src/v8/src/hydrogen.cc

   1 // Copyright 2013 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/hydrogen.h"
   6
   7 #include <algorithm>
   8
   9 #include "src/v8.h"
  10 #include "src/allocation-site-scopes.h"
  11 #include "src/codegen.h"
  12 #include "src/full-codegen.h"
  13 #include "src/hashmap.h"
  14 #include "src/hydrogen-bce.h"
  15 #include "src/hydrogen-bch.h"
  16 #include "src/hydrogen-canonicalize.h"
  17 #include "src/hydrogen-check-elimination.h"
  18 #include "src/hydrogen-dce.h"
  19 #include "src/hydrogen-dehoist.h"
  20 #include "src/hydrogen-environment-liveness.h"
  21 #include "src/hydrogen-escape-analysis.h"
  22 #include "src/hydrogen-infer-representation.h"
  23 #include "src/hydrogen-infer-types.h"
  24 #include "src/hydrogen-load-elimination.h"
  25 #include "src/hydrogen-gvn.h"
  26 #include "src/hydrogen-mark-deoptimize.h"
  27 #include "src/hydrogen-mark-unreachable.h"
  28 #include "src/hydrogen-osr.h"
  29 #include "src/hydrogen-range-analysis.h"
  30 #include "src/hydrogen-redundant-phi.h"
  31 #include "src/hydrogen-removable-simulates.h"
  32 #include "src/hydrogen-representation-changes.h"
  33 #include "src/hydrogen-sce.h"
  34 #include "src/hydrogen-store-elimination.h"
  35 #include "src/hydrogen-uint32-analysis.h"
  36 #include "src/lithium-allocator.h"
  37 #include "src/parser.h"
  38 #include "src/runtime.h"
  39 #include "src/scopeinfo.h"
  40 #include "src/scopes.h"
  41 #include "src/stub-cache.h"
  42 #include "src/typing.h"
  43
  44 #if V8_TARGET_ARCH_IA32
  45 #include "src/ia32/lithium-codegen-ia32.h"
  46 #elif V8_TARGET_ARCH_X64
  47 #include "src/x64/lithium-codegen-x64.h"
  48 #elif V8_TARGET_ARCH_ARM64
  49 #include "src/arm64/lithium-codegen-arm64.h"
  50 #elif V8_TARGET_ARCH_ARM
  51 #include "src/arm/lithium-codegen-arm.h"
  52 #elif V8_TARGET_ARCH_MIPS
  53 #include "src/mips/lithium-codegen-mips.h"
  54 #elif V8_TARGET_ARCH_X87
  55 #include "src/x87/lithium-codegen-x87.h"
  56 #else
  57 #error Unsupported target architecture.
  58 #endif
  59
  60 namespace v8 {
  61 namespace internal {
  62
  63 HBasicBlock::HBasicBlock(HGraph* graph)
  64     : block_id_(graph->GetNextBlockID()),
  65       graph_(graph),
  66       phis_(4, graph->zone()),
  67       first_(NULL),
  68       last_(NULL),
  69       end_(NULL),
  70       loop_information_(NULL),
  71       predecessors_(2, graph->zone()),
  72       dominator_(NULL),
  73       dominated_blocks_(4, graph->zone()),
  74       last_environment_(NULL),
  75       argument_count_(-1),
  76       first_instruction_index_(-1),
  77       last_instruction_index_(-1),
  78       deleted_phis_(4, graph->zone()),
  79       parent_loop_header_(NULL),
  80       inlined_entry_block_(NULL),
  81       is_inline_return_target_(false),
  82       is_reachable_(true),
  83       dominates_loop_successors_(false),
  84       is_osr_entry_(false),
  85       is_ordered_(false) { }
  86
  87
  88 Isolate* HBasicBlock::isolate() const {
  89   return graph_->isolate();
  90 }
  91
  92
  93 void HBasicBlock::MarkUnreachable() {
  94   is_reachable_ = false;
  95 }
  96
  97
  98 void HBasicBlock::AttachLoopInformation() {
  99   ASSERT(!IsLoopHeader());
 100   loop_information_ = new(zone()) HLoopInformation(this, zone());
 101 }
 102
 103
 104 void HBasicBlock::DetachLoopInformation() {
 105   ASSERT(IsLoopHeader());
 106   loop_information_ = NULL;
 107 }
 108
 109
 110 void HBasicBlock::AddPhi(HPhi* phi) {
 111   ASSERT(!IsStartBlock());
 112   phis_.Add(phi, zone());
 113   phi->SetBlock(this);
 114 }
 115
 116
 117 void HBasicBlock::RemovePhi(HPhi* phi) {
 118   ASSERT(phi->block() == this);
 119   ASSERT(phis_.Contains(phi));
 120   phi->Kill();
 121   phis_.RemoveElement(phi);
 122   phi->SetBlock(NULL);
 123 }
 124
 125
 126 void HBasicBlock::AddInstruction(HInstruction* instr,
 127                                  HSourcePosition position) {
 128   ASSERT(!IsStartBlock() || !IsFinished());
 129   ASSERT(!instr->IsLinked());
 130   ASSERT(!IsFinished());
 131
 132   if (!position.IsUnknown()) {
 133     instr->set_position(position);
 134   }
 135   if (first_ == NULL) {
 136     ASSERT(last_environment() != NULL);
 137     ASSERT(!last_environment()->ast_id().IsNone());
 138     HBlockEntry* entry = new(zone()) HBlockEntry();
 139     entry->InitializeAsFirst(this);
 140     if (!position.IsUnknown()) {
 141       entry->set_position(position);
 142     } else {
 143       ASSERT(!FLAG_hydrogen_track_positions ||
 144              !graph()->info()->IsOptimizing());
 145     }
 146     first_ = last_ = entry;
 147   }
 148   instr->InsertAfter(last_);
 149 }
 150
 151
 152 HPhi* HBasicBlock::AddNewPhi(int merged_index) {
 153   if (graph()->IsInsideNoSideEffectsScope()) {
 154     merged_index = HPhi::kInvalidMergedIndex;
 155   }
 156   HPhi* phi = new(zone()) HPhi(merged_index, zone());
 157   AddPhi(phi);
 158   return phi;
 159 }
 160
 161
 162 HSimulate* HBasicBlock::CreateSimulate(BailoutId ast_id,
 163                                        RemovableSimulate removable) {
 164   ASSERT(HasEnvironment());
 165   HEnvironment* environment = last_environment();
 166   ASSERT(ast_id.IsNone() ||
 167          ast_id == BailoutId::StubEntry() ||
 168          environment->closure()->shared()->VerifyBailoutId(ast_id));
 169
 170   int push_count = environment->push_count();
 171   int pop_count = environment->pop_count();
 172
 173   HSimulate* instr =
 174       new(zone()) HSimulate(ast_id, pop_count, zone(), removable);
 175 #ifdef DEBUG
 176   instr->set_closure(environment->closure());
 177 #endif
 178   // Order of pushed values: newest (top of stack) first. This allows
 179   // HSimulate::MergeWith() to easily append additional pushed values
 180   // that are older (from further down the stack).
 181   for (int i = 0; i < push_count; ++i) {
 182     instr->AddPushedValue(environment->ExpressionStackAt(i));
 183   }
 184   for (GrowableBitVector::Iterator it(environment->assigned_variables(),
 185                                       zone());
 186        !it.Done();
 187        it.Advance()) {
 188     int index = it.Current();
 189     instr->AddAssignedValue(index, environment->Lookup(index));
 190   }
 191   environment->ClearHistory();
 192   return instr;
 193 }
 194
 195
 196 void HBasicBlock::Finish(HControlInstruction* end, HSourcePosition position) {
 197   ASSERT(!IsFinished());
 198   AddInstruction(end, position);
 199   end_ = end;
 200   for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 201     it.Current()->RegisterPredecessor(this);
 202   }
 203 }
 204
 205
 206 void HBasicBlock::Goto(HBasicBlock* block,
 207                        HSourcePosition position,
 208                        FunctionState* state,
 209                        bool add_simulate) {
 210   bool drop_extra = state != NULL &&
 211       state->inlining_kind() == NORMAL_RETURN;
 212
 213   if (block->IsInlineReturnTarget()) {
 214     HEnvironment* env = last_environment();
 215     int argument_count = env->arguments_environment()->parameter_count();
 216     AddInstruction(new(zone())
 217                    HLeaveInlined(state->entry(), argument_count),
 218                    position);
 219     UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 220   }
 221
 222   if (add_simulate) AddNewSimulate(BailoutId::None(), position);
 223   HGoto* instr = new(zone()) HGoto(block);
 224   Finish(instr, position);
 225 }
 226
 227
 228 void HBasicBlock::AddLeaveInlined(HValue* return_value,
 229                                   FunctionState* state,
 230                                   HSourcePosition position) {
 231   HBasicBlock* target = state->function_return();
 232   bool drop_extra = state->inlining_kind() == NORMAL_RETURN;
 233
 234   ASSERT(target->IsInlineReturnTarget());
 235   ASSERT(return_value != NULL);
 236   HEnvironment* env = last_environment();
 237   int argument_count = env->arguments_environment()->parameter_count();
 238   AddInstruction(new(zone()) HLeaveInlined(state->entry(), argument_count),
 239                  position);
 240   UpdateEnvironment(last_environment()->DiscardInlined(drop_extra));
 241   last_environment()->Push(return_value);
 242   AddNewSimulate(BailoutId::None(), position);
 243   HGoto* instr = new(zone()) HGoto(target);
 244   Finish(instr, position);
 245 }
 246
 247
 248 void HBasicBlock::SetInitialEnvironment(HEnvironment* env) {
 249   ASSERT(!HasEnvironment());
 250   ASSERT(first() == NULL);
 251   UpdateEnvironment(env);
 252 }
 253
 254
 255 void HBasicBlock::UpdateEnvironment(HEnvironment* env) {
 256   last_environment_ = env;
 257   graph()->update_maximum_environment_size(env->first_expression_index());
 258 }
 259
 260
 261 void HBasicBlock::SetJoinId(BailoutId ast_id) {
 262   int length = predecessors_.length();
 263   ASSERT(length > 0);
 264   for (int i = 0; i < length; i++) {
 265     HBasicBlock* predecessor = predecessors_[i];
 266     ASSERT(predecessor->end()->IsGoto());
 267     HSimulate* simulate = HSimulate::cast(predecessor->end()->previous());
 268     ASSERT(i != 0 ||
 269            (predecessor->last_environment()->closure().is_null() ||
 270             predecessor->last_environment()->closure()->shared()
 271               ->VerifyBailoutId(ast_id)));
 272     simulate->set_ast_id(ast_id);
 273     predecessor->last_environment()->set_ast_id(ast_id);
 274   }
 275 }
 276
 277
 278 bool HBasicBlock::Dominates(HBasicBlock* other) const {
 279   HBasicBlock* current = other->dominator();
 280   while (current != NULL) {
 281     if (current == this) return true;
 282     current = current->dominator();
 283   }
 284   return false;
 285 }
 286
 287
 288 bool HBasicBlock::EqualToOrDominates(HBasicBlock* other) const {
 289   if (this == other) return true;
 290   return Dominates(other);
 291 }
 292
 293
 294 int HBasicBlock::LoopNestingDepth() const {
 295   const HBasicBlock* current = this;
 296   int result  = (current->IsLoopHeader()) ? 1 : 0;
 297   while (current->parent_loop_header() != NULL) {
 298     current = current->parent_loop_header();
 299     result++;
 300   }
 301   return result;
 302 }
 303
 304
 305 void HBasicBlock::PostProcessLoopHeader(IterationStatement* stmt) {
 306   ASSERT(IsLoopHeader());
 307
 308   SetJoinId(stmt->EntryId());
 309   if (predecessors()->length() == 1) {
 310     // This is a degenerated loop.
 311     DetachLoopInformation();
 312     return;
 313   }
 314
 315   // Only the first entry into the loop is from outside the loop. All other
 316   // entries must be back edges.
 317   for (int i = 1; i < predecessors()->length(); ++i) {
 318     loop_information()->RegisterBackEdge(predecessors()->at(i));
 319   }
 320 }
 321
 322
 323 void HBasicBlock::MarkSuccEdgeUnreachable(int succ) {
 324   ASSERT(IsFinished());
 325   HBasicBlock* succ_block = end()->SuccessorAt(succ);
 326
 327   ASSERT(succ_block->predecessors()->length() == 1);
 328   succ_block->MarkUnreachable();
 329 }
 330
 331
 332 void HBasicBlock::RegisterPredecessor(HBasicBlock* pred) {
 333   if (HasPredecessor()) {
 334     // Only loop header blocks can have a predecessor added after
 335     // instructions have been added to the block (they have phis for all
 336     // values in the environment, these phis may be eliminated later).
 337     ASSERT(IsLoopHeader() || first_ == NULL);
 338     HEnvironment* incoming_env = pred->last_environment();
 339     if (IsLoopHeader()) {
 340       ASSERT(phis()->length() == incoming_env->length());
 341       for (int i = 0; i < phis_.length(); ++i) {
 342         phis_[i]->AddInput(incoming_env->values()->at(i));
 343       }
 344     } else {
 345       last_environment()->AddIncomingEdge(this, pred->last_environment());
 346     }
 347   } else if (!HasEnvironment() && !IsFinished()) {
 348     ASSERT(!IsLoopHeader());
 349     SetInitialEnvironment(pred->last_environment()->Copy());
 350   }
 351
 352   predecessors_.Add(pred, zone());
 353 }
 354
 355
 356 void HBasicBlock::AddDominatedBlock(HBasicBlock* block) {
 357   ASSERT(!dominated_blocks_.Contains(block));
 358   // Keep the list of dominated blocks sorted such that if there is two
 359   // succeeding block in this list, the predecessor is before the successor.
 360   int index = 0;
 361   while (index < dominated_blocks_.length() &&
 362          dominated_blocks_[index]->block_id() < block->block_id()) {
 363     ++index;
 364   }
 365   dominated_blocks_.InsertAt(index, block, zone());
 366 }
 367
 368
 369 void HBasicBlock::AssignCommonDominator(HBasicBlock* other) {
 370   if (dominator_ == NULL) {
 371     dominator_ = other;
 372     other->AddDominatedBlock(this);
 373   } else if (other->dominator() != NULL) {
 374     HBasicBlock* first = dominator_;
 375     HBasicBlock* second = other;
 376
 377     while (first != second) {
 378       if (first->block_id() > second->block_id()) {
 379         first = first->dominator();
 380       } else {
 381         second = second->dominator();
 382       }
 383       ASSERT(first != NULL && second != NULL);
 384     }
 385
 386     if (dominator_ != first) {
 387       ASSERT(dominator_->dominated_blocks_.Contains(this));
 388       dominator_->dominated_blocks_.RemoveElement(this);
 389       dominator_ = first;
 390       first->AddDominatedBlock(this);
 391     }
 392   }
 393 }
 394
 395
 396 void HBasicBlock::AssignLoopSuccessorDominators() {
 397   // Mark blocks that dominate all subsequent reachable blocks inside their
 398   // loop. Exploit the fact that blocks are sorted in reverse post order. When
 399   // the loop is visited in increasing block id order, if the number of
 400   // non-loop-exiting successor edges at the dominator_candidate block doesn't
 401   // exceed the number of previously encountered predecessor edges, there is no
 402   // path from the loop header to any block with higher id that doesn't go
 403   // through the dominator_candidate block. In this case, the
 404   // dominator_candidate block is guaranteed to dominate all blocks reachable
 405   // from it with higher ids.
 406   HBasicBlock* last = loop_information()->GetLastBackEdge();
 407   int outstanding_successors = 1;  // one edge from the pre-header
 408   // Header always dominates everything.
 409   MarkAsLoopSuccessorDominator();
 410   for (int j = block_id(); j <= last->block_id(); ++j) {
 411     HBasicBlock* dominator_candidate = graph_->blocks()->at(j);
 412     for (HPredecessorIterator it(dominator_candidate); !it.Done();
 413          it.Advance()) {
 414       HBasicBlock* predecessor = it.Current();
 415       // Don't count back edges.
 416       if (predecessor->block_id() < dominator_candidate->block_id()) {
 417         outstanding_successors--;
 418       }
 419     }
 420
 421     // If more successors than predecessors have been seen in the loop up to
 422     // now, it's not possible to guarantee that the current block dominates
 423     // all of the blocks with higher IDs. In this case, assume conservatively
 424     // that those paths through loop that don't go through the current block
 425     // contain all of the loop's dependencies. Also be careful to record
 426     // dominator information about the current loop that's being processed,
 427     // and not nested loops, which will be processed when
 428     // AssignLoopSuccessorDominators gets called on their header.
 429     ASSERT(outstanding_successors >= 0);
 430     HBasicBlock* parent_loop_header = dominator_candidate->parent_loop_header();
 431     if (outstanding_successors == 0 &&
 432         (parent_loop_header == this && !dominator_candidate->IsLoopHeader())) {
 433       dominator_candidate->MarkAsLoopSuccessorDominator();
 434     }
 435     HControlInstruction* end = dominator_candidate->end();
 436     for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 437       HBasicBlock* successor = it.Current();
 438       // Only count successors that remain inside the loop and don't loop back
 439       // to a loop header.
 440       if (successor->block_id() > dominator_candidate->block_id() &&
 441           successor->block_id() <= last->block_id()) {
 442         // Backwards edges must land on loop headers.
 443         ASSERT(successor->block_id() > dominator_candidate->block_id() ||
 444                successor->IsLoopHeader());
 445         outstanding_successors++;
 446       }
 447     }
 448   }
 449 }
 450
 451
 452 int HBasicBlock::PredecessorIndexOf(HBasicBlock* predecessor) const {
 453   for (int i = 0; i < predecessors_.length(); ++i) {
 454     if (predecessors_[i] == predecessor) return i;
 455   }
 456   UNREACHABLE();
 457   return -1;
 458 }
 459
 460
 461 #ifdef DEBUG
 462 void HBasicBlock::Verify() {
 463   // Check that every block is finished.
 464   ASSERT(IsFinished());
 465   ASSERT(block_id() >= 0);
 466
 467   // Check that the incoming edges are in edge split form.
 468   if (predecessors_.length() > 1) {
 469     for (int i = 0; i < predecessors_.length(); ++i) {
 470       ASSERT(predecessors_[i]->end()->SecondSuccessor() == NULL);
 471     }
 472   }
 473 }
 474 #endif
 475
 476
 477 void HLoopInformation::RegisterBackEdge(HBasicBlock* block) {
 478   this->back_edges_.Add(block, block->zone());
 479   AddBlock(block);
 480 }
 481
 482
 483 HBasicBlock* HLoopInformation::GetLastBackEdge() const {
 484   int max_id = -1;
 485   HBasicBlock* result = NULL;
 486   for (int i = 0; i < back_edges_.length(); ++i) {
 487     HBasicBlock* cur = back_edges_[i];
 488     if (cur->block_id() > max_id) {
 489       max_id = cur->block_id();
 490       result = cur;
 491     }
 492   }
 493   return result;
 494 }
 495
 496
 497 void HLoopInformation::AddBlock(HBasicBlock* block) {
 498   if (block == loop_header()) return;
 499   if (block->parent_loop_header() == loop_header()) return;
 500   if (block->parent_loop_header() != NULL) {
 501     AddBlock(block->parent_loop_header());
 502   } else {
 503     block->set_parent_loop_header(loop_header());
 504     blocks_.Add(block, block->zone());
 505     for (int i = 0; i < block->predecessors()->length(); ++i) {
 506       AddBlock(block->predecessors()->at(i));
 507     }
 508   }
 509 }
 510
 511
 512 #ifdef DEBUG
 513
 514 // Checks reachability of the blocks in this graph and stores a bit in
 515 // the BitVector "reachable()" for every block that can be reached
 516 // from the start block of the graph. If "dont_visit" is non-null, the given
 517 // block is treated as if it would not be part of the graph. "visited_count()"
 518 // returns the number of reachable blocks.
 519 class ReachabilityAnalyzer BASE_EMBEDDED {
 520  public:
 521   ReachabilityAnalyzer(HBasicBlock* entry_block,
 522                        int block_count,
 523                        HBasicBlock* dont_visit)
 524       : visited_count_(0),
 525         stack_(16, entry_block->zone()),
 526         reachable_(block_count, entry_block->zone()),
 527         dont_visit_(dont_visit) {
 528     PushBlock(entry_block);
 529     Analyze();
 530   }
 531
 532   int visited_count() const { return visited_count_; }
 533   const BitVector* reachable() const { return &reachable_; }
 534
 535  private:
 536   void PushBlock(HBasicBlock* block) {
 537     if (block != NULL && block != dont_visit_ &&
 538         !reachable_.Contains(block->block_id())) {
 539       reachable_.Add(block->block_id());
 540       stack_.Add(block, block->zone());
 541       visited_count_++;
 542     }
 543   }
 544
 545   void Analyze() {
 546     while (!stack_.is_empty()) {
 547       HControlInstruction* end = stack_.RemoveLast()->end();
 548       for (HSuccessorIterator it(end); !it.Done(); it.Advance()) {
 549         PushBlock(it.Current());
 550       }
 551     }
 552   }
 553
 554   int visited_count_;
 555   ZoneList<HBasicBlock*> stack_;
 556   BitVector reachable_;
 557   HBasicBlock* dont_visit_;
 558 };
 559
 560
 561 void HGraph::Verify(bool do_full_verify) const {
 562   Heap::RelocationLock relocation_lock(isolate()->heap());
 563   AllowHandleDereference allow_deref;
 564   AllowDeferredHandleDereference allow_deferred_deref;
 565   for (int i = 0; i < blocks_.length(); i++) {
 566     HBasicBlock* block = blocks_.at(i);
 567
 568     block->Verify();
 569
 570     // Check that every block contains at least one node and that only the last
 571     // node is a control instruction.
 572     HInstruction* current = block->first();
 573     ASSERT(current != NULL && current->IsBlockEntry());
 574     while (current != NULL) {
 575       ASSERT((current->next() == NULL) == current->IsControlInstruction());
 576       ASSERT(current->block() == block);
 577       current->Verify();
 578       current = current->next();
 579     }
 580
 581     // Check that successors are correctly set.
 582     HBasicBlock* first = block->end()->FirstSuccessor();
 583     HBasicBlock* second = block->end()->SecondSuccessor();
 584     ASSERT(second == NULL || first != NULL);
 585
 586     // Check that the predecessor array is correct.
 587     if (first != NULL) {
 588       ASSERT(first->predecessors()->Contains(block));
 589       if (second != NULL) {
 590         ASSERT(second->predecessors()->Contains(block));
 591       }
 592     }
 593
 594     // Check that phis have correct arguments.
 595     for (int j = 0; j < block->phis()->length(); j++) {
 596       HPhi* phi = block->phis()->at(j);
 597       phi->Verify();
 598     }
 599
 600     // Check that all join blocks have predecessors that end with an
 601     // unconditional goto and agree on their environment node id.
 602     if (block->predecessors()->length() >= 2) {
 603       BailoutId id =
 604           block->predecessors()->first()->last_environment()->ast_id();
 605       for (int k = 0; k < block->predecessors()->length(); k++) {
 606         HBasicBlock* predecessor = block->predecessors()->at(k);
 607         ASSERT(predecessor->end()->IsGoto() ||
 608                predecessor->end()->IsDeoptimize());
 609         ASSERT(predecessor->last_environment()->ast_id() == id);
 610       }
 611     }
 612   }
 613
 614   // Check special property of first block to have no predecessors.
 615   ASSERT(blocks_.at(0)->predecessors()->is_empty());
 616
 617   if (do_full_verify) {
 618     // Check that the graph is fully connected.
 619     ReachabilityAnalyzer analyzer(entry_block_, blocks_.length(), NULL);
 620     ASSERT(analyzer.visited_count() == blocks_.length());
 621
 622     // Check that entry block dominator is NULL.
 623     ASSERT(entry_block_->dominator() == NULL);
 624
 625     // Check dominators.
 626     for (int i = 0; i < blocks_.length(); ++i) {
 627       HBasicBlock* block = blocks_.at(i);
 628       if (block->dominator() == NULL) {
 629         // Only start block may have no dominator assigned to.
 630         ASSERT(i == 0);
 631       } else {
 632         // Assert that block is unreachable if dominator must not be visited.
 633         ReachabilityAnalyzer dominator_analyzer(entry_block_,
 634                                                 blocks_.length(),
 635                                                 block->dominator());
 636         ASSERT(!dominator_analyzer.reachable()->Contains(block->block_id()));
 637       }
 638     }
 639   }
 640 }
 641
 642 #endif
 643
 644
 645 HConstant* HGraph::GetConstant(SetOncePointer<HConstant>* pointer,
 646                                int32_t value) {
 647   if (!pointer->is_set()) {
 648     // Can't pass GetInvalidContext() to HConstant::New, because that will
 649     // recursively call GetConstant
 650     HConstant* constant = HConstant::New(zone(), NULL, value);
 651     constant->InsertAfter(entry_block()->first());
 652     pointer->set(constant);
 653     return constant;
 654   }
 655   return ReinsertConstantIfNecessary(pointer->get());
 656 }
 657
 658
 659 HConstant* HGraph::ReinsertConstantIfNecessary(HConstant* constant) {
 660   if (!constant->IsLinked()) {
 661     // The constant was removed from the graph. Reinsert.
 662     constant->ClearFlag(HValue::kIsDead);
 663     constant->InsertAfter(entry_block()->first());
 664   }
 665   return constant;
 666 }
 667
 668
 669 HConstant* HGraph::GetConstant0() {
 670   return GetConstant(&constant_0_, 0);
 671 }
 672
 673
 674 HConstant* HGraph::GetConstant1() {
 675   return GetConstant(&constant_1_, 1);
 676 }
 677
 678
 679 HConstant* HGraph::GetConstantMinus1() {
 680   return GetConstant(&constant_minus1_, -1);
 681 }
 682
 683
 684 #define DEFINE_GET_CONSTANT(Name, name, type, htype, boolean_value)            \
 685 HConstant* HGraph::GetConstant##Name() {                                       \
 686   if (!constant_##name##_.is_set()) {                                          \
 687     HConstant* constant = new(zone()) HConstant(                               \
 688         Unique<Object>::CreateImmovable(isolate()->factory()->name##_value()), \
 689         Unique<Map>::CreateImmovable(isolate()->factory()->type##_map()),      \
 690         false,                                                                 \
 691         Representation::Tagged(),                                              \
 692         htype,                                                                 \
 693         true,                                                                  \
 694         boolean_value,                                                         \
 695         false,                                                                 \
 696         ODDBALL_TYPE);                                                         \
 697     constant->InsertAfter(entry_block()->first());                             \
 698     constant_##name##_.set(constant);                                          \
 699   }                                                                            \
 700   return ReinsertConstantIfNecessary(constant_##name##_.get());                \
 701 }
 702
 703
 704 DEFINE_GET_CONSTANT(Undefined, undefined, undefined, HType::Undefined(), false)
 705 DEFINE_GET_CONSTANT(True, true, boolean, HType::Boolean(), true)
 706 DEFINE_GET_CONSTANT(False, false, boolean, HType::Boolean(), false)
 707 DEFINE_GET_CONSTANT(Hole, the_hole, the_hole, HType::None(), false)
 708 DEFINE_GET_CONSTANT(Null, null, null, HType::Null(), false)
 709
 710
 711 #undef DEFINE_GET_CONSTANT
 712
 713 #define DEFINE_IS_CONSTANT(Name, name)                                         \
 714 bool HGraph::IsConstant##Name(HConstant* constant) {                           \
 715   return constant_##name##_.is_set() && constant == constant_##name##_.get();  \
 716 }
 717 DEFINE_IS_CONSTANT(Undefined, undefined)
 718 DEFINE_IS_CONSTANT(0, 0)
 719 DEFINE_IS_CONSTANT(1, 1)
 720 DEFINE_IS_CONSTANT(Minus1, minus1)
 721 DEFINE_IS_CONSTANT(True, true)
 722 DEFINE_IS_CONSTANT(False, false)
 723 DEFINE_IS_CONSTANT(Hole, the_hole)
 724 DEFINE_IS_CONSTANT(Null, null)
 725
 726 #undef DEFINE_IS_CONSTANT
 727
 728
 729 HConstant* HGraph::GetInvalidContext() {
 730   return GetConstant(&constant_invalid_context_, 0xFFFFC0C7);
 731 }
 732
 733
 734 bool HGraph::IsStandardConstant(HConstant* constant) {
 735   if (IsConstantUndefined(constant)) return true;
 736   if (IsConstant0(constant)) return true;
 737   if (IsConstant1(constant)) return true;
 738   if (IsConstantMinus1(constant)) return true;
 739   if (IsConstantTrue(constant)) return true;
 740   if (IsConstantFalse(constant)) return true;
 741   if (IsConstantHole(constant)) return true;
 742   if (IsConstantNull(constant)) return true;
 743   return false;
 744 }
 745
 746
 747 HGraphBuilder::IfBuilder::IfBuilder(HGraphBuilder* builder)
 748     : builder_(builder),
 749       finished_(false),
 750       did_then_(false),
 751       did_else_(false),
 752       did_else_if_(false),
 753       did_and_(false),
 754       did_or_(false),
 755       captured_(false),
 756       needs_compare_(true),
 757       pending_merge_block_(false),
 758       split_edge_merge_block_(NULL),
 759       merge_at_join_blocks_(NULL),
 760       normal_merge_at_join_block_count_(0),
 761       deopt_merge_at_join_block_count_(0) {
 762   HEnvironment* env = builder->environment();
 763   first_true_block_ = builder->CreateBasicBlock(env->Copy());
 764   first_false_block_ = builder->CreateBasicBlock(env->Copy());
 765 }
 766
 767
 768 HGraphBuilder::IfBuilder::IfBuilder(
 769     HGraphBuilder* builder,
 770     HIfContinuation* continuation)
 771     : builder_(builder),
 772       finished_(false),
 773       did_then_(false),
 774       did_else_(false),
 775       did_else_if_(false),
 776       did_and_(false),
 777       did_or_(false),
 778       captured_(false),
 779       needs_compare_(false),
 780       pending_merge_block_(false),
 781       first_true_block_(NULL),
 782       first_false_block_(NULL),
 783       split_edge_merge_block_(NULL),
 784       merge_at_join_blocks_(NULL),
 785       normal_merge_at_join_block_count_(0),
 786       deopt_merge_at_join_block_count_(0) {
 787   continuation->Continue(&first_true_block_,
 788                          &first_false_block_);
 789 }
 790
 791
 792 HControlInstruction* HGraphBuilder::IfBuilder::AddCompare(
 793     HControlInstruction* compare) {
 794   ASSERT(did_then_ == did_else_);
 795   if (did_else_) {
 796     // Handle if-then-elseif
 797     did_else_if_ = true;
 798     did_else_ = false;
 799     did_then_ = false;
 800     did_and_ = false;
 801     did_or_ = false;
 802     pending_merge_block_ = false;
 803     split_edge_merge_block_ = NULL;
 804     HEnvironment* env = builder_->environment();
 805     first_true_block_ = builder_->CreateBasicBlock(env->Copy());
 806     first_false_block_ = builder_->CreateBasicBlock(env->Copy());
 807   }
 808   if (split_edge_merge_block_ != NULL) {
 809     HEnvironment* env = first_false_block_->last_environment();
 810     HBasicBlock* split_edge =
 811         builder_->CreateBasicBlock(env->Copy());
 812     if (did_or_) {
 813       compare->SetSuccessorAt(0, split_edge);
 814       compare->SetSuccessorAt(1, first_false_block_);
 815     } else {
 816       compare->SetSuccessorAt(0, first_true_block_);
 817       compare->SetSuccessorAt(1, split_edge);
 818     }
 819     builder_->GotoNoSimulate(split_edge, split_edge_merge_block_);
 820   } else {
 821     compare->SetSuccessorAt(0, first_true_block_);
 822     compare->SetSuccessorAt(1, first_false_block_);
 823   }
 824   builder_->FinishCurrentBlock(compare);
 825   needs_compare_ = false;
 826   return compare;
 827 }
 828
 829
 830 void HGraphBuilder::IfBuilder::Or() {
 831   ASSERT(!needs_compare_);
 832   ASSERT(!did_and_);
 833   did_or_ = true;
 834   HEnvironment* env = first_false_block_->last_environment();
 835   if (split_edge_merge_block_ == NULL) {
 836     split_edge_merge_block_ =
 837         builder_->CreateBasicBlock(env->Copy());
 838     builder_->GotoNoSimulate(first_true_block_, split_edge_merge_block_);
 839     first_true_block_ = split_edge_merge_block_;
 840   }
 841   builder_->set_current_block(first_false_block_);
 842   first_false_block_ = builder_->CreateBasicBlock(env->Copy());
 843 }
 844
 845
 846 void HGraphBuilder::IfBuilder::And() {
 847   ASSERT(!needs_compare_);
 848   ASSERT(!did_or_);
 849   did_and_ = true;
 850   HEnvironment* env = first_false_block_->last_environment();
 851   if (split_edge_merge_block_ == NULL) {
 852     split_edge_merge_block_ = builder_->CreateBasicBlock(env->Copy());
 853     builder_->GotoNoSimulate(first_false_block_, split_edge_merge_block_);
 854     first_false_block_ = split_edge_merge_block_;
 855   }
 856   builder_->set_current_block(first_true_block_);
 857   first_true_block_ = builder_->CreateBasicBlock(env->Copy());
 858 }
 859
 860
 861 void HGraphBuilder::IfBuilder::CaptureContinuation(
 862     HIfContinuation* continuation) {
 863   ASSERT(!did_else_if_);
 864   ASSERT(!finished_);
 865   ASSERT(!captured_);
 866
 867   HBasicBlock* true_block = NULL;
 868   HBasicBlock* false_block = NULL;
 869   Finish(&true_block, &false_block);
 870   ASSERT(true_block != NULL);
 871   ASSERT(false_block != NULL);
 872   continuation->Capture(true_block, false_block);
 873   captured_ = true;
 874   builder_->set_current_block(NULL);
 875   End();
 876 }
 877
 878
 879 void HGraphBuilder::IfBuilder::JoinContinuation(HIfContinuation* continuation) {
 880   ASSERT(!did_else_if_);
 881   ASSERT(!finished_);
 882   ASSERT(!captured_);
 883   HBasicBlock* true_block = NULL;
 884   HBasicBlock* false_block = NULL;
 885   Finish(&true_block, &false_block);
 886   merge_at_join_blocks_ = NULL;
 887   if (true_block != NULL && !true_block->IsFinished()) {
 888     ASSERT(continuation->IsTrueReachable());
 889     builder_->GotoNoSimulate(true_block, continuation->true_branch());
 890   }
 891   if (false_block != NULL && !false_block->IsFinished()) {
 892     ASSERT(continuation->IsFalseReachable());
 893     builder_->GotoNoSimulate(false_block, continuation->false_branch());
 894   }
 895   captured_ = true;
 896   End();
 897 }
 898
 899
 900 void HGraphBuilder::IfBuilder::Then() {
 901   ASSERT(!captured_);
 902   ASSERT(!finished_);
 903   did_then_ = true;
 904   if (needs_compare_) {
 905     // Handle if's without any expressions, they jump directly to the "else"
 906     // branch. However, we must pretend that the "then" branch is reachable,
 907     // so that the graph builder visits it and sees any live range extending
 908     // constructs within it.
 909     HConstant* constant_false = builder_->graph()->GetConstantFalse();
 910     ToBooleanStub::Types boolean_type = ToBooleanStub::Types();
 911     boolean_type.Add(ToBooleanStub::BOOLEAN);
 912     HBranch* branch = builder()->New<HBranch>(
 913         constant_false, boolean_type, first_true_block_, first_false_block_);
 914     builder_->FinishCurrentBlock(branch);
 915   }
 916   builder_->set_current_block(first_true_block_);
 917   pending_merge_block_ = true;
 918 }
 919
 920
 921 void HGraphBuilder::IfBuilder::Else() {
 922   ASSERT(did_then_);
 923   ASSERT(!captured_);
 924   ASSERT(!finished_);
 925   AddMergeAtJoinBlock(false);
 926   builder_->set_current_block(first_false_block_);
 927   pending_merge_block_ = true;
 928   did_else_ = true;
 929 }
 930
 931
 932 void HGraphBuilder::IfBuilder::Deopt(const char* reason) {
 933   ASSERT(did_then_);
 934   builder_->Add<HDeoptimize>(reason, Deoptimizer::EAGER);
 935   AddMergeAtJoinBlock(true);
 936 }
 937
 938
 939 void HGraphBuilder::IfBuilder::Return(HValue* value) {
 940   HValue* parameter_count = builder_->graph()->GetConstantMinus1();
 941   builder_->FinishExitCurrentBlock(
 942       builder_->New<HReturn>(value, parameter_count));
 943   AddMergeAtJoinBlock(false);
 944 }
 945
 946
 947 void HGraphBuilder::IfBuilder::AddMergeAtJoinBlock(bool deopt) {
 948   if (!pending_merge_block_) return;
 949   HBasicBlock* block = builder_->current_block();
 950   ASSERT(block == NULL || !block->IsFinished());
 951   MergeAtJoinBlock* record =
 952       new(builder_->zone()) MergeAtJoinBlock(block, deopt,
 953                                              merge_at_join_blocks_);
 954   merge_at_join_blocks_ = record;
 955   if (block != NULL) {
 956     ASSERT(block->end() == NULL);
 957     if (deopt) {
 958       normal_merge_at_join_block_count_++;
 959     } else {
 960       deopt_merge_at_join_block_count_++;
 961     }
 962   }
 963   builder_->set_current_block(NULL);
 964   pending_merge_block_ = false;
 965 }
 966
 967
 968 void HGraphBuilder::IfBuilder::Finish() {
 969   ASSERT(!finished_);
 970   if (!did_then_) {
 971     Then();
 972   }
 973   AddMergeAtJoinBlock(false);
 974   if (!did_else_) {
 975     Else();
 976     AddMergeAtJoinBlock(false);
 977   }
 978   finished_ = true;
 979 }
 980
 981
 982 void HGraphBuilder::IfBuilder::Finish(HBasicBlock** then_continuation,
 983                                       HBasicBlock** else_continuation) {
 984   Finish();
 985
 986   MergeAtJoinBlock* else_record = merge_at_join_blocks_;
 987   if (else_continuation != NULL) {
 988     *else_continuation = else_record->block_;
 989   }
 990   MergeAtJoinBlock* then_record = else_record->next_;
 991   if (then_continuation != NULL) {
 992     *then_continuation = then_record->block_;
 993   }
 994   ASSERT(then_record->next_ == NULL);
 995 }
 996
 997
 998 void HGraphBuilder::IfBuilder::End() {
 999   if (captured_) return;
1000   Finish();
1001
1002   int total_merged_blocks = normal_merge_at_join_block_count_ +
1003     deopt_merge_at_join_block_count_;
1004   ASSERT(total_merged_blocks >= 1);
1005   HBasicBlock* merge_block = total_merged_blocks == 1
1006       ? NULL : builder_->graph()->CreateBasicBlock();
1007
1008   // Merge non-deopt blocks first to ensure environment has right size for
1009   // padding.
1010   MergeAtJoinBlock* current = merge_at_join_blocks_;
1011   while (current != NULL) {
1012     if (!current->deopt_ && current->block_ != NULL) {
1013       // If there is only one block that makes it through to the end of the
1014       // if, then just set it as the current block and continue rather then
1015       // creating an unnecessary merge block.
1016       if (total_merged_blocks == 1) {
1017         builder_->set_current_block(current->block_);
1018         return;
1019       }
1020       builder_->GotoNoSimulate(current->block_, merge_block);
1021     }
1022     current = current->next_;
1023   }
1024
1025   // Merge deopt blocks, padding when necessary.
1026   current = merge_at_join_blocks_;
1027   while (current != NULL) {
1028     if (current->deopt_ && current->block_ != NULL) {
1029       current->block_->FinishExit(
1030           HAbnormalExit::New(builder_->zone(), NULL),
1031           HSourcePosition::Unknown());
1032     }
1033     current = current->next_;
1034   }
1035   builder_->set_current_block(merge_block);
1036 }
1037
1038
1039 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder,
1040                                         HValue* context,
1041                                         LoopBuilder::Direction direction)
1042     : builder_(builder),
1043       context_(context),
1044       direction_(direction),
1045       finished_(false) {
1046   header_block_ = builder->CreateLoopHeaderBlock();
1047   body_block_ = NULL;
1048   exit_block_ = NULL;
1049   exit_trampoline_block_ = NULL;
1050   increment_amount_ = builder_->graph()->GetConstant1();
1051 }
1052
1053
1054 HGraphBuilder::LoopBuilder::LoopBuilder(HGraphBuilder* builder,
1055                                         HValue* context,
1056                                         LoopBuilder::Direction direction,
1057                                         HValue* increment_amount)
1058     : builder_(builder),
1059       context_(context),
1060       direction_(direction),
1061       finished_(false) {
1062   header_block_ = builder->CreateLoopHeaderBlock();
1063   body_block_ = NULL;
1064   exit_block_ = NULL;
1065   exit_trampoline_block_ = NULL;
1066   increment_amount_ = increment_amount;
1067 }
1068
1069
1070 HValue* HGraphBuilder::LoopBuilder::BeginBody(
1071     HValue* initial,
1072     HValue* terminating,
1073     Token::Value token) {
1074   HEnvironment* env = builder_->environment();
1075   phi_ = header_block_->AddNewPhi(env->values()->length());
1076   phi_->AddInput(initial);
1077   env->Push(initial);
1078   builder_->GotoNoSimulate(header_block_);
1079
1080   HEnvironment* body_env = env->Copy();
1081   HEnvironment* exit_env = env->Copy();
1082   // Remove the phi from the expression stack
1083   body_env->Pop();
1084   exit_env->Pop();
1085   body_block_ = builder_->CreateBasicBlock(body_env);
1086   exit_block_ = builder_->CreateBasicBlock(exit_env);
1087
1088   builder_->set_current_block(header_block_);
1089   env->Pop();
1090   builder_->FinishCurrentBlock(builder_->New<HCompareNumericAndBranch>(
1091           phi_, terminating, token, body_block_, exit_block_));
1092
1093   builder_->set_current_block(body_block_);
1094   if (direction_ == kPreIncrement || direction_ == kPreDecrement) {
1095     HValue* one = builder_->graph()->GetConstant1();
1096     if (direction_ == kPreIncrement) {
1097       increment_ = HAdd::New(zone(), context_, phi_, one);
1098     } else {
1099       increment_ = HSub::New(zone(), context_, phi_, one);
1100     }
1101     increment_->ClearFlag(HValue::kCanOverflow);
1102     builder_->AddInstruction(increment_);
1103     return increment_;
1104   } else {
1105     return phi_;
1106   }
1107 }
1108
1109
1110 void HGraphBuilder::LoopBuilder::Break() {
1111   if (exit_trampoline_block_ == NULL) {
1112     // Its the first time we saw a break.
1113     HEnvironment* env = exit_block_->last_environment()->Copy();
1114     exit_trampoline_block_ = builder_->CreateBasicBlock(env);
1115     builder_->GotoNoSimulate(exit_block_, exit_trampoline_block_);
1116   }
1117
1118   builder_->GotoNoSimulate(exit_trampoline_block_);
1119   builder_->set_current_block(NULL);
1120 }
1121
1122
1123 void HGraphBuilder::LoopBuilder::EndBody() {
1124   ASSERT(!finished_);
1125
1126   if (direction_ == kPostIncrement || direction_ == kPostDecrement) {
1127     if (direction_ == kPostIncrement) {
1128       increment_ = HAdd::New(zone(), context_, phi_, increment_amount_);
1129     } else {
1130       increment_ = HSub::New(zone(), context_, phi_, increment_amount_);
1131     }
1132     increment_->ClearFlag(HValue::kCanOverflow);
1133     builder_->AddInstruction(increment_);
1134   }
1135
1136   // Push the new increment value on the expression stack to merge into the phi.
1137   builder_->environment()->Push(increment_);
1138   HBasicBlock* last_block = builder_->current_block();
1139   builder_->GotoNoSimulate(last_block, header_block_);
1140   header_block_->loop_information()->RegisterBackEdge(last_block);
1141
1142   if (exit_trampoline_block_ != NULL) {
1143     builder_->set_current_block(exit_trampoline_block_);
1144   } else {
1145     builder_->set_current_block(exit_block_);
1146   }
1147   finished_ = true;
1148 }
1149
1150
1151 HGraph* HGraphBuilder::CreateGraph() {
1152   graph_ = new(zone()) HGraph(info_);
1153   if (FLAG_hydrogen_stats) isolate()->GetHStatistics()->Initialize(info_);
1154   CompilationPhase phase("H_Block building", info_);
1155   set_current_block(graph()->entry_block());
1156   if (!BuildGraph()) return NULL;
1157   graph()->FinalizeUniqueness();
1158   return graph_;
1159 }
1160
1161
1162 HInstruction* HGraphBuilder::AddInstruction(HInstruction* instr) {
1163   ASSERT(current_block() != NULL);
1164   ASSERT(!FLAG_hydrogen_track_positions ||
1165          !position_.IsUnknown() ||
1166          !info_->IsOptimizing());
1167   current_block()->AddInstruction(instr, source_position());
1168   if (graph()->IsInsideNoSideEffectsScope()) {
1169     instr->SetFlag(HValue::kHasNoObservableSideEffects);
1170   }
1171   return instr;
1172 }
1173
1174
1175 void HGraphBuilder::FinishCurrentBlock(HControlInstruction* last) {
1176   ASSERT(!FLAG_hydrogen_track_positions ||
1177          !info_->IsOptimizing() ||
1178          !position_.IsUnknown());
1179   current_block()->Finish(last, source_position());
1180   if (last->IsReturn() || last->IsAbnormalExit()) {
1181     set_current_block(NULL);
1182   }
1183 }
1184
1185
1186 void HGraphBuilder::FinishExitCurrentBlock(HControlInstruction* instruction) {
1187   ASSERT(!FLAG_hydrogen_track_positions || !info_->IsOptimizing() ||
1188          !position_.IsUnknown());
1189   current_block()->FinishExit(instruction, source_position());
1190   if (instruction->IsReturn() || instruction->IsAbnormalExit()) {
1191     set_current_block(NULL);
1192   }
1193 }
1194
1195
1196 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
1197   if (FLAG_native_code_counters && counter->Enabled()) {
1198     HValue* reference = Add<HConstant>(ExternalReference(counter));
1199     HValue* old_value = Add<HLoadNamedField>(
1200         reference, static_cast<HValue*>(NULL), HObjectAccess::ForCounter());
1201     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
1202     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
1203     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
1204                           new_value, STORE_TO_INITIALIZED_ENTRY);
1205   }
1206 }
1207
1208
1209 void HGraphBuilder::AddSimulate(BailoutId id,
1210                                 RemovableSimulate removable) {
1211   ASSERT(current_block() != NULL);
1212   ASSERT(!graph()->IsInsideNoSideEffectsScope());
1213   current_block()->AddNewSimulate(id, source_position(), removable);
1214 }
1215
1216
1217 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
1218   HBasicBlock* b = graph()->CreateBasicBlock();
1219   b->SetInitialEnvironment(env);
1220   return b;
1221 }
1222
1223
1224 HBasicBlock* HGraphBuilder::CreateLoopHeaderBlock() {
1225   HBasicBlock* header = graph()->CreateBasicBlock();
1226   HEnvironment* entry_env = environment()->CopyAsLoopHeader(header);
1227   header->SetInitialEnvironment(entry_env);
1228   header->AttachLoopInformation();
1229   return header;
1230 }
1231
1232
1233 HValue* HGraphBuilder::BuildGetElementsKind(HValue* object) {
1234   HValue* map = Add<HLoadNamedField>(object, static_cast<HValue*>(NULL),
1235                                      HObjectAccess::ForMap());
1236
1237   HValue* bit_field2 = Add<HLoadNamedField>(map, static_cast<HValue*>(NULL),
1238                                             HObjectAccess::ForMapBitField2());
1239   return BuildDecodeField<Map::ElementsKindBits>(bit_field2);
1240 }
1241
1242
1243 HValue* HGraphBuilder::BuildCheckHeapObject(HValue* obj) {
1244   if (obj->type().IsHeapObject()) return obj;
1245   return Add<HCheckHeapObject>(obj);
1246 }
1247
1248
1249 void HGraphBuilder::FinishExitWithHardDeoptimization(const char* reason) {
1250   Add<HDeoptimize>(reason, Deoptimizer::EAGER);
1251   FinishExitCurrentBlock(New<HAbnormalExit>());
1252 }
1253
1254
1255 HValue* HGraphBuilder::BuildCheckString(HValue* string) {
1256   if (!string->type().IsString()) {
1257     ASSERT(!string->IsConstant() ||
1258            !HConstant::cast(string)->HasStringValue());
1259     BuildCheckHeapObject(string);
1260     return Add<HCheckInstanceType>(string, HCheckInstanceType::IS_STRING);
1261   }
1262   return string;
1263 }
1264
1265
1266 HValue* HGraphBuilder::BuildWrapReceiver(HValue* object, HValue* function) {
1267   if (object->type().IsJSObject()) return object;
1268   if (function->IsConstant() &&
1269       HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
1270     Handle<JSFunction> f = Handle<JSFunction>::cast(
1271         HConstant::cast(function)->handle(isolate()));
1272     SharedFunctionInfo* shared = f->shared();
1273     if (shared->strict_mode() == STRICT || shared->native()) return object;
1274   }
1275   return Add<HWrapReceiver>(object, function);
1276 }
1277
1278
1279 HValue* HGraphBuilder::BuildCheckForCapacityGrow(
1280     HValue* object,
1281     HValue* elements,
1282     ElementsKind kind,
1283     HValue* length,
1284     HValue* key,
1285     bool is_js_array,
1286     PropertyAccessType access_type) {
1287   IfBuilder length_checker(this);
1288
1289   Token::Value token = IsHoleyElementsKind(kind) ? Token::GTE : Token::EQ;
1290   length_checker.If<HCompareNumericAndBranch>(key, length, token);
1291
1292   length_checker.Then();
1293
1294   HValue* current_capacity = AddLoadFixedArrayLength(elements);
1295
1296   IfBuilder capacity_checker(this);
1297
1298   capacity_checker.If<HCompareNumericAndBranch>(key, current_capacity,
1299                                                 Token::GTE);
1300   capacity_checker.Then();
1301
1302   HValue* max_gap = Add<HConstant>(static_cast<int32_t>(JSObject::kMaxGap));
1303   HValue* max_capacity = AddUncasted<HAdd>(current_capacity, max_gap);
1304
1305   Add<HBoundsCheck>(key, max_capacity);
1306
1307   HValue* new_capacity = BuildNewElementsCapacity(key);
1308   HValue* new_elements = BuildGrowElementsCapacity(object, elements,
1309                                                    kind, kind, length,
1310                                                    new_capacity);
1311
1312   environment()->Push(new_elements);
1313   capacity_checker.Else();
1314
1315   environment()->Push(elements);
1316   capacity_checker.End();
1317
1318   if (is_js_array) {
1319     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
1320     new_length->ClearFlag(HValue::kCanOverflow);
1321
1322     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
1323                           new_length);
1324   }
1325
1326   if (access_type == STORE && kind == FAST_SMI_ELEMENTS) {
1327     HValue* checked_elements = environment()->Top();
1328
1329     // Write zero to ensure that the new element is initialized with some smi.
1330     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
1331   }
1332
1333   length_checker.Else();
1334   Add<HBoundsCheck>(key, length);
1335
1336   environment()->Push(elements);
1337   length_checker.End();
1338
1339   return environment()->Pop();
1340 }
1341
1342
1343 HValue* HGraphBuilder::BuildCopyElementsOnWrite(HValue* object,
1344                                                 HValue* elements,
1345                                                 ElementsKind kind,
1346                                                 HValue* length) {
1347   Factory* factory = isolate()->factory();
1348
1349   IfBuilder cow_checker(this);
1350
1351   cow_checker.If<HCompareMap>(elements, factory->fixed_cow_array_map());
1352   cow_checker.Then();
1353
1354   HValue* capacity = AddLoadFixedArrayLength(elements);
1355
1356   HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
1357                                                    kind, length, capacity);
1358
1359   environment()->Push(new_elements);
1360
1361   cow_checker.Else();
1362
1363   environment()->Push(elements);
1364
1365   cow_checker.End();
1366
1367   return environment()->Pop();
1368 }
1369
1370
1371 void HGraphBuilder::BuildTransitionElementsKind(HValue* object,
1372                                                 HValue* map,
1373                                                 ElementsKind from_kind,
1374                                                 ElementsKind to_kind,
1375                                                 bool is_jsarray) {
1376   ASSERT(!IsFastHoleyElementsKind(from_kind) ||
1377          IsFastHoleyElementsKind(to_kind));
1378
1379   if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
1380     Add<HTrapAllocationMemento>(object);
1381   }
1382
1383   if (!IsSimpleMapChangeTransition(from_kind, to_kind)) {
1384     HInstruction* elements = AddLoadElements(object);
1385
1386     HInstruction* empty_fixed_array = Add<HConstant>(
1387         isolate()->factory()->empty_fixed_array());
1388
1389     IfBuilder if_builder(this);
1390
1391     if_builder.IfNot<HCompareObjectEqAndBranch>(elements, empty_fixed_array);
1392
1393     if_builder.Then();
1394
1395     HInstruction* elements_length = AddLoadFixedArrayLength(elements);
1396
1397     HInstruction* array_length = is_jsarray
1398         ? Add<HLoadNamedField>(object, static_cast<HValue*>(NULL),
1399                                HObjectAccess::ForArrayLength(from_kind))
1400         : elements_length;
1401
1402     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
1403                               array_length, elements_length);
1404
1405     if_builder.End();
1406   }
1407
1408   Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
1409 }
1410
1411
1412 void HGraphBuilder::BuildJSObjectCheck(HValue* receiver,
1413                                        int bit_field_mask) {
1414   // Check that the object isn't a smi.
1415   Add<HCheckHeapObject>(receiver);
1416
1417   // Get the map of the receiver.
1418   HValue* map = Add<HLoadNamedField>(receiver, static_cast<HValue*>(NULL),
1419                                      HObjectAccess::ForMap());
1420
1421   // Check the instance type and if an access check is needed, this can be
1422   // done with a single load, since both bytes are adjacent in the map.
1423   HObjectAccess access(HObjectAccess::ForMapInstanceTypeAndBitField());
1424   HValue* instance_type_and_bit_field =
1425       Add<HLoadNamedField>(map, static_cast<HValue*>(NULL), access);
1426
1427   HValue* mask = Add<HConstant>(0x00FF | (bit_field_mask << 8));
1428   HValue* and_result = AddUncasted<HBitwise>(Token::BIT_AND,
1429                                              instance_type_and_bit_field,
1430                                              mask);
1431   HValue* sub_result = AddUncasted<HSub>(and_result,
1432                                          Add<HConstant>(JS_OBJECT_TYPE));
1433   Add<HBoundsCheck>(sub_result, Add<HConstant>(0x100 - JS_OBJECT_TYPE));
1434 }
1435
1436
1437 void HGraphBuilder::BuildKeyedIndexCheck(HValue* key,
1438                                          HIfContinuation* join_continuation) {
1439   // The sometimes unintuitively backward ordering of the ifs below is
1440   // convoluted, but necessary.  All of the paths must guarantee that the
1441   // if-true of the continuation returns a smi element index and the if-false of
1442   // the continuation returns either a symbol or a unique string key. All other
1443   // object types cause a deopt to fall back to the runtime.
1444
1445   IfBuilder key_smi_if(this);
1446   key_smi_if.If<HIsSmiAndBranch>(key);
1447   key_smi_if.Then();
1448   {
1449     Push(key);  // Nothing to do, just continue to true of continuation.
1450   }
1451   key_smi_if.Else();
1452   {
1453     HValue* map = Add<HLoadNamedField>(key, static_cast<HValue*>(NULL),
1454                                        HObjectAccess::ForMap());
1455     HValue* instance_type =
1456         Add<HLoadNamedField>(map, static_cast<HValue*>(NULL),
1457                              HObjectAccess::ForMapInstanceType());
1458
1459     // Non-unique string, check for a string with a hash code that is actually
1460     // an index.
1461     STATIC_ASSERT(LAST_UNIQUE_NAME_TYPE == FIRST_NONSTRING_TYPE);
1462     IfBuilder not_string_or_name_if(this);
1463     not_string_or_name_if.If<HCompareNumericAndBranch>(
1464         instance_type,
1465         Add<HConstant>(LAST_UNIQUE_NAME_TYPE),
1466         Token::GT);
1467
1468     not_string_or_name_if.Then();
1469     {
1470       // Non-smi, non-Name, non-String: Try to convert to smi in case of
1471       // HeapNumber.
1472       // TODO(danno): This could call some variant of ToString
1473       Push(AddUncasted<HForceRepresentation>(key, Representation::Smi()));
1474     }
1475     not_string_or_name_if.Else();
1476     {
1477       // String or Name: check explicitly for Name, they can short-circuit
1478       // directly to unique non-index key path.
1479       IfBuilder not_symbol_if(this);
1480       not_symbol_if.If<HCompareNumericAndBranch>(
1481           instance_type,
1482           Add<HConstant>(SYMBOL_TYPE),
1483           Token::NE);
1484
1485       not_symbol_if.Then();
1486       {
1487         // String: check whether the String is a String of an index. If it is,
1488         // extract the index value from the hash.
1489         HValue* hash =
1490             Add<HLoadNamedField>(key, static_cast<HValue*>(NULL),
1491                                  HObjectAccess::ForNameHashField());
1492         HValue* not_index_mask = Add<HConstant>(static_cast<int>(
1493             String::kContainsCachedArrayIndexMask));
1494
1495         HValue* not_index_test = AddUncasted<HBitwise>(
1496             Token::BIT_AND, hash, not_index_mask);
1497
1498         IfBuilder string_index_if(this);
1499         string_index_if.If<HCompareNumericAndBranch>(not_index_test,
1500                                                      graph()->GetConstant0(),
1501                                                      Token::EQ);
1502         string_index_if.Then();
1503         {
1504           // String with index in hash: extract string and merge to index path.
1505           Push(BuildDecodeField<String::ArrayIndexValueBits>(hash));
1506         }
1507         string_index_if.Else();
1508         {
1509           // Key is a non-index String, check for uniqueness/internalization. If
1510           // it's not, deopt.
1511           HValue* not_internalized_bit = AddUncasted<HBitwise>(
1512               Token::BIT_AND,
1513               instance_type,
1514               Add<HConstant>(static_cast<int>(kIsNotInternalizedMask)));
1515           DeoptimizeIf<HCompareNumericAndBranch>(
1516               not_internalized_bit,
1517               graph()->GetConstant0(),
1518               Token::NE,
1519               "BuildKeyedIndexCheck: string isn't internalized");
1520           // Key guaranteed to be a unqiue string
1521           Push(key);
1522         }
1523         string_index_if.JoinContinuation(join_continuation);
1524       }
1525       not_symbol_if.Else();
1526       {
1527         Push(key);  // Key is symbol
1528       }
1529       not_symbol_if.JoinContinuation(join_continuation);
1530     }
1531     not_string_or_name_if.JoinContinuation(join_continuation);
1532   }
1533   key_smi_if.JoinContinuation(join_continuation);
1534 }
1535
1536
1537 void HGraphBuilder::BuildNonGlobalObjectCheck(HValue* receiver) {
1538   // Get the the instance type of the receiver, and make sure that it is
1539   // not one of the global object types.
1540   HValue* map = Add<HLoadNamedField>(receiver, static_cast<HValue*>(NULL),
1541                                      HObjectAccess::ForMap());
1542   HValue* instance_type =
1543     Add<HLoadNamedField>(map, static_cast<HValue*>(NULL),
1544                          HObjectAccess::ForMapInstanceType());
1545   STATIC_ASSERT(JS_BUILTINS_OBJECT_TYPE == JS_GLOBAL_OBJECT_TYPE + 1);
1546   HValue* min_global_type = Add<HConstant>(JS_GLOBAL_OBJECT_TYPE);
1547   HValue* max_global_type = Add<HConstant>(JS_BUILTINS_OBJECT_TYPE);
1548
1549   IfBuilder if_global_object(this);
1550   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1551                                                 max_global_type,
1552                                                 Token::LTE);
1553   if_global_object.And();
1554   if_global_object.If<HCompareNumericAndBranch>(instance_type,
1555                                                 min_global_type,
1556                                                 Token::GTE);
1557   if_global_object.ThenDeopt("receiver was a global object");
1558   if_global_object.End();
1559 }
1560
1561
1562 void HGraphBuilder::BuildTestForDictionaryProperties(
1563     HValue* object,
1564     HIfContinuation* continuation) {
1565   HValue* properties = Add<HLoadNamedField>(
1566       object, static_cast<HValue*>(NULL),
1567       HObjectAccess::ForPropertiesPointer());
1568   HValue* properties_map =
1569       Add<HLoadNamedField>(properties, static_cast<HValue*>(NULL),
1570                            HObjectAccess::ForMap());
1571   HValue* hash_map = Add<HLoadRoot>(Heap::kHashTableMapRootIndex);
1572   IfBuilder builder(this);
1573   builder.If<HCompareObjectEqAndBranch>(properties_map, hash_map);
1574   builder.CaptureContinuation(continuation);
1575 }
1576
1577
1578 HValue* HGraphBuilder::BuildKeyedLookupCacheHash(HValue* object,
1579                                                  HValue* key) {
1580   // Load the map of the receiver, compute the keyed lookup cache hash
1581   // based on 32 bits of the map pointer and the string hash.
1582   HValue* object_map =
1583       Add<HLoadNamedField>(object, static_cast<HValue*>(NULL),
1584                            HObjectAccess::ForMapAsInteger32());
1585   HValue* shifted_map = AddUncasted<HShr>(
1586       object_map, Add<HConstant>(KeyedLookupCache::kMapHashShift));
1587   HValue* string_hash =
1588       Add<HLoadNamedField>(key, static_cast<HValue*>(NULL),
1589                            HObjectAccess::ForStringHashField());
1590   HValue* shifted_hash = AddUncasted<HShr>(
1591       string_hash, Add<HConstant>(String::kHashShift));
1592   HValue* xor_result = AddUncasted<HBitwise>(Token::BIT_XOR, shifted_map,
1593                                              shifted_hash);
1594   int mask = (KeyedLookupCache::kCapacityMask & KeyedLookupCache::kHashMask);
1595   return AddUncasted<HBitwise>(Token::BIT_AND, xor_result,
1596                                Add<HConstant>(mask));
1597 }
1598
1599
1600 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoadHelper(
1601     HValue* elements,
1602     HValue* key,
1603     HValue* hash,
1604     HValue* mask,
1605     int current_probe) {
1606   if (current_probe == kNumberDictionaryProbes) {
1607     return NULL;
1608   }
1609
1610   int32_t offset = SeededNumberDictionary::GetProbeOffset(current_probe);
1611   HValue* raw_index = (current_probe == 0)
1612       ? hash
1613       : AddUncasted<HAdd>(hash, Add<HConstant>(offset));
1614   raw_index = AddUncasted<HBitwise>(Token::BIT_AND, raw_index, mask);
1615   int32_t entry_size = SeededNumberDictionary::kEntrySize;
1616   raw_index = AddUncasted<HMul>(raw_index, Add<HConstant>(entry_size));
1617   raw_index->ClearFlag(HValue::kCanOverflow);
1618
1619   int32_t base_offset = SeededNumberDictionary::kElementsStartIndex;
1620   HValue* key_index = AddUncasted<HAdd>(raw_index, Add<HConstant>(base_offset));
1621   key_index->ClearFlag(HValue::kCanOverflow);
1622
1623   HValue* candidate_key = Add<HLoadKeyed>(elements, key_index,
1624                                           static_cast<HValue*>(NULL),
1625                                           FAST_ELEMENTS);
1626
1627   IfBuilder key_compare(this);
1628   key_compare.IfNot<HCompareObjectEqAndBranch>(key, candidate_key);
1629   key_compare.Then();
1630   {
1631     // Key at the current probe doesn't match, try at the next probe.
1632     HValue* result = BuildUncheckedDictionaryElementLoadHelper(
1633         elements, key, hash, mask, current_probe + 1);
1634     if (result == NULL) {
1635       key_compare.Deopt("probes exhausted in keyed load dictionary lookup");
1636       result = graph()->GetConstantUndefined();
1637     } else {
1638       Push(result);
1639     }
1640   }
1641   key_compare.Else();
1642   {
1643     // Key at current probe matches. Details must be zero, otherwise the
1644     // dictionary element requires special handling.
1645     HValue* details_index = AddUncasted<HAdd>(
1646         raw_index, Add<HConstant>(base_offset + 2));
1647     details_index->ClearFlag(HValue::kCanOverflow);
1648
1649     HValue* details = Add<HLoadKeyed>(elements, details_index,
1650                                       static_cast<HValue*>(NULL),
1651                                       FAST_ELEMENTS);
1652     IfBuilder details_compare(this);
1653     details_compare.If<HCompareNumericAndBranch>(details,
1654                                                  graph()->GetConstant0(),
1655                                                  Token::NE);
1656     details_compare.ThenDeopt("keyed load dictionary element not fast case");
1657
1658     details_compare.Else();
1659     {
1660       // Key matches and details are zero --> fast case. Load and return the
1661       // value.
1662       HValue* result_index = AddUncasted<HAdd>(
1663           raw_index, Add<HConstant>(base_offset + 1));
1664       result_index->ClearFlag(HValue::kCanOverflow);
1665
1666       Push(Add<HLoadKeyed>(elements, result_index,
1667                            static_cast<HValue*>(NULL),
1668                            FAST_ELEMENTS));
1669     }
1670     details_compare.End();
1671   }
1672   key_compare.End();
1673
1674   return Pop();
1675 }
1676
1677
1678 HValue* HGraphBuilder::BuildElementIndexHash(HValue* index) {
1679   int32_t seed_value = static_cast<uint32_t>(isolate()->heap()->HashSeed());
1680   HValue* seed = Add<HConstant>(seed_value);
1681   HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, index, seed);
1682
1683   // hash = ~hash + (hash << 15);
1684   HValue* shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(15));
1685   HValue* not_hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash,
1686                                            graph()->GetConstantMinus1());
1687   hash = AddUncasted<HAdd>(shifted_hash, not_hash);
1688
1689   // hash = hash ^ (hash >> 12);
1690   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(12));
1691   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1692
1693   // hash = hash + (hash << 2);
1694   shifted_hash = AddUncasted<HShl>(hash, Add<HConstant>(2));
1695   hash = AddUncasted<HAdd>(hash, shifted_hash);
1696
1697   // hash = hash ^ (hash >> 4);
1698   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(4));
1699   hash = AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1700
1701   // hash = hash * 2057;
1702   hash = AddUncasted<HMul>(hash, Add<HConstant>(2057));
1703   hash->ClearFlag(HValue::kCanOverflow);
1704
1705   // hash = hash ^ (hash >> 16);
1706   shifted_hash = AddUncasted<HShr>(hash, Add<HConstant>(16));
1707   return AddUncasted<HBitwise>(Token::BIT_XOR, hash, shifted_hash);
1708 }
1709
1710
1711 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoad(HValue* receiver,
1712                                                            HValue* elements,
1713                                                            HValue* key,
1714                                                            HValue* hash) {
1715   HValue* capacity = Add<HLoadKeyed>(
1716       elements,
1717       Add<HConstant>(NameDictionary::kCapacityIndex),
1718       static_cast<HValue*>(NULL),
1719       FAST_ELEMENTS);
1720
1721   HValue* mask = AddUncasted<HSub>(capacity, graph()->GetConstant1());
1722   mask->ChangeRepresentation(Representation::Integer32());
1723   mask->ClearFlag(HValue::kCanOverflow);
1724
1725   return BuildUncheckedDictionaryElementLoadHelper(elements, key,
1726                                                    hash, mask, 0);
1727 }
1728
1729
1730 HValue* HGraphBuilder::BuildRegExpConstructResult(HValue* length,
1731                                                   HValue* index,
1732                                                   HValue* input) {
1733   NoObservableSideEffectsScope scope(this);
1734   HConstant* max_length = Add<HConstant>(JSObject::kInitialMaxFastElementArray);
1735   Add<HBoundsCheck>(length, max_length);
1736
1737   // Generate size calculation code here in order to make it dominate
1738   // the JSRegExpResult allocation.
1739   ElementsKind elements_kind = FAST_ELEMENTS;
1740   HValue* size = BuildCalculateElementsSize(elements_kind, length);
1741
1742   // Allocate the JSRegExpResult and the FixedArray in one step.
1743   HValue* result = Add<HAllocate>(
1744       Add<HConstant>(JSRegExpResult::kSize), HType::JSArray(),
1745       NOT_TENURED, JS_ARRAY_TYPE);
1746
1747   // Initialize the JSRegExpResult header.
1748   HValue* global_object = Add<HLoadNamedField>(
1749       context(), static_cast<HValue*>(NULL),
1750       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
1751   HValue* native_context = Add<HLoadNamedField>(
1752       global_object, static_cast<HValue*>(NULL),
1753       HObjectAccess::ForGlobalObjectNativeContext());
1754   Add<HStoreNamedField>(
1755       result, HObjectAccess::ForMap(),
1756       Add<HLoadNamedField>(
1757           native_context, static_cast<HValue*>(NULL),
1758           HObjectAccess::ForContextSlot(Context::REGEXP_RESULT_MAP_INDEX)));
1759   HConstant* empty_fixed_array =
1760       Add<HConstant>(isolate()->factory()->empty_fixed_array());
1761   Add<HStoreNamedField>(
1762       result, HObjectAccess::ForJSArrayOffset(JSArray::kPropertiesOffset),
1763       empty_fixed_array);
1764   Add<HStoreNamedField>(
1765       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1766       empty_fixed_array);
1767   Add<HStoreNamedField>(
1768       result, HObjectAccess::ForJSArrayOffset(JSArray::kLengthOffset), length);
1769
1770   // Initialize the additional fields.
1771   Add<HStoreNamedField>(
1772       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kIndexOffset),
1773       index);
1774   Add<HStoreNamedField>(
1775       result, HObjectAccess::ForJSArrayOffset(JSRegExpResult::kInputOffset),
1776       input);
1777
1778   // Allocate and initialize the elements header.
1779   HAllocate* elements = BuildAllocateElements(elements_kind, size);
1780   BuildInitializeElementsHeader(elements, elements_kind, length);
1781
1782   HConstant* size_in_bytes_upper_bound = EstablishElementsAllocationSize(
1783       elements_kind, max_length->Integer32Value());
1784   elements->set_size_upper_bound(size_in_bytes_upper_bound);
1785
1786   Add<HStoreNamedField>(
1787       result, HObjectAccess::ForJSArrayOffset(JSArray::kElementsOffset),
1788       elements);
1789
1790   // Initialize the elements contents with undefined.
1791   BuildFillElementsWithValue(
1792       elements, elements_kind, graph()->GetConstant0(), length,
1793       graph()->GetConstantUndefined());
1794
1795   return result;
1796 }
1797
1798
1799 HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
1800   NoObservableSideEffectsScope scope(this);
1801
1802   // Convert constant numbers at compile time.
1803   if (object->IsConstant() && HConstant::cast(object)->HasNumberValue()) {
1804     Handle<Object> number = HConstant::cast(object)->handle(isolate());
1805     Handle<String> result = isolate()->factory()->NumberToString(number);
1806     return Add<HConstant>(result);
1807   }
1808
1809   // Create a joinable continuation.
1810   HIfContinuation found(graph()->CreateBasicBlock(),
1811                         graph()->CreateBasicBlock());
1812
1813   // Load the number string cache.
1814   HValue* number_string_cache =
1815       Add<HLoadRoot>(Heap::kNumberStringCacheRootIndex);
1816
1817   // Make the hash mask from the length of the number string cache. It
1818   // contains two elements (number and string) for each cache entry.
1819   HValue* mask = AddLoadFixedArrayLength(number_string_cache);
1820   mask->set_type(HType::Smi());
1821   mask = AddUncasted<HSar>(mask, graph()->GetConstant1());
1822   mask = AddUncasted<HSub>(mask, graph()->GetConstant1());
1823
1824   // Check whether object is a smi.
1825   IfBuilder if_objectissmi(this);
1826   if_objectissmi.If<HIsSmiAndBranch>(object);
1827   if_objectissmi.Then();
1828   {
1829     // Compute hash for smi similar to smi_get_hash().
1830     HValue* hash = AddUncasted<HBitwise>(Token::BIT_AND, object, mask);
1831
1832     // Load the key.
1833     HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1834     HValue* key = Add<HLoadKeyed>(number_string_cache, key_index,
1835                                   static_cast<HValue*>(NULL),
1836                                   FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1837
1838     // Check if object == key.
1839     IfBuilder if_objectiskey(this);
1840     if_objectiskey.If<HCompareObjectEqAndBranch>(object, key);
1841     if_objectiskey.Then();
1842     {
1843       // Make the key_index available.
1844       Push(key_index);
1845     }
1846     if_objectiskey.JoinContinuation(&found);
1847   }
1848   if_objectissmi.Else();
1849   {
1850     if (type->Is(Type::SignedSmall())) {
1851       if_objectissmi.Deopt("Expected smi");
1852     } else {
1853       // Check if the object is a heap number.
1854       IfBuilder if_objectisnumber(this);
1855       HValue* objectisnumber = if_objectisnumber.If<HCompareMap>(
1856           object, isolate()->factory()->heap_number_map());
1857       if_objectisnumber.Then();
1858       {
1859         // Compute hash for heap number similar to double_get_hash().
1860         HValue* low = Add<HLoadNamedField>(
1861             object, objectisnumber,
1862             HObjectAccess::ForHeapNumberValueLowestBits());
1863         HValue* high = Add<HLoadNamedField>(
1864             object, objectisnumber,
1865             HObjectAccess::ForHeapNumberValueHighestBits());
1866         HValue* hash = AddUncasted<HBitwise>(Token::BIT_XOR, low, high);
1867         hash = AddUncasted<HBitwise>(Token::BIT_AND, hash, mask);
1868
1869         // Load the key.
1870         HValue* key_index = AddUncasted<HShl>(hash, graph()->GetConstant1());
1871         HValue* key = Add<HLoadKeyed>(number_string_cache, key_index,
1872                                       static_cast<HValue*>(NULL),
1873                                       FAST_ELEMENTS, ALLOW_RETURN_HOLE);
1874
1875         // Check if the key is a heap number and compare it with the object.
1876         IfBuilder if_keyisnotsmi(this);
1877         HValue* keyisnotsmi = if_keyisnotsmi.IfNot<HIsSmiAndBranch>(key);
1878         if_keyisnotsmi.Then();
1879         {
1880           IfBuilder if_keyisheapnumber(this);
1881           if_keyisheapnumber.If<HCompareMap>(
1882               key, isolate()->factory()->heap_number_map());
1883           if_keyisheapnumber.Then();
1884           {
1885             // Check if values of key and object match.
1886             IfBuilder if_keyeqobject(this);
1887             if_keyeqobject.If<HCompareNumericAndBranch>(
1888                 Add<HLoadNamedField>(key, keyisnotsmi,
1889                                      HObjectAccess::ForHeapNumberValue()),
1890                 Add<HLoadNamedField>(object, objectisnumber,
1891                                      HObjectAccess::ForHeapNumberValue()),
1892                 Token::EQ);
1893             if_keyeqobject.Then();
1894             {
1895               // Make the key_index available.
1896               Push(key_index);
1897             }
1898             if_keyeqobject.JoinContinuation(&found);
1899           }
1900           if_keyisheapnumber.JoinContinuation(&found);
1901         }
1902         if_keyisnotsmi.JoinContinuation(&found);
1903       }
1904       if_objectisnumber.Else();
1905       {
1906         if (type->Is(Type::Number())) {
1907           if_objectisnumber.Deopt("Expected heap number");
1908         }
1909       }
1910       if_objectisnumber.JoinContinuation(&found);
1911     }
1912   }
1913   if_objectissmi.JoinContinuation(&found);
1914
1915   // Check for cache hit.
1916   IfBuilder if_found(this, &found);
1917   if_found.Then();
1918   {
1919     // Count number to string operation in native code.
1920     AddIncrementCounter(isolate()->counters()->number_to_string_native());
1921
1922     // Load the value in case of cache hit.
1923     HValue* key_index = Pop();
1924     HValue* value_index = AddUncasted<HAdd>(key_index, graph()->GetConstant1());
1925     Push(Add<HLoadKeyed>(number_string_cache, value_index,
1926                          static_cast<HValue*>(NULL),
1927                          FAST_ELEMENTS, ALLOW_RETURN_HOLE));
1928   }
1929   if_found.Else();
1930   {
1931     // Cache miss, fallback to runtime.
1932     Add<HPushArguments>(object);
1933     Push(Add<HCallRuntime>(
1934             isolate()->factory()->empty_string(),
1935             Runtime::FunctionForId(Runtime::kHiddenNumberToStringSkipCache),
1936             1));
1937   }
1938   if_found.End();
1939
1940   return Pop();
1941 }
1942
1943
1944 HAllocate* HGraphBuilder::BuildAllocate(
1945     HValue* object_size,
1946     HType type,
1947     InstanceType instance_type,
1948     HAllocationMode allocation_mode) {
1949   // Compute the effective allocation size.
1950   HValue* size = object_size;
1951   if (allocation_mode.CreateAllocationMementos()) {
1952     size = AddUncasted<HAdd>(size, Add<HConstant>(AllocationMemento::kSize));
1953     size->ClearFlag(HValue::kCanOverflow);
1954   }
1955
1956   // Perform the actual allocation.
1957   HAllocate* object = Add<HAllocate>(
1958       size, type, allocation_mode.GetPretenureMode(),
1959       instance_type, allocation_mode.feedback_site());
1960
1961   // Setup the allocation memento.
1962   if (allocation_mode.CreateAllocationMementos()) {
1963     BuildCreateAllocationMemento(
1964         object, object_size, allocation_mode.current_site());
1965   }
1966
1967   return object;
1968 }
1969
1970
1971 HValue* HGraphBuilder::BuildAddStringLengths(HValue* left_length,
1972                                              HValue* right_length) {
1973   // Compute the combined string length and check against max string length.
1974   HValue* length = AddUncasted<HAdd>(left_length, right_length);
1975   // Check that length <= kMaxLength <=> length < MaxLength + 1.
1976   HValue* max_length = Add<HConstant>(String::kMaxLength + 1);
1977   Add<HBoundsCheck>(length, max_length);
1978   return length;
1979 }
1980
1981
1982 HValue* HGraphBuilder::BuildCreateConsString(
1983     HValue* length,
1984     HValue* left,
1985     HValue* right,
1986     HAllocationMode allocation_mode) {
1987   // Determine the string instance types.
1988   HInstruction* left_instance_type = AddLoadStringInstanceType(left);
1989   HInstruction* right_instance_type = AddLoadStringInstanceType(right);
1990
1991   // Allocate the cons string object. HAllocate does not care whether we
1992   // pass CONS_STRING_TYPE or CONS_ASCII_STRING_TYPE here, so we just use
1993   // CONS_STRING_TYPE here. Below we decide whether the cons string is
1994   // one-byte or two-byte and set the appropriate map.
1995   ASSERT(HAllocate::CompatibleInstanceTypes(CONS_STRING_TYPE,
1996                                             CONS_ASCII_STRING_TYPE));
1997   HAllocate* result = BuildAllocate(Add<HConstant>(ConsString::kSize),
1998                                     HType::String(), CONS_STRING_TYPE,
1999                                     allocation_mode);
2000
2001   // Compute intersection and difference of instance types.
2002   HValue* anded_instance_types = AddUncasted<HBitwise>(
2003       Token::BIT_AND, left_instance_type, right_instance_type);
2004   HValue* xored_instance_types = AddUncasted<HBitwise>(
2005       Token::BIT_XOR, left_instance_type, right_instance_type);
2006
2007   // We create a one-byte cons string if
2008   // 1. both strings are one-byte, or
2009   // 2. at least one of the strings is two-byte, but happens to contain only
2010   //    one-byte characters.
2011   // To do this, we check
2012   // 1. if both strings are one-byte, or if the one-byte data hint is set in
2013   //    both strings, or
2014   // 2. if one of the strings has the one-byte data hint set and the other
2015   //    string is one-byte.
2016   IfBuilder if_onebyte(this);
2017   STATIC_ASSERT(kOneByteStringTag != 0);
2018   STATIC_ASSERT(kOneByteDataHintMask != 0);
2019   if_onebyte.If<HCompareNumericAndBranch>(
2020       AddUncasted<HBitwise>(
2021           Token::BIT_AND, anded_instance_types,
2022           Add<HConstant>(static_cast<int32_t>(
2023                   kStringEncodingMask | kOneByteDataHintMask))),
2024       graph()->GetConstant0(), Token::NE);
2025   if_onebyte.Or();
2026   STATIC_ASSERT(kOneByteStringTag != 0 &&
2027                 kOneByteDataHintTag != 0 &&
2028                 kOneByteDataHintTag != kOneByteStringTag);
2029   if_onebyte.If<HCompareNumericAndBranch>(
2030       AddUncasted<HBitwise>(
2031           Token::BIT_AND, xored_instance_types,
2032           Add<HConstant>(static_cast<int32_t>(
2033                   kOneByteStringTag | kOneByteDataHintTag))),
2034       Add<HConstant>(static_cast<int32_t>(
2035               kOneByteStringTag | kOneByteDataHintTag)), Token::EQ);
2036   if_onebyte.Then();
2037   {
2038     // We can safely skip the write barrier for storing the map here.
2039     Add<HStoreNamedField>(
2040         result, HObjectAccess::ForMap(),
2041         Add<HConstant>(isolate()->factory()->cons_ascii_string_map()));
2042   }
2043   if_onebyte.Else();
2044   {
2045     // We can safely skip the write barrier for storing the map here.
2046     Add<HStoreNamedField>(
2047         result, HObjectAccess::ForMap(),
2048         Add<HConstant>(isolate()->factory()->cons_string_map()));
2049   }
2050   if_onebyte.End();
2051
2052   // Initialize the cons string fields.
2053   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2054                         Add<HConstant>(String::kEmptyHashField));
2055   Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2056   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
2057   Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
2058
2059   // Count the native string addition.
2060   AddIncrementCounter(isolate()->counters()->string_add_native());
2061
2062   return result;
2063 }
2064
2065
2066 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
2067                                             HValue* src_offset,
2068                                             String::Encoding src_encoding,
2069                                             HValue* dst,
2070                                             HValue* dst_offset,
2071                                             String::Encoding dst_encoding,
2072                                             HValue* length) {
2073   ASSERT(dst_encoding != String::ONE_BYTE_ENCODING ||
2074          src_encoding == String::ONE_BYTE_ENCODING);
2075   LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
2076   HValue* index = loop.BeginBody(graph()->GetConstant0(), length, Token::LT);
2077   {
2078     HValue* src_index = AddUncasted<HAdd>(src_offset, index);
2079     HValue* value =
2080         AddUncasted<HSeqStringGetChar>(src_encoding, src, src_index);
2081     HValue* dst_index = AddUncasted<HAdd>(dst_offset, index);
2082     Add<HSeqStringSetChar>(dst_encoding, dst, dst_index, value);
2083   }
2084   loop.EndBody();
2085 }
2086
2087
2088 HValue* HGraphBuilder::BuildObjectSizeAlignment(
2089     HValue* unaligned_size, int header_size) {
2090   ASSERT((header_size & kObjectAlignmentMask) == 0);
2091   HValue* size = AddUncasted<HAdd>(
2092       unaligned_size, Add<HConstant>(static_cast<int32_t>(
2093           header_size + kObjectAlignmentMask)));
2094   size->ClearFlag(HValue::kCanOverflow);
2095   return AddUncasted<HBitwise>(
2096       Token::BIT_AND, size, Add<HConstant>(static_cast<int32_t>(
2097           ~kObjectAlignmentMask)));
2098 }
2099
2100
2101 HValue* HGraphBuilder::BuildUncheckedStringAdd(
2102     HValue* left,
2103     HValue* right,
2104     HAllocationMode allocation_mode) {
2105   // Determine the string lengths.
2106   HValue* left_length = AddLoadStringLength(left);
2107   HValue* right_length = AddLoadStringLength(right);
2108
2109   // Compute the combined string length.
2110   HValue* length = BuildAddStringLengths(left_length, right_length);
2111
2112   // Do some manual constant folding here.
2113   if (left_length->IsConstant()) {
2114     HConstant* c_left_length = HConstant::cast(left_length);
2115     ASSERT_NE(0, c_left_length->Integer32Value());
2116     if (c_left_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2117       // The right string contains at least one character.
2118       return BuildCreateConsString(length, left, right, allocation_mode);
2119     }
2120   } else if (right_length->IsConstant()) {
2121     HConstant* c_right_length = HConstant::cast(right_length);
2122     ASSERT_NE(0, c_right_length->Integer32Value());
2123     if (c_right_length->Integer32Value() + 1 >= ConsString::kMinLength) {
2124       // The left string contains at least one character.
2125       return BuildCreateConsString(length, left, right, allocation_mode);
2126     }
2127   }
2128
2129   // Check if we should create a cons string.
2130   IfBuilder if_createcons(this);
2131   if_createcons.If<HCompareNumericAndBranch>(
2132       length, Add<HConstant>(ConsString::kMinLength), Token::GTE);
2133   if_createcons.Then();
2134   {
2135     // Create a cons string.
2136     Push(BuildCreateConsString(length, left, right, allocation_mode));
2137   }
2138   if_createcons.Else();
2139   {
2140     // Determine the string instance types.
2141     HValue* left_instance_type = AddLoadStringInstanceType(left);
2142     HValue* right_instance_type = AddLoadStringInstanceType(right);
2143
2144     // Compute union and difference of instance types.
2145     HValue* ored_instance_types = AddUncasted<HBitwise>(
2146         Token::BIT_OR, left_instance_type, right_instance_type);
2147     HValue* xored_instance_types = AddUncasted<HBitwise>(
2148         Token::BIT_XOR, left_instance_type, right_instance_type);
2149
2150     // Check if both strings have the same encoding and both are
2151     // sequential.
2152     IfBuilder if_sameencodingandsequential(this);
2153     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2154         AddUncasted<HBitwise>(
2155             Token::BIT_AND, xored_instance_types,
2156             Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2157         graph()->GetConstant0(), Token::EQ);
2158     if_sameencodingandsequential.And();
2159     STATIC_ASSERT(kSeqStringTag == 0);
2160     if_sameencodingandsequential.If<HCompareNumericAndBranch>(
2161         AddUncasted<HBitwise>(
2162             Token::BIT_AND, ored_instance_types,
2163             Add<HConstant>(static_cast<int32_t>(kStringRepresentationMask))),
2164         graph()->GetConstant0(), Token::EQ);
2165     if_sameencodingandsequential.Then();
2166     {
2167       HConstant* string_map =
2168           Add<HConstant>(isolate()->factory()->string_map());
2169       HConstant* ascii_string_map =
2170           Add<HConstant>(isolate()->factory()->ascii_string_map());
2171
2172       // Determine map and size depending on whether result is one-byte string.
2173       IfBuilder if_onebyte(this);
2174       STATIC_ASSERT(kOneByteStringTag != 0);
2175       if_onebyte.If<HCompareNumericAndBranch>(
2176           AddUncasted<HBitwise>(
2177               Token::BIT_AND, ored_instance_types,
2178               Add<HConstant>(static_cast<int32_t>(kStringEncodingMask))),
2179           graph()->GetConstant0(), Token::NE);
2180       if_onebyte.Then();
2181       {
2182         // Allocate sequential one-byte string object.
2183         Push(length);
2184         Push(ascii_string_map);
2185       }
2186       if_onebyte.Else();
2187       {
2188         // Allocate sequential two-byte string object.
2189         HValue* size = AddUncasted<HShl>(length, graph()->GetConstant1());
2190         size->ClearFlag(HValue::kCanOverflow);
2191         size->SetFlag(HValue::kUint32);
2192         Push(size);
2193         Push(string_map);
2194       }
2195       if_onebyte.End();
2196       HValue* map = Pop();
2197
2198       // Calculate the number of bytes needed for the characters in the
2199       // string while observing object alignment.
2200       STATIC_ASSERT((SeqString::kHeaderSize & kObjectAlignmentMask) == 0);
2201       HValue* size = BuildObjectSizeAlignment(Pop(), SeqString::kHeaderSize);
2202
2203       // Allocate the string object. HAllocate does not care whether we pass
2204       // STRING_TYPE or ASCII_STRING_TYPE here, so we just use STRING_TYPE here.
2205       HAllocate* result = BuildAllocate(
2206           size, HType::String(), STRING_TYPE, allocation_mode);
2207       Add<HStoreNamedField>(result, HObjectAccess::ForMap(), map);
2208
2209       // Initialize the string fields.
2210       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
2211                             Add<HConstant>(String::kEmptyHashField));
2212       Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
2213
2214       // Copy characters to the result string.
2215       IfBuilder if_twobyte(this);
2216       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
2217       if_twobyte.Then();
2218       {
2219         // Copy characters from the left string.
2220         BuildCopySeqStringChars(
2221             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2222             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2223             left_length);
2224
2225         // Copy characters from the right string.
2226         BuildCopySeqStringChars(
2227             right, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
2228             result, left_length, String::TWO_BYTE_ENCODING,
2229             right_length);
2230       }
2231       if_twobyte.Else();
2232       {
2233         // Copy characters from the left string.
2234         BuildCopySeqStringChars(
2235             left, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2236             result, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2237             left_length);
2238
2239         // Copy characters from the right string.
2240         BuildCopySeqStringChars(
2241             right, graph()->GetConstant0(), String::ONE_BYTE_ENCODING,
2242             result, left_length, String::ONE_BYTE_ENCODING,
2243             right_length);
2244       }
2245       if_twobyte.End();
2246
2247       // Count the native string addition.
2248       AddIncrementCounter(isolate()->counters()->string_add_native());
2249
2250       // Return the sequential string.
2251       Push(result);
2252     }
2253     if_sameencodingandsequential.Else();
2254     {
2255       // Fallback to the runtime to add the two strings.
2256       Add<HPushArguments>(left, right);
2257       Push(Add<HCallRuntime>(
2258             isolate()->factory()->empty_string(),
2259             Runtime::FunctionForId(Runtime::kHiddenStringAdd),
2260             2));
2261     }
2262     if_sameencodingandsequential.End();
2263   }
2264   if_createcons.End();
2265
2266   return Pop();
2267 }
2268
2269
2270 HValue* HGraphBuilder::BuildStringAdd(
2271     HValue* left,
2272     HValue* right,
2273     HAllocationMode allocation_mode) {
2274   NoObservableSideEffectsScope no_effects(this);
2275
2276   // Determine string lengths.
2277   HValue* left_length = AddLoadStringLength(left);
2278   HValue* right_length = AddLoadStringLength(right);
2279
2280   // Check if left string is empty.
2281   IfBuilder if_leftempty(this);
2282   if_leftempty.If<HCompareNumericAndBranch>(
2283       left_length, graph()->GetConstant0(), Token::EQ);
2284   if_leftempty.Then();
2285   {
2286     // Count the native string addition.
2287     AddIncrementCounter(isolate()->counters()->string_add_native());
2288
2289     // Just return the right string.
2290     Push(right);
2291   }
2292   if_leftempty.Else();
2293   {
2294     // Check if right string is empty.
2295     IfBuilder if_rightempty(this);
2296     if_rightempty.If<HCompareNumericAndBranch>(
2297         right_length, graph()->GetConstant0(), Token::EQ);
2298     if_rightempty.Then();
2299     {
2300       // Count the native string addition.
2301       AddIncrementCounter(isolate()->counters()->string_add_native());
2302
2303       // Just return the left string.
2304       Push(left);
2305     }
2306     if_rightempty.Else();
2307     {
2308       // Add the two non-empty strings.
2309       Push(BuildUncheckedStringAdd(left, right, allocation_mode));
2310     }
2311     if_rightempty.End();
2312   }
2313   if_leftempty.End();
2314
2315   return Pop();
2316 }
2317
2318
2319 HInstruction* HGraphBuilder::BuildUncheckedMonomorphicElementAccess(
2320     HValue* checked_object,
2321     HValue* key,
2322     HValue* val,
2323     bool is_js_array,
2324     ElementsKind elements_kind,
2325     PropertyAccessType access_type,
2326     LoadKeyedHoleMode load_mode,
2327     KeyedAccessStoreMode store_mode) {
2328   ASSERT((!IsExternalArrayElementsKind(elements_kind) &&
2329               !IsFixedTypedArrayElementsKind(elements_kind)) ||
2330          !is_js_array);
2331   // No GVNFlag is necessary for ElementsKind if there is an explicit dependency
2332   // on a HElementsTransition instruction. The flag can also be removed if the
2333   // map to check has FAST_HOLEY_ELEMENTS, since there can be no further
2334   // ElementsKind transitions. Finally, the dependency can be removed for stores
2335   // for FAST_ELEMENTS, since a transition to HOLEY elements won't change the
2336   // generated store code.
2337   if ((elements_kind == FAST_HOLEY_ELEMENTS) ||
2338       (elements_kind == FAST_ELEMENTS && access_type == STORE)) {
2339     checked_object->ClearDependsOnFlag(kElementsKind);
2340   }
2341
2342   bool fast_smi_only_elements = IsFastSmiElementsKind(elements_kind);
2343   bool fast_elements = IsFastObjectElementsKind(elements_kind);
2344   HValue* elements = AddLoadElements(checked_object);
2345   if (access_type == STORE && (fast_elements || fast_smi_only_elements) &&
2346       store_mode != STORE_NO_TRANSITION_HANDLE_COW) {
2347     HCheckMaps* check_cow_map = Add<HCheckMaps>(
2348         elements, isolate()->factory()->fixed_array_map());
2349     check_cow_map->ClearDependsOnFlag(kElementsKind);
2350   }
2351   HInstruction* length = NULL;
2352   if (is_js_array) {
2353     length = Add<HLoadNamedField>(
2354         checked_object->ActualValue(), checked_object,
2355         HObjectAccess::ForArrayLength(elements_kind));
2356   } else {
2357     length = AddLoadFixedArrayLength(elements);
2358   }
2359   length->set_type(HType::Smi());
2360   HValue* checked_key = NULL;
2361   if (IsExternalArrayElementsKind(elements_kind) ||
2362       IsFixedTypedArrayElementsKind(elements_kind)) {
2363     HValue* backing_store;
2364     if (IsExternalArrayElementsKind(elements_kind)) {
2365       backing_store = Add<HLoadNamedField>(
2366           elements, static_cast<HValue*>(NULL),
2367           HObjectAccess::ForExternalArrayExternalPointer());
2368     } else {
2369       backing_store = elements;
2370     }
2371     if (store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
2372       NoObservableSideEffectsScope no_effects(this);
2373       IfBuilder length_checker(this);
2374       length_checker.If<HCompareNumericAndBranch>(key, length, Token::LT);
2375       length_checker.Then();
2376       IfBuilder negative_checker(this);
2377       HValue* bounds_check = negative_checker.If<HCompareNumericAndBranch>(
2378           key, graph()->GetConstant0(), Token::GTE);
2379       negative_checker.Then();
2380       HInstruction* result = AddElementAccess(
2381           backing_store, key, val, bounds_check, elements_kind, access_type);
2382       negative_checker.ElseDeopt("Negative key encountered");
2383       negative_checker.End();
2384       length_checker.End();
2385       return result;
2386     } else {
2387       ASSERT(store_mode == STANDARD_STORE);
2388       checked_key = Add<HBoundsCheck>(key, length);
2389       return AddElementAccess(
2390           backing_store, checked_key, val,
2391           checked_object, elements_kind, access_type);
2392     }
2393   }
2394   ASSERT(fast_smi_only_elements ||
2395          fast_elements ||
2396          IsFastDoubleElementsKind(elements_kind));
2397
2398   // In case val is stored into a fast smi array, assure that the value is a smi
2399   // before manipulating the backing store. Otherwise the actual store may
2400   // deopt, leaving the backing store in an invalid state.
2401   if (access_type == STORE && IsFastSmiElementsKind(elements_kind) &&
2402       !val->type().IsSmi()) {
2403     val = AddUncasted<HForceRepresentation>(val, Representation::Smi());
2404   }
2405
2406   if (IsGrowStoreMode(store_mode)) {
2407     NoObservableSideEffectsScope no_effects(this);
2408     Representation representation = HStoreKeyed::RequiredValueRepresentation(
2409         elements_kind, STORE_TO_INITIALIZED_ENTRY);
2410     val = AddUncasted<HForceRepresentation>(val, representation);
2411     elements = BuildCheckForCapacityGrow(checked_object, elements,
2412                                          elements_kind, length, key,
2413                                          is_js_array, access_type);
2414     checked_key = key;
2415   } else {
2416     checked_key = Add<HBoundsCheck>(key, length);
2417
2418     if (access_type == STORE && (fast_elements || fast_smi_only_elements)) {
2419       if (store_mode == STORE_NO_TRANSITION_HANDLE_COW) {
2420         NoObservableSideEffectsScope no_effects(this);
2421         elements = BuildCopyElementsOnWrite(checked_object, elements,
2422                                             elements_kind, length);
2423       } else {
2424         HCheckMaps* check_cow_map = Add<HCheckMaps>(
2425             elements, isolate()->factory()->fixed_array_map());
2426         check_cow_map->ClearDependsOnFlag(kElementsKind);
2427       }
2428     }
2429   }
2430   return AddElementAccess(elements, checked_key, val, checked_object,
2431                           elements_kind, access_type, load_mode);
2432 }
2433
2434
2435 HValue* HGraphBuilder::BuildAllocateArrayFromLength(
2436     JSArrayBuilder* array_builder,
2437     HValue* length_argument) {
2438   if (length_argument->IsConstant() &&
2439       HConstant::cast(length_argument)->HasSmiValue()) {
2440     int array_length = HConstant::cast(length_argument)->Integer32Value();
2441     if (array_length == 0) {
2442       return array_builder->AllocateEmptyArray();
2443     } else {
2444       return array_builder->AllocateArray(length_argument,
2445                                           array_length,
2446                                           length_argument);
2447     }
2448   }
2449
2450   HValue* constant_zero = graph()->GetConstant0();
2451   HConstant* max_alloc_length =
2452       Add<HConstant>(JSObject::kInitialMaxFastElementArray);
2453   HInstruction* checked_length = Add<HBoundsCheck>(length_argument,
2454                                                    max_alloc_length);
2455   IfBuilder if_builder(this);
2456   if_builder.If<HCompareNumericAndBranch>(checked_length, constant_zero,
2457                                           Token::EQ);
2458   if_builder.Then();
2459   const int initial_capacity = JSArray::kPreallocatedArrayElements;
2460   HConstant* initial_capacity_node = Add<HConstant>(initial_capacity);
2461   Push(initial_capacity_node);  // capacity
2462   Push(constant_zero);          // length
2463   if_builder.Else();
2464   if (!(top_info()->IsStub()) &&
2465       IsFastPackedElementsKind(array_builder->kind())) {
2466     // We'll come back later with better (holey) feedback.
2467     if_builder.Deopt("Holey array despite packed elements_kind feedback");
2468   } else {
2469     Push(checked_length);         // capacity
2470     Push(checked_length);         // length
2471   }
2472   if_builder.End();
2473
2474   // Figure out total size
2475   HValue* length = Pop();
2476   HValue* capacity = Pop();
2477   return array_builder->AllocateArray(capacity, max_alloc_length, length);
2478 }
2479
2480
2481 HValue* HGraphBuilder::BuildCalculateElementsSize(ElementsKind kind,
2482                                                   HValue* capacity) {
2483   int elements_size = IsFastDoubleElementsKind(kind)
2484       ? kDoubleSize
2485       : kPointerSize;
2486
2487   HConstant* elements_size_value = Add<HConstant>(elements_size);
2488   HInstruction* mul = HMul::NewImul(zone(), context(),
2489                                     capacity->ActualValue(),
2490                                     elements_size_value);
2491   AddInstruction(mul);
2492   mul->ClearFlag(HValue::kCanOverflow);
2493
2494   STATIC_ASSERT(FixedDoubleArray::kHeaderSize == FixedArray::kHeaderSize);
2495
2496   HConstant* header_size = Add<HConstant>(FixedArray::kHeaderSize);
2497   HValue* total_size = AddUncasted<HAdd>(mul, header_size);
2498   total_size->ClearFlag(HValue::kCanOverflow);
2499   return total_size;
2500 }
2501
2502
2503 HAllocate* HGraphBuilder::AllocateJSArrayObject(AllocationSiteMode mode) {
2504   int base_size = JSArray::kSize;
2505   if (mode == TRACK_ALLOCATION_SITE) {
2506     base_size += AllocationMemento::kSize;
2507   }
2508   HConstant* size_in_bytes = Add<HConstant>(base_size);
2509   return Add<HAllocate>(
2510       size_in_bytes, HType::JSArray(), NOT_TENURED, JS_OBJECT_TYPE);
2511 }
2512
2513
2514 HConstant* HGraphBuilder::EstablishElementsAllocationSize(
2515     ElementsKind kind,
2516     int capacity) {
2517   int base_size = IsFastDoubleElementsKind(kind)
2518       ? FixedDoubleArray::SizeFor(capacity)
2519       : FixedArray::SizeFor(capacity);
2520
2521   return Add<HConstant>(base_size);
2522 }
2523
2524
2525 HAllocate* HGraphBuilder::BuildAllocateElements(ElementsKind kind,
2526                                                 HValue* size_in_bytes) {
2527   InstanceType instance_type = IsFastDoubleElementsKind(kind)
2528       ? FIXED_DOUBLE_ARRAY_TYPE
2529       : FIXED_ARRAY_TYPE;
2530
2531   return Add<HAllocate>(size_in_bytes, HType::HeapObject(), NOT_TENURED,
2532                         instance_type);
2533 }
2534
2535
2536 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
2537                                                   ElementsKind kind,
2538                                                   HValue* capacity) {
2539   Factory* factory = isolate()->factory();
2540   Handle<Map> map = IsFastDoubleElementsKind(kind)
2541       ? factory->fixed_double_array_map()
2542       : factory->fixed_array_map();
2543
2544   Add<HStoreNamedField>(elements, HObjectAccess::ForMap(), Add<HConstant>(map));
2545   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
2546                         capacity);
2547 }
2548
2549
2550 HValue* HGraphBuilder::BuildAllocateElementsAndInitializeElementsHeader(
2551     ElementsKind kind,
2552     HValue* capacity) {
2553   // The HForceRepresentation is to prevent possible deopt on int-smi
2554   // conversion after allocation but before the new object fields are set.
2555   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
2556   HValue* size_in_bytes = BuildCalculateElementsSize(kind, capacity);
2557   HValue* new_elements = BuildAllocateElements(kind, size_in_bytes);
2558   BuildInitializeElementsHeader(new_elements, kind, capacity);
2559   return new_elements;
2560 }
2561
2562
2563 void HGraphBuilder::BuildJSArrayHeader(HValue* array,
2564                                        HValue* array_map,
2565                                        HValue* elements,
2566                                        AllocationSiteMode mode,
2567                                        ElementsKind elements_kind,
2568                                        HValue* allocation_site_payload,
2569                                        HValue* length_field) {
2570   Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
2571
2572   HConstant* empty_fixed_array =
2573     Add<HConstant>(isolate()->factory()->empty_fixed_array());
2574
2575   Add<HStoreNamedField>(
2576       array, HObjectAccess::ForPropertiesPointer(), empty_fixed_array);
2577
2578   Add<HStoreNamedField>(
2579       array, HObjectAccess::ForElementsPointer(),
2580       elements != NULL ? elements : empty_fixed_array);
2581
2582   Add<HStoreNamedField>(
2583       array, HObjectAccess::ForArrayLength(elements_kind), length_field);
2584
2585   if (mode == TRACK_ALLOCATION_SITE) {
2586     BuildCreateAllocationMemento(
2587         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
2588   }
2589 }
2590
2591
2592 HInstruction* HGraphBuilder::AddElementAccess(
2593     HValue* elements,
2594     HValue* checked_key,
2595     HValue* val,
2596     HValue* dependency,
2597     ElementsKind elements_kind,
2598     PropertyAccessType access_type,
2599     LoadKeyedHoleMode load_mode) {
2600   if (access_type == STORE) {
2601     ASSERT(val != NULL);
2602     if (elements_kind == EXTERNAL_UINT8_CLAMPED_ELEMENTS ||
2603         elements_kind == UINT8_CLAMPED_ELEMENTS) {
2604       val = Add<HClampToUint8>(val);
2605     }
2606     return Add<HStoreKeyed>(elements, checked_key, val, elements_kind,
2607                             STORE_TO_INITIALIZED_ENTRY);
2608   }
2609
2610   ASSERT(access_type == LOAD);
2611   ASSERT(val == NULL);
2612   HLoadKeyed* load = Add<HLoadKeyed>(
2613       elements, checked_key, dependency, elements_kind, load_mode);
2614   if (FLAG_opt_safe_uint32_operations &&
2615       (elements_kind == EXTERNAL_UINT32_ELEMENTS ||
2616        elements_kind == UINT32_ELEMENTS)) {
2617     graph()->RecordUint32Instruction(load);
2618   }
2619   return load;
2620 }
2621
2622
2623 HLoadNamedField* HGraphBuilder::AddLoadMap(HValue* object,
2624                                            HValue* dependency) {
2625   return Add<HLoadNamedField>(object, dependency, HObjectAccess::ForMap());
2626 }
2627
2628
2629 HLoadNamedField* HGraphBuilder::AddLoadElements(HValue* object,
2630                                                 HValue* dependency) {
2631   return Add<HLoadNamedField>(
2632       object, dependency, HObjectAccess::ForElementsPointer());
2633 }
2634
2635
2636 HLoadNamedField* HGraphBuilder::AddLoadFixedArrayLength(
2637     HValue* array,
2638     HValue* dependency) {
2639   return Add<HLoadNamedField>(
2640       array, dependency, HObjectAccess::ForFixedArrayLength());
2641 }
2642
2643
2644 HLoadNamedField* HGraphBuilder::AddLoadArrayLength(HValue* array,
2645                                                    ElementsKind kind,
2646                                                    HValue* dependency) {
2647   return Add<HLoadNamedField>(
2648       array, dependency, HObjectAccess::ForArrayLength(kind));
2649 }
2650
2651
2652 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* old_capacity) {
2653   HValue* half_old_capacity = AddUncasted<HShr>(old_capacity,
2654                                                 graph_->GetConstant1());
2655
2656   HValue* new_capacity = AddUncasted<HAdd>(half_old_capacity, old_capacity);
2657   new_capacity->ClearFlag(HValue::kCanOverflow);
2658
2659   HValue* min_growth = Add<HConstant>(16);
2660
2661   new_capacity = AddUncasted<HAdd>(new_capacity, min_growth);
2662   new_capacity->ClearFlag(HValue::kCanOverflow);
2663
2664   return new_capacity;
2665 }
2666
2667
2668 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
2669                                                  HValue* elements,
2670                                                  ElementsKind kind,
2671                                                  ElementsKind new_kind,
2672                                                  HValue* length,
2673                                                  HValue* new_capacity) {
2674   Add<HBoundsCheck>(new_capacity, Add<HConstant>(
2675           (Page::kMaxRegularHeapObjectSize - FixedArray::kHeaderSize) >>
2676           ElementsKindToShiftSize(kind)));
2677
2678   HValue* new_elements = BuildAllocateElementsAndInitializeElementsHeader(
2679       new_kind, new_capacity);
2680
2681   BuildCopyElements(elements, kind, new_elements,
2682                     new_kind, length, new_capacity);
2683
2684   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
2685                         new_elements);
2686
2687   return new_elements;
2688 }
2689
2690
2691 void HGraphBuilder::BuildFillElementsWithValue(HValue* elements,
2692                                                ElementsKind elements_kind,
2693                                                HValue* from,
2694                                                HValue* to,
2695                                                HValue* value) {
2696   if (to == NULL) {
2697     to = AddLoadFixedArrayLength(elements);
2698   }
2699
2700   // Special loop unfolding case
2701   STATIC_ASSERT(JSArray::kPreallocatedArrayElements <=
2702                 kElementLoopUnrollThreshold);
2703   int initial_capacity = -1;
2704   if (from->IsInteger32Constant() && to->IsInteger32Constant()) {
2705     int constant_from = from->GetInteger32Constant();
2706     int constant_to = to->GetInteger32Constant();
2707
2708     if (constant_from == 0 && constant_to <= kElementLoopUnrollThreshold) {
2709       initial_capacity = constant_to;
2710     }
2711   }
2712
2713   // Since we're about to store a hole value, the store instruction below must
2714   // assume an elements kind that supports heap object values.
2715   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
2716     elements_kind = FAST_HOLEY_ELEMENTS;
2717   }
2718
2719   if (initial_capacity >= 0) {
2720     for (int i = 0; i < initial_capacity; i++) {
2721       HInstruction* key = Add<HConstant>(i);
2722       Add<HStoreKeyed>(elements, key, value, elements_kind);
2723     }
2724   } else {
2725     // Carefully loop backwards so that the "from" remains live through the loop
2726     // rather than the to. This often corresponds to keeping length live rather
2727     // then capacity, which helps register allocation, since length is used more
2728     // other than capacity after filling with holes.
2729     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2730
2731     HValue* key = builder.BeginBody(to, from, Token::GT);
2732
2733     HValue* adjusted_key = AddUncasted<HSub>(key, graph()->GetConstant1());
2734     adjusted_key->ClearFlag(HValue::kCanOverflow);
2735
2736     Add<HStoreKeyed>(elements, adjusted_key, value, elements_kind);
2737
2738     builder.EndBody();
2739   }
2740 }
2741
2742
2743 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
2744                                               ElementsKind elements_kind,
2745                                               HValue* from,
2746                                               HValue* to) {
2747   // Fast elements kinds need to be initialized in case statements below cause a
2748   // garbage collection.
2749   Factory* factory = isolate()->factory();
2750
2751   double nan_double = FixedDoubleArray::hole_nan_as_double();
2752   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
2753       ? Add<HConstant>(factory->the_hole_value())
2754       : Add<HConstant>(nan_double);
2755
2756   BuildFillElementsWithValue(elements, elements_kind, from, to, hole);
2757 }
2758
2759
2760 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
2761                                       ElementsKind from_elements_kind,
2762                                       HValue* to_elements,
2763                                       ElementsKind to_elements_kind,
2764                                       HValue* length,
2765                                       HValue* capacity) {
2766   int constant_capacity = -1;
2767   if (capacity != NULL &&
2768       capacity->IsConstant() &&
2769       HConstant::cast(capacity)->HasInteger32Value()) {
2770     int constant_candidate = HConstant::cast(capacity)->Integer32Value();
2771     if (constant_candidate <= kElementLoopUnrollThreshold) {
2772       constant_capacity = constant_candidate;
2773     }
2774   }
2775
2776   bool pre_fill_with_holes =
2777     IsFastDoubleElementsKind(from_elements_kind) &&
2778     IsFastObjectElementsKind(to_elements_kind);
2779   if (pre_fill_with_holes) {
2780     // If the copy might trigger a GC, make sure that the FixedArray is
2781     // pre-initialized with holes to make sure that it's always in a
2782     // consistent state.
2783     BuildFillElementsWithHole(to_elements, to_elements_kind,
2784                               graph()->GetConstant0(), NULL);
2785   }
2786
2787   if (constant_capacity != -1) {
2788     // Unroll the loop for small elements kinds.
2789     for (int i = 0; i < constant_capacity; i++) {
2790       HValue* key_constant = Add<HConstant>(i);
2791       HInstruction* value = Add<HLoadKeyed>(from_elements, key_constant,
2792                                             static_cast<HValue*>(NULL),
2793                                             from_elements_kind);
2794       Add<HStoreKeyed>(to_elements, key_constant, value, to_elements_kind);
2795     }
2796   } else {
2797     if (!pre_fill_with_holes &&
2798         (capacity == NULL || !length->Equals(capacity))) {
2799       BuildFillElementsWithHole(to_elements, to_elements_kind,
2800                                 length, NULL);
2801     }
2802
2803     if (capacity == NULL) {
2804       capacity = AddLoadFixedArrayLength(to_elements);
2805     }
2806
2807     LoopBuilder builder(this, context(), LoopBuilder::kPostDecrement);
2808
2809     HValue* key = builder.BeginBody(length, graph()->GetConstant0(),
2810                                     Token::GT);
2811
2812     key = AddUncasted<HSub>(key, graph()->GetConstant1());
2813     key->ClearFlag(HValue::kCanOverflow);
2814
2815     HValue* element = Add<HLoadKeyed>(from_elements, key,
2816                                       static_cast<HValue*>(NULL),
2817                                       from_elements_kind,
2818                                       ALLOW_RETURN_HOLE);
2819
2820     ElementsKind kind = (IsHoleyElementsKind(from_elements_kind) &&
2821                          IsFastSmiElementsKind(to_elements_kind))
2822       ? FAST_HOLEY_ELEMENTS : to_elements_kind;
2823
2824     if (IsHoleyElementsKind(from_elements_kind) &&
2825         from_elements_kind != to_elements_kind) {
2826       IfBuilder if_hole(this);
2827       if_hole.If<HCompareHoleAndBranch>(element);
2828       if_hole.Then();
2829       HConstant* hole_constant = IsFastDoubleElementsKind(to_elements_kind)
2830         ? Add<HConstant>(FixedDoubleArray::hole_nan_as_double())
2831         : graph()->GetConstantHole();
2832       Add<HStoreKeyed>(to_elements, key, hole_constant, kind);
2833       if_hole.Else();
2834       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
2835       store->SetFlag(HValue::kAllowUndefinedAsNaN);
2836       if_hole.End();
2837     } else {
2838       HStoreKeyed* store = Add<HStoreKeyed>(to_elements, key, element, kind);
2839       store->SetFlag(HValue::kAllowUndefinedAsNaN);
2840     }
2841
2842     builder.EndBody();
2843   }
2844
2845   Counters* counters = isolate()->counters();
2846   AddIncrementCounter(counters->inlined_copied_elements());
2847 }
2848
2849
2850 HValue* HGraphBuilder::BuildCloneShallowArrayCow(HValue* boilerplate,
2851                                                  HValue* allocation_site,
2852                                                  AllocationSiteMode mode,
2853                                                  ElementsKind kind) {
2854   HAllocate* array = AllocateJSArrayObject(mode);
2855
2856   HValue* map = AddLoadMap(boilerplate);
2857   HValue* elements = AddLoadElements(boilerplate);
2858   HValue* length = AddLoadArrayLength(boilerplate, kind);
2859
2860   BuildJSArrayHeader(array,
2861                      map,
2862                      elements,
2863                      mode,
2864                      FAST_ELEMENTS,
2865                      allocation_site,
2866                      length);
2867   return array;
2868 }
2869
2870
2871 HValue* HGraphBuilder::BuildCloneShallowArrayEmpty(HValue* boilerplate,
2872                                                    HValue* allocation_site,
2873                                                    AllocationSiteMode mode) {
2874   HAllocate* array = AllocateJSArrayObject(mode);
2875
2876   HValue* map = AddLoadMap(boilerplate);
2877
2878   BuildJSArrayHeader(array,
2879                      map,
2880                      NULL,  // set elements to empty fixed array
2881                      mode,
2882                      FAST_ELEMENTS,
2883                      allocation_site,
2884                      graph()->GetConstant0());
2885   return array;
2886 }
2887
2888
2889 HValue* HGraphBuilder::BuildCloneShallowArrayNonEmpty(HValue* boilerplate,
2890                                                       HValue* allocation_site,
2891                                                       AllocationSiteMode mode,
2892                                                       ElementsKind kind) {
2893   HValue* boilerplate_elements = AddLoadElements(boilerplate);
2894   HValue* capacity = AddLoadFixedArrayLength(boilerplate_elements);
2895
2896   // Generate size calculation code here in order to make it dominate
2897   // the JSArray allocation.
2898   HValue* elements_size = BuildCalculateElementsSize(kind, capacity);
2899
2900   // Create empty JSArray object for now, store elimination should remove
2901   // redundant initialization of elements and length fields and at the same
2902   // time the object will be fully prepared for GC if it happens during
2903   // elements allocation.
2904   HValue* result = BuildCloneShallowArrayEmpty(
2905       boilerplate, allocation_site, mode);
2906
2907   HAllocate* elements = BuildAllocateElements(kind, elements_size);
2908
2909   // This function implicitly relies on the fact that the
2910   // FastCloneShallowArrayStub is called only for literals shorter than
2911   // JSObject::kInitialMaxFastElementArray.
2912   // Can't add HBoundsCheck here because otherwise the stub will eager a frame.
2913   HConstant* size_upper_bound = EstablishElementsAllocationSize(
2914       kind, JSObject::kInitialMaxFastElementArray);
2915   elements->set_size_upper_bound(size_upper_bound);
2916
2917   Add<HStoreNamedField>(result, HObjectAccess::ForElementsPointer(), elements);
2918
2919   // The allocation for the cloned array above causes register pressure on
2920   // machines with low register counts. Force a reload of the boilerplate
2921   // elements here to free up a register for the allocation to avoid unnecessary
2922   // spillage.
2923   boilerplate_elements = AddLoadElements(boilerplate);
2924   boilerplate_elements->SetFlag(HValue::kCantBeReplaced);
2925
2926   // Copy the elements array header.
2927   for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
2928     HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
2929     Add<HStoreNamedField>(elements, access,
2930         Add<HLoadNamedField>(boilerplate_elements,
2931                              static_cast<HValue*>(NULL), access));
2932   }
2933
2934   // And the result of the length
2935   HValue* length = AddLoadArrayLength(boilerplate, kind);
2936   Add<HStoreNamedField>(result, HObjectAccess::ForArrayLength(kind), length);
2937
2938   BuildCopyElements(boilerplate_elements, kind, elements,
2939                     kind, length, NULL);
2940   return result;
2941 }
2942
2943
2944 void HGraphBuilder::BuildCompareNil(
2945     HValue* value,
2946     Type* type,
2947     HIfContinuation* continuation) {
2948   IfBuilder if_nil(this);
2949   bool some_case_handled = false;
2950   bool some_case_missing = false;
2951
2952   if (type->Maybe(Type::Null())) {
2953     if (some_case_handled) if_nil.Or();
2954     if_nil.If<HCompareObjectEqAndBranch>(value, graph()->GetConstantNull());
2955     some_case_handled = true;
2956   } else {
2957     some_case_missing = true;
2958   }
2959
2960   if (type->Maybe(Type::Undefined())) {
2961     if (some_case_handled) if_nil.Or();
2962     if_nil.If<HCompareObjectEqAndBranch>(value,
2963                                          graph()->GetConstantUndefined());
2964     some_case_handled = true;
2965   } else {
2966     some_case_missing = true;
2967   }
2968
2969   if (type->Maybe(Type::Undetectable())) {
2970     if (some_case_handled) if_nil.Or();
2971     if_nil.If<HIsUndetectableAndBranch>(value);
2972     some_case_handled = true;
2973   } else {
2974     some_case_missing = true;
2975   }
2976
2977   if (some_case_missing) {
2978     if_nil.Then();
2979     if_nil.Else();
2980     if (type->NumClasses() == 1) {
2981       BuildCheckHeapObject(value);
2982       // For ICs, the map checked below is a sentinel map that gets replaced by
2983       // the monomorphic map when the code is used as a template to generate a
2984       // new IC. For optimized functions, there is no sentinel map, the map
2985       // emitted below is the actual monomorphic map.
2986       Add<HCheckMaps>(value, type->Classes().Current());
2987     } else {
2988       if_nil.Deopt("Too many undetectable types");
2989     }
2990   }
2991
2992   if_nil.CaptureContinuation(continuation);
2993 }
2994
2995
2996 void HGraphBuilder::BuildCreateAllocationMemento(
2997     HValue* previous_object,
2998     HValue* previous_object_size,
2999     HValue* allocation_site) {
3000   ASSERT(allocation_site != NULL);
3001   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
3002       previous_object, previous_object_size, HType::HeapObject());
3003   AddStoreMapConstant(
3004       allocation_memento, isolate()->factory()->allocation_memento_map());
3005   Add<HStoreNamedField>(
3006       allocation_memento,
3007       HObjectAccess::ForAllocationMementoSite(),
3008       allocation_site);
3009   if (FLAG_allocation_site_pretenuring) {
3010     HValue* memento_create_count = Add<HLoadNamedField>(
3011         allocation_site, static_cast<HValue*>(NULL),
3012         HObjectAccess::ForAllocationSiteOffset(
3013             AllocationSite::kPretenureCreateCountOffset));
3014     memento_create_count = AddUncasted<HAdd>(
3015         memento_create_count, graph()->GetConstant1());
3016     // This smi value is reset to zero after every gc, overflow isn't a problem
3017     // since the counter is bounded by the new space size.
3018     memento_create_count->ClearFlag(HValue::kCanOverflow);
3019     Add<HStoreNamedField>(
3020         allocation_site, HObjectAccess::ForAllocationSiteOffset(
3021             AllocationSite::kPretenureCreateCountOffset), memento_create_count);
3022   }
3023 }
3024
3025
3026 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
3027   // Get the global context, then the native context
3028   HInstruction* context =
3029       Add<HLoadNamedField>(closure, static_cast<HValue*>(NULL),
3030                            HObjectAccess::ForFunctionContextPointer());
3031   HInstruction* global_object = Add<HLoadNamedField>(
3032       context, static_cast<HValue*>(NULL),
3033       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3034   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3035       GlobalObject::kNativeContextOffset);
3036   return Add<HLoadNamedField>(
3037       global_object, static_cast<HValue*>(NULL), access);
3038 }
3039
3040
3041 HInstruction* HGraphBuilder::BuildGetNativeContext() {
3042   // Get the global context, then the native context
3043   HValue* global_object = Add<HLoadNamedField>(
3044       context(), static_cast<HValue*>(NULL),
3045       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3046   return Add<HLoadNamedField>(
3047       global_object, static_cast<HValue*>(NULL),
3048       HObjectAccess::ForObservableJSObjectOffset(
3049           GlobalObject::kNativeContextOffset));
3050 }
3051
3052
3053 HInstruction* HGraphBuilder::BuildGetArrayFunction() {
3054   HInstruction* native_context = BuildGetNativeContext();
3055   HInstruction* index =
3056       Add<HConstant>(static_cast<int32_t>(Context::ARRAY_FUNCTION_INDEX));
3057   return Add<HLoadKeyed>(
3058       native_context, index, static_cast<HValue*>(NULL), FAST_ELEMENTS);
3059 }
3060
3061
3062 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3063     ElementsKind kind,
3064     HValue* allocation_site_payload,
3065     HValue* constructor_function,
3066     AllocationSiteOverrideMode override_mode) :
3067         builder_(builder),
3068         kind_(kind),
3069         allocation_site_payload_(allocation_site_payload),
3070         constructor_function_(constructor_function) {
3071   ASSERT(!allocation_site_payload->IsConstant() ||
3072          HConstant::cast(allocation_site_payload)->handle(
3073              builder_->isolate())->IsAllocationSite());
3074   mode_ = override_mode == DISABLE_ALLOCATION_SITES
3075       ? DONT_TRACK_ALLOCATION_SITE
3076       : AllocationSite::GetMode(kind);
3077 }
3078
3079
3080 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
3081                                               ElementsKind kind,
3082                                               HValue* constructor_function) :
3083     builder_(builder),
3084     kind_(kind),
3085     mode_(DONT_TRACK_ALLOCATION_SITE),
3086     allocation_site_payload_(NULL),
3087     constructor_function_(constructor_function) {
3088 }
3089
3090
3091 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode() {
3092   if (!builder()->top_info()->IsStub()) {
3093     // A constant map is fine.
3094     Handle<Map> map(builder()->isolate()->get_initial_js_array_map(kind_),
3095                     builder()->isolate());
3096     return builder()->Add<HConstant>(map);
3097   }
3098
3099   if (constructor_function_ != NULL && kind_ == GetInitialFastElementsKind()) {
3100     // No need for a context lookup if the kind_ matches the initial
3101     // map, because we can just load the map in that case.
3102     HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3103     return builder()->Add<HLoadNamedField>(
3104         constructor_function_, static_cast<HValue*>(NULL), access);
3105   }
3106
3107   // TODO(mvstanton): we should always have a constructor function if we
3108   // are creating a stub.
3109   HInstruction* native_context = constructor_function_ != NULL
3110       ? builder()->BuildGetNativeContext(constructor_function_)
3111       : builder()->BuildGetNativeContext();
3112
3113   HInstruction* index = builder()->Add<HConstant>(
3114       static_cast<int32_t>(Context::JS_ARRAY_MAPS_INDEX));
3115
3116   HInstruction* map_array = builder()->Add<HLoadKeyed>(
3117       native_context, index, static_cast<HValue*>(NULL), FAST_ELEMENTS);
3118
3119   HInstruction* kind_index = builder()->Add<HConstant>(kind_);
3120
3121   return builder()->Add<HLoadKeyed>(
3122       map_array, kind_index, static_cast<HValue*>(NULL), FAST_ELEMENTS);
3123 }
3124
3125
3126 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
3127   // Find the map near the constructor function
3128   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
3129   return builder()->Add<HLoadNamedField>(
3130       constructor_function_, static_cast<HValue*>(NULL), access);
3131 }
3132
3133
3134 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
3135   HConstant* capacity = builder()->Add<HConstant>(initial_capacity());
3136   return AllocateArray(capacity,
3137                        capacity,
3138                        builder()->graph()->GetConstant0());
3139 }
3140
3141
3142 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3143     HValue* capacity,
3144     HConstant* capacity_upper_bound,
3145     HValue* length_field,
3146     FillMode fill_mode) {
3147   return AllocateArray(capacity,
3148                        capacity_upper_bound->GetInteger32Constant(),
3149                        length_field,
3150                        fill_mode);
3151 }
3152
3153
3154 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3155     HValue* capacity,
3156     int capacity_upper_bound,
3157     HValue* length_field,
3158     FillMode fill_mode) {
3159   HConstant* elememts_size_upper_bound = capacity->IsInteger32Constant()
3160       ? HConstant::cast(capacity)
3161       : builder()->EstablishElementsAllocationSize(kind_, capacity_upper_bound);
3162
3163   HAllocate* array = AllocateArray(capacity, length_field, fill_mode);
3164   if (!elements_location_->has_size_upper_bound()) {
3165     elements_location_->set_size_upper_bound(elememts_size_upper_bound);
3166   }
3167   return array;
3168 }
3169
3170
3171 HAllocate* HGraphBuilder::JSArrayBuilder::AllocateArray(
3172     HValue* capacity,
3173     HValue* length_field,
3174     FillMode fill_mode) {
3175   // These HForceRepresentations are because we store these as fields in the
3176   // objects we construct, and an int32-to-smi HChange could deopt. Accept
3177   // the deopt possibility now, before allocation occurs.
3178   capacity =
3179       builder()->AddUncasted<HForceRepresentation>(capacity,
3180                                                    Representation::Smi());
3181   length_field =
3182       builder()->AddUncasted<HForceRepresentation>(length_field,
3183                                                    Representation::Smi());
3184
3185   // Generate size calculation code here in order to make it dominate
3186   // the JSArray allocation.
3187   HValue* elements_size =
3188       builder()->BuildCalculateElementsSize(kind_, capacity);
3189
3190   // Allocate (dealing with failure appropriately)
3191   HAllocate* array_object = builder()->AllocateJSArrayObject(mode_);
3192
3193   // Fill in the fields: map, properties, length
3194   HValue* map;
3195   if (allocation_site_payload_ == NULL) {
3196     map = EmitInternalMapCode();
3197   } else {
3198     map = EmitMapCode();
3199   }
3200
3201   builder()->BuildJSArrayHeader(array_object,
3202                                 map,
3203                                 NULL,  // set elements to empty fixed array
3204                                 mode_,
3205                                 kind_,
3206                                 allocation_site_payload_,
3207                                 length_field);
3208
3209   // Allocate and initialize the elements
3210   elements_location_ = builder()->BuildAllocateElements(kind_, elements_size);
3211
3212   builder()->BuildInitializeElementsHeader(elements_location_, kind_, capacity);
3213
3214   // Set the elements
3215   builder()->Add<HStoreNamedField>(
3216       array_object, HObjectAccess::ForElementsPointer(), elements_location_);
3217
3218   if (fill_mode == FILL_WITH_HOLE) {
3219     builder()->BuildFillElementsWithHole(elements_location_, kind_,
3220                                          graph()->GetConstant0(), capacity);
3221   }
3222
3223   return array_object;
3224 }
3225
3226
3227 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
3228   HValue* global_object = Add<HLoadNamedField>(
3229       context(), static_cast<HValue*>(NULL),
3230       HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
3231   HObjectAccess access = HObjectAccess::ForObservableJSObjectOffset(
3232       GlobalObject::kBuiltinsOffset);
3233   HValue* builtins = Add<HLoadNamedField>(
3234       global_object, static_cast<HValue*>(NULL), access);
3235   HObjectAccess function_access = HObjectAccess::ForObservableJSObjectOffset(
3236           JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
3237   return Add<HLoadNamedField>(
3238       builtins, static_cast<HValue*>(NULL), function_access);
3239 }
3240
3241
3242 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
3243     : HGraphBuilder(info),
3244       function_state_(NULL),
3245       initial_function_state_(this, info, NORMAL_RETURN, 0),
3246       ast_context_(NULL),
3247       break_scope_(NULL),
3248       inlined_count_(0),
3249       globals_(10, info->zone()),
3250       inline_bailout_(false),
3251       osr_(new(info->zone()) HOsrBuilder(this)) {
3252   // This is not initialized in the initializer list because the
3253   // constructor for the initial state relies on function_state_ == NULL
3254   // to know it's the initial state.
3255   function_state_= &initial_function_state_;
3256   InitializeAstVisitor(info->zone());
3257   if (FLAG_hydrogen_track_positions) {
3258     SetSourcePosition(info->shared_info()->start_position());
3259   }
3260 }
3261
3262
3263 HBasicBlock* HOptimizedGraphBuilder::CreateJoin(HBasicBlock* first,
3264                                                 HBasicBlock* second,
3265                                                 BailoutId join_id) {
3266   if (first == NULL) {
3267     return second;
3268   } else if (second == NULL) {
3269     return first;
3270   } else {
3271     HBasicBlock* join_block = graph()->CreateBasicBlock();
3272     Goto(first, join_block);
3273     Goto(second, join_block);
3274     join_block->SetJoinId(join_id);
3275     return join_block;
3276   }
3277 }
3278
3279
3280 HBasicBlock* HOptimizedGraphBuilder::JoinContinue(IterationStatement* statement,
3281                                                   HBasicBlock* exit_block,
3282                                                   HBasicBlock* continue_block) {
3283   if (continue_block != NULL) {
3284     if (exit_block != NULL) Goto(exit_block, continue_block);
3285     continue_block->SetJoinId(statement->ContinueId());
3286     return continue_block;
3287   }
3288   return exit_block;
3289 }
3290
3291
3292 HBasicBlock* HOptimizedGraphBuilder::CreateLoop(IterationStatement* statement,
3293                                                 HBasicBlock* loop_entry,
3294                                                 HBasicBlock* body_exit,
3295                                                 HBasicBlock* loop_successor,
3296                                                 HBasicBlock* break_block) {
3297   if (body_exit != NULL) Goto(body_exit, loop_entry);
3298   loop_entry->PostProcessLoopHeader(statement);
3299   if (break_block != NULL) {
3300     if (loop_successor != NULL) Goto(loop_successor, break_block);
3301     break_block->SetJoinId(statement->ExitId());
3302     return break_block;
3303   }
3304   return loop_successor;
3305 }
3306
3307
3308 // Build a new loop header block and set it as the current block.
3309 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry() {
3310   HBasicBlock* loop_entry = CreateLoopHeaderBlock();
3311   Goto(loop_entry);
3312   set_current_block(loop_entry);
3313   return loop_entry;
3314 }
3315
3316
3317 HBasicBlock* HOptimizedGraphBuilder::BuildLoopEntry(
3318     IterationStatement* statement) {
3319   HBasicBlock* loop_entry = osr()->HasOsrEntryAt(statement)
3320       ? osr()->BuildOsrLoopEntry(statement)
3321       : BuildLoopEntry();
3322   return loop_entry;
3323 }
3324
3325
3326 void HBasicBlock::FinishExit(HControlInstruction* instruction,
3327                              HSourcePosition position) {
3328   Finish(instruction, position);
3329   ClearEnvironment();
3330 }
3331
3332
3333 HGraph::HGraph(CompilationInfo* info)
3334     : isolate_(info->isolate()),
3335       next_block_id_(0),
3336       entry_block_(NULL),
3337       blocks_(8, info->zone()),
3338       values_(16, info->zone()),
3339       phi_list_(NULL),
3340       uint32_instructions_(NULL),
3341       osr_(NULL),
3342       info_(info),
3343       zone_(info->zone()),
3344       is_recursive_(false),
3345       use_optimistic_licm_(false),
3346       depends_on_empty_array_proto_elements_(false),
3347       type_change_checksum_(0),
3348       maximum_environment_size_(0),
3349       no_side_effects_scope_count_(0),
3350       disallow_adding_new_values_(false),
3351       next_inline_id_(0),
3352       inlined_functions_(5, info->zone()) {
3353   if (info->IsStub()) {
3354     HydrogenCodeStub* stub = info->code_stub();
3355     CodeStubInterfaceDescriptor* descriptor = stub->GetInterfaceDescriptor();
3356     start_environment_ =
3357         new(zone_) HEnvironment(zone_, descriptor->environment_length());
3358   } else {
3359     TraceInlinedFunction(info->shared_info(), HSourcePosition::Unknown());
3360     start_environment_ =
3361         new(zone_) HEnvironment(NULL, info->scope(), info->closure(), zone_);
3362   }
3363   start_environment_->set_ast_id(BailoutId::FunctionEntry());
3364   entry_block_ = CreateBasicBlock();
3365   entry_block_->SetInitialEnvironment(start_environment_);
3366 }
3367
3368
3369 HBasicBlock* HGraph::CreateBasicBlock() {
3370   HBasicBlock* result = new(zone()) HBasicBlock(this);
3371   blocks_.Add(result, zone());
3372   return result;
3373 }
3374
3375
3376 void HGraph::FinalizeUniqueness() {
3377   DisallowHeapAllocation no_gc;
3378   ASSERT(!OptimizingCompilerThread::IsOptimizerThread(isolate()));
3379   for (int i = 0; i < blocks()->length(); ++i) {
3380     for (HInstructionIterator it(blocks()->at(i)); !it.Done(); it.Advance()) {
3381       it.Current()->FinalizeUniqueness();
3382     }
3383   }
3384 }
3385
3386
3387 int HGraph::TraceInlinedFunction(
3388     Handle<SharedFunctionInfo> shared,
3389     HSourcePosition position) {
3390   if (!FLAG_hydrogen_track_positions) {
3391     return 0;
3392   }
3393
3394   int id = 0;
3395   for (; id < inlined_functions_.length(); id++) {
3396     if (inlined_functions_[id].shared().is_identical_to(shared)) {
3397       break;
3398     }
3399   }
3400
3401   if (id == inlined_functions_.length()) {
3402     inlined_functions_.Add(InlinedFunctionInfo(shared), zone());
3403
3404     if (!shared->script()->IsUndefined()) {
3405       Handle<Script> script(Script::cast(shared->script()));
3406       if (!script->source()->IsUndefined()) {
3407         CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
3408         PrintF(tracing_scope.file(),
3409                "--- FUNCTION SOURCE (%s) id{%d,%d} ---\n",
3410                shared->DebugName()->ToCString().get(),
3411                info()->optimization_id(),
3412                id);
3413
3414         {
3415           ConsStringIteratorOp op;
3416           StringCharacterStream stream(String::cast(script->source()),
3417                                        &op,
3418                                        shared->start_position());
3419           // fun->end_position() points to the last character in the stream. We
3420           // need to compensate by adding one to calculate the length.
3421           int source_len =
3422               shared->end_position() - shared->start_position() + 1;
3423           for (int i = 0; i < source_len; i++) {
3424             if (stream.HasMore()) {
3425               PrintF(tracing_scope.file(), "%c", stream.GetNext());
3426             }
3427           }
3428         }
3429
3430         PrintF(tracing_scope.file(), "\n--- END ---\n");
3431       }
3432     }
3433   }
3434
3435   int inline_id = next_inline_id_++;
3436
3437   if (inline_id != 0) {
3438     CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
3439     PrintF(tracing_scope.file(), "INLINE (%s) id{%d,%d} AS %d AT ",
3440            shared->DebugName()->ToCString().get(),
3441            info()->optimization_id(),
3442            id,
3443            inline_id);
3444     position.PrintTo(tracing_scope.file());
3445     PrintF(tracing_scope.file(), "\n");
3446   }
3447
3448   return inline_id;
3449 }
3450
3451
3452 int HGraph::SourcePositionToScriptPosition(HSourcePosition pos) {
3453   if (!FLAG_hydrogen_track_positions || pos.IsUnknown()) {
3454     return pos.raw();
3455   }
3456
3457   return inlined_functions_[pos.inlining_id()].start_position() +
3458       pos.position();
3459 }
3460
3461
3462 // Block ordering was implemented with two mutually recursive methods,
3463 // HGraph::Postorder and HGraph::PostorderLoopBlocks.
3464 // The recursion could lead to stack overflow so the algorithm has been
3465 // implemented iteratively.
3466 // At a high level the algorithm looks like this:
3467 //
3468 // Postorder(block, loop_header) : {
3469 //   if (block has already been visited or is of another loop) return;
3470 //   mark block as visited;
3471 //   if (block is a loop header) {
3472 //     VisitLoopMembers(block, loop_header);
3473 //     VisitSuccessorsOfLoopHeader(block);
3474 //   } else {
3475 //     VisitSuccessors(block)
3476 //   }
3477 //   put block in result list;
3478 // }
3479 //
3480 // VisitLoopMembers(block, outer_loop_header) {
3481 //   foreach (block b in block loop members) {
3482 //     VisitSuccessorsOfLoopMember(b, outer_loop_header);
3483 //     if (b is loop header) VisitLoopMembers(b);
3484 //   }
3485 // }
3486 //
3487 // VisitSuccessorsOfLoopMember(block, outer_loop_header) {
3488 //   foreach (block b in block successors) Postorder(b, outer_loop_header)
3489 // }
3490 //
3491 // VisitSuccessorsOfLoopHeader(block) {
3492 //   foreach (block b in block successors) Postorder(b, block)
3493 // }
3494 //
3495 // VisitSuccessors(block, loop_header) {
3496 //   foreach (block b in block successors) Postorder(b, loop_header)
3497 // }
3498 //
3499 // The ordering is started calling Postorder(entry, NULL).
3500 //
3501 // Each instance of PostorderProcessor represents the "stack frame" of the
3502 // recursion, and particularly keeps the state of the loop (iteration) of the
3503 // "Visit..." function it represents.
3504 // To recycle memory we keep all the frames in a double linked list but
3505 // this means that we cannot use constructors to initialize the frames.
3506 //
3507 class PostorderProcessor : public ZoneObject {
3508  public:
3509   // Back link (towards the stack bottom).
3510   PostorderProcessor* parent() {return father_; }
3511   // Forward link (towards the stack top).
3512   PostorderProcessor* child() {return child_; }
3513   HBasicBlock* block() { return block_; }
3514   HLoopInformation* loop() { return loop_; }
3515   HBasicBlock* loop_header() { return loop_header_; }
3516
3517   static PostorderProcessor* CreateEntryProcessor(Zone* zone,
3518                                                   HBasicBlock* block) {
3519     PostorderProcessor* result = new(zone) PostorderProcessor(NULL);
3520     return result->SetupSuccessors(zone, block, NULL);
3521   }
3522
3523   PostorderProcessor* PerformStep(Zone* zone,
3524                                   ZoneList<HBasicBlock*>* order) {
3525     PostorderProcessor* next =
3526         PerformNonBacktrackingStep(zone, order);
3527     if (next != NULL) {
3528       return next;
3529     } else {
3530       return Backtrack(zone, order);
3531     }
3532   }
3533
3534  private:
3535   explicit PostorderProcessor(PostorderProcessor* father)
3536       : father_(father), child_(NULL), successor_iterator(NULL) { }
3537
3538   // Each enum value states the cycle whose state is kept by this instance.
3539   enum LoopKind {
3540     NONE,
3541     SUCCESSORS,
3542     SUCCESSORS_OF_LOOP_HEADER,
3543     LOOP_MEMBERS,
3544     SUCCESSORS_OF_LOOP_MEMBER
3545   };
3546
3547   // Each "Setup..." method is like a constructor for a cycle state.
3548   PostorderProcessor* SetupSuccessors(Zone* zone,
3549                                       HBasicBlock* block,
3550                                       HBasicBlock* loop_header) {
3551     if (block == NULL || block->IsOrdered() ||
3552         block->parent_loop_header() != loop_header) {
3553       kind_ = NONE;
3554       block_ = NULL;
3555       loop_ = NULL;
3556       loop_header_ = NULL;
3557       return this;
3558     } else {
3559       block_ = block;
3560       loop_ = NULL;
3561       block->MarkAsOrdered();
3562
3563       if (block->IsLoopHeader()) {
3564         kind_ = SUCCESSORS_OF_LOOP_HEADER;
3565         loop_header_ = block;
3566         InitializeSuccessors();
3567         PostorderProcessor* result = Push(zone);
3568         return result->SetupLoopMembers(zone, block, block->loop_information(),
3569                                         loop_header);
3570       } else {
3571         ASSERT(block->IsFinished());
3572         kind_ = SUCCESSORS;
3573         loop_header_ = loop_header;
3574         InitializeSuccessors();
3575         return this;
3576       }
3577     }
3578   }
3579
3580   PostorderProcessor* SetupLoopMembers(Zone* zone,
3581                                        HBasicBlock* block,
3582                                        HLoopInformation* loop,
3583                                        HBasicBlock* loop_header) {
3584     kind_ = LOOP_MEMBERS;
3585     block_ = block;
3586     loop_ = loop;
3587     loop_header_ = loop_header;
3588     InitializeLoopMembers();
3589     return this;
3590   }
3591
3592   PostorderProcessor* SetupSuccessorsOfLoopMember(
3593       HBasicBlock* block,
3594       HLoopInformation* loop,
3595       HBasicBlock* loop_header) {
3596     kind_ = SUCCESSORS_OF_LOOP_MEMBER;
3597     block_ = block;
3598     loop_ = loop;
3599     loop_header_ = loop_header;
3600     InitializeSuccessors();
3601     return this;
3602   }
3603
3604   // This method "allocates" a new stack frame.
3605   PostorderProcessor* Push(Zone* zone) {
3606     if (child_ == NULL) {
3607       child_ = new(zone) PostorderProcessor(this);
3608     }
3609     return child_;
3610   }
3611
3612   void ClosePostorder(ZoneList<HBasicBlock*>* order, Zone* zone) {
3613     ASSERT(block_->end()->FirstSuccessor() == NULL ||
3614            order->Contains(block_->end()->FirstSuccessor()) ||
3615            block_->end()->FirstSuccessor()->IsLoopHeader());
3616     ASSERT(block_->end()->SecondSuccessor() == NULL ||
3617            order->Contains(block_->end()->SecondSuccessor()) ||
3618            block_->end()->SecondSuccessor()->IsLoopHeader());
3619     order->Add(block_, zone);
3620   }
3621
3622   // This method is the basic block to walk up the stack.
3623   PostorderProcessor* Pop(Zone* zone,
3624                           ZoneList<HBasicBlock*>* order) {
3625     switch (kind_) {
3626       case SUCCESSORS:
3627       case SUCCESSORS_OF_LOOP_HEADER:
3628         ClosePostorder(order, zone);
3629         return father_;
3630       case LOOP_MEMBERS:
3631         return father_;
3632       case SUCCESSORS_OF_LOOP_MEMBER:
3633         if (block()->IsLoopHeader() && block() != loop_->loop_header()) {
3634           // In this case we need to perform a LOOP_MEMBERS cycle so we
3635           // initialize it and return this instead of father.
3636           return SetupLoopMembers(zone, block(),
3637                                   block()->loop_information(), loop_header_);
3638         } else {
3639           return father_;
3640         }
3641       case NONE:
3642         return father_;
3643     }
3644     UNREACHABLE();
3645     return NULL;
3646   }
3647
3648   // Walks up the stack.
3649   PostorderProcessor* Backtrack(Zone* zone,
3650                                 ZoneList<HBasicBlock*>* order) {
3651     PostorderProcessor* parent = Pop(zone, order);
3652     while (parent != NULL) {
3653       PostorderProcessor* next =
3654           parent->PerformNonBacktrackingStep(zone, order);
3655       if (next != NULL) {
3656         return next;
3657       } else {
3658         parent = parent->Pop(zone, order);
3659       }
3660     }
3661     return NULL;
3662   }
3663
3664   PostorderProcessor* PerformNonBacktrackingStep(
3665       Zone* zone,
3666       ZoneList<HBasicBlock*>* order) {
3667     HBasicBlock* next_block;
3668     switch (kind_) {
3669       case SUCCESSORS:
3670         next_block = AdvanceSuccessors();
3671         if (next_block != NULL) {
3672           PostorderProcessor* result = Push(zone);
3673           return result->SetupSuccessors(zone, next_block, loop_header_);
3674         }
3675         break;
3676       case SUCCESSORS_OF_LOOP_HEADER:
3677         next_block = AdvanceSuccessors();
3678         if (next_block != NULL) {
3679           PostorderProcessor* result = Push(zone);
3680           return result->SetupSuccessors(zone, next_block, block());
3681         }
3682         break;
3683       case LOOP_MEMBERS:
3684         next_block = AdvanceLoopMembers();
3685         if (next_block != NULL) {
3686           PostorderProcessor* result = Push(zone);
3687           return result->SetupSuccessorsOfLoopMember(next_block,
3688                                                      loop_, loop_header_);
3689         }
3690         break;
3691       case SUCCESSORS_OF_LOOP_MEMBER:
3692         next_block = AdvanceSuccessors();
3693         if (next_block != NULL) {
3694           PostorderProcessor* result = Push(zone);
3695           return result->SetupSuccessors(zone, next_block, loop_header_);
3696         }
3697         break;
3698       case NONE:
3699         return NULL;
3700     }
3701     return NULL;
3702   }
3703
3704   // The following two methods implement a "foreach b in successors" cycle.
3705   void InitializeSuccessors() {
3706     loop_index = 0;
3707     loop_length = 0;
3708     successor_iterator = HSuccessorIterator(block_->end());
3709   }
3710
3711   HBasicBlock* AdvanceSuccessors() {
3712     if (!successor_iterator.Done()) {
3713       HBasicBlock* result = successor_iterator.Current();
3714       successor_iterator.Advance();
3715       return result;
3716     }
3717     return NULL;
3718   }
3719
3720   // The following two methods implement a "foreach b in loop members" cycle.
3721   void InitializeLoopMembers() {
3722     loop_index = 0;
3723     loop_length = loop_->blocks()->length();
3724   }
3725
3726   HBasicBlock* AdvanceLoopMembers() {
3727     if (loop_index < loop_length) {
3728       HBasicBlock* result = loop_->blocks()->at(loop_index);
3729       loop_index++;
3730       return result;
3731     } else {
3732       return NULL;
3733     }
3734   }
3735
3736   LoopKind kind_;
3737   PostorderProcessor* father_;
3738   PostorderProcessor* child_;
3739   HLoopInformation* loop_;
3740   HBasicBlock* block_;
3741   HBasicBlock* loop_header_;
3742   int loop_index;
3743   int loop_length;
3744   HSuccessorIterator successor_iterator;
3745 };
3746
3747
3748 void HGraph::OrderBlocks() {
3749   CompilationPhase phase("H_Block ordering", info());
3750
3751 #ifdef DEBUG
3752   // Initially the blocks must not be ordered.
3753   for (int i = 0; i < blocks_.length(); ++i) {
3754     ASSERT(!blocks_[i]->IsOrdered());
3755   }
3756 #endif
3757
3758   PostorderProcessor* postorder =
3759       PostorderProcessor::CreateEntryProcessor(zone(), blocks_[0]);
3760   blocks_.Rewind(0);
3761   while (postorder) {
3762     postorder = postorder->PerformStep(zone(), &blocks_);
3763   }
3764
3765 #ifdef DEBUG
3766   // Now all blocks must be marked as ordered.
3767   for (int i = 0; i < blocks_.length(); ++i) {
3768     ASSERT(blocks_[i]->IsOrdered());
3769   }
3770 #endif
3771
3772   // Reverse block list and assign block IDs.
3773   for (int i = 0, j = blocks_.length(); --j >= i; ++i) {
3774     HBasicBlock* bi = blocks_[i];
3775     HBasicBlock* bj = blocks_[j];
3776     bi->set_block_id(j);
3777     bj->set_block_id(i);
3778     blocks_[i] = bj;
3779     blocks_[j] = bi;
3780   }
3781 }
3782
3783
3784 void HGraph::AssignDominators() {
3785   HPhase phase("H_Assign dominators", this);
3786   for (int i = 0; i < blocks_.length(); ++i) {
3787     HBasicBlock* block = blocks_[i];
3788     if (block->IsLoopHeader()) {
3789       // Only the first predecessor of a loop header is from outside the loop.
3790       // All others are back edges, and thus cannot dominate the loop header.
3791       block->AssignCommonDominator(block->predecessors()->first());
3792       block->AssignLoopSuccessorDominators();
3793     } else {
3794       for (int j = blocks_[i]->predecessors()->length() - 1; j >= 0; --j) {
3795         blocks_[i]->AssignCommonDominator(blocks_[i]->predecessors()->at(j));
3796       }
3797     }
3798   }
3799 }
3800
3801
3802 bool HGraph::CheckArgumentsPhiUses() {
3803   int block_count = blocks_.length();
3804   for (int i = 0; i < block_count; ++i) {
3805     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3806       HPhi* phi = blocks_[i]->phis()->at(j);
3807       // We don't support phi uses of arguments for now.
3808       if (phi->CheckFlag(HValue::kIsArguments)) return false;
3809     }
3810   }
3811   return true;
3812 }
3813
3814
3815 bool HGraph::CheckConstPhiUses() {
3816   int block_count = blocks_.length();
3817   for (int i = 0; i < block_count; ++i) {
3818     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3819       HPhi* phi = blocks_[i]->phis()->at(j);
3820       // Check for the hole value (from an uninitialized const).
3821       for (int k = 0; k < phi->OperandCount(); k++) {
3822         if (phi->OperandAt(k) == GetConstantHole()) return false;
3823       }
3824     }
3825   }
3826   return true;
3827 }
3828
3829
3830 void HGraph::CollectPhis() {
3831   int block_count = blocks_.length();
3832   phi_list_ = new(zone()) ZoneList<HPhi*>(block_count, zone());
3833   for (int i = 0; i < block_count; ++i) {
3834     for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
3835       HPhi* phi = blocks_[i]->phis()->at(j);
3836       phi_list_->Add(phi, zone());
3837     }
3838   }
3839 }
3840
3841
3842 // Implementation of utility class to encapsulate the translation state for
3843 // a (possibly inlined) function.
3844 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
3845                              CompilationInfo* info,
3846                              InliningKind inlining_kind,
3847                              int inlining_id)
3848     : owner_(owner),
3849       compilation_info_(info),
3850       call_context_(NULL),
3851       inlining_kind_(inlining_kind),
3852       function_return_(NULL),
3853       test_context_(NULL),
3854       entry_(NULL),
3855       arguments_object_(NULL),
3856       arguments_elements_(NULL),
3857       inlining_id_(inlining_id),
3858       outer_source_position_(HSourcePosition::Unknown()),
3859       outer_(owner->function_state()) {
3860   if (outer_ != NULL) {
3861     // State for an inline function.
3862     if (owner->ast_context()->IsTest()) {
3863       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
3864       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
3865       if_true->MarkAsInlineReturnTarget(owner->current_block());
3866       if_false->MarkAsInlineReturnTarget(owner->current_block());
3867       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
3868       Expression* cond = outer_test_context->condition();
3869       // The AstContext constructor pushed on the context stack.  This newed
3870       // instance is the reason that AstContext can't be BASE_EMBEDDED.
3871       test_context_ = new TestContext(owner, cond, if_true, if_false);
3872     } else {
3873       function_return_ = owner->graph()->CreateBasicBlock();
3874       function_return()->MarkAsInlineReturnTarget(owner->current_block());
3875     }
3876     // Set this after possibly allocating a new TestContext above.
3877     call_context_ = owner->ast_context();
3878   }
3879
3880   // Push on the state stack.
3881   owner->set_function_state(this);
3882
3883   if (FLAG_hydrogen_track_positions) {
3884     outer_source_position_ = owner->source_position();
3885     owner->EnterInlinedSource(
3886       info->shared_info()->start_position(),
3887       inlining_id);
3888     owner->SetSourcePosition(info->shared_info()->start_position());
3889   }
3890 }
3891
3892
3893 FunctionState::~FunctionState() {
3894   delete test_context_;
3895   owner_->set_function_state(outer_);
3896
3897   if (FLAG_hydrogen_track_positions) {
3898     owner_->set_source_position(outer_source_position_);
3899     owner_->EnterInlinedSource(
3900       outer_->compilation_info()->shared_info()->start_position(),
3901       outer_->inlining_id());
3902   }
3903 }
3904
3905
3906 // Implementation of utility classes to represent an expression's context in
3907 // the AST.
3908 AstContext::AstContext(HOptimizedGraphBuilder* owner, Expression::Context kind)
3909     : owner_(owner),
3910       kind_(kind),
3911       outer_(owner->ast_context()),
3912       for_typeof_(false) {
3913   owner->set_ast_context(this);  // Push.
3914 #ifdef DEBUG
3915   ASSERT(owner->environment()->frame_type() == JS_FUNCTION);
3916   original_length_ = owner->environment()->length();
3917 #endif
3918 }
3919
3920
3921 AstContext::~AstContext() {
3922   owner_->set_ast_context(outer_);  // Pop.
3923 }
3924
3925
3926 EffectContext::~EffectContext() {
3927   ASSERT(owner()->HasStackOverflow() ||
3928          owner()->current_block() == NULL ||
3929          (owner()->environment()->length() == original_length_ &&
3930           owner()->environment()->frame_type() == JS_FUNCTION));
3931 }
3932
3933
3934 ValueContext::~ValueContext() {
3935   ASSERT(owner()->HasStackOverflow() ||
3936          owner()->current_block() == NULL ||
3937          (owner()->environment()->length() == original_length_ + 1 &&
3938           owner()->environment()->frame_type() == JS_FUNCTION));
3939 }
3940
3941
3942 void EffectContext::ReturnValue(HValue* value) {
3943   // The value is simply ignored.
3944 }
3945
3946
3947 void ValueContext::ReturnValue(HValue* value) {
3948   // The value is tracked in the bailout environment, and communicated
3949   // through the environment as the result of the expression.
3950   if (!arguments_allowed() && value->CheckFlag(HValue::kIsArguments)) {
3951     owner()->Bailout(kBadValueContextForArgumentsValue);
3952   }
3953   owner()->Push(value);
3954 }
3955
3956
3957 void TestContext::ReturnValue(HValue* value) {
3958   BuildBranch(value);
3959 }
3960
3961
3962 void EffectContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
3963   ASSERT(!instr->IsControlInstruction());
3964   owner()->AddInstruction(instr);
3965   if (instr->HasObservableSideEffects()) {
3966     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
3967   }
3968 }
3969
3970
3971 void EffectContext::ReturnControl(HControlInstruction* instr,
3972                                   BailoutId ast_id) {
3973   ASSERT(!instr->HasObservableSideEffects());
3974   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
3975   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
3976   instr->SetSuccessorAt(0, empty_true);
3977   instr->SetSuccessorAt(1, empty_false);
3978   owner()->FinishCurrentBlock(instr);
3979   HBasicBlock* join = owner()->CreateJoin(empty_true, empty_false, ast_id);
3980   owner()->set_current_block(join);
3981 }
3982
3983
3984 void EffectContext::ReturnContinuation(HIfContinuation* continuation,
3985                                        BailoutId ast_id) {
3986   HBasicBlock* true_branch = NULL;
3987   HBasicBlock* false_branch = NULL;
3988   continuation->Continue(&true_branch, &false_branch);
3989   if (!continuation->IsTrueReachable()) {
3990     owner()->set_current_block(false_branch);
3991   } else if (!continuation->IsFalseReachable()) {
3992     owner()->set_current_block(true_branch);
3993   } else {
3994     HBasicBlock* join = owner()->CreateJoin(true_branch, false_branch, ast_id);
3995     owner()->set_current_block(join);
3996   }
3997 }
3998
3999
4000 void ValueContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4001   ASSERT(!instr->IsControlInstruction());
4002   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4003     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4004   }
4005   owner()->AddInstruction(instr);
4006   owner()->Push(instr);
4007   if (instr->HasObservableSideEffects()) {
4008     owner()->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4009   }
4010 }
4011
4012
4013 void ValueContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4014   ASSERT(!instr->HasObservableSideEffects());
4015   if (!arguments_allowed() && instr->CheckFlag(HValue::kIsArguments)) {
4016     return owner()->Bailout(kBadValueContextForArgumentsObjectValue);
4017   }
4018   HBasicBlock* materialize_false = owner()->graph()->CreateBasicBlock();
4019   HBasicBlock* materialize_true = owner()->graph()->CreateBasicBlock();
4020   instr->SetSuccessorAt(0, materialize_true);
4021   instr->SetSuccessorAt(1, materialize_false);
4022   owner()->FinishCurrentBlock(instr);
4023   owner()->set_current_block(materialize_true);
4024   owner()->Push(owner()->graph()->GetConstantTrue());
4025   owner()->set_current_block(materialize_false);
4026   owner()->Push(owner()->graph()->GetConstantFalse());
4027   HBasicBlock* join =
4028     owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4029   owner()->set_current_block(join);
4030 }
4031
4032
4033 void ValueContext::ReturnContinuation(HIfContinuation* continuation,
4034                                       BailoutId ast_id) {
4035   HBasicBlock* materialize_true = NULL;
4036   HBasicBlock* materialize_false = NULL;
4037   continuation->Continue(&materialize_true, &materialize_false);
4038   if (continuation->IsTrueReachable()) {
4039     owner()->set_current_block(materialize_true);
4040     owner()->Push(owner()->graph()->GetConstantTrue());
4041     owner()->set_current_block(materialize_true);
4042   }
4043   if (continuation->IsFalseReachable()) {
4044     owner()->set_current_block(materialize_false);
4045     owner()->Push(owner()->graph()->GetConstantFalse());
4046     owner()->set_current_block(materialize_false);
4047   }
4048   if (continuation->TrueAndFalseReachable()) {
4049     HBasicBlock* join =
4050         owner()->CreateJoin(materialize_true, materialize_false, ast_id);
4051     owner()->set_current_block(join);
4052   }
4053 }
4054
4055
4056 void TestContext::ReturnInstruction(HInstruction* instr, BailoutId ast_id) {
4057   ASSERT(!instr->IsControlInstruction());
4058   HOptimizedGraphBuilder* builder = owner();
4059   builder->AddInstruction(instr);
4060   // We expect a simulate after every expression with side effects, though
4061   // this one isn't actually needed (and wouldn't work if it were targeted).
4062   if (instr->HasObservableSideEffects()) {
4063     builder->Push(instr);
4064     builder->Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
4065     builder->Pop();
4066   }
4067   BuildBranch(instr);
4068 }
4069
4070
4071 void TestContext::ReturnControl(HControlInstruction* instr, BailoutId ast_id) {
4072   ASSERT(!instr->HasObservableSideEffects());
4073   HBasicBlock* empty_true = owner()->graph()->CreateBasicBlock();
4074   HBasicBlock* empty_false = owner()->graph()->CreateBasicBlock();
4075   instr->SetSuccessorAt(0, empty_true);
4076   instr->SetSuccessorAt(1, empty_false);
4077   owner()->FinishCurrentBlock(instr);
4078   owner()->Goto(empty_true, if_true(), owner()->function_state());
4079   owner()->Goto(empty_false, if_false(), owner()->function_state());
4080   owner()->set_current_block(NULL);
4081 }
4082
4083
4084 void TestContext::ReturnContinuation(HIfContinuation* continuation,
4085                                      BailoutId ast_id) {
4086   HBasicBlock* true_branch = NULL;
4087   HBasicBlock* false_branch = NULL;
4088   continuation->Continue(&true_branch, &false_branch);
4089   if (continuation->IsTrueReachable()) {
4090     owner()->Goto(true_branch, if_true(), owner()->function_state());
4091   }
4092   if (continuation->IsFalseReachable()) {
4093     owner()->Goto(false_branch, if_false(), owner()->function_state());
4094   }
4095   owner()->set_current_block(NULL);
4096 }
4097
4098
4099 void TestContext::BuildBranch(HValue* value) {
4100   // We expect the graph to be in edge-split form: there is no edge that
4101   // connects a branch node to a join node.  We conservatively ensure that
4102   // property by always adding an empty block on the outgoing edges of this
4103   // branch.
4104   HOptimizedGraphBuilder* builder = owner();
4105   if (value != NULL && value->CheckFlag(HValue::kIsArguments)) {
4106     builder->Bailout(kArgumentsObjectValueInATestContext);
4107   }
4108   ToBooleanStub::Types expected(condition()->to_boolean_types());
4109   ReturnControl(owner()->New<HBranch>(value, expected), BailoutId::None());
4110 }
4111
4112
4113 // HOptimizedGraphBuilder infrastructure for bailing out and checking bailouts.
4114 #define CHECK_BAILOUT(call)                     \
4115   do {                                          \
4116     call;                                       \
4117     if (HasStackOverflow()) return;             \
4118   } while (false)
4119
4120
4121 #define CHECK_ALIVE(call)                                       \
4122   do {                                                          \
4123     call;                                                       \
4124     if (HasStackOverflow() || current_block() == NULL) return;  \
4125   } while (false)
4126
4127
4128 #define CHECK_ALIVE_OR_RETURN(call, value)                            \
4129   do {                                                                \
4130     call;                                                             \
4131     if (HasStackOverflow() || current_block() == NULL) return value;  \
4132   } while (false)
4133
4134
4135 void HOptimizedGraphBuilder::Bailout(BailoutReason reason) {
4136   current_info()->set_bailout_reason(reason);
4137   SetStackOverflow();
4138 }
4139
4140
4141 void HOptimizedGraphBuilder::VisitForEffect(Expression* expr) {
4142   EffectContext for_effect(this);
4143   Visit(expr);
4144 }
4145
4146
4147 void HOptimizedGraphBuilder::VisitForValue(Expression* expr,
4148                                            ArgumentsAllowedFlag flag) {
4149   ValueContext for_value(this, flag);
4150   Visit(expr);
4151 }
4152
4153
4154 void HOptimizedGraphBuilder::VisitForTypeOf(Expression* expr) {
4155   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
4156   for_value.set_for_typeof(true);
4157   Visit(expr);
4158 }
4159
4160
4161 void HOptimizedGraphBuilder::VisitForControl(Expression* expr,
4162                                              HBasicBlock* true_block,
4163                                              HBasicBlock* false_block) {
4164   TestContext for_test(this, expr, true_block, false_block);
4165   Visit(expr);
4166 }
4167
4168
4169 void HOptimizedGraphBuilder::VisitExpressions(
4170     ZoneList<Expression*>* exprs) {
4171   for (int i = 0; i < exprs->length(); ++i) {
4172     CHECK_ALIVE(VisitForValue(exprs->at(i)));
4173   }
4174 }
4175
4176
4177 bool HOptimizedGraphBuilder::BuildGraph() {
4178   if (current_info()->function()->is_generator()) {
4179     Bailout(kFunctionIsAGenerator);
4180     return false;
4181   }
4182   Scope* scope = current_info()->scope();
4183   if (scope->HasIllegalRedeclaration()) {
4184     Bailout(kFunctionWithIllegalRedeclaration);
4185     return false;
4186   }
4187   if (scope->calls_eval()) {
4188     Bailout(kFunctionCallsEval);
4189     return false;
4190   }
4191   SetUpScope(scope);
4192
4193   // Add an edge to the body entry.  This is warty: the graph's start
4194   // environment will be used by the Lithium translation as the initial
4195   // environment on graph entry, but it has now been mutated by the
4196   // Hydrogen translation of the instructions in the start block.  This
4197   // environment uses values which have not been defined yet.  These
4198   // Hydrogen instructions will then be replayed by the Lithium
4199   // translation, so they cannot have an environment effect.  The edge to
4200   // the body's entry block (along with some special logic for the start
4201   // block in HInstruction::InsertAfter) seals the start block from
4202   // getting unwanted instructions inserted.
4203   //
4204   // TODO(kmillikin): Fix this.  Stop mutating the initial environment.
4205   // Make the Hydrogen instructions in the initial block into Hydrogen
4206   // values (but not instructions), present in the initial environment and
4207   // not replayed by the Lithium translation.
4208   HEnvironment* initial_env = environment()->CopyWithoutHistory();
4209   HBasicBlock* body_entry = CreateBasicBlock(initial_env);
4210   Goto(body_entry);
4211   body_entry->SetJoinId(BailoutId::FunctionEntry());
4212   set_current_block(body_entry);
4213
4214   // Handle implicit declaration of the function name in named function
4215   // expressions before other declarations.
4216   if (scope->is_function_scope() && scope->function() != NULL) {
4217     VisitVariableDeclaration(scope->function());
4218   }
4219   VisitDeclarations(scope->declarations());
4220   Add<HSimulate>(BailoutId::Declarations());
4221
4222   Add<HStackCheck>(HStackCheck::kFunctionEntry);
4223
4224   VisitStatements(current_info()->function()->body());
4225   if (HasStackOverflow()) return false;
4226
4227   if (current_block() != NULL) {
4228     Add<HReturn>(graph()->GetConstantUndefined());
4229     set_current_block(NULL);
4230   }
4231
4232   // If the checksum of the number of type info changes is the same as the
4233   // last time this function was compiled, then this recompile is likely not
4234   // due to missing/inadequate type feedback, but rather too aggressive
4235   // optimization. Disable optimistic LICM in that case.
4236   Handle<Code> unoptimized_code(current_info()->shared_info()->code());
4237   ASSERT(unoptimized_code->kind() == Code::FUNCTION);
4238   Handle<TypeFeedbackInfo> type_info(
4239       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
4240   int checksum = type_info->own_type_change_checksum();
4241   int composite_checksum = graph()->update_type_change_checksum(checksum);
4242   graph()->set_use_optimistic_licm(
4243       !type_info->matches_inlined_type_change_checksum(composite_checksum));
4244   type_info->set_inlined_type_change_checksum(composite_checksum);
4245
4246   // Perform any necessary OSR-specific cleanups or changes to the graph.
4247   osr()->FinishGraph();
4248
4249   return true;
4250 }
4251
4252
4253 bool HGraph::Optimize(BailoutReason* bailout_reason) {
4254   OrderBlocks();
4255   AssignDominators();
4256
4257   // We need to create a HConstant "zero" now so that GVN will fold every
4258   // zero-valued constant in the graph together.
4259   // The constant is needed to make idef-based bounds check work: the pass
4260   // evaluates relations with "zero" and that zero cannot be created after GVN.
4261   GetConstant0();
4262
4263 #ifdef DEBUG
4264   // Do a full verify after building the graph and computing dominators.
4265   Verify(true);
4266 #endif
4267
4268   if (FLAG_analyze_environment_liveness && maximum_environment_size() != 0) {
4269     Run<HEnvironmentLivenessAnalysisPhase>();
4270   }
4271
4272   if (!CheckConstPhiUses()) {
4273     *bailout_reason = kUnsupportedPhiUseOfConstVariable;
4274     return false;
4275   }
4276   Run<HRedundantPhiEliminationPhase>();
4277   if (!CheckArgumentsPhiUses()) {
4278     *bailout_reason = kUnsupportedPhiUseOfArguments;
4279     return false;
4280   }
4281
4282   // Find and mark unreachable code to simplify optimizations, especially gvn,
4283   // where unreachable code could unnecessarily defeat LICM.
4284   Run<HMarkUnreachableBlocksPhase>();
4285
4286   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4287   if (FLAG_use_escape_analysis) Run<HEscapeAnalysisPhase>();
4288
4289   if (FLAG_load_elimination) Run<HLoadEliminationPhase>();
4290
4291   CollectPhis();
4292
4293   if (has_osr()) osr()->FinishOsrValues();
4294
4295   Run<HInferRepresentationPhase>();
4296
4297   // Remove HSimulate instructions that have turned out not to be needed
4298   // after all by folding them into the following HSimulate.
4299   // This must happen after inferring representations.
4300   Run<HMergeRemovableSimulatesPhase>();
4301
4302   Run<HMarkDeoptimizeOnUndefinedPhase>();
4303   Run<HRepresentationChangesPhase>();
4304
4305   Run<HInferTypesPhase>();
4306
4307   // Must be performed before canonicalization to ensure that Canonicalize
4308   // will not remove semantically meaningful ToInt32 operations e.g. BIT_OR with
4309   // zero.
4310   if (FLAG_opt_safe_uint32_operations) Run<HUint32AnalysisPhase>();
4311
4312   if (FLAG_use_canonicalizing) Run<HCanonicalizePhase>();
4313
4314   if (FLAG_use_gvn) Run<HGlobalValueNumberingPhase>();
4315
4316   if (FLAG_check_elimination) Run<HCheckEliminationPhase>();
4317
4318   if (FLAG_store_elimination) Run<HStoreEliminationPhase>();
4319
4320   Run<HRangeAnalysisPhase>();
4321
4322   Run<HComputeChangeUndefinedToNaN>();
4323
4324   // Eliminate redundant stack checks on backwards branches.
4325   Run<HStackCheckEliminationPhase>();
4326
4327   if (FLAG_array_bounds_checks_elimination) Run<HBoundsCheckEliminationPhase>();
4328   if (FLAG_array_bounds_checks_hoisting) Run<HBoundsCheckHoistingPhase>();
4329   if (FLAG_array_index_dehoisting) Run<HDehoistIndexComputationsPhase>();
4330   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
4331
4332   RestoreActualValues();
4333
4334   // Find unreachable code a second time, GVN and other optimizations may have
4335   // made blocks unreachable that were previously reachable.
4336   Run<HMarkUnreachableBlocksPhase>();
4337
4338   return true;
4339 }
4340
4341
4342 void HGraph::RestoreActualValues() {
4343   HPhase phase("H_Restore actual values", this);
4344
4345   for (int block_index = 0; block_index < blocks()->length(); block_index++) {
4346     HBasicBlock* block = blocks()->at(block_index);
4347
4348 #ifdef DEBUG
4349     for (int i = 0; i < block->phis()->length(); i++) {
4350       HPhi* phi = block->phis()->at(i);
4351       ASSERT(phi->ActualValue() == phi);
4352     }
4353 #endif
4354
4355     for (HInstructionIterator it(block); !it.Done(); it.Advance()) {
4356       HInstruction* instruction = it.Current();
4357       if (instruction->ActualValue() == instruction) continue;
4358       if (instruction->CheckFlag(HValue::kIsDead)) {
4359         // The instruction was marked as deleted but left in the graph
4360         // as a control flow dependency point for subsequent
4361         // instructions.
4362         instruction->DeleteAndReplaceWith(instruction->ActualValue());
4363       } else {
4364         ASSERT(instruction->IsInformativeDefinition());
4365         if (instruction->IsPurelyInformativeDefinition()) {
4366           instruction->DeleteAndReplaceWith(instruction->RedefinedOperand());
4367         } else {
4368           instruction->ReplaceAllUsesWith(instruction->ActualValue());
4369         }
4370       }
4371     }
4372   }
4373 }
4374
4375
4376 void HOptimizedGraphBuilder::PushArgumentsFromEnvironment(int count) {
4377   ZoneList<HValue*> arguments(count, zone());
4378   for (int i = 0; i < count; ++i) {
4379     arguments.Add(Pop(), zone());
4380   }
4381
4382   HPushArguments* push_args = New<HPushArguments>();
4383   while (!arguments.is_empty()) {
4384     push_args->AddInput(arguments.RemoveLast());
4385   }
4386   AddInstruction(push_args);
4387 }
4388
4389
4390 template <class Instruction>
4391 HInstruction* HOptimizedGraphBuilder::PreProcessCall(Instruction* call) {
4392   PushArgumentsFromEnvironment(call->argument_count());
4393   return call;
4394 }
4395
4396
4397 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
4398   // First special is HContext.
4399   HInstruction* context = Add<HContext>();
4400   environment()->BindContext(context);
4401
4402   // Create an arguments object containing the initial parameters.  Set the
4403   // initial values of parameters including "this" having parameter index 0.
4404   ASSERT_EQ(scope->num_parameters() + 1, environment()->parameter_count());
4405   HArgumentsObject* arguments_object =
4406       New<HArgumentsObject>(environment()->parameter_count());
4407   for (int i = 0; i < environment()->parameter_count(); ++i) {
4408     HInstruction* parameter = Add<HParameter>(i);
4409     arguments_object->AddArgument(parameter, zone());
4410     environment()->Bind(i, parameter);
4411   }
4412   AddInstruction(arguments_object);
4413   graph()->SetArgumentsObject(arguments_object);
4414
4415   HConstant* undefined_constant = graph()->GetConstantUndefined();
4416   // Initialize specials and locals to undefined.
4417   for (int i = environment()->parameter_count() + 1;
4418        i < environment()->length();
4419        ++i) {
4420     environment()->Bind(i, undefined_constant);
4421   }
4422
4423   // Handle the arguments and arguments shadow variables specially (they do
4424   // not have declarations).
4425   if (scope->arguments() != NULL) {
4426     if (!scope->arguments()->IsStackAllocated()) {
4427       return Bailout(kContextAllocatedArguments);
4428     }
4429
4430     environment()->Bind(scope->arguments(),
4431                         graph()->GetArgumentsObject());
4432   }
4433 }
4434
4435
4436 void HOptimizedGraphBuilder::VisitStatements(ZoneList<Statement*>* statements) {
4437   for (int i = 0; i < statements->length(); i++) {
4438     Statement* stmt = statements->at(i);
4439     CHECK_ALIVE(Visit(stmt));
4440     if (stmt->IsJump()) break;
4441   }
4442 }
4443
4444
4445 void HOptimizedGraphBuilder::VisitBlock(Block* stmt) {
4446   ASSERT(!HasStackOverflow());
4447   ASSERT(current_block() != NULL);
4448   ASSERT(current_block()->HasPredecessor());
4449
4450   Scope* outer_scope = scope();
4451   Scope* scope = stmt->scope();
4452   BreakAndContinueInfo break_info(stmt, outer_scope);
4453
4454   { BreakAndContinueScope push(&break_info, this);
4455     if (scope != NULL) {
4456       // Load the function object.
4457       Scope* declaration_scope = scope->DeclarationScope();
4458       HInstruction* function;
4459       HValue* outer_context = environment()->context();
4460       if (declaration_scope->is_global_scope() ||
4461           declaration_scope->is_eval_scope()) {
4462         function = new(zone()) HLoadContextSlot(
4463             outer_context, Context::CLOSURE_INDEX, HLoadContextSlot::kNoCheck);
4464       } else {
4465         function = New<HThisFunction>();
4466       }
4467       AddInstruction(function);
4468       // Allocate a block context and store it to the stack frame.
4469       HInstruction* inner_context = Add<HAllocateBlockContext>(
4470           outer_context, function, scope->GetScopeInfo());
4471       HInstruction* instr = Add<HStoreFrameContext>(inner_context);
4472       if (instr->HasObservableSideEffects()) {
4473         AddSimulate(stmt->EntryId(), REMOVABLE_SIMULATE);
4474       }
4475       set_scope(scope);
4476       environment()->BindContext(inner_context);
4477       VisitDeclarations(scope->declarations());
4478       AddSimulate(stmt->DeclsId(), REMOVABLE_SIMULATE);
4479     }
4480     CHECK_BAILOUT(VisitStatements(stmt->statements()));
4481   }
4482   set_scope(outer_scope);
4483   if (scope != NULL && current_block() != NULL) {
4484     HValue* inner_context = environment()->context();
4485     HValue* outer_context = Add<HLoadNamedField>(
4486         inner_context, static_cast<HValue*>(NULL),
4487         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4488
4489     HInstruction* instr = Add<HStoreFrameContext>(outer_context);
4490     if (instr->HasObservableSideEffects()) {
4491       AddSimulate(stmt->ExitId(), REMOVABLE_SIMULATE);
4492     }
4493     environment()->BindContext(outer_context);
4494   }
4495   HBasicBlock* break_block = break_info.break_block();
4496   if (break_block != NULL) {
4497     if (current_block() != NULL) Goto(break_block);
4498     break_block->SetJoinId(stmt->ExitId());
4499     set_current_block(break_block);
4500   }
4501 }
4502
4503
4504 void HOptimizedGraphBuilder::VisitExpressionStatement(
4505     ExpressionStatement* stmt) {
4506   ASSERT(!HasStackOverflow());
4507   ASSERT(current_block() != NULL);
4508   ASSERT(current_block()->HasPredecessor());
4509   VisitForEffect(stmt->expression());
4510 }
4511
4512
4513 void HOptimizedGraphBuilder::VisitEmptyStatement(EmptyStatement* stmt) {
4514   ASSERT(!HasStackOverflow());
4515   ASSERT(current_block() != NULL);
4516   ASSERT(current_block()->HasPredecessor());
4517 }
4518
4519
4520 void HOptimizedGraphBuilder::VisitIfStatement(IfStatement* stmt) {
4521   ASSERT(!HasStackOverflow());
4522   ASSERT(current_block() != NULL);
4523   ASSERT(current_block()->HasPredecessor());
4524   if (stmt->condition()->ToBooleanIsTrue()) {
4525     Add<HSimulate>(stmt->ThenId());
4526     Visit(stmt->then_statement());
4527   } else if (stmt->condition()->ToBooleanIsFalse()) {
4528     Add<HSimulate>(stmt->ElseId());
4529     Visit(stmt->else_statement());
4530   } else {
4531     HBasicBlock* cond_true = graph()->CreateBasicBlock();
4532     HBasicBlock* cond_false = graph()->CreateBasicBlock();
4533     CHECK_BAILOUT(VisitForControl(stmt->condition(), cond_true, cond_false));
4534
4535     if (cond_true->HasPredecessor()) {
4536       cond_true->SetJoinId(stmt->ThenId());
4537       set_current_block(cond_true);
4538       CHECK_BAILOUT(Visit(stmt->then_statement()));
4539       cond_true = current_block();
4540     } else {
4541       cond_true = NULL;
4542     }
4543
4544     if (cond_false->HasPredecessor()) {
4545       cond_false->SetJoinId(stmt->ElseId());
4546       set_current_block(cond_false);
4547       CHECK_BAILOUT(Visit(stmt->else_statement()));
4548       cond_false = current_block();
4549     } else {
4550       cond_false = NULL;
4551     }
4552
4553     HBasicBlock* join = CreateJoin(cond_true, cond_false, stmt->IfId());
4554     set_current_block(join);
4555   }
4556 }
4557
4558
4559 HBasicBlock* HOptimizedGraphBuilder::BreakAndContinueScope::Get(
4560     BreakableStatement* stmt,
4561     BreakType type,
4562     Scope** scope,
4563     int* drop_extra) {
4564   *drop_extra = 0;
4565   BreakAndContinueScope* current = this;
4566   while (current != NULL && current->info()->target() != stmt) {
4567     *drop_extra += current->info()->drop_extra();
4568     current = current->next();
4569   }
4570   ASSERT(current != NULL);  // Always found (unless stack is malformed).
4571   *scope = current->info()->scope();
4572
4573   if (type == BREAK) {
4574     *drop_extra += current->info()->drop_extra();
4575   }
4576
4577   HBasicBlock* block = NULL;
4578   switch (type) {
4579     case BREAK:
4580       block = current->info()->break_block();
4581       if (block == NULL) {
4582         block = current->owner()->graph()->CreateBasicBlock();
4583         current->info()->set_break_block(block);
4584       }
4585       break;
4586
4587     case CONTINUE:
4588       block = current->info()->continue_block();
4589       if (block == NULL) {
4590         block = current->owner()->graph()->CreateBasicBlock();
4591         current->info()->set_continue_block(block);
4592       }
4593       break;
4594   }
4595
4596   return block;
4597 }
4598
4599
4600 void HOptimizedGraphBuilder::VisitContinueStatement(
4601     ContinueStatement* stmt) {
4602   ASSERT(!HasStackOverflow());
4603   ASSERT(current_block() != NULL);
4604   ASSERT(current_block()->HasPredecessor());
4605   Scope* outer_scope = NULL;
4606   Scope* inner_scope = scope();
4607   int drop_extra = 0;
4608   HBasicBlock* continue_block = break_scope()->Get(
4609       stmt->target(), BreakAndContinueScope::CONTINUE,
4610       &outer_scope, &drop_extra);
4611   HValue* context = environment()->context();
4612   Drop(drop_extra);
4613   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4614   if (context_pop_count > 0) {
4615     while (context_pop_count-- > 0) {
4616       HInstruction* context_instruction = Add<HLoadNamedField>(
4617           context, static_cast<HValue*>(NULL),
4618           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4619       context = context_instruction;
4620     }
4621     HInstruction* instr = Add<HStoreFrameContext>(context);
4622     if (instr->HasObservableSideEffects()) {
4623       AddSimulate(stmt->target()->EntryId(), REMOVABLE_SIMULATE);
4624     }
4625     environment()->BindContext(context);
4626   }
4627
4628   Goto(continue_block);
4629   set_current_block(NULL);
4630 }
4631
4632
4633 void HOptimizedGraphBuilder::VisitBreakStatement(BreakStatement* stmt) {
4634   ASSERT(!HasStackOverflow());
4635   ASSERT(current_block() != NULL);
4636   ASSERT(current_block()->HasPredecessor());
4637   Scope* outer_scope = NULL;
4638   Scope* inner_scope = scope();
4639   int drop_extra = 0;
4640   HBasicBlock* break_block = break_scope()->Get(
4641       stmt->target(), BreakAndContinueScope::BREAK,
4642       &outer_scope, &drop_extra);
4643   HValue* context = environment()->context();
4644   Drop(drop_extra);
4645   int context_pop_count = inner_scope->ContextChainLength(outer_scope);
4646   if (context_pop_count > 0) {
4647     while (context_pop_count-- > 0) {
4648       HInstruction* context_instruction = Add<HLoadNamedField>(
4649           context, static_cast<HValue*>(NULL),
4650           HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
4651       context = context_instruction;
4652     }
4653     HInstruction* instr = Add<HStoreFrameContext>(context);
4654     if (instr->HasObservableSideEffects()) {
4655       AddSimulate(stmt->target()->ExitId(), REMOVABLE_SIMULATE);
4656     }
4657     environment()->BindContext(context);
4658   }
4659   Goto(break_block);
4660   set_current_block(NULL);
4661 }
4662
4663
4664 void HOptimizedGraphBuilder::VisitReturnStatement(ReturnStatement* stmt) {
4665   ASSERT(!HasStackOverflow());
4666   ASSERT(current_block() != NULL);
4667   ASSERT(current_block()->HasPredecessor());
4668   FunctionState* state = function_state();
4669   AstContext* context = call_context();
4670   if (context == NULL) {
4671     // Not an inlined return, so an actual one.
4672     CHECK_ALIVE(VisitForValue(stmt->expression()));
4673     HValue* result = environment()->Pop();
4674     Add<HReturn>(result);
4675   } else if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
4676     // Return from an inlined construct call. In a test context the return value
4677     // will always evaluate to true, in a value context the return value needs
4678     // to be a JSObject.
4679     if (context->IsTest()) {
4680       TestContext* test = TestContext::cast(context);
4681       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4682       Goto(test->if_true(), state);
4683     } else if (context->IsEffect()) {
4684       CHECK_ALIVE(VisitForEffect(stmt->expression()));
4685       Goto(function_return(), state);
4686     } else {
4687       ASSERT(context->IsValue());
4688       CHECK_ALIVE(VisitForValue(stmt->expression()));
4689       HValue* return_value = Pop();
4690       HValue* receiver = environment()->arguments_environment()->Lookup(0);
4691       HHasInstanceTypeAndBranch* typecheck =
4692           New<HHasInstanceTypeAndBranch>(return_value,
4693                                          FIRST_SPEC_OBJECT_TYPE,
4694                                          LAST_SPEC_OBJECT_TYPE);
4695       HBasicBlock* if_spec_object = graph()->CreateBasicBlock();
4696       HBasicBlock* not_spec_object = graph()->CreateBasicBlock();
4697       typecheck->SetSuccessorAt(0, if_spec_object);
4698       typecheck->SetSuccessorAt(1, not_spec_object);
4699       FinishCurrentBlock(typecheck);
4700       AddLeaveInlined(if_spec_object, return_value, state);
4701       AddLeaveInlined(not_spec_object, receiver, state);
4702     }
4703   } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
4704     // Return from an inlined setter call. The returned value is never used, the
4705     // value of an assignment is always the value of the RHS of the assignment.
4706     CHECK_ALIVE(VisitForEffect(stmt->expression()));
4707     if (context->IsTest()) {
4708       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4709       context->ReturnValue(rhs);
4710     } else if (context->IsEffect()) {
4711       Goto(function_return(), state);
4712     } else {
4713       ASSERT(context->IsValue());
4714       HValue* rhs = environment()->arguments_environment()->Lookup(1);
4715       AddLeaveInlined(rhs, state);
4716     }
4717   } else {
4718     // Return from a normal inlined function. Visit the subexpression in the
4719     // expression context of the call.
4720     if (context->IsTest()) {
4721       TestContext* test = TestContext::cast(context);
4722       VisitForControl(stmt->expression(), test->if_true(), test->if_false());
4723     } else if (context->IsEffect()) {
4724       // Visit in value context and ignore the result. This is needed to keep
4725       // environment in sync with full-codegen since some visitors (e.g.
4726       // VisitCountOperation) use the operand stack differently depending on
4727       // context.
4728       CHECK_ALIVE(VisitForValue(stmt->expression()));
4729       Pop();
4730       Goto(function_return(), state);
4731     } else {
4732       ASSERT(context->IsValue());
4733       CHECK_ALIVE(VisitForValue(stmt->expression()));
4734       AddLeaveInlined(Pop(), state);
4735     }
4736   }
4737   set_current_block(NULL);
4738 }
4739
4740
4741 void HOptimizedGraphBuilder::VisitWithStatement(WithStatement* stmt) {
4742   ASSERT(!HasStackOverflow());
4743   ASSERT(current_block() != NULL);
4744   ASSERT(current_block()->HasPredecessor());
4745   return Bailout(kWithStatement);
4746 }
4747
4748
4749 void HOptimizedGraphBuilder::VisitSwitchStatement(SwitchStatement* stmt) {
4750   ASSERT(!HasStackOverflow());
4751   ASSERT(current_block() != NULL);
4752   ASSERT(current_block()->HasPredecessor());
4753
4754   // We only optimize switch statements with a bounded number of clauses.
4755   const int kCaseClauseLimit = 128;
4756   ZoneList<CaseClause*>* clauses = stmt->cases();
4757   int clause_count = clauses->length();
4758   ZoneList<HBasicBlock*> body_blocks(clause_count, zone());
4759   if (clause_count > kCaseClauseLimit) {
4760     return Bailout(kSwitchStatementTooManyClauses);
4761   }
4762
4763   CHECK_ALIVE(VisitForValue(stmt->tag()));
4764   Add<HSimulate>(stmt->EntryId());
4765   HValue* tag_value = Top();
4766   Type* tag_type = stmt->tag()->bounds().lower;
4767
4768   // 1. Build all the tests, with dangling true branches
4769   BailoutId default_id = BailoutId::None();
4770   for (int i = 0; i < clause_count; ++i) {
4771     CaseClause* clause = clauses->at(i);
4772     if (clause->is_default()) {
4773       body_blocks.Add(NULL, zone());
4774       if (default_id.IsNone()) default_id = clause->EntryId();
4775       continue;
4776     }
4777
4778     // Generate a compare and branch.
4779     CHECK_ALIVE(VisitForValue(clause->label()));
4780     HValue* label_value = Pop();
4781
4782     Type* label_type = clause->label()->bounds().lower;
4783     Type* combined_type = clause->compare_type();
4784     HControlInstruction* compare = BuildCompareInstruction(
4785         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
4786         combined_type,
4787         ScriptPositionToSourcePosition(stmt->tag()->position()),
4788         ScriptPositionToSourcePosition(clause->label()->position()),
4789         PUSH_BEFORE_SIMULATE, clause->id());
4790
4791     HBasicBlock* next_test_block = graph()->CreateBasicBlock();
4792     HBasicBlock* body_block = graph()->CreateBasicBlock();
4793     body_blocks.Add(body_block, zone());
4794     compare->SetSuccessorAt(0, body_block);
4795     compare->SetSuccessorAt(1, next_test_block);
4796     FinishCurrentBlock(compare);
4797
4798     set_current_block(body_block);
4799     Drop(1);  // tag_value
4800
4801     set_current_block(next_test_block);
4802   }
4803
4804   // Save the current block to use for the default or to join with the
4805   // exit.
4806   HBasicBlock* last_block = current_block();
4807   Drop(1);  // tag_value
4808
4809   // 2. Loop over the clauses and the linked list of tests in lockstep,
4810   // translating the clause bodies.
4811   HBasicBlock* fall_through_block = NULL;
4812
4813   BreakAndContinueInfo break_info(stmt, scope());
4814   { BreakAndContinueScope push(&break_info, this);
4815     for (int i = 0; i < clause_count; ++i) {
4816       CaseClause* clause = clauses->at(i);
4817
4818       // Identify the block where normal (non-fall-through) control flow
4819       // goes to.
4820       HBasicBlock* normal_block = NULL;
4821       if (clause->is_default()) {
4822         if (last_block == NULL) continue;
4823         normal_block = last_block;
4824         last_block = NULL;  // Cleared to indicate we've handled it.
4825       } else {
4826         normal_block = body_blocks[i];
4827       }
4828
4829       if (fall_through_block == NULL) {
4830         set_current_block(normal_block);
4831       } else {
4832         HBasicBlock* join = CreateJoin(fall_through_block,
4833                                        normal_block,
4834                                        clause->EntryId());
4835         set_current_block(join);
4836       }
4837
4838       CHECK_BAILOUT(VisitStatements(clause->statements()));
4839       fall_through_block = current_block();
4840     }
4841   }
4842
4843   // Create an up-to-3-way join.  Use the break block if it exists since
4844   // it's already a join block.
4845   HBasicBlock* break_block = break_info.break_block();
4846   if (break_block == NULL) {
4847     set_current_block(CreateJoin(fall_through_block,
4848                                  last_block,
4849                                  stmt->ExitId()));
4850   } else {
4851     if (fall_through_block != NULL) Goto(fall_through_block, break_block);
4852     if (last_block != NULL) Goto(last_block, break_block);
4853     break_block->SetJoinId(stmt->ExitId());
4854     set_current_block(break_block);
4855   }
4856 }
4857
4858
4859 void HOptimizedGraphBuilder::VisitLoopBody(IterationStatement* stmt,
4860                                            HBasicBlock* loop_entry) {
4861   Add<HSimulate>(stmt->StackCheckId());
4862   HStackCheck* stack_check =
4863       HStackCheck::cast(Add<HStackCheck>(HStackCheck::kBackwardsBranch));
4864   ASSERT(loop_entry->IsLoopHeader());
4865   loop_entry->loop_information()->set_stack_check(stack_check);
4866   CHECK_BAILOUT(Visit(stmt->body()));
4867 }
4868
4869
4870 void HOptimizedGraphBuilder::VisitDoWhileStatement(DoWhileStatement* stmt) {
4871   ASSERT(!HasStackOverflow());
4872   ASSERT(current_block() != NULL);
4873   ASSERT(current_block()->HasPredecessor());
4874   ASSERT(current_block() != NULL);
4875   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
4876
4877   BreakAndContinueInfo break_info(stmt, scope());
4878   {
4879     BreakAndContinueScope push(&break_info, this);
4880     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
4881   }
4882   HBasicBlock* body_exit =
4883       JoinContinue(stmt, current_block(), break_info.continue_block());
4884   HBasicBlock* loop_successor = NULL;
4885   if (body_exit != NULL && !stmt->cond()->ToBooleanIsTrue()) {
4886     set_current_block(body_exit);
4887     loop_successor = graph()->CreateBasicBlock();
4888     if (stmt->cond()->ToBooleanIsFalse()) {
4889       loop_entry->loop_information()->stack_check()->Eliminate();
4890       Goto(loop_successor);
4891       body_exit = NULL;
4892     } else {
4893       // The block for a true condition, the actual predecessor block of the
4894       // back edge.
4895       body_exit = graph()->CreateBasicBlock();
4896       CHECK_BAILOUT(VisitForControl(stmt->cond(), body_exit, loop_successor));
4897     }
4898     if (body_exit != NULL && body_exit->HasPredecessor()) {
4899       body_exit->SetJoinId(stmt->BackEdgeId());
4900     } else {
4901       body_exit = NULL;
4902     }
4903     if (loop_successor->HasPredecessor()) {
4904       loop_successor->SetJoinId(stmt->ExitId());
4905     } else {
4906       loop_successor = NULL;
4907     }
4908   }
4909   HBasicBlock* loop_exit = CreateLoop(stmt,
4910                                       loop_entry,
4911                                       body_exit,
4912                                       loop_successor,
4913                                       break_info.break_block());
4914   set_current_block(loop_exit);
4915 }
4916
4917
4918 void HOptimizedGraphBuilder::VisitWhileStatement(WhileStatement* stmt) {
4919   ASSERT(!HasStackOverflow());
4920   ASSERT(current_block() != NULL);
4921   ASSERT(current_block()->HasPredecessor());
4922   ASSERT(current_block() != NULL);
4923   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
4924
4925   // If the condition is constant true, do not generate a branch.
4926   HBasicBlock* loop_successor = NULL;
4927   if (!stmt->cond()->ToBooleanIsTrue()) {
4928     HBasicBlock* body_entry = graph()->CreateBasicBlock();
4929     loop_successor = graph()->CreateBasicBlock();
4930     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
4931     if (body_entry->HasPredecessor()) {
4932       body_entry->SetJoinId(stmt->BodyId());
4933       set_current_block(body_entry);
4934     }
4935     if (loop_successor->HasPredecessor()) {
4936       loop_successor->SetJoinId(stmt->ExitId());
4937     } else {
4938       loop_successor = NULL;
4939     }
4940   }
4941
4942   BreakAndContinueInfo break_info(stmt, scope());
4943   if (current_block() != NULL) {
4944     BreakAndContinueScope push(&break_info, this);
4945     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
4946   }
4947   HBasicBlock* body_exit =
4948       JoinContinue(stmt, current_block(), break_info.continue_block());
4949   HBasicBlock* loop_exit = CreateLoop(stmt,
4950                                       loop_entry,
4951                                       body_exit,
4952                                       loop_successor,
4953                                       break_info.break_block());
4954   set_current_block(loop_exit);
4955 }
4956
4957
4958 void HOptimizedGraphBuilder::VisitForStatement(ForStatement* stmt) {
4959   ASSERT(!HasStackOverflow());
4960   ASSERT(current_block() != NULL);
4961   ASSERT(current_block()->HasPredecessor());
4962   if (stmt->init() != NULL) {
4963     CHECK_ALIVE(Visit(stmt->init()));
4964   }
4965   ASSERT(current_block() != NULL);
4966   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
4967
4968   HBasicBlock* loop_successor = NULL;
4969   if (stmt->cond() != NULL) {
4970     HBasicBlock* body_entry = graph()->CreateBasicBlock();
4971     loop_successor = graph()->CreateBasicBlock();
4972     CHECK_BAILOUT(VisitForControl(stmt->cond(), body_entry, loop_successor));
4973     if (body_entry->HasPredecessor()) {
4974       body_entry->SetJoinId(stmt->BodyId());
4975       set_current_block(body_entry);
4976     }
4977     if (loop_successor->HasPredecessor()) {
4978       loop_successor->SetJoinId(stmt->ExitId());
4979     } else {
4980       loop_successor = NULL;
4981     }
4982   }
4983
4984   BreakAndContinueInfo break_info(stmt, scope());
4985   if (current_block() != NULL) {
4986     BreakAndContinueScope push(&break_info, this);
4987     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
4988   }
4989   HBasicBlock* body_exit =
4990       JoinContinue(stmt, current_block(), break_info.continue_block());
4991
4992   if (stmt->next() != NULL && body_exit != NULL) {
4993     set_current_block(body_exit);
4994     CHECK_BAILOUT(Visit(stmt->next()));
4995     body_exit = current_block();
4996   }
4997
4998   HBasicBlock* loop_exit = CreateLoop(stmt,
4999                                       loop_entry,
5000                                       body_exit,
5001                                       loop_successor,
5002                                       break_info.break_block());
5003   set_current_block(loop_exit);
5004 }
5005
5006
5007 void HOptimizedGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
5008   ASSERT(!HasStackOverflow());
5009   ASSERT(current_block() != NULL);
5010   ASSERT(current_block()->HasPredecessor());
5011
5012   if (!FLAG_optimize_for_in) {
5013     return Bailout(kForInStatementOptimizationIsDisabled);
5014   }
5015
5016   if (stmt->for_in_type() != ForInStatement::FAST_FOR_IN) {
5017     return Bailout(kForInStatementIsNotFastCase);
5018   }
5019
5020   if (!stmt->each()->IsVariableProxy() ||
5021       !stmt->each()->AsVariableProxy()->var()->IsStackLocal()) {
5022     return Bailout(kForInStatementWithNonLocalEachVariable);
5023   }
5024
5025   Variable* each_var = stmt->each()->AsVariableProxy()->var();
5026
5027   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
5028   HValue* enumerable = Top();  // Leave enumerable at the top.
5029
5030   HInstruction* map = Add<HForInPrepareMap>(enumerable);
5031   Add<HSimulate>(stmt->PrepareId());
5032
5033   HInstruction* array = Add<HForInCacheArray>(
5034       enumerable, map, DescriptorArray::kEnumCacheBridgeCacheIndex);
5035
5036   HInstruction* enum_length = Add<HMapEnumLength>(map);
5037
5038   HInstruction* start_index = Add<HConstant>(0);
5039
5040   Push(map);
5041   Push(array);
5042   Push(enum_length);
5043   Push(start_index);
5044
5045   HInstruction* index_cache = Add<HForInCacheArray>(
5046       enumerable, map, DescriptorArray::kEnumCacheBridgeIndicesCacheIndex);
5047   HForInCacheArray::cast(array)->set_index_cache(
5048       HForInCacheArray::cast(index_cache));
5049
5050   HBasicBlock* loop_entry = BuildLoopEntry(stmt);
5051
5052   HValue* index = environment()->ExpressionStackAt(0);
5053   HValue* limit = environment()->ExpressionStackAt(1);
5054
5055   // Check that we still have more keys.
5056   HCompareNumericAndBranch* compare_index =
5057       New<HCompareNumericAndBranch>(index, limit, Token::LT);
5058   compare_index->set_observed_input_representation(
5059       Representation::Smi(), Representation::Smi());
5060
5061   HBasicBlock* loop_body = graph()->CreateBasicBlock();
5062   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
5063
5064   compare_index->SetSuccessorAt(0, loop_body);
5065   compare_index->SetSuccessorAt(1, loop_successor);
5066   FinishCurrentBlock(compare_index);
5067
5068   set_current_block(loop_successor);
5069   Drop(5);
5070
5071   set_current_block(loop_body);
5072
5073   HValue* key = Add<HLoadKeyed>(
5074       environment()->ExpressionStackAt(2),  // Enum cache.
5075       environment()->ExpressionStackAt(0),  // Iteration index.
5076       environment()->ExpressionStackAt(0),
5077       FAST_ELEMENTS);
5078
5079   // Check if the expected map still matches that of the enumerable.
5080   // If not just deoptimize.
5081   Add<HCheckMapValue>(environment()->ExpressionStackAt(4),
5082                       environment()->ExpressionStackAt(3));
5083
5084   Bind(each_var, key);
5085
5086   BreakAndContinueInfo break_info(stmt, scope(), 5);
5087   {
5088     BreakAndContinueScope push(&break_info, this);
5089     CHECK_BAILOUT(VisitLoopBody(stmt, loop_entry));
5090   }
5091
5092   HBasicBlock* body_exit =
5093       JoinContinue(stmt, current_block(), break_info.continue_block());
5094
5095   if (body_exit != NULL) {
5096     set_current_block(body_exit);
5097
5098     HValue* current_index = Pop();
5099     Push(AddUncasted<HAdd>(current_index, graph()->GetConstant1()));
5100     body_exit = current_block();
5101   }
5102
5103   HBasicBlock* loop_exit = CreateLoop(stmt,
5104                                       loop_entry,
5105                                       body_exit,
5106                                       loop_successor,
5107                                       break_info.break_block());
5108
5109   set_current_block(loop_exit);
5110 }
5111
5112
5113 void HOptimizedGraphBuilder::VisitForOfStatement(ForOfStatement* stmt) {
5114   ASSERT(!HasStackOverflow());
5115   ASSERT(current_block() != NULL);
5116   ASSERT(current_block()->HasPredecessor());
5117   return Bailout(kForOfStatement);
5118 }
5119
5120
5121 void HOptimizedGraphBuilder::VisitTryCatchStatement(TryCatchStatement* stmt) {
5122   ASSERT(!HasStackOverflow());
5123   ASSERT(current_block() != NULL);
5124   ASSERT(current_block()->HasPredecessor());
5125   return Bailout(kTryCatchStatement);
5126 }
5127
5128
5129 void HOptimizedGraphBuilder::VisitTryFinallyStatement(
5130     TryFinallyStatement* stmt) {
5131   ASSERT(!HasStackOverflow());
5132   ASSERT(current_block() != NULL);
5133   ASSERT(current_block()->HasPredecessor());
5134   return Bailout(kTryFinallyStatement);
5135 }
5136
5137
5138 void HOptimizedGraphBuilder::VisitDebuggerStatement(DebuggerStatement* stmt) {
5139   ASSERT(!HasStackOverflow());
5140   ASSERT(current_block() != NULL);
5141   ASSERT(current_block()->HasPredecessor());
5142   return Bailout(kDebuggerStatement);
5143 }
5144
5145
5146 void HOptimizedGraphBuilder::VisitCaseClause(CaseClause* clause) {
5147   UNREACHABLE();
5148 }
5149
5150
5151 void HOptimizedGraphBuilder::VisitFunctionLiteral(FunctionLiteral* expr) {
5152   ASSERT(!HasStackOverflow());
5153   ASSERT(current_block() != NULL);
5154   ASSERT(current_block()->HasPredecessor());
5155   Handle<SharedFunctionInfo> shared_info = expr->shared_info();
5156   if (shared_info.is_null()) {
5157     shared_info = Compiler::BuildFunctionInfo(expr, current_info()->script());
5158   }
5159   // We also have a stack overflow if the recursive compilation did.
5160   if (HasStackOverflow()) return;
5161   HFunctionLiteral* instr =
5162       New<HFunctionLiteral>(shared_info, expr->pretenure());
5163   return ast_context()->ReturnInstruction(instr, expr->id());
5164 }
5165
5166
5167 void HOptimizedGraphBuilder::VisitNativeFunctionLiteral(
5168     NativeFunctionLiteral* expr) {
5169   ASSERT(!HasStackOverflow());
5170   ASSERT(current_block() != NULL);
5171   ASSERT(current_block()->HasPredecessor());
5172   return Bailout(kNativeFunctionLiteral);
5173 }
5174
5175
5176 void HOptimizedGraphBuilder::VisitConditional(Conditional* expr) {
5177   ASSERT(!HasStackOverflow());
5178   ASSERT(current_block() != NULL);
5179   ASSERT(current_block()->HasPredecessor());
5180   HBasicBlock* cond_true = graph()->CreateBasicBlock();
5181   HBasicBlock* cond_false = graph()->CreateBasicBlock();
5182   CHECK_BAILOUT(VisitForControl(expr->condition(), cond_true, cond_false));
5183
5184   // Visit the true and false subexpressions in the same AST context as the
5185   // whole expression.
5186   if (cond_true->HasPredecessor()) {
5187     cond_true->SetJoinId(expr->ThenId());
5188     set_current_block(cond_true);
5189     CHECK_BAILOUT(Visit(expr->then_expression()));
5190     cond_true = current_block();
5191   } else {
5192     cond_true = NULL;
5193   }
5194
5195   if (cond_false->HasPredecessor()) {
5196     cond_false->SetJoinId(expr->ElseId());
5197     set_current_block(cond_false);
5198     CHECK_BAILOUT(Visit(expr->else_expression()));
5199     cond_false = current_block();
5200   } else {
5201     cond_false = NULL;
5202   }
5203
5204   if (!ast_context()->IsTest()) {
5205     HBasicBlock* join = CreateJoin(cond_true, cond_false, expr->id());
5206     set_current_block(join);
5207     if (join != NULL && !ast_context()->IsEffect()) {
5208       return ast_context()->ReturnValue(Pop());
5209     }
5210   }
5211 }
5212
5213
5214 HOptimizedGraphBuilder::GlobalPropertyAccess
5215     HOptimizedGraphBuilder::LookupGlobalProperty(
5216         Variable* var, LookupResult* lookup, PropertyAccessType access_type) {
5217   if (var->is_this() || !current_info()->has_global_object()) {
5218     return kUseGeneric;
5219   }
5220   Handle<GlobalObject> global(current_info()->global_object());
5221   global->Lookup(var->name(), lookup);
5222   if (!lookup->IsNormal() ||
5223       (access_type == STORE && lookup->IsReadOnly()) ||
5224       lookup->holder() != *global) {
5225     return kUseGeneric;
5226   }
5227
5228   return kUseCell;
5229 }
5230
5231
5232 HValue* HOptimizedGraphBuilder::BuildContextChainWalk(Variable* var) {
5233   ASSERT(var->IsContextSlot());
5234   HValue* context = environment()->context();
5235   int length = scope()->ContextChainLength(var->scope());
5236   while (length-- > 0) {
5237     context = Add<HLoadNamedField>(
5238         context, static_cast<HValue*>(NULL),
5239         HObjectAccess::ForContextSlot(Context::PREVIOUS_INDEX));
5240   }
5241   return context;
5242 }
5243
5244
5245 void HOptimizedGraphBuilder::VisitVariableProxy(VariableProxy* expr) {
5246   if (expr->is_this()) {
5247     current_info()->set_this_has_uses(true);
5248   }
5249
5250   ASSERT(!HasStackOverflow());
5251   ASSERT(current_block() != NULL);
5252   ASSERT(current_block()->HasPredecessor());
5253   Variable* variable = expr->var();
5254   switch (variable->location()) {
5255     case Variable::UNALLOCATED: {
5256       if (IsLexicalVariableMode(variable->mode())) {
5257         // TODO(rossberg): should this be an ASSERT?
5258         return Bailout(kReferenceToGlobalLexicalVariable);
5259       }
5260       // Handle known global constants like 'undefined' specially to avoid a
5261       // load from a global cell for them.
5262       Handle<Object> constant_value =
5263           isolate()->factory()->GlobalConstantFor(variable->name());
5264       if (!constant_value.is_null()) {
5265         HConstant* instr = New<HConstant>(constant_value);
5266         return ast_context()->ReturnInstruction(instr, expr->id());
5267       }
5268
5269       LookupResult lookup(isolate());
5270       GlobalPropertyAccess type = LookupGlobalProperty(variable, &lookup, LOAD);
5271
5272       if (type == kUseCell &&
5273           current_info()->global_object()->IsAccessCheckNeeded()) {
5274         type = kUseGeneric;
5275       }
5276
5277       if (type == kUseCell) {
5278         Handle<GlobalObject> global(current_info()->global_object());
5279         Handle<PropertyCell> cell(global->GetPropertyCell(&lookup));
5280         if (cell->type()->IsConstant()) {
5281           PropertyCell::AddDependentCompilationInfo(cell, top_info());
5282           Handle<Object> constant_object = cell->type()->AsConstant()->Value();
5283           if (constant_object->IsConsString()) {
5284             constant_object =
5285                 String::Flatten(Handle<String>::cast(constant_object));
5286           }
5287           HConstant* constant = New<HConstant>(constant_object);
5288           return ast_context()->ReturnInstruction(constant, expr->id());
5289         } else {
5290           HLoadGlobalCell* instr =
5291               New<HLoadGlobalCell>(cell, lookup.GetPropertyDetails());
5292           return ast_context()->ReturnInstruction(instr, expr->id());
5293         }
5294       } else {
5295         HValue* global_object = Add<HLoadNamedField>(
5296             context(), static_cast<HValue*>(NULL),
5297             HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
5298         HLoadGlobalGeneric* instr =
5299             New<HLoadGlobalGeneric>(global_object,
5300                                     variable->name(),
5301                                     ast_context()->is_for_typeof());
5302         return ast_context()->ReturnInstruction(instr, expr->id());
5303       }
5304     }
5305
5306     case Variable::PARAMETER:
5307     case Variable::LOCAL: {
5308       HValue* value = LookupAndMakeLive(variable);
5309       if (value == graph()->GetConstantHole()) {
5310         ASSERT(IsDeclaredVariableMode(variable->mode()) &&
5311                variable->mode() != VAR);
5312         return Bailout(kReferenceToUninitializedVariable);
5313       }
5314       return ast_context()->ReturnValue(value);
5315     }
5316
5317     case Variable::CONTEXT: {
5318       HValue* context = BuildContextChainWalk(variable);
5319       HLoadContextSlot::Mode mode;
5320       switch (variable->mode()) {
5321         case LET:
5322         case CONST:
5323           mode = HLoadContextSlot::kCheckDeoptimize;
5324           break;
5325         case CONST_LEGACY:
5326           mode = HLoadContextSlot::kCheckReturnUndefined;
5327           break;
5328         default:
5329           mode = HLoadContextSlot::kNoCheck;
5330           break;
5331       }
5332       HLoadContextSlot* instr =
5333           new(zone()) HLoadContextSlot(context, variable->index(), mode);
5334       return ast_context()->ReturnInstruction(instr, expr->id());
5335     }
5336
5337     case Variable::LOOKUP:
5338       return Bailout(kReferenceToAVariableWhichRequiresDynamicLookup);
5339   }
5340 }
5341
5342
5343 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
5344   ASSERT(!HasStackOverflow());
5345   ASSERT(current_block() != NULL);
5346   ASSERT(current_block()->HasPredecessor());
5347   HConstant* instr = New<HConstant>(expr->value());
5348   return ast_context()->ReturnInstruction(instr, expr->id());
5349 }
5350
5351
5352 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
5353   ASSERT(!HasStackOverflow());
5354   ASSERT(current_block() != NULL);
5355   ASSERT(current_block()->HasPredecessor());
5356   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5357   Handle<FixedArray> literals(closure->literals());
5358   HRegExpLiteral* instr = New<HRegExpLiteral>(literals,
5359                                               expr->pattern(),
5360                                               expr->flags(),
5361                                               expr->literal_index());
5362   return ast_context()->ReturnInstruction(instr, expr->id());
5363 }
5364
5365
5366 static bool CanInlinePropertyAccess(Type* type) {
5367   if (type->Is(Type::NumberOrString())) return true;
5368   if (!type->IsClass()) return false;
5369   Handle<Map> map = type->AsClass()->Map();
5370   return map->IsJSObjectMap() &&
5371       !map->is_dictionary_map() &&
5372       !map->has_named_interceptor();
5373 }
5374
5375
5376 // Determines whether the given array or object literal boilerplate satisfies
5377 // all limits to be considered for fast deep-copying and computes the total
5378 // size of all objects that are part of the graph.
5379 static bool IsFastLiteral(Handle<JSObject> boilerplate,
5380                           int max_depth,
5381                           int* max_properties) {
5382   if (boilerplate->map()->is_deprecated() &&
5383       !JSObject::TryMigrateInstance(boilerplate)) {
5384     return false;
5385   }
5386
5387   ASSERT(max_depth >= 0 && *max_properties >= 0);
5388   if (max_depth == 0) return false;
5389
5390   Isolate* isolate = boilerplate->GetIsolate();
5391   Handle<FixedArrayBase> elements(boilerplate->elements());
5392   if (elements->length() > 0 &&
5393       elements->map() != isolate->heap()->fixed_cow_array_map()) {
5394     if (boilerplate->HasFastObjectElements()) {
5395       Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
5396       int length = elements->length();
5397       for (int i = 0; i < length; i++) {
5398         if ((*max_properties)-- == 0) return false;
5399         Handle<Object> value(fast_elements->get(i), isolate);
5400         if (value->IsJSObject()) {
5401           Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5402           if (!IsFastLiteral(value_object,
5403                              max_depth - 1,
5404                              max_properties)) {
5405             return false;
5406           }
5407         }
5408       }
5409     } else if (!boilerplate->HasFastDoubleElements()) {
5410       return false;
5411     }
5412   }
5413
5414   Handle<FixedArray> properties(boilerplate->properties());
5415   if (properties->length() > 0) {
5416     return false;
5417   } else {
5418     Handle<DescriptorArray> descriptors(
5419         boilerplate->map()->instance_descriptors());
5420     int limit = boilerplate->map()->NumberOfOwnDescriptors();
5421     for (int i = 0; i < limit; i++) {
5422       PropertyDetails details = descriptors->GetDetails(i);
5423       if (details.type() != FIELD) continue;
5424       int index = descriptors->GetFieldIndex(i);
5425       if ((*max_properties)-- == 0) return false;
5426       Handle<Object> value(boilerplate->InObjectPropertyAt(index), isolate);
5427       if (value->IsJSObject()) {
5428         Handle<JSObject> value_object = Handle<JSObject>::cast(value);
5429         if (!IsFastLiteral(value_object,
5430                            max_depth - 1,
5431                            max_properties)) {
5432           return false;
5433         }
5434       }
5435     }
5436   }
5437   return true;
5438 }
5439
5440
5441 void HOptimizedGraphBuilder::VisitObjectLiteral(ObjectLiteral* expr) {
5442   ASSERT(!HasStackOverflow());
5443   ASSERT(current_block() != NULL);
5444   ASSERT(current_block()->HasPredecessor());
5445   expr->BuildConstantProperties(isolate());
5446   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
5447   HInstruction* literal;
5448
5449   // Check whether to use fast or slow deep-copying for boilerplate.
5450   int max_properties = kMaxFastLiteralProperties;
5451   Handle<Object> literals_cell(closure->literals()->get(expr->literal_index()),
5452                                isolate());
5453   Handle<AllocationSite> site;
5454   Handle<JSObject> boilerplate;
5455   if (!literals_cell->IsUndefined()) {
5456     // Retrieve the boilerplate
5457     site = Handle<AllocationSite>::cast(literals_cell);
5458     boilerplate = Handle<JSObject>(JSObject::cast(site->transition_info()),
5459                                    isolate());
5460   }
5461
5462   if (!boilerplate.is_null() &&
5463       IsFastLiteral(boilerplate, kMaxFastLiteralDepth, &max_properties)) {
5464     AllocationSiteUsageContext usage_context(isolate(), site, false);
5465     usage_context.EnterNewScope();
5466     literal = BuildFastLiteral(boilerplate, &usage_context);
5467     usage_context.ExitScope(site, boilerplate);
5468   } else {
5469     NoObservableSideEffectsScope no_effects(this);
5470     Handle<FixedArray> closure_literals(closure->literals(), isolate());
5471     Handle<FixedArray> constant_properties = expr->constant_properties();
5472     int literal_index = expr->literal_index();
5473     int flags = expr->fast_elements()
5474         ? ObjectLiteral::kFastElements : ObjectLiteral::kNoFlags;
5475     flags |= expr->has_function()
5476         ? ObjectLiteral::kHasFunction : ObjectLiteral::kNoFlags;
5477
5478     Add<HPushArguments>(Add<HConstant>(closure_literals),
5479                         Add<HConstant>(literal_index),
5480                         Add<HConstant>(constant_properties),
5481                         Add<HConstant>(flags));
5482
5483     // TODO(mvstanton): Add a flag to turn off creation of any
5484     // AllocationMementos for this call: we are in crankshaft and should have
5485     // learned enough about transition behavior to stop emitting mementos.
5486     Runtime::FunctionId function_id = Runtime::kHiddenCreateObjectLiteral;
5487     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5488                                 Runtime::FunctionForId(function_id),
5489                                 4);
5490   }
5491
5492   // The object is expected in the bailout environment during computation
5493   // of the property values and is the value of the entire expression.
5494   Push(literal);
5495
5496   expr->CalculateEmitStore(zone());
5497
5498   for (int i = 0; i < expr->properties()->length(); i++) {
5499     ObjectLiteral::Property* property = expr->properties()->at(i);
5500     if (property->IsCompileTimeValue()) continue;
5501
5502     Literal* key = property->key();
5503     Expression* value = property->value();
5504
5505     switch (property->kind()) {
5506       case ObjectLiteral::Property::MATERIALIZED_LITERAL:
5507         ASSERT(!CompileTimeValue::IsCompileTimeValue(value));
5508         // Fall through.
5509       case ObjectLiteral::Property::COMPUTED:
5510         if (key->value()->IsInternalizedString()) {
5511           if (property->emit_store()) {
5512             CHECK_ALIVE(VisitForValue(value));
5513             HValue* value = Pop();
5514             Handle<Map> map = property->GetReceiverType();
5515             Handle<String> name = property->key()->AsPropertyName();
5516             HInstruction* store;
5517             if (map.is_null()) {
5518               // If we don't know the monomorphic type, do a generic store.
5519               CHECK_ALIVE(store = BuildNamedGeneric(
5520                   STORE, literal, name, value));
5521             } else {
5522               PropertyAccessInfo info(
5523                   this, STORE, ToType(map), name, map->instance_type());
5524               if (info.CanAccessMonomorphic()) {
5525                 HValue* checked_literal = Add<HCheckMaps>(literal, map);
5526                 ASSERT(!info.lookup()->IsPropertyCallbacks());
5527                 store = BuildMonomorphicAccess(
5528                     &info, literal, checked_literal, value,
5529                     BailoutId::None(), BailoutId::None());
5530               } else {
5531                 CHECK_ALIVE(store = BuildNamedGeneric(
5532                     STORE, literal, name, value));
5533               }
5534             }
5535             AddInstruction(store);
5536             if (store->HasObservableSideEffects()) {
5537               Add<HSimulate>(key->id(), REMOVABLE_SIMULATE);
5538             }
5539           } else {
5540             CHECK_ALIVE(VisitForEffect(value));
5541           }
5542           break;
5543         }
5544         // Fall through.
5545       case ObjectLiteral::Property::PROTOTYPE:
5546       case ObjectLiteral::Property::SETTER:
5547       case ObjectLiteral::Property::GETTER:
5548         return Bailout(kObjectLiteralWithComplexProperty);
5549       default: UNREACHABLE();
5550     }
5551   }
5552
5553   if (expr->has_function()) {
5554     // Return the result of the transformation to fast properties
5555     // instead of the original since this operation changes the map
5556     // of the object. This makes sure that the original object won't
5557     // be used by other optimized code before it is transformed
5558     // (e.g. because of code motion).
5559     HToFastProperties* result = Add<HToFastProperties>(Pop());
5560     return ast_context()->ReturnValue(result);
5561   } else {
5562     return ast_context()->ReturnValue(Pop());
5563   }
5564 }
5565
5566
5567 void HOptimizedGraphBuilder::VisitArrayLiteral(ArrayLiteral* expr) {
5568   ASSERT(!HasStackOverflow());
5569   ASSERT(current_block() != NULL);
5570   ASSERT(current_block()->HasPredecessor());
5571   expr->BuildConstantElements(isolate());
5572   ZoneList<Expression*>* subexprs = expr->values();
5573   int length = subexprs->length();
5574   HInstruction* literal;
5575
5576   Handle<AllocationSite> site;
5577   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
5578   bool uninitialized = false;
5579   Handle<Object> literals_cell(literals->get(expr->literal_index()),
5580                                isolate());
5581   Handle<JSObject> boilerplate_object;
5582   if (literals_cell->IsUndefined()) {
5583     uninitialized = true;
5584     Handle<Object> raw_boilerplate;
5585     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
5586         isolate(), raw_boilerplate,
5587         Runtime::CreateArrayLiteralBoilerplate(
5588             isolate(), literals, expr->constant_elements()),
5589         Bailout(kArrayBoilerplateCreationFailed));
5590
5591     boilerplate_object = Handle<JSObject>::cast(raw_boilerplate);
5592     AllocationSiteCreationContext creation_context(isolate());
5593     site = creation_context.EnterNewScope();
5594     if (JSObject::DeepWalk(boilerplate_object, &creation_context).is_null()) {
5595       return Bailout(kArrayBoilerplateCreationFailed);
5596     }
5597     creation_context.ExitScope(site, boilerplate_object);
5598     literals->set(expr->literal_index(), *site);
5599
5600     if (boilerplate_object->elements()->map() ==
5601         isolate()->heap()->fixed_cow_array_map()) {
5602       isolate()->counters()->cow_arrays_created_runtime()->Increment();
5603     }
5604   } else {
5605     ASSERT(literals_cell->IsAllocationSite());
5606     site = Handle<AllocationSite>::cast(literals_cell);
5607     boilerplate_object = Handle<JSObject>(
5608         JSObject::cast(site->transition_info()), isolate());
5609   }
5610
5611   ASSERT(!boilerplate_object.is_null());
5612   ASSERT(site->SitePointsToLiteral());
5613
5614   ElementsKind boilerplate_elements_kind =
5615       boilerplate_object->GetElementsKind();
5616
5617   // Check whether to use fast or slow deep-copying for boilerplate.
5618   int max_properties = kMaxFastLiteralProperties;
5619   if (IsFastLiteral(boilerplate_object,
5620                     kMaxFastLiteralDepth,
5621                     &max_properties)) {
5622     AllocationSiteUsageContext usage_context(isolate(), site, false);
5623     usage_context.EnterNewScope();
5624     literal = BuildFastLiteral(boilerplate_object, &usage_context);
5625     usage_context.ExitScope(site, boilerplate_object);
5626   } else {
5627     NoObservableSideEffectsScope no_effects(this);
5628     // Boilerplate already exists and constant elements are never accessed,
5629     // pass an empty fixed array to the runtime function instead.
5630     Handle<FixedArray> constants = isolate()->factory()->empty_fixed_array();
5631     int literal_index = expr->literal_index();
5632     int flags = expr->depth() == 1
5633         ? ArrayLiteral::kShallowElements
5634         : ArrayLiteral::kNoFlags;
5635     flags |= ArrayLiteral::kDisableMementos;
5636
5637     Add<HPushArguments>(Add<HConstant>(literals),
5638                         Add<HConstant>(literal_index),
5639                         Add<HConstant>(constants),
5640                         Add<HConstant>(flags));
5641
5642     // TODO(mvstanton): Consider a flag to turn off creation of any
5643     // AllocationMementos for this call: we are in crankshaft and should have
5644     // learned enough about transition behavior to stop emitting mementos.
5645     Runtime::FunctionId function_id = Runtime::kHiddenCreateArrayLiteral;
5646     literal = Add<HCallRuntime>(isolate()->factory()->empty_string(),
5647                                 Runtime::FunctionForId(function_id),
5648                                 4);
5649
5650     // De-opt if elements kind changed from boilerplate_elements_kind.
5651     Handle<Map> map = Handle<Map>(boilerplate_object->map(), isolate());
5652     literal = Add<HCheckMaps>(literal, map);
5653   }
5654
5655   // The array is expected in the bailout environment during computation
5656   // of the property values and is the value of the entire expression.
5657   Push(literal);
5658   // The literal index is on the stack, too.
5659   Push(Add<HConstant>(expr->literal_index()));
5660
5661   HInstruction* elements = NULL;
5662
5663   for (int i = 0; i < length; i++) {
5664     Expression* subexpr = subexprs->at(i);
5665     // If the subexpression is a literal or a simple materialized literal it
5666     // is already set in the cloned array.
5667     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
5668
5669     CHECK_ALIVE(VisitForValue(subexpr));
5670     HValue* value = Pop();
5671     if (!Smi::IsValid(i)) return Bailout(kNonSmiKeyInArrayLiteral);
5672
5673     elements = AddLoadElements(literal);
5674
5675     HValue* key = Add<HConstant>(i);
5676
5677     switch (boilerplate_elements_kind) {
5678       case FAST_SMI_ELEMENTS:
5679       case FAST_HOLEY_SMI_ELEMENTS:
5680       case FAST_ELEMENTS:
5681       case FAST_HOLEY_ELEMENTS:
5682       case FAST_DOUBLE_ELEMENTS:
5683       case FAST_HOLEY_DOUBLE_ELEMENTS: {
5684         HStoreKeyed* instr = Add<HStoreKeyed>(elements, key, value,
5685                                               boilerplate_elements_kind);
5686         instr->SetUninitialized(uninitialized);
5687         break;
5688       }
5689       default:
5690         UNREACHABLE();
5691         break;
5692     }
5693
5694     Add<HSimulate>(expr->GetIdForElement(i));
5695   }
5696
5697   Drop(1);  // array literal index
5698   return ast_context()->ReturnValue(Pop());
5699 }
5700
5701
5702 HCheckMaps* HOptimizedGraphBuilder::AddCheckMap(HValue* object,
5703                                                 Handle<Map> map) {
5704   BuildCheckHeapObject(object);
5705   return Add<HCheckMaps>(object, map);
5706 }
5707
5708
5709 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedField(
5710     PropertyAccessInfo* info,
5711     HValue* checked_object) {
5712   // See if this is a load for an immutable property
5713   if (checked_object->ActualValue()->IsConstant() &&
5714       info->lookup()->IsCacheable() &&
5715       info->lookup()->IsReadOnly() && info->lookup()->IsDontDelete()) {
5716     Handle<Object> object(
5717         HConstant::cast(checked_object->ActualValue())->handle(isolate()));
5718
5719     if (object->IsJSObject()) {
5720       LookupResult lookup(isolate());
5721       Handle<JSObject>::cast(object)->Lookup(info->name(), &lookup);
5722       Handle<Object> value(lookup.GetLazyValue(), isolate());
5723
5724       if (!value->IsTheHole()) {
5725         return New<HConstant>(value);
5726       }
5727     }
5728   }
5729
5730   HObjectAccess access = info->access();
5731   if (access.representation().IsDouble()) {
5732     // Load the heap number.
5733     checked_object = Add<HLoadNamedField>(
5734         checked_object, static_cast<HValue*>(NULL),
5735         access.WithRepresentation(Representation::Tagged()));
5736     // Load the double value from it.
5737     access = HObjectAccess::ForHeapNumberValue();
5738   }
5739
5740   SmallMapList* map_list = info->field_maps();
5741   if (map_list->length() == 0) {
5742     return New<HLoadNamedField>(checked_object, checked_object, access);
5743   }
5744
5745   UniqueSet<Map>* maps = new(zone()) UniqueSet<Map>(map_list->length(), zone());
5746   for (int i = 0; i < map_list->length(); ++i) {
5747     maps->Add(Unique<Map>::CreateImmovable(map_list->at(i)), zone());
5748   }
5749   return New<HLoadNamedField>(
5750       checked_object, checked_object, access, maps, info->field_type());
5751 }
5752
5753
5754 HInstruction* HOptimizedGraphBuilder::BuildStoreNamedField(
5755     PropertyAccessInfo* info,
5756     HValue* checked_object,
5757     HValue* value) {
5758   bool transition_to_field = info->lookup()->IsTransition();
5759   // TODO(verwaest): Move this logic into PropertyAccessInfo.
5760   HObjectAccess field_access = info->access();
5761
5762   HStoreNamedField *instr;
5763   if (field_access.representation().IsDouble()) {
5764     HObjectAccess heap_number_access =
5765         field_access.WithRepresentation(Representation::Tagged());
5766     if (transition_to_field) {
5767       // The store requires a mutable HeapNumber to be allocated.
5768       NoObservableSideEffectsScope no_side_effects(this);
5769       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
5770
5771       // TODO(hpayer): Allocation site pretenuring support.
5772       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
5773           HType::HeapObject(),
5774           NOT_TENURED,
5775           HEAP_NUMBER_TYPE);
5776       AddStoreMapConstant(heap_number, isolate()->factory()->heap_number_map());
5777       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
5778                             value);
5779       instr = New<HStoreNamedField>(checked_object->ActualValue(),
5780                                     heap_number_access,
5781                                     heap_number);
5782     } else {
5783       // Already holds a HeapNumber; load the box and write its value field.
5784       HInstruction* heap_number = Add<HLoadNamedField>(
5785           checked_object, static_cast<HValue*>(NULL), heap_number_access);
5786       instr = New<HStoreNamedField>(heap_number,
5787                                     HObjectAccess::ForHeapNumberValue(),
5788                                     value, STORE_TO_INITIALIZED_ENTRY);
5789     }
5790   } else {
5791     if (field_access.representation().IsHeapObject()) {
5792       BuildCheckHeapObject(value);
5793     }
5794
5795     if (!info->field_maps()->is_empty()) {
5796       ASSERT(field_access.representation().IsHeapObject());
5797       value = Add<HCheckMaps>(value, info->field_maps());
5798     }
5799
5800     // This is a normal store.
5801     instr = New<HStoreNamedField>(
5802         checked_object->ActualValue(), field_access, value,
5803         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
5804   }
5805
5806   if (transition_to_field) {
5807     Handle<Map> transition(info->transition());
5808     ASSERT(!transition->is_deprecated());
5809     instr->SetTransition(Add<HConstant>(transition));
5810   }
5811   return instr;
5812 }
5813
5814
5815 bool HOptimizedGraphBuilder::PropertyAccessInfo::IsCompatible(
5816     PropertyAccessInfo* info) {
5817   if (!CanInlinePropertyAccess(type_)) return false;
5818
5819   // Currently only handle Type::Number as a polymorphic case.
5820   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
5821   // instruction.
5822   if (type_->Is(Type::Number())) return false;
5823
5824   // Values are only compatible for monomorphic load if they all behave the same
5825   // regarding value wrappers.
5826   if (type_->Is(Type::NumberOrString())) {
5827     if (!info->type_->Is(Type::NumberOrString())) return false;
5828   } else {
5829     if (info->type_->Is(Type::NumberOrString())) return false;
5830   }
5831
5832   if (!LookupDescriptor()) return false;
5833
5834   if (!lookup_.IsFound()) {
5835     return (!info->lookup_.IsFound() || info->has_holder()) &&
5836         map()->prototype() == info->map()->prototype();
5837   }
5838
5839   // Mismatch if the other access info found the property in the prototype
5840   // chain.
5841   if (info->has_holder()) return false;
5842
5843   if (lookup_.IsPropertyCallbacks()) {
5844     return accessor_.is_identical_to(info->accessor_) &&
5845         api_holder_.is_identical_to(info->api_holder_);
5846   }
5847
5848   if (lookup_.IsConstant()) {
5849     return constant_.is_identical_to(info->constant_);
5850   }
5851
5852   ASSERT(lookup_.IsField());
5853   if (!info->lookup_.IsField()) return false;
5854
5855   Representation r = access_.representation();
5856   if (IsLoad()) {
5857     if (!info->access_.representation().IsCompatibleForLoad(r)) return false;
5858   } else {
5859     if (!info->access_.representation().IsCompatibleForStore(r)) return false;
5860   }
5861   if (info->access_.offset() != access_.offset()) return false;
5862   if (info->access_.IsInobject() != access_.IsInobject()) return false;
5863   if (IsLoad()) {
5864     if (field_maps_.is_empty()) {
5865       info->field_maps_.Clear();
5866     } else if (!info->field_maps_.is_empty()) {
5867       for (int i = 0; i < field_maps_.length(); ++i) {
5868         info->field_maps_.AddMapIfMissing(field_maps_.at(i), info->zone());
5869       }
5870       info->field_maps_.Sort();
5871     }
5872   } else {
5873     // We can only merge stores that agree on their field maps. The comparison
5874     // below is safe, since we keep the field maps sorted.
5875     if (field_maps_.length() != info->field_maps_.length()) return false;
5876     for (int i = 0; i < field_maps_.length(); ++i) {
5877       if (!field_maps_.at(i).is_identical_to(info->field_maps_.at(i))) {
5878         return false;
5879       }
5880     }
5881   }
5882   info->GeneralizeRepresentation(r);
5883   info->field_type_ = info->field_type_.Combine(field_type_);
5884   return true;
5885 }
5886
5887
5888 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupDescriptor() {
5889   if (!type_->IsClass()) return true;
5890   map()->LookupDescriptor(NULL, *name_, &lookup_);
5891   return LoadResult(map());
5892 }
5893
5894
5895 bool HOptimizedGraphBuilder::PropertyAccessInfo::LoadResult(Handle<Map> map) {
5896   if (!IsLoad() && lookup_.IsProperty() &&
5897       (lookup_.IsReadOnly() || !lookup_.IsCacheable())) {
5898     return false;
5899   }
5900
5901   if (lookup_.IsField()) {
5902     // Construct the object field access.
5903     access_ = HObjectAccess::ForField(map, &lookup_, name_);
5904
5905     // Load field map for heap objects.
5906     LoadFieldMaps(map);
5907   } else if (lookup_.IsPropertyCallbacks()) {
5908     Handle<Object> callback(lookup_.GetValueFromMap(*map), isolate());
5909     if (!callback->IsAccessorPair()) return false;
5910     Object* raw_accessor = IsLoad()
5911         ? Handle<AccessorPair>::cast(callback)->getter()
5912         : Handle<AccessorPair>::cast(callback)->setter();
5913     if (!raw_accessor->IsJSFunction()) return false;
5914     Handle<JSFunction> accessor = handle(JSFunction::cast(raw_accessor));
5915     if (accessor->shared()->IsApiFunction()) {
5916       CallOptimization call_optimization(accessor);
5917       if (call_optimization.is_simple_api_call()) {
5918         CallOptimization::HolderLookup holder_lookup;
5919         Handle<Map> receiver_map = this->map();
5920         api_holder_ = call_optimization.LookupHolderOfExpectedType(
5921             receiver_map, &holder_lookup);
5922       }
5923     }
5924     accessor_ = accessor;
5925   } else if (lookup_.IsConstant()) {
5926     constant_ = handle(lookup_.GetConstantFromMap(*map), isolate());
5927   }
5928
5929   return true;
5930 }
5931
5932
5933 void HOptimizedGraphBuilder::PropertyAccessInfo::LoadFieldMaps(
5934     Handle<Map> map) {
5935   // Clear any previously collected field maps/type.
5936   field_maps_.Clear();
5937   field_type_ = HType::Tagged();
5938
5939   // Figure out the field type from the accessor map.
5940   Handle<HeapType> field_type(lookup_.GetFieldTypeFromMap(*map), isolate());
5941
5942   // Collect the (stable) maps from the field type.
5943   int num_field_maps = field_type->NumClasses();
5944   if (num_field_maps == 0) return;
5945   ASSERT(access_.representation().IsHeapObject());
5946   field_maps_.Reserve(num_field_maps, zone());
5947   HeapType::Iterator<Map> it = field_type->Classes();
5948   while (!it.Done()) {
5949     Handle<Map> field_map = it.Current();
5950     if (!field_map->is_stable()) {
5951       field_maps_.Clear();
5952       return;
5953     }
5954     field_maps_.Add(field_map, zone());
5955     it.Advance();
5956   }
5957   field_maps_.Sort();
5958   ASSERT_EQ(num_field_maps, field_maps_.length());
5959
5960   // Determine field HType from field HeapType.
5961   field_type_ = HType::FromType<HeapType>(field_type);
5962   ASSERT(field_type_.IsHeapObject());
5963
5964   // Add dependency on the map that introduced the field.
5965   Map::AddDependentCompilationInfo(
5966       handle(lookup_.GetFieldOwnerFromMap(*map), isolate()),
5967       DependentCode::kFieldTypeGroup, top_info());
5968 }
5969
5970
5971 bool HOptimizedGraphBuilder::PropertyAccessInfo::LookupInPrototypes() {
5972   Handle<Map> map = this->map();
5973
5974   while (map->prototype()->IsJSObject()) {
5975     holder_ = handle(JSObject::cast(map->prototype()));
5976     if (holder_->map()->is_deprecated()) {
5977       JSObject::TryMigrateInstance(holder_);
5978     }
5979     map = Handle<Map>(holder_->map());
5980     if (!CanInlinePropertyAccess(ToType(map))) {
5981       lookup_.NotFound();
5982       return false;
5983     }
5984     map->LookupDescriptor(*holder_, *name_, &lookup_);
5985     if (lookup_.IsFound()) return LoadResult(map);
5986   }
5987   lookup_.NotFound();
5988   return true;
5989 }
5990
5991
5992 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessMonomorphic() {
5993   if (IsSIMD128PropertyCallback() &&
5994       CpuFeatures::SupportsSIMD128InCrankshaft()) {
5995     return true;
5996   }
5997   if (!CanInlinePropertyAccess(type_)) return false;
5998   if (IsJSObjectFieldAccessor()) return IsLoad();
5999   if (!LookupDescriptor()) return false;
6000   if (lookup_.IsFound()) {
6001     if (IsLoad()) return true;
6002     return !lookup_.IsReadOnly() && lookup_.IsCacheable();
6003   }
6004   if (!LookupInPrototypes()) return false;
6005   if (IsLoad()) return true;
6006
6007   if (lookup_.IsPropertyCallbacks()) return true;
6008   Handle<Map> map = this->map();
6009   map->LookupTransition(NULL, *name_, &lookup_);
6010   if (lookup_.IsTransitionToField() && map->unused_property_fields() > 0) {
6011     // Construct the object field access.
6012     access_ = HObjectAccess::ForField(map, &lookup_, name_);
6013
6014     // Load field map for heap objects.
6015     LoadFieldMaps(transition());
6016     return true;
6017   }
6018   return false;
6019 }
6020
6021
6022 bool HOptimizedGraphBuilder::PropertyAccessInfo::CanAccessAsMonomorphic(
6023     SmallMapList* types) {
6024   ASSERT(type_->Is(ToType(types->first())));
6025   if (!CanAccessMonomorphic()) return false;
6026   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6027   if (types->length() > kMaxLoadPolymorphism) return false;
6028
6029   if (IsSIMD128PropertyCallback() &&
6030       CpuFeatures::SupportsSIMD128InCrankshaft()) {
6031     for (int i = 1; i < types->length(); ++i) {
6032       if (types->at(i)->instance_type() == types->first()->instance_type()) {
6033         return false;
6034       }
6035     }
6036     return true;
6037   }
6038
6039   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6040   if (GetJSObjectFieldAccess(&access)) {
6041     for (int i = 1; i < types->length(); ++i) {
6042       PropertyAccessInfo test_info(
6043           builder_, access_type_, ToType(types->at(i)), name_,
6044           types->at(i)->instance_type());
6045       HObjectAccess test_access = HObjectAccess::ForMap();  // bogus default
6046       if (!test_info.GetJSObjectFieldAccess(&test_access)) return false;
6047       if (!access.Equals(test_access)) return false;
6048     }
6049     return true;
6050   }
6051
6052   // Currently only handle Type::Number as a polymorphic case.
6053   // TODO(verwaest): Support monomorphic handling of numbers with a HCheckNumber
6054   // instruction.
6055   if (type_->Is(Type::Number())) return false;
6056
6057   // Multiple maps cannot transition to the same target map.
6058   ASSERT(!IsLoad() || !lookup_.IsTransition());
6059   if (lookup_.IsTransition() && types->length() > 1) return false;
6060
6061   for (int i = 1; i < types->length(); ++i) {
6062     PropertyAccessInfo test_info(
6063         builder_, access_type_, ToType(types->at(i)), name_,
6064         types->at(i)->instance_type());
6065     if (!test_info.IsCompatible(this)) return false;
6066   }
6067
6068   return true;
6069 }
6070
6071
6072 static bool NeedsWrappingFor(Type* type, Handle<JSFunction> target) {
6073   return type->Is(Type::NumberOrString()) &&
6074       target->shared()->strict_mode() == SLOPPY &&
6075       !target->shared()->native();
6076 }
6077
6078
6079 static bool IsSIMDProperty(Handle<String> name, uint8_t* mask) {
6080   SmartArrayPointer<char> cstring = name->ToCString();
6081   int i = 0;
6082   while (i <= 3) {
6083     int shift = 0;
6084     switch (cstring[i]) {
6085       case 'W':
6086         shift++;
6087       case 'Z':
6088         shift++;
6089       case 'Y':
6090         shift++;
6091       case 'X':
6092         break;
6093       default:
6094         return false;
6095     }
6096     *mask |= (shift << 2*i);
6097     i++;
6098   }
6099
6100   return true;
6101 }
6102
6103
6104 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicAccess(
6105     PropertyAccessInfo* info,
6106     HValue* object,
6107     HValue* checked_object,
6108     HValue* value,
6109     BailoutId ast_id,
6110     BailoutId return_id,
6111     bool can_inline_accessor) {
6112
6113   HObjectAccess access = HObjectAccess::ForMap();  // bogus default
6114   if (info->GetJSObjectFieldAccess(&access)) {
6115     ASSERT(info->IsLoad());
6116     return New<HLoadNamedField>(object, checked_object, access);
6117   }
6118
6119   HValue* checked_holder = checked_object;
6120   if (info->has_holder()) {
6121     Handle<JSObject> prototype(JSObject::cast(info->map()->prototype()));
6122     checked_holder = BuildCheckPrototypeMaps(prototype, info->holder());
6123   }
6124
6125   if (!info->lookup()->IsFound()) {
6126     ASSERT(info->IsLoad());
6127     return graph()->GetConstantUndefined();
6128   }
6129
6130   if (info->lookup()->IsField()) {
6131     if (info->IsLoad()) {
6132       if (info->map()->constructor()->IsJSFunction()) {
6133         JSFunction* constructor = JSFunction::cast(info->map()->constructor());
6134         String* class_name =
6135           String::cast(constructor->shared()->instance_class_name());
6136         uint8_t mask = 0;
6137         if (class_name->Equals(isolate()->heap()->simd()) &&
6138             IsSIMDProperty(info->name(), &mask) &&
6139             CpuFeatures::SupportsSIMD128InCrankshaft()) {
6140           return New<HConstant>(mask);
6141         }
6142       }
6143       return BuildLoadNamedField(info, checked_holder);
6144     } else {
6145       return BuildStoreNamedField(info, checked_object, value);
6146     }
6147   }
6148
6149   if (info->lookup()->IsTransition()) {
6150     ASSERT(!info->IsLoad());
6151     return BuildStoreNamedField(info, checked_object, value);
6152   }
6153
6154   if (info->lookup()->IsPropertyCallbacks()) {
6155     Push(checked_object);
6156     int argument_count = 1;
6157     if (!info->IsLoad()) {
6158       argument_count = 2;
6159       Push(value);
6160     }
6161
6162     if (NeedsWrappingFor(info->type(), info->accessor())) {
6163       HValue* function = Add<HConstant>(info->accessor());
6164       PushArgumentsFromEnvironment(argument_count);
6165       return New<HCallFunction>(function, argument_count, WRAP_AND_CALL);
6166     } else if (FLAG_inline_accessors && can_inline_accessor) {
6167       bool success = info->IsLoad()
6168           ? TryInlineGetter(info->accessor(), info->map(), ast_id, return_id)
6169           : TryInlineSetter(
6170               info->accessor(), info->map(), ast_id, return_id, value);
6171       if (success || HasStackOverflow()) return NULL;
6172     }
6173
6174     PushArgumentsFromEnvironment(argument_count);
6175     return BuildCallConstantFunction(info->accessor(), argument_count);
6176   }
6177
6178   ASSERT(info->lookup()->IsConstant());
6179   if (info->IsLoad()) {
6180     return New<HConstant>(info->constant());
6181   } else {
6182     return New<HCheckValue>(value, Handle<JSFunction>::cast(info->constant()));
6183   }
6184 }
6185
6186
6187 void HOptimizedGraphBuilder::HandlePolymorphicNamedFieldAccess(
6188     PropertyAccessType access_type,
6189     BailoutId ast_id,
6190     BailoutId return_id,
6191     HValue* object,
6192     HValue* value,
6193     SmallMapList* types,
6194     Handle<String> name) {
6195   // Something did not match; must use a polymorphic load.
6196   int count = 0;
6197   HBasicBlock* join = NULL;
6198   HBasicBlock* number_block = NULL;
6199   bool handled_string = false;
6200
6201   bool handle_smi = false;
6202   STATIC_ASSERT(kMaxLoadPolymorphism == kMaxStorePolymorphism);
6203   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
6204     PropertyAccessInfo info(
6205         this, access_type, ToType(types->at(i)), name,
6206         types->at(i)->instance_type());
6207     if (info.type()->Is(Type::String())) {
6208       if (handled_string) continue;
6209       handled_string = true;
6210     }
6211     if (info.CanAccessMonomorphic()) {
6212       count++;
6213       if (info.type()->Is(Type::Number())) {
6214         handle_smi = true;
6215         break;
6216       }
6217     }
6218   }
6219
6220   count = 0;
6221   HControlInstruction* smi_check = NULL;
6222   handled_string = false;
6223
6224   for (int i = 0; i < types->length() && count < kMaxLoadPolymorphism; ++i) {
6225     PropertyAccessInfo info(
6226         this, access_type, ToType(types->at(i)), name,
6227         types->at(i)->instance_type());
6228     if (info.type()->Is(Type::String())) {
6229       if (handled_string) continue;
6230       handled_string = true;
6231     }
6232     if (!info.CanAccessMonomorphic()) continue;
6233
6234     if (count == 0) {
6235       join = graph()->CreateBasicBlock();
6236       if (handle_smi) {
6237         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
6238         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
6239         number_block = graph()->CreateBasicBlock();
6240         smi_check = New<HIsSmiAndBranch>(
6241             object, empty_smi_block, not_smi_block);
6242         FinishCurrentBlock(smi_check);
6243         GotoNoSimulate(empty_smi_block, number_block);
6244         set_current_block(not_smi_block);
6245       } else {
6246         BuildCheckHeapObject(object);
6247       }
6248     }
6249     ++count;
6250     HBasicBlock* if_true = graph()->CreateBasicBlock();
6251     HBasicBlock* if_false = graph()->CreateBasicBlock();
6252     HUnaryControlInstruction* compare;
6253
6254     HValue* dependency;
6255     if (info.type()->Is(Type::Number())) {
6256       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
6257       compare = New<HCompareMap>(object, heap_number_map, if_true, if_false);
6258       dependency = smi_check;
6259     } else if (info.type()->Is(Type::String())) {
6260       compare = New<HIsStringAndBranch>(object, if_true, if_false);
6261       dependency = compare;
6262     } else {
6263       compare = New<HCompareMap>(object, info.map(), if_true, if_false);
6264       dependency = compare;
6265     }
6266     FinishCurrentBlock(compare);
6267
6268     if (info.type()->Is(Type::Number())) {
6269       GotoNoSimulate(if_true, number_block);
6270       if_true = number_block;
6271     }
6272
6273     set_current_block(if_true);
6274
6275     HInstruction* access = BuildMonomorphicAccess(
6276         &info, object, dependency, value, ast_id,
6277         return_id, FLAG_polymorphic_inlining);
6278
6279     HValue* result = NULL;
6280     switch (access_type) {
6281       case LOAD:
6282         result = access;
6283         break;
6284       case STORE:
6285         result = value;
6286         break;
6287     }
6288
6289     if (access == NULL) {
6290       if (HasStackOverflow()) return;
6291     } else {
6292       if (!access->IsLinked()) AddInstruction(access);
6293       if (!ast_context()->IsEffect()) Push(result);
6294     }
6295
6296     if (current_block() != NULL) Goto(join);
6297     set_current_block(if_false);
6298   }
6299
6300   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
6301   // know about and do not want to handle ones we've never seen.  Otherwise
6302   // use a generic IC.
6303   if (count == types->length() && FLAG_deoptimize_uncommon_cases) {
6304     FinishExitWithHardDeoptimization("Uknown map in polymorphic access");
6305   } else {
6306     HInstruction* instr = BuildNamedGeneric(access_type, object, name, value);
6307     AddInstruction(instr);
6308     if (!ast_context()->IsEffect()) Push(access_type == LOAD ? instr : value);
6309
6310     if (join != NULL) {
6311       Goto(join);
6312     } else {
6313       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6314       if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6315       return;
6316     }
6317   }
6318
6319   ASSERT(join != NULL);
6320   if (join->HasPredecessor()) {
6321     join->SetJoinId(ast_id);
6322     set_current_block(join);
6323     if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
6324   } else {
6325     set_current_block(NULL);
6326   }
6327 }
6328
6329
6330 static bool ComputeReceiverTypes(Expression* expr,
6331                                  HValue* receiver,
6332                                  SmallMapList** t,
6333                                  Zone* zone) {
6334   SmallMapList* types = expr->GetReceiverTypes();
6335   *t = types;
6336   bool monomorphic = expr->IsMonomorphic();
6337   if (types != NULL && receiver->HasMonomorphicJSObjectType()) {
6338     Map* root_map = receiver->GetMonomorphicJSObjectMap()->FindRootMap();
6339     types->FilterForPossibleTransitions(root_map);
6340     monomorphic = types->length() == 1;
6341   }
6342   return monomorphic && CanInlinePropertyAccess(
6343       IC::MapToType<Type>(types->first(), zone));
6344 }
6345
6346
6347 static bool AreStringTypes(SmallMapList* types) {
6348   for (int i = 0; i < types->length(); i++) {
6349     if (types->at(i)->instance_type() >= FIRST_NONSTRING_TYPE) return false;
6350   }
6351   return true;
6352 }
6353
6354
6355 static bool AreInt32x4Types(SmallMapList* types) {
6356   if (types == NULL || types->length() == 0) return false;
6357   for (int i = 0; i < types->length(); i++) {
6358     if (types->at(i)->instance_type() != INT32x4_TYPE) return false;
6359   }
6360   return true;
6361 }
6362
6363
6364 static bool AreFloat32x4Types(SmallMapList* types) {
6365   if (types == NULL || types->length() == 0) return false;
6366   for (int i = 0; i < types->length(); i++) {
6367     if (types->at(i)->instance_type() != FLOAT32x4_TYPE) return false;
6368   }
6369   return true;
6370 }
6371
6372
6373 static bool AreFloat64x2Types(SmallMapList* types) {
6374   if (types == NULL || types->length() == 0) return false;
6375   for (int i = 0; i < types->length(); i++) {
6376     if (types->at(i)->instance_type() != FLOAT64x2_TYPE) return false;
6377   }
6378   return true;
6379 }
6380
6381
6382 static BuiltinFunctionId NameToId(Isolate* isolate, Handle<String> name,
6383                                   InstanceType type) {
6384   BuiltinFunctionId id;
6385   if (name->Equals(isolate->heap()->signMask())) {
6386     if (type == FLOAT32x4_TYPE) {
6387       id = kFloat32x4GetSignMask;
6388     } else if (type == FLOAT64x2_TYPE) {
6389       id = kFloat64x2GetSignMask;
6390     } else {
6391       ASSERT(type == INT32x4_TYPE);
6392       id = kInt32x4GetSignMask;
6393     }
6394   } else if (name->Equals(isolate->heap()->x())) {
6395     if (type == FLOAT32x4_TYPE) {
6396       id = kFloat32x4GetX;
6397     } else if (type == FLOAT64x2_TYPE) {
6398       id = kFloat64x2GetX;
6399     } else {
6400       ASSERT(type == INT32x4_TYPE);
6401       id = kInt32x4GetX;
6402     }
6403   } else if (name->Equals(isolate->heap()->y())) {
6404     if (type == FLOAT32x4_TYPE) {
6405       id = kFloat32x4GetY;
6406     } else if (type == FLOAT64x2_TYPE) {
6407       id = kFloat64x2GetY;
6408     } else {
6409       ASSERT(type == INT32x4_TYPE);
6410       id = kInt32x4GetY;
6411     }
6412   } else if (name->Equals(isolate->heap()->z())) {
6413     id = type == FLOAT32x4_TYPE ? kFloat32x4GetZ : kInt32x4GetZ;
6414   } else if (name->Equals(isolate->heap()->w())) {
6415     id = type == FLOAT32x4_TYPE ? kFloat32x4GetW : kInt32x4GetW;
6416   } else if (name->Equals(isolate->heap()->flagX())) {
6417     ASSERT(type == INT32x4_TYPE);
6418     id = kInt32x4GetFlagX;
6419   } else if (name->Equals(isolate->heap()->flagY())) {
6420     ASSERT(type == INT32x4_TYPE);
6421     id = kInt32x4GetFlagY;
6422   } else if (name->Equals(isolate->heap()->flagZ())) {
6423     ASSERT(type == INT32x4_TYPE);
6424     id = kInt32x4GetFlagZ;
6425   } else if (name->Equals(isolate->heap()->flagW())) {
6426     ASSERT(type == INT32x4_TYPE);
6427     id = kInt32x4GetFlagW;
6428   } else {
6429     UNREACHABLE();
6430     id = kSIMD128Unreachable;
6431   }
6432
6433   return id;
6434 }
6435
6436
6437 void HOptimizedGraphBuilder::BuildStore(Expression* expr,
6438                                         Property* prop,
6439                                         BailoutId ast_id,
6440                                         BailoutId return_id,
6441                                         bool is_uninitialized) {
6442   if (!prop->key()->IsPropertyName()) {
6443     // Keyed store.
6444     HValue* value = environment()->ExpressionStackAt(0);
6445     HValue* key = environment()->ExpressionStackAt(1);
6446     HValue* object = environment()->ExpressionStackAt(2);
6447     bool has_side_effects = false;
6448     HandleKeyedElementAccess(object, key, value, expr,
6449                              STORE, &has_side_effects);
6450     Drop(3);
6451     Push(value);
6452     Add<HSimulate>(return_id, REMOVABLE_SIMULATE);
6453     return ast_context()->ReturnValue(Pop());
6454   }
6455
6456   // Named store.
6457   HValue* value = Pop();
6458   HValue* object = Pop();
6459
6460   Literal* key = prop->key()->AsLiteral();
6461   Handle<String> name = Handle<String>::cast(key->value());
6462   ASSERT(!name.is_null());
6463
6464   HInstruction* instr = BuildNamedAccess(STORE, ast_id, return_id, expr,
6465                                          object, name, value, is_uninitialized);
6466   if (instr == NULL) return;
6467
6468   if (!ast_context()->IsEffect()) Push(value);
6469   AddInstruction(instr);
6470   if (instr->HasObservableSideEffects()) {
6471     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6472   }
6473   if (!ast_context()->IsEffect()) Drop(1);
6474   return ast_context()->ReturnValue(value);
6475 }
6476
6477
6478 void HOptimizedGraphBuilder::HandlePropertyAssignment(Assignment* expr) {
6479   Property* prop = expr->target()->AsProperty();
6480   ASSERT(prop != NULL);
6481   CHECK_ALIVE(VisitForValue(prop->obj()));
6482   if (!prop->key()->IsPropertyName()) {
6483     CHECK_ALIVE(VisitForValue(prop->key()));
6484   }
6485   CHECK_ALIVE(VisitForValue(expr->value()));
6486   BuildStore(expr, prop, expr->id(),
6487              expr->AssignmentId(), expr->IsUninitialized());
6488 }
6489
6490
6491 // Because not every expression has a position and there is not common
6492 // superclass of Assignment and CountOperation, we cannot just pass the
6493 // owning expression instead of position and ast_id separately.
6494 void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
6495     Variable* var,
6496     HValue* value,
6497     BailoutId ast_id) {
6498   LookupResult lookup(isolate());
6499   GlobalPropertyAccess type = LookupGlobalProperty(var, &lookup, STORE);
6500   if (type == kUseCell) {
6501     Handle<GlobalObject> global(current_info()->global_object());
6502     Handle<PropertyCell> cell(global->GetPropertyCell(&lookup));
6503     if (cell->type()->IsConstant()) {
6504       Handle<Object> constant = cell->type()->AsConstant()->Value();
6505       if (value->IsConstant()) {
6506         HConstant* c_value = HConstant::cast(value);
6507         if (!constant.is_identical_to(c_value->handle(isolate()))) {
6508           Add<HDeoptimize>("Constant global variable assignment",
6509                            Deoptimizer::EAGER);
6510         }
6511       } else {
6512         HValue* c_constant = Add<HConstant>(constant);
6513         IfBuilder builder(this);
6514         if (constant->IsNumber()) {
6515           builder.If<HCompareNumericAndBranch>(value, c_constant, Token::EQ);
6516         } else {
6517           builder.If<HCompareObjectEqAndBranch>(value, c_constant);
6518         }
6519         builder.Then();
6520         builder.Else();
6521         Add<HDeoptimize>("Constant global variable assignment",
6522                          Deoptimizer::EAGER);
6523         builder.End();
6524       }
6525     }
6526     HInstruction* instr =
6527         Add<HStoreGlobalCell>(value, cell, lookup.GetPropertyDetails());
6528     if (instr->HasObservableSideEffects()) {
6529       Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6530     }
6531   } else {
6532     HValue* global_object = Add<HLoadNamedField>(
6533         context(), static_cast<HValue*>(NULL),
6534         HObjectAccess::ForContextSlot(Context::GLOBAL_OBJECT_INDEX));
6535     HStoreNamedGeneric* instr =
6536         Add<HStoreNamedGeneric>(global_object, var->name(),
6537                                  value, function_strict_mode());
6538     USE(instr);
6539     ASSERT(instr->HasObservableSideEffects());
6540     Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
6541   }
6542 }
6543
6544
6545 void HOptimizedGraphBuilder::HandleCompoundAssignment(Assignment* expr) {
6546   Expression* target = expr->target();
6547   VariableProxy* proxy = target->AsVariableProxy();
6548   Property* prop = target->AsProperty();
6549   ASSERT(proxy == NULL || prop == NULL);
6550
6551   // We have a second position recorded in the FullCodeGenerator to have
6552   // type feedback for the binary operation.
6553   BinaryOperation* operation = expr->binary_operation();
6554
6555   if (proxy != NULL) {
6556     Variable* var = proxy->var();
6557     if (var->mode() == LET)  {
6558       return Bailout(kUnsupportedLetCompoundAssignment);
6559     }
6560
6561     CHECK_ALIVE(VisitForValue(operation));
6562
6563     switch (var->location()) {
6564       case Variable::UNALLOCATED:
6565         HandleGlobalVariableAssignment(var,
6566                                        Top(),
6567                                        expr->AssignmentId());
6568         break;
6569
6570       case Variable::PARAMETER:
6571       case Variable::LOCAL:
6572         if (var->mode() == CONST_LEGACY)  {
6573           return Bailout(kUnsupportedConstCompoundAssignment);
6574         }
6575         BindIfLive(var, Top());
6576         break;
6577
6578       case Variable::CONTEXT: {
6579         // Bail out if we try to mutate a parameter value in a function
6580         // using the arguments object.  We do not (yet) correctly handle the
6581         // arguments property of the function.
6582         if (current_info()->scope()->arguments() != NULL) {
6583           // Parameters will be allocated to context slots.  We have no
6584           // direct way to detect that the variable is a parameter so we do
6585           // a linear search of the parameter variables.
6586           int count = current_info()->scope()->num_parameters();
6587           for (int i = 0; i < count; ++i) {
6588             if (var == current_info()->scope()->parameter(i)) {
6589               Bailout(kAssignmentToParameterFunctionUsesArgumentsObject);
6590             }
6591           }
6592         }
6593
6594         HStoreContextSlot::Mode mode;
6595
6596         switch (var->mode()) {
6597           case LET:
6598             mode = HStoreContextSlot::kCheckDeoptimize;
6599             break;
6600           case CONST:
6601             // This case is checked statically so no need to
6602             // perform checks here
6603             UNREACHABLE();
6604           case CONST_LEGACY:
6605             return ast_context()->ReturnValue(Pop());
6606           default:
6607             mode = HStoreContextSlot::kNoCheck;
6608         }
6609
6610         HValue* context = BuildContextChainWalk(var);
6611         HStoreContextSlot* instr = Add<HStoreContextSlot>(
6612             context, var->index(), mode, Top());
6613         if (instr->HasObservableSideEffects()) {
6614           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
6615         }
6616         break;
6617       }
6618
6619       case Variable::LOOKUP:
6620         return Bailout(kCompoundAssignmentToLookupSlot);
6621     }
6622     return ast_context()->ReturnValue(Pop());
6623
6624   } else if (prop != NULL) {
6625     CHECK_ALIVE(VisitForValue(prop->obj()));
6626     HValue* object = Top();
6627     HValue* key = NULL;
6628     if ((!prop->IsFunctionPrototype() && !prop->key()->IsPropertyName()) ||
6629         prop->IsStringAccess()) {
6630       CHECK_ALIVE(VisitForValue(prop->key()));
6631       key = Top();
6632     }
6633
6634     CHECK_ALIVE(PushLoad(prop, object, key));
6635
6636     CHECK_ALIVE(VisitForValue(expr->value()));
6637     HValue* right = Pop();
6638     HValue* left = Pop();
6639
6640     Push(BuildBinaryOperation(operation, left, right, PUSH_BEFORE_SIMULATE));
6641
6642     BuildStore(expr, prop, expr->id(),
6643                expr->AssignmentId(), expr->IsUninitialized());
6644   } else {
6645     return Bailout(kInvalidLhsInCompoundAssignment);
6646   }
6647 }
6648
6649
6650 void HOptimizedGraphBuilder::VisitAssignment(Assignment* expr) {
6651   ASSERT(!HasStackOverflow());
6652   ASSERT(current_block() != NULL);
6653   ASSERT(current_block()->HasPredecessor());
6654   VariableProxy* proxy = expr->target()->AsVariableProxy();
6655   Property* prop = expr->target()->AsProperty();
6656   ASSERT(proxy == NULL || prop == NULL);
6657
6658   if (expr->is_compound()) {
6659     HandleCompoundAssignment(expr);
6660     return;
6661   }
6662
6663   if (prop != NULL) {
6664     HandlePropertyAssignment(expr);
6665   } else if (proxy != NULL) {
6666     Variable* var = proxy->var();
6667
6668     if (var->mode() == CONST) {
6669       if (expr->op() != Token::INIT_CONST) {
6670         return Bailout(kNonInitializerAssignmentToConst);
6671       }
6672     } else if (var->mode() == CONST_LEGACY) {
6673       if (expr->op() != Token::INIT_CONST_LEGACY) {
6674         CHECK_ALIVE(VisitForValue(expr->value()));
6675         return ast_context()->ReturnValue(Pop());
6676       }
6677
6678       if (var->IsStackAllocated()) {
6679         // We insert a use of the old value to detect unsupported uses of const
6680         // variables (e.g. initialization inside a loop).
6681         HValue* old_value = environment()->Lookup(var);
6682         Add<HUseConst>(old_value);
6683       }
6684     }
6685
6686     if (proxy->IsArguments()) return Bailout(kAssignmentToArguments);
6687
6688     // Handle the assignment.
6689     switch (var->location()) {
6690       case Variable::UNALLOCATED:
6691         CHECK_ALIVE(VisitForValue(expr->value()));
6692         HandleGlobalVariableAssignment(var,
6693                                        Top(),
6694                                        expr->AssignmentId());
6695         return ast_context()->ReturnValue(Pop());
6696
6697       case Variable::PARAMETER:
6698       case Variable::LOCAL: {
6699         // Perform an initialization check for let declared variables
6700         // or parameters.
6701         if (var->mode() == LET && expr->op() == Token::ASSIGN) {
6702           HValue* env_value = environment()->Lookup(var);
6703           if (env_value == graph()->GetConstantHole()) {
6704             return Bailout(kAssignmentToLetVariableBeforeInitialization);
6705           }
6706         }
6707         // We do not allow the arguments object to occur in a context where it
6708         // may escape, but assignments to stack-allocated locals are
6709         // permitted.
6710         CHECK_ALIVE(VisitForValue(expr->value(), ARGUMENTS_ALLOWED));
6711         HValue* value = Pop();
6712         BindIfLive(var, value);
6713         return ast_context()->ReturnValue(value);
6714       }
6715
6716       case Variable::CONTEXT: {
6717         // Bail out if we try to mutate a parameter value in a function using
6718         // the arguments object.  We do not (yet) correctly handle the
6719         // arguments property of the function.
6720         if (current_info()->scope()->arguments() != NULL) {
6721           // Parameters will rewrite to context slots.  We have no direct way
6722           // to detect that the variable is a parameter.
6723           int count = current_info()->scope()->num_parameters();
6724           for (int i = 0; i < count; ++i) {
6725             if (var == current_info()->scope()->parameter(i)) {
6726               return Bailout(kAssignmentToParameterInArgumentsObject);
6727             }
6728           }
6729         }
6730
6731         CHECK_ALIVE(VisitForValue(expr->value()));
6732         HStoreContextSlot::Mode mode;
6733         if (expr->op() == Token::ASSIGN) {
6734           switch (var->mode()) {
6735             case LET:
6736               mode = HStoreContextSlot::kCheckDeoptimize;
6737               break;
6738             case CONST:
6739               // This case is checked statically so no need to
6740               // perform checks here
6741               UNREACHABLE();
6742             case CONST_LEGACY:
6743               return ast_context()->ReturnValue(Pop());
6744             default:
6745               mode = HStoreContextSlot::kNoCheck;
6746           }
6747         } else if (expr->op() == Token::INIT_VAR ||
6748                    expr->op() == Token::INIT_LET ||
6749                    expr->op() == Token::INIT_CONST) {
6750           mode = HStoreContextSlot::kNoCheck;
6751         } else {
6752           ASSERT(expr->op() == Token::INIT_CONST_LEGACY);
6753
6754           mode = HStoreContextSlot::kCheckIgnoreAssignment;
6755         }
6756
6757         HValue* context = BuildContextChainWalk(var);
6758         HStoreContextSlot* instr = Add<HStoreContextSlot>(
6759             context, var->index(), mode, Top());
6760         if (instr->HasObservableSideEffects()) {
6761           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
6762         }
6763         return ast_context()->ReturnValue(Pop());
6764       }
6765
6766       case Variable::LOOKUP:
6767         return Bailout(kAssignmentToLOOKUPVariable);
6768     }
6769   } else {
6770     return Bailout(kInvalidLeftHandSideInAssignment);
6771   }
6772 }
6773
6774
6775 void HOptimizedGraphBuilder::VisitYield(Yield* expr) {
6776   // Generators are not optimized, so we should never get here.
6777   UNREACHABLE();
6778 }
6779
6780
6781 void HOptimizedGraphBuilder::VisitThrow(Throw* expr) {
6782   ASSERT(!HasStackOverflow());
6783   ASSERT(current_block() != NULL);
6784   ASSERT(current_block()->HasPredecessor());
6785   // We don't optimize functions with invalid left-hand sides in
6786   // assignments, count operations, or for-in.  Consequently throw can
6787   // currently only occur in an effect context.
6788   ASSERT(ast_context()->IsEffect());
6789   CHECK_ALIVE(VisitForValue(expr->exception()));
6790
6791   HValue* value = environment()->Pop();
6792   if (!FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
6793   Add<HPushArguments>(value);
6794   Add<HCallRuntime>(isolate()->factory()->empty_string(),
6795                     Runtime::FunctionForId(Runtime::kHiddenThrow), 1);
6796   Add<HSimulate>(expr->id());
6797
6798   // If the throw definitely exits the function, we can finish with a dummy
6799   // control flow at this point.  This is not the case if the throw is inside
6800   // an inlined function which may be replaced.
6801   if (call_context() == NULL) {
6802     FinishExitCurrentBlock(New<HAbnormalExit>());
6803   }
6804 }
6805
6806
6807 HInstruction* HGraphBuilder::AddLoadStringInstanceType(HValue* string) {
6808   if (string->IsConstant()) {
6809     HConstant* c_string = HConstant::cast(string);
6810     if (c_string->HasStringValue()) {
6811       return Add<HConstant>(c_string->StringValue()->map()->instance_type());
6812     }
6813   }
6814   return Add<HLoadNamedField>(
6815       Add<HLoadNamedField>(string, static_cast<HValue*>(NULL),
6816                            HObjectAccess::ForMap()),
6817       static_cast<HValue*>(NULL), HObjectAccess::ForMapInstanceType());
6818 }
6819
6820
6821 HInstruction* HGraphBuilder::AddLoadStringLength(HValue* string) {
6822   if (string->IsConstant()) {
6823     HConstant* c_string = HConstant::cast(string);
6824     if (c_string->HasStringValue()) {
6825       return Add<HConstant>(c_string->StringValue()->length());
6826     }
6827   }
6828   return Add<HLoadNamedField>(string, static_cast<HValue*>(NULL),
6829                               HObjectAccess::ForStringLength());
6830 }
6831
6832
6833 HInstruction* HOptimizedGraphBuilder::BuildNamedGeneric(
6834     PropertyAccessType access_type,
6835     HValue* object,
6836     Handle<String> name,
6837     HValue* value,
6838     bool is_uninitialized) {
6839   if (is_uninitialized) {
6840     Add<HDeoptimize>("Insufficient type feedback for generic named access",
6841                      Deoptimizer::SOFT);
6842   }
6843   if (access_type == LOAD) {
6844     return New<HLoadNamedGeneric>(object, name);
6845   } else {
6846     return New<HStoreNamedGeneric>(object, name, value, function_strict_mode());
6847   }
6848 }
6849
6850
6851
6852 HInstruction* HOptimizedGraphBuilder::BuildKeyedGeneric(
6853     PropertyAccessType access_type,
6854     HValue* object,
6855     HValue* key,
6856     HValue* value) {
6857   if (access_type == LOAD) {
6858     return New<HLoadKeyedGeneric>(object, key);
6859   } else {
6860     return New<HStoreKeyedGeneric>(object, key, value, function_strict_mode());
6861   }
6862 }
6863
6864
6865 LoadKeyedHoleMode HOptimizedGraphBuilder::BuildKeyedHoleMode(Handle<Map> map) {
6866   // Loads from a "stock" fast holey double arrays can elide the hole check.
6867   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
6868   if (*map == isolate()->get_initial_js_array_map(FAST_HOLEY_DOUBLE_ELEMENTS) &&
6869       isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
6870     Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
6871     Handle<JSObject> object_prototype = isolate()->initial_object_prototype();
6872     BuildCheckPrototypeMaps(prototype, object_prototype);
6873     load_mode = ALLOW_RETURN_HOLE;
6874     graph()->MarkDependsOnEmptyArrayProtoElements();
6875   }
6876
6877   return load_mode;
6878 }
6879
6880
6881 HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess(
6882     HValue* object,
6883     HValue* key,
6884     HValue* val,
6885     HValue* dependency,
6886     Handle<Map> map,
6887     PropertyAccessType access_type,
6888     KeyedAccessStoreMode store_mode) {
6889   HCheckMaps* checked_object = Add<HCheckMaps>(object, map, dependency);
6890   if (dependency) {
6891     checked_object->ClearDependsOnFlag(kElementsKind);
6892   }
6893
6894   if (access_type == STORE && map->prototype()->IsJSObject()) {
6895     // monomorphic stores need a prototype chain check because shape
6896     // changes could allow callbacks on elements in the chain that
6897     // aren't compatible with monomorphic keyed stores.
6898     Handle<JSObject> prototype(JSObject::cast(map->prototype()));
6899     JSObject* holder = JSObject::cast(map->prototype());
6900     while (!holder->GetPrototype()->IsNull()) {
6901       holder = JSObject::cast(holder->GetPrototype());
6902     }
6903
6904     BuildCheckPrototypeMaps(prototype,
6905                             Handle<JSObject>(JSObject::cast(holder)));
6906   }
6907
6908   LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
6909   return BuildUncheckedMonomorphicElementAccess(
6910       checked_object, key, val,
6911       map->instance_type() == JS_ARRAY_TYPE,
6912       map->elements_kind(), access_type,
6913       load_mode, store_mode);
6914 }
6915
6916
6917 HInstruction* HOptimizedGraphBuilder::TryBuildConsolidatedElementLoad(
6918     HValue* object,
6919     HValue* key,
6920     HValue* val,
6921     SmallMapList* maps) {
6922   // For polymorphic loads of similar elements kinds (i.e. all tagged or all
6923   // double), always use the "worst case" code without a transition.  This is
6924   // much faster than transitioning the elements to the worst case, trading a
6925   // HTransitionElements for a HCheckMaps, and avoiding mutation of the array.
6926   bool has_double_maps = false;
6927   bool has_smi_or_object_maps = false;
6928   bool has_js_array_access = false;
6929   bool has_non_js_array_access = false;
6930   bool has_seen_holey_elements = false;
6931   Handle<Map> most_general_consolidated_map;
6932   for (int i = 0; i < maps->length(); ++i) {
6933     Handle<Map> map = maps->at(i);
6934     if (!map->IsJSObjectMap()) return NULL;
6935     // Don't allow mixing of JSArrays with JSObjects.
6936     if (map->instance_type() == JS_ARRAY_TYPE) {
6937       if (has_non_js_array_access) return NULL;
6938       has_js_array_access = true;
6939     } else if (has_js_array_access) {
6940       return NULL;
6941     } else {
6942       has_non_js_array_access = true;
6943     }
6944     // Don't allow mixed, incompatible elements kinds.
6945     if (map->has_fast_double_elements()) {
6946       if (has_smi_or_object_maps) return NULL;
6947       has_double_maps = true;
6948     } else if (map->has_fast_smi_or_object_elements()) {
6949       if (has_double_maps) return NULL;
6950       has_smi_or_object_maps = true;
6951     } else {
6952       return NULL;
6953     }
6954     // Remember if we've ever seen holey elements.
6955     if (IsHoleyElementsKind(map->elements_kind())) {
6956       has_seen_holey_elements = true;
6957     }
6958     // Remember the most general elements kind, the code for its load will
6959     // properly handle all of the more specific cases.
6960     if ((i == 0) || IsMoreGeneralElementsKindTransition(
6961             most_general_consolidated_map->elements_kind(),
6962             map->elements_kind())) {
6963       most_general_consolidated_map = map;
6964     }
6965   }
6966   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
6967
6968   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
6969   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
6970   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
6971   ElementsKind consolidated_elements_kind = has_seen_holey_elements
6972       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
6973       : most_general_consolidated_map->elements_kind();
6974   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
6975       checked_object, key, val,
6976       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
6977       consolidated_elements_kind,
6978       LOAD, NEVER_RETURN_HOLE, STANDARD_STORE);
6979   return instr;
6980 }
6981
6982
6983 HValue* HOptimizedGraphBuilder::HandlePolymorphicElementAccess(
6984     HValue* object,
6985     HValue* key,
6986     HValue* val,
6987     SmallMapList* maps,
6988     PropertyAccessType access_type,
6989     KeyedAccessStoreMode store_mode,
6990     bool* has_side_effects) {
6991   *has_side_effects = false;
6992   BuildCheckHeapObject(object);
6993
6994   if (access_type == LOAD) {
6995     HInstruction* consolidated_load =
6996         TryBuildConsolidatedElementLoad(object, key, val, maps);
6997     if (consolidated_load != NULL) {
6998       *has_side_effects |= consolidated_load->HasObservableSideEffects();
6999       return consolidated_load;
7000     }
7001   }
7002
7003   // Elements_kind transition support.
7004   MapHandleList transition_target(maps->length());
7005   // Collect possible transition targets.
7006   MapHandleList possible_transitioned_maps(maps->length());
7007   for (int i = 0; i < maps->length(); ++i) {
7008     Handle<Map> map = maps->at(i);
7009     ElementsKind elements_kind = map->elements_kind();
7010     if (IsFastElementsKind(elements_kind) &&
7011         elements_kind != GetInitialFastElementsKind()) {
7012       possible_transitioned_maps.Add(map);
7013     }
7014     if (elements_kind == SLOPPY_ARGUMENTS_ELEMENTS) {
7015       HInstruction* result = BuildKeyedGeneric(access_type, object, key, val);
7016       *has_side_effects = result->HasObservableSideEffects();
7017       return AddInstruction(result);
7018     }
7019   }
7020   // Get transition target for each map (NULL == no transition).
7021   for (int i = 0; i < maps->length(); ++i) {
7022     Handle<Map> map = maps->at(i);
7023     Handle<Map> transitioned_map =
7024         map->FindTransitionedMap(&possible_transitioned_maps);
7025     transition_target.Add(transitioned_map);
7026   }
7027
7028   MapHandleList untransitionable_maps(maps->length());
7029   HTransitionElementsKind* transition = NULL;
7030   for (int i = 0; i < maps->length(); ++i) {
7031     Handle<Map> map = maps->at(i);
7032     ASSERT(map->IsMap());
7033     if (!transition_target.at(i).is_null()) {
7034       ASSERT(Map::IsValidElementsTransition(
7035           map->elements_kind(),
7036           transition_target.at(i)->elements_kind()));
7037       transition = Add<HTransitionElementsKind>(object, map,
7038                                                 transition_target.at(i));
7039     } else {
7040       untransitionable_maps.Add(map);
7041     }
7042   }
7043
7044   // If only one map is left after transitioning, handle this case
7045   // monomorphically.
7046   ASSERT(untransitionable_maps.length() >= 1);
7047   if (untransitionable_maps.length() == 1) {
7048     Handle<Map> untransitionable_map = untransitionable_maps[0];
7049     HInstruction* instr = NULL;
7050     if (untransitionable_map->has_slow_elements_kind() ||
7051         !untransitionable_map->IsJSObjectMap()) {
7052       instr = AddInstruction(BuildKeyedGeneric(access_type, object, key, val));
7053     } else {
7054       instr = BuildMonomorphicElementAccess(
7055           object, key, val, transition, untransitionable_map, access_type,
7056           store_mode);
7057     }
7058     *has_side_effects |= instr->HasObservableSideEffects();
7059     return access_type == STORE ? NULL : instr;
7060   }
7061
7062   HBasicBlock* join = graph()->CreateBasicBlock();
7063
7064   for (int i = 0; i < untransitionable_maps.length(); ++i) {
7065     Handle<Map> map = untransitionable_maps[i];
7066     if (!map->IsJSObjectMap()) continue;
7067     ElementsKind elements_kind = map->elements_kind();
7068     HBasicBlock* this_map = graph()->CreateBasicBlock();
7069     HBasicBlock* other_map = graph()->CreateBasicBlock();
7070     HCompareMap* mapcompare =
7071         New<HCompareMap>(object, map, this_map, other_map);
7072     FinishCurrentBlock(mapcompare);
7073
7074     set_current_block(this_map);
7075     HInstruction* access = NULL;
7076     if (IsDictionaryElementsKind(elements_kind)) {
7077       access = AddInstruction(BuildKeyedGeneric(access_type, object, key, val));
7078     } else {
7079       ASSERT(IsFastElementsKind(elements_kind) ||
7080              IsExternalArrayElementsKind(elements_kind) ||
7081              IsFixedTypedArrayElementsKind(elements_kind));
7082       LoadKeyedHoleMode load_mode = BuildKeyedHoleMode(map);
7083       // Happily, mapcompare is a checked object.
7084       access = BuildUncheckedMonomorphicElementAccess(
7085           mapcompare, key, val,
7086           map->instance_type() == JS_ARRAY_TYPE,
7087           elements_kind, access_type,
7088           load_mode,
7089           store_mode);
7090     }
7091     *has_side_effects |= access->HasObservableSideEffects();
7092     // The caller will use has_side_effects and add a correct Simulate.
7093     access->SetFlag(HValue::kHasNoObservableSideEffects);
7094     if (access_type == LOAD) {
7095       Push(access);
7096     }
7097     NoObservableSideEffectsScope scope(this);
7098     GotoNoSimulate(join);
7099     set_current_block(other_map);
7100   }
7101
7102   // Ensure that we visited at least one map above that goes to join. This is
7103   // necessary because FinishExitWithHardDeoptimization does an AbnormalExit
7104   // rather than joining the join block. If this becomes an issue, insert a
7105   // generic access in the case length() == 0.
7106   ASSERT(join->predecessors()->length() > 0);
7107   // Deopt if none of the cases matched.
7108   NoObservableSideEffectsScope scope(this);
7109   FinishExitWithHardDeoptimization("Unknown map in polymorphic element access");
7110   set_current_block(join);
7111   return access_type == STORE ? NULL : Pop();
7112 }
7113
7114
7115 HValue* HOptimizedGraphBuilder::HandleKeyedElementAccess(
7116     HValue* obj,
7117     HValue* key,
7118     HValue* val,
7119     Expression* expr,
7120     PropertyAccessType access_type,
7121     bool* has_side_effects) {
7122   ASSERT(!expr->IsPropertyName());
7123   HInstruction* instr = NULL;
7124
7125   SmallMapList* types;
7126   bool monomorphic = ComputeReceiverTypes(expr, obj, &types, zone());
7127
7128   bool force_generic = false;
7129   if (access_type == STORE &&
7130       (monomorphic || (types != NULL && !types->is_empty()))) {
7131     // Stores can't be mono/polymorphic if their prototype chain has dictionary
7132     // elements. However a receiver map that has dictionary elements itself
7133     // should be left to normal mono/poly behavior (the other maps may benefit
7134     // from highly optimized stores).
7135     for (int i = 0; i < types->length(); i++) {
7136       Handle<Map> current_map = types->at(i);
7137       if (current_map->DictionaryElementsInPrototypeChainOnly()) {
7138         force_generic = true;
7139         monomorphic = false;
7140         break;
7141       }
7142     }
7143   }
7144
7145   if (monomorphic) {
7146     Handle<Map> map = types->first();
7147     if (map->has_slow_elements_kind() || !map->IsJSObjectMap()) {
7148       instr = AddInstruction(BuildKeyedGeneric(access_type, obj, key, val));
7149     } else {
7150       BuildCheckHeapObject(obj);
7151       instr = BuildMonomorphicElementAccess(
7152           obj, key, val, NULL, map, access_type, expr->GetStoreMode());
7153     }
7154   } else if (!force_generic && (types != NULL && !types->is_empty())) {
7155     return HandlePolymorphicElementAccess(
7156         obj, key, val, types, access_type,
7157         expr->GetStoreMode(), has_side_effects);
7158   } else {
7159     if (access_type == STORE) {
7160       if (expr->IsAssignment() &&
7161           expr->AsAssignment()->HasNoTypeInformation()) {
7162         Add<HDeoptimize>("Insufficient type feedback for keyed store",
7163                          Deoptimizer::SOFT);
7164       }
7165     } else {
7166       if (expr->AsProperty()->HasNoTypeInformation()) {
7167         Add<HDeoptimize>("Insufficient type feedback for keyed load",
7168                          Deoptimizer::SOFT);
7169       }
7170     }
7171     instr = AddInstruction(BuildKeyedGeneric(access_type, obj, key, val));
7172   }
7173   *has_side_effects = instr->HasObservableSideEffects();
7174   return instr;
7175 }
7176
7177
7178 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
7179   // Outermost function already has arguments on the stack.
7180   if (function_state()->outer() == NULL) return;
7181
7182   if (function_state()->arguments_pushed()) return;
7183
7184   // Push arguments when entering inlined function.
7185   HEnterInlined* entry = function_state()->entry();
7186   entry->set_arguments_pushed();
7187
7188   HArgumentsObject* arguments = entry->arguments_object();
7189   const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
7190
7191   HInstruction* insert_after = entry;
7192   for (int i = 0; i < arguments_values->length(); i++) {
7193     HValue* argument = arguments_values->at(i);
7194     HInstruction* push_argument = New<HPushArguments>(argument);
7195     push_argument->InsertAfter(insert_after);
7196     insert_after = push_argument;
7197   }
7198
7199   HArgumentsElements* arguments_elements = New<HArgumentsElements>(true);
7200   arguments_elements->ClearFlag(HValue::kUseGVN);
7201   arguments_elements->InsertAfter(insert_after);
7202   function_state()->set_arguments_elements(arguments_elements);
7203 }
7204
7205
7206 bool HOptimizedGraphBuilder::TryArgumentsAccess(Property* expr) {
7207   VariableProxy* proxy = expr->obj()->AsVariableProxy();
7208   if (proxy == NULL) return false;
7209   if (!proxy->var()->IsStackAllocated()) return false;
7210   if (!environment()->Lookup(proxy->var())->CheckFlag(HValue::kIsArguments)) {
7211     return false;
7212   }
7213
7214   HInstruction* result = NULL;
7215   if (expr->key()->IsPropertyName()) {
7216     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7217     if (!name->IsOneByteEqualTo(STATIC_ASCII_VECTOR("length"))) return false;
7218
7219     if (function_state()->outer() == NULL) {
7220       HInstruction* elements = Add<HArgumentsElements>(false);
7221       result = New<HArgumentsLength>(elements);
7222     } else {
7223       // Number of arguments without receiver.
7224       int argument_count = environment()->
7225           arguments_environment()->parameter_count() - 1;
7226       result = New<HConstant>(argument_count);
7227     }
7228   } else {
7229     Push(graph()->GetArgumentsObject());
7230     CHECK_ALIVE_OR_RETURN(VisitForValue(expr->key()), true);
7231     HValue* key = Pop();
7232     Drop(1);  // Arguments object.
7233     if (function_state()->outer() == NULL) {
7234       HInstruction* elements = Add<HArgumentsElements>(false);
7235       HInstruction* length = Add<HArgumentsLength>(elements);
7236       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7237       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7238     } else {
7239       EnsureArgumentsArePushedForAccess();
7240
7241       // Number of arguments without receiver.
7242       HInstruction* elements = function_state()->arguments_elements();
7243       int argument_count = environment()->
7244           arguments_environment()->parameter_count() - 1;
7245       HInstruction* length = Add<HConstant>(argument_count);
7246       HInstruction* checked_key = Add<HBoundsCheck>(key, length);
7247       result = New<HAccessArgumentsAt>(elements, length, checked_key);
7248     }
7249   }
7250   ast_context()->ReturnInstruction(result, expr->id());
7251   return true;
7252 }
7253
7254
7255 HInstruction* HOptimizedGraphBuilder::BuildNamedAccess(
7256     PropertyAccessType access,
7257     BailoutId ast_id,
7258     BailoutId return_id,
7259     Expression* expr,
7260     HValue* object,
7261     Handle<String> name,
7262     HValue* value,
7263     bool is_uninitialized) {
7264   SmallMapList* types;
7265   ComputeReceiverTypes(expr, object, &types, zone());
7266   ASSERT(types != NULL);
7267
7268   if (types->length() > 0) {
7269     PropertyAccessInfo info(
7270         this, access, ToType(types->first()), name,
7271         types->first()->instance_type());
7272     if (!info.CanAccessAsMonomorphic(types)) {
7273       HandlePolymorphicNamedFieldAccess(
7274           access, ast_id, return_id, object, value, types, name);
7275       return NULL;
7276     }
7277
7278     HValue* checked_object;
7279     // Type::Number() is only supported by polymorphic load/call handling.
7280     ASSERT(!info.type()->Is(Type::Number()));
7281     BuildCheckHeapObject(object);
7282
7283     if (AreStringTypes(types)) {
7284       checked_object =
7285           Add<HCheckInstanceType>(object, HCheckInstanceType::IS_STRING);
7286     } else if (info.IsSIMD128PropertyCallback() &&
7287                AreFloat32x4Types(types) &&
7288                CpuFeatures::SupportsSIMD128InCrankshaft()) {
7289       Handle<JSFunction> function(
7290           isolate()->native_context()->float32x4_function());
7291       HInstruction* constant_function = Add<HConstant>(function);
7292       HObjectAccess map_access = HObjectAccess::ForPrototypeOrInitialMap();
7293       HInstruction* map = Add<HLoadNamedField>(
7294           constant_function, static_cast<HValue*>(NULL), map_access);
7295       HObjectAccess prototype_access = HObjectAccess::ForMapPrototype();
7296       HInstruction* prototype = Add<HLoadNamedField>(
7297           map, static_cast<HValue*>(NULL), prototype_access);
7298       Handle<Map> initial_function_prototype_map(
7299           isolate()->native_context()->float32x4_function_prototype_map());
7300       Add<HCheckMaps>(prototype, initial_function_prototype_map);
7301       BuiltinFunctionId id = NameToId(isolate(), name, FLOAT32x4_TYPE);
7302       return NewUncasted<HUnarySIMDOperation>(object, id);
7303     } else if (info.IsSIMD128PropertyCallback() &&
7304                AreFloat64x2Types(types) &&
7305                CpuFeatures::SupportsSIMD128InCrankshaft()) {
7306       Handle<JSFunction> function(
7307           isolate()->native_context()->float64x2_function());
7308       HInstruction* constant_function = Add<HConstant>(function);
7309       HObjectAccess map_access = HObjectAccess::ForPrototypeOrInitialMap();
7310       HInstruction* map = Add<HLoadNamedField>(
7311           constant_function, static_cast<HValue*>(NULL), map_access);
7312       HObjectAccess prototype_access = HObjectAccess::ForMapPrototype();
7313       HInstruction* prototype = Add<HLoadNamedField>(
7314           map, static_cast<HValue*>(NULL), prototype_access);
7315       Handle<Map> initial_function_prototype_map(
7316           isolate()->native_context()->float64x2_function_prototype_map());
7317       Add<HCheckMaps>(prototype, initial_function_prototype_map);
7318       BuiltinFunctionId id = NameToId(isolate(), name, FLOAT64x2_TYPE);
7319       return NewUncasted<HUnarySIMDOperation>(object, id);
7320     } else if (info.IsSIMD128PropertyCallback() &&
7321                AreInt32x4Types(types) &&
7322                CpuFeatures::SupportsSIMD128InCrankshaft()) {
7323       Handle<JSFunction> function(
7324           isolate()->native_context()->int32x4_function());
7325       HInstruction* constant_function = Add<HConstant>(function);
7326       HObjectAccess map_access = HObjectAccess::ForPrototypeOrInitialMap();
7327       HInstruction* map = Add<HLoadNamedField>(
7328           constant_function, static_cast<HValue*>(NULL), map_access);
7329       HObjectAccess prototype_access = HObjectAccess::ForMapPrototype();
7330       HInstruction* prototype = Add<HLoadNamedField>(
7331           map, static_cast<HValue*>(NULL), prototype_access);
7332       Handle<Map> initial_function_prototype_map(
7333           isolate()->native_context()->int32x4_function_prototype_map());
7334       Add<HCheckMaps>(prototype, initial_function_prototype_map);
7335       BuiltinFunctionId id = NameToId(isolate(), name, INT32x4_TYPE);
7336       return NewUncasted<HUnarySIMDOperation>(object, id);
7337     } else {
7338       checked_object = Add<HCheckMaps>(object, types);
7339     }
7340     return BuildMonomorphicAccess(
7341         &info, object, checked_object, value, ast_id, return_id);
7342   }
7343
7344   return BuildNamedGeneric(access, object, name, value, is_uninitialized);
7345 }
7346
7347
7348 void HOptimizedGraphBuilder::PushLoad(Property* expr,
7349                                       HValue* object,
7350                                       HValue* key) {
7351   ValueContext for_value(this, ARGUMENTS_NOT_ALLOWED);
7352   Push(object);
7353   if (key != NULL) Push(key);
7354   BuildLoad(expr, expr->LoadId());
7355 }
7356
7357
7358 void HOptimizedGraphBuilder::BuildLoad(Property* expr,
7359                                        BailoutId ast_id) {
7360   HInstruction* instr = NULL;
7361   if (expr->IsStringAccess()) {
7362     HValue* index = Pop();
7363     HValue* string = Pop();
7364     HInstruction* char_code = BuildStringCharCodeAt(string, index);
7365     AddInstruction(char_code);
7366     instr = NewUncasted<HStringCharFromCode>(char_code);
7367
7368   } else if (expr->IsFunctionPrototype()) {
7369     HValue* function = Pop();
7370     BuildCheckHeapObject(function);
7371     instr = New<HLoadFunctionPrototype>(function);
7372
7373   } else if (expr->key()->IsPropertyName()) {
7374     Handle<String> name = expr->key()->AsLiteral()->AsPropertyName();
7375     HValue* object = Pop();
7376
7377     instr = BuildNamedAccess(LOAD, ast_id, expr->LoadId(), expr,
7378                              object, name, NULL, expr->IsUninitialized());
7379     if (instr == NULL) return;
7380     if (instr->IsLinked()) return ast_context()->ReturnValue(instr);
7381
7382   } else {
7383     HValue* key = Pop();
7384     HValue* obj = Pop();
7385
7386     bool has_side_effects = false;
7387     HValue* load = HandleKeyedElementAccess(
7388         obj, key, NULL, expr, LOAD, &has_side_effects);
7389     if (has_side_effects) {
7390       if (ast_context()->IsEffect()) {
7391         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7392       } else {
7393         Push(load);
7394         Add<HSimulate>(ast_id, REMOVABLE_SIMULATE);
7395         Drop(1);
7396       }
7397     }
7398     return ast_context()->ReturnValue(load);
7399   }
7400   return ast_context()->ReturnInstruction(instr, ast_id);
7401 }
7402
7403
7404 void HOptimizedGraphBuilder::VisitProperty(Property* expr) {
7405   ASSERT(!HasStackOverflow());
7406   ASSERT(current_block() != NULL);
7407   ASSERT(current_block()->HasPredecessor());
7408
7409   if (TryArgumentsAccess(expr)) return;
7410
7411   CHECK_ALIVE(VisitForValue(expr->obj()));
7412   if ((!expr->IsFunctionPrototype() && !expr->key()->IsPropertyName()) ||
7413       expr->IsStringAccess()) {
7414     CHECK_ALIVE(VisitForValue(expr->key()));
7415   }
7416
7417   BuildLoad(expr, expr->id());
7418 }
7419
7420
7421 HInstruction* HGraphBuilder::BuildConstantMapCheck(Handle<JSObject> constant) {
7422   HCheckMaps* check = Add<HCheckMaps>(
7423       Add<HConstant>(constant), handle(constant->map()));
7424   check->ClearDependsOnFlag(kElementsKind);
7425   return check;
7426 }
7427
7428
7429 HInstruction* HGraphBuilder::BuildCheckPrototypeMaps(Handle<JSObject> prototype,
7430                                                      Handle<JSObject> holder) {
7431   while (holder.is_null() || !prototype.is_identical_to(holder)) {
7432     BuildConstantMapCheck(prototype);
7433     Object* next_prototype = prototype->GetPrototype();
7434     if (next_prototype->IsNull()) return NULL;
7435     CHECK(next_prototype->IsJSObject());
7436     prototype = handle(JSObject::cast(next_prototype));
7437   }
7438   return BuildConstantMapCheck(prototype);
7439 }
7440
7441
7442 void HOptimizedGraphBuilder::AddCheckPrototypeMaps(Handle<JSObject> holder,
7443                                                    Handle<Map> receiver_map) {
7444   if (!holder.is_null()) {
7445     Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
7446     BuildCheckPrototypeMaps(prototype, holder);
7447   }
7448 }
7449
7450
7451 HInstruction* HOptimizedGraphBuilder::NewPlainFunctionCall(
7452     HValue* fun, int argument_count, bool pass_argument_count) {
7453   return New<HCallJSFunction>(
7454       fun, argument_count, pass_argument_count);
7455 }
7456
7457
7458 HInstruction* HOptimizedGraphBuilder::NewArgumentAdaptorCall(
7459     HValue* fun, HValue* context,
7460     int argument_count, HValue* expected_param_count) {
7461   CallInterfaceDescriptor* descriptor =
7462       isolate()->call_descriptor(Isolate::ArgumentAdaptorCall);
7463
7464   HValue* arity = Add<HConstant>(argument_count - 1);
7465
7466   HValue* op_vals[] = { fun, context, arity, expected_param_count };
7467
7468   Handle<Code> adaptor =
7469       isolate()->builtins()->ArgumentsAdaptorTrampoline();
7470   HConstant* adaptor_value = Add<HConstant>(adaptor);
7471
7472   return New<HCallWithDescriptor>(
7473       adaptor_value, argument_count, descriptor,
7474       Vector<HValue*>(op_vals, descriptor->environment_length()));
7475 }
7476
7477
7478 HInstruction* HOptimizedGraphBuilder::BuildCallConstantFunction(
7479     Handle<JSFunction> jsfun, int argument_count) {
7480   HValue* target = Add<HConstant>(jsfun);
7481   // For constant functions, we try to avoid calling the
7482   // argument adaptor and instead call the function directly
7483   int formal_parameter_count = jsfun->shared()->formal_parameter_count();
7484   bool dont_adapt_arguments =
7485       (formal_parameter_count ==
7486        SharedFunctionInfo::kDontAdaptArgumentsSentinel);
7487   int arity = argument_count - 1;
7488   bool can_invoke_directly =
7489       dont_adapt_arguments || formal_parameter_count == arity;
7490   if (can_invoke_directly) {
7491     if (jsfun.is_identical_to(current_info()->closure())) {
7492       graph()->MarkRecursive();
7493     }
7494     return NewPlainFunctionCall(target, argument_count, dont_adapt_arguments);
7495   } else {
7496     HValue* param_count_value = Add<HConstant>(formal_parameter_count);
7497     HValue* context = Add<HLoadNamedField>(
7498         target, static_cast<HValue*>(NULL),
7499         HObjectAccess::ForFunctionContextPointer());
7500     return NewArgumentAdaptorCall(target, context,
7501         argument_count, param_count_value);
7502   }
7503   UNREACHABLE();
7504   return NULL;
7505 }
7506
7507
7508 class FunctionSorter {
7509  public:
7510   FunctionSorter(int index = 0, int ticks = 0, int size = 0)
7511       : index_(index), ticks_(ticks), size_(size) { }
7512
7513   int index() const { return index_; }
7514   int ticks() const { return ticks_; }
7515   int size() const { return size_; }
7516
7517  private:
7518   int index_;
7519   int ticks_;
7520   int size_;
7521 };
7522
7523
7524 inline bool operator<(const FunctionSorter& lhs, const FunctionSorter& rhs) {
7525   int diff = lhs.ticks() - rhs.ticks();
7526   if (diff != 0) return diff > 0;
7527   return lhs.size() < rhs.size();
7528 }
7529
7530
7531 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
7532     Call* expr,
7533     HValue* receiver,
7534     SmallMapList* types,
7535     Handle<String> name) {
7536   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
7537   FunctionSorter order[kMaxCallPolymorphism];
7538
7539   bool handle_smi = false;
7540   bool handled_string = false;
7541   int ordered_functions = 0;
7542
7543   for (int i = 0;
7544        i < types->length() && ordered_functions < kMaxCallPolymorphism;
7545        ++i) {
7546     PropertyAccessInfo info(
7547         this, LOAD, ToType(types->at(i)), name,
7548         types->at(i)->instance_type());
7549     if (info.CanAccessMonomorphic() &&
7550         info.lookup()->IsConstant() &&
7551         info.constant()->IsJSFunction()) {
7552       if (info.type()->Is(Type::String())) {
7553         if (handled_string) continue;
7554         handled_string = true;
7555       }
7556       Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7557       if (info.type()->Is(Type::Number())) {
7558         handle_smi = true;
7559       }
7560       expr->set_target(target);
7561       order[ordered_functions++] = FunctionSorter(
7562           i, target->shared()->profiler_ticks(), InliningAstSize(target));
7563     }
7564   }
7565
7566   std::sort(order, order + ordered_functions);
7567
7568   HBasicBlock* number_block = NULL;
7569   HBasicBlock* join = NULL;
7570   handled_string = false;
7571   int count = 0;
7572
7573   for (int fn = 0; fn < ordered_functions; ++fn) {
7574     int i = order[fn].index();
7575     PropertyAccessInfo info(this, LOAD, ToType(types->at(i)), name,
7576                             types->at(i)->instance_type());
7577     if (info.type()->Is(Type::String())) {
7578       if (handled_string) continue;
7579       handled_string = true;
7580     }
7581     // Reloads the target.
7582     info.CanAccessMonomorphic();
7583     Handle<JSFunction> target = Handle<JSFunction>::cast(info.constant());
7584
7585     expr->set_target(target);
7586     if (count == 0) {
7587       // Only needed once.
7588       join = graph()->CreateBasicBlock();
7589       if (handle_smi) {
7590         HBasicBlock* empty_smi_block = graph()->CreateBasicBlock();
7591         HBasicBlock* not_smi_block = graph()->CreateBasicBlock();
7592         number_block = graph()->CreateBasicBlock();
7593         FinishCurrentBlock(New<HIsSmiAndBranch>(
7594                 receiver, empty_smi_block, not_smi_block));
7595         GotoNoSimulate(empty_smi_block, number_block);
7596         set_current_block(not_smi_block);
7597       } else {
7598         BuildCheckHeapObject(receiver);
7599       }
7600     }
7601     ++count;
7602     HBasicBlock* if_true = graph()->CreateBasicBlock();
7603     HBasicBlock* if_false = graph()->CreateBasicBlock();
7604     HUnaryControlInstruction* compare;
7605
7606     Handle<Map> map = info.map();
7607     if (info.type()->Is(Type::Number())) {
7608       Handle<Map> heap_number_map = isolate()->factory()->heap_number_map();
7609       compare = New<HCompareMap>(receiver, heap_number_map, if_true, if_false);
7610     } else if (info.type()->Is(Type::String())) {
7611       compare = New<HIsStringAndBranch>(receiver, if_true, if_false);
7612     } else {
7613       compare = New<HCompareMap>(receiver, map, if_true, if_false);
7614     }
7615     FinishCurrentBlock(compare);
7616
7617     if (info.type()->Is(Type::Number())) {
7618       GotoNoSimulate(if_true, number_block);
7619       if_true = number_block;
7620     }
7621
7622     set_current_block(if_true);
7623
7624     AddCheckPrototypeMaps(info.holder(), map);
7625
7626     HValue* function = Add<HConstant>(expr->target());
7627     environment()->SetExpressionStackAt(0, function);
7628     Push(receiver);
7629     CHECK_ALIVE(VisitExpressions(expr->arguments()));
7630     bool needs_wrapping = NeedsWrappingFor(info.type(), target);
7631     bool try_inline = FLAG_polymorphic_inlining && !needs_wrapping;
7632     if (FLAG_trace_inlining && try_inline) {
7633       Handle<JSFunction> caller = current_info()->closure();
7634       SmartArrayPointer<char> caller_name =
7635           caller->shared()->DebugName()->ToCString();
7636       PrintF("Trying to inline the polymorphic call to %s from %s\n",
7637              name->ToCString().get(),
7638              caller_name.get());
7639     }
7640     if (try_inline && TryInlineCall(expr)) {
7641       // Trying to inline will signal that we should bailout from the
7642       // entire compilation by setting stack overflow on the visitor.
7643       if (HasStackOverflow()) return;
7644     } else {
7645       // Since HWrapReceiver currently cannot actually wrap numbers and strings,
7646       // use the regular CallFunctionStub for method calls to wrap the receiver.
7647       // TODO(verwaest): Support creation of value wrappers directly in
7648       // HWrapReceiver.
7649       HInstruction* call = needs_wrapping
7650           ? NewUncasted<HCallFunction>(
7651               function, argument_count, WRAP_AND_CALL)
7652           : BuildCallConstantFunction(target, argument_count);
7653       PushArgumentsFromEnvironment(argument_count);
7654       AddInstruction(call);
7655       Drop(1);  // Drop the function.
7656       if (!ast_context()->IsEffect()) Push(call);
7657     }
7658
7659     if (current_block() != NULL) Goto(join);
7660     set_current_block(if_false);
7661   }
7662
7663   // Finish up.  Unconditionally deoptimize if we've handled all the maps we
7664   // know about and do not want to handle ones we've never seen.  Otherwise
7665   // use a generic IC.
7666   if (ordered_functions == types->length() && FLAG_deoptimize_uncommon_cases) {
7667     FinishExitWithHardDeoptimization("Unknown map in polymorphic call");
7668   } else {
7669     Property* prop = expr->expression()->AsProperty();
7670     HInstruction* function = BuildNamedGeneric(
7671         LOAD, receiver, name, NULL, prop->IsUninitialized());
7672     AddInstruction(function);
7673     Push(function);
7674     AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
7675
7676     environment()->SetExpressionStackAt(1, function);
7677     environment()->SetExpressionStackAt(0, receiver);
7678     CHECK_ALIVE(VisitExpressions(expr->arguments()));
7679
7680     CallFunctionFlags flags = receiver->type().IsJSObject()
7681         ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
7682     HInstruction* call = New<HCallFunction>(
7683         function, argument_count, flags);
7684
7685     PushArgumentsFromEnvironment(argument_count);
7686
7687     Drop(1);  // Function.
7688
7689     if (join != NULL) {
7690       AddInstruction(call);
7691       if (!ast_context()->IsEffect()) Push(call);
7692       Goto(join);
7693     } else {
7694       return ast_context()->ReturnInstruction(call, expr->id());
7695     }
7696   }
7697
7698   // We assume that control flow is always live after an expression.  So
7699   // even without predecessors to the join block, we set it as the exit
7700   // block and continue by adding instructions there.
7701   ASSERT(join != NULL);
7702   if (join->HasPredecessor()) {
7703     set_current_block(join);
7704     join->SetJoinId(expr->id());
7705     if (!ast_context()->IsEffect()) return ast_context()->ReturnValue(Pop());
7706   } else {
7707     set_current_block(NULL);
7708   }
7709 }
7710
7711
7712 void HOptimizedGraphBuilder::TraceInline(Handle<JSFunction> target,
7713                                          Handle<JSFunction> caller,
7714                                          const char* reason) {
7715   if (FLAG_trace_inlining) {
7716     SmartArrayPointer<char> target_name =
7717         target->shared()->DebugName()->ToCString();
7718     SmartArrayPointer<char> caller_name =
7719         caller->shared()->DebugName()->ToCString();
7720     if (reason == NULL) {
7721       PrintF("Inlined %s called from %s.\n", target_name.get(),
7722              caller_name.get());
7723     } else {
7724       PrintF("Did not inline %s called from %s (%s).\n",
7725              target_name.get(), caller_name.get(), reason);
7726     }
7727   }
7728 }
7729
7730
7731 static const int kNotInlinable = 1000000000;
7732
7733
7734 int HOptimizedGraphBuilder::InliningAstSize(Handle<JSFunction> target) {
7735   if (!FLAG_use_inlining) return kNotInlinable;
7736
7737   // Precondition: call is monomorphic and we have found a target with the
7738   // appropriate arity.
7739   Handle<JSFunction> caller = current_info()->closure();
7740   Handle<SharedFunctionInfo> target_shared(target->shared());
7741
7742   // Always inline builtins marked for inlining.
7743   if (target->IsBuiltin()) {
7744     return target_shared->inline_builtin() ? 0 : kNotInlinable;
7745   }
7746
7747   if (target_shared->IsApiFunction()) {
7748     TraceInline(target, caller, "target is api function");
7749     return kNotInlinable;
7750   }
7751
7752   // Do a quick check on source code length to avoid parsing large
7753   // inlining candidates.
7754   if (target_shared->SourceSize() >
7755       Min(FLAG_max_inlined_source_size, kUnlimitedMaxInlinedSourceSize)) {
7756     TraceInline(target, caller, "target text too big");
7757     return kNotInlinable;
7758   }
7759
7760   // Target must be inlineable.
7761   if (!target_shared->IsInlineable()) {
7762     TraceInline(target, caller, "target not inlineable");
7763     return kNotInlinable;
7764   }
7765   if (target_shared->dont_inline() || target_shared->dont_optimize()) {
7766     TraceInline(target, caller, "target contains unsupported syntax [early]");
7767     return kNotInlinable;
7768   }
7769
7770   int nodes_added = target_shared->ast_node_count();
7771   return nodes_added;
7772 }
7773
7774
7775 bool HOptimizedGraphBuilder::TryInline(Handle<JSFunction> target,
7776                                        int arguments_count,
7777                                        HValue* implicit_return_value,
7778                                        BailoutId ast_id,
7779                                        BailoutId return_id,
7780                                        InliningKind inlining_kind,
7781                                        HSourcePosition position) {
7782   int nodes_added = InliningAstSize(target);
7783   if (nodes_added == kNotInlinable) return false;
7784
7785   Handle<JSFunction> caller = current_info()->closure();
7786
7787   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
7788     TraceInline(target, caller, "target AST is too large [early]");
7789     return false;
7790   }
7791
7792   // Don't inline deeper than the maximum number of inlining levels.
7793   HEnvironment* env = environment();
7794   int current_level = 1;
7795   while (env->outer() != NULL) {
7796     if (current_level == FLAG_max_inlining_levels) {
7797       TraceInline(target, caller, "inline depth limit reached");
7798       return false;
7799     }
7800     if (env->outer()->frame_type() == JS_FUNCTION) {
7801       current_level++;
7802     }
7803     env = env->outer();
7804   }
7805
7806   // Don't inline recursive functions.
7807   for (FunctionState* state = function_state();
7808        state != NULL;
7809        state = state->outer()) {
7810     if (*state->compilation_info()->closure() == *target) {
7811       TraceInline(target, caller, "target is recursive");
7812       return false;
7813     }
7814   }
7815
7816   // We don't want to add more than a certain number of nodes from inlining.
7817   if (inlined_count_ > Min(FLAG_max_inlined_nodes_cumulative,
7818                            kUnlimitedMaxInlinedNodesCumulative)) {
7819     TraceInline(target, caller, "cumulative AST node limit reached");
7820     return false;
7821   }
7822
7823   // Parse and allocate variables.
7824   CompilationInfo target_info(target, zone());
7825   Handle<SharedFunctionInfo> target_shared(target->shared());
7826   if (!Parser::Parse(&target_info) || !Scope::Analyze(&target_info)) {
7827     if (target_info.isolate()->has_pending_exception()) {
7828       // Parse or scope error, never optimize this function.
7829       SetStackOverflow();
7830       target_shared->DisableOptimization(kParseScopeError);
7831     }
7832     TraceInline(target, caller, "parse failure");
7833     return false;
7834   }
7835
7836   if (target_info.scope()->num_heap_slots() > 0) {
7837     TraceInline(target, caller, "target has context-allocated variables");
7838     return false;
7839   }
7840   FunctionLiteral* function = target_info.function();
7841
7842   // The following conditions must be checked again after re-parsing, because
7843   // earlier the information might not have been complete due to lazy parsing.
7844   nodes_added = function->ast_node_count();
7845   if (nodes_added > Min(FLAG_max_inlined_nodes, kUnlimitedMaxInlinedNodes)) {
7846     TraceInline(target, caller, "target AST is too large [late]");
7847     return false;
7848   }
7849   AstProperties::Flags* flags(function->flags());
7850   if (flags->Contains(kDontInline) || function->dont_optimize()) {
7851     TraceInline(target, caller, "target contains unsupported syntax [late]");
7852     return false;
7853   }
7854
7855   // If the function uses the arguments object check that inlining of functions
7856   // with arguments object is enabled and the arguments-variable is
7857   // stack allocated.
7858   if (function->scope()->arguments() != NULL) {
7859     if (!FLAG_inline_arguments) {
7860       TraceInline(target, caller, "target uses arguments object");
7861       return false;
7862     }
7863
7864     if (!function->scope()->arguments()->IsStackAllocated()) {
7865       TraceInline(target,
7866                   caller,
7867                   "target uses non-stackallocated arguments object");
7868       return false;
7869     }
7870   }
7871
7872   // All declarations must be inlineable.
7873   ZoneList<Declaration*>* decls = target_info.scope()->declarations();
7874   int decl_count = decls->length();
7875   for (int i = 0; i < decl_count; ++i) {
7876     if (!decls->at(i)->IsInlineable()) {
7877       TraceInline(target, caller, "target has non-trivial declaration");
7878       return false;
7879     }
7880   }
7881
7882   // Generate the deoptimization data for the unoptimized version of
7883   // the target function if we don't already have it.
7884   if (!target_shared->has_deoptimization_support()) {
7885     // Note that we compile here using the same AST that we will use for
7886     // generating the optimized inline code.
7887     target_info.EnableDeoptimizationSupport();
7888     if (!FullCodeGenerator::MakeCode(&target_info)) {
7889       TraceInline(target, caller, "could not generate deoptimization info");
7890       return false;
7891     }
7892     if (target_shared->scope_info() == ScopeInfo::Empty(isolate())) {
7893       // The scope info might not have been set if a lazily compiled
7894       // function is inlined before being called for the first time.
7895       Handle<ScopeInfo> target_scope_info =
7896           ScopeInfo::Create(target_info.scope(), zone());
7897       target_shared->set_scope_info(*target_scope_info);
7898     }
7899     target_shared->EnableDeoptimizationSupport(*target_info.code());
7900     target_shared->set_feedback_vector(*target_info.feedback_vector());
7901     Compiler::RecordFunctionCompilation(Logger::FUNCTION_TAG,
7902                                         &target_info,
7903                                         target_shared);
7904   }
7905
7906   // ----------------------------------------------------------------
7907   // After this point, we've made a decision to inline this function (so
7908   // TryInline should always return true).
7909
7910   // Type-check the inlined function.
7911   ASSERT(target_shared->has_deoptimization_support());
7912   AstTyper::Run(&target_info);
7913
7914   int function_id = graph()->TraceInlinedFunction(target_shared, position);
7915
7916   // Save the pending call context. Set up new one for the inlined function.
7917   // The function state is new-allocated because we need to delete it
7918   // in two different places.
7919   FunctionState* target_state = new FunctionState(
7920       this, &target_info, inlining_kind, function_id);
7921
7922   HConstant* undefined = graph()->GetConstantUndefined();
7923
7924   HEnvironment* inner_env =
7925       environment()->CopyForInlining(target,
7926                                      arguments_count,
7927                                      function,
7928                                      undefined,
7929                                      function_state()->inlining_kind());
7930
7931   HConstant* context = Add<HConstant>(Handle<Context>(target->context()));
7932   inner_env->BindContext(context);
7933
7934   HArgumentsObject* arguments_object = NULL;
7935
7936   // If the function uses arguments object create and bind one, also copy
7937   // current arguments values to use them for materialization.
7938   if (function->scope()->arguments() != NULL) {
7939     ASSERT(function->scope()->arguments()->IsStackAllocated());
7940     HEnvironment* arguments_env = inner_env->arguments_environment();
7941     int arguments_count = arguments_env->parameter_count();
7942     arguments_object = Add<HArgumentsObject>(arguments_count);
7943     inner_env->Bind(function->scope()->arguments(), arguments_object);
7944     for (int i = 0; i < arguments_count; i++) {
7945       arguments_object->AddArgument(arguments_env->Lookup(i), zone());
7946     }
7947   }
7948
7949   // Capture the state before invoking the inlined function for deopt in the
7950   // inlined function. This simulate has no bailout-id since it's not directly
7951   // reachable for deopt, and is only used to capture the state. If the simulate
7952   // becomes reachable by merging, the ast id of the simulate merged into it is
7953   // adopted.
7954   Add<HSimulate>(BailoutId::None());
7955
7956   current_block()->UpdateEnvironment(inner_env);
7957   Scope* saved_scope = scope();
7958   set_scope(target_info.scope());
7959   HEnterInlined* enter_inlined =
7960       Add<HEnterInlined>(return_id, target, arguments_count, function,
7961                          function_state()->inlining_kind(),
7962                          function->scope()->arguments(),
7963                          arguments_object);
7964   function_state()->set_entry(enter_inlined);
7965
7966   VisitDeclarations(target_info.scope()->declarations());
7967   VisitStatements(function->body());
7968   set_scope(saved_scope);
7969   if (HasStackOverflow()) {
7970     // Bail out if the inline function did, as we cannot residualize a call
7971     // instead.
7972     TraceInline(target, caller, "inline graph construction failed");
7973     target_shared->DisableOptimization(kInliningBailedOut);
7974     inline_bailout_ = true;
7975     delete target_state;
7976     return true;
7977   }
7978
7979   // Update inlined nodes count.
7980   inlined_count_ += nodes_added;
7981
7982   Handle<Code> unoptimized_code(target_shared->code());
7983   ASSERT(unoptimized_code->kind() == Code::FUNCTION);
7984   Handle<TypeFeedbackInfo> type_info(
7985       TypeFeedbackInfo::cast(unoptimized_code->type_feedback_info()));
7986   graph()->update_type_change_checksum(type_info->own_type_change_checksum());
7987
7988   TraceInline(target, caller, NULL);
7989
7990   if (current_block() != NULL) {
7991     FunctionState* state = function_state();
7992     if (state->inlining_kind() == CONSTRUCT_CALL_RETURN) {
7993       // Falling off the end of an inlined construct call. In a test context the
7994       // return value will always evaluate to true, in a value context the
7995       // return value is the newly allocated receiver.
7996       if (call_context()->IsTest()) {
7997         Goto(inlined_test_context()->if_true(), state);
7998       } else if (call_context()->IsEffect()) {
7999         Goto(function_return(), state);
8000       } else {
8001         ASSERT(call_context()->IsValue());
8002         AddLeaveInlined(implicit_return_value, state);
8003       }
8004     } else if (state->inlining_kind() == SETTER_CALL_RETURN) {
8005       // Falling off the end of an inlined setter call. The returned value is
8006       // never used, the value of an assignment is always the value of the RHS
8007       // of the assignment.
8008       if (call_context()->IsTest()) {
8009         inlined_test_context()->ReturnValue(implicit_return_value);
8010       } else if (call_context()->IsEffect()) {
8011         Goto(function_return(), state);
8012       } else {
8013         ASSERT(call_context()->IsValue());
8014         AddLeaveInlined(implicit_return_value, state);
8015       }
8016     } else {
8017       // Falling off the end of a normal inlined function. This basically means
8018       // returning undefined.
8019       if (call_context()->IsTest()) {
8020         Goto(inlined_test_context()->if_false(), state);
8021       } else if (call_context()->IsEffect()) {
8022         Goto(function_return(), state);
8023       } else {
8024         ASSERT(call_context()->IsValue());
8025         AddLeaveInlined(undefined, state);
8026       }
8027     }
8028   }
8029
8030   // Fix up the function exits.
8031   if (inlined_test_context() != NULL) {
8032     HBasicBlock* if_true = inlined_test_context()->if_true();
8033     HBasicBlock* if_false = inlined_test_context()->if_false();
8034
8035     HEnterInlined* entry = function_state()->entry();
8036
8037     // Pop the return test context from the expression context stack.
8038     ASSERT(ast_context() == inlined_test_context());
8039     ClearInlinedTestContext();
8040     delete target_state;
8041
8042     // Forward to the real test context.
8043     if (if_true->HasPredecessor()) {
8044       entry->RegisterReturnTarget(if_true, zone());
8045       if_true->SetJoinId(ast_id);
8046       HBasicBlock* true_target = TestContext::cast(ast_context())->if_true();
8047       Goto(if_true, true_target, function_state());
8048     }
8049     if (if_false->HasPredecessor()) {
8050       entry->RegisterReturnTarget(if_false, zone());
8051       if_false->SetJoinId(ast_id);
8052       HBasicBlock* false_target = TestContext::cast(ast_context())->if_false();
8053       Goto(if_false, false_target, function_state());
8054     }
8055     set_current_block(NULL);
8056     return true;
8057
8058   } else if (function_return()->HasPredecessor()) {
8059     function_state()->entry()->RegisterReturnTarget(function_return(), zone());
8060     function_return()->SetJoinId(ast_id);
8061     set_current_block(function_return());
8062   } else {
8063     set_current_block(NULL);
8064   }
8065   delete target_state;
8066   return true;
8067 }
8068
8069
8070 bool HOptimizedGraphBuilder::TryInlineCall(Call* expr) {
8071   return TryInline(expr->target(),
8072                    expr->arguments()->length(),
8073                    NULL,
8074                    expr->id(),
8075                    expr->ReturnId(),
8076                    NORMAL_RETURN,
8077                    ScriptPositionToSourcePosition(expr->position()));
8078 }
8079
8080
8081 bool HOptimizedGraphBuilder::TryInlineConstruct(CallNew* expr,
8082                                                 HValue* implicit_return_value) {
8083   return TryInline(expr->target(),
8084                    expr->arguments()->length(),
8085                    implicit_return_value,
8086                    expr->id(),
8087                    expr->ReturnId(),
8088                    CONSTRUCT_CALL_RETURN,
8089                    ScriptPositionToSourcePosition(expr->position()));
8090 }
8091
8092
8093 bool HOptimizedGraphBuilder::TryInlineGetter(Handle<JSFunction> getter,
8094                                              Handle<Map> receiver_map,
8095                                              BailoutId ast_id,
8096                                              BailoutId return_id) {
8097   if (TryInlineApiGetter(getter, receiver_map, ast_id)) return true;
8098   return TryInline(getter,
8099                    0,
8100                    NULL,
8101                    ast_id,
8102                    return_id,
8103                    GETTER_CALL_RETURN,
8104                    source_position());
8105 }
8106
8107
8108 bool HOptimizedGraphBuilder::TryInlineSetter(Handle<JSFunction> setter,
8109                                              Handle<Map> receiver_map,
8110                                              BailoutId id,
8111                                              BailoutId assignment_id,
8112                                              HValue* implicit_return_value) {
8113   if (TryInlineApiSetter(setter, receiver_map, id)) return true;
8114   return TryInline(setter,
8115                    1,
8116                    implicit_return_value,
8117                    id, assignment_id,
8118                    SETTER_CALL_RETURN,
8119                    source_position());
8120 }
8121
8122
8123 bool HOptimizedGraphBuilder::TryInlineApply(Handle<JSFunction> function,
8124                                             Call* expr,
8125                                             int arguments_count) {
8126   return TryInline(function,
8127                    arguments_count,
8128                    NULL,
8129                    expr->id(),
8130                    expr->ReturnId(),
8131                    NORMAL_RETURN,
8132                    ScriptPositionToSourcePosition(expr->position()));
8133 }
8134
8135
8136 bool HOptimizedGraphBuilder::TryInlineBuiltinFunctionCall(Call* expr) {
8137   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8138   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8139   switch (id) {
8140     case kMathExp:
8141       if (!FLAG_fast_math) break;
8142       // Fall through if FLAG_fast_math.
8143     case kMathRound:
8144     case kMathFloor:
8145     case kMathAbs:
8146     case kMathSqrt:
8147     case kMathLog:
8148     case kMathClz32:
8149       if (expr->arguments()->length() == 1) {
8150         HValue* argument = Pop();
8151         Drop(2);  // Receiver and function.
8152         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8153         ast_context()->ReturnInstruction(op, expr->id());
8154         return true;
8155       }
8156       break;
8157     case kMathImul:
8158       if (expr->arguments()->length() == 2) {
8159         HValue* right = Pop();
8160         HValue* left = Pop();
8161         Drop(2);  // Receiver and function.
8162         HInstruction* op = HMul::NewImul(zone(), context(), left, right);
8163         ast_context()->ReturnInstruction(op, expr->id());
8164         return true;
8165       }
8166       break;
8167 #define SIMD_NULLARY_OPERATION_CASE_ITEM(p1, p2, name, p4)                     \
8168     case k##name:
8169 SIMD_NULLARY_OPERATIONS(SIMD_NULLARY_OPERATION_CASE_ITEM)
8170 #undef SIMD_NULLARY_OPERATION_CASE_ITEM
8171       if (CpuFeatures::SupportsSIMD128InCrankshaft() &&
8172           expr->arguments()->length() == 0) {
8173         Drop(2);  // Receiver and function.
8174         HInstruction* op = NewUncasted<HNullarySIMDOperation>(id);
8175         ast_context()->ReturnInstruction(op, expr->id());
8176         return true;
8177       }
8178       break;
8179 #define SIMD_UNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5)                   \
8180     case k##name:
8181 SIMD_UNARY_OPERATIONS(SIMD_UNARY_OPERATION_CASE_ITEM)
8182 #undef SIMD_UNARY_OPERATION_CASE_ITEM
8183       if (CpuFeatures::SupportsSIMD128InCrankshaft() &&
8184           expr->arguments()->length() == 1) {
8185         HValue* argument = Pop();
8186         Drop(2);  // Receiver and function.
8187         HInstruction* op = NewUncasted<HUnarySIMDOperation>(argument, id);
8188         ast_context()->ReturnInstruction(op, expr->id());
8189         return true;
8190       }
8191       break;
8192 #define SIMD_BINARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6)              \
8193     case k##name:
8194 SIMD_BINARY_OPERATIONS(SIMD_BINARY_OPERATION_CASE_ITEM)
8195 #undef SIMD_BINARY_OPERATION_CASE_ITEM
8196       if (CpuFeatures::SupportsSIMD128InCrankshaft() &&
8197           expr->arguments()->length() == 2) {
8198         HValue* right = Pop();
8199         HValue* left = Pop();
8200         Drop(2);  // Receiver and function.
8201         HInstruction* op = NewUncasted<HBinarySIMDOperation>(left, right, id);
8202         ast_context()->ReturnInstruction(op, expr->id());
8203         return true;
8204       }
8205       break;
8206 #define SIMD_TERNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6, p7)         \
8207     case k##name:
8208 SIMD_TERNARY_OPERATIONS(SIMD_TERNARY_OPERATION_CASE_ITEM)
8209 #undef SIMD_TERNARY_OPERATION_CASE_ITEM
8210       if (CpuFeatures::SupportsSIMD128InCrankshaft() &&
8211           expr->arguments()->length() == 3) {
8212         HValue* right = Pop();
8213         HValue* left = Pop();
8214         HValue* value = Pop();
8215         Drop(2);  // Receiver and function.
8216         HInstruction* op =
8217             NewUncasted<HTernarySIMDOperation>(value, left, right, id);
8218         ast_context()->ReturnInstruction(op, expr->id());
8219         return true;
8220       }
8221       break;
8222 #define SIMD_QUARTERNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6, p7, p8) \
8223     case k##name:
8224 SIMD_QUARTERNARY_OPERATIONS(SIMD_QUARTERNARY_OPERATION_CASE_ITEM)
8225 #undef SIMD_QUARTERNARY_OPERATION_CASE_ITEM
8226       if (CpuFeatures::SupportsSIMD128InCrankshaft() &&
8227           expr->arguments()->length() == 4) {
8228         HValue* w = Pop();
8229         HValue* z = Pop();
8230         HValue* y = Pop();
8231         HValue* x = Pop();
8232         Drop(2);  // Receiver and function.
8233         HInstruction* op =
8234             NewUncasted<HQuarternarySIMDOperation>(x, y, z, w, id);
8235         ast_context()->ReturnInstruction(op, expr->id());
8236         return true;
8237       }
8238       break;
8239     default:
8240       // Not supported for inlining yet.
8241       break;
8242   }
8243   return false;
8244 }
8245
8246
8247 bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
8248     Call* expr,
8249     HValue* receiver,
8250     Handle<Map> receiver_map) {
8251   // Try to inline calls like Math.* as operations in the calling function.
8252   if (!expr->target()->shared()->HasBuiltinFunctionId()) return false;
8253   BuiltinFunctionId id = expr->target()->shared()->builtin_function_id();
8254   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
8255   switch (id) {
8256     case kStringCharCodeAt:
8257     case kStringCharAt:
8258       if (argument_count == 2) {
8259         HValue* index = Pop();
8260         HValue* string = Pop();
8261         Drop(1);  // Function.
8262         HInstruction* char_code =
8263             BuildStringCharCodeAt(string, index);
8264         if (id == kStringCharCodeAt) {
8265           ast_context()->ReturnInstruction(char_code, expr->id());
8266           return true;
8267         }
8268         AddInstruction(char_code);
8269         HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
8270         ast_context()->ReturnInstruction(result, expr->id());
8271         return true;
8272       }
8273       break;
8274     case kStringFromCharCode:
8275       if (argument_count == 2) {
8276         HValue* argument = Pop();
8277         Drop(2);  // Receiver and function.
8278         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
8279         ast_context()->ReturnInstruction(result, expr->id());
8280         return true;
8281       }
8282       break;
8283     case kMathExp:
8284       if (!FLAG_fast_math) break;
8285       // Fall through if FLAG_fast_math.
8286     case kMathRound:
8287     case kMathFloor:
8288     case kMathAbs:
8289     case kMathSqrt:
8290     case kMathLog:
8291     case kMathClz32:
8292       if (argument_count == 2) {
8293         HValue* argument = Pop();
8294         Drop(2);  // Receiver and function.
8295         HInstruction* op = NewUncasted<HUnaryMathOperation>(argument, id);
8296         ast_context()->ReturnInstruction(op, expr->id());
8297         return true;
8298       }
8299       break;
8300     case kMathPow:
8301       if (argument_count == 3) {
8302         HValue* right = Pop();
8303         HValue* left = Pop();
8304         Drop(2);  // Receiver and function.
8305         HInstruction* result = NULL;
8306         // Use sqrt() if exponent is 0.5 or -0.5.
8307         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
8308           double exponent = HConstant::cast(right)->DoubleValue();
8309           if (exponent == 0.5) {
8310             result = NewUncasted<HUnaryMathOperation>(left, kMathPowHalf);
8311           } else if (exponent == -0.5) {
8312             HValue* one = graph()->GetConstant1();
8313             HInstruction* sqrt = AddUncasted<HUnaryMathOperation>(
8314                 left, kMathPowHalf);
8315             // MathPowHalf doesn't have side effects so there's no need for
8316             // an environment simulation here.
8317             ASSERT(!sqrt->HasObservableSideEffects());
8318             result = NewUncasted<HDiv>(one, sqrt);
8319           } else if (exponent == 2.0) {
8320             result = NewUncasted<HMul>(left, left);
8321           }
8322         }
8323
8324         if (result == NULL) {
8325           result = NewUncasted<HPower>(left, right);
8326         }
8327         ast_context()->ReturnInstruction(result, expr->id());
8328         return true;
8329       }
8330       break;
8331     case kMathMax:
8332     case kMathMin:
8333       if (argument_count == 3) {
8334         HValue* right = Pop();
8335         HValue* left = Pop();
8336         Drop(2);  // Receiver and function.
8337         HMathMinMax::Operation op = (id == kMathMin) ? HMathMinMax::kMathMin
8338                                                      : HMathMinMax::kMathMax;
8339         HInstruction* result = NewUncasted<HMathMinMax>(left, right, op);
8340         ast_context()->ReturnInstruction(result, expr->id());
8341         return true;
8342       }
8343       break;
8344     case kMathImul:
8345       if (argument_count == 3) {
8346         HValue* right = Pop();
8347         HValue* left = Pop();
8348         Drop(2);  // Receiver and function.
8349         HInstruction* result = HMul::NewImul(zone(), context(), left, right);
8350         ast_context()->ReturnInstruction(result, expr->id());
8351         return true;
8352       }
8353       break;
8354     case kArrayPop: {
8355       if (receiver_map.is_null()) return false;
8356       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8357       ElementsKind elements_kind = receiver_map->elements_kind();
8358       if (!IsFastElementsKind(elements_kind)) return false;
8359       if (receiver_map->is_observed()) return false;
8360       ASSERT(receiver_map->is_extensible());
8361
8362       Drop(expr->arguments()->length());
8363       HValue* result;
8364       HValue* reduced_length;
8365       HValue* receiver = Pop();
8366
8367       HValue* checked_object = AddCheckMap(receiver, receiver_map);
8368       HValue* length = Add<HLoadNamedField>(
8369           checked_object, static_cast<HValue*>(NULL),
8370           HObjectAccess::ForArrayLength(elements_kind));
8371
8372       Drop(1);  // Function.
8373
8374       { NoObservableSideEffectsScope scope(this);
8375         IfBuilder length_checker(this);
8376
8377         HValue* bounds_check = length_checker.If<HCompareNumericAndBranch>(
8378             length, graph()->GetConstant0(), Token::EQ);
8379         length_checker.Then();
8380
8381         if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8382
8383         length_checker.Else();
8384         HValue* elements = AddLoadElements(checked_object);
8385         // Ensure that we aren't popping from a copy-on-write array.
8386         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8387           elements = BuildCopyElementsOnWrite(checked_object, elements,
8388                                               elements_kind, length);
8389         }
8390         reduced_length = AddUncasted<HSub>(length, graph()->GetConstant1());
8391         result = AddElementAccess(elements, reduced_length, NULL,
8392                                   bounds_check, elements_kind, LOAD);
8393         Factory* factory = isolate()->factory();
8394         double nan_double = FixedDoubleArray::hole_nan_as_double();
8395         HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
8396             ? Add<HConstant>(factory->the_hole_value())
8397             : Add<HConstant>(nan_double);
8398         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
8399           elements_kind = FAST_HOLEY_ELEMENTS;
8400         }
8401         AddElementAccess(
8402             elements, reduced_length, hole, bounds_check, elements_kind, STORE);
8403         Add<HStoreNamedField>(
8404             checked_object, HObjectAccess::ForArrayLength(elements_kind),
8405             reduced_length, STORE_TO_INITIALIZED_ENTRY);
8406
8407         if (!ast_context()->IsEffect()) Push(result);
8408
8409         length_checker.End();
8410       }
8411       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8412       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8413       if (!ast_context()->IsEffect()) Drop(1);
8414
8415       ast_context()->ReturnValue(result);
8416       return true;
8417     }
8418     case kArrayPush: {
8419       if (receiver_map.is_null()) return false;
8420       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8421       ElementsKind elements_kind = receiver_map->elements_kind();
8422       if (!IsFastElementsKind(elements_kind)) return false;
8423       if (receiver_map->is_observed()) return false;
8424       if (JSArray::IsReadOnlyLengthDescriptor(receiver_map)) return false;
8425       ASSERT(receiver_map->is_extensible());
8426
8427       // If there may be elements accessors in the prototype chain, the fast
8428       // inlined version can't be used.
8429       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8430       // If there currently can be no elements accessors on the prototype chain,
8431       // it doesn't mean that there won't be any later. Install a full prototype
8432       // chain check to trap element accessors being installed on the prototype
8433       // chain, which would cause elements to go to dictionary mode and result
8434       // in a map change.
8435       Handle<JSObject> prototype(JSObject::cast(receiver_map->prototype()));
8436       BuildCheckPrototypeMaps(prototype, Handle<JSObject>());
8437
8438       const int argc = expr->arguments()->length();
8439       if (argc != 1) return false;
8440
8441       HValue* value_to_push = Pop();
8442       HValue* array = Pop();
8443       Drop(1);  // Drop function.
8444
8445       HInstruction* new_size = NULL;
8446       HValue* length = NULL;
8447
8448       {
8449         NoObservableSideEffectsScope scope(this);
8450
8451         length = Add<HLoadNamedField>(array, static_cast<HValue*>(NULL),
8452           HObjectAccess::ForArrayLength(elements_kind));
8453
8454         new_size = AddUncasted<HAdd>(length, graph()->GetConstant1());
8455
8456         bool is_array = receiver_map->instance_type() == JS_ARRAY_TYPE;
8457         BuildUncheckedMonomorphicElementAccess(array, length,
8458                                                value_to_push, is_array,
8459                                                elements_kind, STORE,
8460                                                NEVER_RETURN_HOLE,
8461                                                STORE_AND_GROW_NO_TRANSITION);
8462
8463         if (!ast_context()->IsEffect()) Push(new_size);
8464         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8465         if (!ast_context()->IsEffect()) Drop(1);
8466       }
8467
8468       ast_context()->ReturnValue(new_size);
8469       return true;
8470     }
8471     case kArrayShift: {
8472       if (receiver_map.is_null()) return false;
8473       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8474       ElementsKind kind = receiver_map->elements_kind();
8475       if (!IsFastElementsKind(kind)) return false;
8476       if (receiver_map->is_observed()) return false;
8477       ASSERT(receiver_map->is_extensible());
8478
8479       // If there may be elements accessors in the prototype chain, the fast
8480       // inlined version can't be used.
8481       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8482
8483       // If there currently can be no elements accessors on the prototype chain,
8484       // it doesn't mean that there won't be any later. Install a full prototype
8485       // chain check to trap element accessors being installed on the prototype
8486       // chain, which would cause elements to go to dictionary mode and result
8487       // in a map change.
8488       BuildCheckPrototypeMaps(
8489           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8490           Handle<JSObject>::null());
8491
8492       // Threshold for fast inlined Array.shift().
8493       HConstant* inline_threshold = Add<HConstant>(static_cast<int32_t>(16));
8494
8495       Drop(expr->arguments()->length());
8496       HValue* receiver = Pop();
8497       HValue* function = Pop();
8498       HValue* result;
8499
8500       {
8501         NoObservableSideEffectsScope scope(this);
8502
8503         HValue* length = Add<HLoadNamedField>(
8504             receiver, static_cast<HValue*>(NULL),
8505             HObjectAccess::ForArrayLength(kind));
8506
8507         IfBuilder if_lengthiszero(this);
8508         HValue* lengthiszero = if_lengthiszero.If<HCompareNumericAndBranch>(
8509             length, graph()->GetConstant0(), Token::EQ);
8510         if_lengthiszero.Then();
8511         {
8512           if (!ast_context()->IsEffect()) Push(graph()->GetConstantUndefined());
8513         }
8514         if_lengthiszero.Else();
8515         {
8516           HValue* elements = AddLoadElements(receiver);
8517
8518           // Check if we can use the fast inlined Array.shift().
8519           IfBuilder if_inline(this);
8520           if_inline.If<HCompareNumericAndBranch>(
8521               length, inline_threshold, Token::LTE);
8522           if (IsFastSmiOrObjectElementsKind(kind)) {
8523             // We cannot handle copy-on-write backing stores here.
8524             if_inline.AndIf<HCompareMap>(
8525                 elements, isolate()->factory()->fixed_array_map());
8526           }
8527           if_inline.Then();
8528           {
8529             // Remember the result.
8530             if (!ast_context()->IsEffect()) {
8531               Push(AddElementAccess(elements, graph()->GetConstant0(), NULL,
8532                                     lengthiszero, kind, LOAD));
8533             }
8534
8535             // Compute the new length.
8536             HValue* new_length = AddUncasted<HSub>(
8537                 length, graph()->GetConstant1());
8538             new_length->ClearFlag(HValue::kCanOverflow);
8539
8540             // Copy the remaining elements.
8541             LoopBuilder loop(this, context(), LoopBuilder::kPostIncrement);
8542             {
8543               HValue* new_key = loop.BeginBody(
8544                   graph()->GetConstant0(), new_length, Token::LT);
8545               HValue* key = AddUncasted<HAdd>(new_key, graph()->GetConstant1());
8546               key->ClearFlag(HValue::kCanOverflow);
8547               HValue* element = AddUncasted<HLoadKeyed>(
8548                   elements, key, lengthiszero, kind, ALLOW_RETURN_HOLE);
8549               HStoreKeyed* store = Add<HStoreKeyed>(
8550                   elements, new_key, element, kind);
8551               store->SetFlag(HValue::kAllowUndefinedAsNaN);
8552             }
8553             loop.EndBody();
8554
8555             // Put a hole at the end.
8556             HValue* hole = IsFastSmiOrObjectElementsKind(kind)
8557                 ? Add<HConstant>(isolate()->factory()->the_hole_value())
8558                 : Add<HConstant>(FixedDoubleArray::hole_nan_as_double());
8559             if (IsFastSmiOrObjectElementsKind(kind)) kind = FAST_HOLEY_ELEMENTS;
8560             Add<HStoreKeyed>(
8561                 elements, new_length, hole, kind, INITIALIZING_STORE);
8562
8563             // Remember new length.
8564             Add<HStoreNamedField>(
8565                 receiver, HObjectAccess::ForArrayLength(kind),
8566                 new_length, STORE_TO_INITIALIZED_ENTRY);
8567           }
8568           if_inline.Else();
8569           {
8570             Add<HPushArguments>(receiver);
8571             result = Add<HCallJSFunction>(function, 1, true);
8572             if (!ast_context()->IsEffect()) Push(result);
8573           }
8574           if_inline.End();
8575         }
8576         if_lengthiszero.End();
8577       }
8578       result = ast_context()->IsEffect() ? graph()->GetConstant0() : Top();
8579       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8580       if (!ast_context()->IsEffect()) Drop(1);
8581       ast_context()->ReturnValue(result);
8582       return true;
8583     }
8584     case kArrayIndexOf:
8585     case kArrayLastIndexOf: {
8586       if (receiver_map.is_null()) return false;
8587       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
8588       ElementsKind kind = receiver_map->elements_kind();
8589       if (!IsFastElementsKind(kind)) return false;
8590       if (receiver_map->is_observed()) return false;
8591       if (argument_count != 2) return false;
8592       ASSERT(receiver_map->is_extensible());
8593
8594       // If there may be elements accessors in the prototype chain, the fast
8595       // inlined version can't be used.
8596       if (receiver_map->DictionaryElementsInPrototypeChainOnly()) return false;
8597
8598       // If there currently can be no elements accessors on the prototype chain,
8599       // it doesn't mean that there won't be any later. Install a full prototype
8600       // chain check to trap element accessors being installed on the prototype
8601       // chain, which would cause elements to go to dictionary mode and result
8602       // in a map change.
8603       BuildCheckPrototypeMaps(
8604           handle(JSObject::cast(receiver_map->prototype()), isolate()),
8605           Handle<JSObject>::null());
8606
8607       HValue* search_element = Pop();
8608       HValue* receiver = Pop();
8609       Drop(1);  // Drop function.
8610
8611       ArrayIndexOfMode mode = (id == kArrayIndexOf)
8612           ? kFirstIndexOf : kLastIndexOf;
8613       HValue* index = BuildArrayIndexOf(receiver, search_element, kind, mode);
8614
8615       if (!ast_context()->IsEffect()) Push(index);
8616       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8617       if (!ast_context()->IsEffect()) Drop(1);
8618       ast_context()->ReturnValue(index);
8619       return true;
8620     }
8621 #define SIMD_NULLARY_OPERATION_CASE_ITEM(p1, p2, name, p4)                     \
8622     case k##name:
8623 SIMD_NULLARY_OPERATIONS(SIMD_NULLARY_OPERATION_CASE_ITEM)
8624 #undef SIMD_NULLARY_OPERATION_CASE_ITEM
8625       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 1) {
8626         Drop(2);  // Receiver and function.
8627         HInstruction* op = NewUncasted<HNullarySIMDOperation>(id);
8628         ast_context()->ReturnInstruction(op, expr->id());
8629         return true;
8630       }
8631       break;
8632 #define SIMD_UNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5)                   \
8633     case k##name:
8634 SIMD_UNARY_OPERATIONS(SIMD_UNARY_OPERATION_CASE_ITEM)
8635 #undef SIMD_UNARY_OPERATION_CASE_ITEM
8636       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 2) {
8637         HValue* argument = Pop();
8638         Drop(2);  // Receiver and function.
8639         HInstruction* op = NewUncasted<HUnarySIMDOperation>(argument, id);
8640         ast_context()->ReturnInstruction(op, expr->id());
8641         return true;
8642       }
8643       break;
8644 #define SIMD_BINARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6)              \
8645     case k##name:
8646 SIMD_BINARY_OPERATIONS(SIMD_BINARY_OPERATION_CASE_ITEM)
8647 #undef SIMD_BINARY_OPERATION_CASE_ITEM
8648       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 3) {
8649         HValue* right = Pop();
8650         HValue* left = Pop();
8651         Drop(2);  // Receiver and function.
8652         HInstruction* op = NewUncasted<HBinarySIMDOperation>(left, right, id);
8653         ast_context()->ReturnInstruction(op, expr->id());
8654         return true;
8655       }
8656       break;
8657 #define SIMD_TERNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6, p7)         \
8658     case k##name:
8659 SIMD_TERNARY_OPERATIONS(SIMD_TERNARY_OPERATION_CASE_ITEM)
8660 #undef SIMD_TERNARY_OPERATION_CASE_ITEM
8661       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 4) {
8662         HValue* right = Pop();
8663         HValue* left = Pop();
8664         HValue* value = Pop();
8665         Drop(2);  // Receiver and function.
8666         HInstruction* op =
8667             NewUncasted<HTernarySIMDOperation>(value, left, right, id);
8668         ast_context()->ReturnInstruction(op, expr->id());
8669         return true;
8670       }
8671       break;
8672 #define SIMD_QUARTERNARY_OPERATION_CASE_ITEM(p1, p2, name, p4, p5, p6, p7, p8) \
8673     case k##name:
8674 SIMD_QUARTERNARY_OPERATIONS(SIMD_QUARTERNARY_OPERATION_CASE_ITEM)
8675 #undef SIMD_QUARTERNARY_OPERATION_CASE_ITEM
8676       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 5) {
8677         HValue* w = Pop();
8678         HValue* z = Pop();
8679         HValue* y = Pop();
8680         HValue* x = Pop();
8681         Drop(2);  // Receiver and function.
8682         HValue* context = environment()->context();
8683         HInstruction* op =
8684             HQuarternarySIMDOperation::New(zone(), context, x, y, z, w, id);
8685         ast_context()->ReturnInstruction(op, expr->id());
8686         return true;
8687       }
8688       break;
8689     case kFloat32x4ArrayGetAt:
8690     case kFloat64x2ArrayGetAt:
8691     case kInt32x4ArrayGetAt:
8692       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 2) {
8693         HValue* key = Pop();
8694         HValue* typed32x4_array = Pop();
8695         ASSERT(typed32x4_array == receiver);
8696         Drop(1);  // Drop function.
8697         HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
8698             typed32x4_array, key, NULL,
8699             receiver_map->instance_type() == JS_ARRAY_TYPE,
8700             receiver_map->elements_kind(),
8701             LOAD,  // is_store.
8702             NEVER_RETURN_HOLE,  // load_mode.
8703             STANDARD_STORE);
8704         ast_context()->ReturnValue(instr);
8705         return true;
8706       }
8707       break;
8708     case kFloat32x4ArraySetAt:
8709     case kFloat64x2ArraySetAt:
8710     case kInt32x4ArraySetAt:
8711       if (CpuFeatures::SupportsSIMD128InCrankshaft() && argument_count == 3) {
8712         HValue* value = Pop();
8713         HValue* key = Pop();
8714         HValue* typed32x4_array = Pop();
8715         ASSERT(typed32x4_array == receiver);
8716         Drop(1);  // Drop function.
8717         // TODO(haitao): add STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS.
8718         KeyedAccessStoreMode store_mode = STANDARD_STORE;
8719         BuildUncheckedMonomorphicElementAccess(
8720             typed32x4_array, key, value,
8721             receiver_map->instance_type() == JS_ARRAY_TYPE,
8722             receiver_map->elements_kind(),
8723             STORE,  // is_store.
8724             NEVER_RETURN_HOLE,  // load_mode.
8725             store_mode);
8726         Push(value);
8727         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
8728         ast_context()->ReturnValue(Pop());
8729         return true;
8730       }
8731       break;
8732     default:
8733       // Not yet supported for inlining.
8734       break;
8735   }
8736   return false;
8737 }
8738
8739
8740 bool HOptimizedGraphBuilder::TryInlineApiFunctionCall(Call* expr,
8741                                                       HValue* receiver) {
8742   Handle<JSFunction> function = expr->target();
8743   int argc = expr->arguments()->length();
8744   SmallMapList receiver_maps;
8745   return TryInlineApiCall(function,
8746                           receiver,
8747                           &receiver_maps,
8748                           argc,
8749                           expr->id(),
8750                           kCallApiFunction);
8751 }
8752
8753
8754 bool HOptimizedGraphBuilder::TryInlineApiMethodCall(
8755     Call* expr,
8756     HValue* receiver,
8757     SmallMapList* receiver_maps) {
8758   Handle<JSFunction> function = expr->target();
8759   int argc = expr->arguments()->length();
8760   return TryInlineApiCall(function,
8761                           receiver,
8762                           receiver_maps,
8763                           argc,
8764                           expr->id(),
8765                           kCallApiMethod);
8766 }
8767
8768
8769 bool HOptimizedGraphBuilder::TryInlineApiGetter(Handle<JSFunction> function,
8770                                                 Handle<Map> receiver_map,
8771                                                 BailoutId ast_id) {
8772   SmallMapList receiver_maps(1, zone());
8773   receiver_maps.Add(receiver_map, zone());
8774   return TryInlineApiCall(function,
8775                           NULL,  // Receiver is on expression stack.
8776                           &receiver_maps,
8777                           0,
8778                           ast_id,
8779                           kCallApiGetter);
8780 }
8781
8782
8783 bool HOptimizedGraphBuilder::TryInlineApiSetter(Handle<JSFunction> function,
8784                                                 Handle<Map> receiver_map,
8785                                                 BailoutId ast_id) {
8786   SmallMapList receiver_maps(1, zone());
8787   receiver_maps.Add(receiver_map, zone());
8788   return TryInlineApiCall(function,
8789                           NULL,  // Receiver is on expression stack.
8790                           &receiver_maps,
8791                           1,
8792                           ast_id,
8793                           kCallApiSetter);
8794 }
8795
8796
8797 bool HOptimizedGraphBuilder::TryInlineApiCall(Handle<JSFunction> function,
8798                                                HValue* receiver,
8799                                                SmallMapList* receiver_maps,
8800                                                int argc,
8801                                                BailoutId ast_id,
8802                                                ApiCallType call_type) {
8803   CallOptimization optimization(function);
8804   if (!optimization.is_simple_api_call()) return false;
8805   Handle<Map> holder_map;
8806   if (call_type == kCallApiFunction) {
8807     // Cannot embed a direct reference to the global proxy map
8808     // as it maybe dropped on deserialization.
8809     CHECK(!isolate()->serializer_enabled());
8810     ASSERT_EQ(0, receiver_maps->length());
8811     receiver_maps->Add(handle(
8812         function->context()->global_object()->global_receiver()->map()),
8813         zone());
8814   }
8815   CallOptimization::HolderLookup holder_lookup =
8816       CallOptimization::kHolderNotFound;
8817   Handle<JSObject> api_holder = optimization.LookupHolderOfExpectedType(
8818       receiver_maps->first(), &holder_lookup);
8819   if (holder_lookup == CallOptimization::kHolderNotFound) return false;
8820
8821   if (FLAG_trace_inlining) {
8822     PrintF("Inlining api function ");
8823     function->ShortPrint();
8824     PrintF("\n");
8825   }
8826
8827   bool drop_extra = false;
8828   bool is_store = false;
8829   switch (call_type) {
8830     case kCallApiFunction:
8831     case kCallApiMethod:
8832       // Need to check that none of the receiver maps could have changed.
8833       Add<HCheckMaps>(receiver, receiver_maps);
8834       // Need to ensure the chain between receiver and api_holder is intact.
8835       if (holder_lookup == CallOptimization::kHolderFound) {
8836         AddCheckPrototypeMaps(api_holder, receiver_maps->first());
8837       } else {
8838         ASSERT_EQ(holder_lookup, CallOptimization::kHolderIsReceiver);
8839       }
8840       // Includes receiver.
8841       PushArgumentsFromEnvironment(argc + 1);
8842       // Drop function after call.
8843       drop_extra = true;
8844       break;
8845     case kCallApiGetter:
8846       // Receiver and prototype chain cannot have changed.
8847       ASSERT_EQ(0, argc);
8848       ASSERT_EQ(NULL, receiver);
8849       // Receiver is on expression stack.
8850       receiver = Pop();
8851       Add<HPushArguments>(receiver);
8852       break;
8853     case kCallApiSetter:
8854       {
8855         is_store = true;
8856         // Receiver and prototype chain cannot have changed.
8857         ASSERT_EQ(1, argc);
8858         ASSERT_EQ(NULL, receiver);
8859         // Receiver and value are on expression stack.
8860         HValue* value = Pop();
8861         receiver = Pop();
8862         Add<HPushArguments>(receiver, value);
8863         break;
8864      }
8865   }
8866
8867   HValue* holder = NULL;
8868   switch (holder_lookup) {
8869     case CallOptimization::kHolderFound:
8870       holder = Add<HConstant>(api_holder);
8871       break;
8872     case CallOptimization::kHolderIsReceiver:
8873       holder = receiver;
8874       break;
8875     case CallOptimization::kHolderNotFound:
8876       UNREACHABLE();
8877       break;
8878   }
8879   Handle<CallHandlerInfo> api_call_info = optimization.api_call_info();
8880   Handle<Object> call_data_obj(api_call_info->data(), isolate());
8881   bool call_data_is_undefined = call_data_obj->IsUndefined();
8882   HValue* call_data = Add<HConstant>(call_data_obj);
8883   ApiFunction fun(v8::ToCData<Address>(api_call_info->callback()));
8884   ExternalReference ref = ExternalReference(&fun,
8885                                             ExternalReference::DIRECT_API_CALL,
8886                                             isolate());
8887   HValue* api_function_address = Add<HConstant>(ExternalReference(ref));
8888
8889   HValue* op_vals[] = {
8890     Add<HConstant>(function),
8891     call_data,
8892     holder,
8893     api_function_address,
8894     context()
8895   };
8896
8897   CallInterfaceDescriptor* descriptor =
8898       isolate()->call_descriptor(Isolate::ApiFunctionCall);
8899
8900   CallApiFunctionStub stub(isolate(), is_store, call_data_is_undefined, argc);
8901   Handle<Code> code = stub.GetCode();
8902   HConstant* code_value = Add<HConstant>(code);
8903
8904   ASSERT((sizeof(op_vals) / kPointerSize) ==
8905          descriptor->environment_length());
8906
8907   HInstruction* call = New<HCallWithDescriptor>(
8908       code_value, argc + 1, descriptor,
8909       Vector<HValue*>(op_vals, descriptor->environment_length()));
8910
8911   if (drop_extra) Drop(1);  // Drop function.
8912   ast_context()->ReturnInstruction(call, ast_id);
8913   return true;
8914 }
8915
8916
8917 bool HOptimizedGraphBuilder::TryCallApply(Call* expr) {
8918   ASSERT(expr->expression()->IsProperty());
8919
8920   if (!expr->IsMonomorphic()) {
8921     return false;
8922   }
8923   Handle<Map> function_map = expr->GetReceiverTypes()->first();
8924   if (function_map->instance_type() != JS_FUNCTION_TYPE ||
8925       !expr->target()->shared()->HasBuiltinFunctionId() ||
8926       expr->target()->shared()->builtin_function_id() != kFunctionApply) {
8927     return false;
8928   }
8929
8930   if (current_info()->scope()->arguments() == NULL) return false;
8931
8932   ZoneList<Expression*>* args = expr->arguments();
8933   if (args->length() != 2) return false;
8934
8935   VariableProxy* arg_two = args->at(1)->AsVariableProxy();
8936   if (arg_two == NULL || !arg_two->var()->IsStackAllocated()) return false;
8937   HValue* arg_two_value = LookupAndMakeLive(arg_two->var());
8938   if (!arg_two_value->CheckFlag(HValue::kIsArguments)) return false;
8939
8940   // Found pattern f.apply(receiver, arguments).
8941   CHECK_ALIVE_OR_RETURN(VisitForValue(args->at(0)), true);
8942   HValue* receiver = Pop();  // receiver
8943   HValue* function = Pop();  // f
8944   Drop(1);  // apply
8945
8946   HValue* checked_function = AddCheckMap(function, function_map);
8947
8948   if (function_state()->outer() == NULL) {
8949     HInstruction* elements = Add<HArgumentsElements>(false);
8950     HInstruction* length = Add<HArgumentsLength>(elements);
8951     HValue* wrapped_receiver = BuildWrapReceiver(receiver, checked_function);
8952     HInstruction* result = New<HApplyArguments>(function,
8953                                                 wrapped_receiver,
8954                                                 length,
8955                                                 elements);
8956     ast_context()->ReturnInstruction(result, expr->id());
8957     return true;
8958   } else {
8959     // We are inside inlined function and we know exactly what is inside
8960     // arguments object. But we need to be able to materialize at deopt.
8961     ASSERT_EQ(environment()->arguments_environment()->parameter_count(),
8962               function_state()->entry()->arguments_object()->arguments_count());
8963     HArgumentsObject* args = function_state()->entry()->arguments_object();
8964     const ZoneList<HValue*>* arguments_values = args->arguments_values();
8965     int arguments_count = arguments_values->length();
8966     Push(function);
8967     Push(BuildWrapReceiver(receiver, checked_function));
8968     for (int i = 1; i < arguments_count; i++) {
8969       Push(arguments_values->at(i));
8970     }
8971
8972     Handle<JSFunction> known_function;
8973     if (function->IsConstant() &&
8974         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
8975       known_function = Handle<JSFunction>::cast(
8976           HConstant::cast(function)->handle(isolate()));
8977       int args_count = arguments_count - 1;  // Excluding receiver.
8978       if (TryInlineApply(known_function, expr, args_count)) return true;
8979     }
8980
8981     PushArgumentsFromEnvironment(arguments_count);
8982     HInvokeFunction* call = New<HInvokeFunction>(
8983         function, known_function, arguments_count);
8984     Drop(1);  // Function.
8985     ast_context()->ReturnInstruction(call, expr->id());
8986     return true;
8987   }
8988 }
8989
8990
8991 HValue* HOptimizedGraphBuilder::ImplicitReceiverFor(HValue* function,
8992                                                     Handle<JSFunction> target) {
8993   SharedFunctionInfo* shared = target->shared();
8994   if (shared->strict_mode() == SLOPPY && !shared->native()) {
8995     // Cannot embed a direct reference to the global proxy
8996     // as is it dropped on deserialization.
8997     CHECK(!isolate()->serializer_enabled());
8998     Handle<JSObject> global_receiver(
8999         target->context()->global_object()->global_receiver());
9000     return Add<HConstant>(global_receiver);
9001   }
9002   return graph()->GetConstantUndefined();
9003 }
9004
9005
9006 void HOptimizedGraphBuilder::BuildArrayCall(Expression* expression,
9007                                             int arguments_count,
9008                                             HValue* function,
9009                                             Handle<AllocationSite> site) {
9010   Add<HCheckValue>(function, array_function());
9011
9012   if (IsCallArrayInlineable(arguments_count, site)) {
9013     BuildInlinedCallArray(expression, arguments_count, site);
9014     return;
9015   }
9016
9017   HInstruction* call = PreProcessCall(New<HCallNewArray>(
9018       function, arguments_count + 1, site->GetElementsKind()));
9019   if (expression->IsCall()) {
9020     Drop(1);
9021   }
9022   ast_context()->ReturnInstruction(call, expression->id());
9023 }
9024
9025
9026 HValue* HOptimizedGraphBuilder::BuildArrayIndexOf(HValue* receiver,
9027                                                   HValue* search_element,
9028                                                   ElementsKind kind,
9029                                                   ArrayIndexOfMode mode) {
9030   ASSERT(IsFastElementsKind(kind));
9031
9032   NoObservableSideEffectsScope no_effects(this);
9033
9034   HValue* elements = AddLoadElements(receiver);
9035   HValue* length = AddLoadArrayLength(receiver, kind);
9036
9037   HValue* initial;
9038   HValue* terminating;
9039   Token::Value token;
9040   LoopBuilder::Direction direction;
9041   if (mode == kFirstIndexOf) {
9042     initial = graph()->GetConstant0();
9043     terminating = length;
9044     token = Token::LT;
9045     direction = LoopBuilder::kPostIncrement;
9046   } else {
9047     ASSERT_EQ(kLastIndexOf, mode);
9048     initial = length;
9049     terminating = graph()->GetConstant0();
9050     token = Token::GT;
9051     direction = LoopBuilder::kPreDecrement;
9052   }
9053
9054   Push(graph()->GetConstantMinus1());
9055   if (IsFastDoubleElementsKind(kind) || IsFastSmiElementsKind(kind)) {
9056     LoopBuilder loop(this, context(), direction);
9057     {
9058       HValue* index = loop.BeginBody(initial, terminating, token);
9059       HValue* element = AddUncasted<HLoadKeyed>(
9060           elements, index, static_cast<HValue*>(NULL),
9061           kind, ALLOW_RETURN_HOLE);
9062       IfBuilder if_issame(this);
9063       if (IsFastDoubleElementsKind(kind)) {
9064         if_issame.If<HCompareNumericAndBranch>(
9065             element, search_element, Token::EQ_STRICT);
9066       } else {
9067         if_issame.If<HCompareObjectEqAndBranch>(element, search_element);
9068       }
9069       if_issame.Then();
9070       {
9071         Drop(1);
9072         Push(index);
9073         loop.Break();
9074       }
9075       if_issame.End();
9076     }
9077     loop.EndBody();
9078   } else {
9079     IfBuilder if_isstring(this);
9080     if_isstring.If<HIsStringAndBranch>(search_element);
9081     if_isstring.Then();
9082     {
9083       LoopBuilder loop(this, context(), direction);
9084       {
9085         HValue* index = loop.BeginBody(initial, terminating, token);
9086         HValue* element = AddUncasted<HLoadKeyed>(
9087             elements, index, static_cast<HValue*>(NULL),
9088             kind, ALLOW_RETURN_HOLE);
9089         IfBuilder if_issame(this);
9090         if_issame.If<HIsStringAndBranch>(element);
9091         if_issame.AndIf<HStringCompareAndBranch>(
9092             element, search_element, Token::EQ_STRICT);
9093         if_issame.Then();
9094         {
9095           Drop(1);
9096           Push(index);
9097           loop.Break();
9098         }
9099         if_issame.End();
9100       }
9101       loop.EndBody();
9102     }
9103     if_isstring.Else();
9104     {
9105       IfBuilder if_isnumber(this);
9106       if_isnumber.If<HIsSmiAndBranch>(search_element);
9107       if_isnumber.OrIf<HCompareMap>(
9108           search_element, isolate()->factory()->heap_number_map());
9109       if_isnumber.Then();
9110       {
9111         HValue* search_number =
9112             AddUncasted<HForceRepresentation>(search_element,
9113                                               Representation::Double());
9114         LoopBuilder loop(this, context(), direction);
9115         {
9116           HValue* index = loop.BeginBody(initial, terminating, token);
9117           HValue* element = AddUncasted<HLoadKeyed>(
9118               elements, index, static_cast<HValue*>(NULL),
9119               kind, ALLOW_RETURN_HOLE);
9120
9121           IfBuilder if_element_isnumber(this);
9122           if_element_isnumber.If<HIsSmiAndBranch>(element);
9123           if_element_isnumber.OrIf<HCompareMap>(
9124               element, isolate()->factory()->heap_number_map());
9125           if_element_isnumber.Then();
9126           {
9127             HValue* number =
9128                 AddUncasted<HForceRepresentation>(element,
9129                                                   Representation::Double());
9130             IfBuilder if_issame(this);
9131             if_issame.If<HCompareNumericAndBranch>(
9132                 number, search_number, Token::EQ_STRICT);
9133             if_issame.Then();
9134             {
9135               Drop(1);
9136               Push(index);
9137               loop.Break();
9138             }
9139             if_issame.End();
9140           }
9141           if_element_isnumber.End();
9142         }
9143         loop.EndBody();
9144       }
9145       if_isnumber.Else();
9146       {
9147         LoopBuilder loop(this, context(), direction);
9148         {
9149           HValue* index = loop.BeginBody(initial, terminating, token);
9150           HValue* element = AddUncasted<HLoadKeyed>(
9151               elements, index, static_cast<HValue*>(NULL),
9152               kind, ALLOW_RETURN_HOLE);
9153           IfBuilder if_issame(this);
9154           if_issame.If<HCompareObjectEqAndBranch>(
9155               element, search_element);
9156           if_issame.Then();
9157           {
9158             Drop(1);
9159             Push(index);
9160             loop.Break();
9161           }
9162           if_issame.End();
9163         }
9164         loop.EndBody();
9165       }
9166       if_isnumber.End();
9167     }
9168     if_isstring.End();
9169   }
9170
9171   return Pop();
9172 }
9173
9174
9175 bool HOptimizedGraphBuilder::TryHandleArrayCall(Call* expr, HValue* function) {
9176   if (!array_function().is_identical_to(expr->target())) {
9177     return false;
9178   }
9179
9180   Handle<AllocationSite> site = expr->allocation_site();
9181   if (site.is_null()) return false;
9182
9183   BuildArrayCall(expr,
9184                  expr->arguments()->length(),
9185                  function,
9186                  site);
9187   return true;
9188 }
9189
9190
9191 bool HOptimizedGraphBuilder::TryHandleArrayCallNew(CallNew* expr,
9192                                                    HValue* function) {
9193   if (!array_function().is_identical_to(expr->target())) {
9194     return false;
9195   }
9196
9197   BuildArrayCall(expr,
9198                  expr->arguments()->length(),
9199                  function,
9200                  expr->allocation_site());
9201   return true;
9202 }
9203
9204
9205 void HOptimizedGraphBuilder::VisitCall(Call* expr) {
9206   ASSERT(!HasStackOverflow());
9207   ASSERT(current_block() != NULL);
9208   ASSERT(current_block()->HasPredecessor());
9209   Expression* callee = expr->expression();
9210   int argument_count = expr->arguments()->length() + 1;  // Plus receiver.
9211   HInstruction* call = NULL;
9212
9213   Property* prop = callee->AsProperty();
9214   if (prop != NULL) {
9215     CHECK_ALIVE(VisitForValue(prop->obj()));
9216     HValue* receiver = Top();
9217
9218     SmallMapList* types;
9219     ComputeReceiverTypes(expr, receiver, &types, zone());
9220
9221     if (prop->key()->IsPropertyName() && types->length() > 0) {
9222       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
9223       PropertyAccessInfo info(this, LOAD, ToType(types->first()), name,
9224                               types->first()->instance_type());
9225       if (!info.CanAccessAsMonomorphic(types)) {
9226         HandlePolymorphicCallNamed(expr, receiver, types, name);
9227         return;
9228       }
9229     }
9230
9231     HValue* key = NULL;
9232     if (!prop->key()->IsPropertyName()) {
9233       CHECK_ALIVE(VisitForValue(prop->key()));
9234       key = Pop();
9235     }
9236
9237     CHECK_ALIVE(PushLoad(prop, receiver, key));
9238     HValue* function = Pop();
9239
9240     if (FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
9241
9242     // Push the function under the receiver.
9243     environment()->SetExpressionStackAt(0, function);
9244
9245     Push(receiver);
9246
9247     if (function->IsConstant() &&
9248         HConstant::cast(function)->handle(isolate())->IsJSFunction()) {
9249       Handle<JSFunction> known_function = Handle<JSFunction>::cast(
9250           HConstant::cast(function)->handle(isolate()));
9251       expr->set_target(known_function);
9252
9253       if (TryCallApply(expr)) return;
9254       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9255
9256       Handle<Map> map = types->length() == 1 ? types->first() : Handle<Map>();
9257       if (TryInlineBuiltinMethodCall(expr, receiver, map)) {
9258         if (FLAG_trace_inlining) {
9259           PrintF("Inlining builtin ");
9260           known_function->ShortPrint();
9261           PrintF("\n");
9262         }
9263         return;
9264       }
9265       if (TryInlineApiMethodCall(expr, receiver, types)) return;
9266
9267       // Wrap the receiver if necessary.
9268       if (NeedsWrappingFor(ToType(types->first()), known_function)) {
9269         // Since HWrapReceiver currently cannot actually wrap numbers and
9270         // strings, use the regular CallFunctionStub for method calls to wrap
9271         // the receiver.
9272         // TODO(verwaest): Support creation of value wrappers directly in
9273         // HWrapReceiver.
9274         call = New<HCallFunction>(
9275             function, argument_count, WRAP_AND_CALL);
9276       } else if (TryInlineCall(expr)) {
9277         return;
9278       } else {
9279         call = BuildCallConstantFunction(known_function, argument_count);
9280       }
9281
9282     } else {
9283       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9284       CallFunctionFlags flags = receiver->type().IsJSObject()
9285           ? NO_CALL_FUNCTION_FLAGS : CALL_AS_METHOD;
9286       call = New<HCallFunction>(function, argument_count, flags);
9287     }
9288     PushArgumentsFromEnvironment(argument_count);
9289
9290   } else {
9291     VariableProxy* proxy = expr->expression()->AsVariableProxy();
9292     if (proxy != NULL && proxy->var()->is_possibly_eval(isolate())) {
9293       return Bailout(kPossibleDirectCallToEval);
9294     }
9295
9296     // The function is on the stack in the unoptimized code during
9297     // evaluation of the arguments.
9298     CHECK_ALIVE(VisitForValue(expr->expression()));
9299     HValue* function = Top();
9300     if (expr->global_call()) {
9301       Variable* var = proxy->var();
9302       bool known_global_function = false;
9303       // If there is a global property cell for the name at compile time and
9304       // access check is not enabled we assume that the function will not change
9305       // and generate optimized code for calling the function.
9306       LookupResult lookup(isolate());
9307       GlobalPropertyAccess type = LookupGlobalProperty(var, &lookup, LOAD);
9308       if (type == kUseCell &&
9309           !current_info()->global_object()->IsAccessCheckNeeded()) {
9310         Handle<GlobalObject> global(current_info()->global_object());
9311         known_global_function = expr->ComputeGlobalTarget(global, &lookup);
9312       }
9313       if (known_global_function) {
9314         Add<HCheckValue>(function, expr->target());
9315
9316         // Placeholder for the receiver.
9317         Push(graph()->GetConstantUndefined());
9318         CHECK_ALIVE(VisitExpressions(expr->arguments()));
9319
9320         // Patch the global object on the stack by the expected receiver.
9321         HValue* receiver = ImplicitReceiverFor(function, expr->target());
9322         const int receiver_index = argument_count - 1;
9323         environment()->SetExpressionStackAt(receiver_index, receiver);
9324
9325         if (TryInlineBuiltinFunctionCall(expr)) {
9326           if (FLAG_trace_inlining) {
9327             PrintF("Inlining builtin ");
9328             expr->target()->ShortPrint();
9329             PrintF("\n");
9330           }
9331           return;
9332         }
9333         if (TryInlineApiFunctionCall(expr, receiver)) return;
9334         if (TryHandleArrayCall(expr, function)) return;
9335         if (TryInlineCall(expr)) return;
9336
9337         PushArgumentsFromEnvironment(argument_count);
9338         call = BuildCallConstantFunction(expr->target(), argument_count);
9339       } else {
9340         Push(graph()->GetConstantUndefined());
9341         CHECK_ALIVE(VisitExpressions(expr->arguments()));
9342         PushArgumentsFromEnvironment(argument_count);
9343         call = New<HCallFunction>(function, argument_count);
9344       }
9345
9346     } else if (expr->IsMonomorphic()) {
9347       Add<HCheckValue>(function, expr->target());
9348
9349       Push(graph()->GetConstantUndefined());
9350       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9351
9352       HValue* receiver = ImplicitReceiverFor(function, expr->target());
9353       const int receiver_index = argument_count - 1;
9354       environment()->SetExpressionStackAt(receiver_index, receiver);
9355
9356       if (TryInlineBuiltinFunctionCall(expr)) {
9357         if (FLAG_trace_inlining) {
9358           PrintF("Inlining builtin ");
9359           expr->target()->ShortPrint();
9360           PrintF("\n");
9361         }
9362         return;
9363       }
9364       if (TryInlineApiFunctionCall(expr, receiver)) return;
9365
9366       if (TryInlineCall(expr)) return;
9367
9368       call = PreProcessCall(New<HInvokeFunction>(
9369           function, expr->target(), argument_count));
9370
9371     } else {
9372       Push(graph()->GetConstantUndefined());
9373       CHECK_ALIVE(VisitExpressions(expr->arguments()));
9374       PushArgumentsFromEnvironment(argument_count);
9375       call = New<HCallFunction>(function, argument_count);
9376     }
9377   }
9378
9379   Drop(1);  // Drop the function.
9380   return ast_context()->ReturnInstruction(call, expr->id());
9381 }
9382
9383
9384 void HOptimizedGraphBuilder::BuildInlinedCallArray(
9385     Expression* expression,
9386     int argument_count,
9387     Handle<AllocationSite> site) {
9388   ASSERT(!site.is_null());
9389   ASSERT(argument_count >= 0 && argument_count <= 1);
9390   NoObservableSideEffectsScope no_effects(this);
9391
9392   // We should at least have the constructor on the expression stack.
9393   HValue* constructor = environment()->ExpressionStackAt(argument_count);
9394
9395   // Register on the site for deoptimization if the transition feedback changes.
9396   AllocationSite::AddDependentCompilationInfo(
9397       site, AllocationSite::TRANSITIONS, top_info());
9398   ElementsKind kind = site->GetElementsKind();
9399   HInstruction* site_instruction = Add<HConstant>(site);
9400
9401   // In the single constant argument case, we may have to adjust elements kind
9402   // to avoid creating a packed non-empty array.
9403   if (argument_count == 1 && !IsHoleyElementsKind(kind)) {
9404     HValue* argument = environment()->Top();
9405     if (argument->IsConstant()) {
9406       HConstant* constant_argument = HConstant::cast(argument);
9407       ASSERT(constant_argument->HasSmiValue());
9408       int constant_array_size = constant_argument->Integer32Value();
9409       if (constant_array_size != 0) {
9410         kind = GetHoleyElementsKind(kind);
9411       }
9412     }
9413   }
9414
9415   // Build the array.
9416   JSArrayBuilder array_builder(this,
9417                                kind,
9418                                site_instruction,
9419                                constructor,
9420                                DISABLE_ALLOCATION_SITES);
9421   HValue* new_object = argument_count == 0
9422       ? array_builder.AllocateEmptyArray()
9423       : BuildAllocateArrayFromLength(&array_builder, Top());
9424
9425   int args_to_drop = argument_count + (expression->IsCall() ? 2 : 1);
9426   Drop(args_to_drop);
9427   ast_context()->ReturnValue(new_object);
9428 }
9429
9430
9431 // Checks whether allocation using the given constructor can be inlined.
9432 static bool IsAllocationInlineable(Handle<JSFunction> constructor) {
9433   return constructor->has_initial_map() &&
9434       constructor->initial_map()->instance_type() == JS_OBJECT_TYPE &&
9435       constructor->initial_map()->instance_size() < HAllocate::kMaxInlineSize &&
9436       constructor->initial_map()->InitialPropertiesLength() == 0;
9437 }
9438
9439
9440 bool HOptimizedGraphBuilder::IsCallArrayInlineable(
9441     int argument_count,
9442     Handle<AllocationSite> site) {
9443   Handle<JSFunction> caller = current_info()->closure();
9444   Handle<JSFunction> target = array_function();
9445   // We should have the function plus array arguments on the environment stack.
9446   ASSERT(environment()->length() >= (argument_count + 1));
9447   ASSERT(!site.is_null());
9448
9449   bool inline_ok = false;
9450   if (site->CanInlineCall()) {
9451     // We also want to avoid inlining in certain 1 argument scenarios.
9452     if (argument_count == 1) {
9453       HValue* argument = Top();
9454       if (argument->IsConstant()) {
9455         // Do not inline if the constant length argument is not a smi or
9456         // outside the valid range for unrolled loop initialization.
9457         HConstant* constant_argument = HConstant::cast(argument);
9458         if (constant_argument->HasSmiValue()) {
9459           int value = constant_argument->Integer32Value();
9460           inline_ok = value >= 0 && value <= kElementLoopUnrollThreshold;
9461           if (!inline_ok) {
9462             TraceInline(target, caller,
9463                         "Constant length outside of valid inlining range.");
9464           }
9465         }
9466       } else {
9467         TraceInline(target, caller,
9468                     "Dont inline [new] Array(n) where n isn't constant.");
9469       }
9470     } else if (argument_count == 0) {
9471       inline_ok = true;
9472     } else {
9473       TraceInline(target, caller, "Too many arguments to inline.");
9474     }
9475   } else {
9476     TraceInline(target, caller, "AllocationSite requested no inlining.");
9477   }
9478
9479   if (inline_ok) {
9480     TraceInline(target, caller, NULL);
9481   }
9482   return inline_ok;
9483 }
9484
9485
9486 void HOptimizedGraphBuilder::VisitCallNew(CallNew* expr) {
9487   ASSERT(!HasStackOverflow());
9488   ASSERT(current_block() != NULL);
9489   ASSERT(current_block()->HasPredecessor());
9490   if (!FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
9491   int argument_count = expr->arguments()->length() + 1;  // Plus constructor.
9492   Factory* factory = isolate()->factory();
9493
9494   // The constructor function is on the stack in the unoptimized code
9495   // during evaluation of the arguments.
9496   CHECK_ALIVE(VisitForValue(expr->expression()));
9497   HValue* function = Top();
9498   CHECK_ALIVE(VisitExpressions(expr->arguments()));
9499
9500   if (FLAG_inline_construct &&
9501       expr->IsMonomorphic() &&
9502       IsAllocationInlineable(expr->target())) {
9503     Handle<JSFunction> constructor = expr->target();
9504     HValue* check = Add<HCheckValue>(function, constructor);
9505
9506     // Force completion of inobject slack tracking before generating
9507     // allocation code to finalize instance size.
9508     if (constructor->IsInobjectSlackTrackingInProgress()) {
9509       constructor->CompleteInobjectSlackTracking();
9510     }
9511
9512     // Calculate instance size from initial map of constructor.
9513     ASSERT(constructor->has_initial_map());
9514     Handle<Map> initial_map(constructor->initial_map());
9515     int instance_size = initial_map->instance_size();
9516     ASSERT(initial_map->InitialPropertiesLength() == 0);
9517
9518     // Allocate an instance of the implicit receiver object.
9519     HValue* size_in_bytes = Add<HConstant>(instance_size);
9520     HAllocationMode allocation_mode;
9521     if (FLAG_pretenuring_call_new) {
9522       if (FLAG_allocation_site_pretenuring) {
9523         // Try to use pretenuring feedback.
9524         Handle<AllocationSite> allocation_site = expr->allocation_site();
9525         allocation_mode = HAllocationMode(allocation_site);
9526         // Take a dependency on allocation site.
9527         AllocationSite::AddDependentCompilationInfo(allocation_site,
9528                                                     AllocationSite::TENURING,
9529                                                     top_info());
9530       }
9531     }
9532
9533     HAllocate* receiver = BuildAllocate(
9534         size_in_bytes, HType::JSObject(), JS_OBJECT_TYPE, allocation_mode);
9535     receiver->set_known_initial_map(initial_map);
9536
9537     // Initialize map and fields of the newly allocated object.
9538     { NoObservableSideEffectsScope no_effects(this);
9539       ASSERT(initial_map->instance_type() == JS_OBJECT_TYPE);
9540       Add<HStoreNamedField>(receiver,
9541           HObjectAccess::ForMapAndOffset(initial_map, JSObject::kMapOffset),
9542           Add<HConstant>(initial_map));
9543       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
9544       Add<HStoreNamedField>(receiver,
9545           HObjectAccess::ForMapAndOffset(initial_map,
9546                                          JSObject::kPropertiesOffset),
9547           empty_fixed_array);
9548       Add<HStoreNamedField>(receiver,
9549           HObjectAccess::ForMapAndOffset(initial_map,
9550                                          JSObject::kElementsOffset),
9551           empty_fixed_array);
9552       if (initial_map->inobject_properties() != 0) {
9553         HConstant* undefined = graph()->GetConstantUndefined();
9554         for (int i = 0; i < initial_map->inobject_properties(); i++) {
9555           int property_offset = initial_map->GetInObjectPropertyOffset(i);
9556           Add<HStoreNamedField>(receiver,
9557               HObjectAccess::ForMapAndOffset(initial_map, property_offset),
9558               undefined);
9559         }
9560       }
9561     }
9562
9563     // Replace the constructor function with a newly allocated receiver using
9564     // the index of the receiver from the top of the expression stack.
9565     const int receiver_index = argument_count - 1;
9566     ASSERT(environment()->ExpressionStackAt(receiver_index) == function);
9567     environment()->SetExpressionStackAt(receiver_index, receiver);
9568
9569     if (TryInlineConstruct(expr, receiver)) {
9570       // Inlining worked, add a dependency on the initial map to make sure that
9571       // this code is deoptimized whenever the initial map of the constructor
9572       // changes.
9573       Map::AddDependentCompilationInfo(
9574           initial_map, DependentCode::kInitialMapChangedGroup, top_info());
9575       return;
9576     }
9577
9578     // TODO(mstarzinger): For now we remove the previous HAllocate and all
9579     // corresponding instructions and instead add HPushArguments for the
9580     // arguments in case inlining failed.  What we actually should do is for
9581     // inlining to try to build a subgraph without mutating the parent graph.
9582     HInstruction* instr = current_block()->last();
9583     do {
9584       HInstruction* prev_instr = instr->previous();
9585       instr->DeleteAndReplaceWith(NULL);
9586       instr = prev_instr;
9587     } while (instr != check);
9588     environment()->SetExpressionStackAt(receiver_index, function);
9589     HInstruction* call =
9590       PreProcessCall(New<HCallNew>(function, argument_count));
9591     return ast_context()->ReturnInstruction(call, expr->id());
9592   } else {
9593     // The constructor function is both an operand to the instruction and an
9594     // argument to the construct call.
9595     if (TryHandleArrayCallNew(expr, function)) return;
9596
9597     HInstruction* call =
9598         PreProcessCall(New<HCallNew>(function, argument_count));
9599     return ast_context()->ReturnInstruction(call, expr->id());
9600   }
9601 }
9602
9603
9604 // Support for generating inlined runtime functions.
9605
9606 // Lookup table for generators for runtime calls that are generated inline.
9607 // Elements of the table are member pointers to functions of
9608 // HOptimizedGraphBuilder.
9609 #define INLINE_FUNCTION_GENERATOR_ADDRESS(Name, argc, ressize)  \
9610     &HOptimizedGraphBuilder::Generate##Name,
9611
9612 const HOptimizedGraphBuilder::InlineFunctionGenerator
9613     HOptimizedGraphBuilder::kInlineFunctionGenerators[] = {
9614         INLINE_FUNCTION_LIST(INLINE_FUNCTION_GENERATOR_ADDRESS)
9615         INLINE_OPTIMIZED_FUNCTION_LIST(INLINE_FUNCTION_GENERATOR_ADDRESS)
9616 };
9617 #undef INLINE_FUNCTION_GENERATOR_ADDRESS
9618
9619
9620 template <class ViewClass>
9621 void HGraphBuilder::BuildArrayBufferViewInitialization(
9622     HValue* obj,
9623     HValue* buffer,
9624     HValue* byte_offset,
9625     HValue* byte_length) {
9626
9627   for (int offset = ViewClass::kSize;
9628        offset < ViewClass::kSizeWithInternalFields;
9629        offset += kPointerSize) {
9630     Add<HStoreNamedField>(obj,
9631         HObjectAccess::ForObservableJSObjectOffset(offset),
9632         graph()->GetConstant0());
9633   }
9634
9635   Add<HStoreNamedField>(
9636       obj,
9637       HObjectAccess::ForJSArrayBufferViewByteOffset(),
9638       byte_offset);
9639   Add<HStoreNamedField>(
9640       obj,
9641       HObjectAccess::ForJSArrayBufferViewByteLength(),
9642       byte_length);
9643
9644   if (buffer != NULL) {
9645     Add<HStoreNamedField>(
9646         obj,
9647         HObjectAccess::ForJSArrayBufferViewBuffer(), buffer);
9648     HObjectAccess weak_first_view_access =
9649         HObjectAccess::ForJSArrayBufferWeakFirstView();
9650     Add<HStoreNamedField>(obj,
9651         HObjectAccess::ForJSArrayBufferViewWeakNext(),
9652         Add<HLoadNamedField>(buffer,
9653                              static_cast<HValue*>(NULL),
9654                              weak_first_view_access));
9655     Add<HStoreNamedField>(buffer, weak_first_view_access, obj);
9656   } else {
9657     Add<HStoreNamedField>(
9658         obj,
9659         HObjectAccess::ForJSArrayBufferViewBuffer(),
9660         Add<HConstant>(static_cast<int32_t>(0)));
9661     Add<HStoreNamedField>(obj,
9662         HObjectAccess::ForJSArrayBufferViewWeakNext(),
9663         graph()->GetConstantUndefined());
9664   }
9665 }
9666
9667
9668 void HOptimizedGraphBuilder::GenerateDataViewInitialize(
9669     CallRuntime* expr) {
9670   ZoneList<Expression*>* arguments = expr->arguments();
9671
9672   ASSERT(arguments->length()== 4);
9673   CHECK_ALIVE(VisitForValue(arguments->at(0)));
9674   HValue* obj = Pop();
9675
9676   CHECK_ALIVE(VisitForValue(arguments->at(1)));
9677   HValue* buffer = Pop();
9678
9679   CHECK_ALIVE(VisitForValue(arguments->at(2)));
9680   HValue* byte_offset = Pop();
9681
9682   CHECK_ALIVE(VisitForValue(arguments->at(3)));
9683   HValue* byte_length = Pop();
9684
9685   {
9686     NoObservableSideEffectsScope scope(this);
9687     BuildArrayBufferViewInitialization<JSDataView>(
9688         obj, buffer, byte_offset, byte_length);
9689   }
9690 }
9691
9692
9693 static Handle<Map> TypedArrayMap(Isolate* isolate,
9694                                  ExternalArrayType array_type,
9695                                  ElementsKind target_kind) {
9696   Handle<Context> native_context = isolate->native_context();
9697   Handle<JSFunction> fun;
9698   switch (array_type) {
9699 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size)                       \
9700     case kExternal##Type##Array:                                              \
9701       fun = Handle<JSFunction>(native_context->type##_array_fun());           \
9702       break;
9703
9704     TYPED_ARRAYS(TYPED_ARRAY_CASE)
9705 #undef TYPED_ARRAY_CASE
9706   }
9707   Handle<Map> map(fun->initial_map());
9708   return Map::AsElementsKind(map, target_kind);
9709 }
9710
9711
9712 HValue* HOptimizedGraphBuilder::BuildAllocateExternalElements(
9713     ExternalArrayType array_type,
9714     bool is_zero_byte_offset,
9715     HValue* buffer, HValue* byte_offset, HValue* length) {
9716   Handle<Map> external_array_map(
9717       isolate()->heap()->MapForExternalArrayType(array_type));
9718
9719   // The HForceRepresentation is to prevent possible deopt on int-smi
9720   // conversion after allocation but before the new object fields are set.
9721   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
9722   HValue* elements =
9723       Add<HAllocate>(
9724           Add<HConstant>(ExternalArray::kAlignedSize),
9725           HType::HeapObject(),
9726           NOT_TENURED,
9727           external_array_map->instance_type());
9728
9729   AddStoreMapConstant(elements, external_array_map);
9730   Add<HStoreNamedField>(elements,
9731       HObjectAccess::ForFixedArrayLength(), length);
9732
9733   HValue* backing_store = Add<HLoadNamedField>(
9734       buffer, static_cast<HValue*>(NULL),
9735       HObjectAccess::ForJSArrayBufferBackingStore());
9736
9737   HValue* typed_array_start;
9738   if (is_zero_byte_offset) {
9739     typed_array_start = backing_store;
9740   } else {
9741     HInstruction* external_pointer =
9742         AddUncasted<HAdd>(backing_store, byte_offset);
9743     // Arguments are checked prior to call to TypedArrayInitialize,
9744     // including byte_offset.
9745     external_pointer->ClearFlag(HValue::kCanOverflow);
9746     typed_array_start = external_pointer;
9747   }
9748
9749   Add<HStoreNamedField>(elements,
9750       HObjectAccess::ForExternalArrayExternalPointer(),
9751       typed_array_start);
9752
9753   return elements;
9754 }
9755
9756
9757 HValue* HOptimizedGraphBuilder::BuildAllocateFixedTypedArray(
9758     ExternalArrayType array_type, size_t element_size,
9759     ElementsKind fixed_elements_kind,
9760     HValue* byte_length, HValue* length) {
9761   STATIC_ASSERT(
9762       (FixedTypedArrayBase::kHeaderSize & kObjectAlignmentMask) == 0);
9763   HValue* total_size;
9764
9765   // if fixed array's elements are not aligned to object's alignment,
9766   // we need to align the whole array to object alignment.
9767   if (element_size % kObjectAlignment != 0) {
9768     total_size = BuildObjectSizeAlignment(
9769         byte_length, FixedTypedArrayBase::kHeaderSize);
9770   } else {
9771     total_size = AddUncasted<HAdd>(byte_length,
9772         Add<HConstant>(FixedTypedArrayBase::kHeaderSize));
9773     total_size->ClearFlag(HValue::kCanOverflow);
9774   }
9775
9776   // The HForceRepresentation is to prevent possible deopt on int-smi
9777   // conversion after allocation but before the new object fields are set.
9778   length = AddUncasted<HForceRepresentation>(length, Representation::Smi());
9779   Handle<Map> fixed_typed_array_map(
9780       isolate()->heap()->MapForFixedTypedArray(array_type));
9781   HValue* elements =
9782       Add<HAllocate>(total_size, HType::HeapObject(),
9783                      NOT_TENURED, fixed_typed_array_map->instance_type());
9784   AddStoreMapConstant(elements, fixed_typed_array_map);
9785
9786   Add<HStoreNamedField>(elements,
9787       HObjectAccess::ForFixedArrayLength(),
9788       length);
9789
9790   HValue* filler = Add<HConstant>(static_cast<int32_t>(0));
9791   if (IsFixedFloat32x4ElementsKind(fixed_elements_kind)) {
9792     filler = AddUncasted<HNullarySIMDOperation>(kFloat32x4Zero);
9793   } else if (IsFixedFloat64x2ElementsKind(fixed_elements_kind)) {
9794     filler = AddUncasted<HNullarySIMDOperation>(kFloat64x2Zero);
9795   } else if (IsFixedInt32x4ElementsKind(fixed_elements_kind)) {
9796     filler = AddUncasted<HNullarySIMDOperation>(kInt32x4Zero);
9797   }
9798
9799   {
9800     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
9801
9802     HValue* key = builder.BeginBody(
9803         Add<HConstant>(static_cast<int32_t>(0)),
9804         length, Token::LT);
9805     Add<HStoreKeyed>(elements, key, filler, fixed_elements_kind);
9806
9807     builder.EndBody();
9808   }
9809   return elements;
9810 }
9811
9812
9813 void HOptimizedGraphBuilder::GenerateTypedArrayInitialize(
9814     CallRuntime* expr) {
9815   ZoneList<Expression*>* arguments = expr->arguments();
9816
9817   static const int kObjectArg = 0;
9818   static const int kArrayIdArg = 1;
9819   static const int kBufferArg = 2;
9820   static const int kByteOffsetArg = 3;
9821   static const int kByteLengthArg = 4;
9822   static const int kArgsLength = 5;
9823   ASSERT(arguments->length() == kArgsLength);
9824
9825
9826   CHECK_ALIVE(VisitForValue(arguments->at(kObjectArg)));
9827   HValue* obj = Pop();
9828
9829   if (arguments->at(kArrayIdArg)->IsLiteral()) {
9830     // This should never happen in real use, but can happen when fuzzing.
9831     // Just bail out.
9832     Bailout(kNeedSmiLiteral);
9833     return;
9834   }
9835   Handle<Object> value =
9836       static_cast<Literal*>(arguments->at(kArrayIdArg))->value();
9837   if (!value->IsSmi()) {
9838     // This should never happen in real use, but can happen when fuzzing.
9839     // Just bail out.
9840     Bailout(kNeedSmiLiteral);
9841     return;
9842   }
9843   int array_id = Smi::cast(*value)->value();
9844
9845   HValue* buffer;
9846   if (!arguments->at(kBufferArg)->IsNullLiteral()) {
9847     CHECK_ALIVE(VisitForValue(arguments->at(kBufferArg)));
9848     buffer = Pop();
9849   } else {
9850     buffer = NULL;
9851   }
9852
9853   HValue* byte_offset;
9854   bool is_zero_byte_offset;
9855
9856   if (arguments->at(kByteOffsetArg)->IsLiteral()
9857       && Smi::FromInt(0) ==
9858       *static_cast<Literal*>(arguments->at(kByteOffsetArg))->value()) {
9859     byte_offset = Add<HConstant>(static_cast<int32_t>(0));
9860     is_zero_byte_offset = true;
9861   } else {
9862     CHECK_ALIVE(VisitForValue(arguments->at(kByteOffsetArg)));
9863     byte_offset = Pop();
9864     is_zero_byte_offset = false;
9865     ASSERT(buffer != NULL);
9866   }
9867
9868   CHECK_ALIVE(VisitForValue(arguments->at(kByteLengthArg)));
9869   HValue* byte_length = Pop();
9870
9871   NoObservableSideEffectsScope scope(this);
9872   IfBuilder byte_offset_smi(this);
9873
9874   if (!is_zero_byte_offset) {
9875     byte_offset_smi.If<HIsSmiAndBranch>(byte_offset);
9876     byte_offset_smi.Then();
9877   }
9878
9879   ExternalArrayType array_type =
9880       kExternalInt8Array;  // Bogus initialization.
9881   size_t element_size = 1;  // Bogus initialization.
9882   ElementsKind external_elements_kind =  // Bogus initialization.
9883       EXTERNAL_INT8_ELEMENTS;
9884   ElementsKind fixed_elements_kind =  // Bogus initialization.
9885       INT8_ELEMENTS;
9886   Runtime::ArrayIdToTypeAndSize(array_id,
9887       &array_type,
9888       &external_elements_kind,
9889       &fixed_elements_kind,
9890       &element_size);
9891
9892
9893   { //  byte_offset is Smi.
9894     BuildArrayBufferViewInitialization<JSTypedArray>(
9895         obj, buffer, byte_offset, byte_length);
9896
9897
9898     HInstruction* length = AddUncasted<HDiv>(byte_length,
9899         Add<HConstant>(static_cast<int32_t>(element_size)));
9900
9901     Add<HStoreNamedField>(obj,
9902         HObjectAccess::ForJSTypedArrayLength(),
9903         length);
9904
9905     HValue* elements;
9906     if (buffer != NULL) {
9907       elements = BuildAllocateExternalElements(
9908           array_type, is_zero_byte_offset, buffer, byte_offset, length);
9909       Handle<Map> obj_map = TypedArrayMap(
9910           isolate(), array_type, external_elements_kind);
9911       AddStoreMapConstant(obj, obj_map);
9912     } else {
9913       ASSERT(is_zero_byte_offset);
9914       elements = BuildAllocateFixedTypedArray(
9915           array_type, element_size, fixed_elements_kind,
9916           byte_length, length);
9917     }
9918     Add<HStoreNamedField>(
9919         obj, HObjectAccess::ForElementsPointer(), elements);
9920   }
9921
9922   if (!is_zero_byte_offset) {
9923     byte_offset_smi.Else();
9924     { //  byte_offset is not Smi.
9925       Push(obj);
9926       CHECK_ALIVE(VisitForValue(arguments->at(kArrayIdArg)));
9927       Push(buffer);
9928       Push(byte_offset);
9929       Push(byte_length);
9930       PushArgumentsFromEnvironment(kArgsLength);
9931       Add<HCallRuntime>(expr->name(), expr->function(), kArgsLength);
9932     }
9933   }
9934   byte_offset_smi.End();
9935 }
9936
9937
9938 void HOptimizedGraphBuilder::GenerateMaxSmi(CallRuntime* expr) {
9939   ASSERT(expr->arguments()->length() == 0);
9940   HConstant* max_smi = New<HConstant>(static_cast<int32_t>(Smi::kMaxValue));
9941   return ast_context()->ReturnInstruction(max_smi, expr->id());
9942 }
9943
9944
9945 void HOptimizedGraphBuilder::GenerateTypedArrayMaxSizeInHeap(
9946     CallRuntime* expr) {
9947   ASSERT(expr->arguments()->length() == 0);
9948   HConstant* result = New<HConstant>(static_cast<int32_t>(
9949         FLAG_typed_array_max_size_in_heap));
9950   return ast_context()->ReturnInstruction(result, expr->id());
9951 }
9952
9953
9954 void HOptimizedGraphBuilder::GenerateArrayBufferGetByteLength(
9955     CallRuntime* expr) {
9956   ASSERT(expr->arguments()->length() == 1);
9957   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9958   HValue* buffer = Pop();
9959   HInstruction* result = New<HLoadNamedField>(
9960     buffer,
9961     static_cast<HValue*>(NULL),
9962     HObjectAccess::ForJSArrayBufferByteLength());
9963   return ast_context()->ReturnInstruction(result, expr->id());
9964 }
9965
9966
9967 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteLength(
9968     CallRuntime* expr) {
9969   ASSERT(expr->arguments()->length() == 1);
9970   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9971   HValue* buffer = Pop();
9972   HInstruction* result = New<HLoadNamedField>(
9973     buffer,
9974     static_cast<HValue*>(NULL),
9975     HObjectAccess::ForJSArrayBufferViewByteLength());
9976   return ast_context()->ReturnInstruction(result, expr->id());
9977 }
9978
9979
9980 void HOptimizedGraphBuilder::GenerateArrayBufferViewGetByteOffset(
9981     CallRuntime* expr) {
9982   ASSERT(expr->arguments()->length() == 1);
9983   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9984   HValue* buffer = Pop();
9985   HInstruction* result = New<HLoadNamedField>(
9986     buffer,
9987     static_cast<HValue*>(NULL),
9988     HObjectAccess::ForJSArrayBufferViewByteOffset());
9989   return ast_context()->ReturnInstruction(result, expr->id());
9990 }
9991
9992
9993 void HOptimizedGraphBuilder::GenerateTypedArrayGetLength(
9994     CallRuntime* expr) {
9995   ASSERT(expr->arguments()->length() == 1);
9996   CHECK_ALIVE(VisitForValue(expr->arguments()->at(0)));
9997   HValue* buffer = Pop();
9998   HInstruction* result = New<HLoadNamedField>(
9999     buffer,
10000     static_cast<HValue*>(NULL),
10001     HObjectAccess::ForJSTypedArrayLength());
10002   return ast_context()->ReturnInstruction(result, expr->id());
10003 }
10004
10005
10006 void HOptimizedGraphBuilder::VisitCallRuntime(CallRuntime* expr) {
10007   ASSERT(!HasStackOverflow());
10008   ASSERT(current_block() != NULL);
10009   ASSERT(current_block()->HasPredecessor());
10010   if (expr->is_jsruntime()) {
10011     return Bailout(kCallToAJavaScriptRuntimeFunction);
10012   }
10013
10014   const Runtime::Function* function = expr->function();
10015   ASSERT(function != NULL);
10016
10017   if (function->intrinsic_type == Runtime::INLINE ||
10018       function->intrinsic_type == Runtime::INLINE_OPTIMIZED) {
10019     ASSERT(expr->name()->length() > 0);
10020     ASSERT(expr->name()->Get(0) == '_');
10021     // Call to an inline function.
10022     int lookup_index = static_cast<int>(function->function_id) -
10023         static_cast<int>(Runtime::kFirstInlineFunction);
10024     ASSERT(lookup_index >= 0);
10025     ASSERT(static_cast<size_t>(lookup_index) <
10026            ARRAY_SIZE(kInlineFunctionGenerators));
10027     InlineFunctionGenerator generator = kInlineFunctionGenerators[lookup_index];
10028
10029     // Call the inline code generator using the pointer-to-member.
10030     (this->*generator)(expr);
10031   } else {
10032     ASSERT(function->intrinsic_type == Runtime::RUNTIME);
10033     Handle<String> name = expr->name();
10034     int argument_count = expr->arguments()->length();
10035     CHECK_ALIVE(VisitExpressions(expr->arguments()));
10036     PushArgumentsFromEnvironment(argument_count);
10037     HCallRuntime* call = New<HCallRuntime>(name, function,
10038                                            argument_count);
10039     return ast_context()->ReturnInstruction(call, expr->id());
10040   }
10041 }
10042
10043
10044 void HOptimizedGraphBuilder::VisitUnaryOperation(UnaryOperation* expr) {
10045   ASSERT(!HasStackOverflow());
10046   ASSERT(current_block() != NULL);
10047   ASSERT(current_block()->HasPredecessor());
10048   switch (expr->op()) {
10049     case Token::DELETE: return VisitDelete(expr);
10050     case Token::VOID: return VisitVoid(expr);
10051     case Token::TYPEOF: return VisitTypeof(expr);
10052     case Token::NOT: return VisitNot(expr);
10053     default: UNREACHABLE();
10054   }
10055 }
10056
10057
10058 void HOptimizedGraphBuilder::VisitDelete(UnaryOperation* expr) {
10059   Property* prop = expr->expression()->AsProperty();
10060   VariableProxy* proxy = expr->expression()->AsVariableProxy();
10061   if (prop != NULL) {
10062     CHECK_ALIVE(VisitForValue(prop->obj()));
10063     CHECK_ALIVE(VisitForValue(prop->key()));
10064     HValue* key = Pop();
10065     HValue* obj = Pop();
10066     HValue* function = AddLoadJSBuiltin(Builtins::DELETE);
10067     Add<HPushArguments>(obj, key, Add<HConstant>(function_strict_mode()));
10068     // TODO(olivf) InvokeFunction produces a check for the parameter count,
10069     // even though we are certain to pass the correct number of arguments here.
10070     HInstruction* instr = New<HInvokeFunction>(function, 3);
10071     return ast_context()->ReturnInstruction(instr, expr->id());
10072   } else if (proxy != NULL) {
10073     Variable* var = proxy->var();
10074     if (var->IsUnallocated()) {
10075       Bailout(kDeleteWithGlobalVariable);
10076     } else if (var->IsStackAllocated() || var->IsContextSlot()) {
10077       // Result of deleting non-global variables is false.  'this' is not
10078       // really a variable, though we implement it as one.  The
10079       // subexpression does not have side effects.
10080       HValue* value = var->is_this()
10081           ? graph()->GetConstantTrue()
10082           : graph()->GetConstantFalse();
10083       return ast_context()->ReturnValue(value);
10084     } else {
10085       Bailout(kDeleteWithNonGlobalVariable);
10086     }
10087   } else {
10088     // Result of deleting non-property, non-variable reference is true.
10089     // Evaluate the subexpression for side effects.
10090     CHECK_ALIVE(VisitForEffect(expr->expression()));
10091     return ast_context()->ReturnValue(graph()->GetConstantTrue());
10092   }
10093 }
10094
10095
10096 void HOptimizedGraphBuilder::VisitVoid(UnaryOperation* expr) {
10097   CHECK_ALIVE(VisitForEffect(expr->expression()));
10098   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
10099 }
10100
10101
10102 void HOptimizedGraphBuilder::VisitTypeof(UnaryOperation* expr) {
10103   CHECK_ALIVE(VisitForTypeOf(expr->expression()));
10104   HValue* value = Pop();
10105   HInstruction* instr = New<HTypeof>(value);
10106   return ast_context()->ReturnInstruction(instr, expr->id());
10107 }
10108
10109
10110 void HOptimizedGraphBuilder::VisitNot(UnaryOperation* expr) {
10111   if (ast_context()->IsTest()) {
10112     TestContext* context = TestContext::cast(ast_context());
10113     VisitForControl(expr->expression(),
10114                     context->if_false(),
10115                     context->if_true());
10116     return;
10117   }
10118
10119   if (ast_context()->IsEffect()) {
10120     VisitForEffect(expr->expression());
10121     return;
10122   }
10123
10124   ASSERT(ast_context()->IsValue());
10125   HBasicBlock* materialize_false = graph()->CreateBasicBlock();
10126   HBasicBlock* materialize_true = graph()->CreateBasicBlock();
10127   CHECK_BAILOUT(VisitForControl(expr->expression(),
10128                                 materialize_false,
10129                                 materialize_true));
10130
10131   if (materialize_false->HasPredecessor()) {
10132     materialize_false->SetJoinId(expr->MaterializeFalseId());
10133     set_current_block(materialize_false);
10134     Push(graph()->GetConstantFalse());
10135   } else {
10136     materialize_false = NULL;
10137   }
10138
10139   if (materialize_true->HasPredecessor()) {
10140     materialize_true->SetJoinId(expr->MaterializeTrueId());
10141     set_current_block(materialize_true);
10142     Push(graph()->GetConstantTrue());
10143   } else {
10144     materialize_true = NULL;
10145   }
10146
10147   HBasicBlock* join =
10148     CreateJoin(materialize_false, materialize_true, expr->id());
10149   set_current_block(join);
10150   if (join != NULL) return ast_context()->ReturnValue(Pop());
10151 }
10152
10153
10154 HInstruction* HOptimizedGraphBuilder::BuildIncrement(
10155     bool returns_original_input,
10156     CountOperation* expr) {
10157   // The input to the count operation is on top of the expression stack.
10158   Representation rep = Representation::FromType(expr->type());
10159   if (rep.IsNone() || rep.IsTagged()) {
10160     rep = Representation::Smi();
10161   }
10162
10163   if (returns_original_input) {
10164     // We need an explicit HValue representing ToNumber(input).  The
10165     // actual HChange instruction we need is (sometimes) added in a later
10166     // phase, so it is not available now to be used as an input to HAdd and
10167     // as the return value.
10168     HInstruction* number_input = AddUncasted<HForceRepresentation>(Pop(), rep);
10169     if (!rep.IsDouble()) {
10170       number_input->SetFlag(HInstruction::kFlexibleRepresentation);
10171       number_input->SetFlag(HInstruction::kCannotBeTagged);
10172     }
10173     Push(number_input);
10174   }
10175
10176   // The addition has no side effects, so we do not need
10177   // to simulate the expression stack after this instruction.
10178   // Any later failures deopt to the load of the input or earlier.
10179   HConstant* delta = (expr->op() == Token::INC)
10180       ? graph()->GetConstant1()
10181       : graph()->GetConstantMinus1();
10182   HInstruction* instr = AddUncasted<HAdd>(Top(), delta);
10183   if (instr->IsAdd()) {
10184     HAdd* add = HAdd::cast(instr);
10185     add->set_observed_input_representation(1, rep);
10186     add->set_observed_input_representation(2, Representation::Smi());
10187   }
10188   instr->SetFlag(HInstruction::kCannotBeTagged);
10189   instr->ClearAllSideEffects();
10190   return instr;
10191 }
10192
10193
10194 void HOptimizedGraphBuilder::BuildStoreForEffect(Expression* expr,
10195                                                  Property* prop,
10196                                                  BailoutId ast_id,
10197                                                  BailoutId return_id,
10198                                                  HValue* object,
10199                                                  HValue* key,
10200                                                  HValue* value) {
10201   EffectContext for_effect(this);
10202   Push(object);
10203   if (key != NULL) Push(key);
10204   Push(value);
10205   BuildStore(expr, prop, ast_id, return_id);
10206 }
10207
10208
10209 void HOptimizedGraphBuilder::VisitCountOperation(CountOperation* expr) {
10210   ASSERT(!HasStackOverflow());
10211   ASSERT(current_block() != NULL);
10212   ASSERT(current_block()->HasPredecessor());
10213   if (!FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
10214   Expression* target = expr->expression();
10215   VariableProxy* proxy = target->AsVariableProxy();
10216   Property* prop = target->AsProperty();
10217   if (proxy == NULL && prop == NULL) {
10218     return Bailout(kInvalidLhsInCountOperation);
10219   }
10220
10221   // Match the full code generator stack by simulating an extra stack
10222   // element for postfix operations in a non-effect context.  The return
10223   // value is ToNumber(input).
10224   bool returns_original_input =
10225       expr->is_postfix() && !ast_context()->IsEffect();
10226   HValue* input = NULL;  // ToNumber(original_input).
10227   HValue* after = NULL;  // The result after incrementing or decrementing.
10228
10229   if (proxy != NULL) {
10230     Variable* var = proxy->var();
10231     if (var->mode() == CONST_LEGACY)  {
10232       return Bailout(kUnsupportedCountOperationWithConst);
10233     }
10234     // Argument of the count operation is a variable, not a property.
10235     ASSERT(prop == NULL);
10236     CHECK_ALIVE(VisitForValue(target));
10237
10238     after = BuildIncrement(returns_original_input, expr);
10239     input = returns_original_input ? Top() : Pop();
10240     Push(after);
10241
10242     switch (var->location()) {
10243       case Variable::UNALLOCATED:
10244         HandleGlobalVariableAssignment(var,
10245                                        after,
10246                                        expr->AssignmentId());
10247         break;
10248
10249       case Variable::PARAMETER:
10250       case Variable::LOCAL:
10251         BindIfLive(var, after);
10252         break;
10253
10254       case Variable::CONTEXT: {
10255         // Bail out if we try to mutate a parameter value in a function
10256         // using the arguments object.  We do not (yet) correctly handle the
10257         // arguments property of the function.
10258         if (current_info()->scope()->arguments() != NULL) {
10259           // Parameters will rewrite to context slots.  We have no direct
10260           // way to detect that the variable is a parameter so we use a
10261           // linear search of the parameter list.
10262           int count = current_info()->scope()->num_parameters();
10263           for (int i = 0; i < count; ++i) {
10264             if (var == current_info()->scope()->parameter(i)) {
10265               return Bailout(kAssignmentToParameterInArgumentsObject);
10266             }
10267           }
10268         }
10269
10270         HValue* context = BuildContextChainWalk(var);
10271         HStoreContextSlot::Mode mode = IsLexicalVariableMode(var->mode())
10272             ? HStoreContextSlot::kCheckDeoptimize : HStoreContextSlot::kNoCheck;
10273         HStoreContextSlot* instr = Add<HStoreContextSlot>(context, var->index(),
10274                                                           mode, after);
10275         if (instr->HasObservableSideEffects()) {
10276           Add<HSimulate>(expr->AssignmentId(), REMOVABLE_SIMULATE);
10277         }
10278         break;
10279       }
10280
10281       case Variable::LOOKUP:
10282         return Bailout(kLookupVariableInCountOperation);
10283     }
10284
10285     Drop(returns_original_input ? 2 : 1);
10286     return ast_context()->ReturnValue(expr->is_postfix() ? input : after);
10287   }
10288
10289   // Argument of the count operation is a property.
10290   ASSERT(prop != NULL);
10291   if (returns_original_input) Push(graph()->GetConstantUndefined());
10292
10293   CHECK_ALIVE(VisitForValue(prop->obj()));
10294   HValue* object = Top();
10295
10296   HValue* key = NULL;
10297   if ((!prop->IsFunctionPrototype() && !prop->key()->IsPropertyName()) ||
10298       prop->IsStringAccess()) {
10299     CHECK_ALIVE(VisitForValue(prop->key()));
10300     key = Top();
10301   }
10302
10303   CHECK_ALIVE(PushLoad(prop, object, key));
10304
10305   after = BuildIncrement(returns_original_input, expr);
10306
10307   if (returns_original_input) {
10308     input = Pop();
10309     // Drop object and key to push it again in the effect context below.
10310     Drop(key == NULL ? 1 : 2);
10311     environment()->SetExpressionStackAt(0, input);
10312     CHECK_ALIVE(BuildStoreForEffect(
10313         expr, prop, expr->id(), expr->AssignmentId(), object, key, after));
10314     return ast_context()->ReturnValue(Pop());
10315   }
10316
10317   environment()->SetExpressionStackAt(0, after);
10318   return BuildStore(expr, prop, expr->id(), expr->AssignmentId());
10319 }
10320
10321
10322 HInstruction* HOptimizedGraphBuilder::BuildStringCharCodeAt(
10323     HValue* string,
10324     HValue* index) {
10325   if (string->IsConstant() && index->IsConstant()) {
10326     HConstant* c_string = HConstant::cast(string);
10327     HConstant* c_index = HConstant::cast(index);
10328     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
10329       int32_t i = c_index->NumberValueAsInteger32();
10330       Handle<String> s = c_string->StringValue();
10331       if (i < 0 || i >= s->length()) {
10332         return New<HConstant>(OS::nan_value());
10333       }
10334       return New<HConstant>(s->Get(i));
10335     }
10336   }
10337   string = BuildCheckString(string);
10338   index = Add<HBoundsCheck>(index, AddLoadStringLength(string));
10339   return New<HStringCharCodeAt>(string, index);
10340 }
10341
10342
10343 // Checks if the given shift amounts have following forms:
10344 // (N1) and (N2) with N1 + N2 = 32; (sa) and (32 - sa).
10345 static bool ShiftAmountsAllowReplaceByRotate(HValue* sa,
10346                                              HValue* const32_minus_sa) {
10347   if (sa->IsConstant() && const32_minus_sa->IsConstant()) {
10348     const HConstant* c1 = HConstant::cast(sa);
10349     const HConstant* c2 = HConstant::cast(const32_minus_sa);
10350     return c1->HasInteger32Value() && c2->HasInteger32Value() &&
10351         (c1->Integer32Value() + c2->Integer32Value() == 32);
10352   }
10353   if (!const32_minus_sa->IsSub()) return false;
10354   HSub* sub = HSub::cast(const32_minus_sa);
10355   return sub->left()->EqualsInteger32Constant(32) && sub->right() == sa;
10356 }
10357
10358
10359 // Checks if the left and the right are shift instructions with the oposite
10360 // directions that can be replaced by one rotate right instruction or not.
10361 // Returns the operand and the shift amount for the rotate instruction in the
10362 // former case.
10363 bool HGraphBuilder::MatchRotateRight(HValue* left,
10364                                      HValue* right,
10365                                      HValue** operand,
10366                                      HValue** shift_amount) {
10367   HShl* shl;
10368   HShr* shr;
10369   if (left->IsShl() && right->IsShr()) {
10370     shl = HShl::cast(left);
10371     shr = HShr::cast(right);
10372   } else if (left->IsShr() && right->IsShl()) {
10373     shl = HShl::cast(right);
10374     shr = HShr::cast(left);
10375   } else {
10376     return false;
10377   }
10378   if (shl->left() != shr->left()) return false;
10379
10380   if (!ShiftAmountsAllowReplaceByRotate(shl->right(), shr->right()) &&
10381       !ShiftAmountsAllowReplaceByRotate(shr->right(), shl->right())) {
10382     return false;
10383   }
10384   *operand= shr->left();
10385   *shift_amount = shr->right();
10386   return true;
10387 }
10388
10389
10390 bool CanBeZero(HValue* right) {
10391   if (right->IsConstant()) {
10392     HConstant* right_const = HConstant::cast(right);
10393     if (right_const->HasInteger32Value() &&
10394        (right_const->Integer32Value() & 0x1f) != 0) {
10395       return false;
10396     }
10397   }
10398   return true;
10399 }
10400
10401
10402 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
10403                                          Type* expected) {
10404   if (expected->Is(Type::SignedSmall())) {
10405     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
10406   }
10407   if (expected->Is(Type::Signed32())) {
10408     return AddUncasted<HForceRepresentation>(number,
10409                                              Representation::Integer32());
10410   }
10411   return number;
10412 }
10413
10414
10415 HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
10416   if (value->IsConstant()) {
10417     HConstant* constant = HConstant::cast(value);
10418     Maybe<HConstant*> number = constant->CopyToTruncatedNumber(zone());
10419     if (number.has_value) {
10420       *expected = Type::Number(zone());
10421       return AddInstruction(number.value);
10422     }
10423   }
10424
10425   // We put temporary values on the stack, which don't correspond to anything
10426   // in baseline code. Since nothing is observable we avoid recording those
10427   // pushes with a NoObservableSideEffectsScope.
10428   NoObservableSideEffectsScope no_effects(this);
10429
10430   Type* expected_type = *expected;
10431
10432   // Separate the number type from the rest.
10433   Type* expected_obj =
10434       Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
10435   Type* expected_number =
10436       Type::Intersect(expected_type, Type::Number(zone()), zone());
10437
10438   // We expect to get a number.
10439   // (We need to check first, since Type::None->Is(Type::Any()) == true.
10440   if (expected_obj->Is(Type::None())) {
10441     ASSERT(!expected_number->Is(Type::None(zone())));
10442     return value;
10443   }
10444
10445   if (expected_obj->Is(Type::Undefined(zone()))) {
10446     // This is already done by HChange.
10447     *expected = Type::Union(expected_number, Type::Number(zone()), zone());
10448     return value;
10449   }
10450
10451   return value;
10452 }
10453
10454
10455 HValue* HOptimizedGraphBuilder::BuildBinaryOperation(
10456     BinaryOperation* expr,
10457     HValue* left,
10458     HValue* right,
10459     PushBeforeSimulateBehavior push_sim_result) {
10460   Type* left_type = expr->left()->bounds().lower;
10461   Type* right_type = expr->right()->bounds().lower;
10462   Type* result_type = expr->bounds().lower;
10463   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
10464   Handle<AllocationSite> allocation_site = expr->allocation_site();
10465
10466   HAllocationMode allocation_mode;
10467   if (FLAG_allocation_site_pretenuring && !allocation_site.is_null()) {
10468     allocation_mode = HAllocationMode(allocation_site);
10469   }
10470
10471   HValue* result = HGraphBuilder::BuildBinaryOperation(
10472       expr->op(), left, right, left_type, right_type, result_type,
10473       fixed_right_arg, allocation_mode);
10474   // Add a simulate after instructions with observable side effects, and
10475   // after phis, which are the result of BuildBinaryOperation when we
10476   // inlined some complex subgraph.
10477   if (result->HasObservableSideEffects() || result->IsPhi()) {
10478     if (push_sim_result == PUSH_BEFORE_SIMULATE) {
10479       Push(result);
10480       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10481       Drop(1);
10482     } else {
10483       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
10484     }
10485   }
10486   return result;
10487 }
10488
10489
10490 HValue* HGraphBuilder::BuildBinaryOperation(
10491     Token::Value op,
10492     HValue* left,
10493     HValue* right,
10494     Type* left_type,
10495     Type* right_type,
10496     Type* result_type,
10497     Maybe<int> fixed_right_arg,
10498     HAllocationMode allocation_mode) {
10499
10500   Representation left_rep = Representation::FromType(left_type);
10501   Representation right_rep = Representation::FromType(right_type);
10502
10503   bool maybe_string_add = op == Token::ADD &&
10504                           (left_type->Maybe(Type::String()) ||
10505                            right_type->Maybe(Type::String()));
10506
10507   if (left_type->Is(Type::None())) {
10508     Add<HDeoptimize>("Insufficient type feedback for LHS of binary operation",
10509                      Deoptimizer::SOFT);
10510     // TODO(rossberg): we should be able to get rid of non-continuous
10511     // defaults.
10512     left_type = Type::Any(zone());
10513   } else {
10514     if (!maybe_string_add) left = TruncateToNumber(left, &left_type);
10515     left_rep = Representation::FromType(left_type);
10516   }
10517
10518   if (right_type->Is(Type::None())) {
10519     Add<HDeoptimize>("Insufficient type feedback for RHS of binary operation",
10520                      Deoptimizer::SOFT);
10521     right_type = Type::Any(zone());
10522   } else {
10523     if (!maybe_string_add) right = TruncateToNumber(right, &right_type);
10524     right_rep = Representation::FromType(right_type);
10525   }
10526
10527   // Special case for string addition here.
10528   if (op == Token::ADD &&
10529       (left_type->Is(Type::String()) || right_type->Is(Type::String()))) {
10530     // Validate type feedback for left argument.
10531     if (left_type->Is(Type::String())) {
10532       left = BuildCheckString(left);
10533     }
10534
10535     // Validate type feedback for right argument.
10536     if (right_type->Is(Type::String())) {
10537       right = BuildCheckString(right);
10538     }
10539
10540     // Convert left argument as necessary.
10541     if (left_type->Is(Type::Number())) {
10542       ASSERT(right_type->Is(Type::String()));
10543       left = BuildNumberToString(left, left_type);
10544     } else if (!left_type->Is(Type::String())) {
10545       ASSERT(right_type->Is(Type::String()));
10546       HValue* function = AddLoadJSBuiltin(Builtins::STRING_ADD_RIGHT);
10547       Add<HPushArguments>(left, right);
10548       return AddUncasted<HInvokeFunction>(function, 2);
10549     }
10550
10551     // Convert right argument as necessary.
10552     if (right_type->Is(Type::Number())) {
10553       ASSERT(left_type->Is(Type::String()));
10554       right = BuildNumberToString(right, right_type);
10555     } else if (!right_type->Is(Type::String())) {
10556       ASSERT(left_type->Is(Type::String()));
10557       HValue* function = AddLoadJSBuiltin(Builtins::STRING_ADD_LEFT);
10558       Add<HPushArguments>(left, right);
10559       return AddUncasted<HInvokeFunction>(function, 2);
10560     }
10561
10562     // Fast path for empty constant strings.
10563     if (left->IsConstant() &&
10564         HConstant::cast(left)->HasStringValue() &&
10565         HConstant::cast(left)->StringValue()->length() == 0) {
10566       return right;
10567     }
10568     if (right->IsConstant() &&
10569         HConstant::cast(right)->HasStringValue() &&
10570         HConstant::cast(right)->StringValue()->length() == 0) {
10571       return left;
10572     }
10573
10574     // Register the dependent code with the allocation site.
10575     if (!allocation_mode.feedback_site().is_null()) {
10576       ASSERT(!graph()->info()->IsStub());
10577       Handle<AllocationSite> site(allocation_mode.feedback_site());
10578       AllocationSite::AddDependentCompilationInfo(
10579           site, AllocationSite::TENURING, top_info());
10580     }
10581
10582     // Inline the string addition into the stub when creating allocation
10583     // mementos to gather allocation site feedback, or if we can statically
10584     // infer that we're going to create a cons string.
10585     if ((graph()->info()->IsStub() &&
10586          allocation_mode.CreateAllocationMementos()) ||
10587         (left->IsConstant() &&
10588          HConstant::cast(left)->HasStringValue() &&
10589          HConstant::cast(left)->StringValue()->length() + 1 >=
10590            ConsString::kMinLength) ||
10591         (right->IsConstant() &&
10592          HConstant::cast(right)->HasStringValue() &&
10593          HConstant::cast(right)->StringValue()->length() + 1 >=
10594            ConsString::kMinLength)) {
10595       return BuildStringAdd(left, right, allocation_mode);
10596     }
10597
10598     // Fallback to using the string add stub.
10599     return AddUncasted<HStringAdd>(
10600         left, right, allocation_mode.GetPretenureMode(),
10601         STRING_ADD_CHECK_NONE, allocation_mode.feedback_site());
10602   }
10603
10604   if (graph()->info()->IsStub()) {
10605     left = EnforceNumberType(left, left_type);
10606     right = EnforceNumberType(right, right_type);
10607   }
10608
10609   Representation result_rep = Representation::FromType(result_type);
10610
10611   bool is_non_primitive = (left_rep.IsTagged() && !left_rep.IsSmi()) ||
10612                           (right_rep.IsTagged() && !right_rep.IsSmi());
10613
10614   HInstruction* instr = NULL;
10615   // Only the stub is allowed to call into the runtime, since otherwise we would
10616   // inline several instructions (including the two pushes) for every tagged
10617   // operation in optimized code, which is more expensive, than a stub call.
10618   if (graph()->info()->IsStub() && is_non_primitive) {
10619     HValue* function = AddLoadJSBuiltin(BinaryOpIC::TokenToJSBuiltin(op));
10620     Add<HPushArguments>(left, right);
10621     instr = AddUncasted<HInvokeFunction>(function, 2);
10622   } else {
10623     switch (op) {
10624       case Token::ADD:
10625         instr = AddUncasted<HAdd>(left, right);
10626         break;
10627       case Token::SUB:
10628         instr = AddUncasted<HSub>(left, right);
10629         break;
10630       case Token::MUL:
10631         instr = AddUncasted<HMul>(left, right);
10632         break;
10633       case Token::MOD: {
10634         if (fixed_right_arg.has_value &&
10635             !right->EqualsInteger32Constant(fixed_right_arg.value)) {
10636           HConstant* fixed_right = Add<HConstant>(
10637               static_cast<int>(fixed_right_arg.value));
10638           IfBuilder if_same(this);
10639           if_same.If<HCompareNumericAndBranch>(right, fixed_right, Token::EQ);
10640           if_same.Then();
10641           if_same.ElseDeopt("Unexpected RHS of binary operation");
10642           right = fixed_right;
10643         }
10644         instr = AddUncasted<HMod>(left, right);
10645         break;
10646       }
10647       case Token::DIV:
10648         instr = AddUncasted<HDiv>(left, right);
10649         break;
10650       case Token::BIT_XOR:
10651       case Token::BIT_AND:
10652         instr = AddUncasted<HBitwise>(op, left, right);
10653         break;
10654       case Token::BIT_OR: {
10655         HValue* operand, *shift_amount;
10656         if (left_type->Is(Type::Signed32()) &&
10657             right_type->Is(Type::Signed32()) &&
10658             MatchRotateRight(left, right, &operand, &shift_amount)) {
10659           instr = AddUncasted<HRor>(operand, shift_amount);
10660         } else {
10661           instr = AddUncasted<HBitwise>(op, left, right);
10662         }
10663         break;
10664       }
10665       case Token::SAR:
10666         instr = AddUncasted<HSar>(left, right);
10667         break;
10668       case Token::SHR:
10669         instr = AddUncasted<HShr>(left, right);
10670         if (FLAG_opt_safe_uint32_operations && instr->IsShr() &&
10671             CanBeZero(right)) {
10672           graph()->RecordUint32Instruction(instr);
10673         }
10674         break;
10675       case Token::SHL:
10676         instr = AddUncasted<HShl>(left, right);
10677         break;
10678       default:
10679         UNREACHABLE();
10680     }
10681   }
10682
10683   if (instr->IsBinaryOperation()) {
10684     HBinaryOperation* binop = HBinaryOperation::cast(instr);
10685     binop->set_observed_input_representation(1, left_rep);
10686     binop->set_observed_input_representation(2, right_rep);
10687     binop->initialize_output_representation(result_rep);
10688     if (graph()->info()->IsStub()) {
10689       // Stub should not call into stub.
10690       instr->SetFlag(HValue::kCannotBeTagged);
10691       // And should truncate on HForceRepresentation already.
10692       if (left->IsForceRepresentation()) {
10693         left->CopyFlag(HValue::kTruncatingToSmi, instr);
10694         left->CopyFlag(HValue::kTruncatingToInt32, instr);
10695       }
10696       if (right->IsForceRepresentation()) {
10697         right->CopyFlag(HValue::kTruncatingToSmi, instr);
10698         right->CopyFlag(HValue::kTruncatingToInt32, instr);
10699       }
10700     }
10701   }
10702   return instr;
10703 }
10704
10705
10706 // Check for the form (%_ClassOf(foo) === 'BarClass').
10707 static bool IsClassOfTest(CompareOperation* expr) {
10708   if (expr->op() != Token::EQ_STRICT) return false;
10709   CallRuntime* call = expr->left()->AsCallRuntime();
10710   if (call == NULL) return false;
10711   Literal* literal = expr->right()->AsLiteral();
10712   if (literal == NULL) return false;
10713   if (!literal->value()->IsString()) return false;
10714   if (!call->name()->IsOneByteEqualTo(STATIC_ASCII_VECTOR("_ClassOf"))) {
10715     return false;
10716   }
10717   ASSERT(call->arguments()->length() == 1);
10718   return true;
10719 }
10720
10721
10722 void HOptimizedGraphBuilder::VisitBinaryOperation(BinaryOperation* expr) {
10723   ASSERT(!HasStackOverflow());
10724   ASSERT(current_block() != NULL);
10725   ASSERT(current_block()->HasPredecessor());
10726   switch (expr->op()) {
10727     case Token::COMMA:
10728       return VisitComma(expr);
10729     case Token::OR:
10730     case Token::AND:
10731       return VisitLogicalExpression(expr);
10732     default:
10733       return VisitArithmeticExpression(expr);
10734   }
10735 }
10736
10737
10738 void HOptimizedGraphBuilder::VisitComma(BinaryOperation* expr) {
10739   CHECK_ALIVE(VisitForEffect(expr->left()));
10740   // Visit the right subexpression in the same AST context as the entire
10741   // expression.
10742   Visit(expr->right());
10743 }
10744
10745
10746 void HOptimizedGraphBuilder::VisitLogicalExpression(BinaryOperation* expr) {
10747   bool is_logical_and = expr->op() == Token::AND;
10748   if (ast_context()->IsTest()) {
10749     TestContext* context = TestContext::cast(ast_context());
10750     // Translate left subexpression.
10751     HBasicBlock* eval_right = graph()->CreateBasicBlock();
10752     if (is_logical_and) {
10753       CHECK_BAILOUT(VisitForControl(expr->left(),
10754                                     eval_right,
10755                                     context->if_false()));
10756     } else {
10757       CHECK_BAILOUT(VisitForControl(expr->left(),
10758                                     context->if_true(),
10759                                     eval_right));
10760     }
10761
10762     // Translate right subexpression by visiting it in the same AST
10763     // context as the entire expression.
10764     if (eval_right->HasPredecessor()) {
10765       eval_right->SetJoinId(expr->RightId());
10766       set_current_block(eval_right);
10767       Visit(expr->right());
10768     }
10769
10770   } else if (ast_context()->IsValue()) {
10771     CHECK_ALIVE(VisitForValue(expr->left()));
10772     ASSERT(current_block() != NULL);
10773     HValue* left_value = Top();
10774
10775     // Short-circuit left values that always evaluate to the same boolean value.
10776     if (expr->left()->ToBooleanIsTrue() || expr->left()->ToBooleanIsFalse()) {
10777       // l (evals true)  && r -> r
10778       // l (evals true)  || r -> l
10779       // l (evals false) && r -> l
10780       // l (evals false) || r -> r
10781       if (is_logical_and == expr->left()->ToBooleanIsTrue()) {
10782         Drop(1);
10783         CHECK_ALIVE(VisitForValue(expr->right()));
10784       }
10785       return ast_context()->ReturnValue(Pop());
10786     }
10787
10788     // We need an extra block to maintain edge-split form.
10789     HBasicBlock* empty_block = graph()->CreateBasicBlock();
10790     HBasicBlock* eval_right = graph()->CreateBasicBlock();
10791     ToBooleanStub::Types expected(expr->left()->to_boolean_types());
10792     HBranch* test = is_logical_and
10793         ? New<HBranch>(left_value, expected, eval_right, empty_block)
10794         : New<HBranch>(left_value, expected, empty_block, eval_right);
10795     FinishCurrentBlock(test);
10796
10797     set_current_block(eval_right);
10798     Drop(1);  // Value of the left subexpression.
10799     CHECK_BAILOUT(VisitForValue(expr->right()));
10800
10801     HBasicBlock* join_block =
10802       CreateJoin(empty_block, current_block(), expr->id());
10803     set_current_block(join_block);
10804     return ast_context()->ReturnValue(Pop());
10805
10806   } else {
10807     ASSERT(ast_context()->IsEffect());
10808     // In an effect context, we don't need the value of the left subexpression,
10809     // only its control flow and side effects.  We need an extra block to
10810     // maintain edge-split form.
10811     HBasicBlock* empty_block = graph()->CreateBasicBlock();
10812     HBasicBlock* right_block = graph()->CreateBasicBlock();
10813     if (is_logical_and) {
10814       CHECK_BAILOUT(VisitForControl(expr->left(), right_block, empty_block));
10815     } else {
10816       CHECK_BAILOUT(VisitForControl(expr->left(), empty_block, right_block));
10817     }
10818
10819     // TODO(kmillikin): Find a way to fix this.  It's ugly that there are
10820     // actually two empty blocks (one here and one inserted by
10821     // TestContext::BuildBranch, and that they both have an HSimulate though the
10822     // second one is not a merge node, and that we really have no good AST ID to
10823     // put on that first HSimulate.
10824
10825     if (empty_block->HasPredecessor()) {
10826       empty_block->SetJoinId(expr->id());
10827     } else {
10828       empty_block = NULL;
10829     }
10830
10831     if (right_block->HasPredecessor()) {
10832       right_block->SetJoinId(expr->RightId());
10833       set_current_block(right_block);
10834       CHECK_BAILOUT(VisitForEffect(expr->right()));
10835       right_block = current_block();
10836     } else {
10837       right_block = NULL;
10838     }
10839
10840     HBasicBlock* join_block =
10841       CreateJoin(empty_block, right_block, expr->id());
10842     set_current_block(join_block);
10843     // We did not materialize any value in the predecessor environments,
10844     // so there is no need to handle it here.
10845   }
10846 }
10847
10848
10849 void HOptimizedGraphBuilder::VisitArithmeticExpression(BinaryOperation* expr) {
10850   CHECK_ALIVE(VisitForValue(expr->left()));
10851   CHECK_ALIVE(VisitForValue(expr->right()));
10852   SetSourcePosition(expr->position());
10853   HValue* right = Pop();
10854   HValue* left = Pop();
10855   HValue* result =
10856       BuildBinaryOperation(expr, left, right,
10857           ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
10858                                     : PUSH_BEFORE_SIMULATE);
10859   if (FLAG_hydrogen_track_positions && result->IsBinaryOperation()) {
10860     HBinaryOperation::cast(result)->SetOperandPositions(
10861         zone(),
10862         ScriptPositionToSourcePosition(expr->left()->position()),
10863         ScriptPositionToSourcePosition(expr->right()->position()));
10864   }
10865   return ast_context()->ReturnValue(result);
10866 }
10867
10868
10869 void HOptimizedGraphBuilder::HandleLiteralCompareTypeof(CompareOperation* expr,
10870                                                         Expression* sub_expr,
10871                                                         Handle<String> check) {
10872   CHECK_ALIVE(VisitForTypeOf(sub_expr));
10873   SetSourcePosition(expr->position());
10874   HValue* value = Pop();
10875   HTypeofIsAndBranch* instr = New<HTypeofIsAndBranch>(value, check);
10876   return ast_context()->ReturnControl(instr, expr->id());
10877 }
10878
10879
10880 static bool IsLiteralCompareBool(Isolate* isolate,
10881                                  HValue* left,
10882                                  Token::Value op,
10883                                  HValue* right) {
10884   return op == Token::EQ_STRICT &&
10885       ((left->IsConstant() &&
10886           HConstant::cast(left)->handle(isolate)->IsBoolean()) ||
10887        (right->IsConstant() &&
10888            HConstant::cast(right)->handle(isolate)->IsBoolean()));
10889 }
10890
10891
10892 void HOptimizedGraphBuilder::VisitCompareOperation(CompareOperation* expr) {
10893   ASSERT(!HasStackOverflow());
10894   ASSERT(current_block() != NULL);
10895   ASSERT(current_block()->HasPredecessor());
10896
10897   if (!FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
10898
10899   // Check for a few fast cases. The AST visiting behavior must be in sync
10900   // with the full codegen: We don't push both left and right values onto
10901   // the expression stack when one side is a special-case literal.
10902   Expression* sub_expr = NULL;
10903   Handle<String> check;
10904   if (expr->IsLiteralCompareTypeof(&sub_expr, &check)) {
10905     return HandleLiteralCompareTypeof(expr, sub_expr, check);
10906   }
10907   if (expr->IsLiteralCompareUndefined(&sub_expr, isolate())) {
10908     return HandleLiteralCompareNil(expr, sub_expr, kUndefinedValue);
10909   }
10910   if (expr->IsLiteralCompareNull(&sub_expr)) {
10911     return HandleLiteralCompareNil(expr, sub_expr, kNullValue);
10912   }
10913
10914   if (IsClassOfTest(expr)) {
10915     CallRuntime* call = expr->left()->AsCallRuntime();
10916     ASSERT(call->arguments()->length() == 1);
10917     CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
10918     HValue* value = Pop();
10919     Literal* literal = expr->right()->AsLiteral();
10920     Handle<String> rhs = Handle<String>::cast(literal->value());
10921     HClassOfTestAndBranch* instr = New<HClassOfTestAndBranch>(value, rhs);
10922     return ast_context()->ReturnControl(instr, expr->id());
10923   }
10924
10925   Type* left_type = expr->left()->bounds().lower;
10926   Type* right_type = expr->right()->bounds().lower;
10927   Type* combined_type = expr->combined_type();
10928
10929   CHECK_ALIVE(VisitForValue(expr->left()));
10930   CHECK_ALIVE(VisitForValue(expr->right()));
10931
10932   if (FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
10933
10934   HValue* right = Pop();
10935   HValue* left = Pop();
10936   Token::Value op = expr->op();
10937
10938   if (IsLiteralCompareBool(isolate(), left, op, right)) {
10939     HCompareObjectEqAndBranch* result =
10940         New<HCompareObjectEqAndBranch>(left, right);
10941     return ast_context()->ReturnControl(result, expr->id());
10942   }
10943
10944   if (op == Token::INSTANCEOF) {
10945     // Check to see if the rhs of the instanceof is a global function not
10946     // residing in new space. If it is we assume that the function will stay the
10947     // same.
10948     Handle<JSFunction> target = Handle<JSFunction>::null();
10949     VariableProxy* proxy = expr->right()->AsVariableProxy();
10950     bool global_function = (proxy != NULL) && proxy->var()->IsUnallocated();
10951     if (global_function &&
10952         current_info()->has_global_object() &&
10953         !current_info()->global_object()->IsAccessCheckNeeded()) {
10954       Handle<String> name = proxy->name();
10955       Handle<GlobalObject> global(current_info()->global_object());
10956       LookupResult lookup(isolate());
10957       global->Lookup(name, &lookup);
10958       if (lookup.IsNormal() && lookup.GetValue()->IsJSFunction()) {
10959         Handle<JSFunction> candidate(JSFunction::cast(lookup.GetValue()));
10960         // If the function is in new space we assume it's more likely to
10961         // change and thus prefer the general IC code.
10962         if (!isolate()->heap()->InNewSpace(*candidate)) {
10963           target = candidate;
10964         }
10965       }
10966     }
10967
10968     // If the target is not null we have found a known global function that is
10969     // assumed to stay the same for this instanceof.
10970     if (target.is_null()) {
10971       HInstanceOf* result = New<HInstanceOf>(left, right);
10972       return ast_context()->ReturnInstruction(result, expr->id());
10973     } else {
10974       Add<HCheckValue>(right, target);
10975       HInstanceOfKnownGlobal* result =
10976         New<HInstanceOfKnownGlobal>(left, target);
10977       return ast_context()->ReturnInstruction(result, expr->id());
10978     }
10979
10980     // Code below assumes that we don't fall through.
10981     UNREACHABLE();
10982   } else if (op == Token::IN) {
10983     HValue* function = AddLoadJSBuiltin(Builtins::IN);
10984     Add<HPushArguments>(left, right);
10985     // TODO(olivf) InvokeFunction produces a check for the parameter count,
10986     // even though we are certain to pass the correct number of arguments here.
10987     HInstruction* result = New<HInvokeFunction>(function, 2);
10988     return ast_context()->ReturnInstruction(result, expr->id());
10989   }
10990
10991   PushBeforeSimulateBehavior push_behavior =
10992     ast_context()->IsEffect() ? NO_PUSH_BEFORE_SIMULATE
10993                               : PUSH_BEFORE_SIMULATE;
10994   HControlInstruction* compare = BuildCompareInstruction(
10995       op, left, right, left_type, right_type, combined_type,
10996       ScriptPositionToSourcePosition(expr->left()->position()),
10997       ScriptPositionToSourcePosition(expr->right()->position()),
10998       push_behavior, expr->id());
10999   if (compare == NULL) return;  // Bailed out.
11000   return ast_context()->ReturnControl(compare, expr->id());
11001 }
11002
11003
11004 HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
11005     Token::Value op,
11006     HValue* left,
11007     HValue* right,
11008     Type* left_type,
11009     Type* right_type,
11010     Type* combined_type,
11011     HSourcePosition left_position,
11012     HSourcePosition right_position,
11013     PushBeforeSimulateBehavior push_sim_result,
11014     BailoutId bailout_id) {
11015   // Cases handled below depend on collected type feedback. They should
11016   // soft deoptimize when there is no type feedback.
11017   if (combined_type->Is(Type::None())) {
11018     Add<HDeoptimize>("Insufficient type feedback for combined type "
11019                      "of binary operation",
11020                      Deoptimizer::SOFT);
11021     combined_type = left_type = right_type = Type::Any(zone());
11022   }
11023
11024   Representation left_rep = Representation::FromType(left_type);
11025   Representation right_rep = Representation::FromType(right_type);
11026   Representation combined_rep = Representation::FromType(combined_type);
11027
11028   if (combined_type->Is(Type::Receiver())) {
11029     if (Token::IsEqualityOp(op)) {
11030       // HCompareObjectEqAndBranch can only deal with object, so
11031       // exclude numbers.
11032       if ((left->IsConstant() &&
11033            HConstant::cast(left)->HasNumberValue()) ||
11034           (right->IsConstant() &&
11035            HConstant::cast(right)->HasNumberValue())) {
11036         Add<HDeoptimize>("Type mismatch between feedback and constant",
11037                          Deoptimizer::SOFT);
11038         // The caller expects a branch instruction, so make it happy.
11039         return New<HBranch>(graph()->GetConstantTrue());
11040       }
11041       // Can we get away with map check and not instance type check?
11042       HValue* operand_to_check =
11043           left->block()->block_id() < right->block()->block_id() ? left : right;
11044       if (combined_type->IsClass()) {
11045         Handle<Map> map = combined_type->AsClass()->Map();
11046         AddCheckMap(operand_to_check, map);
11047         HCompareObjectEqAndBranch* result =
11048             New<HCompareObjectEqAndBranch>(left, right);
11049         if (FLAG_hydrogen_track_positions) {
11050           result->set_operand_position(zone(), 0, left_position);
11051           result->set_operand_position(zone(), 1, right_position);
11052         }
11053         return result;
11054       } else {
11055         BuildCheckHeapObject(operand_to_check);
11056         Add<HCheckInstanceType>(operand_to_check,
11057                                 HCheckInstanceType::IS_SPEC_OBJECT);
11058         HCompareObjectEqAndBranch* result =
11059             New<HCompareObjectEqAndBranch>(left, right);
11060         return result;
11061       }
11062     } else {
11063       Bailout(kUnsupportedNonPrimitiveCompare);
11064       return NULL;
11065     }
11066   } else if (combined_type->Is(Type::InternalizedString()) &&
11067              Token::IsEqualityOp(op)) {
11068     // If we have a constant argument, it should be consistent with the type
11069     // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
11070     if ((left->IsConstant() &&
11071          !HConstant::cast(left)->HasInternalizedStringValue()) ||
11072         (right->IsConstant() &&
11073          !HConstant::cast(right)->HasInternalizedStringValue())) {
11074       Add<HDeoptimize>("Type mismatch between feedback and constant",
11075                        Deoptimizer::SOFT);
11076       // The caller expects a branch instruction, so make it happy.
11077       return New<HBranch>(graph()->GetConstantTrue());
11078     }
11079     BuildCheckHeapObject(left);
11080     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
11081     BuildCheckHeapObject(right);
11082     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
11083     HCompareObjectEqAndBranch* result =
11084         New<HCompareObjectEqAndBranch>(left, right);
11085     return result;
11086   } else if (combined_type->Is(Type::String())) {
11087     BuildCheckHeapObject(left);
11088     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
11089     BuildCheckHeapObject(right);
11090     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
11091     HStringCompareAndBranch* result =
11092         New<HStringCompareAndBranch>(left, right, op);
11093     return result;
11094   } else {
11095     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
11096       HCompareGeneric* result = Add<HCompareGeneric>(left, right, op);
11097       result->set_observed_input_representation(1, left_rep);
11098       result->set_observed_input_representation(2, right_rep);
11099       if (result->HasObservableSideEffects()) {
11100         if (push_sim_result == PUSH_BEFORE_SIMULATE) {
11101           Push(result);
11102           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11103           Drop(1);
11104         } else {
11105           AddSimulate(bailout_id, REMOVABLE_SIMULATE);
11106         }
11107       }
11108       // TODO(jkummerow): Can we make this more efficient?
11109       HBranch* branch = New<HBranch>(result);
11110       return branch;
11111     } else {
11112       HCompareNumericAndBranch* result =
11113           New<HCompareNumericAndBranch>(left, right, op);
11114       result->set_observed_input_representation(left_rep, right_rep);
11115       if (FLAG_hydrogen_track_positions) {
11116         result->SetOperandPositions(zone(), left_position, right_position);
11117       }
11118       return result;
11119     }
11120   }
11121 }
11122
11123
11124 void HOptimizedGraphBuilder::HandleLiteralCompareNil(CompareOperation* expr,
11125                                                      Expression* sub_expr,
11126                                                      NilValue nil) {
11127   ASSERT(!HasStackOverflow());
11128   ASSERT(current_block() != NULL);
11129   ASSERT(current_block()->HasPredecessor());
11130   ASSERT(expr->op() == Token::EQ || expr->op() == Token::EQ_STRICT);
11131   if (!FLAG_hydrogen_track_positions) SetSourcePosition(expr->position());
11132   CHECK_ALIVE(VisitForValue(sub_expr));
11133   HValue* value = Pop();
11134   if (expr->op() == Token::EQ_STRICT) {
11135     HConstant* nil_constant = nil == kNullValue
11136         ? graph()->GetConstantNull()
11137         : graph()->GetConstantUndefined();
11138     HCompareObjectEqAndBranch* instr =
11139         New<HCompareObjectEqAndBranch>(value, nil_constant);
11140     return ast_context()->ReturnControl(instr, expr->id());
11141   } else {
11142     ASSERT_EQ(Token::EQ, expr->op());
11143     Type* type = expr->combined_type()->Is(Type::None())
11144         ? Type::Any(zone()) : expr->combined_type();
11145     HIfContinuation continuation;
11146     BuildCompareNil(value, type, &continuation);
11147     return ast_context()->ReturnContinuation(&continuation, expr->id());
11148   }
11149 }
11150
11151
11152 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
11153   // If we share optimized code between different closures, the
11154   // this-function is not a constant, except inside an inlined body.
11155   if (function_state()->outer() != NULL) {
11156       return New<HConstant>(
11157           function_state()->compilation_info()->closure());
11158   } else {
11159       return New<HThisFunction>();
11160   }
11161 }
11162
11163
11164 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
11165     Handle<JSObject> boilerplate_object,
11166     AllocationSiteUsageContext* site_context) {
11167   NoObservableSideEffectsScope no_effects(this);
11168   InstanceType instance_type = boilerplate_object->map()->instance_type();
11169   ASSERT(instance_type == JS_ARRAY_TYPE || instance_type == JS_OBJECT_TYPE);
11170
11171   HType type = instance_type == JS_ARRAY_TYPE
11172       ? HType::JSArray() : HType::JSObject();
11173   HValue* object_size_constant = Add<HConstant>(
11174       boilerplate_object->map()->instance_size());
11175
11176   PretenureFlag pretenure_flag = NOT_TENURED;
11177   if (FLAG_allocation_site_pretenuring) {
11178     pretenure_flag = site_context->current()->GetPretenureMode();
11179     Handle<AllocationSite> site(site_context->current());
11180     AllocationSite::AddDependentCompilationInfo(
11181         site, AllocationSite::TENURING, top_info());
11182   }
11183
11184   HInstruction* object = Add<HAllocate>(object_size_constant, type,
11185       pretenure_flag, instance_type, site_context->current());
11186
11187   // If allocation folding reaches Page::kMaxRegularHeapObjectSize the
11188   // elements array may not get folded into the object. Hence, we set the
11189   // elements pointer to empty fixed array and let store elimination remove
11190   // this store in the folding case.
11191   HConstant* empty_fixed_array = Add<HConstant>(
11192       isolate()->factory()->empty_fixed_array());
11193   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11194       empty_fixed_array);
11195
11196   BuildEmitObjectHeader(boilerplate_object, object);
11197
11198   Handle<FixedArrayBase> elements(boilerplate_object->elements());
11199   int elements_size = (elements->length() > 0 &&
11200       elements->map() != isolate()->heap()->fixed_cow_array_map()) ?
11201           elements->Size() : 0;
11202
11203   if (pretenure_flag == TENURED &&
11204       elements->map() == isolate()->heap()->fixed_cow_array_map() &&
11205       isolate()->heap()->InNewSpace(*elements)) {
11206     // If we would like to pretenure a fixed cow array, we must ensure that the
11207     // array is already in old space, otherwise we'll create too many old-to-
11208     // new-space pointers (overflowing the store buffer).
11209     elements = Handle<FixedArrayBase>(
11210         isolate()->factory()->CopyAndTenureFixedCOWArray(
11211             Handle<FixedArray>::cast(elements)));
11212     boilerplate_object->set_elements(*elements);
11213   }
11214
11215   HInstruction* object_elements = NULL;
11216   if (elements_size > 0) {
11217     HValue* object_elements_size = Add<HConstant>(elements_size);
11218     InstanceType instance_type = boilerplate_object->HasFastDoubleElements()
11219         ? FIXED_DOUBLE_ARRAY_TYPE : FIXED_ARRAY_TYPE;
11220     object_elements = Add<HAllocate>(
11221         object_elements_size, HType::HeapObject(),
11222         pretenure_flag, instance_type, site_context->current());
11223   }
11224   BuildInitElementsInObjectHeader(boilerplate_object, object, object_elements);
11225
11226   // Copy object elements if non-COW.
11227   if (object_elements != NULL) {
11228     BuildEmitElements(boilerplate_object, elements, object_elements,
11229                       site_context);
11230   }
11231
11232   // Copy in-object properties.
11233   if (boilerplate_object->map()->NumberOfFields() != 0) {
11234     BuildEmitInObjectProperties(boilerplate_object, object, site_context,
11235                                 pretenure_flag);
11236   }
11237   return object;
11238 }
11239
11240
11241 void HOptimizedGraphBuilder::BuildEmitObjectHeader(
11242     Handle<JSObject> boilerplate_object,
11243     HInstruction* object) {
11244   ASSERT(boilerplate_object->properties()->length() == 0);
11245
11246   Handle<Map> boilerplate_object_map(boilerplate_object->map());
11247   AddStoreMapConstant(object, boilerplate_object_map);
11248
11249   Handle<Object> properties_field =
11250       Handle<Object>(boilerplate_object->properties(), isolate());
11251   ASSERT(*properties_field == isolate()->heap()->empty_fixed_array());
11252   HInstruction* properties = Add<HConstant>(properties_field);
11253   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
11254   Add<HStoreNamedField>(object, access, properties);
11255
11256   if (boilerplate_object->IsJSArray()) {
11257     Handle<JSArray> boilerplate_array =
11258         Handle<JSArray>::cast(boilerplate_object);
11259     Handle<Object> length_field =
11260         Handle<Object>(boilerplate_array->length(), isolate());
11261     HInstruction* length = Add<HConstant>(length_field);
11262
11263     ASSERT(boilerplate_array->length()->IsSmi());
11264     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
11265         boilerplate_array->GetElementsKind()), length);
11266   }
11267 }
11268
11269
11270 void HOptimizedGraphBuilder::BuildInitElementsInObjectHeader(
11271     Handle<JSObject> boilerplate_object,
11272     HInstruction* object,
11273     HInstruction* object_elements) {
11274   ASSERT(boilerplate_object->properties()->length() == 0);
11275   if (object_elements == NULL) {
11276     Handle<Object> elements_field =
11277         Handle<Object>(boilerplate_object->elements(), isolate());
11278     object_elements = Add<HConstant>(elements_field);
11279   }
11280   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
11281       object_elements);
11282 }
11283
11284
11285 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
11286     Handle<JSObject> boilerplate_object,
11287     HInstruction* object,
11288     AllocationSiteUsageContext* site_context,
11289     PretenureFlag pretenure_flag) {
11290   Handle<Map> boilerplate_map(boilerplate_object->map());
11291   Handle<DescriptorArray> descriptors(boilerplate_map->instance_descriptors());
11292   int limit = boilerplate_map->NumberOfOwnDescriptors();
11293
11294   int copied_fields = 0;
11295   for (int i = 0; i < limit; i++) {
11296     PropertyDetails details = descriptors->GetDetails(i);
11297     if (details.type() != FIELD) continue;
11298     copied_fields++;
11299     int index = descriptors->GetFieldIndex(i);
11300     int property_offset = boilerplate_object->GetInObjectPropertyOffset(index);
11301     Handle<Name> name(descriptors->GetKey(i));
11302     Handle<Object> value =
11303         Handle<Object>(boilerplate_object->InObjectPropertyAt(index),
11304         isolate());
11305
11306     // The access for the store depends on the type of the boilerplate.
11307     HObjectAccess access = boilerplate_object->IsJSArray() ?
11308         HObjectAccess::ForJSArrayOffset(property_offset) :
11309         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11310
11311     if (value->IsJSObject()) {
11312       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11313       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11314       HInstruction* result =
11315           BuildFastLiteral(value_object, site_context);
11316       site_context->ExitScope(current_site, value_object);
11317       Add<HStoreNamedField>(object, access, result);
11318     } else {
11319       Representation representation = details.representation();
11320       HInstruction* value_instruction;
11321
11322       if (representation.IsDouble()) {
11323         // Allocate a HeapNumber box and store the value into it.
11324         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
11325         // This heap number alloc does not have a corresponding
11326         // AllocationSite. That is okay because
11327         // 1) it's a child object of another object with a valid allocation site
11328         // 2) we can just use the mode of the parent object for pretenuring
11329         HInstruction* double_box =
11330             Add<HAllocate>(heap_number_constant, HType::HeapObject(),
11331                 pretenure_flag, HEAP_NUMBER_TYPE);
11332         AddStoreMapConstant(double_box,
11333             isolate()->factory()->heap_number_map());
11334         Add<HStoreNamedField>(double_box, HObjectAccess::ForHeapNumberValue(),
11335                               Add<HConstant>(value));
11336         value_instruction = double_box;
11337       } else if (representation.IsSmi()) {
11338         value_instruction = value->IsUninitialized()
11339             ? graph()->GetConstant0()
11340             : Add<HConstant>(value);
11341         // Ensure that value is stored as smi.
11342         access = access.WithRepresentation(representation);
11343       } else {
11344         value_instruction = Add<HConstant>(value);
11345       }
11346
11347       Add<HStoreNamedField>(object, access, value_instruction);
11348     }
11349   }
11350
11351   int inobject_properties = boilerplate_object->map()->inobject_properties();
11352   HInstruction* value_instruction =
11353       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
11354   for (int i = copied_fields; i < inobject_properties; i++) {
11355     ASSERT(boilerplate_object->IsJSObject());
11356     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
11357     HObjectAccess access =
11358         HObjectAccess::ForMapAndOffset(boilerplate_map, property_offset);
11359     Add<HStoreNamedField>(object, access, value_instruction);
11360   }
11361 }
11362
11363
11364 void HOptimizedGraphBuilder::BuildEmitElements(
11365     Handle<JSObject> boilerplate_object,
11366     Handle<FixedArrayBase> elements,
11367     HValue* object_elements,
11368     AllocationSiteUsageContext* site_context) {
11369   ElementsKind kind = boilerplate_object->map()->elements_kind();
11370   int elements_length = elements->length();
11371   HValue* object_elements_length = Add<HConstant>(elements_length);
11372   BuildInitializeElementsHeader(object_elements, kind, object_elements_length);
11373
11374   // Copy elements backing store content.
11375   if (elements->IsFixedDoubleArray()) {
11376     BuildEmitFixedDoubleArray(elements, kind, object_elements);
11377   } else if (elements->IsFixedArray()) {
11378     BuildEmitFixedArray(elements, kind, object_elements,
11379                         site_context);
11380   } else {
11381     UNREACHABLE();
11382   }
11383 }
11384
11385
11386 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
11387     Handle<FixedArrayBase> elements,
11388     ElementsKind kind,
11389     HValue* object_elements) {
11390   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11391   int elements_length = elements->length();
11392   for (int i = 0; i < elements_length; i++) {
11393     HValue* key_constant = Add<HConstant>(i);
11394     HInstruction* value_instruction =
11395         Add<HLoadKeyed>(boilerplate_elements, key_constant,
11396                         static_cast<HValue*>(NULL), kind,
11397                         ALLOW_RETURN_HOLE);
11398     HInstruction* store = Add<HStoreKeyed>(object_elements, key_constant,
11399                                            value_instruction, kind);
11400     store->SetFlag(HValue::kAllowUndefinedAsNaN);
11401   }
11402 }
11403
11404
11405 void HOptimizedGraphBuilder::BuildEmitFixedArray(
11406     Handle<FixedArrayBase> elements,
11407     ElementsKind kind,
11408     HValue* object_elements,
11409     AllocationSiteUsageContext* site_context) {
11410   HInstruction* boilerplate_elements = Add<HConstant>(elements);
11411   int elements_length = elements->length();
11412   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
11413   for (int i = 0; i < elements_length; i++) {
11414     Handle<Object> value(fast_elements->get(i), isolate());
11415     HValue* key_constant = Add<HConstant>(i);
11416     if (value->IsJSObject()) {
11417       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
11418       Handle<AllocationSite> current_site = site_context->EnterNewScope();
11419       HInstruction* result =
11420           BuildFastLiteral(value_object, site_context);
11421       site_context->ExitScope(current_site, value_object);
11422       Add<HStoreKeyed>(object_elements, key_constant, result, kind);
11423     } else {
11424       HInstruction* value_instruction =
11425           Add<HLoadKeyed>(boilerplate_elements, key_constant,
11426                           static_cast<HValue*>(NULL), kind,
11427                           ALLOW_RETURN_HOLE);
11428       Add<HStoreKeyed>(object_elements, key_constant, value_instruction, kind);
11429     }
11430   }
11431 }
11432
11433
11434 void HOptimizedGraphBuilder::VisitThisFunction(ThisFunction* expr) {
11435   ASSERT(!HasStackOverflow());
11436   ASSERT(current_block() != NULL);
11437   ASSERT(current_block()->HasPredecessor());
11438   HInstruction* instr = BuildThisFunction();
11439   return ast_context()->ReturnInstruction(instr, expr->id());
11440 }
11441
11442
11443 void HOptimizedGraphBuilder::VisitDeclarations(
11444     ZoneList<Declaration*>* declarations) {
11445   ASSERT(globals_.is_empty());
11446   AstVisitor::VisitDeclarations(declarations);
11447   if (!globals_.is_empty()) {
11448     Handle<FixedArray> array =
11449        isolate()->factory()->NewFixedArray(globals_.length(), TENURED);
11450     for (int i = 0; i < globals_.length(); ++i) array->set(i, *globals_.at(i));
11451     int flags = DeclareGlobalsEvalFlag::encode(current_info()->is_eval()) |
11452         DeclareGlobalsNativeFlag::encode(current_info()->is_native()) |
11453         DeclareGlobalsStrictMode::encode(current_info()->strict_mode());
11454     Add<HDeclareGlobals>(array, flags);
11455     globals_.Rewind(0);
11456   }
11457 }
11458
11459
11460 void HOptimizedGraphBuilder::VisitVariableDeclaration(
11461     VariableDeclaration* declaration) {
11462   VariableProxy* proxy = declaration->proxy();
11463   VariableMode mode = declaration->mode();
11464   Variable* variable = proxy->var();
11465   bool hole_init = mode == LET || mode == CONST || mode == CONST_LEGACY;
11466   switch (variable->location()) {
11467     case Variable::UNALLOCATED:
11468       globals_.Add(variable->name(), zone());
11469       globals_.Add(variable->binding_needs_init()
11470                        ? isolate()->factory()->the_hole_value()
11471                        : isolate()->factory()->undefined_value(), zone());
11472       return;
11473     case Variable::PARAMETER:
11474     case Variable::LOCAL:
11475       if (hole_init) {
11476         HValue* value = graph()->GetConstantHole();
11477         environment()->Bind(variable, value);
11478       }
11479       break;
11480     case Variable::CONTEXT:
11481       if (hole_init) {
11482         HValue* value = graph()->GetConstantHole();
11483         HValue* context = environment()->context();
11484         HStoreContextSlot* store = Add<HStoreContextSlot>(
11485             context, variable->index(), HStoreContextSlot::kNoCheck, value);
11486         if (store->HasObservableSideEffects()) {
11487           Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11488         }
11489       }
11490       break;
11491     case Variable::LOOKUP:
11492       return Bailout(kUnsupportedLookupSlotInDeclaration);
11493   }
11494 }
11495
11496
11497 void HOptimizedGraphBuilder::VisitFunctionDeclaration(
11498     FunctionDeclaration* declaration) {
11499   VariableProxy* proxy = declaration->proxy();
11500   Variable* variable = proxy->var();
11501   switch (variable->location()) {
11502     case Variable::UNALLOCATED: {
11503       globals_.Add(variable->name(), zone());
11504       Handle<SharedFunctionInfo> function = Compiler::BuildFunctionInfo(
11505           declaration->fun(), current_info()->script());
11506       // Check for stack-overflow exception.
11507       if (function.is_null()) return SetStackOverflow();
11508       globals_.Add(function, zone());
11509       return;
11510     }
11511     case Variable::PARAMETER:
11512     case Variable::LOCAL: {
11513       CHECK_ALIVE(VisitForValue(declaration->fun()));
11514       HValue* value = Pop();
11515       BindIfLive(variable, value);
11516       break;
11517     }
11518     case Variable::CONTEXT: {
11519       CHECK_ALIVE(VisitForValue(declaration->fun()));
11520       HValue* value = Pop();
11521       HValue* context = environment()->context();
11522       HStoreContextSlot* store = Add<HStoreContextSlot>(
11523           context, variable->index(), HStoreContextSlot::kNoCheck, value);
11524       if (store->HasObservableSideEffects()) {
11525         Add<HSimulate>(proxy->id(), REMOVABLE_SIMULATE);
11526       }
11527       break;
11528     }
11529     case Variable::LOOKUP:
11530       return Bailout(kUnsupportedLookupSlotInDeclaration);
11531   }
11532 }
11533
11534
11535 void HOptimizedGraphBuilder::VisitModuleDeclaration(
11536     ModuleDeclaration* declaration) {
11537   UNREACHABLE();
11538 }
11539
11540
11541 void HOptimizedGraphBuilder::VisitImportDeclaration(
11542     ImportDeclaration* declaration) {
11543   UNREACHABLE();
11544 }
11545
11546
11547 void HOptimizedGraphBuilder::VisitExportDeclaration(
11548     ExportDeclaration* declaration) {
11549   UNREACHABLE();
11550 }
11551
11552
11553 void HOptimizedGraphBuilder::VisitModuleLiteral(ModuleLiteral* module) {
11554   UNREACHABLE();
11555 }
11556
11557
11558 void HOptimizedGraphBuilder::VisitModuleVariable(ModuleVariable* module) {
11559   UNREACHABLE();
11560 }
11561
11562
11563 void HOptimizedGraphBuilder::VisitModulePath(ModulePath* module) {
11564   UNREACHABLE();
11565 }
11566
11567
11568 void HOptimizedGraphBuilder::VisitModuleUrl(ModuleUrl* module) {
11569   UNREACHABLE();
11570 }
11571
11572
11573 void HOptimizedGraphBuilder::VisitModuleStatement(ModuleStatement* stmt) {
11574   UNREACHABLE();
11575 }
11576
11577
11578 // Generators for inline runtime functions.
11579 // Support for types.
11580 void HOptimizedGraphBuilder::GenerateIsSmi(CallRuntime* call) {
11581   ASSERT(call->arguments()->length() == 1);
11582   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11583   HValue* value = Pop();
11584   HIsSmiAndBranch* result = New<HIsSmiAndBranch>(value);
11585   return ast_context()->ReturnControl(result, call->id());
11586 }
11587
11588
11589 void HOptimizedGraphBuilder::GenerateIsSpecObject(CallRuntime* call) {
11590   ASSERT(call->arguments()->length() == 1);
11591   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11592   HValue* value = Pop();
11593   HHasInstanceTypeAndBranch* result =
11594       New<HHasInstanceTypeAndBranch>(value,
11595                                      FIRST_SPEC_OBJECT_TYPE,
11596                                      LAST_SPEC_OBJECT_TYPE);
11597   return ast_context()->ReturnControl(result, call->id());
11598 }
11599
11600
11601 void HOptimizedGraphBuilder::GenerateIsFunction(CallRuntime* call) {
11602   ASSERT(call->arguments()->length() == 1);
11603   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11604   HValue* value = Pop();
11605   HHasInstanceTypeAndBranch* result =
11606       New<HHasInstanceTypeAndBranch>(value, JS_FUNCTION_TYPE);
11607   return ast_context()->ReturnControl(result, call->id());
11608 }
11609
11610
11611 void HOptimizedGraphBuilder::GenerateIsMinusZero(CallRuntime* call) {
11612   ASSERT(call->arguments()->length() == 1);
11613   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11614   HValue* value = Pop();
11615   HCompareMinusZeroAndBranch* result = New<HCompareMinusZeroAndBranch>(value);
11616   return ast_context()->ReturnControl(result, call->id());
11617 }
11618
11619
11620 void HOptimizedGraphBuilder::GenerateHasCachedArrayIndex(CallRuntime* call) {
11621   ASSERT(call->arguments()->length() == 1);
11622   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11623   HValue* value = Pop();
11624   HHasCachedArrayIndexAndBranch* result =
11625       New<HHasCachedArrayIndexAndBranch>(value);
11626   return ast_context()->ReturnControl(result, call->id());
11627 }
11628
11629
11630 void HOptimizedGraphBuilder::GenerateIsArray(CallRuntime* call) {
11631   ASSERT(call->arguments()->length() == 1);
11632   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11633   HValue* value = Pop();
11634   HHasInstanceTypeAndBranch* result =
11635       New<HHasInstanceTypeAndBranch>(value, JS_ARRAY_TYPE);
11636   return ast_context()->ReturnControl(result, call->id());
11637 }
11638
11639
11640 void HOptimizedGraphBuilder::GenerateIsRegExp(CallRuntime* call) {
11641   ASSERT(call->arguments()->length() == 1);
11642   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11643   HValue* value = Pop();
11644   HHasInstanceTypeAndBranch* result =
11645       New<HHasInstanceTypeAndBranch>(value, JS_REGEXP_TYPE);
11646   return ast_context()->ReturnControl(result, call->id());
11647 }
11648
11649
11650 void HOptimizedGraphBuilder::GenerateIsObject(CallRuntime* call) {
11651   ASSERT(call->arguments()->length() == 1);
11652   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11653   HValue* value = Pop();
11654   HIsObjectAndBranch* result = New<HIsObjectAndBranch>(value);
11655   return ast_context()->ReturnControl(result, call->id());
11656 }
11657
11658
11659 void HOptimizedGraphBuilder::GenerateIsNonNegativeSmi(CallRuntime* call) {
11660   return Bailout(kInlinedRuntimeFunctionIsNonNegativeSmi);
11661 }
11662
11663
11664 void HOptimizedGraphBuilder::GenerateIsUndetectableObject(CallRuntime* call) {
11665   ASSERT(call->arguments()->length() == 1);
11666   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11667   HValue* value = Pop();
11668   HIsUndetectableAndBranch* result = New<HIsUndetectableAndBranch>(value);
11669   return ast_context()->ReturnControl(result, call->id());
11670 }
11671
11672
11673 void HOptimizedGraphBuilder::GenerateIsStringWrapperSafeForDefaultValueOf(
11674     CallRuntime* call) {
11675   return Bailout(kInlinedRuntimeFunctionIsStringWrapperSafeForDefaultValueOf);
11676 }
11677
11678
11679 // Support for construct call checks.
11680 void HOptimizedGraphBuilder::GenerateIsConstructCall(CallRuntime* call) {
11681   ASSERT(call->arguments()->length() == 0);
11682   if (function_state()->outer() != NULL) {
11683     // We are generating graph for inlined function.
11684     HValue* value = function_state()->inlining_kind() == CONSTRUCT_CALL_RETURN
11685         ? graph()->GetConstantTrue()
11686         : graph()->GetConstantFalse();
11687     return ast_context()->ReturnValue(value);
11688   } else {
11689     return ast_context()->ReturnControl(New<HIsConstructCallAndBranch>(),
11690                                         call->id());
11691   }
11692 }
11693
11694
11695 // Support for arguments.length and arguments[?].
11696 void HOptimizedGraphBuilder::GenerateArgumentsLength(CallRuntime* call) {
11697   // Our implementation of arguments (based on this stack frame or an
11698   // adapter below it) does not work for inlined functions.  This runtime
11699   // function is blacklisted by AstNode::IsInlineable.
11700   ASSERT(function_state()->outer() == NULL);
11701   ASSERT(call->arguments()->length() == 0);
11702   HInstruction* elements = Add<HArgumentsElements>(false);
11703   HArgumentsLength* result = New<HArgumentsLength>(elements);
11704   return ast_context()->ReturnInstruction(result, call->id());
11705 }
11706
11707
11708 void HOptimizedGraphBuilder::GenerateArguments(CallRuntime* call) {
11709   // Our implementation of arguments (based on this stack frame or an
11710   // adapter below it) does not work for inlined functions.  This runtime
11711   // function is blacklisted by AstNode::IsInlineable.
11712   ASSERT(function_state()->outer() == NULL);
11713   ASSERT(call->arguments()->length() == 1);
11714   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11715   HValue* index = Pop();
11716   HInstruction* elements = Add<HArgumentsElements>(false);
11717   HInstruction* length = Add<HArgumentsLength>(elements);
11718   HInstruction* checked_index = Add<HBoundsCheck>(index, length);
11719   HAccessArgumentsAt* result = New<HAccessArgumentsAt>(
11720       elements, length, checked_index);
11721   return ast_context()->ReturnInstruction(result, call->id());
11722 }
11723
11724
11725 // Support for accessing the class and value fields of an object.
11726 void HOptimizedGraphBuilder::GenerateClassOf(CallRuntime* call) {
11727   // The special form detected by IsClassOfTest is detected before we get here
11728   // and does not cause a bailout.
11729   return Bailout(kInlinedRuntimeFunctionClassOf);
11730 }
11731
11732
11733 void HOptimizedGraphBuilder::GenerateValueOf(CallRuntime* call) {
11734   ASSERT(call->arguments()->length() == 1);
11735   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11736   HValue* object = Pop();
11737
11738   IfBuilder if_objectisvalue(this);
11739   HValue* objectisvalue = if_objectisvalue.If<HHasInstanceTypeAndBranch>(
11740       object, JS_VALUE_TYPE);
11741   if_objectisvalue.Then();
11742   {
11743     // Return the actual value.
11744     Push(Add<HLoadNamedField>(
11745             object, objectisvalue,
11746             HObjectAccess::ForObservableJSObjectOffset(
11747                 JSValue::kValueOffset)));
11748     Add<HSimulate>(call->id(), FIXED_SIMULATE);
11749   }
11750   if_objectisvalue.Else();
11751   {
11752     // If the object is not a value return the object.
11753     Push(object);
11754     Add<HSimulate>(call->id(), FIXED_SIMULATE);
11755   }
11756   if_objectisvalue.End();
11757   return ast_context()->ReturnValue(Pop());
11758 }
11759
11760
11761 void HOptimizedGraphBuilder::GenerateDateField(CallRuntime* call) {
11762   ASSERT(call->arguments()->length() == 2);
11763   ASSERT_NE(NULL, call->arguments()->at(1)->AsLiteral());
11764   Smi* index = Smi::cast(*(call->arguments()->at(1)->AsLiteral()->value()));
11765   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11766   HValue* date = Pop();
11767   HDateField* result = New<HDateField>(date, index);
11768   return ast_context()->ReturnInstruction(result, call->id());
11769 }
11770
11771
11772 void HOptimizedGraphBuilder::GenerateOneByteSeqStringSetChar(
11773     CallRuntime* call) {
11774   ASSERT(call->arguments()->length() == 3);
11775   // We need to follow the evaluation order of full codegen.
11776   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11777   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
11778   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11779   HValue* string = Pop();
11780   HValue* value = Pop();
11781   HValue* index = Pop();
11782   Add<HSeqStringSetChar>(String::ONE_BYTE_ENCODING, string,
11783                          index, value);
11784   Add<HSimulate>(call->id(), FIXED_SIMULATE);
11785   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
11786 }
11787
11788
11789 void HOptimizedGraphBuilder::GenerateTwoByteSeqStringSetChar(
11790     CallRuntime* call) {
11791   ASSERT(call->arguments()->length() == 3);
11792   // We need to follow the evaluation order of full codegen.
11793   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11794   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
11795   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11796   HValue* string = Pop();
11797   HValue* value = Pop();
11798   HValue* index = Pop();
11799   Add<HSeqStringSetChar>(String::TWO_BYTE_ENCODING, string,
11800                          index, value);
11801   Add<HSimulate>(call->id(), FIXED_SIMULATE);
11802   return ast_context()->ReturnValue(graph()->GetConstantUndefined());
11803 }
11804
11805
11806 void HOptimizedGraphBuilder::GenerateSetValueOf(CallRuntime* call) {
11807   ASSERT(call->arguments()->length() == 2);
11808   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11809   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11810   HValue* value = Pop();
11811   HValue* object = Pop();
11812
11813   // Check if object is a JSValue.
11814   IfBuilder if_objectisvalue(this);
11815   if_objectisvalue.If<HHasInstanceTypeAndBranch>(object, JS_VALUE_TYPE);
11816   if_objectisvalue.Then();
11817   {
11818     // Create in-object property store to kValueOffset.
11819     Add<HStoreNamedField>(object,
11820         HObjectAccess::ForObservableJSObjectOffset(JSValue::kValueOffset),
11821         value);
11822     if (!ast_context()->IsEffect()) {
11823       Push(value);
11824     }
11825     Add<HSimulate>(call->id(), FIXED_SIMULATE);
11826   }
11827   if_objectisvalue.Else();
11828   {
11829     // Nothing to do in this case.
11830     if (!ast_context()->IsEffect()) {
11831       Push(value);
11832     }
11833     Add<HSimulate>(call->id(), FIXED_SIMULATE);
11834   }
11835   if_objectisvalue.End();
11836   if (!ast_context()->IsEffect()) {
11837     Drop(1);
11838   }
11839   return ast_context()->ReturnValue(value);
11840 }
11841
11842
11843 // Fast support for charCodeAt(n).
11844 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
11845   ASSERT(call->arguments()->length() == 2);
11846   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11847   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11848   HValue* index = Pop();
11849   HValue* string = Pop();
11850   HInstruction* result = BuildStringCharCodeAt(string, index);
11851   return ast_context()->ReturnInstruction(result, call->id());
11852 }
11853
11854
11855 // Fast support for string.charAt(n) and string[n].
11856 void HOptimizedGraphBuilder::GenerateStringCharFromCode(CallRuntime* call) {
11857   ASSERT(call->arguments()->length() == 1);
11858   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11859   HValue* char_code = Pop();
11860   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
11861   return ast_context()->ReturnInstruction(result, call->id());
11862 }
11863
11864
11865 // Fast support for string.charAt(n) and string[n].
11866 void HOptimizedGraphBuilder::GenerateStringCharAt(CallRuntime* call) {
11867   ASSERT(call->arguments()->length() == 2);
11868   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11869   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11870   HValue* index = Pop();
11871   HValue* string = Pop();
11872   HInstruction* char_code = BuildStringCharCodeAt(string, index);
11873   AddInstruction(char_code);
11874   HInstruction* result = NewUncasted<HStringCharFromCode>(char_code);
11875   return ast_context()->ReturnInstruction(result, call->id());
11876 }
11877
11878
11879 // Fast support for object equality testing.
11880 void HOptimizedGraphBuilder::GenerateObjectEquals(CallRuntime* call) {
11881   ASSERT(call->arguments()->length() == 2);
11882   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11883   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11884   HValue* right = Pop();
11885   HValue* left = Pop();
11886   HCompareObjectEqAndBranch* result =
11887       New<HCompareObjectEqAndBranch>(left, right);
11888   return ast_context()->ReturnControl(result, call->id());
11889 }
11890
11891
11892 // Fast support for StringAdd.
11893 void HOptimizedGraphBuilder::GenerateStringAdd(CallRuntime* call) {
11894   ASSERT_EQ(2, call->arguments()->length());
11895   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11896   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11897   HValue* right = Pop();
11898   HValue* left = Pop();
11899   HInstruction* result = NewUncasted<HStringAdd>(left, right);
11900   return ast_context()->ReturnInstruction(result, call->id());
11901 }
11902
11903
11904 // Fast support for SubString.
11905 void HOptimizedGraphBuilder::GenerateSubString(CallRuntime* call) {
11906   ASSERT_EQ(3, call->arguments()->length());
11907   CHECK_ALIVE(VisitExpressions(call->arguments()));
11908   PushArgumentsFromEnvironment(call->arguments()->length());
11909   HCallStub* result = New<HCallStub>(CodeStub::SubString, 3);
11910   return ast_context()->ReturnInstruction(result, call->id());
11911 }
11912
11913
11914 // Fast support for StringCompare.
11915 void HOptimizedGraphBuilder::GenerateStringCompare(CallRuntime* call) {
11916   ASSERT_EQ(2, call->arguments()->length());
11917   CHECK_ALIVE(VisitExpressions(call->arguments()));
11918   PushArgumentsFromEnvironment(call->arguments()->length());
11919   HCallStub* result = New<HCallStub>(CodeStub::StringCompare, 2);
11920   return ast_context()->ReturnInstruction(result, call->id());
11921 }
11922
11923
11924 // Support for direct calls from JavaScript to native RegExp code.
11925 void HOptimizedGraphBuilder::GenerateRegExpExec(CallRuntime* call) {
11926   ASSERT_EQ(4, call->arguments()->length());
11927   CHECK_ALIVE(VisitExpressions(call->arguments()));
11928   PushArgumentsFromEnvironment(call->arguments()->length());
11929   HCallStub* result = New<HCallStub>(CodeStub::RegExpExec, 4);
11930   return ast_context()->ReturnInstruction(result, call->id());
11931 }
11932
11933
11934 void HOptimizedGraphBuilder::GenerateDoubleLo(CallRuntime* call) {
11935   ASSERT_EQ(1, call->arguments()->length());
11936   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11937   HValue* value = Pop();
11938   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::LOW);
11939   return ast_context()->ReturnInstruction(result, call->id());
11940 }
11941
11942
11943 void HOptimizedGraphBuilder::GenerateDoubleHi(CallRuntime* call) {
11944   ASSERT_EQ(1, call->arguments()->length());
11945   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11946   HValue* value = Pop();
11947   HInstruction* result = NewUncasted<HDoubleBits>(value, HDoubleBits::HIGH);
11948   return ast_context()->ReturnInstruction(result, call->id());
11949 }
11950
11951
11952 void HOptimizedGraphBuilder::GenerateConstructDouble(CallRuntime* call) {
11953   ASSERT_EQ(2, call->arguments()->length());
11954   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11955   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11956   HValue* lo = Pop();
11957   HValue* hi = Pop();
11958   HInstruction* result = NewUncasted<HConstructDouble>(hi, lo);
11959   return ast_context()->ReturnInstruction(result, call->id());
11960 }
11961
11962
11963 // Construct a RegExp exec result with two in-object properties.
11964 void HOptimizedGraphBuilder::GenerateRegExpConstructResult(CallRuntime* call) {
11965   ASSERT_EQ(3, call->arguments()->length());
11966   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11967   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
11968   CHECK_ALIVE(VisitForValue(call->arguments()->at(2)));
11969   HValue* input = Pop();
11970   HValue* index = Pop();
11971   HValue* length = Pop();
11972   HValue* result = BuildRegExpConstructResult(length, index, input);
11973   return ast_context()->ReturnValue(result);
11974 }
11975
11976
11977 // Support for fast native caches.
11978 void HOptimizedGraphBuilder::GenerateGetFromCache(CallRuntime* call) {
11979   return Bailout(kInlinedRuntimeFunctionGetFromCache);
11980 }
11981
11982
11983 // Fast support for number to string.
11984 void HOptimizedGraphBuilder::GenerateNumberToString(CallRuntime* call) {
11985   ASSERT_EQ(1, call->arguments()->length());
11986   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
11987   HValue* number = Pop();
11988   HValue* result = BuildNumberToString(number, Type::Any(zone()));
11989   return ast_context()->ReturnValue(result);
11990 }
11991
11992
11993 // Fast call for custom callbacks.
11994 void HOptimizedGraphBuilder::GenerateCallFunction(CallRuntime* call) {
11995   // 1 ~ The function to call is not itself an argument to the call.
11996   int arg_count = call->arguments()->length() - 1;
11997   ASSERT(arg_count >= 1);  // There's always at least a receiver.
11998
11999   CHECK_ALIVE(VisitExpressions(call->arguments()));
12000   // The function is the last argument
12001   HValue* function = Pop();
12002   // Push the arguments to the stack
12003   PushArgumentsFromEnvironment(arg_count);
12004
12005   IfBuilder if_is_jsfunction(this);
12006   if_is_jsfunction.If<HHasInstanceTypeAndBranch>(function, JS_FUNCTION_TYPE);
12007
12008   if_is_jsfunction.Then();
12009   {
12010     HInstruction* invoke_result =
12011         Add<HInvokeFunction>(function, arg_count);
12012     if (!ast_context()->IsEffect()) {
12013       Push(invoke_result);
12014     }
12015     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12016   }
12017
12018   if_is_jsfunction.Else();
12019   {
12020     HInstruction* call_result =
12021         Add<HCallFunction>(function, arg_count);
12022     if (!ast_context()->IsEffect()) {
12023       Push(call_result);
12024     }
12025     Add<HSimulate>(call->id(), FIXED_SIMULATE);
12026   }
12027   if_is_jsfunction.End();
12028
12029   if (ast_context()->IsEffect()) {
12030     // EffectContext::ReturnValue ignores the value, so we can just pass
12031     // 'undefined' (as we do not have the call result anymore).
12032     return ast_context()->ReturnValue(graph()->GetConstantUndefined());
12033   } else {
12034     return ast_context()->ReturnValue(Pop());
12035   }
12036 }
12037
12038
12039 // Fast call to math functions.
12040 void HOptimizedGraphBuilder::GenerateMathPow(CallRuntime* call) {
12041   ASSERT_EQ(2, call->arguments()->length());
12042   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12043   CHECK_ALIVE(VisitForValue(call->arguments()->at(1)));
12044   HValue* right = Pop();
12045   HValue* left = Pop();
12046   HInstruction* result = NewUncasted<HPower>(left, right);
12047   return ast_context()->ReturnInstruction(result, call->id());
12048 }
12049
12050
12051 void HOptimizedGraphBuilder::GenerateMathLogRT(CallRuntime* call) {
12052   ASSERT(call->arguments()->length() == 1);
12053   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12054   HValue* value = Pop();
12055   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathLog);
12056   return ast_context()->ReturnInstruction(result, call->id());
12057 }
12058
12059
12060 void HOptimizedGraphBuilder::GenerateMathSqrtRT(CallRuntime* call) {
12061   ASSERT(call->arguments()->length() == 1);
12062   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12063   HValue* value = Pop();
12064   HInstruction* result = NewUncasted<HUnaryMathOperation>(value, kMathSqrt);
12065   return ast_context()->ReturnInstruction(result, call->id());
12066 }
12067
12068
12069 void HOptimizedGraphBuilder::GenerateGetCachedArrayIndex(CallRuntime* call) {
12070   ASSERT(call->arguments()->length() == 1);
12071   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
12072   HValue* value = Pop();
12073   HGetCachedArrayIndex* result = New<HGetCachedArrayIndex>(value);
12074   return ast_context()->ReturnInstruction(result, call->id());
12075 }
12076
12077
12078 void HOptimizedGraphBuilder::GenerateFastAsciiArrayJoin(CallRuntime* call) {
12079   return Bailout(kInlinedRuntimeFunctionFastAsciiArrayJoin);
12080 }
12081
12082
12083 // Support for generators.
12084 void HOptimizedGraphBuilder::GenerateGeneratorNext(CallRuntime* call) {
12085   return Bailout(kInlinedRuntimeFunctionGeneratorNext);
12086 }
12087
12088
12089 void HOptimizedGraphBuilder::GenerateGeneratorThrow(CallRuntime* call) {
12090   return Bailout(kInlinedRuntimeFunctionGeneratorThrow);
12091 }
12092
12093
12094 void HOptimizedGraphBuilder::GenerateDebugBreakInOptimizedCode(
12095     CallRuntime* call) {
12096   Add<HDebugBreak>();
12097   return ast_context()->ReturnValue(graph()->GetConstant0());
12098 }
12099
12100
12101 void HOptimizedGraphBuilder::GenerateDebugCallbackSupportsStepping(
12102     CallRuntime* call) {
12103   ASSERT(call->arguments()->length() == 1);
12104   // Debugging is not supported in optimized code.
12105   return ast_context()->ReturnValue(graph()->GetConstantFalse());
12106 }
12107
12108
12109 #undef CHECK_BAILOUT
12110 #undef CHECK_ALIVE
12111
12112
12113 HEnvironment::HEnvironment(HEnvironment* outer,
12114                            Scope* scope,
12115                            Handle<JSFunction> closure,
12116                            Zone* zone)
12117     : closure_(closure),
12118       values_(0, zone),
12119       frame_type_(JS_FUNCTION),
12120       parameter_count_(0),
12121       specials_count_(1),
12122       local_count_(0),
12123       outer_(outer),
12124       entry_(NULL),
12125       pop_count_(0),
12126       push_count_(0),
12127       ast_id_(BailoutId::None()),
12128       zone_(zone) {
12129   Scope* declaration_scope = scope->DeclarationScope();
12130   Initialize(declaration_scope->num_parameters() + 1,
12131              declaration_scope->num_stack_slots(), 0);
12132 }
12133
12134
12135 HEnvironment::HEnvironment(Zone* zone, int parameter_count)
12136     : values_(0, zone),
12137       frame_type_(STUB),
12138       parameter_count_(parameter_count),
12139       specials_count_(1),
12140       local_count_(0),
12141       outer_(NULL),
12142       entry_(NULL),
12143       pop_count_(0),
12144       push_count_(0),
12145       ast_id_(BailoutId::None()),
12146       zone_(zone) {
12147   Initialize(parameter_count, 0, 0);
12148 }
12149
12150
12151 HEnvironment::HEnvironment(const HEnvironment* other, Zone* zone)
12152     : values_(0, zone),
12153       frame_type_(JS_FUNCTION),
12154       parameter_count_(0),
12155       specials_count_(0),
12156       local_count_(0),
12157       outer_(NULL),
12158       entry_(NULL),
12159       pop_count_(0),
12160       push_count_(0),
12161       ast_id_(other->ast_id()),
12162       zone_(zone) {
12163   Initialize(other);
12164 }
12165
12166
12167 HEnvironment::HEnvironment(HEnvironment* outer,
12168                            Handle<JSFunction> closure,
12169                            FrameType frame_type,
12170                            int arguments,
12171                            Zone* zone)
12172     : closure_(closure),
12173       values_(arguments, zone),
12174       frame_type_(frame_type),
12175       parameter_count_(arguments),
12176       specials_count_(0),
12177       local_count_(0),
12178       outer_(outer),
12179       entry_(NULL),
12180       pop_count_(0),
12181       push_count_(0),
12182       ast_id_(BailoutId::None()),
12183       zone_(zone) {
12184 }
12185
12186
12187 void HEnvironment::Initialize(int parameter_count,
12188                               int local_count,
12189                               int stack_height) {
12190   parameter_count_ = parameter_count;
12191   local_count_ = local_count;
12192
12193   // Avoid reallocating the temporaries' backing store on the first Push.
12194   int total = parameter_count + specials_count_ + local_count + stack_height;
12195   values_.Initialize(total + 4, zone());
12196   for (int i = 0; i < total; ++i) values_.Add(NULL, zone());
12197 }
12198
12199
12200 void HEnvironment::Initialize(const HEnvironment* other) {
12201   closure_ = other->closure();
12202   values_.AddAll(other->values_, zone());
12203   assigned_variables_.Union(other->assigned_variables_, zone());
12204   frame_type_ = other->frame_type_;
12205   parameter_count_ = other->parameter_count_;
12206   local_count_ = other->local_count_;
12207   if (other->outer_ != NULL) outer_ = other->outer_->Copy();  // Deep copy.
12208   entry_ = other->entry_;
12209   pop_count_ = other->pop_count_;
12210   push_count_ = other->push_count_;
12211   specials_count_ = other->specials_count_;
12212   ast_id_ = other->ast_id_;
12213 }
12214
12215
12216 void HEnvironment::AddIncomingEdge(HBasicBlock* block, HEnvironment* other) {
12217   ASSERT(!block->IsLoopHeader());
12218   ASSERT(values_.length() == other->values_.length());
12219
12220   int length = values_.length();
12221   for (int i = 0; i < length; ++i) {
12222     HValue* value = values_[i];
12223     if (value != NULL && value->IsPhi() && value->block() == block) {
12224       // There is already a phi for the i'th value.
12225       HPhi* phi = HPhi::cast(value);
12226       // Assert index is correct and that we haven't missed an incoming edge.
12227       ASSERT(phi->merged_index() == i || !phi->HasMergedIndex());
12228       ASSERT(phi->OperandCount() == block->predecessors()->length());
12229       phi->AddInput(other->values_[i]);
12230     } else if (values_[i] != other->values_[i]) {
12231       // There is a fresh value on the incoming edge, a phi is needed.
12232       ASSERT(values_[i] != NULL && other->values_[i] != NULL);
12233       HPhi* phi = block->AddNewPhi(i);
12234       HValue* old_value = values_[i];
12235       for (int j = 0; j < block->predecessors()->length(); j++) {
12236         phi->AddInput(old_value);
12237       }
12238       phi->AddInput(other->values_[i]);
12239       this->values_[i] = phi;
12240     }
12241   }
12242 }
12243
12244
12245 void HEnvironment::Bind(int index, HValue* value) {
12246   ASSERT(value != NULL);
12247   assigned_variables_.Add(index, zone());
12248   values_[index] = value;
12249 }
12250
12251
12252 bool HEnvironment::HasExpressionAt(int index) const {
12253   return index >= parameter_count_ + specials_count_ + local_count_;
12254 }
12255
12256
12257 bool HEnvironment::ExpressionStackIsEmpty() const {
12258   ASSERT(length() >= first_expression_index());
12259   return length() == first_expression_index();
12260 }
12261
12262
12263 void HEnvironment::SetExpressionStackAt(int index_from_top, HValue* value) {
12264   int count = index_from_top + 1;
12265   int index = values_.length() - count;
12266   ASSERT(HasExpressionAt(index));
12267   // The push count must include at least the element in question or else
12268   // the new value will not be included in this environment's history.
12269   if (push_count_ < count) {
12270     // This is the same effect as popping then re-pushing 'count' elements.
12271     pop_count_ += (count - push_count_);
12272     push_count_ = count;
12273   }
12274   values_[index] = value;
12275 }
12276
12277
12278 void HEnvironment::Drop(int count) {
12279   for (int i = 0; i < count; ++i) {
12280     Pop();
12281   }
12282 }
12283
12284
12285 HEnvironment* HEnvironment::Copy() const {
12286   return new(zone()) HEnvironment(this, zone());
12287 }
12288
12289
12290 HEnvironment* HEnvironment::CopyWithoutHistory() const {
12291   HEnvironment* result = Copy();
12292   result->ClearHistory();
12293   return result;
12294 }
12295
12296
12297 HEnvironment* HEnvironment::CopyAsLoopHeader(HBasicBlock* loop_header) const {
12298   HEnvironment* new_env = Copy();
12299   for (int i = 0; i < values_.length(); ++i) {
12300     HPhi* phi = loop_header->AddNewPhi(i);
12301     phi->AddInput(values_[i]);
12302     new_env->values_[i] = phi;
12303   }
12304   new_env->ClearHistory();
12305   return new_env;
12306 }
12307
12308
12309 HEnvironment* HEnvironment::CreateStubEnvironment(HEnvironment* outer,
12310                                                   Handle<JSFunction> target,
12311                                                   FrameType frame_type,
12312                                                   int arguments) const {
12313   HEnvironment* new_env =
12314       new(zone()) HEnvironment(outer, target, frame_type,
12315                                arguments + 1, zone());
12316   for (int i = 0; i <= arguments; ++i) {  // Include receiver.
12317     new_env->Push(ExpressionStackAt(arguments - i));
12318   }
12319   new_env->ClearHistory();
12320   return new_env;
12321 }
12322
12323
12324 HEnvironment* HEnvironment::CopyForInlining(
12325     Handle<JSFunction> target,
12326     int arguments,
12327     FunctionLiteral* function,
12328     HConstant* undefined,
12329     InliningKind inlining_kind) const {
12330   ASSERT(frame_type() == JS_FUNCTION);
12331
12332   // Outer environment is a copy of this one without the arguments.
12333   int arity = function->scope()->num_parameters();
12334
12335   HEnvironment* outer = Copy();
12336   outer->Drop(arguments + 1);  // Including receiver.
12337   outer->ClearHistory();
12338
12339   if (inlining_kind == CONSTRUCT_CALL_RETURN) {
12340     // Create artificial constructor stub environment.  The receiver should
12341     // actually be the constructor function, but we pass the newly allocated
12342     // object instead, DoComputeConstructStubFrame() relies on that.
12343     outer = CreateStubEnvironment(outer, target, JS_CONSTRUCT, arguments);
12344   } else if (inlining_kind == GETTER_CALL_RETURN) {
12345     // We need an additional StackFrame::INTERNAL frame for restoring the
12346     // correct context.
12347     outer = CreateStubEnvironment(outer, target, JS_GETTER, arguments);
12348   } else if (inlining_kind == SETTER_CALL_RETURN) {
12349     // We need an additional StackFrame::INTERNAL frame for temporarily saving
12350     // the argument of the setter, see StoreStubCompiler::CompileStoreViaSetter.
12351     outer = CreateStubEnvironment(outer, target, JS_SETTER, arguments);
12352   }
12353
12354   if (arity != arguments) {
12355     // Create artificial arguments adaptation environment.
12356     outer = CreateStubEnvironment(outer, target, ARGUMENTS_ADAPTOR, arguments);
12357   }
12358
12359   HEnvironment* inner =
12360       new(zone()) HEnvironment(outer, function->scope(), target, zone());
12361   // Get the argument values from the original environment.
12362   for (int i = 0; i <= arity; ++i) {  // Include receiver.
12363     HValue* push = (i <= arguments) ?
12364         ExpressionStackAt(arguments - i) : undefined;
12365     inner->SetValueAt(i, push);
12366   }
12367   inner->SetValueAt(arity + 1, context());
12368   for (int i = arity + 2; i < inner->length(); ++i) {
12369     inner->SetValueAt(i, undefined);
12370   }
12371
12372   inner->set_ast_id(BailoutId::FunctionEntry());
12373   return inner;
12374 }
12375
12376
12377 void HEnvironment::PrintTo(StringStream* stream) {
12378   for (int i = 0; i < length(); i++) {
12379     if (i == 0) stream->Add("parameters\n");
12380     if (i == parameter_count()) stream->Add("specials\n");
12381     if (i == parameter_count() + specials_count()) stream->Add("locals\n");
12382     if (i == parameter_count() + specials_count() + local_count()) {
12383       stream->Add("expressions\n");
12384     }
12385     HValue* val = values_.at(i);
12386     stream->Add("%d: ", i);
12387     if (val != NULL) {
12388       val->PrintNameTo(stream);
12389     } else {
12390       stream->Add("NULL");
12391     }
12392     stream->Add("\n");
12393   }
12394   PrintF("\n");
12395 }
12396
12397
12398 void HEnvironment::PrintToStd() {
12399   HeapStringAllocator string_allocator;
12400   StringStream trace(&string_allocator);
12401   PrintTo(&trace);
12402   PrintF("%s", trace.ToCString().get());
12403 }
12404
12405
12406 void HTracer::TraceCompilation(CompilationInfo* info) {
12407   Tag tag(this, "compilation");
12408   if (info->IsOptimizing()) {
12409     Handle<String> name = info->function()->debug_name();
12410     PrintStringProperty("name", name->ToCString().get());
12411     PrintIndent();
12412     trace_.Add("method \"%s:%d\"\n",
12413                name->ToCString().get(),
12414                info->optimization_id());
12415   } else {
12416     CodeStub::Major major_key = info->code_stub()->MajorKey();
12417     PrintStringProperty("name", CodeStub::MajorName(major_key, false));
12418     PrintStringProperty("method", "stub");
12419   }
12420   PrintLongProperty("date", static_cast<int64_t>(OS::TimeCurrentMillis()));
12421 }
12422
12423
12424 void HTracer::TraceLithium(const char* name, LChunk* chunk) {
12425   ASSERT(!chunk->isolate()->concurrent_recompilation_enabled());
12426   AllowHandleDereference allow_deref;
12427   AllowDeferredHandleDereference allow_deferred_deref;
12428   Trace(name, chunk->graph(), chunk);
12429 }
12430
12431
12432 void HTracer::TraceHydrogen(const char* name, HGraph* graph) {
12433   ASSERT(!graph->isolate()->concurrent_recompilation_enabled());
12434   AllowHandleDereference allow_deref;
12435   AllowDeferredHandleDereference allow_deferred_deref;
12436   Trace(name, graph, NULL);
12437 }
12438
12439
12440 void HTracer::Trace(const char* name, HGraph* graph, LChunk* chunk) {
12441   Tag tag(this, "cfg");
12442   PrintStringProperty("name", name);
12443   const ZoneList<HBasicBlock*>* blocks = graph->blocks();
12444   for (int i = 0; i < blocks->length(); i++) {
12445     HBasicBlock* current = blocks->at(i);
12446     Tag block_tag(this, "block");
12447     PrintBlockProperty("name", current->block_id());
12448     PrintIntProperty("from_bci", -1);
12449     PrintIntProperty("to_bci", -1);
12450
12451     if (!current->predecessors()->is_empty()) {
12452       PrintIndent();
12453       trace_.Add("predecessors");
12454       for (int j = 0; j < current->predecessors()->length(); ++j) {
12455         trace_.Add(" \"B%d\"", current->predecessors()->at(j)->block_id());
12456       }
12457       trace_.Add("\n");
12458     } else {
12459       PrintEmptyProperty("predecessors");
12460     }
12461
12462     if (current->end()->SuccessorCount() == 0) {
12463       PrintEmptyProperty("successors");
12464     } else  {
12465       PrintIndent();
12466       trace_.Add("successors");
12467       for (HSuccessorIterator it(current->end()); !it.Done(); it.Advance()) {
12468         trace_.Add(" \"B%d\"", it.Current()->block_id());
12469       }
12470       trace_.Add("\n");
12471     }
12472
12473     PrintEmptyProperty("xhandlers");
12474
12475     {
12476       PrintIndent();
12477       trace_.Add("flags");
12478       if (current->IsLoopSuccessorDominator()) {
12479         trace_.Add(" \"dom-loop-succ\"");
12480       }
12481       if (current->IsUnreachable()) {
12482         trace_.Add(" \"dead\"");
12483       }
12484       if (current->is_osr_entry()) {
12485         trace_.Add(" \"osr\"");
12486       }
12487       trace_.Add("\n");
12488     }
12489
12490     if (current->dominator() != NULL) {
12491       PrintBlockProperty("dominator", current->dominator()->block_id());
12492     }
12493
12494     PrintIntProperty("loop_depth", current->LoopNestingDepth());
12495
12496     if (chunk != NULL) {
12497       int first_index = current->first_instruction_index();
12498       int last_index = current->last_instruction_index();
12499       PrintIntProperty(
12500           "first_lir_id",
12501           LifetimePosition::FromInstructionIndex(first_index).Value());
12502       PrintIntProperty(
12503           "last_lir_id",
12504           LifetimePosition::FromInstructionIndex(last_index).Value());
12505     }
12506
12507     {
12508       Tag states_tag(this, "states");
12509       Tag locals_tag(this, "locals");
12510       int total = current->phis()->length();
12511       PrintIntProperty("size", current->phis()->length());
12512       PrintStringProperty("method", "None");
12513       for (int j = 0; j < total; ++j) {
12514         HPhi* phi = current->phis()->at(j);
12515         PrintIndent();
12516         trace_.Add("%d ", phi->merged_index());
12517         phi->PrintNameTo(&trace_);
12518         trace_.Add(" ");
12519         phi->PrintTo(&trace_);
12520         trace_.Add("\n");
12521       }
12522     }
12523
12524     {
12525       Tag HIR_tag(this, "HIR");
12526       for (HInstructionIterator it(current); !it.Done(); it.Advance()) {
12527         HInstruction* instruction = it.Current();
12528         int uses = instruction->UseCount();
12529         PrintIndent();
12530         trace_.Add("0 %d ", uses);
12531         instruction->PrintNameTo(&trace_);
12532         trace_.Add(" ");
12533         instruction->PrintTo(&trace_);
12534         if (FLAG_hydrogen_track_positions &&
12535             instruction->has_position() &&
12536             instruction->position().raw() != 0) {
12537           const HSourcePosition pos = instruction->position();
12538           trace_.Add(" pos:");
12539           if (pos.inlining_id() != 0) {
12540             trace_.Add("%d_", pos.inlining_id());
12541           }
12542           trace_.Add("%d", pos.position());
12543         }
12544         trace_.Add(" <|@\n");
12545       }
12546     }
12547
12548
12549     if (chunk != NULL) {
12550       Tag LIR_tag(this, "LIR");
12551       int first_index = current->first_instruction_index();
12552       int last_index = current->last_instruction_index();
12553       if (first_index != -1 && last_index != -1) {
12554         const ZoneList<LInstruction*>* instructions = chunk->instructions();
12555         for (int i = first_index; i <= last_index; ++i) {
12556           LInstruction* linstr = instructions->at(i);
12557           if (linstr != NULL) {
12558             PrintIndent();
12559             trace_.Add("%d ",
12560                        LifetimePosition::FromInstructionIndex(i).Value());
12561             linstr->PrintTo(&trace_);
12562             trace_.Add(" [hir:");
12563             linstr->hydrogen_value()->PrintNameTo(&trace_);
12564             trace_.Add("]");
12565             trace_.Add(" <|@\n");
12566           }
12567         }
12568       }
12569     }
12570   }
12571 }
12572
12573
12574 void HTracer::TraceLiveRanges(const char* name, LAllocator* allocator) {
12575   Tag tag(this, "intervals");
12576   PrintStringProperty("name", name);
12577
12578   const Vector<LiveRange*>* fixed_d = allocator->fixed_double_live_ranges();
12579   for (int i = 0; i < fixed_d->length(); ++i) {
12580     TraceLiveRange(fixed_d->at(i), "fixed", allocator->zone());
12581   }
12582
12583   const Vector<LiveRange*>* fixed = allocator->fixed_live_ranges();
12584   for (int i = 0; i < fixed->length(); ++i) {
12585     TraceLiveRange(fixed->at(i), "fixed", allocator->zone());
12586   }
12587
12588   const ZoneList<LiveRange*>* live_ranges = allocator->live_ranges();
12589   for (int i = 0; i < live_ranges->length(); ++i) {
12590     TraceLiveRange(live_ranges->at(i), "object", allocator->zone());
12591   }
12592 }
12593
12594
12595 void HTracer::TraceLiveRange(LiveRange* range, const char* type,
12596                              Zone* zone) {
12597   if (range != NULL && !range->IsEmpty()) {
12598     PrintIndent();
12599     trace_.Add("%d %s", range->id(), type);
12600     if (range->HasRegisterAssigned()) {
12601       LOperand* op = range->CreateAssignedOperand(zone);
12602       int assigned_reg = op->index();
12603       if (op->IsDoubleRegister()) {
12604         trace_.Add(" \"%s\"",
12605                    DoubleRegister::AllocationIndexToString(assigned_reg));
12606       } else if (op->IsFloat32x4Register()) {
12607         trace_.Add(" \"%s\"",
12608                    SIMD128Register::AllocationIndexToString(assigned_reg));
12609       } else if (op->IsFloat64x2Register()) {
12610         trace_.Add(" \"%s\"",
12611                    SIMD128Register::AllocationIndexToString(assigned_reg));
12612       } else if (op->IsInt32x4Register()) {
12613         trace_.Add(" \"%s\"",
12614                    SIMD128Register::AllocationIndexToString(assigned_reg));
12615       } else {
12616         ASSERT(op->IsRegister());
12617         trace_.Add(" \"%s\"", Register::AllocationIndexToString(assigned_reg));
12618       }
12619     } else if (range->IsSpilled()) {
12620       LOperand* op = range->TopLevel()->GetSpillOperand();
12621       if (op->IsDoubleStackSlot()) {
12622         trace_.Add(" \"double_stack:%d\"", op->index());
12623       } else if (op->IsFloat32x4StackSlot()) {
12624         trace_.Add(" \"float32x4_stack:%d\"", op->index());
12625       } else if (op->IsFloat64x2StackSlot()) {
12626         trace_.Add(" \"float64x2_stack:%d\"", op->index());
12627       } else if (op->IsInt32x4StackSlot()) {
12628         trace_.Add(" \"int32x4_stack:%d\"", op->index());
12629       } else {
12630         ASSERT(op->IsStackSlot());
12631         trace_.Add(" \"stack:%d\"", op->index());
12632       }
12633     }
12634     int parent_index = -1;
12635     if (range->IsChild()) {
12636       parent_index = range->parent()->id();
12637     } else {
12638       parent_index = range->id();
12639     }
12640     LOperand* op = range->FirstHint();
12641     int hint_index = -1;
12642     if (op != NULL && op->IsUnallocated()) {
12643       hint_index = LUnallocated::cast(op)->virtual_register();
12644     }
12645     trace_.Add(" %d %d", parent_index, hint_index);
12646     UseInterval* cur_interval = range->first_interval();
12647     while (cur_interval != NULL && range->Covers(cur_interval->start())) {
12648       trace_.Add(" [%d, %d[",
12649                  cur_interval->start().Value(),
12650                  cur_interval->end().Value());
12651       cur_interval = cur_interval->next();
12652     }
12653
12654     UsePosition* current_pos = range->first_pos();
12655     while (current_pos != NULL) {
12656       if (current_pos->RegisterIsBeneficial() || FLAG_trace_all_uses) {
12657         trace_.Add(" %d M", current_pos->pos().Value());
12658       }
12659       current_pos = current_pos->next();
12660     }
12661
12662     trace_.Add(" \"\"\n");
12663   }
12664 }
12665
12666
12667 void HTracer::FlushToFile() {
12668   AppendChars(filename_.start(), trace_.ToCString().get(), trace_.length(),
12669               false);
12670   trace_.Reset();
12671 }
12672
12673
12674 void HStatistics::Initialize(CompilationInfo* info) {
12675   if (info->shared_info().is_null()) return;
12676   source_size_ += info->shared_info()->SourceSize();
12677 }
12678
12679
12680 void HStatistics::Print() {
12681   PrintF("Timing results:\n");
12682   TimeDelta sum;
12683   for (int i = 0; i < times_.length(); ++i) {
12684     sum += times_[i];
12685   }
12686
12687   for (int i = 0; i < names_.length(); ++i) {
12688     PrintF("%32s", names_[i]);
12689     double ms = times_[i].InMillisecondsF();
12690     double percent = times_[i].PercentOf(sum);
12691     PrintF(" %8.3f ms / %4.1f %% ", ms, percent);
12692
12693     unsigned size = sizes_[i];
12694     double size_percent = static_cast<double>(size) * 100 / total_size_;
12695     PrintF(" %9u bytes / %4.1f %%\n", size, size_percent);
12696   }
12697
12698   PrintF("----------------------------------------"
12699          "---------------------------------------\n");
12700   TimeDelta total = create_graph_ + optimize_graph_ + generate_code_;
12701   PrintF("%32s %8.3f ms / %4.1f %% \n",
12702          "Create graph",
12703          create_graph_.InMillisecondsF(),
12704          create_graph_.PercentOf(total));
12705   PrintF("%32s %8.3f ms / %4.1f %% \n",
12706          "Optimize graph",
12707          optimize_graph_.InMillisecondsF(),
12708          optimize_graph_.PercentOf(total));
12709   PrintF("%32s %8.3f ms / %4.1f %% \n",
12710          "Generate and install code",
12711          generate_code_.InMillisecondsF(),
12712          generate_code_.PercentOf(total));
12713   PrintF("----------------------------------------"
12714          "---------------------------------------\n");
12715   PrintF("%32s %8.3f ms (%.1f times slower than full code gen)\n",
12716          "Total",
12717          total.InMillisecondsF(),
12718          total.TimesOf(full_code_gen_));
12719
12720   double source_size_in_kb = static_cast<double>(source_size_) / 1024;
12721   double normalized_time =  source_size_in_kb > 0
12722       ? total.InMillisecondsF() / source_size_in_kb
12723       : 0;
12724   double normalized_size_in_kb = source_size_in_kb > 0
12725       ? total_size_ / 1024 / source_size_in_kb
12726       : 0;
12727   PrintF("%32s %8.3f ms           %7.3f kB allocated\n",
12728          "Average per kB source",
12729          normalized_time, normalized_size_in_kb);
12730 }
12731
12732
12733 void HStatistics::SaveTiming(const char* name, TimeDelta time, unsigned size) {
12734   total_size_ += size;
12735   for (int i = 0; i < names_.length(); ++i) {
12736     if (strcmp(names_[i], name) == 0) {
12737       times_[i] += time;
12738       sizes_[i] += size;
12739       return;
12740     }
12741   }
12742   names_.Add(name);
12743   times_.Add(time);
12744   sizes_.Add(size);
12745 }
12746
12747
12748 HPhase::~HPhase() {
12749   if (ShouldProduceTraceOutput()) {
12750     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
12751   }
12752
12753 #ifdef DEBUG
12754   graph_->Verify(false);  // No full verify.
12755 #endif
12756 }
12757
12758 } }  // namespace v8::internal