cell_constant, nullptr, access,
5558                                          field_maps, HType::HeapObject());
5559           }
5560           instr->ClearDependsOnFlag(kInobjectFields);
5561           instr->SetDependsOnFlag(kGlobalVars);
5562           return ast_context()->ReturnInstruction(instr, expr->id());
5563         }
5564       } else if (variable->IsGlobalSlot()) {
5565         DCHECK(variable->index() > 0);
5566         DCHECK(variable->IsStaticGlobalObjectProperty());
5567         // Each var occupies two slots in the context: for reads and writes.
5568         int slot_index = variable->index();
5569         int depth = scope()->ContextChainLength(variable->scope());
5570
5571         HLoadGlobalViaContext* instr =
5572             New<HLoadGlobalViaContext>(depth, slot_index);
5573         return ast_context()->ReturnInstruction(instr, expr->id());
5574
5575       } else {
5576         HValue* global_object = Add<HLoadNamedField>(
5577             context(), nullptr,
5578             HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
5579         HLoadGlobalGeneric* instr = New<HLoadGlobalGeneric>(
5580             global_object, variable->name(), ast_context()->typeof_mode());
5581         instr->SetVectorAndSlot(handle(current_feedback_vector(), isolate()),
5582                                 expr->VariableFeedbackSlot());
5583         return ast_context()->ReturnInstruction(instr, expr->id());
5584       }
5585     }
5586
5587     case VariableLocation::PARAMETER:
5588     case VariableLocation::LOCAL: {
5589       HValue* value = LookupAndMakeLive(variable);
5590       if (value == graph()->GetConstantHole()) {
5591         DCHECK(IsDeclaredVariableMode(variable->mode()) &&
5592                variable->mode() != VAR);
5593         return Bailout(kReferenceToUninitializedVariable);
5594       }
5595       return ast_context()->ReturnValue(value);
5596     }
5597
5598     case VariableLocation::CONTEXT: {
5599       HValue* context = BuildContextChainWalk(variable);
5600       HLoadContextSlot::Mode mode;
5601       switch (variable->mode()) {
5602         case LET:
5603         case CONST:
5604           mode = HLoadContextSlot::kCheckDeoptimize;
5605           break;
5606         case CONST_LEGACY:
5607           mode = HLoadContextSlot::kCheckReturnUndefined;
5608           break;
5609         default:
5610           mode = HLoadContextSlot::kNoCheck;
5611           break;
5612       }
5613       HLoadContextSlot* instr =
5614           new(zone()) HLoadContextSlot(context, variable->index(), mode);
5615       return ast_context()->ReturnInstruction(instr, expr->id());
5616     }
5617
5618     case VariableLocation::LOOKUP:
5619       return Bailout(kReferenceToAVariableWhichRequiresDynamicLookup);
5620   }
5621 }
5622
5623
5624 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
5625   DCHECK(!HasStackOverflow());
5626   DCHECK(current_block() != NULL);
5627   DCHECK(current_block()->HasPredecessor());
5628   HConstant* instr = New<HConstant>(expr->value());
5629   return ast_context()->ReturnInstruction(instr, expr->id());
5630 }
5631
5632
5633 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
5634   DCHECK(!HasStackOverflow());
5635   DCHECK(current_block() != NULL);
5636   DCHECK(current_block()->HasPredecessor());
5637   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5638   Handle<FixedArray> literals(closure->literals());
5639   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
5640                                               expr->pattern(),
5641                                               expr->flags(),
5642                                               expr->literal_index());
5643   return ast_context()->ReturnInstruction(instr, expr->id());
5644 }
5645
5646
5647 static bool CanInlinePropertyAccess(Handle<Map> map) {
5648   if (map->instance_type() == HEAP_NUMBER_TYPE) return true;
5649   if (map->instance_type() < FIRST_NONSTRING_TYPE) return true;
5650   return map->IsJSObjectMap() && !map->is_dictionary_map() &&
5651          !map->has_named_interceptor() &&
5652          // TODO(verwaest): Whitelist contexts to which we have access.
5653          !map->is_access_check_needed();
5654 }
5655
5656
5657 // Determines whether the given array or object literal boilerplate satisfies
5658 // all limits to be considered for fast deep-copying and computes the total
5659 // size of all objects that are part of the graph.
5660 static bool IsFastLiteral(Handle<JSObject> boilerplate,
5661                           int max_depth,
5662                           int* max_properties) {
5663   if (boilerplate->map()->is_deprecated() &&
5664       !JSObject::TryMigrateInstance(boilerplate)) {
5665     return false;
5666   }
5667
5668   DCHECK(max_depth >= 0 && *max_properties >= 0);
5669   if (max_depth == 0) return false;
5670
5671   Isolate* isolate = boilerplate->GetIsolate();
5672   Handle<FixedArrayBase> elements(boilerplate->elements());
5673   if (elements->length() > 0 &&
5674       elements->map() != isolate->heap()->fixed_cow_array_map()) {
5675     if (boilerplate->HasFastSmiOrObjectElements()) {
5676       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
5677       int length = elements->length();
5678       for (int i = 0; i < length; i++) {
5679         if ((*max_properties)-- == 0) return false;
5680         Handle<Object> value(fast_elements->get(i), isolate);
5681         if (value->IsJSObject()) {
5682           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5683           if (!IsFastLiteral(value_object,
5684                              max_depth - 1,
5685                              max_properties)) {
5686             return false;
5687           }
5688         }
5689       }
5690     } else if (!boilerplate->HasFastDoubleElements()) {
5691       return false;
5692     }
5693   }
5694
5695   Handle<FixedArray> properties(boilerplate->properties());
5696   if (properties->length() > 0) {
5697     return false;
5698   } else {
5699     Handle<DescriptorArray> descriptors(
5700         boilerplate->map()->instance_descriptors());
5701     int limit = boilerplate->map()->NumberOfOwnDescriptors();
5702     for (int i = 0; i < limit; i++) {
5703       PropertyDetails details = descriptors->GetDetails(i);
5704       if (details.type() != DATA) continue;
5705       if ((*max_properties)-- == 0) return false;
5706       FieldIndex field_index = FieldIndex::ForDescriptor(boilerplate->map(), i);
5707       if (boilerplate->IsUnboxedDoubleField(field_index)) continue;
5708       Handle<Object> value(boilerplate->RawFastPropertyAt(field_index),
5709                            isolate);
5710       if (value->IsJSObject()) {
5711         Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5712         if (!IsFastLiteral(value_object,
5713                            max_depth - 1,
5714                            max_properties)) {
5715           return false;
5716         }
5717       }
5718     }
5719   }
5720   return true;
5721 }
5722
5723
5724 void HOptimizedGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
5725   DCHECK(!HasStackOverflow());
5726   DCHECK(current_block() != NULL);
5727   DCHECK(current_block()->HasPredecessor());
5728
5729   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5730   HInstruction* literal;
5731
5732   // Check whether to use fast or slow deep-copying for boilerplate.
5733   int max_properties = kMaxFastLiteralProperties;
5734   Handle<Object> literals_cell(closure->literals()->get(expr->literal_index()),
5735                                isolate());
5736   Handle<AllocationSite> site;
5737   Handle<JSObject> boilerplate;
5738   if (!literals_cell->IsUndefined()) {
5739     // Retrieve the boilerplate
5740     site = Handle<AllocationSite>::cast(literals_cell);
5741     boilerplate = Handle<JSObject>(JSObject::cast(site->transition_info()),
5742                                    isolate());
5743   }
5744
5745   if (!boilerplate.is_null() &&
5746       IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
5747     AllocationSiteUsageContext site_context(isolate(), site, false);
5748     site_context.EnterNewScope();
5749     literal = BuildFastLiteral(boilerplate, &site_context);
5750     site_context.ExitScope(site, boilerplate);
5751   } else {
5752     NoObservableSideEffectsScope no_effects(this);
5753     Handle<FixedArray> closure_literals(closure->literals(), isolate());
5754     Handle<FixedArray> constant_properties = expr->constant_properties();
5755     int literal_index = expr->literal_index();
5756     int flags = expr->ComputeFlags(true);
5757
5758     Add<HPushArguments>(Add<HConstant>(closure_literals),
5759                         Add<HConstant>(literal_index),
5760                         Add<HConstant>(constant_properties),
5761                         Add<HConstant>(flags));
5762
5763     Runtime::FunctionId function_id = Runtime::kCreateObjectLiteral;
5764     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5765                                 Runtime::FunctionForId(function_id),
5766                                 4);
5767   }
5768
5769   // The object is expected in the bailout environment during computation
5770   // of the property values and is the value of the entire expression.
5771   Push(literal);
5772
5773   for (int i = 0; i < expr->properties()->length(); i++) {
5774     ObjectLiteral::Property* property = expr->properties()->at(i);
5775     if (property->is_computed_name()) return Bailout(kComputedPropertyName);
5776     if (property->IsCompileTimeValue()) continue;
5777
5778     Literal* key = property->key()->AsLiteral();
5779     Expression* value = property->value();
5780
5781     switch (property->kind()) {
5782       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
5783         DCHECK(!CompileTimeValue::IsCompileTimeValue(value));
5784         // Fall through.
5785       case ObjectLiteral::Property::COMPUTED:
5786         // It is safe to use [[Put]] here because the boilerplate already
5787         // contains computed properties with an uninitialized value.
5788         if (key->value()->IsInternalizedString()) {
5789           if (property->emit_store()) {
5790             CHECK_ALIVE(VisitForValue(value));
5791             HValue* value = Pop();
5792
5793             // Add [[HomeObject]] to function literals.
5794             if (FunctionLiteral::NeedsHomeObject(property->value())) {
5795               Handle<Symbol> sym = isolate()->factory()->home_object_symbol();
5796               HInstruction* store_home = BuildKeyedGeneric(
5797                   STORE, NULL, value, Add<HConstant>(sym), literal);
5798               AddInstruction(store_home);
5799               DCHECK(store_home->HasObservableSideEffects());
5800               Add<HSimulate>(property->value()->id(), REMOVABLE_SIMULATE);
5801             }
5802
5803             Handle<Map> map = property->GetReceiverType();
5804             Handle<String> name = key->AsPropertyName();
5805             HValue* store;
5806             if (map.is_null()) {
5807               // If we don't know the monomorphic type, do a generic store.
5808               CHECK_ALIVE(store = BuildNamedGeneric(
5809                   STORE, NULL, literal, name, value));
5810             } else {
5811               PropertyAccessInfo info(this, STORE, map, name);
5812               if (info.CanAccessMonomorphic()) {
5813                 HValue* checked_literal = Add<HCheckMaps>(literal, map);
5814                 DCHECK(!info.IsAccessorConstant());
5815                 store = BuildMonomorphicAccess(
5816                     &info, literal, checked_literal, value,
5817                     BailoutId::None(), BailoutId::None());
5818               } else {
5819                 CHECK_ALIVE(store = BuildNamedGeneric(
5820                     STORE, NULL, literal, name, value));
5821               }
5822             }
5823             if (store->IsInstruction()) {
5824               AddInstruction(HInstruction::cast(store));
5825             }
5826             DCHECK(store->HasObservableSideEffects());
5827             Add<HSimulate>(key->id(), REMOVABLE_SIMULATE);
5828           } else {
5829             CHECK_ALIVE(VisitForEffect(value));
5830           }
5831           break;
5832         }
5833         // Fall through.
5834       case ObjectLiteral::Property::PROTOTYPE:
5835       case ObjectLiteral::Property::SETTER:
5836       case ObjectLiteral::Property::GETTER:
5837         return Bailout(kObjectLiteralWithComplexProperty);
5838       default: UNREACHABLE();
5839     }
5840   }
5841
5842   if (expr->has_function()) {
5843     // Return the result of the transformation to fast properties
5844     // instead of the original since this operation changes the map
5845     // of the object. This makes sure that the original object won't
5846     // be used by other optimized code before it is transformed
5847     // (e.g. because of code motion).
5848     HToFastProperties* result = Add<HToFastProperties>(Pop());
5849     return ast_context()->ReturnValue(result);
5850   } else {
5851     return ast_context()->ReturnValue(Pop());
5852   }
5853 }
5854
5855
5856 void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
5857   DCHECK(!HasStackOverflow());
5858   DCHECK(current_block() != NULL);
5859   DCHECK(current_block()->HasPredecessor());
5860   expr->BuildConstantElements(isolate());
5861   ZoneList<Expression*>* subexprs = expr->values();
5862   int length = subexprs->length();
5863   HInstruction* literal;
5864
5865   Handle<AllocationSite> site;
5866   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
5867   bool uninitialized = false;
5868   Handle<Object> literals_cell(literals->get(expr->literal_index()),
5869                                isolate());
5870   Handle<JSObject> boilerplate_object;
5871   if (literals_cell->IsUndefined()) {
5872     uninitialized = true;
5873     Handle<Object> raw_boilerplate;
5874     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
5875         isolate(), raw_boilerplate,
5876         Runtime::CreateArrayLiteralBoilerplate(
5877             isolate(), literals, expr->constant_elements(),
5878             is_strong(function_language_mode())),
5879         Bailout(kArrayBoilerplateCreationFailed));
5880
5881     boilerplate_object = Handle<JSObject>::cast(raw_boilerplate);
5882     AllocationSiteCreationContext creation_context(isolate());
5883     site = creation_context.EnterNewScope();
5884     if (JSObject::DeepWalk(boilerplate_object, &creation_context).is_null()) {
5885       return Bailout(kArrayBoilerplateCreationFailed);
5886     }
5887     creation_context.ExitScope(site, boilerplate_object);
5888     literals->set(expr->literal_index(), *site);
5889
5890     if (boilerplate_object->elements()->map() ==
5891         isolate()->heap()->fixed_cow_array_map()) {
5892       isolate()->counters()->cow_arrays_created_runtime()->Increment();
5893     }
5894   } else {
5895     DCHECK(literals_cell->IsAllocationSite());
5896     site = Handle<AllocationSite>::cast(literals_cell);
5897     boilerplate_object = Handle<JSObject>(
5898         JSObject::cast(site->transition_info()), isolate());
5899   }
5900
5901   DCHECK(!boilerplate_object.is_null());
5902   DCHECK(site->SitePointsToLiteral());
5903
5904   ElementsKind boilerplate_elements_kind =
5905       boilerplate_object->GetElementsKind();
5906
5907   // Check whether to use fast or slow deep-copying for boilerplate.
5908   int max_properties = kMaxFastLiteralProperties;
5909   if (IsFastLiteral(boilerplate_object,
5910                     kMaxFastLiteralDepth,
5911                     &max_properties)) {
5912     AllocationSiteUsageContext site_context(isolate(), site, false);
5913     site_context.EnterNewScope();
5914     literal = BuildFastLiteral(boilerplate_object, &site_context);
5915     site_context.ExitScope(site, boilerplate_object);
5916   } else {
5917     NoObservableSideEffectsScope no_effects(this);
5918     // Boilerplate already exists and constant elements are never accessed,
5919     // pass an empty fixed array to the runtime function instead.
5920     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
5921     int literal_index = expr->literal_index();
5922     int flags = expr->ComputeFlags(true);
5923
5924     Add<HPushArguments>(Add<HConstant>(literals),
5925                         Add<HConstant>(literal_index),
5926                         Add<HConstant>(constants),
5927                         Add<HConstant>(flags));
5928
5929     Runtime::FunctionId function_id = Runtime::kCreateArrayLiteral;
5930     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5931                                 Runtime::FunctionForId(function_id),
5932                                 4);
5933
5934     // Register to deopt if the boilerplate ElementsKind changes.
5935     top_info()->dependencies()->AssumeTransitionStable(site);
5936   }
5937
5938   // The array is expected in the bailout environment during computation
5939   // of the property values and is the value of the entire expression.
5940   Push(literal);
5941   // The literal index is on the stack, too.
5942   Push(Add<HConstant>(expr->literal_index()));
5943
5944   HInstruction* elements = NULL;
5945
5946   for (int i = 0; i < length; i++) {
5947     Expression* subexpr = subexprs->at(i);
5948     if (subexpr->IsSpread()) {
5949       return Bailout(kSpread);
5950     }
5951
5952     // If the subexpression is a literal or a simple materialized literal it
5953     // is already set in the cloned array.
5954     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
5955
5956     CHECK_ALIVE(VisitForValue(subexpr));
5957     HValue* value = Pop();
5958     if (!Smi::IsValid(i)) return Bailout(kNonSmiKeyInArrayLiteral);
5959
5960     elements = AddLoadElements(literal);
5961
5962     HValue* key = Add<HConstant>(i);
5963
5964     switch (boilerplate_elements_kind) {
5965       case FAST_SMI_ELEMENTS:
5966       case FAST_HOLEY_SMI_ELEMENTS:
5967       case FAST_ELEMENTS:
5968       case FAST_HOLEY_ELEMENTS:
5969       case FAST_DOUBLE_ELEMENTS:
5970       case FAST_HOLEY_DOUBLE_ELEMENTS: {
5971         HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
5972                                               boilerplate_elements_kind);
5973         instr->SetUninitialized(uninitialized);
5974         break;
5975       }
5976       default:
5977         UNREACHABLE();
5978         break;
5979     }
5980
5981     Add<HSimulate>(expr->GetIdForElement(i));
5982   }
5983
5984   Drop(1);  // array literal index
5985   return ast_context()->ReturnValue(Pop());
5986 }
5987
5988
5989 HCheckMaps* HOptimizedGraphBuilder::AddCheckMap(HValue* object,
5990                                                 Handle<Map> map) {
5991   BuildCheckHeapObject(object);
5992   return Add<HCheckMaps>(object, map);
5993 }
5994
5995
5996 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
5997     PropertyAccessInfo* info,
5998     HValue* checked_object) {
5999   // See if this is a load for an immutable property
6000   if (checked_object->ActualValue()->IsConstant()) {
6001     Handle<Object> object(
6002         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
6003
6004     if (object->IsJSObject()) {
6005       LookupIterator it(object, info->name(),
6006                         LookupIterator::OWN_SKIP_INTERCEPTOR);
6007       Handle<Object> value = JSReceiver::GetDataProperty(&it);
6008       if (it.IsFound() && it.IsReadOnly() && !it.IsConfigurable()) {
6009         return New<HConstant>(value);
6010       }
6011     }
6012   }
6013
6014   HObjectAccess access = info->access();
6015   if (access.representation().IsDouble() &&
6016       (!FLAG_unbox_double_fields || !access.IsInobject())) {
6017     // Load the heap number.
6018     checked_object = Add<HLoadNamedField>(
6019         checked_object, nullptr,
6020         access.WithRepresentation(Representation::Tagged()));
6021     // Load the double value from it.
6022     access = HObjectAccess::ForHeapNumberValue();
6023   }
6024
6025   SmallMapList* map_list = info->field_maps();
6026   if (map_list->length() == 0) {
6027     return New<HLoadNamedField>(checked_object, checked_object, access);
6028   }
6029
6030   UniqueSet<Map>* maps = new(zone()) UniqueSet<Map>(map_list->length(), zone());
6031   for (int i = 0; i < map_list->length(); ++i) {
6032     maps->Add(Unique<Map>::CreateImmovable(map_list->at(i)), zone());
6033   }
6034   return New<HLoadNamedField>(
6035       checked_object, checked_object, access, maps, info->field_type());
6036 }
6037
6038
6039 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
6040     PropertyAccessInfo* info,
6041     HValue* checked_object,
6042     HValue* value) {
6043   bool transition_to_field = info->IsTransition();
6044   // TODO(verwaest): Move this logic into PropertyAccessInfo.
6045   HObjectAccess field_access = info->access();
6046
6047   HStoreNamedField *instr;
6048   if (field_access.representation().IsDouble() &&
6049       (!FLAG_unbox_double_fields || !field_access.IsInobject())) {
6050     HObjectAccess heap_number_access =
6051         field_access.WithRepresentation(Representation::Tagged());
6052     if (transition_to_field) {
6053       // The store requires a mutable HeapNumber to be allocated.
6054       NoObservableSideEffectsScope no_side_effects(this);
6055       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
6056
6057       // TODO(hpayer): Allocation site pretenuring support.
6058       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
6059           HType::HeapObject(),
6060           NOT_TENURED,
6061           MUTABLE_HEAP_NUMBER_TYPE);
6062       AddStoreMapConstant(
6063           heap_number, isolate()->factory()->mutable_heap_number_map());
6064       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
6065                             value);
6066       instr = New<HStoreNamedField>(checked_object->ActualValue(),
6067                                     heap_number_access,
6068                                     heap_number);
6069     } else {
6070       // Already holds a HeapNumber; load the box and write its value field.
6071       HInstruction* heap_number =
6072           Add<HLoadNamedField>(checked_object, nullptr, heap_number_access);
6073       instr = New<HStoreNamedField>(heap_number,
6074                                     HObjectAccess::ForHeapNumberValue(),
6075                                     value, STORE_TO_INITIALIZED_ENTRY);
6076     }
6077   } else {
6078     if (field_access.representation().IsHeapObject()) {
6079       BuildCheckHeapObject(value);
6080     }
6081
6082     if (!info->field_maps()->is_empty()) {
6083       DCHECK(field_access.representation().IsHeapObject());
6084       value = Add<HCheckMaps>(value, info->field_maps());
6085     }
6086
6087     // This is a normal store.
6088     instr = New<HStoreNamedField>(
6089         checked_object->ActualValue(), field_access, value,
6090         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
6091   }
6092
6093   if (transition_to_field) {
6094     Handle<Map> transition(info->transition());
6095     DCHECK(!transition->is_deprecated());
6096     instr->SetTransition(Add<HConstant>(transition));
6097   }
6098   return instr;
6099 }
6100
6101
6102 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
6103     PropertyAccessInfo* info) {
6104   if (!CanInlinePropertyAccess(map_)) return false;
6105
6106   // Currently only handle Type::Number as a polymorphic case.
6107   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6108   // instruction.
6109   if (IsNumberType()) return false;
6110
6111   // Values are only compatible for monomorphic load if they all behave the same
6112   // regarding value wrappers.
6113   if (IsValueWrapped() != info->IsValueWrapped()) return false;
6114
6115   if (!LookupDescriptor()) return false;
6116
6117   if (!IsFound()) {
6118     return (!info->IsFound() || info->has_holder()) &&
6119            map()->prototype() == info->map()->prototype();
6120   }
6121
6122   // Mismatch if the other access info found the property in the prototype
6123   // chain.
6124   if (info->has_holder()) return false;
6125
6126   if (IsAccessorConstant()) {
6127     return accessor_.is_identical_to(info->accessor_) &&
6128         api_holder_.is_identical_to(info->api_holder_);
6129   }
6130
6131   if (IsDataConstant()) {
6132     return constant_.is_identical_to(info->constant_);
6133   }
6134
6135   DCHECK(IsData());
6136   if (!info->IsData()) return false;
6137
6138   Representation r = access_.representation();
6139   if (IsLoad()) {
6140     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
6141   } else {
6142     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
6143   }
6144   if (info->access_.offset() != access_.offset()) return false;
6145   if (info->access_.IsInobject() != access_.IsInobject()) return false;
6146   if (IsLoad()) {
6147     if (field_maps_.is_empty()) {
6148       info->field_maps_.Clear();
6149     } else if (!info->field_maps_.is_empty()) {
6150       for (int i = 0; i < field_maps_.length(); ++i) {
6151         info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
6152       }
6153       info->field_maps_.Sort();
6154     }
6155   } else {
6156     // We can only merge stores that agree on their field maps. The comparison
6157     // below is safe, since we keep the field maps sorted.
6158     if (field_maps_.length() != info->field_maps_.length()) return false;
6159     for (int i = 0; i < field_maps_.length(); ++i) {
6160       if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
6161         return false;
6162       }
6163     }
6164   }
6165   info->GeneralizeRepresentation(r);
6166   info->field_type_ = info->field_type_.Combine(field_type_);
6167   return true;
6168 }
6169
6170
6171 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
6172   if (!map_->IsJSObjectMap()) return true;
6173   LookupDescriptor(*map_, *name_);
6174   return LoadResult(map_);
6175 }
6176
6177
6178 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
6179   if (!IsLoad() && IsProperty() && IsReadOnly()) {
6180     return false;
6181   }
6182
6183   if (IsData()) {
6184     // Construct the object field access.
6185     int index = GetLocalFieldIndexFromMap(map);
6186     access_ = HObjectAccess::ForField(map, index, representation(), name_);
6187
6188     // Load field map for heap objects.
6189     return LoadFieldMaps(map);
6190   } else if (IsAccessorConstant()) {
6191     Handle<Object> accessors = GetAccessorsFromMap(map);
6192     if (!accessors->IsAccessorPair()) return false;
6193     Object* raw_accessor =
6194         IsLoad() ? Handle<AccessorPair>::cast(accessors)->getter()
6195                  : Handle<AccessorPair>::cast(accessors)->setter();
6196     if (!raw_accessor->IsJSFunction()) return false;
6197     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
6198     if (accessor->shared()->IsApiFunction()) {
6199       CallOptimization call_optimization(accessor);
6200       if (call_optimization.is_simple_api_call()) {
6201         CallOptimization::HolderLookup holder_lookup;
6202         api_holder_ =
6203             call_optimization.LookupHolderOfExpectedType(map_, &holder_lookup);
6204       }
6205     }
6206     accessor_ = accessor;
6207   } else if (IsDataConstant()) {
6208     constant_ = GetConstantFromMap(map);
6209   }
6210
6211   return true;
6212 }
6213
6214
6215 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
6216     Handle<Map> map) {
6217   // Clear any previously collected field maps/type.
6218   field_maps_.Clear();
6219   field_type_ = HType::Tagged();
6220
6221   // Figure out the field type from the accessor map.
6222   Handle<HeapType> field_type = GetFieldTypeFromMap(map);
6223
6224   // Collect the (stable) maps from the field type.
6225   int num_field_maps = field_type->NumClasses();
6226   if (num_field_maps > 0) {
6227     DCHECK(access_.representation().IsHeapObject());
6228     field_maps_.Reserve(num_field_maps, zone());
6229     HeapType::Iterator<Map> it = field_type->Classes();
6230     while (!it.Done()) {
6231       Handle<Map> field_map = it.Current();
6232       if (!field_map->is_stable()) {
6233         field_maps_.Clear();
6234         break;
6235       }
6236       field_maps_.Add(field_map, zone());
6237       it.Advance();
6238     }
6239   }
6240
6241   if (field_maps_.is_empty()) {
6242     // Store is not safe if the field map was cleared.
6243     return IsLoad() || !field_type->Is(HeapType::None());
6244   }
6245
6246   field_maps_.Sort();
6247   DCHECK_EQ(num_field_maps, field_maps_.length());
6248
6249   // Determine field HType from field HeapType.
6250   field_type_ = HType::FromType<HeapType>(field_type);
6251   DCHECK(field_type_.IsHeapObject());
6252
6253   // Add dependency on the map that introduced the field.
6254   top_info()->dependencies()->AssumeFieldType(GetFieldOwnerFromMap(map));
6255   return true;
6256 }
6257
6258
6259 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
6260   Handle<Map> map = this->map();
6261
6262   while (map->prototype()->IsJSObject()) {
6263     holder_ = handle(JSObject::cast(map->prototype()));
6264     if (holder_->map()->is_deprecated()) {
6265       JSObject::TryMigrateInstance(holder_);
6266     }
6267     map = Handle<Map>(holder_->map());
6268     if (!CanInlinePropertyAccess(map)) {
6269       NotFound();
6270       return false;
6271     }
6272     LookupDescriptor(*map, *name_);
6273     if (IsFound()) return LoadResult(map);
6274   }
6275
6276   NotFound();
6277   return !map->prototype()->IsJSReceiver();
6278 }
6279
6280
6281 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsIntegerIndexedExotic() {
6282   InstanceType instance_type = map_->instance_type();
6283   return instance_type == JS_TYPED_ARRAY_TYPE &&
6284          IsSpecialIndex(isolate()->unicode_cache(), *name_);
6285 }
6286
6287
6288 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
6289   if (!CanInlinePropertyAccess(map_)) return false;
6290   if (IsJSObjectFieldAccessor()) return IsLoad();
6291   if (IsJSArrayBufferViewFieldAccessor()) return IsLoad();
6292   if (map_->function_with_prototype() && !map_->has_non_instance_prototype() &&
6293       name_.is_identical_to(isolate()->factory()->prototype_string())) {
6294     return IsLoad();
6295   }
6296   if (!LookupDescriptor()) return false;
6297   if (IsFound()) return IsLoad() || !IsReadOnly();
6298   if (IsIntegerIndexedExotic()) return false;
6299   if (!LookupInPrototypes()) return false;
6300   if (IsLoad()) return true;
6301
6302   if (IsAccessorConstant()) return true;
6303   LookupTransition(*map_, *name_, NONE);
6304   if (IsTransitionToData() && map_->unused_property_fields() > 0) {
6305     // Construct the object field access.
6306     int descriptor = transition()->LastAdded();
6307     int index =
6308         transition()->instance_descriptors()->GetFieldIndex(descriptor) -
6309         map_->inobject_properties();
6310     PropertyDetails details =
6311         transition()->instance_descriptors()->GetDetails(descriptor);
6312     Representation representation = details.representation();
6313     access_ = HObjectAccess::ForField(map_, index, representation, name_);
6314
6315     // Load field map for heap objects.
6316     return LoadFieldMaps(transition());
6317   }
6318   return false;
6319 }
6320
6321
6322 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
6323     SmallMapList* maps) {
6324   DCHECK(map_.is_identical_to(maps->first()));
6325   if (!CanAccessMonomorphic()) return false;
6326   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6327   if (maps->length() > kMaxLoadPolymorphism) return false;
6328   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6329   if (GetJSObjectFieldAccess(&access)) {
6330     for (int i = 1; i < maps->length(); ++i) {
6331       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6332       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6333       if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
6334       if (!access.Equals(test_access)) return false;
6335     }
6336     return true;
6337   }
6338   if (GetJSArrayBufferViewFieldAccess(&access)) {
6339     for (int i = 1; i < maps->length(); ++i) {
6340       PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6341       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6342       if (!test_info.GetJSArrayBufferViewFieldAccess(&test_access)) {
6343         return false;
6344       }
6345       if (!access.Equals(test_access)) return false;
6346     }
6347     return true;
6348   }
6349
6350   // Currently only handle numbers as a polymorphic case.
6351   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6352   // instruction.
6353   if (IsNumberType()) return false;
6354
6355   // Multiple maps cannot transition to the same target map.
6356   DCHECK(!IsLoad() || !IsTransition());
6357   if (IsTransition() && maps->length() > 1) return false;
6358
6359   for (int i = 1; i < maps->length(); ++i) {
6360     PropertyAccessInfo test_info(builder_, access_type_, maps->at(i), name_);
6361     if (!test_info.IsCompatible(this)) return false;
6362   }
6363
6364   return true;
6365 }
6366
6367
6368 Handle<Map> HOptimizedGraphBuilder::PropertyAccessInfo::map() {
6369   JSFunction* ctor = IC::GetRootConstructor(
6370       *map_, current_info()->closure()->context()->native_context());
6371   if (ctor != NULL) return handle(ctor->initial_map());
6372   return map_;
6373 }
6374
6375
6376 static bool NeedsWrapping(Handle<Map> map, Handle<JSFunction> target) {
6377   return !map->IsJSObjectMap() &&
6378          is_sloppy(target->shared()->language_mode()) &&
6379          !target->shared()->native();
6380 }
6381
6382
6383 bool HOptimizedGraphBuilder::PropertyAccessInfo::NeedsWrappingFor(
6384     Handle<JSFunction> target) const {
6385   return NeedsWrapping(map_, target);
6386 }
6387
6388
6389 HValue* HOptimizedGraphBuilder::BuildMonomorphicAccess(
6390     PropertyAccessInfo* info, HValue* object, HValue* checked_object,
6391     HValue* value, BailoutId ast_id, BailoutId return_id,
6392     bool can_inline_accessor) {
6393   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6394   if (info->GetJSObjectFieldAccess(&access)) {
6395     DCHECK(info->IsLoad());
6396     return New<HLoadNamedField>(object, checked_object, access);
6397   }
6398
6399   if (info->GetJSArrayBufferViewFieldAccess(&access)) {
6400     DCHECK(info->IsLoad());
6401     checked_object = Add<HCheckArrayBufferNotNeutered>(checked_object);
6402     return New<HLoadNamedField>(object, checked_object, access);
6403   }
6404
6405   if (info->name().is_identical_to(isolate()->factory()->prototype_string()) &&
6406       info->map()->function_with_prototype()) {
6407     DCHECK(!info->map()->has_non_instance_prototype());
6408     return New<HLoadFunctionPrototype>(checked_object);
6409   }
6410
6411   HValue* checked_holder = checked_object;
6412   if (info->has_holder()) {
6413     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
6414     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
6415   }
6416
6417   if (!info->IsFound()) {
6418     DCHECK(info->IsLoad());
6419     if (is_strong(function_language_mode())) {
6420       return New<HCallRuntime>(
6421           isolate()->factory()->empty_string(),
6422           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
6423           0);
6424     } else {
6425       return graph()->GetConstantUndefined();
6426     }
6427   }
6428
6429   if (info->IsData()) {
6430     if (info->IsLoad()) {
6431       return BuildLoadNamedField(info, checked_holder);
6432     } else {
6433       return BuildStoreNamedField(info, checked_object, value);
6434     }
6435   }
6436
6437   if (info->IsTransition()) {
6438     DCHECK(!info->IsLoad());
6439     return BuildStoreNamedField(info, checked_object, value);
6440   }
6441
6442   if (info->IsAccessorConstant()) {
6443     Push(checked_object);
6444     int argument_count = 1;
6445     if (!info->IsLoad()) {
6446       argument_count = 2;
6447       Push(value);
6448     }
6449
6450     if (info->NeedsWrappingFor(info->accessor())) {
6451       HValue* function = Add<HConstant>(info->accessor());
6452       PushArgumentsFromEnvironment(argument_count);
6453       return New<HCallFunction>(function, argument_count, WRAP_AND_CALL);
6454     } else if (FLAG_inline_accessors && can_inline_accessor) {
6455       bool success = info->IsLoad()
6456           ? TryInlineGetter(info->accessor(), info->map(), ast_id, return_id)
6457           : TryInlineSetter(
6458               info->accessor(), info->map(), ast_id, return_id, value);
6459       if (success || HasStackOverflow()) return NULL;
6460     }
6461
6462     PushArgumentsFromEnvironment(argument_count);
6463     return BuildCallConstantFunction(info->accessor(), argument_count);
6464   }
6465
6466   DCHECK(info->IsDataConstant());
6467   if (info->IsLoad()) {
6468     return New<HConstant>(info->constant());
6469   } else {
6470     return New<HCheckValue>(value, Handle<JSFunction>::cast(info->constant()));
6471   }
6472 }
6473
6474
6475 void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
6476     PropertyAccessType access_type, Expression* expr, BailoutId ast_id,
6477     BailoutId return_id, HValue* object, HValue* value, SmallMapList* maps,
6478     Handle<String> name) {
6479   // Something did not match; must use a polymorphic load.
6480   int count = 0;
6481   HBasicBlock* join = NULL;
6482   HBasicBlock* number_block = NULL;
6483   bool handled_string = false;
6484
6485   bool handle_smi = false;
6486   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6487   int i;
6488   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6489     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6490     if (info.IsStringType()) {
6491       if (handled_string) continue;
6492       handled_string = true;
6493     }
6494     if (info.CanAccessMonomorphic()) {
6495       count++;
6496       if (info.IsNumberType()) {
6497         handle_smi = true;
6498         break;
6499       }
6500     }
6501   }
6502
6503   if (i < maps->length()) {
6504     count = -1;
6505     maps->Clear();
6506   } else {
6507     count = 0;
6508   }
6509   HControlInstruction* smi_check = NULL;
6510   handled_string = false;
6511
6512   for (i = 0; i < maps->length() && count < kMaxLoadPolymorphism; ++i) {
6513     PropertyAccessInfo info(this, access_type, maps->at(i), name);
6514     if (info.IsStringType()) {
6515       if (handled_string) continue;
6516       handled_string = true;
6517     }
6518     if (!info.CanAccessMonomorphic()) continue;
6519
6520     if (count == 0) {
6521       join = graph()->CreateBasicBlock();
6522       if (handle_smi) {
6523         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
6524         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
6525         number_block = graph()->CreateBasicBlock();
6526         smi_check = New<HIsSmiAndBranch>(
6527             object, empty_smi_block, not_smi_block);
6528         FinishCurrentBlock(smi_check);
6529         GotoNoSimulate(empty_smi_block, number_block);
6530         set_current_block(not_smi_block);
6531       } else {
6532         BuildCheckHeapObject(object);
6533       }
6534     }
6535     ++count;
6536     HBasicBlock* if_true = graph()->CreateBasicBlock();
6537     HBasicBlock* if_false = graph()->CreateBasicBlock();
6538     HUnaryControlInstruction* compare;
6539
6540     HValue* dependency;
6541     if (info.IsNumberType()) {
6542       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
6543       compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
6544       dependency = smi_check;
6545     } else if (info.IsStringType()) {
6546       compare = New<HIsStringAndBranch>(object, if_true, if_false);
6547       dependency = compare;
6548     } else {
6549       compare = New<HCompareMap>(object, info.map(), if_true, if_false);
6550       dependency = compare;
6551     }
6552     FinishCurrentBlock(compare);
6553
6554     if (info.IsNumberType()) {
6555       GotoNoSimulate(if_true, number_block);
6556       if_true = number_block;
6557     }
6558
6559     set_current_block(if_true);
6560
6561     HValue* access =
6562         BuildMonomorphicAccess(&info, object, dependency, value, ast_id,
6563                                return_id, FLAG_polymorphic_inlining);
6564
6565     HValue* result = NULL;
6566     switch (access_type) {
6567       case LOAD:
6568         result = access;
6569         break;
6570       case STORE:
6571         result = value;
6572         break;
6573     }
6574
6575     if (access == NULL) {
6576       if (HasStackOverflow()) return;
6577     } else {
6578       if (access->IsInstruction()) {
6579         HInstruction* instr = HInstruction::cast(access);
6580         if (!instr->IsLinked()) AddInstruction(instr);
6581       }
6582       if (!ast_context()->IsEffect()) Push(result);
6583     }
6584
6585     if (current_block() != NULL) Goto(join);
6586     set_current_block(if_false);
6587   }
6588
6589   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
6590   // know about and do not want to handle ones we've never seen.  Otherwise
6591   // use a generic IC.
6592   if (count == maps->length() && FLAG_deoptimize_uncommon_cases) {
6593     FinishExitWithHardDeoptimization(
6594         Deoptimizer::kUnknownMapInPolymorphicAccess);
6595   } else {
6596     HInstruction* instr = BuildNamedGeneric(access_type, expr, object, name,
6597                                             value);
6598     AddInstruction(instr);
6599     if (!ast_context()->IsEffect()) Push(access_type == LOAD ? instr : value);
6600
6601     if (join != NULL) {
6602       Goto(join);
6603     } else {
6604       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6605       if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6606       return;
6607     }
6608   }
6609
6610   DCHECK(join != NULL);
6611   if (join->HasPredecessor()) {
6612     join->SetJoinId(ast_id);
6613     set_current_block(join);
6614     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6615   } else {
6616     set_current_block(NULL);
6617   }
6618 }
6619
6620
6621 static bool ComputeReceiverTypes(Expression* expr,
6622                                  HValue* receiver,
6623                                  SmallMapList** t,
6624                                  Zone* zone) {
6625   SmallMapList* maps = expr->GetReceiverTypes();
6626   *t = maps;
6627   bool monomorphic = expr->IsMonomorphic();
6628   if (maps != NULL && receiver->HasMonomorphicJSObjectType()) {
6629     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
6630     maps->FilterForPossibleTransitions(root_map);
6631     monomorphic = maps->length() == 1;
6632   }
6633   return monomorphic && CanInlinePropertyAccess(maps->first());
6634 }
6635
6636
6637 static bool AreStringTypes(SmallMapList* maps) {
6638   for (int i = 0; i < maps->length(); i++) {
6639     if (maps->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
6640   }
6641   return true;
6642 }
6643
6644
6645 void HOptimizedGraphBuilder::BuildStore(Expression* expr,
6646                                         Property* prop,
6647                                         BailoutId ast_id,
6648                                         BailoutId return_id,
6649                                         bool is_uninitialized) {
6650   if (!prop->key()->IsPropertyName()) {
6651     // Keyed store.
6652     HValue* value = Pop();
6653     HValue* key = Pop();
6654     HValue* object = Pop();
6655     bool has_side_effects = false;
6656     HValue* result = HandleKeyedElementAccess(
6657         object, key, value, expr, ast_id, return_id, STORE, &has_side_effects);
6658     if (has_side_effects) {
6659       if (!ast_context()->IsEffect()) Push(value);
6660       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6661       if (!ast_context()->IsEffect()) Drop(1);
6662     }
6663     if (result == NULL) return;
6664     return ast_context()->ReturnValue(value);
6665   }
6666
6667   // Named store.
6668   HValue* value = Pop();
6669   HValue* object = Pop();
6670
6671   Literal* key = prop->key()->AsLiteral();
6672   Handle<String> name = Handle<String>::cast(key->value());
6673   DCHECK(!name.is_null());
6674
6675   HValue* access = BuildNamedAccess(STORE, ast_id, return_id, expr, object,
6676                                     name, value, is_uninitialized);
6677   if (access == NULL) return;
6678
6679   if (!ast_context()->IsEffect()) Push(value);
6680   if (access->IsInstruction()) AddInstruction(HInstruction::cast(access));
6681   if (access->HasObservableSideEffects()) {
6682     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6683   }
6684   if (!ast_context()->IsEffect()) Drop(1);
6685   return ast_context()->ReturnValue(value);
6686 }
6687
6688
6689 void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
6690   Property* prop = expr->target()->AsProperty();
6691   DCHECK(prop != NULL);
6692   CHECK_ALIVE(VisitForValue(prop->obj()));
6693   if (!prop->key()->IsPropertyName()) {
6694     CHECK_ALIVE(VisitForValue(prop->key()));
6695   }
6696   CHECK_ALIVE(VisitForValue(expr->value()));
6697   BuildStore(expr, prop, expr->id(),
6698              expr->AssignmentId(), expr->IsUninitialized());
6699 }
6700
6701
6702 // Because not every expression has a position and there is not common
6703 // superclass of Assignment and CountOperation, we cannot just pass the
6704 // owning expression instead of position and ast_id separately.
6705 void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
6706     Variable* var,
6707     HValue* value,
6708     BailoutId ast_id) {
6709   Handle<GlobalObject> global(current_info()->global_object());
6710
6711   // Lookup in script contexts.
6712   {
6713     Handle<ScriptContextTable> script_contexts(
6714         global->native_context()->script_context_table());
6715     ScriptContextTable::LookupResult lookup;
6716     if (ScriptContextTable::Lookup(script_contexts, var->name(), &lookup)) {
6717       if (lookup.mode == CONST) {
6718         return Bailout(kNonInitializerAssignmentToConst);
6719       }
6720       Handle<Context> script_context =
6721           ScriptContextTable::GetContext(script_contexts, lookup.context_index);
6722
6723       Handle<Object> current_value =
6724           FixedArray::get(script_context, lookup.slot_index);
6725
6726       // If the values is not the hole, it will stay initialized,
6727       // so no need to generate a check.
6728       if (*current_value == *isolate()->factory()->the_hole_value()) {
6729         return Bailout(kReferenceToUninitializedVariable);
6730       }
6731
6732       HStoreNamedField* instr = Add<HStoreNamedField>(
6733           Add<HConstant>(script_context),
6734           HObjectAccess::ForContextSlot(lookup.slot_index), value);
6735       USE(instr);
6736       DCHECK(instr->HasObservableSideEffects());
6737       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6738       return;
6739     }
6740   }
6741
6742   LookupIterator it(global, var->name(), LookupIterator::OWN);
6743   GlobalPropertyAccess type = LookupGlobalProperty(var, &it, STORE);
6744   if (type == kUseCell) {
6745     Handle<PropertyCell> cell = it.GetPropertyCell();
6746     top_info()->dependencies()->AssumePropertyCell(cell);
6747     auto cell_type = it.property_details().cell_type();
6748     if (cell_type == PropertyCellType::kConstant ||
6749         cell_type == PropertyCellType::kUndefined) {
6750       Handle<Object> constant(cell->value(), isolate());
6751       if (value->IsConstant()) {
6752         HConstant* c_value = HConstant::cast(value);
6753         if (!constant.is_identical_to(c_value->handle(isolate()))) {
6754           Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6755                            Deoptimizer::EAGER);
6756         }
6757       } else {
6758         HValue* c_constant = Add<HConstant>(constant);
6759         IfBuilder builder(this);
6760         if (constant->IsNumber()) {
6761           builder.If<HCompareNumericAndBranch>(value, c_constant, Token::EQ);
6762         } else {
6763           builder.If<HCompareObjectEqAndBranch>(value, c_constant);
6764         }
6765         builder.Then();
6766         builder.Else();
6767         Add<HDeoptimize>(Deoptimizer::kConstantGlobalVariableAssignment,
6768                          Deoptimizer::EAGER);
6769         builder.End();
6770       }
6771     }
6772     HConstant* cell_constant = Add<HConstant>(cell);
6773     auto access = HObjectAccess::ForPropertyCellValue();
6774     if (cell_type == PropertyCellType::kConstantType) {
6775       switch (cell->GetConstantType()) {
6776         case PropertyCellConstantType::kSmi:
6777           access = access.WithRepresentation(Representation::Smi());
6778           break;
6779         case PropertyCellConstantType::kStableMap: {
6780           // The map may no longer be stable, deopt if it's ever different from
6781           // what is currently there, which will allow for restablization.
6782           Handle<Map> map(HeapObject::cast(cell->value())->map());
6783           Add<HCheckHeapObject>(value);
6784           value = Add<HCheckMaps>(value, map);
6785           access = access.WithRepresentation(Representation::HeapObject());
6786           break;
6787         }
6788       }
6789     }
6790     HInstruction* instr = Add<HStoreNamedField>(cell_constant, access, value);
6791     instr->ClearChangesFlag(kInobjectFields);
6792     instr->SetChangesFlag(kGlobalVars);
6793     if (instr->HasObservableSideEffects()) {
6794       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6795     }
6796   } else if (var->IsGlobalSlot()) {
6797     DCHECK(var->index() > 0);
6798     DCHECK(var->IsStaticGlobalObjectProperty());
6799     // Each var occupies two slots in the context: for reads and writes.
6800     int slot_index = var->index() + 1;
6801     int depth = scope()->ContextChainLength(var->scope());
6802
6803     HStoreGlobalViaContext* instr = Add<HStoreGlobalViaContext>(
6804         value, depth, slot_index, function_language_mode());
6805     USE(instr);
6806     DCHECK(instr->HasObservableSideEffects());
6807     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6808
6809   } else {
6810     HValue* global_object = Add<HLoadNamedField>(
6811         context(), nullptr,
6812         HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
6813     HStoreNamedGeneric* instr =
6814         Add<HStoreNamedGeneric>(global_object, var->name(), value,
6815                                 function_language_mode(), PREMONOMORPHIC);
6816     USE(instr);
6817     DCHECK(instr->HasObservableSideEffects());
6818     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6819   }
6820 }
6821
6822
6823 void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
6824   Expression* target = expr->target();
6825   VariableProxy* proxy = target->AsVariableProxy();
6826   Property* prop = target->AsProperty();
6827   DCHECK(proxy == NULL || prop == NULL);
6828
6829   // We have a second position recorded in the FullCodeGenerator to have
6830   // type feedback for the binary operation.
6831   BinaryOperation* operation = expr->binary_operation();
6832
6833   if (proxy != NULL) {
6834     Variable* var = proxy->var();
6835     if (var->mode() == LET)  {
6836       return Bailout(kUnsupportedLetCompoundAssignment);
6837     }
6838
6839     CHECK_ALIVE(VisitForValue(operation));
6840
6841     switch (var->location()) {
6842       case VariableLocation::GLOBAL:
6843       case VariableLocation::UNALLOCATED:
6844         HandleGlobalVariableAssignment(var,
6845                                        Top(),
6846                                        expr->AssignmentId());
6847         break;
6848
6849       case VariableLocation::PARAMETER:
6850       case VariableLocation::LOCAL:
6851         if (var->mode() == CONST_LEGACY)  {
6852           return Bailout(kUnsupportedConstCompoundAssignment);
6853         }
6854         if (var->mode() == CONST) {
6855           return Bailout(kNonInitializerAssignmentToConst);
6856         }
6857         BindIfLive(var, Top());
6858         break;
6859
6860       case VariableLocation::CONTEXT: {
6861         // Bail out if we try to mutate a parameter value in a function
6862         // using the arguments object.  We do not (yet) correctly handle the
6863         // arguments property of the function.
6864         if (current_info()->scope()->arguments() != NULL) {
6865           // Parameters will be allocated to context slots.  We have no
6866           // direct way to detect that the variable is a parameter so we do
6867           // a linear search of the parameter variables.
6868           int count = current_info()->scope()->num_parameters();
6869           for (int i = 0; i < count; ++i) {
6870             if (var == current_info()->scope()->parameter(i)) {
6871               Bailout(kAssignmentToParameterFunctionUsesArgumentsObject);
6872             }
6873           }
6874         }
6875
6876         HStoreContextSlot::Mode mode;
6877
6878         switch (var->mode()) {
6879           case LET:
6880             mode = HStoreContextSlot::kCheckDeoptimize;
6881             break;
6882           case CONST:
6883             return Bailout(kNonInitializerAssignmentToConst);
6884           case CONST_LEGACY:
6885             return ast_context()->ReturnValue(Pop());
6886           default:
6887             mode = HStoreContextSlot::kNoCheck;
6888         }
6889
6890         HValue* context = BuildContextChainWalk(var);
6891         HStoreContextSlot* instr = Add<HStoreContextSlot>(
6892             context, var->index(), mode, Top());
6893         if (instr->HasObservableSideEffects()) {
6894           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
6895         }
6896         break;
6897       }
6898
6899       case VariableLocation::LOOKUP:
6900         return Bailout(kCompoundAssignmentToLookupSlot);
6901     }
6902     return ast_context()->ReturnValue(Pop());
6903
6904   } else if (prop != NULL) {
6905     CHECK_ALIVE(VisitForValue(prop->obj()));
6906     HValue* object = Top();
6907     HValue* key = NULL;
6908     if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
6909       CHECK_ALIVE(VisitForValue(prop->key()));
6910       key = Top();
6911     }
6912
6913     CHECK_ALIVE(PushLoad(prop, object, key));
6914
6915     CHECK_ALIVE(VisitForValue(expr->value()));
6916     HValue* right = Pop();
6917     HValue* left = Pop();
6918
6919     Push(BuildBinaryOperation(operation, left, right, PUSH_BEFORE_SIMULATE));
6920
6921     BuildStore(expr, prop, expr->id(),
6922                expr->AssignmentId(), expr->IsUninitialized());
6923   } else {
6924     return Bailout(kInvalidLhsInCompoundAssignment);
6925   }
6926 }
6927
6928
6929 void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
6930   DCHECK(!HasStackOverflow());
6931   DCHECK(current_block() != NULL);
6932   DCHECK(current_block()->HasPredecessor());
6933   VariableProxy* proxy = expr->target()->AsVariableProxy();
6934   Property* prop = expr->target()->AsProperty();
6935   DCHECK(proxy == NULL || prop == NULL);
6936
6937   if (expr->is_compound()) {
6938     HandleCompoundAssignment(expr);
6939     return;
6940   }
6941
6942   if (prop != NULL) {
6943     HandlePropertyAssignment(expr);
6944   } else if (proxy != NULL) {
6945     Variable* var = proxy->var();
6946
6947     if (var->mode() == CONST) {
6948       if (expr->op() != Token::INIT_CONST) {
6949         return Bailout(kNonInitializerAssignmentToConst);
6950       }
6951     } else if (var->mode() == CONST_LEGACY) {
6952       if (expr->op() != Token::INIT_CONST_LEGACY) {
6953         CHECK_ALIVE(VisitForValue(expr->value()));
6954         return ast_context()->ReturnValue(Pop());
6955       }
6956
6957       if (var->IsStackAllocated()) {
6958         // We insert a use of the old value to detect unsupported uses of const
6959         // variables (e.g. initialization inside a loop).
6960         HValue* old_value = environment()->Lookup(var);
6961         Add<HUseConst>(old_value);
6962       }
6963     }
6964
6965     if (proxy->IsArguments()) return Bailout(kAssignmentToArguments);
6966
6967     // Handle the assignment.
6968     switch (var->location()) {
6969       case VariableLocation::GLOBAL:
6970       case VariableLocation::UNALLOCATED:
6971         CHECK_ALIVE(VisitForValue(expr->value()));
6972         HandleGlobalVariableAssignment(var,
6973                                        Top(),
6974                                        expr->AssignmentId());
6975         return ast_context()->ReturnValue(Pop());
6976
6977       case VariableLocation::PARAMETER:
6978       case VariableLocation::LOCAL: {
6979         // Perform an initialization check for let declared variables
6980         // or parameters.
6981         if (var->mode() == LET && expr->op() == Token::ASSIGN) {
6982           HValue* env_value = environment()->Lookup(var);
6983           if (env_value == graph()->GetConstantHole()) {
6984             return Bailout(kAssignmentToLetVariableBeforeInitialization);
6985           }
6986         }
6987         // We do not allow the arguments object to occur in a context where it
6988         // may escape, but assignments to stack-allocated locals are
6989         // permitted.
6990         CHECK_ALIVE(VisitForValue(expr->value(), ARGUMENTS_ALLOWED));
6991         HValue* value = Pop();
6992         BindIfLive(var, value);
6993         return ast_context()->ReturnValue(value);
6994       }
6995
6996       case VariableLocation::CONTEXT: {
6997         // Bail out if we try to mutate a parameter value in a function using
6998         // the arguments object.  We do not (yet) correctly handle the
6999         // arguments property of the function.
7000         if (current_info()->scope()->arguments() != NULL) {
7001           // Parameters will rewrite to context slots.  We have no direct way
7002           // to detect that the variable is a parameter.
7003           int count = current_info()->scope()->num_parameters();
7004           for (int i = 0; i < count; ++i) {
7005             if (var == current_info()->scope()->parameter(i)) {
7006               return Bailout(kAssignmentToParameterInArgumentsObject);
7007             }
7008           }
7009         }
7010
7011         CHECK_ALIVE(VisitForValue(expr->value()));
7012         HStoreContextSlot::Mode mode;
7013         if (expr->op() == Token::ASSIGN) {
7014           switch (var->mode()) {
7015             case LET:
7016               mode = HStoreContextSlot::kCheckDeoptimize;
7017               break;
7018             case CONST:
7019               // This case is checked statically so no need to
7020               // perform checks here
7021               UNREACHABLE();
7022             case CONST_LEGACY:
7023               return ast_context()->ReturnValue(Pop());
7024             default:
7025               mode = HStoreContextSlot::kNoCheck;
7026           }
7027         } else if (expr->op() == Token::INIT_VAR ||
7028                    expr->op() == Token::INIT_LET ||
7029                    expr->op() == Token::INIT_CONST) {
7030           mode = HStoreContextSlot::kNoCheck;
7031         } else {
7032           DCHECK(expr->op() == Token::INIT_CONST_LEGACY);
7033
7034           mode = HStoreContextSlot::kCheckIgnoreAssignment;
7035         }
7036
7037         HValue* context = BuildContextChainWalk(var);
7038         HStoreContextSlot* instr = Add<HStoreContextSlot>(
7039             context, var->index(), mode, Top());
7040         if (instr->HasObservableSideEffects()) {
7041           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
7042         }
7043         return ast_context()->ReturnValue(Pop());
7044       }
7045
7046       case VariableLocation::LOOKUP:
7047         return Bailout(kAssignmentToLOOKUPVariable);
7048     }
7049   } else {
7050     return Bailout(kInvalidLeftHandSideInAssignment);
7051   }
7052 }
7053
7054
7055 void HOptimizedGraphBuilder::VisitYield(Yield* expr) {
7056   // Generators are not optimized, so we should never get here.
7057   UNREACHABLE();
7058 }
7059
7060
7061 void HOptimizedGraphBuilder::VisitThrow(Throw* expr) {
7062   DCHECK(!HasStackOverflow());
7063   DCHECK(current_block() != NULL);
7064   DCHECK(current_block()->HasPredecessor());
7065   if (!ast_context()->IsEffect()) {
7066     // The parser turns invalid left-hand sides in assignments into throw
7067     // statements, which may not be in effect contexts. We might still try
7068     // to optimize such functions; bail out now if we do.
7069     return Bailout(kInvalidLeftHandSideInAssignment);
7070   }
7071   CHECK_ALIVE(VisitForValue(expr->exception()));
7072
7073   HValue* value = environment()->Pop();
7074   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
7075   Add<HPushArguments>(value);
7076   Add<HCallRuntime>(isolate()->factory()->empty_string(),
7077                     Runtime::FunctionForId(Runtime::kThrow), 1);
7078   Add<HSimulate>(expr->id());
7079
7080   // If the throw definitely exits the function, we can finish with a dummy
7081   // control flow at this point.  This is not the case if the throw is inside
7082   // an inlined function which may be replaced.
7083   if (call_context() == NULL) {
7084     FinishExitCurrentBlock(New<HAbnormalExit>());
7085   }
7086 }
7087
7088
7089 HInstruction* HGraphBuilder::AddLoadStringInstanceType(HValue* string) {
7090   if (string->IsConstant()) {
7091     HConstant* c_string = HConstant::cast(string);
7092     if (c_string->HasStringValue()) {
7093       return Add<HConstant>(c_string->StringValue()->map()->instance_type());
7094     }
7095   }
7096   return Add<HLoadNamedField>(
7097       Add<HLoadNamedField>(string, nullptr, HObjectAccess::ForMap()), nullptr,
7098       HObjectAccess::ForMapInstanceType());
7099 }
7100
7101
7102 HInstruction* HGraphBuilder::AddLoadStringLength(HValue* string) {
7103   return AddInstruction(BuildLoadStringLength(string));
7104 }
7105
7106
7107 HInstruction* HGraphBuilder::BuildLoadStringLength(HValue* string) {
7108   if (string->IsConstant()) {
7109     HConstant* c_string = HConstant::cast(string);
7110     if (c_string->HasStringValue()) {
7111       return New<HConstant>(c_string->StringValue()->length());
7112     }
7113   }
7114   return New<HLoadNamedField>(string, nullptr,
7115                               HObjectAccess::ForStringLength());
7116 }
7117
7118
7119 HInstruction* HOptimizedGraphBuilder::BuildNamedGeneric(
7120     PropertyAccessType access_type, Expression* expr, HValue* object,
7121     Handle<String> name, HValue* value, bool is_uninitialized) {
7122   if (is_uninitialized) {
7123     Add<HDeoptimize>(
7124         Deoptimizer::kInsufficientTypeFeedbackForGenericNamedAccess,
7125         Deoptimizer::SOFT);
7126   }
7127   if (access_type == LOAD) {
7128     Handle<TypeFeedbackVector> vector =
7129         handle(current_feedback_vector(), isolate());
7130     FeedbackVectorICSlot slot = expr->AsProperty()->PropertyFeedbackSlot();
7131
7132     if (!expr->AsProperty()->key()->IsPropertyName()) {
7133       // It's possible that a keyed load of a constant string was converted
7134       // to a named load. Here, at the last minute, we need to make sure to
7135       // use a generic Keyed Load if we are using the type vector, because
7136       // it has to share information with full code.
7137       HConstant* key = Add<HConstant>(name);
7138       HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7139           object, key, function_language_mode(), PREMONOMORPHIC);
7140       result->SetVectorAndSlot(vector, slot);
7141       return result;
7142     }
7143
7144     HLoadNamedGeneric* result = New<HLoadNamedGeneric>(
7145         object, name, function_language_mode(), PREMONOMORPHIC);
7146     result->SetVectorAndSlot(vector, slot);
7147     return result;
7148   } else {
7149     return New<HStoreNamedGeneric>(object, name, value,
7150                                    function_language_mode(), PREMONOMORPHIC);
7151   }
7152 }
7153
7154
7155
7156 HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
7157     PropertyAccessType access_type,
7158     Expression* expr,
7159     HValue* object,
7160     HValue* key,
7161     HValue* value) {
7162   if (access_type == LOAD) {
7163     InlineCacheState initial_state = expr->AsProperty()->GetInlineCacheState();
7164     HLoadKeyedGeneric* result = New<HLoadKeyedGeneric>(
7165         object, key, function_language_mode(), initial_state);
7166     // HLoadKeyedGeneric with vector ics benefits from being encoded as
7167     // MEGAMORPHIC because the vector/slot combo becomes unnecessary.
7168     if (initial_state != MEGAMORPHIC) {
7169       // We need to pass vector information.
7170       Handle<TypeFeedbackVector> vector =
7171           handle(current_feedback_vector(), isolate());
7172       FeedbackVectorICSlot slot = expr->AsProperty()->PropertyFeedbackSlot();
7173       result->SetVectorAndSlot(vector, slot);
7174     }
7175     return result;
7176   } else {
7177     return New<HStoreKeyedGeneric>(object, key, value, function_language_mode(),
7178                                    PREMONOMORPHIC);
7179   }
7180 }
7181
7182
7183 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
7184   // Loads from a "stock" fast holey double arrays can elide the hole check.
7185   // Loads from a "stock" fast holey array can convert the hole to undefined
7186   // with impunity.
7187   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
7188   bool holey_double_elements =
7189       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS);
7190   bool holey_elements =
7191       *map == isolate()->get_initial_js_array_map(FAST_HOLEY_ELEMENTS);
7192   if ((holey_double_elements || holey_elements) &&
7193       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
7194     load_mode =
7195         holey_double_elements ? ALLOW_RETURN_HOLE : CONVERT_HOLE_TO_UNDEFINED;
7196
7197     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
7198     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
7199     BuildCheckPrototypeMaps(prototype, object_prototype);
7200     graph()->MarkDependsOnEmptyArrayProtoElements();
7201   }
7202   return load_mode;
7203 }
7204
7205
7206 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
7207     HValue* object,
7208     HValue* key,
7209     HValue* val,
7210     HValue* dependency,
7211     Handle<Map> map,
7212     PropertyAccessType access_type,
7213     KeyedAccessStoreMode store_mode) {
7214   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
7215
7216   if (access_type == STORE && map->prototype()->IsJSObject()) {
7217     // monomorphic stores need a prototype chain check because shape
7218     // changes could allow callbacks on elements in the chain that
7219     // aren't compatible with monomorphic keyed stores.
7220     PrototypeIterator iter(map);
7221     JSObject* holder = NULL;
7222     while (!iter.IsAtEnd()) {
7223       holder = JSObject::cast(*PrototypeIterator::GetCurrent(iter));
7224       iter.Advance();
7225     }
7226     DCHECK(holder && holder->IsJSObject());
7227
7228     BuildCheckPrototypeMaps(handle(JSObject::cast(map->prototype())),
7229                             Handle<JSObject>(holder));
7230   }
7231
7232   LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7233   return BuildUncheckedMonomorphicElementAccess(
7234       checked_object, key, val,
7235       map->instance_type() == JS_ARRAY_TYPE,
7236       map->elements_kind(), access_type,
7237       load_mode, store_mode);
7238 }
7239
7240
7241 static bool CanInlineElementAccess(Handle<Map> map) {
7242   return map->IsJSObjectMap() && !map->has_dictionary_elements() &&
7243          !map->has_sloppy_arguments_elements() &&
7244          !map->has_indexed_interceptor() && !map->is_access_check_needed();
7245 }
7246
7247
7248 HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
7249     HValue* object,
7250     HValue* key,
7251     HValue* val,
7252     SmallMapList* maps) {
7253   // For polymorphic loads of similar elements kinds (i.e. all tagged or all
7254   // double), always use the "worst case" code without a transition.  This is
7255   // much faster than transitioning the elements to the worst case, trading a
7256   // HTransitionElements for a HCheckMaps, and avoiding mutation of the array.
7257   bool has_double_maps = false;
7258   bool has_smi_or_object_maps = false;
7259   bool has_js_array_access = false;
7260   bool has_non_js_array_access = false;
7261   bool has_seen_holey_elements = false;
7262   Handle<Map> most_general_consolidated_map;
7263   for (int i = 0; i < maps->length(); ++i) {
7264     Handle<Map> map = maps->at(i);
7265     if (!CanInlineElementAccess(map)) return NULL;
7266     // Don't allow mixing of JSArrays with JSObjects.
7267     if (map->instance_type() == JS_ARRAY_TYPE) {
7268       if (has_non_js_array_access) return NULL;
7269       has_js_array_access = true;
7270     } else if (has_js_array_access) {
7271       return NULL;
7272     } else {
7273       has_non_js_array_access = true;
7274     }
7275     // Don't allow mixed, incompatible elements kinds.
7276     if (map->has_fast_double_elements()) {
7277       if (has_smi_or_object_maps) return NULL;
7278       has_double_maps = true;
7279     } else if (map->has_fast_smi_or_object_elements()) {
7280       if (has_double_maps) return NULL;
7281       has_smi_or_object_maps = true;
7282     } else {
7283       return NULL;
7284     }
7285     // Remember if we've ever seen holey elements.
7286     if (IsHoleyElementsKind(map->elements_kind())) {
7287       has_seen_holey_elements = true;
7288     }
7289     // Remember the most general elements kind, the code for its load will
7290     // properly handle all of the more specific cases.
7291     if ((i == 0) || IsMoreGeneralElementsKindTransition(
7292             most_general_consolidated_map->elements_kind(),
7293             map->elements_kind())) {
7294       most_general_consolidated_map = map;
7295     }
7296   }
7297   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
7298
7299   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
7300   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
7301   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
7302   ElementsKind consolidated_elements_kind = has_seen_holey_elements
7303       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
7304       : most_general_consolidated_map->elements_kind();
7305   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
7306       checked_object, key, val,
7307       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
7308       consolidated_elements_kind,
7309       LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
7310   return instr;
7311 }
7312
7313
7314 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
7315     Expression* expr,
7316     HValue* object,
7317     HValue* key,
7318     HValue* val,
7319     SmallMapList* maps,
7320     PropertyAccessType access_type,
7321     KeyedAccessStoreMode store_mode,
7322     bool* has_side_effects) {
7323   *has_side_effects = false;
7324   BuildCheckHeapObject(object);
7325
7326   if (access_type == LOAD) {
7327     HInstruction* consolidated_load =
7328         TryBuildConsolidatedElementLoad(object, key, val, maps);
7329     if (consolidated_load != NULL) {
7330       *has_side_effects |= consolidated_load->HasObservableSideEffects();
7331       return consolidated_load;
7332     }
7333   }
7334
7335   // Elements_kind transition support.
7336   MapHandleList transition_target(maps->length());
7337   // Collect possible transition targets.
7338   MapHandleList possible_transitioned_maps(maps->length());
7339   for (int i = 0; i < maps->length(); ++i) {
7340     Handle<Map> map = maps->at(i);
7341     // Loads from strings or loads with a mix of string and non-string maps
7342     // shouldn't be handled polymorphically.
7343     DCHECK(access_type != LOAD || !map->IsStringMap());
7344     ElementsKind elements_kind = map->elements_kind();
7345     if (CanInlineElementAccess(map) && IsFastElementsKind(elements_kind) &&
7346         elements_kind != GetInitialFastElementsKind()) {
7347       possible_transitioned_maps.Add(map);
7348     }
7349     if (IsSloppyArgumentsElements(elements_kind)) {
7350       HInstruction* result = BuildKeyedGeneric(access_type, expr, object, key,
7351                                                val);
7352       *has_side_effects = result->HasObservableSideEffects();
7353       return AddInstruction(result);
7354     }
7355   }
7356   // Get transition target for each map (NULL == no transition).
7357   for (int i = 0; i < maps->length(); ++i) {
7358     Handle<Map> map = maps->at(i);
7359     Handle<Map> transitioned_map =
7360         Map::FindTransitionedMap(map, &possible_transitioned_maps);
7361     transition_target.Add(transitioned_map);
7362   }
7363
7364   MapHandleList untransitionable_maps(maps->length());
7365   HTransitionElementsKind* transition = NULL;
7366   for (int i = 0; i < maps->length(); ++i) {
7367     Handle<Map> map = maps->at(i);
7368     DCHECK(map->IsMap());
7369     if (!transition_target.at(i).is_null()) {
7370       DCHECK(Map::IsValidElementsTransition(
7371           map->elements_kind(),
7372           transition_target.at(i)->elements_kind()));
7373       transition = Add<HTransitionElementsKind>(object, map,
7374                                                 transition_target.at(i));
7375     } else {
7376       untransitionable_maps.Add(map);
7377     }
7378   }
7379
7380   // If only one map is left after transitioning, handle this case
7381   // monomorphically.
7382   DCHECK(untransitionable_maps.length() >= 1);
7383   if (untransitionable_maps.length() == 1) {
7384     Handle<Map> untransitionable_map = untransitionable_maps[0];
7385     HInstruction* instr = NULL;
7386     if (!CanInlineElementAccess(untransitionable_map)) {
7387       instr = AddInstruction(BuildKeyedGeneric(access_type, expr, object, key,
7388                                                val));
7389     } else {
7390       instr = BuildMonomorphicElementAccess(
7391           object, key, val, transition, untransitionable_map, access_type,
7392           store_mode);
7393     }
7394     *has_side_effects |= instr->HasObservableSideEffects();
7395     return access_type == STORE ? val : instr;
7396   }
7397
7398   HBasicBlock* join = graph()->CreateBasicBlock();
7399
7400   for (int i = 0; i < untransitionable_maps.length(); ++i) {
7401     Handle<Map> map = untransitionable_maps[i];
7402     ElementsKind elements_kind = map->elements_kind();
7403     HBasicBlock* this_map = graph()->CreateBasicBlock();
7404     HBasicBlock* other_map = graph()->CreateBasicBlock();
7405     HCompareMap* mapcompare =
7406         New<HCompareMap>(object, map, this_map, other_map);
7407     FinishCurrentBlock(mapcompare);
7408
7409     set_current_block(this_map);
7410     HInstruction* access = NULL;
7411     if (!CanInlineElementAccess(map)) {
7412       access = AddInstruction(BuildKeyedGeneric(access_type, expr, object, key,
7413                                                 val));
7414     } else {
7415       DCHECK(IsFastElementsKind(elements_kind) ||
7416              IsExternalArrayElementsKind(elements_kind) ||
7417              IsFixedTypedArrayElementsKind(elements_kind));
7418       LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7419       // Happily, mapcompare is a checked object.
7420       access = BuildUncheckedMonomorphicElementAccess(
7421           mapcompare, key, val,
7422           map->instance_type() == JS_ARRAY_TYPE,
7423           elements_kind, access_type,
7424           load_mode,
7425           store_mode);
7426     }
7427     *has_side_effects |= access->HasObservableSideEffects();
7428     // The caller will use has_side_effects and add a correct Simulate.
7429     access->SetFlag(HValue::kHasNoObservableSideEffects);
7430     if (access_type == LOAD) {
7431       Push(access);
7432     }
7433     NoObservableSideEffectsScope scope(this);
7434     GotoNoSimulate(join);
7435     set_current_block(other_map);
7436   }
7437
7438   // Ensure that we visited at least one map above that goes to join. This is
7439   // necessary because FinishExitWithHardDeoptimization does an AbnormalExit
7440   // rather than joining the join block. If this becomes an issue, insert a
7441   // generic access in the case length() == 0.
7442   DCHECK(join->predecessors()->length() > 0);
7443   // Deopt if none of the cases matched.
7444   NoObservableSideEffectsScope scope(this);
7445   FinishExitWithHardDeoptimization(
7446       Deoptimizer::kUnknownMapInPolymorphicElementAccess);
7447   set_current_block(join);
7448   return access_type == STORE ? val : Pop();
7449 }
7450
7451
7452 HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
7453     HValue* obj, HValue* key, HValue* val, Expression* expr, BailoutId ast_id,
7454     BailoutId return_id, PropertyAccessType access_type,
7455     bool* has_side_effects) {
7456   if (key->ActualValue()->IsConstant()) {
7457     Handle<Object> constant =
7458         HConstant::cast(key->ActualValue())->handle(isolate());
7459     uint32_t array_index;
7460     if (constant->IsString() &&
7461         !Handle<String>::cast(constant)->AsArrayIndex(&array_index)) {
7462       if (!constant->IsUniqueName()) {
7463         constant = isolate()->factory()->InternalizeString(
7464             Handle<String>::cast(constant));
7465       }
7466       HValue* access =
7467           BuildNamedAccess(access_type, ast_id, return_id, expr, obj,
7468                            Handle<String>::cast(constant), val, false);
7469       if (access == NULL || access->IsPhi() ||
7470           HInstruction::cast(access)->IsLinked()) {
7471         *has_side_effects = false;
7472       } else {
7473         HInstruction* instr = HInstruction::cast(access);
7474         AddInstruction(instr);
7475         *has_side_effects = instr->HasObservableSideEffects();
7476       }
7477       return access;
7478     }
7479   }
7480
7481   DCHECK(!expr->IsPropertyName());
7482   HInstruction* instr = NULL;
7483
7484   SmallMapList* maps;
7485   bool monomorphic = ComputeReceiverTypes(expr, obj, &maps, zone());
7486
7487   bool force_generic = false;
7488   if (expr->GetKeyType() == PROPERTY) {
7489     // Non-Generic accesses assume that elements are being accessed, and will
7490     // deopt for non-index keys, which the IC knows will occur.
7491     // TODO(jkummerow): Consider adding proper support for property accesses.
7492     force_generic = true;
7493     monomorphic = false;
7494   } else if (access_type == STORE &&
7495              (monomorphic || (maps != NULL && !maps->is_empty()))) {
7496     // Stores can't be mono/polymorphic if their prototype chain has dictionary
7497     // elements. However a receiver map that has dictionary elements itself
7498     // should be left to normal mono/poly behavior (the other maps may benefit
7499     // from highly optimized stores).
7500     for (int i = 0; i < maps->length(); i++) {
7501       Handle<Map> current_map = maps->at(i);
7502       if (current_map->DictionaryElementsInPrototypeChainOnly()) {
7503         force_generic = true;
7504         monomorphic = false;
7505         break;
7506       }
7507     }
7508   } else if (access_type == LOAD && !monomorphic &&
7509              (maps != NULL && !maps->is_empty())) {
7510     // Polymorphic loads have to go generic if any of the maps are strings.
7511     // If some, but not all of the maps are strings, we should go generic
7512     // because polymorphic access wants to key on ElementsKind and isn't
7513     // compatible with strings.
7514     for (int i = 0; i < maps->length(); i++) {
7515       Handle<Map> current_map = maps->at(i);
7516       if (current_map->IsStringMap()) {
7517         force_generic = true;
7518         break;
7519       }
7520     }
7521   }
7522
7523   if (monomorphic) {
7524     Handle<Map> map = maps->first();
7525     if (!CanInlineElementAccess(map)) {
7526       instr = AddInstruction(BuildKeyedGeneric(access_type, expr, obj, key,
7527                                                val));
7528     } else {
7529       BuildCheckHeapObject(obj);
7530       instr = BuildMonomorphicElementAccess(
7531           obj, key, val, NULL, map, access_type, expr->GetStoreMode());
7532     }
7533   } else if (!force_generic && (maps != NULL && !maps->is_empty())) {
7534     return HandlePolymorphicElementAccess(expr, obj, key, val, maps,
7535                                           access_type, expr->GetStoreMode(),
7536                                           has_side_effects);
7537   } else {
7538     if (access_type == STORE) {
7539       if (expr->IsAssignment() &&
7540           expr->AsAssignment()->HasNoTypeInformation()) {
7541         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedStore,
7542                          Deoptimizer::SOFT);
7543       }
7544     } else {
7545       if (expr->AsProperty()->HasNoTypeInformation()) {
7546         Add<HDeoptimize>(Deoptimizer::kInsufficientTypeFeedbackForKeyedLoad,
7547                          Deoptimizer::SOFT);
7548       }
7549     }
7550     instr = AddInstruction(BuildKeyedGeneric(access_type, expr, obj, key, val));
7551   }
7552   *has_side_effects = instr->HasObservableSideEffects();
7553   return instr;
7554 }
7555
7556
7557 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
7558   // Outermost function already has arguments on the stack.
7559   if (function_state()->outer() == NULL) return;
7560
7561   if (function_state()->arguments_pushed()) return;
7562
7563   // Push arguments when entering inlined function.
7564   HEnterInlined* entry = function_state()->entry();
7565   entry->set_arguments_pushed();
7566
7567   HArgumentsObject* arguments = entry->arguments_object();
7568   const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
7569
7570   HInstruction* insert_after = entry;
7571   for (int i = 0; i < arguments_values->length(); i++) {
7572     HValue* argument = arguments_values->at(i);
7573     HInstruction* push_argument = New<HPushArguments>(argument);
7574     push_argument->InsertAfter(insert_after);
7575     insert_after = push_argument;
7576   }
7577
7578   HArgumentsElements* arguments_elements = New<HArgumentsElements>(true);
7579   arguments_elements->ClearFlag(HValue::kUseGVN);
7580   arguments_elements->InsertAfter(insert_after);
7581   function_state()->set_arguments_elements(arguments_elements);
7582 }
7583
7584
7585 bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
7586   VariableProxy* proxy = expr->obj()->AsVariableProxy();
7587   if (proxy == NULL) return false;
7588   if (!proxy->var()->IsStackAllocated()) return false;
7589   if (!environment()->Lookup(proxy->var())->CheckFlag(HValue::kIsArguments)) {
7590     return false;
7591   }
7592
7593   HInstruction* result = NULL;
7594   if (expr->key()->IsPropertyName()) {
7595     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7596     if (!String::Equals(name, isolate()->factory()->length_string())) {
7597       return false;
7598     }
7599
7600     if (function_state()->outer() == NULL) {
7601       HInstruction* elements = Add<HArgumentsElements>(false);
7602       result = New<HArgumentsLength>(elements);
7603     } else {
7604       // Number of arguments without receiver.
7605       int argument_count = environment()->
7606           arguments_environment()->parameter_count() - 1;
7607       result = New<HConstant>(argument_count);
7608     }
7609   } else {
7610     Push(graph()->GetArgumentsObject());
7611     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);
7612     HValue* key = Pop();
7613     Drop(1);  // Arguments object.
7614     if (function_state()->outer() == NULL) {
7615       HInstruction* elements = Add<HArgumentsElements>(false);
7616       HInstruction* length = Add<HArgumentsLength>(elements);
7617       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7618       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7619     } else {
7620       EnsureArgumentsArePushedForAccess();
7621
7622       // Number of arguments without receiver.
7623       HInstruction* elements = function_state()->arguments_elements();
7624       int argument_count = environment()->
7625           arguments_environment()->parameter_count() - 1;
7626       HInstruction* length = Add<HConstant>(argument_count);
7627       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7628       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7629     }
7630   }
7631   ast_context()->ReturnInstruction(result, expr->id());
7632   return true;
7633 }
7634
7635
7636 HValue* HOptimizedGraphBuilder::BuildNamedAccess(
7637     PropertyAccessType access, BailoutId ast_id, BailoutId return_id,
7638     Expression* expr, HValue* object, Handle<String> name, HValue* value,
7639     bool is_uninitialized) {
7640   SmallMapList* maps;
7641   ComputeReceiverTypes(expr, object, &maps, zone());
7642   DCHECK(maps != NULL);
7643
7644   if (maps->length() > 0) {
7645     PropertyAccessInfo info(this, access, maps->first(), name);
7646     if (!info.CanAccessAsMonomorphic(maps)) {
7647       HandlePolymorphicNamedFieldAccess(access, expr, ast_id, return_id, object,
7648                                         value, maps, name);
7649       return NULL;
7650     }
7651
7652     HValue* checked_object;
7653     // Type::Number() is only supported by polymorphic load/call handling.
7654     DCHECK(!info.IsNumberType());
7655     BuildCheckHeapObject(object);
7656     if (AreStringTypes(maps)) {
7657       checked_object =
7658           Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
7659     } else {
7660       checked_object = Add<HCheckMaps>(object, maps);
7661     }
7662     return BuildMonomorphicAccess(
7663         &info, object, checked_object, value, ast_id, return_id);
7664   }
7665
7666   return BuildNamedGeneric(access, expr, object, name, value, is_uninitialized);
7667 }
7668
7669
7670 void HOptimizedGraphBuilder::PushLoad(Property* expr,
7671                                       HValue* object,
7672                                       HValue* key) {
7673   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
7674   Push(object);
7675   if (key != NULL) Push(key);
7676   BuildLoad(expr, expr->LoadId());
7677 }
7678
7679
7680 void HOptimizedGraphBuilder::BuildLoad(Property* expr,
7681                                        BailoutId ast_id) {
7682   HInstruction* instr = NULL;
7683   if (expr->IsStringAccess()) {
7684     HValue* index = Pop();
7685     HValue* string = Pop();
7686     HInstruction* char_code = BuildStringCharCodeAt(string, index);
7687     AddInstruction(char_code);
7688     instr = NewUncasted<HStringCharFromCode>(char_code);
7689
7690   } else if (expr->key()->IsPropertyName()) {
7691     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7692     HValue* object = Pop();
7693
7694     HValue* value = BuildNamedAccess(LOAD, ast_id, expr->LoadId(), expr, object,
7695                                      name, NULL, expr->IsUninitialized());
7696     if (value == NULL) return;
7697     if (value->IsPhi()) return ast_context()->ReturnValue(value);
7698     instr = HInstruction::cast(value);
7699     if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
7700
7701   } else {
7702     HValue* key = Pop();
7703     HValue* obj = Pop();
7704
7705     bool has_side_effects = false;
7706     HValue* load = HandleKeyedElementAccess(
7707         obj, key, NULL, expr, ast_id, expr->LoadId(), LOAD, &has_side_effects);
7708     if (has_side_effects) {
7709       if (ast_context()->IsEffect()) {
7710         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7711       } else {
7712         Push(load);
7713         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7714         Drop(1);
7715       }
7716     }
7717     if (load == NULL) return;
7718     return ast_context()->ReturnValue(load);
7719   }
7720   return ast_context()->ReturnInstruction(instr, ast_id);
7721 }
7722
7723
7724 void HOptimizedGraphBuilder::VisitProperty(Property* expr) {
7725   DCHECK(!HasStackOverflow());
7726   DCHECK(current_block() != NULL);
7727   DCHECK(current_block()->HasPredecessor());
7728
7729   if (TryArgumentsAccess(expr)) return;
7730
7731   CHECK_ALIVE(VisitForValue(expr->obj()));
7732   if (!expr->key()->IsPropertyName() || expr->IsStringAccess()) {
7733     CHECK_ALIVE(VisitForValue(expr->key()));
7734   }
7735
7736   BuildLoad(expr, expr->id());
7737 }
7738
7739
7740 HInstruction* HGraphBuilder::BuildConstantMapCheck(Handle<JSObject> constant) {
7741   HCheckMaps* check = Add<HCheckMaps>(
7742       Add<HConstant>(constant), handle(constant->map()));
7743   check->ClearDependsOnFlag(kElementsKind);
7744   return check;
7745 }
7746
7747
7748 HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
7749                                                      Handle<JSObject> holder) {
7750   PrototypeIterator iter(isolate(), prototype,
7751                          PrototypeIterator::START_AT_RECEIVER);
7752   while (holder.is_null() ||
7753          !PrototypeIterator::GetCurrent(iter).is_identical_to(holder)) {
7754     BuildConstantMapCheck(
7755         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7756     iter.Advance();
7757     if (iter.IsAtEnd()) {
7758       return NULL;
7759     }
7760   }
7761   return BuildConstantMapCheck(
7762       Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)));
7763 }
7764
7765
7766 void HOptimizedGraphBuilder::AddCheckPrototypeMaps(Handle<JSObject> holder,
7767                                                    Handle<Map> receiver_map) {
7768   if (!holder.is_null()) {
7769     Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
7770     BuildCheckPrototypeMaps(prototype, holder);
7771   }
7772 }
7773
7774
7775 HInstruction* HOptimizedGraphBuilder::NewPlainFunctionCall(
7776     HValue* fun, int argument_count, bool pass_argument_count) {
7777   return New<HCallJSFunction>(fun, argument_count, pass_argument_count);
7778 }
7779
7780
7781 HInstruction* HOptimizedGraphBuilder::NewArgumentAdaptorCall(
7782     HValue* fun, HValue* context,
7783     int argument_count, HValue* expected_param_count) {
7784   ArgumentAdaptorDescriptor descriptor(isolate());
7785   HValue* arity = Add<HConstant>(argument_count - 1);
7786
7787   HValue* op_vals[] = { context, fun, arity, expected_param_count };
7788
7789   Handle<Code> adaptor =
7790       isolate()->builtins()->ArgumentsAdaptorTrampoline();
7791   HConstant* adaptor_value = Add<HConstant>(adaptor);
7792
7793   return New<HCallWithDescriptor>(adaptor_value, argument_count, descriptor,
7794                                   Vector<HValue*>(op_vals, arraysize(op_vals)));
7795 }
7796
7797
7798 HInstruction* HOptimizedGraphBuilder::BuildCallConstantFunction(
7799     Handle<JSFunction> jsfun, int argument_count) {
7800   HValue* target = Add<HConstant>(jsfun);
7801   // For constant functions, we try to avoid calling the
7802   // argument adaptor and instead call the function directly
7803   int formal_parameter_count =
7804       jsfun->shared()->internal_formal_parameter_count();
7805   bool dont_adapt_arguments =
7806       (formal_parameter_count ==
7807        SharedFunctionInfo::kDontAdaptArgumentsSentinel);
7808   int arity = argument_count - 1;
7809   bool can_invoke_directly =
7810       dont_adapt_arguments || formal_parameter_count == arity;
7811   if (can_invoke_directly) {
7812     if (jsfun.is_identical_to(current_info()->closure())) {
7813       graph()->MarkRecursive();
7814     }
7815     return NewPlainFunctionCall(target, argument_count, dont_adapt_arguments);
7816   } else {
7817     HValue* param_count_value = Add<HConstant>(formal_parameter_count);
7818     HValue* context = Add<HLoadNamedField>(
7819         target, nullptr, HObjectAccess::ForFunctionContextPointer());
7820     return NewArgumentAdaptorCall(target, context,
7821         argument_count, param_count_value);
7822   }
7823   UNREACHABLE();
7824   return NULL;
7825 }
7826
7827
7828 class FunctionSorter {
7829  public:
7830   explicit FunctionSorter(int index = 0, int ticks = 0, int size = 0)
7831       : index_(index), ticks_(ticks), size_(size) {}
7832
7833   int index() const { return index_; }
7834   int ticks() const { return ticks_; }
7835   int size() const { return size_; }
7836
7837  private:
7838   int index_;
7839   int ticks_;
7840   int size_;
7841 };
7842
7843
7844 inline bool operator<(const FunctionSorter& lhs, const FunctionSorter& rhs) {
7845   int diff = lhs.ticks() - rhs.ticks();
7846   if (diff != 0) return diff > 0;
7847   return lhs.size() < rhs.size();
7848 }
7849
7850
7851 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(Call* expr,
7852                                                         HValue* receiver,
7853                                                         SmallMapList* maps,
7854                                                         Handle<String> name) {
7855   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
7856   FunctionSorter order[kMaxCallPolymorphism];
7857
7858   bool handle_smi = false;
7859   bool handled_string = false;
7860   int ordered_functions = 0;
7861
7862   int i;
7863   for (i = 0; i < maps->length() && ordered_functions < kMaxCallPolymorphism;
7864        ++i) {
7865     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
7866     if (info.CanAccessMonomorphic() && info.IsDataConstant() &&
7867         info.constant()->IsJSFunction()) {
7868       if (info.IsStringType()) {
7869         if (handled_string) continue;
7870         handled_string = true;
7871       }
7872       Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7873       if (info.IsNumberType()) {
7874         handle_smi = true;
7875       }
7876       expr->set_target(target);
7877       order[ordered_functions++] = FunctionSorter(
7878           i, target->shared()->profiler_ticks(), InliningAstSize(target));
7879     }
7880   }
7881
7882   std::sort(order, order + ordered_functions);
7883
7884   if (i < maps->length()) {
7885     maps->Clear();
7886     ordered_functions = -1;
7887   }
7888
7889   HBasicBlock* number_block = NULL;
7890   HBasicBlock* join = NULL;
7891   handled_string = false;
7892   int count = 0;
7893
7894   for (int fn = 0; fn < ordered_functions; ++fn) {
7895     int i = order[fn].index();
7896     PropertyAccessInfo info(this, LOAD, maps->at(i), name);
7897     if (info.IsStringType()) {
7898       if (handled_string) continue;
7899       handled_string = true;
7900     }
7901     // Reloads the target.
7902     info.CanAccessMonomorphic();
7903     Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7904
7905     expr->set_target(target);
7906     if (count == 0) {
7907       // Only needed once.
7908       join = graph()->CreateBasicBlock();
7909       if (handle_smi) {
7910         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
7911         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
7912         number_block = graph()->CreateBasicBlock();
7913         FinishCurrentBlock(New<HIsSmiAndBranch>(
7914                 receiver, empty_smi_block, not_smi_block));
7915         GotoNoSimulate(empty_smi_block, number_block);
7916         set_current_block(not_smi_block);
7917       } else {
7918         BuildCheckHeapObject(receiver);
7919       }
7920     }
7921     ++count;
7922     HBasicBlock* if_true = graph()->CreateBasicBlock();
7923     HBasicBlock* if_false = graph()->CreateBasicBlock();
7924     HUnaryControlInstruction* compare;
7925
7926     Handle<Map> map = info.map();
7927     if (info.IsNumberType()) {
7928       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
7929       compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
7930     } else if (info.IsStringType()) {
7931       compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
7932     } else {
7933       compare = New<HCompareMap>(receiver, map, if_true, if_false);
7934     }
7935     FinishCurrentBlock(compare);
7936
7937     if (info.IsNumberType()) {
7938       GotoNoSimulate(if_true, number_block);
7939       if_true = number_block;
7940     }
7941
7942     set_current_block(if_true);
7943
7944     AddCheckPrototypeMaps(info.holder(), map);
7945
7946     HValue* function = Add<HConstant>(expr->target());
7947     environment()->SetExpressionStackAt(0, function);
7948     Push(receiver);
7949     CHECK_ALIVE(VisitExpressions(expr->arguments()));
7950     bool needs_wrapping = info.NeedsWrappingFor(target);
7951     bool try_inline = FLAG_polymorphic_inlining && !needs_wrapping;
7952     if (FLAG_trace_inlining && try_inline) {
7953       Handle<JSFunction> caller = current_info()->closure();
7954       base::SmartArrayPointer<char> caller_name =
7955           caller->shared()->DebugName()->ToCString();
7956       PrintF("Trying to inline the polymorphic call to %s from %s\n",
7957              name->ToCString().get(),
7958              caller_name.get());
7959     }
7960     if (try_inline && TryInlineCall(expr)) {
7961       // Trying to inline will signal that we should bailout from the
7962       // entire compilation by setting stack overflow on the visitor.
7963       if (HasStackOverflow()) return;
7964     } else {
7965       // Since HWrapReceiver currently cannot actually wrap numbers and strings,
7966       // use the regular CallFunctionStub for method calls to wrap the receiver.
7967       // TODO(verwaest): Support creation of value wrappers directly in
7968       // HWrapReceiver.
7969       HInstruction* call = needs_wrapping
7970           ? NewUncasted<HCallFunction>(
7971               function, argument_count, WRAP_AND_CALL)
7972           : BuildCallConstantFunction(target, argument_count);
7973       PushArgumentsFromEnvironment(argument_count);
7974       AddInstruction(call);
7975       Drop(1);  // Drop the function.
7976       if (!ast_context()->IsEffect()) Push(call);
7977     }
7978
7979     if (current_block() != NULL) Goto(join);
7980     set_current_block(if_false);
7981   }
7982
7983   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
7984   // know about and do not want to handle ones we've never seen.  Otherwise
7985   // use a generic IC.
7986   if (ordered_functions == maps->length() && FLAG_deoptimize_uncommon_cases) {
7987     FinishExitWithHardDeoptimization(Deoptimizer::kUnknownMapInPolymorphicCall);
7988   } else {
7989     Property* prop = expr->expression()->AsProperty();
7990     HInstruction* function = BuildNamedGeneric(
7991         LOAD, prop, receiver, name, NULL, prop->IsUninitialized());
7992     AddInstruction(function);
7993     Push(function);
7994     AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
7995
7996     environment()->SetExpressionStackAt(1, function);
7997     environment()->SetExpressionStackAt(0, receiver);
7998     CHECK_ALIVE(VisitExpressions(expr->arguments()));
7999
8000     CallFunctionFlags flags = receiver->type().IsJSObject()
8001         ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
8002     HInstruction* call = New<HCallFunction>(
8003         function, argument_count, flags);
8004
8005     PushArgumentsFromEnvironment(argument_count);
8006
8007     Drop(1);  // Function.
8008
8009     if (join != NULL) {
8010       AddInstruction(call);
8011       if (!ast_context()->IsEffect()) Push(call);
8012       Goto(join);
8013     } else {
8014       return ast_context()->ReturnInstruction(call, expr->id());
8015     }
8016   }
8017
8018   // We assume that control flow is always live after an expression.  So
8019   // even without predecessors to the join block, we set it as the exit
8020   // block and continue by adding instructions there.
8021   DCHECK(join != NULL);
8022   if (join->HasPredecessor()) {
8023     set_current_block(join);
8024     join->SetJoinId(expr->id());
8025     if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
8026   } else {
8027     set_current_block(NULL);
8028   }
8029 }
8030
8031
8032 void HOptimizedGraphBuilder::TraceInline(Handle<JSFunction> target,
8033                                          Handle<JSFunction> caller,
8034                                          const char* reason) {
8035   if (FLAG_trace_inlining) {
8036     base::SmartArrayPointer<char> target_name =
8037         target->shared()->DebugName()->ToCString();
8038     base::SmartArrayPointer<char> caller_name =
8039         caller->shared()->DebugName()->ToCString();
8040     if (reason == NULL) {
8041       PrintF("Inlined %s called from %s.\n", target_name.get(),
8042              caller_name.get());
8043     } else {
8044       PrintF("Did not inline %s called from %s (%s).\n",
8045              target_name.get(), caller_name.get(), reason);
8046     }
8047   }
8048 }
8049
8050
8051 static const int kNotInlinable = 1000000000;
8052
8053
8054 int HOptimizedGraphBuilder::InliningAstSize(Handle<JSFunction> target) {
8055   if (!FLAG_use_inlining) return kNotInlinable;
8056
8057   // Precondition: call is monomorphic and we have found a target with the
8058   // appropriate arity.
8059   Handle<JSFunction> caller = current_info()->closure();
8060   Handle<SharedFunctionInfo> target_shared(target->shared());
8061
8062   // Always inline functions that force inlining.
8063   if (target_shared->force_inline()) {
8064     return 0;
8065   }
8066   if (target->IsBuiltin()) {
8067     return kNotInlinable;
8068   }
8069
8070   if (target_shared->IsApiFunction()) {
8071     TraceInline(target, caller, "target is api function");
8072     return kNotInlinable;
8073   }
8074
8075   // Do a quick check on source code length to avoid parsing large
8076   // inlining candidates.
8077   if (target_shared->SourceSize() >
8078       Min(FLAG_max_inlined_source_size, kUnlimitedMaxInlinedSourceSize)) {
8079     TraceInline(target, caller, "target text too big");
8080     return kNotInlinable;
8081   }
8082
8083   // Target must be inlineable.
8084   if (!target_shared->IsInlineable()) {
8085     TraceInline(target, caller, "target not inlineable");
8086     return kNotInlinable;
8087   }
8088   if (target_shared->disable_optimization_reason() != kNoReason) {
8089     TraceInline(target, caller, "target contains unsupported syntax [early]");
8090     return kNotInlinable;
8091   }
8092
8093   int nodes_added = target_shared->ast_node_count();
8094   return nodes_added;
8095 }
8096
8097
8098 bool HOptimizedGraphBuilder::TryInline(Handle<JSFunction> target,
8099                                        int arguments_count,
8100                                        HValue* implicit_return_value,
8101                                        BailoutId ast_id, BailoutId return_id,
8102                                        InliningKind inlining_kind) {
8103   if (target->context()->native_context() !=
8104       top_info()->closure()->context()->native_context()) {
8105     return false;
8106   }
8107   int nodes_added = InliningAstSize(target);
8108   if (nodes_added == kNotInlinable) return false;
8109
8110   Handle<JSFunction> caller = current_info()->closure();
8111
8112   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8113     TraceInline(target, caller, "target AST is too large [early]");
8114     return false;
8115   }
8116
8117   // Don't inline deeper than the maximum number of inlining levels.
8118   HEnvironment* env = environment();
8119   int current_level = 1;
8120   while (env->outer() != NULL) {
8121     if (current_level == FLAG_max_inlining_levels) {
8122       TraceInline(target, caller, "inline depth limit reached");
8123       return false;
8124     }
8125     if (env->outer()->frame_type() == JS_FUNCTION) {
8126       current_level++;
8127     }
8128     env = env->outer();
8129   }
8130
8131   // Don't inline recursive functions.
8132   for (FunctionState* state = function_state();
8133        state != NULL;
8134        state = state->outer()) {
8135     if (*state->compilation_info()->closure() == *target) {
8136       TraceInline(target, caller, "target is recursive");
8137       return false;
8138     }
8139   }
8140
8141   // We don't want to add more than a certain number of nodes from inlining.
8142   // Always inline small methods (<= 10 nodes).
8143   if (inlined_count_ > Min(FLAG_max_inlined_nodes_cumulative,
8144                            kUnlimitedMaxInlinedNodesCumulative)) {
8145     TraceInline(target, caller, "cumulative AST node limit reached");
8146     return false;
8147   }
8148
8149   // Parse and allocate variables.
8150   // Use the same AstValueFactory for creating strings in the sub-compilation
8151   // step, but don't transfer ownership to target_info.
8152   ParseInfo parse_info(zone(), target);
8153   parse_info.set_ast_value_factory(
8154       top_info()->parse_info()->ast_value_factory());
8155   parse_info.set_ast_value_factory_owned(false);
8156
8157   CompilationInfo target_info(&parse_info);
8158   Handle<SharedFunctionInfo> target_shared(target->shared());
8159   if (target_shared->HasDebugInfo()) {
8160     TraceInline(target, caller, "target is being debugged");
8161     return false;
8162   }
8163   if (!Compiler::ParseAndAnalyze(target_info.parse_info())) {
8164     if (target_info.isolate()->has_pending_exception()) {
8165       // Parse or scope error, never optimize this function.
8166       SetStackOverflow();
8167       target_shared->DisableOptimization(kParseScopeError);
8168     }
8169     TraceInline(target, caller, "parse failure");
8170     return false;
8171   }
8172
8173   if (target_info.scope()->num_heap_slots() > 0) {
8174     TraceInline(target, caller, "target has context-allocated variables");
8175     return false;
8176   }
8177   FunctionLiteral* function = target_info.function();
8178
8179   // The following conditions must be checked again after re-parsing, because
8180   // earlier the information might not have been complete due to lazy parsing.
8181   nodes_added = function->ast_node_count();
8182   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
8183     TraceInline(target, caller, "target AST is too large [late]");
8184     return false;
8185   }
8186   if (function->dont_optimize()) {
8187     TraceInline(target, caller, "target contains unsupported syntax [late]");
8188     return false;
8189   }
8190
8191   // If the function uses the arguments object check that inlining of functions
8192   // with arguments object is enabled and the arguments-variable is
8193   // stack allocated.
8194   if (function->scope()->arguments() != NULL) {
8195     if (!FLAG_inline_arguments) {
8196       TraceInline(target, caller, "target uses arguments object");
8197       return false;
8198     }
8199   }
8200
8201   // All declarations must be inlineable.
8202   ZoneList<Declaration*>* decls = target_info.scope()->declarations();
8203   int decl_count = decls->length();
8204   for (int i = 0; i < decl_count; ++i) {
8205     if (!decls->at(i)->IsInlineable()) {
8206       TraceInline(target, caller, "target has non-trivial declaration");
8207       return false;
8208     }
8209   }
8210
8211   // Generate the deoptimization data for the unoptimized version of
8212   // the target function if we don't already have it.
8213   if (!Compiler::EnsureDeoptimizationSupport(&target_info)) {
8214     TraceInline(target, caller, "could not generate deoptimization info");
8215     return false;
8216   }
8217
8218   // In strong mode it is an error to call a function with too few arguments.
8219   // In that case do not inline because then the arity check would be skipped.
8220   if (is_strong(function->language_mode()) &&
8221       arguments_count < function->parameter_count()) {
8222     TraceInline(target, caller,
8223                 "too few arguments passed to a strong function");
8224     return false;
8225   }
8226
8227   // ----------------------------------------------------------------
8228   // After this point, we've made a decision to inline this function (so
8229   // TryInline should always return true).
8230
8231   // Type-check the inlined function.
8232   DCHECK(target_shared->has_deoptimization_support());
8233   AstTyper::Run(&target_info);
8234
8235   int inlining_id = 0;
8236   if (top_info()->is_tracking_positions()) {
8237     inlining_id = top_info()->TraceInlinedFunction(
8238         target_shared, source_position(), function_state()->inlining_id());
8239   }
8240
8241   // Save the pending call context. Set up new one for the inlined function.
8242   // The function state is new-allocated because we need to delete it
8243   // in two different places.
8244   FunctionState* target_state =
8245       new FunctionState(this, &target_info, inlining_kind, inlining_id);
8246
8247   HConstant* undefined = graph()->GetConstantUndefined();
8248
8249   HEnvironment* inner_env =
8250       environment()->CopyForInlining(target,
8251                                      arguments_count,
8252                                      function,
8253                                      undefined,
8254                                      function_state()->inlining_kind());
8255
8256   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
8257   inner_env->BindContext(context);
8258
8259   // Create a dematerialized arguments object for the function, also copy the
8260   // current arguments values to use them for materialization.
8261   HEnvironment* arguments_env = inner_env->arguments_environment();
8262   int parameter_count = arguments_env->parameter_count();
8263   HArgumentsObject* arguments_object = Add<HArgumentsObject>(parameter_count);
8264   for (int i = 0; i < parameter_count; i++) {
8265     arguments_object->AddArgument(arguments_env->Lookup(i), zone());
8266   }
8267
8268   // If the function uses arguments object then bind bind one.
8269   if (function->scope()->arguments() != NULL) {
8270     DCHECK(function->scope()->arguments()->IsStackAllocated());
8271     inner_env->Bind(function->scope()->arguments(), arguments_object);
8272   }
8273
8274   // Capture the state before invoking the inlined function for deopt in the
8275   // inlined function. This simulate has no bailout-id since it's not directly
8276   // reachable for deopt, and is only used to capture the state. If the simulate
8277   // becomes reachable by merging, the ast id of the simulate merged into it is
8278   // adopted.
8279   Add<HSimulate>(BailoutId::None());
8280
8281   current_block()->UpdateEnvironment(inner_env);
8282   Scope* saved_scope = scope();
8283   set_scope(target_info.scope());
8284   HEnterInlined* enter_inlined =
8285       Add<HEnterInlined>(return_id, target, context, arguments_count, function,
8286                          function_state()->inlining_kind(),
8287                          function->scope()->arguments(), arguments_object);
8288   if (top_info()->is_tracking_positions()) {
8289     enter_inlined->set_inlining_id(inlining_id);
8290   }
8291   function_state()->set_entry(enter_inlined);
8292
8293   VisitDeclarations(target_info.scope()->declarations());
8294   VisitStatements(function->body());
8295   set_scope(saved_scope);
8296   if (HasStackOverflow()) {
8297     // Bail out if the inline function did, as we cannot residualize a call
8298     // instead, but do not disable optimization for the outer function.
8299     TraceInline(target, caller, "inline graph construction failed");
8300     target_shared->DisableOptimization(kInliningBailedOut);
8301     current_info()->RetryOptimization(kInliningBailedOut);
8302     delete target_state;
8303     return true;
8304   }
8305
8306   // Update inlined nodes count.
8307   inlined_count_ += nodes_added;
8308
8309   Handle<Code> unoptimized_code(target_shared->code());
8310   DCHECK(unoptimized_code->kind() == Code::FUNCTION);
8311   Handle<TypeFeedbackInfo> type_info(
8312       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
8313   graph()->update_type_change_checksum(type_info->own_type_change_checksum());
8314
8315   TraceInline(target, caller, NULL);
8316
8317   if (current_block() != NULL) {
8318     FunctionState* state = function_state();
8319     if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
8320       // Falling off the end of an inlined construct call. In a test context the
8321       // return value will always evaluate to true, in a value context the
8322       // return value is the newly allocated receiver.
8323       if (call_context()->IsTest()) {
8324         Goto(inlined_test_context()->if_true(), state);
8325       } else if (call_context()->IsEffect()) {
8326         Goto(function_return(), state);
8327       } else {
8328         DCHECK(call_context()->IsValue());
8329         AddLeaveInlined(implicit_return_value, state);
8330       }
8331     } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
8332       // Falling off the end of an inlined setter call. The returned value is
8333       // never used, the value of an assignment is always the value of the RHS
8334       // of the assignment.
8335       if (call_context()->IsTest()) {
8336         inlined_test_context()->ReturnValue(implicit_return_value);
8337       } else if (call_context()->IsEffect()) {
8338         Goto(function_return(), state);
8339       } else {
8340         DCHECK(call_context()->IsValue());
8341         AddLeaveInlined(implicit_return_value, state);
8342       }
8343     } else {
8344       // Falling off the end of a normal inlined function. This basically means
8345       // returning undefined.
8346       if (call_context()->IsTest()) {
8347         Goto(inlined_test_context()->if_false(), state);
8348       } else if (call_context()->IsEffect()) {
8349         Goto(function_return(), state);
8350       } else {
8351         DCHECK(call_context()->IsValue());
8352         AddLeaveInlined(undefined, state);
8353       }
8354     }
8355   }
8356
8357   // Fix up the function exits.
8358   if (inlined_test_context() != NULL) {
8359     HBasicBlock* if_true = inlined_test_context()->if_true();
8360     HBasicBlock* if_false = inlined_test_context()->if_false();
8361
8362     HEnterInlined* entry = function_state()->entry();
8363
8364     // Pop the return test context from the expression context stack.
8365     DCHECK(ast_context() == inlined_test_context());
8366     ClearInlinedTestContext();
8367     delete target_state;
8368
8369     // Forward to the real test context.
8370     if (if_true->HasPredecessor()) {
8371       entry->RegisterReturnTarget(if_true, zone());
8372       if_true->SetJoinId(ast_id);
8373       HBasicBlock* true_target = TestContext::cast(ast_context())->if_true();
8374       Goto(if_true, true_target, function_state());
8375     }
8376     if (if_false->HasPredecessor()) {
8377       entry->RegisterReturnTarget(if_false, zone());
8378       if_false->SetJoinId(ast_id);
8379       HBasicBlock* false_target = TestContext::cast(ast_context())->if_false();
8380       Goto(if_false, false_target, function_state());
8381     }
8382     set_current_block(NULL);
8383     return true;
8384
8385   } else if (function_return()->HasPredecessor()) {
8386     function_state()->entry()->RegisterReturnTarget(function_return(), zone());
8387     function_return()->SetJoinId(ast_id);
8388     set_current_block(function_return());
8389   } else {
8390     set_current_block(NULL);
8391   }
8392   delete target_state;
8393   return true;
8394 }
8395
8396
8397 bool HOptimizedGraphBuilder::TryInlineCall(Call* expr) {
8398   return TryInline(expr->target(), expr->arguments()->length(), NULL,
8399                    expr->id(), expr->ReturnId(), NORMAL_RETURN);
8400 }
8401
8402
8403 bool HOptimizedGraphBuilder::TryInlineConstruct(CallNew* expr,
8404                                                 HValue* implicit_return_value) {
8405   return TryInline(expr->target(), expr->arguments()->length(),
8406                    implicit_return_value, expr->id(), expr->ReturnId(),
8407                    CONSTRUCT_CALL_RETURN);
8408 }
8409
8410
8411 bool HOptimizedGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
8412                                              Handle<Map> receiver_map,
8413                                              BailoutId ast_id,
8414                                              BailoutId return_id) {
8415   if (TryInlineApiGetter(getter, receiver_map, ast_id)) return true;
8416   return TryInline(getter, 0, NULL, ast_id, return_id, GETTER_CALL_RETURN);
8417 }
8418
8419
8420 bool HOptimizedGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
8421                                              Handle<Map> receiver_map,
8422                                              BailoutId id,
8423                                              BailoutId assignment_id,
8424                                              HValue* implicit_return_value) {
8425   if (TryInlineApiSetter(setter, receiver_map, id)) return true;
8426   return TryInline(setter, 1, implicit_return_value, id, assignment_id,
8427                    SETTER_CALL_RETURN);
8428 }
8429
8430
8431 bool HOptimizedGraphBuilder::TryInlineIndirectCall(Handle<JSFunction> function,
8432                                                    Call* expr,
8433                                                    int arguments_count) {
8434   return TryInline(function, arguments_count, NULL, expr->id(),
8435                    expr->ReturnId(), NORMAL_RETURN);
8436 }
8437
8438
8439 bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
8440   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8441   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8442   switch (id) {
8443     case kMathExp:
8444       if (!FLAG_fast_math) break;
8445       // Fall through if FLAG_fast_math.
8446     case kMathRound:
8447     case kMathFround:
8448     case kMathFloor:
8449     case kMathAbs:
8450     case kMathSqrt:
8451     case kMathLog:
8452     case kMathClz32:
8453       if (expr->arguments()->length() == 1) {
8454         HValue* argument = Pop();
8455         Drop(2);  // Receiver and function.
8456         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8457         ast_context()->ReturnInstruction(op, expr->id());
8458         return true;
8459       }
8460       break;
8461     case kMathImul:
8462       if (expr->arguments()->length() == 2) {
8463         HValue* right = Pop();
8464         HValue* left = Pop();
8465         Drop(2);  // Receiver and function.
8466         HInstruction* op =
8467             HMul::NewImul(isolate(), zone(), context(), left, right);
8468         ast_context()->ReturnInstruction(op, expr->id());
8469         return true;
8470       }
8471       break;
8472     default:
8473       // Not supported for inlining yet.
8474       break;
8475   }
8476   return false;
8477 }
8478
8479
8480 // static
8481 bool HOptimizedGraphBuilder::IsReadOnlyLengthDescriptor(
8482     Handle<Map> jsarray_map) {
8483   DCHECK(!jsarray_map->is_dictionary_map());
8484   Isolate* isolate = jsarray_map->GetIsolate();
8485   Handle<Name> length_string = isolate->factory()->length_string();
8486   DescriptorArray* descriptors = jsarray_map->instance_descriptors();
8487   int number = descriptors->SearchWithCache(*length_string, *jsarray_map);
8488   DCHECK_NE(DescriptorArray::kNotFound, number);
8489   return descriptors->GetDetails(number).IsReadOnly();
8490 }
8491
8492
8493 // static
8494 bool HOptimizedGraphBuilder::CanInlineArrayResizeOperation(
8495     Handle<Map> receiver_map) {
8496   return !receiver_map.is_null() &&
8497          receiver_map->instance_type() == JS_ARRAY_TYPE &&
8498          IsFastElementsKind(receiver_map->elements_kind()) &&
8499          !receiver_map->is_dictionary_map() &&
8500          !IsReadOnlyLengthDescriptor(receiver_map) &&
8501          !receiver_map->is_observed() && receiver_map->is_extensible();
8502 }
8503
8504
8505 bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
8506     Call* expr, Handle<JSFunction> function, Handle<Map> receiver_map,
8507     int args_count_no_receiver) {
8508   if (!function->shared()->HasBuiltinFunctionId()) return false;
8509   BuiltinFunctionId id = function->shared()->builtin_function_id();
8510   int argument_count = args_count_no_receiver + 1;  // Plus receiver.
8511
8512   if (receiver_map.is_null()) {
8513     HValue* receiver = environment()->ExpressionStackAt(args_count_no_receiver);
8514     if (receiver->IsConstant() &&
8515         HConstant::cast(receiver)->handle(isolate())->IsHeapObject()) {
8516       receiver_map =
8517           handle(Handle<HeapObject>::cast(
8518                      HConstant::cast(receiver)->handle(isolate()))->map());
8519     }
8520   }
8521   // Try to inline calls like Math.* as operations in the calling function.
8522   switch (id) {
8523     case kStringCharCodeAt:
8524     case kStringCharAt:
8525       if (argument_count == 2) {
8526         HValue* index = Pop();
8527         HValue* string = Pop();
8528         Drop(1);  // Function.
8529         HInstruction* char_code =
8530             BuildStringCharCodeAt(string, index);
8531         if (id == kStringCharCodeAt) {
8532           ast_context()->ReturnInstruction(char_code, expr->id());
8533           return true;
8534         }
8535         AddInstruction(char_code);
8536         HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
8537         ast_context()->ReturnInstruction(result, expr->id());
8538         return true;
8539       }
8540       break;
8541     case kStringFromCharCode:
8542       if (argument_count == 2) {
8543         HValue* argument = Pop();
8544         Drop(2);  // Receiver and function.
8545         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
8546         ast_context()->ReturnInstruction(result, expr->id());
8547         return true;
8548       }
8549       break;
8550     case kMathExp:
8551       if (!FLAG_fast_math) break;
8552       // Fall through if FLAG_fast_math.
8553     case kMathRound:
8554     case kMathFround:
8555     case kMathFloor:
8556     case kMathAbs:
8557     case kMathSqrt:
8558     case kMathLog:
8559     case kMathClz32:
8560       if (argument_count == 2) {
8561         HValue* argument = Pop();
8562         Drop(2);  // Receiver and function.
8563         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8564         ast_context()->ReturnInstruction(op, expr->id());
8565         return true;
8566       }
8567       break;
8568     case kMathPow:
8569       if (argument_count == 3) {
8570         HValue* right = Pop();
8571         HValue* left = Pop();
8572         Drop(2);  // Receiver and function.
8573         HInstruction* result = NULL;
8574         // Use sqrt() if exponent is 0.5 or -0.5.
8575         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
8576           double exponent = HConstant::cast(right)->DoubleValue();
8577           if (exponent == 0.5) {
8578             result = NewUncasted<HUnaryMathOperation>(left, kMathPowHalf);
8579           } else if (exponent == -0.5) {
8580             HValue* one = graph()->GetConstant1();
8581             HInstruction* sqrt = AddUncasted<HUnaryMathOperation>(
8582                 left, kMathPowHalf);
8583             // MathPowHalf doesn't have side effects so there's no need for
8584             // an environment simulation here.
8585             DCHECK(!sqrt->HasObservableSideEffects());
8586             result = NewUncasted<HDiv>(one, sqrt);
8587           } else if (exponent == 2.0) {
8588             result = NewUncasted<HMul>(left, left);
8589           }
8590         }
8591
8592         if (result == NULL) {
8593           result = NewUncasted<HPower>(left, right);
8594         }
8595         ast_context()->ReturnInstruction(result, expr->id());
8596         return true;
8597       }
8598       break;
8599     case kMathMax:
8600     case kMathMin:
8601       if (argument_count == 3) {
8602         HValue* right = Pop();
8603         HValue* left = Pop();
8604         Drop(2);  // Receiver and function.
8605         HMathMinMax::Operation op = (id == kMathMin) ? HMathMinMax::kMathMin
8606                                                      : HMathMinMax::kMathMax;
8607         HInstruction* result = NewUncasted<HMathMinMax>(left, right, op);
8608         ast_context()->ReturnInstruction(result, expr->id());
8609         return true;
8610       }
8611       break;
8612     case kMathImul:
8613       if (argument_count == 3) {
8614         HValue* right = Pop();
8615         HValue* left = Pop();
8616         Drop(2);  // Receiver and function.
8617         HInstruction* result =
8618             HMul::NewImul(isolate(), zone(), context(), left, right);
8619         ast_context()->ReturnInstruction(result, expr->id());
8620         return true;
8621       }
8622       break;
8623     case kArrayPop: {
8624       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8625       ElementsKind elements_kind = receiver_map->elements_kind();
8626
8627       Drop(args_count_no_receiver);
8628       HValue* result;
8629       HValue* reduced_length;
8630       HValue* receiver = Pop();
8631
8632       HValue* checked_object = AddCheckMap(receiver, receiver_map);
8633       HValue* length =
8634           Add<HLoadNamedField>(checked_object, nullptr,
8635                                HObjectAccess::ForArrayLength(elements_kind));
8636
8637       Drop(1);  // Function.
8638
8639       { NoObservableSideEffectsScope scope(this);
8640         IfBuilder length_checker(this);
8641
8642         HValue* bounds_check = length_checker.If<HCompareNumericAndBranch>(
8643             length, graph()->GetConstant0(), Token::EQ);
8644         length_checker.Then();
8645
8646         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8647
8648         length_checker.Else();
8649         HValue* elements = AddLoadElements(checked_object);
8650         // Ensure that we aren't popping from a copy-on-write array.
8651         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8652           elements = BuildCopyElementsOnWrite(checked_object, elements,
8653                                               elements_kind, length);
8654         }
8655         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
8656         result = AddElementAccess(elements, reduced_length, NULL,
8657                                   bounds_check, elements_kind, LOAD);
8658         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
8659                            ? graph()->GetConstantHole()
8660                            : Add<HConstant>(HConstant::kHoleNaN);
8661         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8662           elements_kind = FAST_HOLEY_ELEMENTS;
8663         }
8664         AddElementAccess(
8665             elements, reduced_length, hole, bounds_check, elements_kind, STORE);
8666         Add<HStoreNamedField>(
8667             checked_object, HObjectAccess::ForArrayLength(elements_kind),
8668             reduced_length, STORE_TO_INITIALIZED_ENTRY);
8669
8670         if (!ast_context()->IsEffect()) Push(result);
8671
8672         length_checker.End();
8673       }
8674       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8675       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8676       if (!ast_context()->IsEffect()) Drop(1);
8677
8678       ast_context()->ReturnValue(result);
8679       return true;
8680     }
8681     case kArrayPush: {
8682       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8683       ElementsKind elements_kind = receiver_map->elements_kind();
8684
8685       // If there may be elements accessors in the prototype chain, the fast
8686       // inlined version can't be used.
8687       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8688       // If there currently can be no elements accessors on the prototype chain,
8689       // it doesn't mean that there won't be any later. Install a full prototype
8690       // chain check to trap element accessors being installed on the prototype
8691       // chain, which would cause elements to go to dictionary mode and result
8692       // in a map change.
8693       Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
8694       BuildCheckPrototypeMaps(prototype, Handle<JSObject>());
8695
8696       // Protect against adding elements to the Array prototype, which needs to
8697       // route through appropriate bottlenecks.
8698       if (isolate()->IsFastArrayConstructorPrototypeChainIntact() &&
8699           !prototype->IsJSArray()) {
8700         return false;
8701       }
8702
8703       const int argc = args_count_no_receiver;
8704       if (argc != 1) return false;
8705
8706       HValue* value_to_push = Pop();
8707       HValue* array = Pop();
8708       Drop(1);  // Drop function.
8709
8710       HInstruction* new_size = NULL;
8711       HValue* length = NULL;
8712
8713       {
8714         NoObservableSideEffectsScope scope(this);
8715
8716         length = Add<HLoadNamedField>(
8717             array, nullptr, HObjectAccess::ForArrayLength(elements_kind));
8718
8719         new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
8720
8721         bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
8722         HValue* checked_array = Add<HCheckMaps>(array, receiver_map);
8723         BuildUncheckedMonomorphicElementAccess(
8724             checked_array, length, value_to_push, is_array, elements_kind,
8725             STORE, NEVER_RETURN_HOLE, STORE_AND_GROW_NO_TRANSITION);
8726
8727         if (!ast_context()->IsEffect()) Push(new_size);
8728         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8729         if (!ast_context()->IsEffect()) Drop(1);
8730       }
8731
8732       ast_context()->ReturnValue(new_size);
8733       return true;
8734     }
8735     case kArrayShift: {
8736       if (!CanInlineArrayResizeOperation(receiver_map)) return false;
8737       ElementsKind kind = receiver_map->elements_kind();
8738
8739       // If there may be elements accessors in the prototype chain, the fast
8740       // inlined version can't be used.
8741       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8742
8743       // If there currently can be no elements accessors on the prototype chain,
8744       // it doesn't mean that there won't be any later. Install a full prototype
8745       // chain check to trap element accessors being installed on the prototype
8746       // chain, which would cause elements to go to dictionary mode and result
8747       // in a map change.
8748       BuildCheckPrototypeMaps(
8749           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8750           Handle<JSObject>::null());
8751
8752       // Threshold for fast inlined Array.shift().
8753       HConstant* inline_threshold = Add<HConstant>(static_cast<int32_t>(16));
8754
8755       Drop(args_count_no_receiver);
8756       HValue* receiver = Pop();
8757       HValue* function = Pop();
8758       HValue* result;
8759
8760       {
8761         NoObservableSideEffectsScope scope(this);
8762
8763         HValue* length = Add<HLoadNamedField>(
8764             receiver, nullptr, HObjectAccess::ForArrayLength(kind));
8765
8766         IfBuilder if_lengthiszero(this);
8767         HValue* lengthiszero = if_lengthiszero.If<HCompareNumericAndBranch>(
8768             length, graph()->GetConstant0(), Token::EQ);
8769         if_lengthiszero.Then();
8770         {
8771           if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8772         }
8773         if_lengthiszero.Else();
8774         {
8775           HValue* elements = AddLoadElements(receiver);
8776
8777           // Check if we can use the fast inlined Array.shift().
8778           IfBuilder if_inline(this);
8779           if_inline.If<HCompareNumericAndBranch>(
8780               length, inline_threshold, Token::LTE);
8781           if (IsFastSmiOrObjectElementsKind(kind)) {
8782             // We cannot handle copy-on-write backing stores here.
8783             if_inline.AndIf<HCompareMap>(
8784                 elements, isolate()->factory()->fixed_array_map());
8785           }
8786           if_inline.Then();
8787           {
8788             // Remember the result.
8789             if (!ast_context()->IsEffect()) {
8790               Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
8791                                     lengthiszero, kind, LOAD));
8792             }
8793
8794             // Compute the new length.
8795             HValue* new_length = AddUncasted<HSub>(
8796                 length, graph()->GetConstant1());
8797             new_length->ClearFlag(HValue::kCanOverflow);
8798
8799             // Copy the remaining elements.
8800             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
8801             {
8802               HValue* new_key = loop.BeginBody(
8803                   graph()->GetConstant0(), new_length, Token::LT);
8804               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
8805               key->ClearFlag(HValue::kCanOverflow);
8806               ElementsKind copy_kind =
8807                   kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
8808               HValue* element = AddUncasted<HLoadKeyed>(
8809                   elements, key, lengthiszero, copy_kind, ALLOW_RETURN_HOLE);
8810               HStoreKeyed* store =
8811                   Add<HStoreKeyed>(elements, new_key, element, copy_kind);
8812               store->SetFlag(HValue::kAllowUndefinedAsNaN);
8813             }
8814             loop.EndBody();
8815
8816             // Put a hole at the end.
8817             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
8818                                ? graph()->GetConstantHole()
8819                                : Add<HConstant>(HConstant::kHoleNaN);
8820             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
8821             Add<HStoreKeyed>(
8822                 elements, new_length, hole, kind, INITIALIZING_STORE);
8823
8824             // Remember new length.
8825             Add<HStoreNamedField>(
8826                 receiver, HObjectAccess::ForArrayLength(kind),
8827                 new_length, STORE_TO_INITIALIZED_ENTRY);
8828           }
8829           if_inline.Else();
8830           {
8831             Add<HPushArguments>(receiver);
8832             result = Add<HCallJSFunction>(function, 1, true);
8833             if (!ast_context()->IsEffect()) Push(result);
8834           }
8835           if_inline.End();
8836         }
8837         if_lengthiszero.End();
8838       }
8839       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8840       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8841       if (!ast_context()->IsEffect()) Drop(1);
8842       ast_context()->ReturnValue(result);
8843       return true;
8844     }
8845     case kArrayIndexOf:
8846     case kArrayLastIndexOf: {
8847       if (receiver_map.is_null()) return false;
8848       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8849       ElementsKind kind = receiver_map->elements_kind();
8850       if (!IsFastElementsKind(kind)) return false;
8851       if (receiver_map->is_observed()) return false;
8852       if (argument_count != 2) return false;
8853       if (!receiver_map->is_extensible()) return false;
8854
8855       // If there may be elements accessors in the prototype chain, the fast
8856       // inlined version can't be used.
8857       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8858
8859       // If there currently can be no elements accessors on the prototype chain,
8860       // it doesn't mean that there won't be any later. Install a full prototype
8861       // chain check to trap element accessors being installed on the prototype
8862       // chain, which would cause elements to go to dictionary mode and result
8863       // in a map change.
8864       BuildCheckPrototypeMaps(
8865           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8866           Handle<JSObject>::null());
8867
8868       HValue* search_element = Pop();
8869       HValue* receiver = Pop();
8870       Drop(1);  // Drop function.
8871
8872       ArrayIndexOfMode mode = (id == kArrayIndexOf)
8873           ? kFirstIndexOf : kLastIndexOf;
8874       HValue* index = BuildArrayIndexOf(receiver, search_element, kind, mode);
8875
8876       if (!ast_context()->IsEffect()) Push(index);
8877       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8878       if (!ast_context()->IsEffect()) Drop(1);
8879       ast_context()->ReturnValue(index);
8880       return true;
8881     }
8882     default:
8883       // Not yet supported for inlining.
8884       break;
8885   }
8886   return false;
8887 }
8888
8889
8890 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
8891                                                       HValue* receiver) {
8892   Handle<JSFunction> function = expr->target();
8893   int argc = expr->arguments()->length();
8894   SmallMapList receiver_maps;
8895   return TryInlineApiCall(function,
8896                           receiver,
8897                           &receiver_maps,
8898                           argc,
8899                           expr->id(),
8900                           kCallApiFunction);
8901 }
8902
8903
8904 bool HOptimizedGraphBuilder::TryInlineApiMethodCall(
8905     Call* expr,
8906     HValue* receiver,
8907     SmallMapList* receiver_maps) {
8908   Handle<JSFunction> function = expr->target();
8909   int argc = expr->arguments()->length();
8910   return TryInlineApiCall(function,
8911                           receiver,
8912                           receiver_maps,
8913                           argc,
8914                           expr->id(),
8915                           kCallApiMethod);
8916 }
8917
8918
8919 bool HOptimizedGraphBuilder::TryInlineApiGetter(Handle<JSFunction> function,
8920                                                 Handle<Map> receiver_map,
8921                                                 BailoutId ast_id) {
8922   SmallMapList receiver_maps(1, zone());
8923   receiver_maps.Add(receiver_map, zone());
8924   return TryInlineApiCall(function,
8925                           NULL,  // Receiver is on expression stack.
8926                           &receiver_maps,
8927                           0,
8928                           ast_id,
8929                           kCallApiGetter);
8930 }
8931
8932
8933 bool HOptimizedGraphBuilder::TryInlineApiSetter(Handle<JSFunction> function,
8934                                                 Handle<Map> receiver_map,
8935                                                 BailoutId ast_id) {
8936   SmallMapList receiver_maps(1, zone());
8937   receiver_maps.Add(receiver_map, zone());
8938   return TryInlineApiCall(function,
8939                           NULL,  // Receiver is on expression stack.
8940                           &receiver_maps,
8941                           1,
8942                           ast_id,
8943                           kCallApiSetter);
8944 }
8945
8946
8947 bool HOptimizedGraphBuilder::TryInlineApiCall(Handle<JSFunction> function,
8948                                                HValue* receiver,
8949                                                SmallMapList* receiver_maps,
8950                                                int argc,
8951                                                BailoutId ast_id,
8952                                                ApiCallType call_type) {
8953   if (function->context()->native_context() !=
8954       top_info()->closure()->context()->native_context()) {
8955     return false;
8956   }
8957   CallOptimization optimization(function);
8958   if (!optimization.is_simple_api_call()) return false;
8959   Handle<Map> holder_map;
8960   for (int i = 0; i < receiver_maps->length(); ++i) {
8961     auto map = receiver_maps->at(i);
8962     // Don't inline calls to receivers requiring accesschecks.
8963     if (map->is_access_check_needed()) return false;
8964   }
8965   if (call_type == kCallApiFunction) {
8966     // Cannot embed a direct reference to the global proxy map
8967     // as it maybe dropped on deserialization.
8968     CHECK(!isolate()->serializer_enabled());
8969     DCHECK_EQ(0, receiver_maps->length());
8970     receiver_maps->Add(handle(function->global_proxy()->map()), zone());
8971   }
8972   CallOptimization::HolderLookup holder_lookup =
8973       CallOptimization::kHolderNotFound;
8974   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
8975       receiver_maps->first(), &holder_lookup);
8976   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
8977
8978   if (FLAG_trace_inlining) {
8979     PrintF("Inlining api function ");
8980     function->ShortPrint();
8981     PrintF("\n");
8982   }
8983
8984   bool is_function = false;
8985   bool is_store = false;
8986   switch (call_type) {
8987     case kCallApiFunction:
8988     case kCallApiMethod:
8989       // Need to check that none of the receiver maps could have changed.
8990       Add<HCheckMaps>(receiver, receiver_maps);
8991       // Need to ensure the chain between receiver and api_holder is intact.
8992       if (holder_lookup == CallOptimization::kHolderFound) {
8993         AddCheckPrototypeMaps(api_holder, receiver_maps->first());
8994       } else {
8995         DCHECK_EQ(holder_lookup, CallOptimization::kHolderIsReceiver);
8996       }
8997       // Includes receiver.
8998       PushArgumentsFromEnvironment(argc + 1);
8999       is_function = true;
9000       break;
9001     case kCallApiGetter:
9002       // Receiver and prototype chain cannot have changed.
9003       DCHECK_EQ(0, argc);
9004       DCHECK_NULL(receiver);
9005       // Receiver is on expression stack.
9006       receiver = Pop();
9007       Add<HPushArguments>(receiver);
9008       break;
9009     case kCallApiSetter:
9010       {
9011         is_store = true;
9012         // Receiver and prototype chain cannot have changed.
9013         DCHECK_EQ(1, argc);
9014         DCHECK_NULL(receiver);
9015         // Receiver and value are on expression stack.
9016         HValue* value = Pop();
9017         receiver = Pop();
9018         Add<HPushArguments>(receiver, value);
9019         break;
9020      }
9021   }
9022
9023   HValue* holder = NULL;
9024   switch (holder_lookup) {
9025     case CallOptimization::kHolderFound:
9026       holder = Add<HConstant>(api_holder);
9027       break;
9028     case CallOptimization::kHolderIsReceiver:
9029       holder = receiver;
9030       break;
9031     case CallOptimization::kHolderNotFound:
9032       UNREACHABLE();
9033       break;
9034   }
9035   Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
9036   Handle<Object> call_data_obj(api_call_info->data(), isolate());
9037   bool call_data_undefined = call_data_obj->IsUndefined();
9038   HValue* call_data = Add<HConstant>(call_data_obj);
9039   ApiFunction fun(v8::ToCData<Address>(api_call_info->callback()));
9040   ExternalReference ref = ExternalReference(&fun,
9041                                             ExternalReference::DIRECT_API_CALL,
9042                                             isolate());
9043   HValue* api_function_address = Add<HConstant>(ExternalReference(ref));
9044
9045   HValue* op_vals[] = {context(), Add<HConstant>(function), call_data, holder,
9046                        api_function_address, nullptr};
9047
9048   HInstruction* call = nullptr;
9049   if (!is_function) {
9050     CallApiAccessorStub stub(isolate(), is_store, call_data_undefined);
9051     Handle<Code> code = stub.GetCode();
9052     HConstant* code_value = Add<HConstant>(code);
9053     ApiAccessorDescriptor descriptor(isolate());
9054     call = New<HCallWithDescriptor>(
9055         code_value, argc + 1, descriptor,
9056         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9057   } else if (argc <= CallApiFunctionWithFixedArgsStub::kMaxFixedArgs) {
9058     CallApiFunctionWithFixedArgsStub stub(isolate(), argc, call_data_undefined);
9059     Handle<Code> code = stub.GetCode();
9060     HConstant* code_value = Add<HConstant>(code);
9061     ApiFunctionWithFixedArgsDescriptor descriptor(isolate());
9062     call = New<HCallWithDescriptor>(
9063         code_value, argc + 1, descriptor,
9064         Vector<HValue*>(op_vals, arraysize(op_vals) - 1));
9065     Drop(1);  // Drop function.
9066   } else {
9067     op_vals[arraysize(op_vals) - 1] = Add<HConstant>(argc);
9068     CallApiFunctionStub stub(isolate(), call_data_undefined);
9069     Handle<Code> code = stub.GetCode();
9070     HConstant* code_value = Add<HConstant>(code);
9071     ApiFunctionDescriptor descriptor(isolate());
9072     call =
9073         New<HCallWithDescriptor>(code_value, argc + 1, descriptor,
9074                                  Vector<HValue*>(op_vals, arraysize(op_vals)));
9075     Drop(1);  // Drop function.
9076   }
9077
9078   ast_context()->ReturnInstruction(call, ast_id);
9079   return true;
9080 }
9081
9082
9083 void HOptimizedGraphBuilder::HandleIndirectCall(Call* expr, HValue* function,
9084                                                 int arguments_count) {
9085   Handle<JSFunction> known_function;
9086   int args_count_no_receiver = arguments_count - 1;
9087   if (function->IsConstant() &&
9088       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9089     known_function =
9090         Handle<JSFunction>::cast(HConstant::cast(function)->handle(isolate()));
9091     if (TryInlineBuiltinMethodCall(expr, known_function, Handle<Map>(),
9092                                    args_count_no_receiver)) {
9093       if (FLAG_trace_inlining) {
9094         PrintF("Inlining builtin ");
9095         known_function->ShortPrint();
9096         PrintF("\n");
9097       }
9098       return;
9099     }
9100
9101     if (TryInlineIndirectCall(known_function, expr, args_count_no_receiver)) {
9102       return;
9103     }
9104   }
9105
9106   PushArgumentsFromEnvironment(arguments_count);
9107   HInvokeFunction* call =
9108       New<HInvokeFunction>(function, known_function, arguments_count);
9109   Drop(1);  // Function
9110   ast_context()->ReturnInstruction(call, expr->id());
9111 }
9112
9113
9114 bool HOptimizedGraphBuilder::TryIndirectCall(Call* expr) {
9115   DCHECK(expr->expression()->IsProperty());
9116
9117   if (!expr->IsMonomorphic()) {
9118     return false;
9119   }
9120   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9121   if (function_map->instance_type() != JS_FUNCTION_TYPE ||
9122       !expr->target()->shared()->HasBuiltinFunctionId()) {
9123     return false;
9124   }
9125
9126   switch (expr->target()->shared()->builtin_function_id()) {
9127     case kFunctionCall: {
9128       if (expr->arguments()->length() == 0) return false;
9129       BuildFunctionCall(expr);
9130       return true;
9131     }
9132     case kFunctionApply: {
9133       // For .apply, only the pattern f.apply(receiver, arguments)
9134       // is supported.
9135       if (current_info()->scope()->arguments() == NULL) return false;
9136
9137       if (!CanBeFunctionApplyArguments(expr)) return false;
9138
9139       BuildFunctionApply(expr);
9140       return true;
9141     }
9142     default: { return false; }
9143   }
9144   UNREACHABLE();
9145 }
9146
9147
9148 void HOptimizedGraphBuilder::BuildFunctionApply(Call* expr) {
9149   ZoneList<Expression*>* args = expr->arguments();
9150   CHECK_ALIVE(VisitForValue(args->at(0)));
9151   HValue* receiver = Pop();  // receiver
9152   HValue* function = Pop();  // f
9153   Drop(1);  // apply
9154
9155   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9156   HValue* checked_function = AddCheckMap(function, function_map);
9157
9158   if (function_state()->outer() == NULL) {
9159     HInstruction* elements = Add<HArgumentsElements>(false);
9160     HInstruction* length = Add<HArgumentsLength>(elements);
9161     HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
9162     HInstruction* result = New<HApplyArguments>(function,
9163                                                 wrapped_receiver,
9164                                                 length,
9165                                                 elements);
9166     ast_context()->ReturnInstruction(result, expr->id());
9167   } else {
9168     // We are inside inlined function and we know exactly what is inside
9169     // arguments object. But we need to be able to materialize at deopt.
9170     DCHECK_EQ(environment()->arguments_environment()->parameter_count(),
9171               function_state()->entry()->arguments_object()->arguments_count());
9172     HArgumentsObject* args = function_state()->entry()->arguments_object();
9173     const ZoneList<HValue*>* arguments_values = args->arguments_values();
9174     int arguments_count = arguments_values->length();
9175     Push(function);
9176     Push(BuildWrapReceiver(receiver, checked_function));
9177     for (int i = 1; i < arguments_count; i++) {
9178       Push(arguments_values->at(i));
9179     }
9180     HandleIndirectCall(expr, function, arguments_count);
9181   }
9182 }
9183
9184
9185 // f.call(...)
9186 void HOptimizedGraphBuilder::BuildFunctionCall(Call* expr) {
9187   HValue* function = Top();  // f
9188   Handle<Map> function_map = expr->GetReceiverTypes()->first();
9189   HValue* checked_function = AddCheckMap(function, function_map);
9190
9191   // f and call are on the stack in the unoptimized code
9192   // during evaluation of the arguments.
9193   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9194
9195   int args_length = expr->arguments()->length();
9196   int receiver_index = args_length - 1;
9197   // Patch the receiver.
9198   HValue* receiver = BuildWrapReceiver(
9199       environment()->ExpressionStackAt(receiver_index), checked_function);
9200   environment()->SetExpressionStackAt(receiver_index, receiver);
9201
9202   // Call must not be on the stack from now on.
9203   int call_index = args_length + 1;
9204   environment()->RemoveExpressionStackAt(call_index);
9205
9206   HandleIndirectCall(expr, function, args_length);
9207 }
9208
9209
9210 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
9211                                                     Handle<JSFunction> target) {
9212   SharedFunctionInfo* shared = target->shared();
9213   if (is_sloppy(shared->language_mode()) && !shared->native()) {
9214     // Cannot embed a direct reference to the global proxy
9215     // as is it dropped on deserialization.
9216     CHECK(!isolate()->serializer_enabled());
9217     Handle<JSObject> global_proxy(target->context()->global_proxy());
9218     return Add<HConstant>(global_proxy);
9219   }
9220   return graph()->GetConstantUndefined();
9221 }
9222
9223
9224 void HOptimizedGraphBuilder::BuildArrayCall(Expression* expression,
9225                                             int arguments_count,
9226                                             HValue* function,
9227                                             Handle<AllocationSite> site) {
9228   Add<HCheckValue>(function, array_function());
9229
9230   if (IsCallArrayInlineable(arguments_count, site)) {
9231     BuildInlinedCallArray(expression, arguments_count, site);
9232     return;
9233   }
9234
9235   HInstruction* call = PreProcessCall(New<HCallNewArray>(
9236       function, arguments_count + 1, site->GetElementsKind(), site));
9237   if (expression->IsCall()) {
9238     Drop(1);
9239   }
9240   ast_context()->ReturnInstruction(call, expression->id());
9241 }
9242
9243
9244 HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
9245                                                   HValue* search_element,
9246                                                   ElementsKind kind,
9247                                                   ArrayIndexOfMode mode) {
9248   DCHECK(IsFastElementsKind(kind));
9249
9250   NoObservableSideEffectsScope no_effects(this);
9251
9252   HValue* elements = AddLoadElements(receiver);
9253   HValue* length = AddLoadArrayLength(receiver, kind);
9254
9255   HValue* initial;
9256   HValue* terminating;
9257   Token::Value token;
9258   LoopBuilder::Direction direction;
9259   if (mode == kFirstIndexOf) {
9260     initial = graph()->GetConstant0();
9261     terminating = length;
9262     token = Token::LT;
9263     direction = LoopBuilder::kPostIncrement;
9264   } else {
9265     DCHECK_EQ(kLastIndexOf, mode);
9266     initial = length;
9267     terminating = graph()->GetConstant0();
9268     token = Token::GT;
9269     direction = LoopBuilder::kPreDecrement;
9270   }
9271
9272   Push(graph()->GetConstantMinus1());
9273   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
9274     // Make sure that we can actually compare numbers correctly below, see
9275     // https://code.google.com/p/chromium/issues/detail?id=407946 for details.
9276     search_element = AddUncasted<HForceRepresentation>(
9277         search_element, IsFastSmiElementsKind(kind) ? Representation::Smi()
9278                                                     : Representation::Double());
9279
9280     LoopBuilder loop(this, context(), direction);
9281     {
9282       HValue* index = loop.BeginBody(initial, terminating, token);
9283       HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr, kind,
9284                                                 ALLOW_RETURN_HOLE);
9285       IfBuilder if_issame(this);
9286       if_issame.If<HCompareNumericAndBranch>(element, search_element,
9287                                              Token::EQ_STRICT);
9288       if_issame.Then();
9289       {
9290         Drop(1);
9291         Push(index);
9292         loop.Break();
9293       }
9294       if_issame.End();
9295     }
9296     loop.EndBody();
9297   } else {
9298     IfBuilder if_isstring(this);
9299     if_isstring.If<HIsStringAndBranch>(search_element);
9300     if_isstring.Then();
9301     {
9302       LoopBuilder loop(this, context(), direction);
9303       {
9304         HValue* index = loop.BeginBody(initial, terminating, token);
9305         HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9306                                                   kind, ALLOW_RETURN_HOLE);
9307         IfBuilder if_issame(this);
9308         if_issame.If<HIsStringAndBranch>(element);
9309         if_issame.AndIf<HStringCompareAndBranch>(
9310             element, search_element, Token::EQ_STRICT);
9311         if_issame.Then();
9312         {
9313           Drop(1);
9314           Push(index);
9315           loop.Break();
9316         }
9317         if_issame.End();
9318       }
9319       loop.EndBody();
9320     }
9321     if_isstring.Else();
9322     {
9323       IfBuilder if_isnumber(this);
9324       if_isnumber.If<HIsSmiAndBranch>(search_element);
9325       if_isnumber.OrIf<HCompareMap>(
9326           search_element, isolate()->factory()->heap_number_map());
9327       if_isnumber.Then();
9328       {
9329         HValue* search_number =
9330             AddUncasted<HForceRepresentation>(search_element,
9331                                               Representation::Double());
9332         LoopBuilder loop(this, context(), direction);
9333         {
9334           HValue* index = loop.BeginBody(initial, terminating, token);
9335           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9336                                                     kind, ALLOW_RETURN_HOLE);
9337
9338           IfBuilder if_element_isnumber(this);
9339           if_element_isnumber.If<HIsSmiAndBranch>(element);
9340           if_element_isnumber.OrIf<HCompareMap>(
9341               element, isolate()->factory()->heap_number_map());
9342           if_element_isnumber.Then();
9343           {
9344             HValue* number =
9345                 AddUncasted<HForceRepresentation>(element,
9346                                                   Representation::Double());
9347             IfBuilder if_issame(this);
9348             if_issame.If<HCompareNumericAndBranch>(
9349                 number, search_number, Token::EQ_STRICT);
9350             if_issame.Then();
9351             {
9352               Drop(1);
9353               Push(index);
9354               loop.Break();
9355             }
9356             if_issame.End();
9357           }
9358           if_element_isnumber.End();
9359         }
9360         loop.EndBody();
9361       }
9362       if_isnumber.Else();
9363       {
9364         LoopBuilder loop(this, context(), direction);
9365         {
9366           HValue* index = loop.BeginBody(initial, terminating, token);
9367           HValue* element = AddUncasted<HLoadKeyed>(elements, index, nullptr,
9368                                                     kind, ALLOW_RETURN_HOLE);
9369           IfBuilder if_issame(this);
9370           if_issame.If<HCompareObjectEqAndBranch>(
9371               element, search_element);
9372           if_issame.Then();
9373           {
9374             Drop(1);
9375             Push(index);
9376             loop.Break();
9377           }
9378           if_issame.End();
9379         }
9380         loop.EndBody();
9381       }
9382       if_isnumber.End();
9383     }
9384     if_isstring.End();
9385   }
9386
9387   return Pop();
9388 }
9389
9390
9391 bool HOptimizedGraphBuilder::TryHandleArrayCall(Call* expr, HValue* function) {
9392   if (!array_function().is_identical_to(expr->target())) {
9393     return false;
9394   }
9395
9396   Handle<AllocationSite> site = expr->allocation_site();
9397   if (site.is_null()) return false;
9398
9399   BuildArrayCall(expr,
9400                  expr->arguments()->length(),
9401                  function,
9402                  site);
9403   return true;
9404 }
9405
9406
9407 bool HOptimizedGraphBuilder::TryHandleArrayCallNew(CallNew* expr,
9408                                                    HValue* function) {
9409   if (!array_function().is_identical_to(expr->target())) {
9410     return false;
9411   }
9412
9413   Handle<AllocationSite> site = expr->allocation_site();
9414   if (site.is_null()) return false;
9415
9416   BuildArrayCall(expr, expr->arguments()->length(), function, site);
9417   return true;
9418 }
9419
9420
9421 bool HOptimizedGraphBuilder::CanBeFunctionApplyArguments(Call* expr) {
9422   ZoneList<Expression*>* args = expr->arguments();
9423   if (args->length() != 2) return false;
9424   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
9425   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
9426   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
9427   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
9428   return true;
9429 }
9430
9431
9432 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
9433   DCHECK(!HasStackOverflow());
9434   DCHECK(current_block() != NULL);
9435   DCHECK(current_block()->HasPredecessor());
9436   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9437   Expression* callee = expr->expression();
9438   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
9439   HInstruction* call = NULL;
9440
9441   Property* prop = callee->AsProperty();
9442   if (prop != NULL) {
9443     CHECK_ALIVE(VisitForValue(prop->obj()));
9444     HValue* receiver = Top();
9445
9446     SmallMapList* maps;
9447     ComputeReceiverTypes(expr, receiver, &maps, zone());
9448
9449     if (prop->key()->IsPropertyName() && maps->length() > 0) {
9450       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
9451       PropertyAccessInfo info(this, LOAD, maps->first(), name);
9452       if (!info.CanAccessAsMonomorphic(maps)) {
9453         HandlePolymorphicCallNamed(expr, receiver, maps, name);
9454         return;
9455       }
9456     }
9457     HValue* key = NULL;
9458     if (!prop->key()->IsPropertyName()) {
9459       CHECK_ALIVE(VisitForValue(prop->key()));
9460       key = Pop();
9461     }
9462
9463     CHECK_ALIVE(PushLoad(prop, receiver, key));
9464     HValue* function = Pop();
9465
9466     if (function->IsConstant() &&
9467         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9468       // Push the function under the receiver.
9469       environment()->SetExpressionStackAt(0, function);
9470       Push(receiver);
9471
9472       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
9473           HConstant::cast(function)->handle(isolate()));
9474       expr->set_target(known_function);
9475
9476       if (TryIndirectCall(expr)) return;
9477       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9478
9479       Handle<Map> map = maps->length() == 1 ? maps->first() : Handle<Map>();
9480       if (TryInlineBuiltinMethodCall(expr, known_function, map,
9481                                      expr->arguments()->length())) {
9482         if (FLAG_trace_inlining) {
9483           PrintF("Inlining builtin ");
9484           known_function->ShortPrint();
9485           PrintF("\n");
9486         }
9487         return;
9488       }
9489       if (TryInlineApiMethodCall(expr, receiver, maps)) return;
9490
9491       // Wrap the receiver if necessary.
9492       if (NeedsWrapping(maps->first(), known_function)) {
9493         // Since HWrapReceiver currently cannot actually wrap numbers and
9494         // strings, use the regular CallFunctionStub for method calls to wrap
9495         // the receiver.
9496         // TODO(verwaest): Support creation of value wrappers directly in
9497         // HWrapReceiver.
9498         call = New<HCallFunction>(
9499             function, argument_count, WRAP_AND_CALL);
9500       } else if (TryInlineCall(expr)) {
9501         return;
9502       } else {
9503         call = BuildCallConstantFunction(known_function, argument_count);
9504       }
9505
9506     } else {
9507       ArgumentsAllowedFlag arguments_flag = ARGUMENTS_NOT_ALLOWED;
9508       if (CanBeFunctionApplyArguments(expr) && expr->is_uninitialized()) {
9509         // We have to use EAGER deoptimization here because Deoptimizer::SOFT
9510         // gets ignored by the always-opt flag, which leads to incorrect code.
9511         Add<HDeoptimize>(
9512             Deoptimizer::kInsufficientTypeFeedbackForCallWithArguments,
9513             Deoptimizer::EAGER);
9514         arguments_flag = ARGUMENTS_FAKED;
9515       }
9516
9517       // Push the function under the receiver.
9518       environment()->SetExpressionStackAt(0, function);
9519       Push(receiver);
9520
9521       CHECK_ALIVE(VisitExpressions(expr->arguments(), arguments_flag));
9522       CallFunctionFlags flags = receiver->type().IsJSObject()
9523           ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
9524       call = New<HCallFunction>(function, argument_count, flags);
9525     }
9526     PushArgumentsFromEnvironment(argument_count);
9527
9528   } else {
9529     VariableProxy* proxy = expr->expression()->AsVariableProxy();
9530     if (proxy != NULL && proxy->var()->is_possibly_eval(isolate())) {
9531       return Bailout(kPossibleDirectCallToEval);
9532     }
9533
9534     // The function is on the stack in the unoptimized code during
9535     // evaluation of the arguments.
9536     CHECK_ALIVE(VisitForValue(expr->expression()));
9537     HValue* function = Top();
9538     if (function->IsConstant() &&
9539         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9540       Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9541       Handle<JSFunction> target = Handle<JSFunction>::cast(constant);
9542       expr->SetKnownGlobalTarget(target);
9543     }
9544
9545     // Placeholder for the receiver.
9546     Push(graph()->GetConstantUndefined());
9547     CHECK_ALIVE(VisitExpressions(expr->arguments()));
9548
9549     if (expr->IsMonomorphic()) {
9550       Add<HCheckValue>(function, expr->target());
9551
9552       // Patch the global object on the stack by the expected receiver.
9553       HValue* receiver = ImplicitReceiverFor(function, expr->target());
9554       const int receiver_index = argument_count - 1;
9555       environment()->SetExpressionStackAt(receiver_index, receiver);
9556
9557       if (TryInlineBuiltinFunctionCall(expr)) {
9558         if (FLAG_trace_inlining) {
9559           PrintF("Inlining builtin ");
9560           expr->target()->ShortPrint();
9561           PrintF("\n");
9562         }
9563         return;
9564       }
9565       if (TryInlineApiFunctionCall(expr, receiver)) return;
9566       if (TryHandleArrayCall(expr, function)) return;
9567       if (TryInlineCall(expr)) return;
9568
9569       PushArgumentsFromEnvironment(argument_count);
9570       call = BuildCallConstantFunction(expr->target(), argument_count);
9571     } else {
9572       PushArgumentsFromEnvironment(argument_count);
9573       HCallFunction* call_function =
9574           New<HCallFunction>(function, argument_count);
9575       call = call_function;
9576       if (expr->is_uninitialized() &&
9577           expr->IsUsingCallFeedbackICSlot(isolate())) {
9578         // We've never seen this call before, so let's have Crankshaft learn
9579         // through the type vector.
9580         Handle<TypeFeedbackVector> vector =
9581             handle(current_feedback_vector(), isolate());
9582         FeedbackVectorICSlot slot = expr->CallFeedbackICSlot();
9583         call_function->SetVectorAndSlot(vector, slot);
9584       }
9585     }
9586   }
9587
9588   Drop(1);  // Drop the function.
9589   return ast_context()->ReturnInstruction(call, expr->id());
9590 }
9591
9592
9593 void HOptimizedGraphBuilder::BuildInlinedCallArray(
9594     Expression* expression,
9595     int argument_count,
9596     Handle<AllocationSite> site) {
9597   DCHECK(!site.is_null());
9598   DCHECK(argument_count >= 0 && argument_count <= 1);
9599   NoObservableSideEffectsScope no_effects(this);
9600
9601   // We should at least have the constructor on the expression stack.
9602   HValue* constructor = environment()->ExpressionStackAt(argument_count);
9603
9604   // Register on the site for deoptimization if the transition feedback changes.
9605   top_info()->dependencies()->AssumeTransitionStable(site);
9606   ElementsKind kind = site->GetElementsKind();
9607   HInstruction* site_instruction = Add<HConstant>(site);
9608
9609   // In the single constant argument case, we may have to adjust elements kind
9610   // to avoid creating a packed non-empty array.
9611   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
9612     HValue* argument = environment()->Top();
9613     if (argument->IsConstant()) {
9614       HConstant* constant_argument = HConstant::cast(argument);
9615       DCHECK(constant_argument->HasSmiValue());
9616       int constant_array_size = constant_argument->Integer32Value();
9617       if (constant_array_size != 0) {
9618         kind = GetHoleyElementsKind(kind);
9619       }
9620     }
9621   }
9622
9623   // Build the array.
9624   JSArrayBuilder array_builder(this,
9625                                kind,
9626                                site_instruction,
9627                                constructor,
9628                                DISABLE_ALLOCATION_SITES);
9629   HValue* new_object = argument_count == 0
9630       ? array_builder.AllocateEmptyArray()
9631       : BuildAllocateArrayFromLength(&array_builder, Top());
9632
9633   int args_to_drop = argument_count + (expression->IsCall() ? 2 : 1);
9634   Drop(args_to_drop);
9635   ast_context()->ReturnValue(new_object);
9636 }
9637
9638
9639 // Checks whether allocation using the given constructor can be inlined.
9640 static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
9641   return constructor->has_initial_map() &&
9642          constructor->initial_map()->instance_type() == JS_OBJECT_TYPE &&
9643          constructor->initial_map()->instance_size() <
9644              HAllocate::kMaxInlineSize;
9645 }
9646
9647
9648 bool HOptimizedGraphBuilder::IsCallArrayInlineable(
9649     int argument_count,
9650     Handle<AllocationSite> site) {
9651   Handle<JSFunction> caller = current_info()->closure();
9652   Handle<JSFunction> target = array_function();
9653   // We should have the function plus array arguments on the environment stack.
9654   DCHECK(environment()->length() >= (argument_count + 1));
9655   DCHECK(!site.is_null());
9656
9657   bool inline_ok = false;
9658   if (site->CanInlineCall()) {
9659     // We also want to avoid inlining in certain 1 argument scenarios.
9660     if (argument_count == 1) {
9661       HValue* argument = Top();
9662       if (argument->IsConstant()) {
9663         // Do not inline if the constant length argument is not a smi or
9664         // outside the valid range for unrolled loop initialization.
9665         HConstant* constant_argument = HConstant::cast(argument);
9666         if (constant_argument->HasSmiValue()) {
9667           int value = constant_argument->Integer32Value();
9668           inline_ok = value >= 0 && value <= kElementLoopUnrollThreshold;
9669           if (!inline_ok) {
9670             TraceInline(target, caller,
9671                         "Constant length outside of valid inlining range.");
9672           }
9673         }
9674       } else {
9675         TraceInline(target, caller,
9676                     "Dont inline [new] Array(n) where n isn't constant.");
9677       }
9678     } else if (argument_count == 0) {
9679       inline_ok = true;
9680     } else {
9681       TraceInline(target, caller, "Too many arguments to inline.");
9682     }
9683   } else {
9684     TraceInline(target, caller, "AllocationSite requested no inlining.");
9685   }
9686
9687   if (inline_ok) {
9688     TraceInline(target, caller, NULL);
9689   }
9690   return inline_ok;
9691 }
9692
9693
9694 void HOptimizedGraphBuilder::VisitCallNew(CallNew* expr) {
9695   DCHECK(!HasStackOverflow());
9696   DCHECK(current_block() != NULL);
9697   DCHECK(current_block()->HasPredecessor());
9698   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
9699   int argument_count = expr->arguments()->length() + 1;  // Plus constructor.
9700   Factory* factory = isolate()->factory();
9701
9702   // The constructor function is on the stack in the unoptimized code
9703   // during evaluation of the arguments.
9704   CHECK_ALIVE(VisitForValue(expr->expression()));
9705   HValue* function = Top();
9706   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9707
9708   if (function->IsConstant() &&
9709       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9710     Handle<Object> constant = HConstant::cast(function)->handle(isolate());
9711     expr->SetKnownGlobalTarget(Handle<JSFunction>::cast(constant));
9712   }
9713
9714   if (FLAG_inline_construct &&
9715       expr->IsMonomorphic() &&
9716       IsAllocationInlineable(expr->target())) {
9717     Handle<JSFunction> constructor = expr->target();
9718     HValue* check = Add<HCheckValue>(function, constructor);
9719
9720     // Force completion of inobject slack tracking before generating
9721     // allocation code to finalize instance size.
9722     if (constructor->IsInobjectSlackTrackingInProgress()) {
9723       constructor->CompleteInobjectSlackTracking();
9724     }
9725
9726     // Calculate instance size from initial map of constructor.
9727     DCHECK(constructor->has_initial_map());
9728     Handle<Map> initial_map(constructor->initial_map());
9729     int instance_size = initial_map->instance_size();
9730
9731     // Allocate an instance of the implicit receiver object.
9732     HValue* size_in_bytes = Add<HConstant>(instance_size);
9733     HAllocationMode allocation_mode;
9734     if (FLAG_pretenuring_call_new) {
9735       if (FLAG_allocation_site_pretenuring) {
9736         // Try to use pretenuring feedback.
9737         Handle<AllocationSite> allocation_site = expr->allocation_site();
9738         allocation_mode = HAllocationMode(allocation_site);
9739         // Take a dependency on allocation site.
9740         top_info()->dependencies()->AssumeTenuringDecision(allocation_site);
9741       }
9742     }
9743
9744     HAllocate* receiver = BuildAllocate(
9745         size_in_bytes, HType::JSObject(), JS_OBJECT_TYPE, allocation_mode);
9746     receiver->set_known_initial_map(initial_map);
9747
9748     // Initialize map and fields of the newly allocated object.
9749     { NoObservableSideEffectsScope no_effects(this);
9750       DCHECK(initial_map->instance_type() == JS_OBJECT_TYPE);
9751       Add<HStoreNamedField>(receiver,
9752           HObjectAccess::ForMapAndOffset(initial_map, JSObject::kMapOffset),
9753           Add<HConstant>(initial_map));
9754       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
9755       Add<HStoreNamedField>(receiver,
9756           HObjectAccess::ForMapAndOffset(initial_map,
9757                                          JSObject::kPropertiesOffset),
9758           empty_fixed_array);
9759       Add<HStoreNamedField>(receiver,
9760           HObjectAccess::ForMapAndOffset(initial_map,
9761                                          JSObject::kElementsOffset),
9762           empty_fixed_array);
9763       BuildInitializeInobjectProperties(receiver, initial_map);
9764     }
9765
9766     // Replace the constructor function with a newly allocated receiver using
9767     // the index of the receiver from the top of the expression stack.
9768     const int receiver_index = argument_count - 1;
9769     DCHECK(environment()->ExpressionStackAt(receiver_index) == function);
9770     environment()->SetExpressionStackAt(receiver_index, receiver);
9771
9772     if (TryInlineConstruct(expr, receiver)) {
9773       // Inlining worked, add a dependency on the initial map to make sure that
9774       // this code is deoptimized whenever the initial map of the constructor
9775       // changes.
9776       top_info()->dependencies()->AssumeInitialMapCantChange(initial_map);
9777       return;
9778     }
9779
9780     // TODO(mstarzinger): For now we remove the previous HAllocate and all
9781     // corresponding instructions and instead add HPushArguments for the
9782     // arguments in case inlining failed.  What we actually should do is for
9783     // inlining to try to build a subgraph without mutating the parent graph.
9784     HInstruction* instr = current_block()->last();
9785     do {
9786       HInstruction* prev_instr = instr->previous();
9787       instr->DeleteAndReplaceWith(NULL);
9788       instr = prev_instr;
9789     } while (instr != check);
9790     environment()->SetExpressionStackAt(receiver_index, function);
9791     HInstruction* call =
9792       PreProcessCall(New<HCallNew>(function, argument_count));
9793     return ast_context()->ReturnInstruction(call, expr->id());
9794   } else {
9795     // The constructor function is both an operand to the instruction and an
9796     // argument to the construct call.
9797     if (TryHandleArrayCallNew(expr, function)) return;
9798
9799     HInstruction* call =
9800         PreProcessCall(New<HCallNew>(function, argument_count));
9801     return ast_context()->ReturnInstruction(call, expr->id());
9802   }
9803 }
9804
9805
9806 void HOptimizedGraphBuilder::BuildInitializeInobjectProperties(
9807     HValue* receiver, Handle<Map> initial_map) {
9808   if (initial_map->inobject_properties() != 0) {
9809     HConstant* undefined = graph()->GetConstantUndefined();
9810     for (int i = 0; i < initial_map->inobject_properties(); i++) {
9811       int property_offset = initial_map->GetInObjectPropertyOffset(i);
9812       Add<HStoreNamedField>(receiver, HObjectAccess::ForMapAndOffset(
9813                                           initial_map, property_offset),
9814                             undefined);
9815     }
9816   }
9817 }
9818
9819
9820 HValue* HGraphBuilder::BuildAllocateEmptyArrayBuffer(HValue* byte_length) {
9821   // We HForceRepresentation here to avoid allocations during an *-to-tagged
9822   // HChange that could cause GC while the array buffer object is not fully
9823   // initialized.
9824   HObjectAccess byte_length_access(HObjectAccess::ForJSArrayBufferByteLength());
9825   byte_length = AddUncasted<HForceRepresentation>(
9826       byte_length, byte_length_access.representation());
9827   HAllocate* result =
9828       BuildAllocate(Add<HConstant>(JSArrayBuffer::kSizeWithInternalFields),
9829                     HType::JSObject(), JS_ARRAY_BUFFER_TYPE, HAllocationMode());
9830
9831   HValue* global_object = Add<HLoadNamedField>(
9832       context(), nullptr,
9833       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
9834   HValue* native_context = Add<HLoadNamedField>(
9835       global_object, nullptr, HObjectAccess::ForGlobalObjectNativeContext());
9836   Add<HStoreNamedField>(
9837       result, HObjectAccess::ForMap(),
9838       Add<HLoadNamedField>(
9839           native_context, nullptr,
9840           HObjectAccess::ForContextSlot(Context::ARRAY_BUFFER_MAP_INDEX)));
9841
9842   HConstant* empty_fixed_array =
9843       Add<HConstant>(isolate()->factory()->empty_fixed_array());
9844   Add<HStoreNamedField>(
9845       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
9846       empty_fixed_array);
9847   Add<HStoreNamedField>(
9848       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
9849       empty_fixed_array);
9850   Add<HStoreNamedField>(
9851       result, HObjectAccess::ForJSArrayBufferBackingStore().WithRepresentation(
9852                   Representation::Smi()),
9853       graph()->GetConstant0());
9854   Add<HStoreNamedField>(result, byte_length_access, byte_length);
9855   Add<HStoreNamedField>(result, HObjectAccess::ForJSArrayBufferBitFieldSlot(),
9856                         graph()->GetConstant0());
9857   Add<HStoreNamedField>(
9858       result, HObjectAccess::ForJSArrayBufferBitField(),
9859       Add<HConstant>((1 << JSArrayBuffer::IsExternal::kShift) |
9860                      (1 << JSArrayBuffer::IsNeuterable::kShift)));
9861
9862   for (int field = 0; field < v8::ArrayBuffer::kInternalFieldCount; ++field) {
9863     Add<HStoreNamedField>(
9864         result,
9865         HObjectAccess::ForObservableJSObjectOffset(
9866             JSArrayBuffer::kSize + field * kPointerSize, Representation::Smi()),
9867         graph()->GetConstant0());
9868   }
9869
9870   return result;
9871 }
9872
9873
9874 template <class ViewClass>
9875 void HGraphBuilder::BuildArrayBufferViewInitialization(
9876     HValue* obj,
9877     HValue* buffer,
9878     HValue* byte_offset,
9879     HValue* byte_length) {
9880
9881   for (int offset = ViewClass::kSize;
9882        offset < ViewClass::kSizeWithInternalFields;
9883        offset += kPointerSize) {
9884     Add<HStoreNamedField>(obj,
9885         HObjectAccess::ForObservableJSObjectOffset(offset),
9886         graph()->GetConstant0());
9887   }
9888
9889   Add<HStoreNamedField>(
9890       obj,
9891       HObjectAccess::ForJSArrayBufferViewByteOffset(),
9892       byte_offset);
9893   Add<HStoreNamedField>(
9894       obj,
9895       HObjectAccess::ForJSArrayBufferViewByteLength(),
9896       byte_length);
9897   Add<HStoreNamedField>(obj, HObjectAccess::ForJSArrayBufferViewBuffer(),
9898                         buffer);
9899 }
9900
9901
9902 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
9903     CallRuntime* expr) {
9904   ZoneList<Expression*>* arguments = expr->arguments();
9905
9906   DCHECK(arguments->length()== 4);
9907   CHECK_ALIVE(VisitForValue(arguments->at(0)));
9908   HValue* obj = Pop();
9909
9910   CHECK_ALIVE(VisitForValue(arguments->at(1)));
9911   HValue* buffer = Pop();
9912
9913   CHECK_ALIVE(VisitForValue(arguments->at(2)));
9914   HValue* byte_offset = Pop();
9915
9916   CHECK_ALIVE(VisitForValue(arguments->at(3)));
9917   HValue* byte_length = Pop();
9918
9919   {
9920     NoObservableSideEffectsScope scope(this);
9921     BuildArrayBufferViewInitialization<JSDataView>(
9922         obj, buffer, byte_offset, byte_length);
9923   }
9924 }
9925
9926
9927 static Handle<Map> TypedArrayMap(Isolate* isolate,
9928                                  ExternalArrayType array_type,
9929                                  ElementsKind target_kind) {
9930   Handle<Context> native_context = isolate->native_context();
9931   Handle<JSFunction> fun;
9932   switch (array_type) {
9933 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
9934     case kExternal##Type##Array:                                              \
9935       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
9936       break;
9937
9938     TYPED_ARRAYS(TYPED_ARRAY_CASE)
9939 #undef TYPED_ARRAY_CASE
9940   }
9941   Handle<Map> map(fun->initial_map());
9942   return Map::AsElementsKind(map, target_kind);
9943 }
9944
9945
9946 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
9947     ExternalArrayType array_type,
9948     bool is_zero_byte_offset,
9949     HValue* buffer, HValue* byte_offset, HValue* length) {
9950   Handle<Map> external_array_map(
9951       isolate()->heap()->MapForExternalArrayType(array_type));
9952
9953   // The HForceRepresentation is to prevent possible deopt on int-smi
9954   // conversion after allocation but before the new object fields are set.
9955   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
9956   HValue* elements =
9957       Add<HAllocate>(Add<HConstant>(ExternalArray::kSize), HType::HeapObject(),
9958                      NOT_TENURED, external_array_map->instance_type());
9959
9960   AddStoreMapConstant(elements, external_array_map);
9961   Add<HStoreNamedField>(elements,
9962       HObjectAccess::ForFixedArrayLength(), length);
9963
9964   HValue* backing_store = Add<HLoadNamedField>(
9965       buffer, nullptr, HObjectAccess::ForJSArrayBufferBackingStore());
9966
9967   HValue* typed_array_start;
9968   if (is_zero_byte_offset) {
9969     typed_array_start = backing_store;
9970   } else {
9971     HInstruction* external_pointer =
9972         AddUncasted<HAdd>(backing_store, byte_offset);
9973     // Arguments are checked prior to call to TypedArrayInitialize,
9974     // including byte_offset.
9975     external_pointer->ClearFlag(HValue::kCanOverflow);
9976     typed_array_start = external_pointer;
9977   }
9978
9979   Add<HStoreNamedField>(elements,
9980       HObjectAccess::ForExternalArrayExternalPointer(),
9981       typed_array_start);
9982
9983   return elements;
9984 }
9985
9986
9987 HValue* HOptimizedGraphBuilder::BuildAllocateFixedTypedArray(
9988     ExternalArrayType array_type, size_t element_size,
9989     ElementsKind fixed_elements_kind, HValue* byte_length, HValue* length,
9990     bool initialize) {
9991   STATIC_ASSERT(
9992       (FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask) == 0);
9993   HValue* total_size;
9994
9995   // if fixed array's elements are not aligned to object's alignment,
9996   // we need to align the whole array to object alignment.
9997   if (element_size % kObjectAlignment != 0) {
9998     total_size = BuildObjectSizeAlignment(
9999         byte_length, FixedTypedArrayBase::kHeaderSize);
10000   } else {
10001     total_size = AddUncasted<HAdd>(byte_length,
10002         Add<HConstant>(FixedTypedArrayBase::kHeaderSize));
10003     total_size->ClearFlag(HValue::kCanOverflow);
10004   }
10005
10006   // The HForceRepresentation is to prevent possible deopt on int-smi
10007   // conversion after allocation but before the new object fields are set.
10008   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
10009   Handle<Map> fixed_typed_array_map(
10010       isolate()->heap()->MapForFixedTypedArray(array_type));
10011   HAllocate* elements =
10012       Add<HAllocate>(total_size, HType::HeapObject(), NOT_TENURED,
10013                      fixed_typed_array_map->instance_type());
10014
10015 #ifndef V8_HOST_ARCH_64_BIT
10016   if (array_type == kExternalFloat64Array) {
10017     elements->MakeDoubleAligned();
10018   }
10019 #endif
10020
10021   AddStoreMapConstant(elements, fixed_typed_array_map);
10022
10023   Add<HStoreNamedField>(elements,
10024       HObjectAccess::ForFixedArrayLength(),
10025       length);
10026   Add<HStoreNamedField>(
10027       elements, HObjectAccess::ForFixedTypedArrayBaseBasePointer(), elements);
10028
10029   Add<HStoreNamedField>(
10030       elements, HObjectAccess::ForFixedTypedArrayBaseExternalPointer(),
10031       Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()));
10032
10033   HValue* filler = Add<HConstant>(static_cast<int32_t>(0));
10034
10035   if (initialize) {
10036     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
10037
10038     HValue* backing_store = AddUncasted<HAdd>(
10039         Add<HConstant>(ExternalReference::fixed_typed_array_base_data_offset()),
10040         elements, Strength::WEAK, AddOfExternalAndTagged);
10041
10042     HValue* key = builder.BeginBody(
10043         Add<HConstant>(static_cast<int32_t>(0)),
10044         length, Token::LT);
10045     Add<HStoreKeyed>(backing_store, key, filler, fixed_elements_kind);
10046
10047     builder.EndBody();
10048   }
10049   return elements;
10050 }
10051
10052
10053 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
10054     CallRuntime* expr) {
10055   ZoneList<Expression*>* arguments = expr->arguments();
10056
10057   static const int kObjectArg = 0;
10058   static const int kArrayIdArg = 1;
10059   static const int kBufferArg = 2;
10060   static const int kByteOffsetArg = 3;
10061   static const int kByteLengthArg = 4;
10062   static const int kInitializeArg = 5;
10063   static const int kArgsLength = 6;
10064   DCHECK(arguments->length() == kArgsLength);
10065
10066
10067   CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
10068   HValue* obj = Pop();
10069
10070   if (!arguments->at(kArrayIdArg)->IsLiteral()) {
10071     // This should never happen in real use, but can happen when fuzzing.
10072     // Just bail out.
10073     Bailout(kNeedSmiLiteral);
10074     return;
10075   }
10076   Handle<Object> value =
10077       static_cast<Literal*>(arguments->at(kArrayIdArg))->value();
10078   if (!value->IsSmi()) {
10079     // This should never happen in real use, but can happen when fuzzing.
10080     // Just bail out.
10081     Bailout(kNeedSmiLiteral);
10082     return;
10083   }
10084   int array_id = Smi::cast(*value)->value();
10085
10086   HValue* buffer;
10087   if (!arguments->at(kBufferArg)->IsNullLiteral()) {
10088     CHECK_ALIVE(VisitForValue(arguments->at(kBufferArg)));
10089     buffer = Pop();
10090   } else {
10091     buffer = NULL;
10092   }
10093
10094   HValue* byte_offset;
10095   bool is_zero_byte_offset;
10096
10097   if (arguments->at(kByteOffsetArg)->IsLiteral()
10098       && Smi::FromInt(0) ==
10099       *static_cast<Literal*>(arguments->at(kByteOffsetArg))->value()) {
10100     byte_offset = Add<HConstant>(static_cast<int32_t>(0));
10101     is_zero_byte_offset = true;
10102   } else {
10103     CHECK_ALIVE(VisitForValue(arguments->at(kByteOffsetArg)));
10104     byte_offset = Pop();
10105     is_zero_byte_offset = false;
10106     DCHECK(buffer != NULL);
10107   }
10108
10109   CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
10110   HValue* byte_length = Pop();
10111
10112   CHECK(arguments->at(kInitializeArg)->IsLiteral());
10113   bool initialize = static_cast<Literal*>(arguments->at(kInitializeArg))
10114                         ->value()
10115                         ->BooleanValue();
10116
10117   NoObservableSideEffectsScope scope(this);
10118   IfBuilder byte_offset_smi(this);
10119
10120   if (!is_zero_byte_offset) {
10121     byte_offset_smi.If<HIsSmiAndBranch>(byte_offset);
10122     byte_offset_smi.Then();
10123   }
10124
10125   ExternalArrayType array_type =
10126       kExternalInt8Array;  // Bogus initialization.
10127   size_t element_size = 1;  // Bogus initialization.
10128   ElementsKind external_elements_kind =  // Bogus initialization.
10129       EXTERNAL_INT8_ELEMENTS;
10130   ElementsKind fixed_elements_kind =  // Bogus initialization.
10131       INT8_ELEMENTS;
10132   Runtime::ArrayIdToTypeAndSize(array_id,
10133       &array_type,
10134       &external_elements_kind,
10135       &fixed_elements_kind,
10136       &element_size);
10137
10138
10139   { //  byte_offset is Smi.
10140     HValue* allocated_buffer = buffer;
10141     if (buffer == NULL) {
10142       allocated_buffer = BuildAllocateEmptyArrayBuffer(byte_length);
10143     }
10144     BuildArrayBufferViewInitialization<JSTypedArray>(obj, allocated_buffer,
10145                                                      byte_offset, byte_length);
10146
10147
10148     HInstruction* length = AddUncasted<HDiv>(byte_length,
10149         Add<HConstant>(static_cast<int32_t>(element_size)));
10150
10151     Add<HStoreNamedField>(obj,
10152         HObjectAccess::ForJSTypedArrayLength(),
10153         length);
10154
10155     HValue* elements;
10156     if (buffer != NULL) {
10157       elements = BuildAllocateExternalElements(
10158           array_type, is_zero_byte_offset, buffer, byte_offset, length);
10159       Handle<Map> obj_map = TypedArrayMap(
10160           isolate(), array_type, external_elements_kind);
10161       AddStoreMapConstant(obj, obj_map);
10162     } else {
10163       DCHECK(is_zero_byte_offset);
10164       elements = BuildAllocateFixedTypedArray(array_type, element_size,
10165                                               fixed_elements_kind, byte_length,
10166                                               length, initialize);
10167     }
10168     Add<HStoreNamedField>(
10169         obj, HObjectAccess::ForElementsPointer(), elements);
10170   }
10171
10172   if (!is_zero_byte_offset) {
10173     byte_offset_smi.Else();
10174     { //  byte_offset is not Smi.
10175       Push(obj);
10176       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
10177       Push(buffer);
10178       Push(byte_offset);
10179       Push(byte_length);
10180       CHECK_ALIVE(VisitForValue(arguments->at(kInitializeArg)));
10181       PushArgumentsFromEnvironment(kArgsLength);
10182       Add<HCallRuntime>(expr->name(), expr->function(), kArgsLength);
10183     }
10184   }
10185   byte_offset_smi.End();
10186 }
10187
10188
10189 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
10190   DCHECK(expr->arguments()->length() == 0);
10191   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
10192   return ast_context()->ReturnInstruction(max_smi, expr->id());
10193 }
10194
10195
10196 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
10197     CallRuntime* expr) {
10198   DCHECK(expr->arguments()->length() == 0);
10199   HConstant* result = New<HConstant>(static_cast<int32_t>(
10200         FLAG_typed_array_max_size_in_heap));
10201   return ast_context()->ReturnInstruction(result, expr->id());
10202 }
10203
10204
10205 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
10206     CallRuntime* expr) {
10207   DCHECK(expr->arguments()->length() == 1);
10208   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10209   HValue* buffer = Pop();
10210   HInstruction* result = New<HLoadNamedField>(
10211       buffer, nullptr, HObjectAccess::ForJSArrayBufferByteLength());
10212   return ast_context()->ReturnInstruction(result, expr->id());
10213 }
10214
10215
10216 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
10217     CallRuntime* expr) {
10218   NoObservableSideEffectsScope scope(this);
10219   DCHECK(expr->arguments()->length() == 1);
10220   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10221   HValue* view = Pop();
10222
10223   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10224       view, nullptr,
10225       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteLengthOffset)));
10226 }
10227
10228
10229 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
10230     CallRuntime* expr) {
10231   NoObservableSideEffectsScope scope(this);
10232   DCHECK(expr->arguments()->length() == 1);
10233   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10234   HValue* view = Pop();
10235
10236   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10237       view, nullptr,
10238       FieldIndex::ForInObjectOffset(JSArrayBufferView::kByteOffsetOffset)));
10239 }
10240
10241
10242 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
10243     CallRuntime* expr) {
10244   NoObservableSideEffectsScope scope(this);
10245   DCHECK(expr->arguments()->length() == 1);
10246   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
10247   HValue* view = Pop();
10248
10249   return ast_context()->ReturnValue(BuildArrayBufferViewFieldAccessor(
10250       view, nullptr,
10251       FieldIndex::ForInObjectOffset(JSTypedArray::kLengthOffset)));
10252 }
10253
10254
10255 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
10256   DCHECK(!HasStackOverflow());
10257   DCHECK(current_block() != NULL);
10258   DCHECK(current_block()->HasPredecessor());
10259   if (expr->is_jsruntime()) {
10260     return Bailout(kCallToAJavaScriptRuntimeFunction);
10261   }
10262
10263   const Runtime::Function* function = expr->function();
10264   DCHECK(function != NULL);
10265   switch (function->function_id) {
10266 #define CALL_INTRINSIC_GENERATOR(Name) \
10267   case Runtime::kInline##Name:         \
10268     return Generate##Name(expr);
10269
10270     FOR_EACH_HYDROGEN_INTRINSIC(CALL_INTRINSIC_GENERATOR)
10271 #undef CALL_INTRINSIC_GENERATOR
10272     default: {
10273       Handle<String> name = expr->name();
10274       int argument_count = expr->arguments()->length();
10275       CHECK_ALIVE(VisitExpressions(expr->arguments()));
10276       PushArgumentsFromEnvironment(argument_count);
10277       HCallRuntime* call = New<HCallRuntime>(name, function, argument_count);
10278       return ast_context()->ReturnInstruction(call, expr->id());
10279     }
10280   }
10281 }
10282
10283
10284 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
10285   DCHECK(!HasStackOverflow());
10286   DCHECK(current_block() != NULL);
10287   DCHECK(current_block()->HasPredecessor());
10288   switch (expr->op()) {
10289     case Token::DELETE: return VisitDelete(expr);
10290     case Token::VOID: return VisitVoid(expr);
10291     case Token::TYPEOF: return VisitTypeof(expr);
10292     case Token::NOT: return VisitNot(expr);
10293     default: UNREACHABLE();
10294   }
10295 }
10296
10297
10298 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
10299   Property* prop = expr->expression()->AsProperty();
10300   VariableProxy* proxy = expr->expression()->AsVariableProxy();
10301   if (prop != NULL) {
10302     CHECK_ALIVE(VisitForValue(prop->obj()));
10303     CHECK_ALIVE(VisitForValue(prop->key()));
10304     HValue* key = Pop();
10305     HValue* obj = Pop();
10306     HValue* function = AddLoadJSBuiltin(Builtins::DELETE);
10307     Add<HPushArguments>(obj, key, Add<HConstant>(function_language_mode()));
10308     // TODO(olivf) InvokeFunction produces a check for the parameter count,
10309     // even though we are certain to pass the correct number of arguments here.
10310     HInstruction* instr = New<HInvokeFunction>(function, 3);
10311     return ast_context()->ReturnInstruction(instr, expr->id());
10312   } else if (proxy != NULL) {
10313     Variable* var = proxy->var();
10314     if (var->IsUnallocatedOrGlobalSlot()) {
10315       Bailout(kDeleteWithGlobalVariable);
10316     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
10317       // Result of deleting non-global variables is false.  'this' is not really
10318       // a variable, though we implement it as one.  The subexpression does not
10319       // have side effects.
10320       HValue* value = var->HasThisName(isolate()) ? graph()->GetConstantTrue()
10321                                                   : graph()->GetConstantFalse();
10322       return ast_context()->ReturnValue(value);
10323     } else {
10324       Bailout(kDeleteWithNonGlobalVariable);
10325     }
10326   } else {
10327     // Result of deleting non-property, non-variable reference is true.
10328     // Evaluate the subexpression for side effects.
10329     CHECK_ALIVE(VisitForEffect(expr->expression()));
10330     return ast_context()->ReturnValue(graph()->GetConstantTrue());
10331   }
10332 }
10333
10334
10335 void HOptimizedGraphBuilder::VisitVoid(UnaryOperation* expr) {
10336   CHECK_ALIVE(VisitForEffect(expr->expression()));
10337   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
10338 }
10339
10340
10341 void HOptimizedGraphBuilder::VisitTypeof(UnaryOperation* expr) {
10342   CHECK_ALIVE(VisitForTypeOf(expr->expression()));
10343   HValue* value = Pop();
10344   HInstruction* instr = New<HTypeof>(value);
10345   return ast_context()->ReturnInstruction(instr, expr->id());
10346 }
10347
10348
10349 void HOptimizedGraphBuilder::VisitNot(UnaryOperation* expr) {
10350   if (ast_context()->IsTest()) {
10351     TestContext* context = TestContext::cast(ast_context());
10352     VisitForControl(expr->expression(),
10353                     context->if_false(),
10354                     context->if_true());
10355     return;
10356   }
10357
10358   if (ast_context()->IsEffect()) {
10359     VisitForEffect(expr->expression());
10360     return;
10361   }
10362
10363   DCHECK(ast_context()->IsValue());
10364   HBasicBlock* materialize_false = graph()->CreateBasicBlock();
10365   HBasicBlock* materialize_true = graph()->CreateBasicBlock();
10366   CHECK_BAILOUT(VisitForControl(expr->expression(),
10367                                 materialize_false,
10368                                 materialize_true));
10369
10370   if (materialize_false->HasPredecessor()) {
10371     materialize_false->SetJoinId(expr->MaterializeFalseId());
10372     set_current_block(materialize_false);
10373     Push(graph()->GetConstantFalse());
10374   } else {
10375     materialize_false = NULL;
10376   }
10377
10378   if (materialize_true->HasPredecessor()) {
10379     materialize_true->SetJoinId(expr->MaterializeTrueId());
10380     set_current_block(materialize_true);
10381     Push(graph()->GetConstantTrue());
10382   } else {
10383     materialize_true = NULL;
10384   }
10385
10386   HBasicBlock* join =
10387     CreateJoin(materialize_false, materialize_true, expr->id());
10388   set_current_block(join);
10389   if (join != NULL) return ast_context()->ReturnValue(Pop());
10390 }
10391
10392
10393 static Representation RepresentationFor(Type* type) {
10394   DisallowHeapAllocation no_allocation;
10395   if (type->Is(Type::None())) return Representation::None();
10396   if (type->Is(Type::SignedSmall())) return Representation::Smi();
10397   if (type->Is(Type::Signed32())) return Representation::Integer32();
10398   if (type->Is(Type::Number())) return Representation::Double();
10399   return Representation::Tagged();
10400 }
10401
10402
10403 HInstruction* HOptimizedGraphBuilder::BuildIncrement(
10404     bool returns_original_input,
10405     CountOperation* expr) {
10406   // The input to the count operation is on top of the expression stack.
10407   Representation rep = RepresentationFor(expr->type());
10408   if (rep.IsNone() || rep.IsTagged()) {
10409     rep = Representation::Smi();
10410   }
10411
10412   if (returns_original_input && !is_strong(function_language_mode())) {
10413     // We need an explicit HValue representing ToNumber(input).  The
10414     // actual HChange instruction we need is (sometimes) added in a later
10415     // phase, so it is not available now to be used as an input to HAdd and
10416     // as the return value.
10417     HInstruction* number_input = AddUncasted<HForceRepresentation>(Pop(), rep);
10418     if (!rep.IsDouble()) {
10419       number_input->SetFlag(HInstruction::kFlexibleRepresentation);
10420       number_input->SetFlag(HInstruction::kCannotBeTagged);
10421     }
10422     Push(number_input);
10423   }
10424
10425   // The addition has no side effects, so we do not need
10426   // to simulate the expression stack after this instruction.
10427   // Any later failures deopt to the load of the input or earlier.
10428   HConstant* delta = (expr->op() == Token::INC)
10429       ? graph()->GetConstant1()
10430       : graph()->GetConstantMinus1();
10431   HInstruction* instr =
10432       AddUncasted<HAdd>(Top(), delta, strength(function_language_mode()));
10433   if (instr->IsAdd()) {
10434     HAdd* add = HAdd::cast(instr);
10435     add->set_observed_input_representation(1, rep);
10436     add->set_observed_input_representation(2, Representation::Smi());
10437   }
10438   if (!is_strong(function_language_mode())) {
10439     instr->ClearAllSideEffects();
10440   } else {
10441     Add<HSimulate>(expr->ToNumberId(), REMOVABLE_SIMULATE);
10442   }
10443   instr->SetFlag(HInstruction::kCannotBeTagged);
10444   return instr;
10445 }
10446
10447
10448 void HOptimizedGraphBuilder::BuildStoreForEffect(Expression* expr,
10449                                                  Property* prop,
10450                                                  BailoutId ast_id,
10451                                                  BailoutId return_id,
10452                                                  HValue* object,
10453                                                  HValue* key,
10454                                                  HValue* value) {
10455   EffectContext for_effect(this);
10456   Push(object);
10457   if (key != NULL) Push(key);
10458   Push(value);
10459   BuildStore(expr, prop, ast_id, return_id);
10460 }
10461
10462
10463 void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
10464   DCHECK(!HasStackOverflow());
10465   DCHECK(current_block() != NULL);
10466   DCHECK(current_block()->HasPredecessor());
10467   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
10468   Expression* target = expr->expression();
10469   VariableProxy* proxy = target->AsVariableProxy();
10470   Property* prop = target->AsProperty();
10471   if (proxy == NULL && prop == NULL) {
10472     return Bailout(kInvalidLhsInCountOperation);
10473   }
10474
10475   // Match the full code generator stack by simulating an extra stack
10476   // element for postfix operations in a non-effect context.  The return
10477   // value is ToNumber(input).
10478   bool returns_original_input =
10479       expr->is_postfix() && !ast_context()->IsEffect();
10480   HValue* input = NULL;  // ToNumber(original_input).
10481   HValue* after = NULL;  // The result after incrementing or decrementing.
10482
10483   if (proxy != NULL) {
10484     Variable* var = proxy->var();
10485     if (var->mode() == CONST_LEGACY)  {
10486       return Bailout(kUnsupportedCountOperationWithConst);
10487     }
10488     if (var->mode() == CONST) {
10489       return Bailout(kNonInitializerAssignmentToConst);
10490     }
10491     // Argument of the count operation is a variable, not a property.
10492     DCHECK(prop == NULL);
10493     CHECK_ALIVE(VisitForValue(target));
10494
10495     after = BuildIncrement(returns_original_input, expr);
10496     input = returns_original_input ? Top() : Pop();
10497     Push(after);
10498
10499     switch (var->location()) {
10500       case VariableLocation::GLOBAL:
10501       case VariableLocation::UNALLOCATED:
10502         HandleGlobalVariableAssignment(var,
10503                                        after,
10504                                        expr->AssignmentId());
10505         break;
10506
10507       case VariableLocation::PARAMETER:
10508       case VariableLocation::LOCAL:
10509         BindIfLive(var, after);
10510         break;
10511
10512       case VariableLocation::CONTEXT: {
10513         // Bail out if we try to mutate a parameter value in a function
10514         // using the arguments object.  We do not (yet) correctly handle the
10515         // arguments property of the function.
10516         if (current_info()->scope()->arguments() != NULL) {
10517           // Parameters will rewrite to context slots.  We have no direct
10518           // way to detect that the variable is a parameter so we use a
10519           // linear search of the parameter list.
10520           int count = current_info()->scope()->num_parameters();
10521           for (int i = 0; i < count; ++i) {
10522             if (var == current_info()->scope()->parameter(i)) {
10523               return Bailout(kAssignmentToParameterInArgumentsObject);
10524             }
10525           }
10526         }
10527
10528         HValue* context = BuildContextChainWalk(var);
10529         HStoreContextSlot::Mode mode = IsLexicalVariableMode(var->mode())
10530             ? HStoreContextSlot::kCheckDeoptimize : HStoreContextSlot::kNoCheck;
10531         HStoreContextSlot* instr = Add<HStoreContextSlot>(context, var->index(),
10532                                                           mode, after);
10533         if (instr->HasObservableSideEffects()) {
10534           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
10535         }
10536         break;
10537       }
10538
10539       case VariableLocation::LOOKUP:
10540         return Bailout(kLookupVariableInCountOperation);
10541     }
10542
10543     Drop(returns_original_input ? 2 : 1);
10544     return ast_context()->ReturnValue(expr->is_postfix() ? input : after);
10545   }
10546
10547   // Argument of the count operation is a property.
10548   DCHECK(prop != NULL);
10549   if (returns_original_input) Push(graph()->GetConstantUndefined());
10550
10551   CHECK_ALIVE(VisitForValue(prop->obj()));
10552   HValue* object = Top();
10553
10554   HValue* key = NULL;
10555   if (!prop->key()->IsPropertyName() || prop->IsStringAccess()) {
10556     CHECK_ALIVE(VisitForValue(prop->key()));
10557     key = Top();
10558   }
10559
10560   CHECK_ALIVE(PushLoad(prop, object, key));
10561
10562   after = BuildIncrement(returns_original_input, expr);
10563
10564   if (returns_original_input) {
10565     input = Pop();
10566     // Drop object and key to push it again in the effect context below.
10567     Drop(key == NULL ? 1 : 2);
10568     environment()->SetExpressionStackAt(0, input);
10569     CHECK_ALIVE(BuildStoreForEffect(
10570         expr, prop, expr->id(), expr->AssignmentId(), object, key, after));
10571     return ast_context()->ReturnValue(Pop());
10572   }
10573
10574   environment()->SetExpressionStackAt(0, after);
10575   return BuildStore(expr, prop, expr->id(), expr->AssignmentId());
10576 }
10577
10578
10579 HInstruction* HOptimizedGraphBuilder::BuildStringCharCodeAt(
10580     HValue* string,
10581     HValue* index) {
10582   if (string->IsConstant() && index->IsConstant()) {
10583     HConstant* c_string = HConstant::cast(string);
10584     HConstant* c_index = HConstant::cast(index);
10585     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
10586       int32_t i = c_index->NumberValueAsInteger32();
10587       Handle<String> s = c_string->StringValue();
10588       if (i < 0 || i >= s->length()) {
10589         return New<HConstant>(std::numeric_limits<double>::quiet_NaN());
10590       }
10591       return New<HConstant>(s->Get(i));
10592     }
10593   }
10594   string = BuildCheckString(string);
10595   index = Add<HBoundsCheck>(index, AddLoadStringLength(string));
10596   return New<HStringCharCodeAt>(string, index);
10597 }
10598
10599
10600 // Checks if the given shift amounts have following forms:
10601 // (N1) and (N2) with N1 + N2 = 32; (sa) and (32 - sa).
10602 static bool ShiftAmountsAllowReplaceByRotate(HValue* sa,
10603                                              HValue* const32_minus_sa) {
10604   if (sa->IsConstant() && const32_minus_sa->IsConstant()) {
10605     const HConstant* c1 = HConstant::cast(sa);
10606     const HConstant* c2 = HConstant::cast(const32_minus_sa);
10607     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
10608         (c1->Integer32Value() + c2->Integer32Value() == 32);
10609   }
10610   if (!const32_minus_sa->IsSub()) return false;
10611   HSub* sub = HSub::cast(const32_minus_sa);
10612   return sub->left()->EqualsInteger32Constant(32) && sub->right() == sa;
10613 }
10614
10615
10616 // Checks if the left and the right are shift instructions with the oposite
10617 // directions that can be replaced by one rotate right instruction or not.
10618 // Returns the operand and the shift amount for the rotate instruction in the
10619 // former case.
10620 bool HGraphBuilder::MatchRotateRight(HValue* left,
10621                                      HValue* right,
10622                                      HValue** operand,
10623                                      HValue** shift_amount) {
10624   HShl* shl;
10625   HShr* shr;
10626   if (left->IsShl() && right->IsShr()) {
10627     shl = HShl::cast(left);
10628     shr = HShr::cast(right);
10629   } else if (left->IsShr() && right->IsShl()) {
10630     shl = HShl::cast(right);
10631     shr = HShr::cast(left);
10632   } else {
10633     return false;
10634   }
10635   if (shl->left() != shr->left()) return false;
10636
10637   if (!ShiftAmountsAllowReplaceByRotate(shl->right(), shr->right()) &&
10638       !ShiftAmountsAllowReplaceByRotate(shr->right(), shl->right())) {
10639     return false;
10640   }
10641   *operand = shr->left();
10642   *shift_amount = shr->right();
10643   return true;
10644 }
10645
10646
10647 bool CanBeZero(HValue* right) {
10648   if (right->IsConstant()) {
10649     HConstant* right_const = HConstant::cast(right);
10650     if (right_const->HasInteger32Value() &&
10651        (right_const->Integer32Value() & 0x1f) != 0) {
10652       return false;
10653     }
10654   }
10655   return true;
10656 }
10657
10658
10659 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
10660                                          Type* expected) {
10661   if (expected->Is(Type::SignedSmall())) {
10662     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
10663   }
10664   if (expected->Is(Type::Signed32())) {
10665     return AddUncasted<HForceRepresentation>(number,
10666                                              Representation::Integer32());
10667   }
10668   return number;
10669 }
10670
10671
10672 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
10673   if (value->IsConstant()) {
10674     HConstant* constant = HConstant::cast(value);
10675     Maybe<HConstant*> number =
10676         constant->CopyToTruncatedNumber(isolate(), zone());
10677     if (number.IsJust()) {
10678       *expected = Type::Number(zone());
10679       return AddInstruction(number.FromJust());
10680     }
10681   }
10682
10683   // We put temporary values on the stack, which don't correspond to anything
10684   // in baseline code. Since nothing is observable we avoid recording those
10685   // pushes with a NoObservableSideEffectsScope.
10686   NoObservableSideEffectsScope no_effects(this);
10687
10688   Type* expected_type = *expected;
10689
10690   // Separate the number type from the rest.
10691   Type* expected_obj =
10692       Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
10693   Type* expected_number =
10694       Type::Intersect(expected_type, Type::Number(zone()), zone());
10695
10696   // We expect to get a number.
10697   // (We need to check first, since Type::None->Is(Type::Any()) == true.
10698   if (expected_obj->Is(Type::None())) {
10699     DCHECK(!expected_number->Is(Type::None(zone())));
10700     return value;
10701   }
10702
10703   if (expected_obj->Is(Type::Undefined(zone()))) {
10704     // This is already done by HChange.
10705     *expected = Type::Union(expected_number, Type::Number(zone()), zone());
10706     return value;
10707   }
10708
10709   return value;
10710 }
10711
10712
10713 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
10714     BinaryOperation* expr,
10715     HValue* left,
10716     HValue* right,
10717     PushBeforeSimulateBehavior push_sim_result) {
10718   Type* left_type = expr->left()->bounds().lower;
10719   Type* right_type = expr->right()->bounds().lower;
10720   Type* result_type = expr->bounds().lower;
10721   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
10722   Handle<AllocationSite> allocation_site = expr->allocation_site();
10723
10724   HAllocationMode allocation_mode;
10725   if (FLAG_allocation_site_pretenuring && !allocation_site.is_null()) {
10726     allocation_mode = HAllocationMode(allocation_site);
10727   }
10728   HValue* result = HGraphBuilder::BuildBinaryOperation(
10729       expr->op(), left, right, left_type, right_type, result_type,
10730       fixed_right_arg, allocation_mode, strength(function_language_mode()),
10731       expr->id());
10732   // Add a simulate after instructions with observable side effects, and
10733   // after phis, which are the result of BuildBinaryOperation when we
10734   // inlined some complex subgraph.
10735   if (result->HasObservableSideEffects() || result->IsPhi()) {
10736     if (push_sim_result == PUSH_BEFORE_SIMULATE) {
10737       Push(result);
10738       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10739       Drop(1);
10740     } else {
10741       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10742     }
10743   }
10744   return result;
10745 }
10746
10747
10748 HValue* HGraphBuilder::BuildBinaryOperation(
10749     Token::Value op, HValue* left, HValue* right, Type* left_type,
10750     Type* right_type, Type* result_type, Maybe<int> fixed_right_arg,
10751     HAllocationMode allocation_mode, Strength strength, BailoutId opt_id) {
10752   bool maybe_string_add = false;
10753   if (op == Token::ADD) {
10754     // If we are adding constant string with something for which we don't have
10755     // a feedback yet, assume that it's also going to be a string and don't
10756     // generate deopt instructions.
10757     if (!left_type->IsInhabited() && right->IsConstant() &&
10758         HConstant::cast(right)->HasStringValue()) {
10759       left_type = Type::String();
10760     }
10761
10762     if (!right_type->IsInhabited() && left->IsConstant() &&
10763         HConstant::cast(left)->HasStringValue()) {
10764       right_type = Type::String();
10765     }
10766
10767     maybe_string_add = (left_type->Maybe(Type::String()) ||
10768                         left_type->Maybe(Type::Receiver()) ||
10769                         right_type->Maybe(Type::String()) ||
10770                         right_type->Maybe(Type::Receiver()));
10771   }
10772
10773   Representation left_rep = RepresentationFor(left_type);
10774   Representation right_rep = RepresentationFor(right_type);
10775
10776   if (!left_type->IsInhabited()) {
10777     Add<HDeoptimize>(
10778         Deoptimizer::kInsufficientTypeFeedbackForLHSOfBinaryOperation,
10779         Deoptimizer::SOFT);
10780     left_type = Type::Any(zone());
10781     left_rep = RepresentationFor(left_type);
10782     maybe_string_add = op == Token::ADD;
10783   }
10784
10785   if (!right_type->IsInhabited()) {
10786     Add<HDeoptimize>(
10787         Deoptimizer::kInsufficientTypeFeedbackForRHSOfBinaryOperation,
10788         Deoptimizer::SOFT);
10789     right_type = Type::Any(zone());
10790     right_rep = RepresentationFor(right_type);
10791     maybe_string_add = op == Token::ADD;
10792   }
10793
10794   if (!maybe_string_add && !is_strong(strength)) {
10795     left = TruncateToNumber(left, &left_type);
10796     right = TruncateToNumber(right, &right_type);
10797   }
10798
10799   // Special case for string addition here.
10800   if (op == Token::ADD &&
10801       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
10802     // Validate type feedback for left argument.
10803     if (left_type->Is(Type::String())) {
10804       left = BuildCheckString(left);
10805     }
10806
10807     // Validate type feedback for right argument.
10808     if (right_type->Is(Type::String())) {
10809       right = BuildCheckString(right);
10810     }
10811
10812     // Convert left argument as necessary.
10813     if (left_type->Is(Type::Number()) && !is_strong(strength)) {
10814       DCHECK(right_type->Is(Type::String()));
10815       left = BuildNumberToString(left, left_type);
10816     } else if (!left_type->Is(Type::String())) {
10817       DCHECK(right_type->Is(Type::String()));
10818       HValue* function = AddLoadJSBuiltin(
10819           is_strong(strength) ? Builtins::STRING_ADD_RIGHT_STRONG
10820                               : Builtins::STRING_ADD_RIGHT);
10821       Add<HPushArguments>(left, right);
10822       return AddUncasted<HInvokeFunction>(function, 2);
10823     }
10824
10825     // Convert right argument as necessary.
10826     if (right_type->Is(Type::Number()) && !is_strong(strength)) {
10827       DCHECK(left_type->Is(Type::String()));
10828       right = BuildNumberToString(right, right_type);
10829     } else if (!right_type->Is(Type::String())) {
10830       DCHECK(left_type->Is(Type::String()));
10831       HValue* function = AddLoadJSBuiltin(is_strong(strength)
10832                                               ? Builtins::STRING_ADD_LEFT_STRONG
10833                                               : Builtins::STRING_ADD_LEFT);
10834       Add<HPushArguments>(left, right);
10835       return AddUncasted<HInvokeFunction>(function, 2);
10836     }
10837
10838     // Fast paths for empty constant strings.
10839     Handle<String> left_string =
10840         left->IsConstant() && HConstant::cast(left)->HasStringValue()
10841             ? HConstant::cast(left)->StringValue()
10842             : Handle<String>();
10843     Handle<String> right_string =
10844         right->IsConstant() && HConstant::cast(right)->HasStringValue()
10845             ? HConstant::cast(right)->StringValue()
10846             : Handle<String>();
10847     if (!left_string.is_null() && left_string->length() == 0) return right;
10848     if (!right_string.is_null() && right_string->length() == 0) return left;
10849     if (!left_string.is_null() && !right_string.is_null()) {
10850       return AddUncasted<HStringAdd>(
10851           left, right, strength, allocation_mode.GetPretenureMode(),
10852           STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10853     }
10854
10855     // Register the dependent code with the allocation site.
10856     if (!allocation_mode.feedback_site().is_null()) {
10857       DCHECK(!graph()->info()->IsStub());
10858       Handle<AllocationSite> site(allocation_mode.feedback_site());
10859       top_info()->dependencies()->AssumeTenuringDecision(site);
10860     }
10861
10862     // Inline the string addition into the stub when creating allocation
10863     // mementos to gather allocation site feedback, or if we can statically
10864     // infer that we're going to create a cons string.
10865     if ((graph()->info()->IsStub() &&
10866          allocation_mode.CreateAllocationMementos()) ||
10867         (left->IsConstant() &&
10868          HConstant::cast(left)->HasStringValue() &&
10869          HConstant::cast(left)->StringValue()->length() + 1 >=
10870            ConsString::kMinLength) ||
10871         (right->IsConstant() &&
10872          HConstant::cast(right)->HasStringValue() &&
10873          HConstant::cast(right)->StringValue()->length() + 1 >=
10874            ConsString::kMinLength)) {
10875       return BuildStringAdd(left, right, allocation_mode);
10876     }
10877
10878     // Fallback to using the string add stub.
10879     return AddUncasted<HStringAdd>(
10880         left, right, strength, allocation_mode.GetPretenureMode(),
10881         STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10882   }
10883
10884   if (graph()->info()->IsStub()) {
10885     left = EnforceNumberType(left, left_type);
10886     right = EnforceNumberType(right, right_type);
10887   }
10888
10889   Representation result_rep = RepresentationFor(result_type);
10890
10891   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
10892                           (right_rep.IsTagged() && !right_rep.IsSmi());
10893
10894   HInstruction* instr = NULL;
10895   // Only the stub is allowed to call into the runtime, since otherwise we would
10896   // inline several instructions (including the two pushes) for every tagged
10897   // operation in optimized code, which is more expensive, than a stub call.
10898   if (graph()->info()->IsStub() && is_non_primitive) {
10899     HValue* function =
10900         AddLoadJSBuiltin(BinaryOpIC::TokenToJSBuiltin(op, strength));
10901     Add<HPushArguments>(left, right);
10902     instr = AddUncasted<HInvokeFunction>(function, 2);
10903   } else {
10904     if (is_strong(strength) && Token::IsBitOp(op)) {
10905       // TODO(conradw): This is not efficient, but is necessary to prevent
10906       // conversion of oddball values to numbers in strong mode. It would be
10907       // better to prevent the conversion rather than adding a runtime check.
10908       IfBuilder if_builder(this);
10909       if_builder.If<HHasInstanceTypeAndBranch>(left, ODDBALL_TYPE);
10910       if_builder.OrIf<HHasInstanceTypeAndBranch>(right, ODDBALL_TYPE);
10911       if_builder.Then();
10912       Add<HCallRuntime>(
10913           isolate()->factory()->empty_string(),
10914           Runtime::FunctionForId(Runtime::kThrowStrongModeImplicitConversion),
10915           0);
10916       if (!graph()->info()->IsStub()) {
10917         Add<HSimulate>(opt_id, REMOVABLE_SIMULATE);
10918       }
10919       if_builder.End();
10920     }
10921     switch (op) {
10922       case Token::ADD:
10923         instr = AddUncasted<HAdd>(left, right, strength);
10924         break;
10925       case Token::SUB:
10926         instr = AddUncasted<HSub>(left, right, strength);
10927         break;
10928       case Token::MUL:
10929         instr = AddUncasted<HMul>(left, right, strength);
10930         break;
10931       case Token::MOD: {
10932         if (fixed_right_arg.IsJust() &&
10933             !right->EqualsInteger32Constant(fixed_right_arg.FromJust())) {
10934           HConstant* fixed_right =
10935               Add<HConstant>(static_cast<int>(fixed_right_arg.FromJust()));
10936           IfBuilder if_same(this);
10937           if_same.If<HCompareNumericAndBranch>(right, fixed_right, Token::EQ);
10938           if_same.Then();
10939           if_same.ElseDeopt(Deoptimizer::kUnexpectedRHSOfBinaryOperation);
10940           right = fixed_right;
10941         }
10942         instr = AddUncasted<HMod>(left, right, strength);
10943         break;
10944       }
10945       case Token::DIV:
10946         instr = AddUncasted<HDiv>(left, right, strength);
10947         break;
10948       case Token::BIT_XOR:
10949       case Token::BIT_AND:
10950         instr = AddUncasted<HBitwise>(op, left, right, strength);
10951         break;
10952       case Token::BIT_OR: {
10953         HValue* operand, *shift_amount;
10954         if (left_type->Is(Type::Signed32()) &&
10955             right_type->Is(Type::Signed32()) &&
10956             MatchRotateRight(left, right, &operand, &shift_amount)) {
10957           instr = AddUncasted<HRor>(operand, shift_amount, strength);
10958         } else {
10959           instr = AddUncasted<HBitwise>(op, left, right, strength);
10960         }
10961         break;
10962       }
10963       case Token::SAR:
10964         instr = AddUncasted<HSar>(left, right, strength);
10965         break;
10966       case Token::SHR:
10967         instr = AddUncasted<HShr>(left, right, strength);
10968         if (instr->IsShr() && CanBeZero(right)) {
10969           graph()->RecordUint32Instruction(instr);
10970         }
10971         break;
10972       case Token::SHL:
10973         instr = AddUncasted<HShl>(left, right, strength);
10974         break;
10975       default:
10976         UNREACHABLE();
10977     }
10978   }
10979
10980   if (instr->IsBinaryOperation()) {
10981     HBinaryOperation* binop = HBinaryOperation::cast(instr);
10982     binop->set_observed_input_representation(1, left_rep);
10983     binop->set_observed_input_representation(2, right_rep);
10984     binop->initialize_output_representation(result_rep);
10985     if (graph()->info()->IsStub()) {
10986       // Stub should not call into stub.
10987       instr->SetFlag(HValue::kCannotBeTagged);
10988       // And should truncate on HForceRepresentation already.
10989       if (left->IsForceRepresentation()) {
10990         left->CopyFlag(HValue::kTruncatingToSmi, instr);
10991         left->CopyFlag(HValue::kTruncatingToInt32, instr);
10992       }
10993       if (right->IsForceRepresentation()) {
10994         right->CopyFlag(HValue::kTruncatingToSmi, instr);
10995         right->CopyFlag(HValue::kTruncatingToInt32, instr);
10996       }
10997     }
10998   }
10999   return instr;
11000 }
11001
11002
11003 // Check for the form (%_ClassOf(foo) === 'BarClass').
11004 static bool IsClassOfTest(CompareOperation* expr) {
11005   if (expr->op() != Token::EQ_STRICT) return false;
11006   CallRuntime* call = expr->left()->AsCallRuntime();
11007   if (call == NULL) return false;
11008   Literal* literal = expr->right()->AsLiteral();
11009   if (literal == NULL) return false;
11010   if (!literal->value()->IsString()) return false;
11011   if (!call->name()->IsOneByteEqualTo(STATIC_CHAR_VECTOR("_ClassOf"))) {
11012     return false;
11013   }
11014   DCHECK(call->arguments()->length() == 1);
11015   return true;
11016 }
11017
11018
11019 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
11020   DCHECK(!HasStackOverflow());
11021   DCHECK(current_block() != NULL);
11022   DCHECK(current_block()->HasPredecessor());
11023   switch (expr->op()) {
11024     case Token::COMMA:
11025       return VisitComma(expr);
11026     case Token::OR:
11027     case Token::AND:
11028       return VisitLogicalExpression(expr);
11029     default:
11030       return VisitArithmeticExpression(expr);
11031   }
11032 }
11033
11034
11035 void HOptimizedGraphBuilder::VisitComma(BinaryOperation* expr) {
11036   CHECK_ALIVE(VisitForEffect(expr->left()));
11037   // Visit the right subexpression in the same AST context as the entire
11038   // expression.
11039   Visit(expr->right());
11040 }
11041
11042
11043 void HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
11044   bool is_logical_and = expr->op() == Token::AND;
11045   if (ast_context()->IsTest()) {
11046     TestContext* context = TestContext::cast(ast_context());
11047     // Translate left subexpression.
11048     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11049     if (is_logical_and) {
11050       CHECK_BAILOUT(VisitForControl(expr->left(),
11051                                     eval_right,
11052                                     context->if_false()));
11053     } else {
11054       CHECK_BAILOUT(VisitForControl(expr->left(),
11055                                     context->if_true(),
11056                                     eval_right));
11057     }
11058
11059     // Translate right subexpression by visiting it in the same AST
11060     // context as the entire expression.
11061     if (eval_right->HasPredecessor()) {
11062       eval_right->SetJoinId(expr->RightId());
11063       set_current_block(eval_right);
11064       Visit(expr->right());
11065     }
11066
11067   } else if (ast_context()->IsValue()) {
11068     CHECK_ALIVE(VisitForValue(expr->left()));
11069     DCHECK(current_block() != NULL);
11070     HValue* left_value = Top();
11071
11072     // Short-circuit left values that always evaluate to the same boolean value.
11073     if (expr->left()->ToBooleanIsTrue() || expr->left()->ToBooleanIsFalse()) {
11074       // l (evals true)  && r -> r
11075       // l (evals true)  || r -> l
11076       // l (evals false) && r -> l
11077       // l (evals false) || r -> r
11078       if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
11079         Drop(1);
11080         CHECK_ALIVE(VisitForValue(expr->right()));
11081       }
11082       return ast_context()->ReturnValue(Pop());
11083     }
11084
11085     // We need an extra block to maintain edge-split form.
11086     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11087     HBasicBlock* eval_right = graph()->CreateBasicBlock();
11088     ToBooleanStub::Types expected(expr->left()->to_boolean_types());
11089     HBranch* test = is_logical_and
11090         ? New<HBranch>(left_value, expected, eval_right, empty_block)
11091         : New<HBranch>(left_value, expected, empty_block, eval_right);
11092     FinishCurrentBlock(test);
11093
11094     set_current_block(eval_right);
11095     Drop(1);  // Value of the left subexpression.
11096     CHECK_BAILOUT(VisitForValue(expr->right()));
11097
11098     HBasicBlock* join_block =
11099       CreateJoin(empty_block, current_block(), expr->id());
11100     set_current_block(join_block);
11101     return ast_context()->ReturnValue(Pop());
11102
11103   } else {
11104     DCHECK(ast_context()->IsEffect());
11105     // In an effect context, we don't need the value of the left subexpression,
11106     // only its control flow and side effects.  We need an extra block to
11107     // maintain edge-split form.
11108     HBasicBlock* empty_block = graph()->CreateBasicBlock();
11109     HBasicBlock* right_block = graph()->CreateBasicBlock();
11110     if (is_logical_and) {
11111       CHECK_BAILOUT(VisitForControl(expr->left(), right_block, empty_block));
11112     } else {
11113       CHECK_BAILOUT(VisitForControl(expr->left(), empty_block, right_block));
11114     }
11115
11116     // TODO(kmillikin): Find a way to fix this.  It's ugly that there are
11117     // actually two empty blocks (one here and one inserted by
11118     // TestContext::BuildBranch, and that they both have an HSimulate though the
11119     // second one is not a merge node, and that we really have no good AST ID to
11120     // put on that first HSimulate.
11121
11122     if (empty_block->HasPredecessor()) {
11123       empty_block->SetJoinId(expr->id());
11124     } else {
11125       empty_block = NULL;
11126     }
11127
11128     if (right_block->HasPredecessor()) {
11129       right_block->SetJoinId(expr->RightId());
11130       set_current_block(right_block);
11131       CHECK_BAILOUT(VisitForEffect(expr->right()));
11132       right_block = current_block();
11133     } else {
11134       right_block = NULL;
11135     }
11136
11137     HBasicBlock* join_block =
11138       CreateJoin(empty_block, right_block, expr->id());
11139     set_current_block(join_block);
11140     // We did not materialize any value in the predecessor environments,
11141     // so there is no need to handle it here.
11142   }
11143 }
11144
11145
11146 void HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
11147   CHECK_ALIVE(VisitForValue(expr->left()));
11148   CHECK_ALIVE(VisitForValue(expr->right()));
11149   SetSourcePosition(expr->position());
11150   HValue* right = Pop();
11151   HValue* left = Pop();
11152   HValue* result =
11153       BuildBinaryOperation(expr, left, right,
11154           ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11155                                     : PUSH_BEFORE_SIMULATE);
11156   if (top_info()->is_tracking_positions() && result->IsBinaryOperation()) {
11157     HBinaryOperation::cast(result)->SetOperandPositions(
11158         zone(),
11159         ScriptPositionToSourcePosition(expr->left()->position()),
11160         ScriptPositionToSourcePosition(expr->right()->position()));
11161   }
11162   return ast_context()->ReturnValue(result);
11163 }
11164
11165
11166 void HOptimizedGraphBuilder::HandleLiteralCompareTypeof(CompareOperation* expr,
11167                                                         Expression* sub_expr,
11168                                                         Handle<String> check) {
11169   CHECK_ALIVE(VisitForTypeOf(sub_expr));
11170   SetSourcePosition(expr->position());
11171   HValue* value = Pop();
11172   HTypeofIsAndBranch* instr = New<HTypeofIsAndBranch>(value, check);
11173   return ast_context()->ReturnControl(instr, expr->id());
11174 }
11175
11176
11177 static bool IsLiteralCompareBool(Isolate* isolate,
11178                                  HValue* left,
11179                                  Token::Value op,
11180                                  HValue* right) {
11181   return op == Token::EQ_STRICT &&
11182       ((left->IsConstant() &&
11183           HConstant::cast(left)->handle(isolate)->IsBoolean()) ||
11184        (right->IsConstant() &&
11185            HConstant::cast(right)->handle(isolate)->IsBoolean()));
11186 }
11187
11188
11189 void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
11190   DCHECK(!HasStackOverflow());
11191   DCHECK(current_block() != NULL);
11192   DCHECK(current_block()->HasPredecessor());
11193
11194   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11195
11196   // Check for a few fast cases. The AST visiting behavior must be in sync
11197   // with the full codegen: We don't push both left and right values onto
11198   // the expression stack when one side is a special-case literal.
11199   Expression* sub_expr = NULL;
11200   Handle<String> check;
11201   if (expr->IsLiteralCompareTypeof(&sub_expr, &check)) {
11202     return HandleLiteralCompareTypeof(expr, sub_expr, check);
11203   }
11204   if (expr->IsLiteralCompareUndefined(&sub_expr, isolate())) {
11205     return HandleLiteralCompareNil(expr, sub_expr, kUndefinedValue);
11206   }
11207   if (expr->IsLiteralCompareNull(&sub_expr)) {
11208     return HandleLiteralCompareNil(expr, sub_expr, kNullValue);
11209   }
11210
11211   if (IsClassOfTest(expr)) {
11212     CallRuntime* call = expr->left()->AsCallRuntime();
11213     DCHECK(call->arguments()->length() == 1);
11214     CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11215     HValue* value = Pop();
11216     Literal* literal = expr->right()->AsLiteral();
11217     Handle<String> rhs = Handle<String>::cast(literal->value());
11218     HClassOfTestAndBranch* instr = New<HClassOfTestAndBranch>(value, rhs);
11219     return ast_context()->ReturnControl(instr, expr->id());
11220   }
11221
11222   Type* left_type = expr->left()->bounds().lower;
11223   Type* right_type = expr->right()->bounds().lower;
11224   Type* combined_type = expr->combined_type();
11225
11226   CHECK_ALIVE(VisitForValue(expr->left()));
11227   CHECK_ALIVE(VisitForValue(expr->right()));
11228
11229   HValue* right = Pop();
11230   HValue* left = Pop();
11231   Token::Value op = expr->op();
11232
11233   if (IsLiteralCompareBool(isolate(), left, op, right)) {
11234     HCompareObjectEqAndBranch* result =
11235         New<HCompareObjectEqAndBranch>(left, right);
11236     return ast_context()->ReturnControl(result, expr->id());
11237   }
11238
11239   if (op == Token::INSTANCEOF) {
11240     // Check to see if the rhs of the instanceof is a known function.
11241     if (right->IsConstant() &&
11242         HConstant::cast(right)->handle(isolate())->IsJSFunction()) {
11243       Handle<Object> function = HConstant::cast(right)->handle(isolate());
11244       Handle<JSFunction> target = Handle<JSFunction>::cast(function);
11245       HInstanceOfKnownGlobal* result =
11246           New<HInstanceOfKnownGlobal>(left, target);
11247       return ast_context()->ReturnInstruction(result, expr->id());
11248     }
11249
11250     HInstanceOf* result = New<HInstanceOf>(left, right);
11251     return ast_context()->ReturnInstruction(result, expr->id());
11252
11253   } else if (op == Token::IN) {
11254     HValue* function = AddLoadJSBuiltin(Builtins::IN);
11255     Add<HPushArguments>(left, right);
11256     // TODO(olivf) InvokeFunction produces a check for the parameter count,
11257     // even though we are certain to pass the correct number of arguments here.
11258     HInstruction* result = New<HInvokeFunction>(function, 2);
11259     return ast_context()->ReturnInstruction(result, expr->id());
11260   }
11261
11262   PushBeforeSimulateBehavior push_behavior =
11263     ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
11264                               : PUSH_BEFORE_SIMULATE;
11265   HControlInstruction* compare = BuildCompareInstruction(
11266       op, left, right, left_type, right_type, combined_type,
11267       ScriptPositionToSourcePosition(expr->left()->position()),
11268       ScriptPositionToSourcePosition(expr->right()->position()),
11269       push_behavior, expr->id());
11270   if (compare == NULL) return;  // Bailed out.
11271   return ast_context()->ReturnControl(compare, expr->id());
11272 }
11273
11274
11275 HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
11276     Token::Value op, HValue* left, HValue* right, Type* left_type,
11277     Type* right_type, Type* combined_type, SourcePosition left_position,
11278     SourcePosition right_position, PushBeforeSimulateBehavior push_sim_result,
11279     BailoutId bailout_id) {
11280   // Cases handled below depend on collected type feedback. They should
11281   // soft deoptimize when there is no type feedback.
11282   if (!combined_type->IsInhabited()) {
11283     Add<HDeoptimize>(
11284         Deoptimizer::kInsufficientTypeFeedbackForCombinedTypeOfBinaryOperation,
11285         Deoptimizer::SOFT);
11286     combined_type = left_type = right_type = Type::Any(zone());
11287   }
11288
11289   Representation left_rep = RepresentationFor(left_type);
11290   Representation right_rep = RepresentationFor(right_type);
11291   Representation combined_rep = RepresentationFor(combined_type);
11292
11293   if (combined_type->Is(Type::Receiver())) {
11294     if (Token::IsEqualityOp(op)) {
11295       // HCompareObjectEqAndBranch can only deal with object, so
11296       // exclude numbers.
11297       if ((left->IsConstant() &&
11298            HConstant::cast(left)->HasNumberValue()) ||
11299           (right->IsConstant() &&
11300            HConstant::cast(right)->HasNumberValue())) {
11301         Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11302                          Deoptimizer::SOFT);
11303         // The caller expects a branch instruction, so make it happy.
11304         return New<HBranch>(graph()->GetConstantTrue());
11305       }
11306       // Can we get away with map check and not instance type check?
11307       HValue* operand_to_check =
11308           left->block()->block_id() < right->block()->block_id() ? left : right;
11309       if (combined_type->IsClass()) {
11310         Handle<Map> map = combined_type->AsClass()->Map();
11311         AddCheckMap(operand_to_check, map);
11312         HCompareObjectEqAndBranch* result =
11313             New<HCompareObjectEqAndBranch>(left, right);
11314         if (top_info()->is_tracking_positions()) {
11315           result->set_operand_position(zone(), 0, left_position);
11316           result->set_operand_position(zone(), 1, right_position);
11317         }
11318         return result;
11319       } else {
11320         BuildCheckHeapObject(operand_to_check);
11321         Add<HCheckInstanceType>(operand_to_check,
11322                                 HCheckInstanceType::IS_SPEC_OBJECT);
11323         HCompareObjectEqAndBranch* result =
11324             New<HCompareObjectEqAndBranch>(left, right);
11325         return result;
11326       }
11327     } else {
11328       Bailout(kUnsupportedNonPrimitiveCompare);
11329       return NULL;
11330     }
11331   } else if (combined_type->Is(Type::InternalizedString()) &&
11332              Token::IsEqualityOp(op)) {
11333     // If we have a constant argument, it should be consistent with the type
11334     // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
11335     if ((left->IsConstant() &&
11336          !HConstant::cast(left)->HasInternalizedStringValue()) ||
11337         (right->IsConstant() &&
11338          !HConstant::cast(right)->HasInternalizedStringValue())) {
11339       Add<HDeoptimize>(Deoptimizer::kTypeMismatchBetweenFeedbackAndConstant,
11340                        Deoptimizer::SOFT);
11341       // The caller expects a branch instruction, so make it happy.
11342       return New<HBranch>(graph()->GetConstantTrue());
11343     }
11344     BuildCheckHeapObject(left);
11345     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
11346     BuildCheckHeapObject(right);
11347     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
11348     HCompareObjectEqAndBranch* result =
11349         New<HCompareObjectEqAndBranch>(left, right);
11350     return result;
11351   } else if (combined_type->Is(Type::String())) {
11352     BuildCheckHeapObject(left);
11353     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
11354     BuildCheckHeapObject(right);
11355     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
11356     HStringCompareAndBranch* result =
11357         New<HStringCompareAndBranch>(left, right, op);
11358     return result;
11359   } else {
11360     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
11361       HCompareGeneric* result = Add<HCompareGeneric>(
11362           left, right, op, strength(function_language_mode()));
11363       result->set_observed_input_representation(1, left_rep);
11364       result->set_observed_input_representation(2, right_rep);
11365       if (result->HasObservableSideEffects()) {
11366         if (push_sim_result == PUSH_BEFORE_SIMULATE) {
11367           Push(result);
11368           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11369           Drop(1);
11370         } else {
11371           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11372         }
11373       }
11374       // TODO(jkummerow): Can we make this more efficient?
11375       HBranch* branch = New<HBranch>(result);
11376       return branch;
11377     } else {
11378       HCompareNumericAndBranch* result = New<HCompareNumericAndBranch>(
11379           left, right, op, strength(function_language_mode()));
11380       result->set_observed_input_representation(left_rep, right_rep);
11381       if (top_info()->is_tracking_positions()) {
11382         result->SetOperandPositions(zone(), left_position, right_position);
11383       }
11384       return result;
11385     }
11386   }
11387 }
11388
11389
11390 void HOptimizedGraphBuilder::HandleLiteralCompareNil(CompareOperation* expr,
11391                                                      Expression* sub_expr,
11392                                                      NilValue nil) {
11393   DCHECK(!HasStackOverflow());
11394   DCHECK(current_block() != NULL);
11395   DCHECK(current_block()->HasPredecessor());
11396   DCHECK(expr->op() == Token::EQ || expr->op() == Token::EQ_STRICT);
11397   if (!top_info()->is_tracking_positions()) SetSourcePosition(expr->position());
11398   CHECK_ALIVE(VisitForValue(sub_expr));
11399   HValue* value = Pop();
11400   if (expr->op() == Token::EQ_STRICT) {
11401     HConstant* nil_constant = nil == kNullValue
11402         ? graph()->GetConstantNull()
11403         : graph()->GetConstantUndefined();
11404     HCompareObjectEqAndBranch* instr =
11405         New<HCompareObjectEqAndBranch>(value, nil_constant);
11406     return ast_context()->ReturnControl(instr, expr->id());
11407   } else {
11408     DCHECK_EQ(Token::EQ, expr->op());
11409     Type* type = expr->combined_type()->Is(Type::None())
11410         ? Type::Any(zone()) : expr->combined_type();
11411     HIfContinuation continuation;
11412     BuildCompareNil(value, type, &continuation);
11413     return ast_context()->ReturnContinuation(&continuation, expr->id());
11414   }
11415 }
11416
11417
11418 void HOptimizedGraphBuilder::VisitSpread(Spread* expr) { UNREACHABLE(); }
11419
11420
11421 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
11422   // If we share optimized code between different closures, the
11423   // this-function is not a constant, except inside an inlined body.
11424   if (function_state()->outer() != NULL) {
11425       return New<HConstant>(
11426           function_state()->compilation_info()->closure());
11427   } else {
11428       return New<HThisFunction>();
11429   }
11430 }
11431
11432
11433 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
11434     Handle<JSObject> boilerplate_object,
11435     AllocationSiteUsageContext* site_context) {
11436   NoObservableSideEffectsScope no_effects(this);
11437   Handle<Map> initial_map(boilerplate_object->map());
11438   InstanceType instance_type = initial_map->instance_type();
11439   DCHECK(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
11440
11441   HType type = instance_type == JS_ARRAY_TYPE
11442       ? HType::JSArray() : HType::JSObject();
11443   HValue* object_size_constant = Add<HConstant>(initial_map->instance_size());
11444
11445   PretenureFlag pretenure_flag = NOT_TENURED;
11446   Handle<AllocationSite> current_site(*site_context->current(), isolate());
11447   if (FLAG_allocation_site_pretenuring) {
11448     pretenure_flag = current_site->GetPretenureMode();
11449     top_info()->dependencies()->AssumeTenuringDecision(current_site);
11450   }
11451
11452   top_info()->dependencies()->AssumeTransitionStable(current_site);
11453
11454   HInstruction* object = Add<HAllocate>(
11455       object_size_constant, type, pretenure_flag, instance_type, current_site);
11456
11457   // If allocation folding reaches Page::kMaxRegularHeapObjectSize the
11458   // elements array may not get folded into the object. Hence, we set the
11459   // elements pointer to empty fixed array and let store elimination remove
11460   // this store in the folding case.
11461   HConstant* empty_fixed_array = Add<HConstant>(
11462       isolate()->factory()->empty_fixed_array());
11463   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11464       empty_fixed_array);
11465
11466   BuildEmitObjectHeader(boilerplate_object, object);
11467
11468   // Similarly to the elements pointer, there is no guarantee that all
11469   // property allocations can get folded, so pre-initialize all in-object
11470   // properties to a safe value.
11471   BuildInitializeInobjectProperties(object, initial_map);
11472
11473   Handle<FixedArrayBase> elements(boilerplate_object->elements());
11474   int elements_size = (elements->length() > 0 &&
11475       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
11476           elements->Size() : 0;
11477
11478   if (pretenure_flag == TENURED &&
11479       elements->map() == isolate()->heap()->fixed_cow_array_map() &&
11480       isolate()->heap()->InNewSpace(*elements)) {
11481     // If we would like to pretenure a fixed cow array, we must ensure that the
11482     // array is already in old space, otherwise we'll create too many old-to-
11483     // new-space pointers (overflowing the store buffer).
11484     elements = Handle<FixedArrayBase>(
11485         isolate()->factory()->CopyAndTenureFixedCOWArray(
11486             Handle<FixedArray>::cast(elements)));
11487     boilerplate_object->set_elements(*elements);
11488   }
11489
11490   HInstruction* object_elements = NULL;
11491   if (elements_size > 0) {
11492     HValue* object_elements_size = Add<HConstant>(elements_size);
11493     InstanceType instance_type = boilerplate_object->HasFastDoubleElements()
11494         ? FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
11495     object_elements =
11496         Add<HAllocate>(object_elements_size, HType::HeapObject(),
11497                        pretenure_flag, instance_type, current_site);
11498     BuildEmitElements(boilerplate_object, elements, object_elements,
11499                       site_context);
11500     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11501                           object_elements);
11502   } else {
11503     Handle<Object> elements_field =
11504         Handle<Object>(boilerplate_object->elements(), isolate());
11505     HInstruction* object_elements_cow = Add<HConstant>(elements_field);
11506     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11507                           object_elements_cow);
11508   }
11509
11510   // Copy in-object properties.
11511   if (initial_map->NumberOfFields() != 0 ||
11512       initial_map->unused_property_fields() > 0) {
11513     BuildEmitInObjectProperties(boilerplate_object, object, site_context,
11514                                 pretenure_flag);
11515   }
11516   return object;
11517 }
11518
11519
11520 void HOptimizedGraphBuilder::BuildEmitObjectHeader(
11521     Handle<JSObject> boilerplate_object,
11522     HInstruction* object) {
11523   DCHECK(boilerplate_object->properties()->length() == 0);
11524
11525   Handle<Map> boilerplate_object_map(boilerplate_object->map());
11526   AddStoreMapConstant(object, boilerplate_object_map);
11527
11528   Handle<Object> properties_field =
11529       Handle<Object>(boilerplate_object->properties(), isolate());
11530   DCHECK(*properties_field == isolate()->heap()->empty_fixed_array());
11531   HInstruction* properties = Add<HConstant>(properties_field);
11532   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
11533   Add<HStoreNamedField>(object, access, properties);
11534
11535   if (boilerplate_object->IsJSArray()) {
11536     Handle<JSArray> boilerplate_array =
11537         Handle<JSArray>::cast(boilerplate_object);
11538     Handle<Object> length_field =
11539         Handle<Object>(boilerplate_array->length(), isolate());
11540     HInstruction* length = Add<HConstant>(length_field);
11541
11542     DCHECK(boilerplate_array->length()->IsSmi());
11543     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
11544         boilerplate_array->GetElementsKind()), length);
11545   }
11546 }
11547
11548
11549 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
11550     Handle<JSObject> boilerplate_object,
11551     HInstruction* object,
11552     AllocationSiteUsageContext* site_context,
11553     PretenureFlag pretenure_flag) {
11554   Handle<Map> boilerplate_map(boilerplate_object->map());
11555   Handle<DescriptorArray> descriptors(boilerplate_map->instance_descriptors());
11556   int limit = boilerplate_map->NumberOfOwnDescriptors();
11557
11558   int copied_fields = 0;
11559   for (int i = 0; i < limit; i++) {
11560     PropertyDetails details = descriptors->GetDetails(i);
11561     if (details.type() != DATA) continue;
11562     copied_fields++;
11563     FieldIndex field_index = FieldIndex::ForDescriptor(*boilerplate_map, i);
11564
11565
11566     int property_offset = field_index.offset();
11567     Handle<Name> name(descriptors->GetKey(i));
11568
11569     // The access for the store depends on the type of the boilerplate.
11570     HObjectAccess access = boilerplate_object->IsJSArray() ?
11571         HObjectAccess::ForJSArrayOffset(property_offset) :
11572         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11573
11574     if (boilerplate_object->IsUnboxedDoubleField(field_index)) {
11575       CHECK(!boilerplate_object->IsJSArray());
11576       double value = boilerplate_object->RawFastDoublePropertyAt(field_index);
11577       access = access.WithRepresentation(Representation::Double());
11578       Add<HStoreNamedField>(object, access, Add<HConstant>(value));
11579       continue;
11580     }
11581     Handle<Object> value(boilerplate_object->RawFastPropertyAt(field_index),
11582                          isolate());
11583
11584     if (value->IsJSObject()) {
11585       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11586       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11587       HInstruction* result =
11588           BuildFastLiteral(value_object, site_context);
11589       site_context->ExitScope(current_site, value_object);
11590       Add<HStoreNamedField>(object, access, result);
11591     } else {
11592       Representation representation = details.representation();
11593       HInstruction* value_instruction;
11594
11595       if (representation.IsDouble()) {
11596         // Allocate a HeapNumber box and store the value into it.
11597         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
11598         // This heap number alloc does not have a corresponding
11599         // AllocationSite. That is okay because
11600         // 1) it's a child object of another object with a valid allocation site
11601         // 2) we can just use the mode of the parent object for pretenuring
11602         HInstruction* double_box =
11603             Add<HAllocate>(heap_number_constant, HType::HeapObject(),
11604                 pretenure_flag, MUTABLE_HEAP_NUMBER_TYPE);
11605         AddStoreMapConstant(double_box,
11606             isolate()->factory()->mutable_heap_number_map());
11607         // Unwrap the mutable heap number from the boilerplate.
11608         HValue* double_value =
11609             Add<HConstant>(Handle<HeapNumber>::cast(value)->value());
11610         Add<HStoreNamedField>(
11611             double_box, HObjectAccess::ForHeapNumberValue(), double_value);
11612         value_instruction = double_box;
11613       } else if (representation.IsSmi()) {
11614         value_instruction = value->IsUninitialized()
11615             ? graph()->GetConstant0()
11616             : Add<HConstant>(value);
11617         // Ensure that value is stored as smi.
11618         access = access.WithRepresentation(representation);
11619       } else {
11620         value_instruction = Add<HConstant>(value);
11621       }
11622
11623       Add<HStoreNamedField>(object, access, value_instruction);
11624     }
11625   }
11626
11627   int inobject_properties = boilerplate_object->map()->inobject_properties();
11628   HInstruction* value_instruction =
11629       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
11630   for (int i = copied_fields; i < inobject_properties; i++) {
11631     DCHECK(boilerplate_object->IsJSObject());
11632     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
11633     HObjectAccess access =
11634         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11635     Add<HStoreNamedField>(object, access, value_instruction);
11636   }
11637 }
11638
11639
11640 void HOptimizedGraphBuilder::BuildEmitElements(
11641     Handle<JSObject> boilerplate_object,
11642     Handle<FixedArrayBase> elements,
11643     HValue* object_elements,
11644     AllocationSiteUsageContext* site_context) {
11645   ElementsKind kind = boilerplate_object->map()->elements_kind();
11646   int elements_length = elements->length();
11647   HValue* object_elements_length = Add<HConstant>(elements_length);
11648   BuildInitializeElementsHeader(object_elements, kind, object_elements_length);
11649
11650   // Copy elements backing store content.
11651   if (elements->IsFixedDoubleArray()) {
11652     BuildEmitFixedDoubleArray(elements, kind, object_elements);
11653   } else if (elements->IsFixedArray()) {
11654     BuildEmitFixedArray(elements, kind, object_elements,
11655                         site_context);
11656   } else {
11657     UNREACHABLE();
11658   }
11659 }
11660
11661
11662 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
11663     Handle<FixedArrayBase> elements,
11664     ElementsKind kind,
11665     HValue* object_elements) {
11666   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11667   int elements_length = elements->length();
11668   for (int i = 0; i < elements_length; i++) {
11669     HValue* key_constant = Add<HConstant>(i);
11670     HInstruction* value_instruction = Add<HLoadKeyed>(
11671         boilerplate_elements, key_constant, nullptr, kind, ALLOW_RETURN_HOLE);
11672     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
11673                                            value_instruction, kind);
11674     store->SetFlag(HValue::kAllowUndefinedAsNaN);
11675   }
11676 }
11677
11678
11679 void HOptimizedGraphBuilder::BuildEmitFixedArray(
11680     Handle<FixedArrayBase> elements,
11681     ElementsKind kind,
11682     HValue* object_elements,
11683     AllocationSiteUsageContext* site_context) {
11684   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11685   int elements_length = elements->length();
11686   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
11687   for (int i = 0; i < elements_length; i++) {
11688     Handle<Object> value(fast_elements->get(i), isolate());
11689     HValue* key_constant = Add<HConstant>(i);
11690     if (value->IsJSObject()) {
11691       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11692       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11693       HInstruction* result =
11694           BuildFastLiteral(value_object, site_context);
11695       site_context->ExitScope(current_site, value_object);
11696       Add<HStoreKeyed>(object_elements, key_constant, result, kind);
11697     } else {
11698       ElementsKind copy_kind =
11699           kind == FAST_HOLEY_SMI_ELEMENTS ? FAST_HOLEY_ELEMENTS : kind;
11700       HInstruction* value_instruction =
11701           Add<HLoadKeyed>(boilerplate_elements, key_constant, nullptr,
11702                           copy_kind, ALLOW_RETURN_HOLE);
11703       Add<HStoreKeyed>(object_elements, key_constant, value_instruction,
11704                        copy_kind);
11705     }
11706   }
11707 }
11708
11709
11710 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
11711   DCHECK(!HasStackOverflow());
11712   DCHECK(current_block() != NULL);
11713   DCHECK(current_block()->HasPredecessor());
11714   HInstruction* instr = BuildThisFunction();
11715   return ast_context()->ReturnInstruction(instr, expr->id());
11716 }
11717
11718
11719 void HOptimizedGraphBuilder::VisitSuperPropertyReference(
11720     SuperPropertyReference* expr) {
11721   DCHECK(!HasStackOverflow());
11722   DCHECK(current_block() != NULL);
11723   DCHECK(current_block()->HasPredecessor());
11724   return Bailout(kSuperReference);
11725 }
11726
11727
11728 void HOptimizedGraphBuilder::VisitSuperCallReference(SuperCallReference* expr) {
11729   DCHECK(!HasStackOverflow());
11730   DCHECK(current_block() != NULL);
11731   DCHECK(current_block()->HasPredecessor());
11732   return Bailout(kSuperReference);
11733 }
11734
11735
11736 void HOptimizedGraphBuilder::VisitDeclarations(
11737     ZoneList<Declaration*>* declarations) {
11738   DCHECK(globals_.is_empty());
11739   AstVisitor::VisitDeclarations(declarations);
11740   if (!globals_.is_empty()) {
11741     Handle<FixedArray> array =
11742        isolate()->factory()->NewFixedArray(globals_.length(), TENURED);
11743     for (int i = 0; i < globals_.length(); ++i) array->set(i, *globals_.at(i));
11744     int flags =
11745         DeclareGlobalsEvalFlag::encode(current_info()->is_eval()) |
11746         DeclareGlobalsNativeFlag::encode(current_info()->is_native()) |
11747         DeclareGlobalsLanguageMode::encode(current_info()->language_mode());
11748     Add<HDeclareGlobals>(array, flags);
11749     globals_.Rewind(0);
11750   }
11751 }
11752
11753
11754 void HOptimizedGraphBuilder::VisitVariableDeclaration(
11755     VariableDeclaration* declaration) {
11756   VariableProxy* proxy = declaration->proxy();
11757   VariableMode mode = declaration->mode();
11758   Variable* variable = proxy->var();
11759   bool hole_init = mode == LET || mode == CONST || mode == CONST_LEGACY;
11760   switch (variable->location()) {
11761     case VariableLocation::GLOBAL:
11762     case VariableLocation::UNALLOCATED:
11763       globals_.Add(variable->name(), zone());
11764       globals_.Add(variable->binding_needs_init()
11765                        ? isolate()->factory()->the_hole_value()
11766                        : isolate()->factory()->undefined_value(), zone());
11767       return;
11768     case VariableLocation::PARAMETER:
11769     case VariableLocation::LOCAL:
11770       if (hole_init) {
11771         HValue* value = graph()->GetConstantHole();
11772         environment()->Bind(variable, value);
11773       }
11774       break;
11775     case VariableLocation::CONTEXT:
11776       if (hole_init) {
11777         HValue* value = graph()->GetConstantHole();
11778         HValue* context = environment()->context();
11779         HStoreContextSlot* store = Add<HStoreContextSlot>(
11780             context, variable->index(), HStoreContextSlot::kNoCheck, value);
11781         if (store->HasObservableSideEffects()) {
11782           Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11783         }
11784       }
11785       break;
11786     case VariableLocation::LOOKUP:
11787       return Bailout(kUnsupportedLookupSlotInDeclaration);
11788   }
11789 }
11790
11791
11792 void HOptimizedGraphBuilder::VisitFunctionDeclaration(
11793     FunctionDeclaration* declaration) {
11794   VariableProxy* proxy = declaration->proxy();
11795   Variable* variable = proxy->var();
11796   switch (variable->location()) {
11797     case VariableLocation::GLOBAL:
11798     case VariableLocation::UNALLOCATED: {
11799       globals_.Add(variable->name(), zone());
11800       Handle<SharedFunctionInfo> function = Compiler::GetSharedFunctionInfo(
11801           declaration->fun(), current_info()->script(), top_info());
11802       // Check for stack-overflow exception.
11803       if (function.is_null()) return SetStackOverflow();
11804       globals_.Add(function, zone());
11805       return;
11806     }
11807     case VariableLocation::PARAMETER:
11808     case VariableLocation::LOCAL: {
11809       CHECK_ALIVE(VisitForValue(declaration->fun()));
11810       HValue* value = Pop();
11811       BindIfLive(variable, value);
11812       break;
11813     }
11814     case VariableLocation::CONTEXT: {
11815       CHECK_ALIVE(VisitForValue(declaration->fun()));
11816       HValue* value = Pop();
11817       HValue* context = environment()->context();
11818       HStoreContextSlot* store = Add<HStoreContextSlot>(
11819           context, variable->index(), HStoreContextSlot::kNoCheck, value);
11820       if (store->HasObservableSideEffects()) {
11821         Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11822       }
11823       break;
11824     }
11825     case VariableLocation::LOOKUP:
11826       return Bailout(kUnsupportedLookupSlotInDeclaration);
11827   }
11828 }
11829
11830
11831 void HOptimizedGraphBuilder::VisitImportDeclaration(
11832     ImportDeclaration* declaration) {
11833   UNREACHABLE();
11834 }
11835
11836
11837 void HOptimizedGraphBuilder::VisitExportDeclaration(
11838     ExportDeclaration* declaration) {
11839   UNREACHABLE();
11840 }
11841
11842
11843 // Generators for inline runtime functions.
11844 // Support for types.
11845 void HOptimizedGraphBuilder::GenerateIsSmi(CallRuntime* call) {
11846   DCHECK(call->arguments()->length() == 1);
11847   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11848   HValue* value = Pop();
11849   HIsSmiAndBranch* result = New<HIsSmiAndBranch>(value);
11850   return ast_context()->ReturnControl(result, call->id());
11851 }
11852
11853
11854 void HOptimizedGraphBuilder::GenerateIsSpecObject(CallRuntime* call) {
11855   DCHECK(call->arguments()->length() == 1);
11856   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11857   HValue* value = Pop();
11858   HHasInstanceTypeAndBranch* result =
11859       New<HHasInstanceTypeAndBranch>(value,
11860                                      FIRST_SPEC_OBJECT_TYPE,
11861                                      LAST_SPEC_OBJECT_TYPE);
11862   return ast_context()->ReturnControl(result, call->id());
11863 }
11864
11865
11866 void HOptimizedGraphBuilder::GenerateIsFunction(CallRuntime* call) {
11867   DCHECK(call->arguments()->length() == 1);
11868   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11869   HValue* value = Pop();
11870   HHasInstanceTypeAndBranch* result =
11871       New<HHasInstanceTypeAndBranch>(value, JS_FUNCTION_TYPE);
11872   return ast_context()->ReturnControl(result, call->id());
11873 }
11874
11875
11876 void HOptimizedGraphBuilder::GenerateIsMinusZero(CallRuntime* call) {
11877   DCHECK(call->arguments()->length() == 1);
11878   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11879   HValue* value = Pop();
11880   HCompareMinusZeroAndBranch* result = New<HCompareMinusZeroAndBranch>(value);
11881   return ast_context()->ReturnControl(result, call->id());
11882 }
11883
11884
11885 void HOptimizedGraphBuilder::GenerateHasCachedArrayIndex(CallRuntime* call) {
11886   DCHECK(call->arguments()->length() == 1);
11887   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11888   HValue* value = Pop();
11889   HHasCachedArrayIndexAndBranch* result =
11890       New<HHasCachedArrayIndexAndBranch>(value);
11891   return ast_context()->ReturnControl(result, call->id());
11892 }
11893
11894
11895 void HOptimizedGraphBuilder::GenerateIsArray(CallRuntime* call) {
11896   DCHECK(call->arguments()->length() == 1);
11897   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11898   HValue* value = Pop();
11899   HHasInstanceTypeAndBranch* result =
11900       New<HHasInstanceTypeAndBranch>(value, JS_ARRAY_TYPE);
11901   return ast_context()->ReturnControl(result, call->id());
11902 }
11903
11904
11905 void HOptimizedGraphBuilder::GenerateIsTypedArray(CallRuntime* call) {
11906   DCHECK(call->arguments()->length() == 1);
11907   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11908   HValue* value = Pop();
11909   HHasInstanceTypeAndBranch* result =
11910       New<HHasInstanceTypeAndBranch>(value, JS_TYPED_ARRAY_TYPE);
11911   return ast_context()->ReturnControl(result, call->id());
11912 }
11913
11914
11915 void HOptimizedGraphBuilder::GenerateIsRegExp(CallRuntime* call) {
11916   DCHECK(call->arguments()->length() == 1);
11917   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11918   HValue* value = Pop();
11919   HHasInstanceTypeAndBranch* result =
11920       New<HHasInstanceTypeAndBranch>(value, JS_REGEXP_TYPE);
11921   return ast_context()->ReturnControl(result, call->id());
11922 }
11923
11924
11925 void HOptimizedGraphBuilder::GenerateIsObject(CallRuntime* call) {
11926   DCHECK(call->arguments()->length() == 1);
11927   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11928   HValue* value = Pop();
11929   HIsObjectAndBranch* result = New<HIsObjectAndBranch>(value);
11930   return ast_context()->ReturnControl(result, call->id());
11931 }
11932
11933
11934 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
11935   DCHECK(call->arguments()->length() == 1);
11936   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11937   HValue* value = Pop();
11938   HIfContinuation continuation;
11939   IfBuilder if_proxy(this);
11940
11941   HValue* smicheck = if_proxy.IfNot<HIsSmiAndBranch>(value);
11942   if_proxy.And();
11943   HValue* map = Add<HLoadNamedField>(value, smicheck, HObjectAccess::ForMap());
11944   HValue* instance_type =
11945       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapInstanceType());
11946   if_proxy.If<HCompareNumericAndBranch>(
11947       instance_type, Add<HConstant>(FIRST_JS_PROXY_TYPE), Token::GTE);
11948   if_proxy.And();
11949   if_proxy.If<HCompareNumericAndBranch>(
11950       instance_type, Add<HConstant>(LAST_JS_PROXY_TYPE), Token::LTE);
11951
11952   if_proxy.CaptureContinuation(&continuation);
11953   return ast_context()->ReturnContinuation(&continuation, call->id());
11954 }
11955
11956
11957 void HOptimizedGraphBuilder::GenerateHasFastPackedElements(CallRuntime* call) {
11958   DCHECK(call->arguments()->length() == 1);
11959   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11960   HValue* object = Pop();
11961   HIfContinuation continuation(graph()->CreateBasicBlock(),
11962                                graph()->CreateBasicBlock());
11963   IfBuilder if_not_smi(this);
11964   if_not_smi.IfNot<HIsSmiAndBranch>(object);
11965   if_not_smi.Then();
11966   {
11967     NoObservableSideEffectsScope no_effects(this);
11968
11969     IfBuilder if_fast_packed(this);
11970     HValue* elements_kind = BuildGetElementsKind(object);
11971     if_fast_packed.If<HCompareNumericAndBranch>(
11972         elements_kind, Add<HConstant>(FAST_SMI_ELEMENTS), Token::EQ);
11973     if_fast_packed.Or();
11974     if_fast_packed.If<HCompareNumericAndBranch>(
11975         elements_kind, Add<HConstant>(FAST_ELEMENTS), Token::EQ);
11976     if_fast_packed.Or();
11977     if_fast_packed.If<HCompareNumericAndBranch>(
11978         elements_kind, Add<HConstant>(FAST_DOUBLE_ELEMENTS), Token::EQ);
11979     if_fast_packed.JoinContinuation(&continuation);
11980   }
11981   if_not_smi.JoinContinuation(&continuation);
11982   return ast_context()->ReturnContinuation(&continuation, call->id());
11983 }
11984
11985
11986 void HOptimizedGraphBuilder::GenerateIsUndetectableObject(CallRuntime* call) {
11987   DCHECK(call->arguments()->length() == 1);
11988   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11989   HValue* value = Pop();
11990   HIsUndetectableAndBranch* result = New<HIsUndetectableAndBranch>(value);
11991   return ast_context()->ReturnControl(result, call->id());
11992 }
11993
11994
11995 // Support for construct call checks.
11996 void HOptimizedGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
11997   DCHECK(call->arguments()->length() == 0);
11998   if (function_state()->outer() != NULL) {
11999     // We are generating graph for inlined function.
12000     HValue* value = function_state()->inlining_kind() == CONSTRUCT_CALL_RETURN
12001         ? graph()->GetConstantTrue()
12002         : graph()->GetConstantFalse();
12003     return ast_context()->ReturnValue(value);
12004   } else {
12005     return ast_context()->ReturnControl(New<HIsConstructCallAndBranch>(),
12006                                         call->id());
12007   }
12008 }
12009
12010
12011 // Support for arguments.length and arguments[?].
12012 void HOptimizedGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
12013   DCHECK(call->arguments()->length() == 0);
12014   HInstruction* result = NULL;
12015   if (function_state()->outer() == NULL) {
12016     HInstruction* elements = Add<HArgumentsElements>(false);
12017     result = New<HArgumentsLength>(elements);
12018   } else {
12019     // Number of arguments without receiver.
12020     int argument_count = environment()->
12021         arguments_environment()->parameter_count() - 1;
12022     result = New<HConstant>(argument_count);
12023   }
12024   return ast_context()->ReturnInstruction(result, call->id());
12025 }
12026
12027
12028 void HOptimizedGraphBuilder::GenerateArguments(CallRuntime* call) {
12029   DCHECK(call->arguments()->length() == 1);
12030   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12031   HValue* index = Pop();
12032   HInstruction* result = NULL;
12033   if (function_state()->outer() == NULL) {
12034     HInstruction* elements = Add<HArgumentsElements>(false);
12035     HInstruction* length = Add<HArgumentsLength>(elements);
12036     HInstruction* checked_index = Add<HBoundsCheck>(index, length);
12037     result = New<HAccessArgumentsAt>(elements, length, checked_index);
12038   } else {
12039     EnsureArgumentsArePushedForAccess();
12040
12041     // Number of arguments without receiver.
12042     HInstruction* elements = function_state()->arguments_elements();
12043     int argument_count = environment()->
12044         arguments_environment()->parameter_count() - 1;
12045     HInstruction* length = Add<HConstant>(argument_count);
12046     HInstruction* checked_key = Add<HBoundsCheck>(index, length);
12047     result = New<HAccessArgumentsAt>(elements, length, checked_key);
12048   }
12049   return ast_context()->ReturnInstruction(result, call->id());
12050 }
12051
12052
12053 void HOptimizedGraphBuilder::GenerateValueOf(CallRuntime* call) {
12054   DCHECK(call->arguments()->length() == 1);
12055   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12056   HValue* object = Pop();
12057
12058   IfBuilder if_objectisvalue(this);
12059   HValue* objectisvalue = if_objectisvalue.If<HHasInstanceTypeAndBranch>(
12060       object, JS_VALUE_TYPE);
12061   if_objectisvalue.Then();
12062   {
12063     // Return the actual value.
12064     Push(Add<HLoadNamedField>(
12065             object, objectisvalue,
12066             HObjectAccess::ForObservableJSObjectOffset(
12067                 JSValue::kValueOffset)));
12068     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12069   }
12070   if_objectisvalue.Else();
12071   {
12072     // If the object is not a value return the object.
12073     Push(object);
12074     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12075   }
12076   if_objectisvalue.End();
12077   return ast_context()->ReturnValue(Pop());
12078 }
12079
12080
12081 void HOptimizedGraphBuilder::GenerateJSValueGetValue(CallRuntime* call) {
12082   DCHECK(call->arguments()->length() == 1);
12083   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12084   HValue* value = Pop();
12085   HInstruction* result = Add<HLoadNamedField>(
12086       value, nullptr,
12087       HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset));
12088   return ast_context()->ReturnInstruction(result, call->id());
12089 }
12090
12091
12092 void HOptimizedGraphBuilder::GenerateIsDate(CallRuntime* call) {
12093   DCHECK_EQ(1, call->arguments()->length());
12094   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12095   HValue* value = Pop();
12096   HHasInstanceTypeAndBranch* result =
12097       New<HHasInstanceTypeAndBranch>(value, JS_DATE_TYPE);
12098   return ast_context()->ReturnControl(result, call->id());
12099 }
12100
12101
12102 void HOptimizedGraphBuilder::GenerateThrowNotDateError(CallRuntime* call) {
12103   DCHECK_EQ(0, call->arguments()->length());
12104   Add<HDeoptimize>(Deoptimizer::kNotADateObject, Deoptimizer::EAGER);
12105   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12106   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12107 }
12108
12109
12110 void HOptimizedGraphBuilder::GenerateDateField(CallRuntime* call) {
12111   DCHECK(call->arguments()->length() == 2);
12112   DCHECK_NOT_NULL(call->arguments()->at(1)->AsLiteral());
12113   Smi* index = Smi::cast(*(call->arguments()->at(1)->AsLiteral()->value()));
12114   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12115   HValue* date = Pop();
12116   HDateField* result = New<HDateField>(date, index);
12117   return ast_context()->ReturnInstruction(result, call->id());
12118 }
12119
12120
12121 void HOptimizedGraphBuilder::GenerateOneByteSeqStringSetChar(
12122     CallRuntime* call) {
12123   DCHECK(call->arguments()->length() == 3);
12124   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12125   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12126   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12127   HValue* string = Pop();
12128   HValue* value = Pop();
12129   HValue* index = Pop();
12130   Add<HSeqStringSetChar>(String::ONE_BYTE_ENCODING, string,
12131                          index, value);
12132   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12133   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12134 }
12135
12136
12137 void HOptimizedGraphBuilder::GenerateTwoByteSeqStringSetChar(
12138     CallRuntime* call) {
12139   DCHECK(call->arguments()->length() == 3);
12140   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12141   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12142   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12143   HValue* string = Pop();
12144   HValue* value = Pop();
12145   HValue* index = Pop();
12146   Add<HSeqStringSetChar>(String::TWO_BYTE_ENCODING, string,
12147                          index, value);
12148   Add<HSimulate>(call->id(), FIXED_SIMULATE);
12149   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12150 }
12151
12152
12153 void HOptimizedGraphBuilder::GenerateSetValueOf(CallRuntime* call) {
12154   DCHECK(call->arguments()->length() == 2);
12155   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12156   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12157   HValue* value = Pop();
12158   HValue* object = Pop();
12159
12160   // Check if object is a JSValue.
12161   IfBuilder if_objectisvalue(this);
12162   if_objectisvalue.If<HHasInstanceTypeAndBranch>(object, JS_VALUE_TYPE);
12163   if_objectisvalue.Then();
12164   {
12165     // Create in-object property store to kValueOffset.
12166     Add<HStoreNamedField>(object,
12167         HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset),
12168         value);
12169     if (!ast_context()->IsEffect()) {
12170       Push(value);
12171     }
12172     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12173   }
12174   if_objectisvalue.Else();
12175   {
12176     // Nothing to do in this case.
12177     if (!ast_context()->IsEffect()) {
12178       Push(value);
12179     }
12180     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12181   }
12182   if_objectisvalue.End();
12183   if (!ast_context()->IsEffect()) {
12184     Drop(1);
12185   }
12186   return ast_context()->ReturnValue(value);
12187 }
12188
12189
12190 // Fast support for charCodeAt(n).
12191 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
12192   DCHECK(call->arguments()->length() == 2);
12193   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12194   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12195   HValue* index = Pop();
12196   HValue* string = Pop();
12197   HInstruction* result = BuildStringCharCodeAt(string, index);
12198   return ast_context()->ReturnInstruction(result, call->id());
12199 }
12200
12201
12202 // Fast support for string.charAt(n) and string[n].
12203 void HOptimizedGraphBuilder::GenerateStringCharFromCode(CallRuntime* call) {
12204   DCHECK(call->arguments()->length() == 1);
12205   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12206   HValue* char_code = Pop();
12207   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12208   return ast_context()->ReturnInstruction(result, call->id());
12209 }
12210
12211
12212 // Fast support for string.charAt(n) and string[n].
12213 void HOptimizedGraphBuilder::GenerateStringCharAt(CallRuntime* call) {
12214   DCHECK(call->arguments()->length() == 2);
12215   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12216   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12217   HValue* index = Pop();
12218   HValue* string = Pop();
12219   HInstruction* char_code = BuildStringCharCodeAt(string, index);
12220   AddInstruction(char_code);
12221   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
12222   return ast_context()->ReturnInstruction(result, call->id());
12223 }
12224
12225
12226 // Fast support for object equality testing.
12227 void HOptimizedGraphBuilder::GenerateObjectEquals(CallRuntime* call) {
12228   DCHECK(call->arguments()->length() == 2);
12229   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12230   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12231   HValue* right = Pop();
12232   HValue* left = Pop();
12233   HCompareObjectEqAndBranch* result =
12234       New<HCompareObjectEqAndBranch>(left, right);
12235   return ast_context()->ReturnControl(result, call->id());
12236 }
12237
12238
12239 // Fast support for StringAdd.
12240 void HOptimizedGraphBuilder::GenerateStringAdd(CallRuntime* call) {
12241   DCHECK_EQ(2, call->arguments()->length());
12242   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12243   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12244   HValue* right = Pop();
12245   HValue* left = Pop();
12246   HInstruction* result =
12247       NewUncasted<HStringAdd>(left, right, strength(function_language_mode()));
12248   return ast_context()->ReturnInstruction(result, call->id());
12249 }
12250
12251
12252 // Fast support for SubString.
12253 void HOptimizedGraphBuilder::GenerateSubString(CallRuntime* call) {
12254   DCHECK_EQ(3, call->arguments()->length());
12255   CHECK_ALIVE(VisitExpressions(call->arguments()));
12256   PushArgumentsFromEnvironment(call->arguments()->length());
12257   HCallStub* result = New<HCallStub>(CodeStub::SubString, 3);
12258   return ast_context()->ReturnInstruction(result, call->id());
12259 }
12260
12261
12262 // Fast support for StringCompare.
12263 void HOptimizedGraphBuilder::GenerateStringCompare(CallRuntime* call) {
12264   DCHECK_EQ(2, call->arguments()->length());
12265   CHECK_ALIVE(VisitExpressions(call->arguments()));
12266   PushArgumentsFromEnvironment(call->arguments()->length());
12267   HCallStub* result = New<HCallStub>(CodeStub::StringCompare, 2);
12268   return ast_context()->ReturnInstruction(result, call->id());
12269 }
12270
12271
12272 void HOptimizedGraphBuilder::GenerateStringGetLength(CallRuntime* call) {
12273   DCHECK(call->arguments()->length() == 1);
12274   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12275   HValue* string = Pop();
12276   HInstruction* result = BuildLoadStringLength(string);
12277   return ast_context()->ReturnInstruction(result, call->id());
12278 }
12279
12280
12281 // Support for direct calls from JavaScript to native RegExp code.
12282 void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
12283   DCHECK_EQ(4, call->arguments()->length());
12284   CHECK_ALIVE(VisitExpressions(call->arguments()));
12285   PushArgumentsFromEnvironment(call->arguments()->length());
12286   HCallStub* result = New<HCallStub>(CodeStub::RegExpExec, 4);
12287   return ast_context()->ReturnInstruction(result, call->id());
12288 }
12289
12290
12291 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
12292   DCHECK_EQ(1, call->arguments()->length());
12293   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12294   HValue* value = Pop();
12295   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::LOW);
12296   return ast_context()->ReturnInstruction(result, call->id());
12297 }
12298
12299
12300 void HOptimizedGraphBuilder::GenerateDoubleHi(CallRuntime* call) {
12301   DCHECK_EQ(1, call->arguments()->length());
12302   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12303   HValue* value = Pop();
12304   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::HIGH);
12305   return ast_context()->ReturnInstruction(result, call->id());
12306 }
12307
12308
12309 void HOptimizedGraphBuilder::GenerateConstructDouble(CallRuntime* call) {
12310   DCHECK_EQ(2, call->arguments()->length());
12311   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12312   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12313   HValue* lo = Pop();
12314   HValue* hi = Pop();
12315   HInstruction* result = NewUncasted<HConstructDouble>(hi, lo);
12316   return ast_context()->ReturnInstruction(result, call->id());
12317 }
12318
12319
12320 // Construct a RegExp exec result with two in-object properties.
12321 void HOptimizedGraphBuilder::GenerateRegExpConstructResult(CallRuntime* call) {
12322   DCHECK_EQ(3, call->arguments()->length());
12323   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12324   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12325   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12326   HValue* input = Pop();
12327   HValue* index = Pop();
12328   HValue* length = Pop();
12329   HValue* result = BuildRegExpConstructResult(length, index, input);
12330   return ast_context()->ReturnValue(result);
12331 }
12332
12333
12334 // Support for fast native caches.
12335 void HOptimizedGraphBuilder::GenerateGetFromCache(CallRuntime* call) {
12336   return Bailout(kInlinedRuntimeFunctionGetFromCache);
12337 }
12338
12339
12340 // Fast support for number to string.
12341 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
12342   DCHECK_EQ(1, call->arguments()->length());
12343   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12344   HValue* number = Pop();
12345   HValue* result = BuildNumberToString(number, Type::Any(zone()));
12346   return ast_context()->ReturnValue(result);
12347 }
12348
12349
12350 // Fast call for custom callbacks.
12351 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
12352   // 1 ~ The function to call is not itself an argument to the call.
12353   int arg_count = call->arguments()->length() - 1;
12354   DCHECK(arg_count >= 1);  // There's always at least a receiver.
12355
12356   CHECK_ALIVE(VisitExpressions(call->arguments()));
12357   // The function is the last argument
12358   HValue* function = Pop();
12359   // Push the arguments to the stack
12360   PushArgumentsFromEnvironment(arg_count);
12361
12362   IfBuilder if_is_jsfunction(this);
12363   if_is_jsfunction.If<HHasInstanceTypeAndBranch>(function, JS_FUNCTION_TYPE);
12364
12365   if_is_jsfunction.Then();
12366   {
12367     HInstruction* invoke_result =
12368         Add<HInvokeFunction>(function, arg_count);
12369     if (!ast_context()->IsEffect()) {
12370       Push(invoke_result);
12371     }
12372     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12373   }
12374
12375   if_is_jsfunction.Else();
12376   {
12377     HInstruction* call_result =
12378         Add<HCallFunction>(function, arg_count);
12379     if (!ast_context()->IsEffect()) {
12380       Push(call_result);
12381     }
12382     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12383   }
12384   if_is_jsfunction.End();
12385
12386   if (ast_context()->IsEffect()) {
12387     // EffectContext::ReturnValue ignores the value, so we can just pass
12388     // 'undefined' (as we do not have the call result anymore).
12389     return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12390   } else {
12391     return ast_context()->ReturnValue(Pop());
12392   }
12393 }
12394
12395
12396 // Fast call to math functions.
12397 void HOptimizedGraphBuilder::GenerateMathPow(CallRuntime* call) {
12398   DCHECK_EQ(2, call->arguments()->length());
12399   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12400   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12401   HValue* right = Pop();
12402   HValue* left = Pop();
12403   HInstruction* result = NewUncasted<HPower>(left, right);
12404   return ast_context()->ReturnInstruction(result, call->id());
12405 }
12406
12407
12408 void HOptimizedGraphBuilder::GenerateMathClz32(CallRuntime* call) {
12409   DCHECK(call->arguments()->length() == 1);
12410   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12411   HValue* value = Pop();
12412   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathClz32);
12413   return ast_context()->ReturnInstruction(result, call->id());
12414 }
12415
12416
12417 void HOptimizedGraphBuilder::GenerateMathFloor(CallRuntime* call) {
12418   DCHECK(call->arguments()->length() == 1);
12419   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12420   HValue* value = Pop();
12421   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathFloor);
12422   return ast_context()->ReturnInstruction(result, call->id());
12423 }
12424
12425
12426 void HOptimizedGraphBuilder::GenerateMathLogRT(CallRuntime* call) {
12427   DCHECK(call->arguments()->length() == 1);
12428   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12429   HValue* value = Pop();
12430   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathLog);
12431   return ast_context()->ReturnInstruction(result, call->id());
12432 }
12433
12434
12435 void HOptimizedGraphBuilder::GenerateMathSqrt(CallRuntime* call) {
12436   DCHECK(call->arguments()->length() == 1);
12437   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12438   HValue* value = Pop();
12439   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathSqrt);
12440   return ast_context()->ReturnInstruction(result, call->id());
12441 }
12442
12443
12444 void HOptimizedGraphBuilder::GenerateLikely(CallRuntime* call) {
12445   DCHECK(call->arguments()->length() == 1);
12446   Visit(call->arguments()->at(0));
12447 }
12448
12449
12450 void HOptimizedGraphBuilder::GenerateUnlikely(CallRuntime* call) {
12451   return GenerateLikely(call);
12452 }
12453
12454
12455 void HOptimizedGraphBuilder::GenerateFixedArrayGet(CallRuntime* call) {
12456   DCHECK(call->arguments()->length() == 2);
12457   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12458   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12459   HValue* index = Pop();
12460   HValue* object = Pop();
12461   HInstruction* result = New<HLoadKeyed>(
12462       object, index, nullptr, FAST_HOLEY_ELEMENTS, ALLOW_RETURN_HOLE);
12463   return ast_context()->ReturnInstruction(result, call->id());
12464 }
12465
12466
12467 void HOptimizedGraphBuilder::GenerateFixedArraySet(CallRuntime* call) {
12468   DCHECK(call->arguments()->length() == 3);
12469   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12470   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12471   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
12472   HValue* value = Pop();
12473   HValue* index = Pop();
12474   HValue* object = Pop();
12475   NoObservableSideEffectsScope no_effects(this);
12476   Add<HStoreKeyed>(object, index, value, FAST_HOLEY_ELEMENTS);
12477   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12478 }
12479
12480
12481 void HOptimizedGraphBuilder::GenerateTheHole(CallRuntime* call) {
12482   DCHECK(call->arguments()->length() == 0);
12483   return ast_context()->ReturnValue(graph()->GetConstantHole());
12484 }
12485
12486
12487 void HOptimizedGraphBuilder::GenerateJSCollectionGetTable(CallRuntime* call) {
12488   DCHECK(call->arguments()->length() == 1);
12489   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12490   HValue* receiver = Pop();
12491   HInstruction* result = New<HLoadNamedField>(
12492       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12493   return ast_context()->ReturnInstruction(result, call->id());
12494 }
12495
12496
12497 void HOptimizedGraphBuilder::GenerateStringGetRawHashField(CallRuntime* call) {
12498   DCHECK(call->arguments()->length() == 1);
12499   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12500   HValue* object = Pop();
12501   HInstruction* result = New<HLoadNamedField>(
12502       object, nullptr, HObjectAccess::ForStringHashField());
12503   return ast_context()->ReturnInstruction(result, call->id());
12504 }
12505
12506
12507 template <typename CollectionType>
12508 HValue* HOptimizedGraphBuilder::BuildAllocateOrderedHashTable() {
12509   static const int kCapacity = CollectionType::kMinCapacity;
12510   static const int kBucketCount = kCapacity / CollectionType::kLoadFactor;
12511   static const int kFixedArrayLength = CollectionType::kHashTableStartIndex +
12512                                        kBucketCount +
12513                                        (kCapacity * CollectionType::kEntrySize);
12514   static const int kSizeInBytes =
12515       FixedArray::kHeaderSize + (kFixedArrayLength * kPointerSize);
12516
12517   // Allocate the table and add the proper map.
12518   HValue* table =
12519       Add<HAllocate>(Add<HConstant>(kSizeInBytes), HType::HeapObject(),
12520                      NOT_TENURED, FIXED_ARRAY_TYPE);
12521   AddStoreMapConstant(table, isolate()->factory()->ordered_hash_table_map());
12522
12523   // Initialize the FixedArray...
12524   HValue* length = Add<HConstant>(kFixedArrayLength);
12525   Add<HStoreNamedField>(table, HObjectAccess::ForFixedArrayLength(), length);
12526
12527   // ...and the OrderedHashTable fields.
12528   Add<HStoreNamedField>(
12529       table,
12530       HObjectAccess::ForOrderedHashTableNumberOfBuckets<CollectionType>(),
12531       Add<HConstant>(kBucketCount));
12532   Add<HStoreNamedField>(
12533       table,
12534       HObjectAccess::ForOrderedHashTableNumberOfElements<CollectionType>(),
12535       graph()->GetConstant0());
12536   Add<HStoreNamedField>(
12537       table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12538                  CollectionType>(),
12539       graph()->GetConstant0());
12540
12541   // Fill the buckets with kNotFound.
12542   HValue* not_found = Add<HConstant>(CollectionType::kNotFound);
12543   for (int i = 0; i < kBucketCount; ++i) {
12544     Add<HStoreNamedField>(
12545         table, HObjectAccess::ForOrderedHashTableBucket<CollectionType>(i),
12546         not_found);
12547   }
12548
12549   // Fill the data table with undefined.
12550   HValue* undefined = graph()->GetConstantUndefined();
12551   for (int i = 0; i < (kCapacity * CollectionType::kEntrySize); ++i) {
12552     Add<HStoreNamedField>(table,
12553                           HObjectAccess::ForOrderedHashTableDataTableIndex<
12554                               CollectionType, kBucketCount>(i),
12555                           undefined);
12556   }
12557
12558   return table;
12559 }
12560
12561
12562 void HOptimizedGraphBuilder::GenerateSetInitialize(CallRuntime* call) {
12563   DCHECK(call->arguments()->length() == 1);
12564   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12565   HValue* receiver = Pop();
12566
12567   NoObservableSideEffectsScope no_effects(this);
12568   HValue* table = BuildAllocateOrderedHashTable<OrderedHashSet>();
12569   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12570   return ast_context()->ReturnValue(receiver);
12571 }
12572
12573
12574 void HOptimizedGraphBuilder::GenerateMapInitialize(CallRuntime* call) {
12575   DCHECK(call->arguments()->length() == 1);
12576   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12577   HValue* receiver = Pop();
12578
12579   NoObservableSideEffectsScope no_effects(this);
12580   HValue* table = BuildAllocateOrderedHashTable<OrderedHashMap>();
12581   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(), table);
12582   return ast_context()->ReturnValue(receiver);
12583 }
12584
12585
12586 template <typename CollectionType>
12587 void HOptimizedGraphBuilder::BuildOrderedHashTableClear(HValue* receiver) {
12588   HValue* old_table = Add<HLoadNamedField>(
12589       receiver, nullptr, HObjectAccess::ForJSCollectionTable());
12590   HValue* new_table = BuildAllocateOrderedHashTable<CollectionType>();
12591   Add<HStoreNamedField>(
12592       old_table, HObjectAccess::ForOrderedHashTableNextTable<CollectionType>(),
12593       new_table);
12594   Add<HStoreNamedField>(
12595       old_table, HObjectAccess::ForOrderedHashTableNumberOfDeletedElements<
12596                      CollectionType>(),
12597       Add<HConstant>(CollectionType::kClearedTableSentinel));
12598   Add<HStoreNamedField>(receiver, HObjectAccess::ForJSCollectionTable(),
12599                         new_table);
12600 }
12601
12602
12603 void HOptimizedGraphBuilder::GenerateSetClear(CallRuntime* call) {
12604   DCHECK(call->arguments()->length() == 1);
12605   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12606   HValue* receiver = Pop();
12607
12608   NoObservableSideEffectsScope no_effects(this);
12609   BuildOrderedHashTableClear<OrderedHashSet>(receiver);
12610   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12611 }
12612
12613
12614 void HOptimizedGraphBuilder::GenerateMapClear(CallRuntime* call) {
12615   DCHECK(call->arguments()->length() == 1);
12616   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12617   HValue* receiver = Pop();
12618
12619   NoObservableSideEffectsScope no_effects(this);
12620   BuildOrderedHashTableClear<OrderedHashMap>(receiver);
12621   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12622 }
12623
12624
12625 void HOptimizedGraphBuilder::GenerateGetCachedArrayIndex(CallRuntime* call) {
12626   DCHECK(call->arguments()->length() == 1);
12627   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12628   HValue* value = Pop();
12629   HGetCachedArrayIndex* result = New<HGetCachedArrayIndex>(value);
12630   return ast_context()->ReturnInstruction(result, call->id());
12631 }
12632
12633
12634 void HOptimizedGraphBuilder::GenerateFastOneByteArrayJoin(CallRuntime* call) {
12635   // Simply returning undefined here would be semantically correct and even
12636   // avoid the bailout. Nevertheless, some ancient benchmarks like SunSpider's
12637   // string-fasta would tank, because fullcode contains an optimized version.
12638   // Obviously the fullcode => Crankshaft => bailout => fullcode dance is
12639   // faster... *sigh*
12640   return Bailout(kInlinedRuntimeFunctionFastOneByteArrayJoin);
12641 }
12642
12643
12644 void HOptimizedGraphBuilder::GenerateDebugBreakInOptimizedCode(
12645     CallRuntime* call) {
12646   Add<HDebugBreak>();
12647   return ast_context()->ReturnValue(graph()->GetConstant0());
12648 }
12649
12650
12651 void HOptimizedGraphBuilder::GenerateDebugIsActive(CallRuntime* call) {
12652   DCHECK(call->arguments()->length() == 0);
12653   HValue* ref =
12654       Add<HConstant>(ExternalReference::debug_is_active_address(isolate()));
12655   HValue* value =
12656       Add<HLoadNamedField>(ref, nullptr, HObjectAccess::ForExternalUInteger8());
12657   return ast_context()->ReturnValue(value);
12658 }
12659
12660
12661 void HOptimizedGraphBuilder::GenerateGetPrototype(CallRuntime* call) {
12662   DCHECK(call->arguments()->length() == 1);
12663   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12664   HValue* object = Pop();
12665
12666   NoObservableSideEffectsScope no_effects(this);
12667
12668   HValue* map = Add<HLoadNamedField>(object, nullptr, HObjectAccess::ForMap());
12669   HValue* bit_field =
12670       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForMapBitField());
12671   HValue* is_access_check_needed_mask =
12672       Add<HConstant>(1 << Map::kIsAccessCheckNeeded);
12673   HValue* is_access_check_needed_test = AddUncasted<HBitwise>(
12674       Token::BIT_AND, bit_field, is_access_check_needed_mask);
12675
12676   HValue* proto =
12677       Add<HLoadNamedField>(map, nullptr, HObjectAccess::ForPrototype());
12678   HValue* proto_map =
12679       Add<HLoadNamedField>(proto, nullptr, HObjectAccess::ForMap());
12680   HValue* proto_bit_field =
12681       Add<HLoadNamedField>(proto_map, nullptr, HObjectAccess::ForMapBitField());
12682   HValue* is_hidden_prototype_mask =
12683       Add<HConstant>(1 << Map::kIsHiddenPrototype);
12684   HValue* is_hidden_prototype_test = AddUncasted<HBitwise>(
12685       Token::BIT_AND, proto_bit_field, is_hidden_prototype_mask);
12686
12687   {
12688     IfBuilder needs_runtime(this);
12689     needs_runtime.If<HCompareNumericAndBranch>(
12690         is_access_check_needed_test, graph()->GetConstant0(), Token::NE);
12691     needs_runtime.OrIf<HCompareNumericAndBranch>(
12692         is_hidden_prototype_test, graph()->GetConstant0(), Token::NE);
12693
12694     needs_runtime.Then();
12695     {
12696       Add<HPushArguments>(object);
12697       Push(Add<HCallRuntime>(
12698           call->name(), Runtime::FunctionForId(Runtime::kGetPrototype), 1));
12699     }
12700
12701     needs_runtime.Else();
12702     Push(proto);
12703   }
12704   return ast_context()->ReturnValue(Pop());
12705 }
12706
12707
12708 #undef CHECK_BAILOUT
12709 #undef CHECK_ALIVE
12710
12711
12712 HEnvironment::HEnvironment(HEnvironment* outer,
12713                            Scope* scope,
12714                            Handle<JSFunction> closure,
12715                            Zone* zone)
12716     : closure_(closure),
12717       values_(0, zone),
12718       frame_type_(JS_FUNCTION),
12719       parameter_count_(0),
12720       specials_count_(1),
12721       local_count_(0),
12722       outer_(outer),
12723       entry_(NULL),
12724       pop_count_(0),
12725       push_count_(0),
12726       ast_id_(BailoutId::None()),
12727       zone_(zone) {
12728   Scope* declaration_scope = scope->DeclarationScope();
12729   Initialize(declaration_scope->num_parameters() + 1,
12730              declaration_scope->num_stack_slots(), 0);
12731 }
12732
12733
12734 HEnvironment::HEnvironment(Zone* zone, int parameter_count)
12735     : values_(0, zone),
12736       frame_type_(STUB),
12737       parameter_count_(parameter_count),
12738       specials_count_(1),
12739       local_count_(0),
12740       outer_(NULL),
12741       entry_(NULL),
12742       pop_count_(0),
12743       push_count_(0),
12744       ast_id_(BailoutId::None()),
12745       zone_(zone) {
12746   Initialize(parameter_count, 0, 0);
12747 }
12748
12749
12750 HEnvironment::HEnvironment(const HEnvironment* other, Zone* zone)
12751     : values_(0, zone),
12752       frame_type_(JS_FUNCTION),
12753       parameter_count_(0),
12754       specials_count_(0),
12755       local_count_(0),
12756       outer_(NULL),
12757       entry_(NULL),
12758       pop_count_(0),
12759       push_count_(0),
12760       ast_id_(other->ast_id()),
12761       zone_(zone) {
12762   Initialize(other);
12763 }
12764
12765
12766 HEnvironment::HEnvironment(HEnvironment* outer,
12767                            Handle<JSFunction> closure,
12768                            FrameType frame_type,
12769                            int arguments,
12770                            Zone* zone)
12771     : closure_(closure),
12772       values_(arguments, zone),
12773       frame_type_(frame_type),
12774       parameter_count_(arguments),
12775       specials_count_(0),
12776       local_count_(0),
12777       outer_(outer),
12778       entry_(NULL),
12779       pop_count_(0),
12780       push_count_(0),
12781       ast_id_(BailoutId::None()),
12782       zone_(zone) {
12783 }
12784
12785
12786 void HEnvironment::Initialize(int parameter_count,
12787                               int local_count,
12788                               int stack_height) {
12789   parameter_count_ = parameter_count;
12790   local_count_ = local_count;
12791
12792   // Avoid reallocating the temporaries' backing store on the first Push.
12793   int total = parameter_count + specials_count_ + local_count + stack_height;
12794   values_.Initialize(total + 4, zone());
12795   for (int i = 0; i < total; ++i) values_.Add(NULL, zone());
12796 }
12797
12798
12799 void HEnvironment::Initialize(const HEnvironment* other) {
12800   closure_ = other->closure();
12801   values_.AddAll(other->values_, zone());
12802   assigned_variables_.Union(other->assigned_variables_, zone());
12803   frame_type_ = other->frame_type_;
12804   parameter_count_ = other->parameter_count_;
12805   local_count_ = other->local_count_;
12806   if (other->outer_ != NULL) outer_ = other->outer_->Copy();  // Deep copy.
12807   entry_ = other->entry_;
12808   pop_count_ = other->pop_count_;
12809   push_count_ = other->push_count_;
12810   specials_count_ = other->specials_count_;
12811   ast_id_ = other->ast_id_;
12812 }
12813
12814
12815 void HEnvironment::AddIncomingEdge(HBasicBlock* block, HEnvironment* other) {
12816   DCHECK(!block->IsLoopHeader());
12817   DCHECK(values_.length() == other->values_.length());
12818
12819   int length = values_.length();
12820   for (int i = 0; i < length; ++i) {
12821     HValue* value = values_[i];
12822     if (value != NULL && value->IsPhi() && value->block() == block) {
12823       // There is already a phi for the i'th value.
12824       HPhi* phi = HPhi::cast(value);
12825       // Assert index is correct and that we haven't missed an incoming edge.
12826       DCHECK(phi->merged_index() == i || !phi->HasMergedIndex());
12827       DCHECK(phi->OperandCount() == block->predecessors()->length());
12828       phi->AddInput(other->values_[i]);
12829     } else if (values_[i] != other->values_[i]) {
12830       // There is a fresh value on the incoming edge, a phi is needed.
12831       DCHECK(values_[i] != NULL && other->values_[i] != NULL);
12832       HPhi* phi = block->AddNewPhi(i);
12833       HValue* old_value = values_[i];
12834       for (int j = 0; j < block->predecessors()->length(); j++) {
12835         phi->AddInput(old_value);
12836       }
12837       phi->AddInput(other->values_[i]);
12838       this->values_[i] = phi;
12839     }
12840   }
12841 }
12842
12843
12844 void HEnvironment::Bind(int index, HValue* value) {
12845   DCHECK(value != NULL);
12846   assigned_variables_.Add(index, zone());
12847   values_[index] = value;
12848 }
12849
12850
12851 bool HEnvironment::HasExpressionAt(int index) const {
12852   return index >= parameter_count_ + specials_count_ + local_count_;
12853 }
12854
12855
12856 bool HEnvironment::ExpressionStackIsEmpty() const {
12857   DCHECK(length() >= first_expression_index());
12858   return length() == first_expression_index();
12859 }
12860
12861
12862 void HEnvironment::SetExpressionStackAt(int index_from_top, HValue* value) {
12863   int count = index_from_top + 1;
12864   int index = values_.length() - count;
12865   DCHECK(HasExpressionAt(index));
12866   // The push count must include at least the element in question or else
12867   // the new value will not be included in this environment's history.
12868   if (push_count_ < count) {
12869     // This is the same effect as popping then re-pushing 'count' elements.
12870     pop_count_ += (count - push_count_);
12871     push_count_ = count;
12872   }
12873   values_[index] = value;
12874 }
12875
12876
12877 HValue* HEnvironment::RemoveExpressionStackAt(int index_from_top) {
12878   int count = index_from_top + 1;
12879   int index = values_.length() - count;
12880   DCHECK(HasExpressionAt(index));
12881   // Simulate popping 'count' elements and then
12882   // pushing 'count - 1' elements back.
12883   pop_count_ += Max(count - push_count_, 0);
12884   push_count_ = Max(push_count_ - count, 0) + (count - 1);
12885   return values_.Remove(index);
12886 }
12887
12888
12889 void HEnvironment::Drop(int count) {
12890   for (int i = 0; i < count; ++i) {
12891     Pop();
12892   }
12893 }
12894
12895
12896 HEnvironment* HEnvironment::Copy() const {
12897   return new(zone()) HEnvironment(this, zone());
12898 }
12899
12900
12901 HEnvironment* HEnvironment::CopyWithoutHistory() const {
12902   HEnvironment* result = Copy();
12903   result->ClearHistory();
12904   return result;
12905 }
12906
12907
12908 HEnvironment* HEnvironment::CopyAsLoopHeader(HBasicBlock* loop_header) const {
12909   HEnvironment* new_env = Copy();
12910   for (int i = 0; i < values_.length(); ++i) {
12911     HPhi* phi = loop_header->AddNewPhi(i);
12912     phi->AddInput(values_[i]);
12913     new_env->values_[i] = phi;
12914   }
12915   new_env->ClearHistory();
12916   return new_env;
12917 }
12918
12919
12920 HEnvironment* HEnvironment::CreateStubEnvironment(HEnvironment* outer,
12921                                                   Handle<JSFunction> target,
12922                                                   FrameType frame_type,
12923                                                   int arguments) const {
12924   HEnvironment* new_env =
12925       new(zone()) HEnvironment(outer, target, frame_type,
12926                                arguments + 1, zone());
12927   for (int i = 0; i <= arguments; ++i) {  // Include receiver.
12928     new_env->Push(ExpressionStackAt(arguments - i));
12929   }
12930   new_env->ClearHistory();
12931   return new_env;
12932 }
12933
12934
12935 HEnvironment* HEnvironment::CopyForInlining(
12936     Handle<JSFunction> target,
12937     int arguments,
12938     FunctionLiteral* function,
12939     HConstant* undefined,
12940     InliningKind inlining_kind) const {
12941   DCHECK(frame_type() == JS_FUNCTION);
12942
12943   // Outer environment is a copy of this one without the arguments.
12944   int arity = function->scope()->num_parameters();
12945
12946   HEnvironment* outer = Copy();
12947   outer->Drop(arguments + 1);  // Including receiver.
12948   outer->ClearHistory();
12949
12950   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
12951     // Create artificial constructor stub environment.  The receiver should
12952     // actually be the constructor function, but we pass the newly allocated
12953     // object instead, DoComputeConstructStubFrame() relies on that.
12954     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
12955   } else if (inlining_kind == GETTER_CALL_RETURN) {
12956     // We need an additional StackFrame::INTERNAL frame for restoring the
12957     // correct context.
12958     outer = CreateStubEnvironment(outer, target, JS_GETTER, arguments);
12959   } else if (inlining_kind == SETTER_CALL_RETURN) {
12960     // We need an additional StackFrame::INTERNAL frame for temporarily saving
12961     // the argument of the setter, see StoreStubCompiler::CompileStoreViaSetter.
12962     outer = CreateStubEnvironment(outer, target, JS_SETTER, arguments);
12963   }
12964
12965   if (arity != arguments) {
12966     // Create artificial arguments adaptation environment.
12967     outer = CreateStubEnvironment(outer, target, ARGUMENTS_ADAPTOR, arguments);
12968   }
12969
12970   HEnvironment* inner =
12971       new(zone()) HEnvironment(outer, function->scope(), target, zone());
12972   // Get the argument values from the original environment.
12973   for (int i = 0; i <= arity; ++i) {  // Include receiver.
12974     HValue* push = (i <= arguments) ?
12975         ExpressionStackAt(arguments - i) : undefined;
12976     inner->SetValueAt(i, push);
12977   }
12978   inner->SetValueAt(arity + 1, context());
12979   for (int i = arity + 2; i < inner->length(); ++i) {
12980     inner->SetValueAt(i, undefined);
12981   }
12982
12983   inner->set_ast_id(BailoutId::FunctionEntry());
12984   return inner;
12985 }
12986
12987
12988 std::ostream& operator<<(std::ostream& os, const HEnvironment& env) {
12989   for (int i = 0; i < env.length(); i++) {
12990     if (i == 0) os << "parameters\n";
12991     if (i == env.parameter_count()) os << "specials\n";
12992     if (i == env.parameter_count() + env.specials_count()) os << "locals\n";
12993     if (i == env.parameter_count() + env.specials_count() + env.local_count()) {
12994       os << "expressions\n";
12995     }
12996     HValue* val = env.values()->at(i);
12997     os << i << ": ";
12998     if (val != NULL) {
12999       os << val;
13000     } else {
13001       os << "NULL";
13002     }
13003     os << "\n";
13004   }
13005   return os << "\n";
13006 }
13007
13008
13009 void HTracer::TraceCompilation(CompilationInfo* info) {
13010   Tag tag(this, "compilation");
13011   if (info->IsOptimizing()) {
13012     Handle<String> name = info->function()->debug_name();
13013     PrintStringProperty("name", name->ToCString().get());
13014     PrintIndent();
13015     trace_.Add("method \"%s:%d\"\n",
13016                name->ToCString().get(),
13017                info->optimization_id());
13018   } else {
13019     CodeStub::Major major_key = info->code_stub()->MajorKey();
13020     PrintStringProperty("name", CodeStub::MajorName(major_key, false));
13021     PrintStringProperty("method", "stub");
13022   }
13023   PrintLongProperty("date",
13024                     static_cast<int64_t>(base::OS::TimeCurrentMillis()));
13025 }
13026
13027
13028 void HTracer::TraceLithium(const char* name, LChunk* chunk) {
13029   DCHECK(!chunk->isolate()->concurrent_recompilation_enabled());
13030   AllowHandleDereference allow_deref;
13031   AllowDeferredHandleDereference allow_deferred_deref;
13032   Trace(name, chunk->graph(), chunk);
13033 }
13034
13035
13036 void HTracer::TraceHydrogen(const char* name, HGraph* graph) {
13037   DCHECK(!graph->isolate()->concurrent_recompilation_enabled());
13038   AllowHandleDereference allow_deref;
13039   AllowDeferredHandleDereference allow_deferred_deref;
13040   Trace(name, graph, NULL);
13041 }
13042
13043
13044 void HTracer::Trace(const char* name, HGraph* graph, LChunk* chunk) {
13045   Tag tag(this, "cfg");
13046   PrintStringProperty("name", name);
13047   const ZoneList<HBasicBlock*>* blocks = graph->blocks();
13048   for (int i = 0; i < blocks->length(); i++) {
13049     HBasicBlock* current = blocks->at(i);
13050     Tag block_tag(this, "block");
13051     PrintBlockProperty("name", current->block_id());
13052     PrintIntProperty("from_bci", -1);
13053     PrintIntProperty("to_bci", -1);
13054
13055     if (!current->predecessors()->is_empty()) {
13056       PrintIndent();
13057       trace_.Add("predecessors");
13058       for (int j = 0; j < current->predecessors()->length(); ++j) {
13059         trace_.Add(" \"B%d\"", current->predecessors()->at(j)->block_id());
13060       }
13061       trace_.Add("\n");
13062     } else {
13063       PrintEmptyProperty("predecessors");
13064     }
13065
13066     if (current->end()->SuccessorCount() == 0) {
13067       PrintEmptyProperty("successors");
13068     } else  {
13069       PrintIndent();
13070       trace_.Add("successors");
13071       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
13072         trace_.Add(" \"B%d\"", it.Current()->block_id());
13073       }
13074       trace_.Add("\n");
13075     }
13076
13077     PrintEmptyProperty("xhandlers");
13078
13079     {
13080       PrintIndent();
13081       trace_.Add("flags");
13082       if (current->IsLoopSuccessorDominator()) {
13083         trace_.Add(" \"dom-loop-succ\"");
13084       }
13085       if (current->IsUnreachable()) {
13086         trace_.Add(" \"dead\"");
13087       }
13088       if (current->is_osr_entry()) {
13089         trace_.Add(" \"osr\"");
13090       }
13091       trace_.Add("\n");
13092     }
13093
13094     if (current->dominator() != NULL) {
13095       PrintBlockProperty("dominator", current->dominator()->block_id());
13096     }
13097
13098     PrintIntProperty("loop_depth", current->LoopNestingDepth());
13099
13100     if (chunk != NULL) {
13101       int first_index = current->first_instruction_index();
13102       int last_index = current->last_instruction_index();
13103       PrintIntProperty(
13104           "first_lir_id",
13105           LifetimePosition::FromInstructionIndex(first_index).Value());
13106       PrintIntProperty(
13107           "last_lir_id",
13108           LifetimePosition::FromInstructionIndex(last_index).Value());
13109     }
13110
13111     {
13112       Tag states_tag(this, "states");
13113       Tag locals_tag(this, "locals");
13114       int total = current->phis()->length();
13115       PrintIntProperty("size", current->phis()->length());
13116       PrintStringProperty("method", "None");
13117       for (int j = 0; j < total; ++j) {
13118         HPhi* phi = current->phis()->at(j);
13119         PrintIndent();
13120         std::ostringstream os;
13121         os << phi->merged_index() << " " << NameOf(phi) << " " << *phi << "\n";
13122         trace_.Add(os.str().c_str());
13123       }
13124     }
13125
13126     {
13127       Tag HIR_tag(this, "HIR");
13128       for (HInstructionIterator it(current); !it.Done(); it.Advance()) {
13129         HInstruction* instruction = it.Current();
13130         int uses = instruction->UseCount();
13131         PrintIndent();
13132         std::ostringstream os;
13133         os << "0 " << uses << " " << NameOf(instruction) << " " << *instruction;
13134         if (graph->info()->is_tracking_positions() &&
13135             instruction->has_position() && instruction->position().raw() != 0) {
13136           const SourcePosition pos = instruction->position();
13137           os << " pos:";
13138           if (pos.inlining_id() != 0) os << pos.inlining_id() << "_";
13139           os << pos.position();
13140         }
13141         os << " <|@\n";
13142         trace_.Add(os.str().c_str());
13143       }
13144     }
13145
13146
13147     if (chunk != NULL) {
13148       Tag LIR_tag(this, "LIR");
13149       int first_index = current->first_instruction_index();
13150       int last_index = current->last_instruction_index();
13151       if (first_index != -1 && last_index != -1) {
13152         const ZoneList<LInstruction*>* instructions = chunk->instructions();
13153         for (int i = first_index; i <= last_index; ++i) {
13154           LInstruction* linstr = instructions->at(i);
13155           if (linstr != NULL) {
13156             PrintIndent();
13157             trace_.Add("%d ",
13158                        LifetimePosition::FromInstructionIndex(i).Value());
13159             linstr->PrintTo(&trace_);
13160             std::ostringstream os;
13161             os << " [hir:" << NameOf(linstr->hydrogen_value()) << "] <|@\n";
13162             trace_.Add(os.str().c_str());
13163           }
13164         }
13165       }
13166     }
13167   }
13168 }
13169
13170
13171 void HTracer::TraceLiveRanges(const char* name, LAllocator* allocator) {
13172   Tag tag(this, "intervals");
13173   PrintStringProperty("name", name);
13174
13175   const Vector<LiveRange*>* fixed_d = allocator->fixed_double_live_ranges();
13176   for (int i = 0; i < fixed_d->length(); ++i) {
13177     TraceLiveRange(fixed_d->at(i), "fixed", allocator->zone());
13178   }
13179
13180   const Vector<LiveRange*>* fixed = allocator->fixed_live_ranges();
13181   for (int i = 0; i < fixed->length(); ++i) {
13182     TraceLiveRange(fixed->at(i), "fixed", allocator->zone());
13183   }
13184
13185   const ZoneList<LiveRange*>* live_ranges = allocator->live_ranges();
13186   for (int i = 0; i < live_ranges->length(); ++i) {
13187     TraceLiveRange(live_ranges->at(i), "object", allocator->zone());
13188   }
13189 }
13190
13191
13192 void HTracer::TraceLiveRange(LiveRange* range, const char* type,
13193                              Zone* zone) {
13194   if (range != NULL && !range->IsEmpty()) {
13195     PrintIndent();
13196     trace_.Add("%d %s", range->id(), type);
13197     if (range->HasRegisterAssigned()) {
13198       LOperand* op = range->CreateAssignedOperand(zone);
13199       int assigned_reg = op->index();
13200       if (op->IsDoubleRegister()) {
13201         trace_.Add(" \"%s\"",
13202                    DoubleRegister::AllocationIndexToString(assigned_reg));
13203       } else {
13204         DCHECK(op->IsRegister());
13205         trace_.Add(" \"%s\"", Register::AllocationIndexToString(assigned_reg));
13206       }
13207     } else if (range->IsSpilled()) {
13208       LOperand* op = range->TopLevel()->GetSpillOperand();
13209       if (op->IsDoubleStackSlot()) {
13210         trace_.Add(" \"double_stack:%d\"", op->index());
13211       } else {
13212         DCHECK(op->IsStackSlot());
13213         trace_.Add(" \"stack:%d\"", op->index());
13214       }
13215     }
13216     int parent_index = -1;
13217     if (range->IsChild()) {
13218       parent_index = range->parent()->id();
13219     } else {
13220       parent_index = range->id();
13221     }
13222     LOperand* op = range->FirstHint();
13223     int hint_index = -1;
13224     if (op != NULL && op->IsUnallocated()) {
13225       hint_index = LUnallocated::cast(op)->virtual_register();
13226     }
13227     trace_.Add(" %d %d", parent_index, hint_index);
13228     UseInterval* cur_interval = range->first_interval();
13229     while (cur_interval != NULL && range->Covers(cur_interval->start())) {
13230       trace_.Add(" [%d, %d[",
13231                  cur_interval->start().Value(),
13232                  cur_interval->end().Value());
13233       cur_interval = cur_interval->next();
13234     }
13235
13236     UsePosition* current_pos = range->first_pos();
13237     while (current_pos != NULL) {
13238       if (current_pos->RegisterIsBeneficial() || FLAG_trace_all_uses) {
13239         trace_.Add(" %d M", current_pos->pos().Value());
13240       }
13241       current_pos = current_pos->next();
13242     }
13243
13244     trace_.Add(" \"\"\n");
13245   }
13246 }
13247
13248
13249 void HTracer::FlushToFile() {
13250   AppendChars(filename_.start(), trace_.ToCString().get(), trace_.length(),
13251               false);
13252   trace_.Reset();
13253 }
13254
13255
13256 void HStatistics::Initialize(CompilationInfo* info) {
13257   if (info->shared_info().is_null()) return;
13258   source_size_ += info->shared_info()->SourceSize();
13259 }
13260
13261
13262 void HStatistics::Print() {
13263   PrintF(
13264       "\n"
13265       "----------------------------------------"
13266       "----------------------------------------\n"
13267       "--- Hydrogen timing results:\n"
13268       "----------------------------------------"
13269       "----------------------------------------\n");
13270   base::TimeDelta sum;
13271   for (int i = 0; i < times_.length(); ++i) {
13272     sum += times_[i];
13273   }
13274
13275   for (int i = 0; i < names_.length(); ++i) {
13276     PrintF("%33s", names_[i]);
13277     double ms = times_[i].InMillisecondsF();
13278     double percent = times_[i].PercentOf(sum);
13279     PrintF(" %8.3f ms / %4.1f %% ", ms, percent);
13280
13281     size_t size = sizes_[i];
13282     double size_percent = static_cast<double>(size) * 100 / total_size_;
13283     PrintF(" %9zu bytes / %4.1f %%\n", size, size_percent);
13284   }
13285
13286   PrintF(
13287       "----------------------------------------"
13288       "----------------------------------------\n");
13289   base::TimeDelta total = create_graph_ + optimize_graph_ + generate_code_;
13290   PrintF("%33s %8.3f ms / %4.1f %% \n", "Create graph",
13291          create_graph_.InMillisecondsF(), create_graph_.PercentOf(total));
13292   PrintF("%33s %8.3f ms / %4.1f %% \n", "Optimize graph",
13293          optimize_graph_.InMillisecondsF(), optimize_graph_.PercentOf(total));
13294   PrintF("%33s %8.3f ms / %4.1f %% \n", "Generate and install code",
13295          generate_code_.InMillisecondsF(), generate_code_.PercentOf(total));
13296   PrintF(
13297       "----------------------------------------"
13298       "----------------------------------------\n");
13299   PrintF("%33s %8.3f ms           %9zu bytes\n", "Total",
13300          total.InMillisecondsF(), total_size_);
13301   PrintF("%33s     (%.1f times slower than full code gen)\n", "",
13302          total.TimesOf(full_code_gen_));
13303
13304   double source_size_in_kb = static_cast<double>(source_size_) / 1024;
13305   double normalized_time =  source_size_in_kb > 0
13306       ? total.InMillisecondsF() / source_size_in_kb
13307       : 0;
13308   double normalized_size_in_kb =
13309       source_size_in_kb > 0
13310           ? static_cast<double>(total_size_) / 1024 / source_size_in_kb
13311           : 0;
13312   PrintF("%33s %8.3f ms           %7.3f kB allocated\n",
13313          "Average per kB source", normalized_time, normalized_size_in_kb);
13314 }
13315
13316
13317 void HStatistics::SaveTiming(const char* name, base::TimeDelta time,
13318                              size_t size) {
13319   total_size_ += size;
13320   for (int i = 0; i < names_.length(); ++i) {
13321     if (strcmp(names_[i], name) == 0) {
13322       times_[i] += time;
13323       sizes_[i] += size;
13324       return;
13325     }
13326   }
13327   names_.Add(name);
13328   times_.Add(time);
13329   sizes_.Add(size);
13330 }
13331
13332
13333 HPhase::~HPhase() {
13334   if (ShouldProduceTraceOutput()) {
13335     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
13336   }
13337
13338 #ifdef DEBUG
13339   graph_->Verify(false);  // No full verify.
13340 #endif
13341 }
13342
13343 }  // namespace internal
13344 }  // namespace v8