[DFG] ToString operation should have fixup for primitives to say this node does not...
[WebKit-https.git] / Source / JavaScriptCore / dfg / DFGFixupPhase.cpp
1 /*
2  * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
24  */
25
26 #include "config.h"
27 #include "DFGFixupPhase.h"
28
29 #if ENABLE(DFG_JIT)
30
31 #include "ArrayPrototype.h"
32 #include "DFGGraph.h"
33 #include "DFGInferredTypeCheck.h"
34 #include "DFGInsertionSet.h"
35 #include "DFGPhase.h"
36 #include "DFGPredictionPropagationPhase.h"
37 #include "DFGVariableAccessDataDump.h"
38 #include "JSCInlines.h"
39 #include "TypeLocation.h"
40
41 namespace JSC { namespace DFG {
42
43 class FixupPhase : public Phase {
44 public:
45     FixupPhase(Graph& graph)
46         : Phase(graph, "fixup")
47         , m_insertionSet(graph)
48     {
49     }
50     
51     bool run()
52     {
53         ASSERT(m_graph.m_fixpointState == BeforeFixpoint);
54         ASSERT(m_graph.m_form == ThreadedCPS);
55         
56         m_profitabilityChanged = false;
57         for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
58             fixupBlock(m_graph.block(blockIndex));
59         
60         while (m_profitabilityChanged) {
61             m_profitabilityChanged = false;
62             
63             for (unsigned i = m_graph.m_argumentPositions.size(); i--;)
64                 m_graph.m_argumentPositions[i].mergeArgumentUnboxingAwareness();
65             
66             for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
67                 fixupGetAndSetLocalsInBlock(m_graph.block(blockIndex));
68         }
69         
70         for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex)
71             fixupChecksInBlock(m_graph.block(blockIndex));
72
73         m_graph.m_planStage = PlanStage::AfterFixup;
74
75         return true;
76     }
77
78 private:
79     void fixupBlock(BasicBlock* block)
80     {
81         if (!block)
82             return;
83         ASSERT(block->isReachable);
84         m_block = block;
85         for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
86             m_currentNode = block->at(m_indexInBlock);
87             fixupNode(m_currentNode);
88         }
89         m_insertionSet.execute(block);
90     }
91     
92     void fixupNode(Node* node)
93     {
94         NodeType op = node->op();
95
96         switch (op) {
97         case SetLocal: {
98             // This gets handled by fixupGetAndSetLocalsInBlock().
99             return;
100         }
101             
102         case BitAnd:
103         case BitOr:
104         case BitXor:
105         case BitRShift:
106         case BitLShift:
107         case BitURShift: {
108             if (Node::shouldSpeculateUntypedForBitOps(node->child1().node(), node->child2().node())) {
109                 fixEdge<UntypedUse>(node->child1());
110                 fixEdge<UntypedUse>(node->child2());
111                 break;
112             }
113             fixIntConvertingEdge(node->child1());
114             fixIntConvertingEdge(node->child2());
115             break;
116         }
117
118         case ArithIMul: {
119             fixIntConvertingEdge(node->child1());
120             fixIntConvertingEdge(node->child2());
121             node->setOp(ArithMul);
122             node->setArithMode(Arith::Unchecked);
123             node->child1().setUseKind(Int32Use);
124             node->child2().setUseKind(Int32Use);
125             break;
126         }
127
128         case ArithClz32: {
129             if (node->child1()->shouldSpeculateNotCell()) {
130                 fixIntConvertingEdge(node->child1());
131                 node->clearFlags(NodeMustGenerate);
132             } else
133                 fixEdge<UntypedUse>(node->child1());
134             break;
135         }
136             
137         case UInt32ToNumber: {
138             fixIntConvertingEdge(node->child1());
139             if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
140                 node->convertToIdentity();
141             else if (node->canSpeculateInt32(FixupPass))
142                 node->setArithMode(Arith::CheckOverflow);
143             else {
144                 node->setArithMode(Arith::DoOverflow);
145                 node->clearFlags(NodeMustGenerate);
146                 node->setResult(enableInt52() ? NodeResultInt52 : NodeResultDouble);
147             }
148             break;
149         }
150             
151         case ValueAdd: {
152             if (attemptToMakeIntegerAdd(node)) {
153                 node->setOp(ArithAdd);
154                 break;
155             }
156             if (Node::shouldSpeculateNumberOrBooleanExpectingDefined(node->child1().node(), node->child2().node())) {
157                 fixDoubleOrBooleanEdge(node->child1());
158                 fixDoubleOrBooleanEdge(node->child2());
159                 node->setOp(ArithAdd);
160                 node->setResult(NodeResultDouble);
161                 break;
162             }
163             
164             if (attemptToMakeFastStringAdd(node))
165                 break;
166
167             fixEdge<UntypedUse>(node->child1());
168             fixEdge<UntypedUse>(node->child2());
169             node->setResult(NodeResultJS);
170             break;
171         }
172
173         case StrCat: {
174             if (attemptToMakeFastStringAdd(node))
175                 break;
176
177             // FIXME: Remove empty string arguments and possibly turn this into a ToString operation. That
178             // would require a form of ToString that takes a KnownPrimitiveUse. This is necessary because
179             // the implementation of StrCat doesn't dynamically optimize for empty strings.
180             // https://bugs.webkit.org/show_bug.cgi?id=148540
181             m_graph.doToChildren(
182                 node,
183                 [&] (Edge& edge) {
184                     fixEdge<KnownPrimitiveUse>(edge);
185                 });
186             break;
187         }
188             
189         case MakeRope: {
190             fixupMakeRope(node);
191             break;
192         }
193             
194         case ArithAdd:
195         case ArithSub: {
196             if (op == ArithSub
197                 && Node::shouldSpeculateUntypedForArithmetic(node->child1().node(), node->child2().node())) {
198                 fixEdge<UntypedUse>(node->child1());
199                 fixEdge<UntypedUse>(node->child2());
200                 node->setResult(NodeResultJS);
201                 break;
202             }
203             if (attemptToMakeIntegerAdd(node))
204                 break;
205             fixDoubleOrBooleanEdge(node->child1());
206             fixDoubleOrBooleanEdge(node->child2());
207             node->setResult(NodeResultDouble);
208             break;
209         }
210             
211         case ArithNegate: {
212             if (node->child1()->shouldSpeculateInt32OrBoolean() && node->canSpeculateInt32(FixupPass)) {
213                 fixIntOrBooleanEdge(node->child1());
214                 if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
215                     node->setArithMode(Arith::Unchecked);
216                 else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
217                     node->setArithMode(Arith::CheckOverflow);
218                 else
219                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
220                 node->setResult(NodeResultInt32);
221                 node->clearFlags(NodeMustGenerate);
222                 break;
223             }
224             if (m_graph.unaryArithShouldSpeculateAnyInt(node, FixupPass)) {
225                 fixEdge<Int52RepUse>(node->child1());
226                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
227                     node->setArithMode(Arith::CheckOverflow);
228                 else
229                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
230                 node->setResult(NodeResultInt52);
231                 node->clearFlags(NodeMustGenerate);
232                 break;
233             }
234             if (node->child1()->shouldSpeculateNotCell()) {
235                 fixDoubleOrBooleanEdge(node->child1());
236                 node->setResult(NodeResultDouble);
237                 node->clearFlags(NodeMustGenerate);
238             } else
239                 fixEdge<UntypedUse>(node->child1());
240             break;
241         }
242             
243         case ArithMul: {
244             Edge& leftChild = node->child1();
245             Edge& rightChild = node->child2();
246             if (Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())) {
247                 fixEdge<UntypedUse>(leftChild);
248                 fixEdge<UntypedUse>(rightChild);
249                 node->setResult(NodeResultJS);
250                 break;
251             }
252             if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
253                 fixIntOrBooleanEdge(leftChild);
254                 fixIntOrBooleanEdge(rightChild);
255                 if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
256                     node->setArithMode(Arith::Unchecked);
257                 else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())
258                     || leftChild.node() == rightChild.node())
259                     node->setArithMode(Arith::CheckOverflow);
260                 else
261                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
262                 break;
263             }
264             if (m_graph.binaryArithShouldSpeculateAnyInt(node, FixupPass)) {
265                 fixEdge<Int52RepUse>(leftChild);
266                 fixEdge<Int52RepUse>(rightChild);
267                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags())
268                     || leftChild.node() == rightChild.node())
269                     node->setArithMode(Arith::CheckOverflow);
270                 else
271                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
272                 node->setResult(NodeResultInt52);
273                 break;
274             }
275             fixDoubleOrBooleanEdge(leftChild);
276             fixDoubleOrBooleanEdge(rightChild);
277             node->setResult(NodeResultDouble);
278             break;
279         }
280
281         case ArithDiv:
282         case ArithMod: {
283             Edge& leftChild = node->child1();
284             Edge& rightChild = node->child2();
285             if (op == ArithDiv
286                 && Node::shouldSpeculateUntypedForArithmetic(leftChild.node(), rightChild.node())
287                 && m_graph.hasExitSite(node->origin.semantic, BadType)) {
288                 fixEdge<UntypedUse>(leftChild);
289                 fixEdge<UntypedUse>(rightChild);
290                 node->setResult(NodeResultJS);
291                 break;
292             }
293             if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
294                 if (optimizeForX86() || optimizeForARM64() || optimizeForARMv7IDIVSupported()) {
295                     fixIntOrBooleanEdge(leftChild);
296                     fixIntOrBooleanEdge(rightChild);
297                     if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
298                         node->setArithMode(Arith::Unchecked);
299                     else if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
300                         node->setArithMode(Arith::CheckOverflow);
301                     else
302                         node->setArithMode(Arith::CheckOverflowAndNegativeZero);
303                     break;
304                 }
305                 
306                 // This will cause conversion nodes to be inserted later.
307                 fixDoubleOrBooleanEdge(leftChild);
308                 fixDoubleOrBooleanEdge(rightChild);
309                 
310                 // We don't need to do ref'ing on the children because we're stealing them from
311                 // the original division.
312                 Node* newDivision = m_insertionSet.insertNode(
313                     m_indexInBlock, SpecBytecodeDouble, *node);
314                 newDivision->setResult(NodeResultDouble);
315                 
316                 node->setOp(DoubleAsInt32);
317                 node->children.initialize(Edge(newDivision, DoubleRepUse), Edge(), Edge());
318                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
319                     node->setArithMode(Arith::CheckOverflow);
320                 else
321                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
322                 break;
323             }
324             fixDoubleOrBooleanEdge(leftChild);
325             fixDoubleOrBooleanEdge(rightChild);
326             node->setResult(NodeResultDouble);
327             break;
328         }
329             
330         case ArithMin:
331         case ArithMax: {
332             if (m_graph.binaryArithShouldSpeculateInt32(node, FixupPass)) {
333                 fixIntOrBooleanEdge(node->child1());
334                 fixIntOrBooleanEdge(node->child2());
335                 break;
336             }
337             fixDoubleOrBooleanEdge(node->child1());
338             fixDoubleOrBooleanEdge(node->child2());
339             node->setResult(NodeResultDouble);
340             break;
341         }
342             
343         case ArithAbs: {
344             if (node->child1()->shouldSpeculateInt32OrBoolean()
345                 && node->canSpeculateInt32(FixupPass)) {
346                 fixIntOrBooleanEdge(node->child1());
347                 if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
348                     node->setArithMode(Arith::Unchecked);
349                 else
350                     node->setArithMode(Arith::CheckOverflow);
351                 node->clearFlags(NodeMustGenerate);
352                 node->setResult(NodeResultInt32);
353                 break;
354             }
355
356             if (node->child1()->shouldSpeculateNotCell()) {
357                 fixDoubleOrBooleanEdge(node->child1());
358                 node->clearFlags(NodeMustGenerate);
359             } else
360                 fixEdge<UntypedUse>(node->child1());
361             node->setResult(NodeResultDouble);
362             break;
363         }
364
365         case ArithPow: {
366             if (node->child2()->shouldSpeculateInt32OrBooleanForArithmetic()) {
367                 fixDoubleOrBooleanEdge(node->child1());
368                 fixIntOrBooleanEdge(node->child2());
369                 break;
370             }
371
372             fixDoubleOrBooleanEdge(node->child1());
373             fixDoubleOrBooleanEdge(node->child2());
374             break;
375         }
376
377         case ArithRandom: {
378             node->setResult(NodeResultDouble);
379             break;
380         }
381
382         case ArithRound:
383         case ArithFloor:
384         case ArithCeil:
385         case ArithTrunc: {
386             if (node->child1()->shouldSpeculateInt32OrBoolean() && m_graph.roundShouldSpeculateInt32(node, FixupPass)) {
387                 fixIntOrBooleanEdge(node->child1());
388                 insertCheck<Int32Use>(node->child1().node());
389                 node->convertToIdentity();
390                 break;
391             }
392             if (node->child1()->shouldSpeculateNotCell()) {
393                 fixDoubleOrBooleanEdge(node->child1());
394
395                 if (isInt32OrBooleanSpeculation(node->getHeapPrediction()) && m_graph.roundShouldSpeculateInt32(node, FixupPass)) {
396                     node->setResult(NodeResultInt32);
397                     if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
398                         node->setArithRoundingMode(Arith::RoundingMode::Int32);
399                     else
400                         node->setArithRoundingMode(Arith::RoundingMode::Int32WithNegativeZeroCheck);
401                 } else {
402                     node->setResult(NodeResultDouble);
403                     node->setArithRoundingMode(Arith::RoundingMode::Double);
404                 }
405                 node->clearFlags(NodeMustGenerate);
406             } else
407                 fixEdge<UntypedUse>(node->child1());
408             break;
409         }
410
411         case ArithCos:
412         case ArithFRound:
413         case ArithLog:
414         case ArithSin:
415         case ArithSqrt:
416         case ArithTan: {
417             Edge& child1 = node->child1();
418             if (child1->shouldSpeculateNotCell()) {
419                 fixDoubleOrBooleanEdge(child1);
420                 node->clearFlags(NodeMustGenerate);
421             } else
422                 fixEdge<UntypedUse>(child1);
423             break;
424         }
425             
426         case LogicalNot: {
427             if (node->child1()->shouldSpeculateBoolean()) {
428                 if (node->child1()->result() == NodeResultBoolean) {
429                     // This is necessary in case we have a bytecode instruction implemented by:
430                     //
431                     // a: CompareEq(...)
432                     // b: LogicalNot(@a)
433                     //
434                     // In that case, CompareEq might have a side-effect. Then, we need to make
435                     // sure that we know that Branch does not exit.
436                     fixEdge<KnownBooleanUse>(node->child1());
437                 } else
438                     fixEdge<BooleanUse>(node->child1());
439             } else if (node->child1()->shouldSpeculateObjectOrOther())
440                 fixEdge<ObjectOrOtherUse>(node->child1());
441             else if (node->child1()->shouldSpeculateInt32OrBoolean())
442                 fixIntOrBooleanEdge(node->child1());
443             else if (node->child1()->shouldSpeculateNumber())
444                 fixEdge<DoubleRepUse>(node->child1());
445             else if (node->child1()->shouldSpeculateString())
446                 fixEdge<StringUse>(node->child1());
447             else if (node->child1()->shouldSpeculateStringOrOther())
448                 fixEdge<StringOrOtherUse>(node->child1());
449             else {
450                 WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
451                 if (masqueradesAsUndefinedWatchpoint->isStillValid())
452                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
453             }
454             break;
455         }
456
457         case CompareEq:
458         case CompareLess:
459         case CompareLessEq:
460         case CompareGreater:
461         case CompareGreaterEq: {
462             if (node->op() == CompareEq
463                 && Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
464                 fixEdge<BooleanUse>(node->child1());
465                 fixEdge<BooleanUse>(node->child2());
466                 node->clearFlags(NodeMustGenerate);
467                 break;
468             }
469             if (Node::shouldSpeculateInt32OrBoolean(node->child1().node(), node->child2().node())) {
470                 fixIntOrBooleanEdge(node->child1());
471                 fixIntOrBooleanEdge(node->child2());
472                 node->clearFlags(NodeMustGenerate);
473                 break;
474             }
475             if (enableInt52()
476                 && Node::shouldSpeculateAnyInt(node->child1().node(), node->child2().node())) {
477                 fixEdge<Int52RepUse>(node->child1());
478                 fixEdge<Int52RepUse>(node->child2());
479                 node->clearFlags(NodeMustGenerate);
480                 break;
481             }
482             if (Node::shouldSpeculateNumberOrBoolean(node->child1().node(), node->child2().node())) {
483                 fixDoubleOrBooleanEdge(node->child1());
484                 fixDoubleOrBooleanEdge(node->child2());
485             }
486             if (node->op() != CompareEq
487                 && node->child1()->shouldSpeculateNotCell()
488                 && node->child2()->shouldSpeculateNotCell()) {
489                 if (node->child1()->shouldSpeculateNumberOrBoolean())
490                     fixDoubleOrBooleanEdge(node->child1());
491                 else
492                     fixEdge<DoubleRepUse>(node->child1());
493                 if (node->child2()->shouldSpeculateNumberOrBoolean())
494                     fixDoubleOrBooleanEdge(node->child2());
495                 else
496                     fixEdge<DoubleRepUse>(node->child2());
497                 node->clearFlags(NodeMustGenerate);
498                 break;
499             }
500             if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
501                 fixEdge<StringIdentUse>(node->child1());
502                 fixEdge<StringIdentUse>(node->child2());
503                 node->clearFlags(NodeMustGenerate);
504                 break;
505             }
506             if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && GPRInfo::numberOfRegisters >= 7) {
507                 fixEdge<StringUse>(node->child1());
508                 fixEdge<StringUse>(node->child2());
509                 node->clearFlags(NodeMustGenerate);
510                 break;
511             }
512
513             if (node->op() != CompareEq)
514                 break;
515             if (Node::shouldSpeculateSymbol(node->child1().node(), node->child2().node())) {
516                 fixEdge<SymbolUse>(node->child1());
517                 fixEdge<SymbolUse>(node->child2());
518                 node->clearFlags(NodeMustGenerate);
519                 break;
520             }
521             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
522                 fixEdge<ObjectUse>(node->child1());
523                 fixEdge<ObjectUse>(node->child2());
524                 node->clearFlags(NodeMustGenerate);
525                 break;
526             }
527
528             // If either child can be proved to be Null or Undefined, comparing them is greatly simplified.
529             bool oneArgumentIsUsedAsSpecOther = false;
530             if (node->child1()->isUndefinedOrNullConstant()) {
531                 fixEdge<OtherUse>(node->child1());
532                 oneArgumentIsUsedAsSpecOther = true;
533             } else if (node->child1()->shouldSpeculateOther()) {
534                 m_insertionSet.insertNode(m_indexInBlock, SpecNone, Check, node->origin,
535                     Edge(node->child1().node(), OtherUse));
536                 fixEdge<OtherUse>(node->child1());
537                 oneArgumentIsUsedAsSpecOther = true;
538             }
539             if (node->child2()->isUndefinedOrNullConstant()) {
540                 fixEdge<OtherUse>(node->child2());
541                 oneArgumentIsUsedAsSpecOther = true;
542             } else if (node->child2()->shouldSpeculateOther()) {
543                 m_insertionSet.insertNode(m_indexInBlock, SpecNone, Check, node->origin,
544                     Edge(node->child2().node(), OtherUse));
545                 fixEdge<OtherUse>(node->child2());
546                 oneArgumentIsUsedAsSpecOther = true;
547             }
548             if (oneArgumentIsUsedAsSpecOther) {
549                 node->clearFlags(NodeMustGenerate);
550                 break;
551             }
552
553             if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObjectOrOther()) {
554                 fixEdge<ObjectUse>(node->child1());
555                 fixEdge<ObjectOrOtherUse>(node->child2());
556                 node->clearFlags(NodeMustGenerate);
557                 break;
558             }
559             if (node->child1()->shouldSpeculateObjectOrOther() && node->child2()->shouldSpeculateObject()) {
560                 fixEdge<ObjectOrOtherUse>(node->child1());
561                 fixEdge<ObjectUse>(node->child2());
562                 node->clearFlags(NodeMustGenerate);
563                 break;
564             }
565
566             break;
567         }
568             
569         case CompareStrictEq: {
570             if (Node::shouldSpeculateBoolean(node->child1().node(), node->child2().node())) {
571                 fixEdge<BooleanUse>(node->child1());
572                 fixEdge<BooleanUse>(node->child2());
573                 break;
574             }
575             if (Node::shouldSpeculateInt32(node->child1().node(), node->child2().node())) {
576                 fixEdge<Int32Use>(node->child1());
577                 fixEdge<Int32Use>(node->child2());
578                 break;
579             }
580             if (enableInt52()
581                 && Node::shouldSpeculateAnyInt(node->child1().node(), node->child2().node())) {
582                 fixEdge<Int52RepUse>(node->child1());
583                 fixEdge<Int52RepUse>(node->child2());
584                 break;
585             }
586             if (Node::shouldSpeculateNumber(node->child1().node(), node->child2().node())) {
587                 fixEdge<DoubleRepUse>(node->child1());
588                 fixEdge<DoubleRepUse>(node->child2());
589                 break;
590             }
591             if (Node::shouldSpeculateSymbol(node->child1().node(), node->child2().node())) {
592                 fixEdge<SymbolUse>(node->child1());
593                 fixEdge<SymbolUse>(node->child2());
594                 break;
595             }
596             if (node->child1()->shouldSpeculateStringIdent() && node->child2()->shouldSpeculateStringIdent()) {
597                 fixEdge<StringIdentUse>(node->child1());
598                 fixEdge<StringIdentUse>(node->child2());
599                 break;
600             }
601             if (node->child1()->shouldSpeculateString() && node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 7) || isFTL(m_graph.m_plan.mode))) {
602                 fixEdge<StringUse>(node->child1());
603                 fixEdge<StringUse>(node->child2());
604                 break;
605             }
606             WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
607             if (masqueradesAsUndefinedWatchpoint->isStillValid()) {
608                 
609                 if (node->child1()->shouldSpeculateObject()) {
610                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
611                     fixEdge<ObjectUse>(node->child1());
612                     break;
613                 }
614                 if (node->child2()->shouldSpeculateObject()) {
615                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
616                     fixEdge<ObjectUse>(node->child2());
617                     break;
618                 }
619                 
620             } else if (node->child1()->shouldSpeculateObject() && node->child2()->shouldSpeculateObject()) {
621                 fixEdge<ObjectUse>(node->child1());
622                 fixEdge<ObjectUse>(node->child2());
623                 break;
624             }
625             if (node->child1()->shouldSpeculateSymbol()) {
626                 fixEdge<SymbolUse>(node->child1());
627                 break;
628             }
629             if (node->child2()->shouldSpeculateSymbol()) {
630                 fixEdge<SymbolUse>(node->child2());
631                 break;
632             }
633             if (node->child1()->shouldSpeculateMisc()) {
634                 fixEdge<MiscUse>(node->child1());
635                 break;
636             }
637             if (node->child2()->shouldSpeculateMisc()) {
638                 fixEdge<MiscUse>(node->child2());
639                 break;
640             }
641             if (node->child1()->shouldSpeculateStringIdent()
642                 && node->child2()->shouldSpeculateNotStringVar()) {
643                 fixEdge<StringIdentUse>(node->child1());
644                 fixEdge<NotStringVarUse>(node->child2());
645                 break;
646             }
647             if (node->child2()->shouldSpeculateStringIdent()
648                 && node->child1()->shouldSpeculateNotStringVar()) {
649                 fixEdge<StringIdentUse>(node->child2());
650                 fixEdge<NotStringVarUse>(node->child1());
651                 break;
652             }
653             if (node->child1()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {
654                 fixEdge<StringUse>(node->child1());
655                 break;
656             }
657             if (node->child2()->shouldSpeculateString() && ((GPRInfo::numberOfRegisters >= 8) || isFTL(m_graph.m_plan.mode))) {
658                 fixEdge<StringUse>(node->child2());
659                 break;
660             }
661             break;
662         }
663             
664         case StringFromCharCode:
665             if (node->child1()->shouldSpeculateInt32())
666                 fixEdge<Int32Use>(node->child1());
667             else
668                 fixEdge<UntypedUse>(node->child1());
669             break;
670
671         case StringCharAt:
672         case StringCharCodeAt: {
673             // Currently we have no good way of refining these.
674             ASSERT(node->arrayMode() == ArrayMode(Array::String));
675             blessArrayOperation(node->child1(), node->child2(), node->child3());
676             fixEdge<KnownCellUse>(node->child1());
677             fixEdge<Int32Use>(node->child2());
678             break;
679         }
680
681         case GetByVal: {
682             if (!node->prediction()) {
683                 m_insertionSet.insertNode(
684                     m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
685             }
686             
687             node->setArrayMode(
688                 node->arrayMode().refine(
689                     m_graph, node,
690                     node->child1()->prediction(),
691                     node->child2()->prediction(),
692                     SpecNone));
693             
694             blessArrayOperation(node->child1(), node->child2(), node->child3());
695             
696             ArrayMode arrayMode = node->arrayMode();
697             switch (arrayMode.type()) {
698             case Array::Contiguous:
699             case Array::Double:
700                 if (arrayMode.arrayClass() == Array::OriginalArray
701                     && arrayMode.speculation() == Array::InBounds) {
702                     JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
703                     if (globalObject->arrayPrototypeChainIsSane()) {
704                         // Check if SaneChain will work on a per-type basis. Note that:
705                         //
706                         // 1) We don't want double arrays to sometimes return undefined, since
707                         // that would require a change to the return type and it would pessimise
708                         // things a lot. So, we'd only want to do that if we actually had
709                         // evidence that we could read from a hole. That's pretty annoying.
710                         // Likely the best way to handle that case is with an equivalent of
711                         // SaneChain for OutOfBounds. For now we just detect when Undefined and
712                         // NaN are indistinguishable according to backwards propagation, and just
713                         // use SaneChain in that case. This happens to catch a lot of cases.
714                         //
715                         // 2) We don't want int32 array loads to have to do a hole check just to
716                         // coerce to Undefined, since that would mean twice the checks.
717                         //
718                         // This has two implications. First, we have to do more checks than we'd
719                         // like. It's unfortunate that we have to do the hole check. Second,
720                         // some accesses that hit a hole will now need to take the full-blown
721                         // out-of-bounds slow path. We can fix that with:
722                         // https://bugs.webkit.org/show_bug.cgi?id=144668
723                         
724                         bool canDoSaneChain = false;
725                         switch (arrayMode.type()) {
726                         case Array::Contiguous:
727                             // This is happens to be entirely natural. We already would have
728                             // returned any JSValue, and now we'll return Undefined. We still do
729                             // the check but it doesn't require taking any kind of slow path.
730                             canDoSaneChain = true;
731                             break;
732                             
733                         case Array::Double:
734                             if (!(node->flags() & NodeBytecodeUsesAsOther)) {
735                                 // Holes look like NaN already, so if the user doesn't care
736                                 // about the difference between Undefined and NaN then we can
737                                 // do this.
738                                 canDoSaneChain = true;
739                             }
740                             break;
741                             
742                         default:
743                             break;
744                         }
745                         
746                         if (canDoSaneChain) {
747                             m_graph.watchpoints().addLazily(
748                                 globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
749                             m_graph.watchpoints().addLazily(
750                                 globalObject->objectPrototype()->structure()->transitionWatchpointSet());
751                             if (globalObject->arrayPrototypeChainIsSane())
752                                 node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
753                         }
754                     }
755                 }
756                 break;
757                 
758             case Array::String:
759                 if ((node->prediction() & ~SpecString)
760                     || m_graph.hasExitSite(node->origin.semantic, OutOfBounds))
761                     node->setArrayMode(arrayMode.withSpeculation(Array::OutOfBounds));
762                 break;
763                 
764             default:
765                 break;
766             }
767             
768             arrayMode = node->arrayMode();
769             switch (arrayMode.type()) {
770             case Array::SelectUsingPredictions:
771             case Array::Unprofiled:
772                 RELEASE_ASSERT_NOT_REACHED();
773                 break;
774             case Array::Generic:
775 #if USE(JSVALUE32_64)
776                 fixEdge<CellUse>(node->child1()); // Speculating cell due to register pressure on 32-bit.
777 #endif
778                 break;
779             case Array::ForceExit:
780                 break;
781             default:
782                 fixEdge<KnownCellUse>(node->child1());
783                 fixEdge<Int32Use>(node->child2());
784                 break;
785             }
786             
787             switch (arrayMode.type()) {
788             case Array::Double:
789                 if (!arrayMode.isOutOfBounds())
790                     node->setResult(NodeResultDouble);
791                 break;
792                 
793             case Array::Float32Array:
794             case Array::Float64Array:
795                 node->setResult(NodeResultDouble);
796                 break;
797                 
798             case Array::Uint32Array:
799                 if (node->shouldSpeculateInt32())
800                     break;
801                 if (node->shouldSpeculateAnyInt() && enableInt52())
802                     node->setResult(NodeResultInt52);
803                 else
804                     node->setResult(NodeResultDouble);
805                 break;
806                 
807             default:
808                 break;
809             }
810             
811             break;
812         }
813
814         case PutByValDirect:
815         case PutByVal:
816         case PutByValAlias: {
817             Edge& child1 = m_graph.varArgChild(node, 0);
818             Edge& child2 = m_graph.varArgChild(node, 1);
819             Edge& child3 = m_graph.varArgChild(node, 2);
820
821             node->setArrayMode(
822                 node->arrayMode().refine(
823                     m_graph, node,
824                     child1->prediction(),
825                     child2->prediction(),
826                     child3->prediction()));
827             
828             blessArrayOperation(child1, child2, m_graph.varArgChild(node, 3));
829             
830             switch (node->arrayMode().modeForPut().type()) {
831             case Array::SelectUsingPredictions:
832             case Array::SelectUsingArguments:
833             case Array::Unprofiled:
834             case Array::Undecided:
835                 RELEASE_ASSERT_NOT_REACHED();
836                 break;
837             case Array::ForceExit:
838             case Array::Generic:
839 #if USE(JSVALUE32_64)
840                 // Due to register pressure on 32-bit, we speculate cell and
841                 // ignore the base-is-not-cell case entirely by letting the
842                 // baseline JIT handle it.
843                 fixEdge<CellUse>(child1);
844 #endif
845                 break;
846             case Array::Int32:
847                 fixEdge<KnownCellUse>(child1);
848                 fixEdge<Int32Use>(child2);
849                 fixEdge<Int32Use>(child3);
850                 break;
851             case Array::Double:
852                 fixEdge<KnownCellUse>(child1);
853                 fixEdge<Int32Use>(child2);
854                 fixEdge<DoubleRepRealUse>(child3);
855                 break;
856             case Array::Int8Array:
857             case Array::Int16Array:
858             case Array::Int32Array:
859             case Array::Uint8Array:
860             case Array::Uint8ClampedArray:
861             case Array::Uint16Array:
862             case Array::Uint32Array:
863                 fixEdge<KnownCellUse>(child1);
864                 fixEdge<Int32Use>(child2);
865                 if (child3->shouldSpeculateInt32())
866                     fixIntOrBooleanEdge(child3);
867                 else if (child3->shouldSpeculateAnyInt())
868                     fixEdge<Int52RepUse>(child3);
869                 else
870                     fixDoubleOrBooleanEdge(child3);
871                 break;
872             case Array::Float32Array:
873             case Array::Float64Array:
874                 fixEdge<KnownCellUse>(child1);
875                 fixEdge<Int32Use>(child2);
876                 fixDoubleOrBooleanEdge(child3);
877                 break;
878             case Array::Contiguous:
879             case Array::ArrayStorage:
880             case Array::SlowPutArrayStorage:
881                 fixEdge<KnownCellUse>(child1);
882                 fixEdge<Int32Use>(child2);
883                 speculateForBarrier(child3);
884                 break;
885             default:
886                 fixEdge<KnownCellUse>(child1);
887                 fixEdge<Int32Use>(child2);
888                 break;
889             }
890             break;
891         }
892             
893         case ArrayPush: {
894             // May need to refine the array mode in case the value prediction contravenes
895             // the array prediction. For example, we may have evidence showing that the
896             // array is in Int32 mode, but the value we're storing is likely to be a double.
897             // Then we should turn this into a conversion to Double array followed by the
898             // push. On the other hand, we absolutely don't want to refine based on the
899             // base prediction. If it has non-cell garbage in it, then we want that to be
900             // ignored. That's because ArrayPush can't handle any array modes that aren't
901             // array-related - so if refine() turned this into a "Generic" ArrayPush then
902             // that would break things.
903             node->setArrayMode(
904                 node->arrayMode().refine(
905                     m_graph, node,
906                     node->child1()->prediction() & SpecCell,
907                     SpecInt32Only,
908                     node->child2()->prediction()));
909             blessArrayOperation(node->child1(), Edge(), node->child3());
910             fixEdge<KnownCellUse>(node->child1());
911             
912             switch (node->arrayMode().type()) {
913             case Array::Int32:
914                 fixEdge<Int32Use>(node->child2());
915                 break;
916             case Array::Double:
917                 fixEdge<DoubleRepRealUse>(node->child2());
918                 break;
919             case Array::Contiguous:
920             case Array::ArrayStorage:
921                 speculateForBarrier(node->child2());
922                 break;
923             default:
924                 break;
925             }
926             break;
927         }
928             
929         case ArrayPop: {
930             blessArrayOperation(node->child1(), Edge(), node->child2());
931             fixEdge<KnownCellUse>(node->child1());
932             break;
933         }
934
935         case ArraySlice: {
936             fixEdge<KnownCellUse>(m_graph.varArgChild(node, 0));
937             fixEdge<Int32Use>(m_graph.varArgChild(node, 1));
938             if (node->numChildren() == 4)
939                 fixEdge<Int32Use>(m_graph.varArgChild(node, 2));
940             break;
941         }
942             
943         case RegExpExec:
944         case RegExpTest: {
945             fixEdge<KnownCellUse>(node->child1());
946             
947             if (node->child2()->shouldSpeculateRegExpObject()) {
948                 fixEdge<RegExpObjectUse>(node->child2());
949
950                 if (node->child3()->shouldSpeculateString())
951                     fixEdge<StringUse>(node->child3());
952             }
953             break;
954         }
955
956         case StringReplace:
957         case StringReplaceRegExp: {
958             if (node->child2()->shouldSpeculateString()) {
959                 m_insertionSet.insertNode(
960                     m_indexInBlock, SpecNone, Check, node->origin,
961                     Edge(node->child2().node(), StringUse));
962                 fixEdge<StringUse>(node->child2());
963             } else if (op == StringReplace) {
964                 if (node->child2()->shouldSpeculateRegExpObject())
965                     addStringReplacePrimordialChecks(node->child2().node());
966                 else 
967                     m_insertionSet.insertNode(
968                         m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
969             }
970
971             if (node->child1()->shouldSpeculateString()
972                 && node->child2()->shouldSpeculateRegExpObject()
973                 && node->child3()->shouldSpeculateString()) {
974
975                 fixEdge<StringUse>(node->child1());
976                 fixEdge<RegExpObjectUse>(node->child2());
977                 fixEdge<StringUse>(node->child3());
978                 break;
979             }
980             break;
981         }
982             
983         case Branch: {
984             if (node->child1()->shouldSpeculateBoolean()) {
985                 if (node->child1()->result() == NodeResultBoolean) {
986                     // This is necessary in case we have a bytecode instruction implemented by:
987                     //
988                     // a: CompareEq(...)
989                     // b: Branch(@a)
990                     //
991                     // In that case, CompareEq might have a side-effect. Then, we need to make
992                     // sure that we know that Branch does not exit.
993                     fixEdge<KnownBooleanUse>(node->child1());
994                 } else
995                     fixEdge<BooleanUse>(node->child1());
996             } else if (node->child1()->shouldSpeculateObjectOrOther())
997                 fixEdge<ObjectOrOtherUse>(node->child1());
998             else if (node->child1()->shouldSpeculateInt32OrBoolean())
999                 fixIntOrBooleanEdge(node->child1());
1000             else if (node->child1()->shouldSpeculateNumber())
1001                 fixEdge<DoubleRepUse>(node->child1());
1002             else if (node->child1()->shouldSpeculateString())
1003                 fixEdge<StringUse>(node->child1());
1004             else if (node->child1()->shouldSpeculateStringOrOther())
1005                 fixEdge<StringOrOtherUse>(node->child1());
1006             else {
1007                 WatchpointSet* masqueradesAsUndefinedWatchpoint = m_graph.globalObjectFor(node->origin.semantic)->masqueradesAsUndefinedWatchpoint();
1008                 if (masqueradesAsUndefinedWatchpoint->isStillValid())
1009                     m_graph.watchpoints().addLazily(masqueradesAsUndefinedWatchpoint);
1010             }
1011             break;
1012         }
1013             
1014         case Switch: {
1015             SwitchData* data = node->switchData();
1016             switch (data->kind) {
1017             case SwitchImm:
1018                 if (node->child1()->shouldSpeculateInt32())
1019                     fixEdge<Int32Use>(node->child1());
1020                 break;
1021             case SwitchChar:
1022                 if (node->child1()->shouldSpeculateString())
1023                     fixEdge<StringUse>(node->child1());
1024                 break;
1025             case SwitchString:
1026                 if (node->child1()->shouldSpeculateStringIdent())
1027                     fixEdge<StringIdentUse>(node->child1());
1028                 else if (node->child1()->shouldSpeculateString())
1029                     fixEdge<StringUse>(node->child1());
1030                 break;
1031             case SwitchCell:
1032                 if (node->child1()->shouldSpeculateCell())
1033                     fixEdge<CellUse>(node->child1());
1034                 // else it's fine for this to have UntypedUse; we will handle this by just making
1035                 // non-cells take the default case.
1036                 break;
1037             }
1038             break;
1039         }
1040             
1041         case ToPrimitive: {
1042             fixupToPrimitive(node);
1043             break;
1044         }
1045
1046         case ToNumber: {
1047             fixupToNumber(node);
1048             break;
1049         }
1050             
1051         case ToString:
1052         case CallStringConstructor: {
1053             fixupToStringOrCallStringConstructor(node);
1054             break;
1055         }
1056             
1057         case NewStringObject: {
1058             fixEdge<KnownStringUse>(node->child1());
1059             break;
1060         }
1061
1062         case NewArrayWithSpread: {
1063             watchHavingABadTime(node);
1064             
1065             BitVector* bitVector = node->bitVector();
1066             for (unsigned i = node->numChildren(); i--;) {
1067                 if (bitVector->get(i))
1068                     fixEdge<KnownCellUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
1069                 else
1070                     fixEdge<UntypedUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
1071             }
1072
1073             break;
1074         }
1075
1076         case Spread: {
1077             // Note: We care about performing the protocol on our child's global object, not necessarily ours.
1078             
1079             watchHavingABadTime(node->child1().node());
1080
1081             JSGlobalObject* globalObject = m_graph.globalObjectFor(node->child1()->origin.semantic);
1082             // When we go down the fast path, we don't consult the prototype chain, so we must prove
1083             // that it doesn't contain any indexed properties, and that any holes will result in
1084             // jsUndefined().
1085             InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
1086             InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
1087             if (node->child1()->shouldSpeculateArray() 
1088                 && arrayPrototypeTransition.isStillValid() 
1089                 && objectPrototypeTransition.isStillValid() 
1090                 && globalObject->arrayPrototypeChainIsSane()
1091                 && m_graph.isWatchingArrayIteratorProtocolWatchpoint(node->child1().node())
1092                 && m_graph.isWatchingHavingABadTimeWatchpoint(node->child1().node())) {
1093                 m_graph.watchpoints().addLazily(objectPrototypeTransition);
1094                 m_graph.watchpoints().addLazily(arrayPrototypeTransition);
1095                 fixEdge<ArrayUse>(node->child1());
1096             } else
1097                 fixEdge<CellUse>(node->child1());
1098             break;
1099         }
1100             
1101         case NewArray: {
1102             watchHavingABadTime(node);
1103             
1104             for (unsigned i = m_graph.varArgNumChildren(node); i--;) {
1105                 node->setIndexingType(
1106                     leastUpperBoundOfIndexingTypeAndType(
1107                         node->indexingType(), m_graph.varArgChild(node, i)->prediction()));
1108             }
1109             switch (node->indexingType()) {
1110             case ALL_BLANK_INDEXING_TYPES:
1111                 CRASH();
1112                 break;
1113             case ALL_UNDECIDED_INDEXING_TYPES:
1114                 if (node->numChildren()) {
1115                     // This will only happen if the children have no type predictions. We
1116                     // would have already exited by now, but insert a forced exit just to
1117                     // be safe.
1118                     m_insertionSet.insertNode(
1119                         m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
1120                 }
1121                 break;
1122             case ALL_INT32_INDEXING_TYPES:
1123                 for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
1124                     fixEdge<Int32Use>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
1125                 break;
1126             case ALL_DOUBLE_INDEXING_TYPES:
1127                 for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
1128                     fixEdge<DoubleRepRealUse>(m_graph.m_varArgChildren[node->firstChild() + operandIndex]);
1129                 break;
1130             case ALL_CONTIGUOUS_INDEXING_TYPES:
1131             case ALL_ARRAY_STORAGE_INDEXING_TYPES:
1132                 break;
1133             default:
1134                 CRASH();
1135                 break;
1136             }
1137             break;
1138         }
1139             
1140         case NewTypedArray: {
1141             watchHavingABadTime(node);
1142             
1143             if (node->child1()->shouldSpeculateInt32()) {
1144                 fixEdge<Int32Use>(node->child1());
1145                 node->clearFlags(NodeMustGenerate);
1146                 break;
1147             }
1148             break;
1149         }
1150             
1151         case NewArrayWithSize: {
1152             watchHavingABadTime(node);
1153             fixEdge<Int32Use>(node->child1());
1154             break;
1155         }
1156
1157         case NewArrayBuffer: {
1158             watchHavingABadTime(node);
1159             break;
1160         }
1161
1162         case CallObjectConstructor: {
1163             if (node->child1()->shouldSpeculateObject()) {
1164                 fixEdge<ObjectUse>(node->child1());
1165                 node->convertToIdentity();
1166                 break;
1167             }
1168
1169             fixEdge<UntypedUse>(node->child1());
1170             break;
1171         }
1172
1173         case ToThis: {
1174             fixupToThis(node);
1175             break;
1176         }
1177             
1178         case PutStructure: {
1179             fixEdge<KnownCellUse>(node->child1());
1180             break;
1181         }
1182             
1183         case GetClosureVar:
1184         case GetFromArguments: {
1185             fixEdge<KnownCellUse>(node->child1());
1186             break;
1187         }
1188
1189         case PutClosureVar:
1190         case PutToArguments: {
1191             fixEdge<KnownCellUse>(node->child1());
1192             speculateForBarrier(node->child2());
1193             break;
1194         }
1195
1196         case SkipScope:
1197         case GetScope:
1198         case GetGetter:
1199         case GetSetter:
1200         case GetGlobalObject: {
1201             fixEdge<KnownCellUse>(node->child1());
1202             break;
1203         }
1204             
1205         case AllocatePropertyStorage:
1206         case ReallocatePropertyStorage: {
1207             fixEdge<KnownCellUse>(node->child1());
1208             break;
1209         }
1210             
1211         case NukeStructureAndSetButterfly: {
1212             fixEdge<KnownCellUse>(node->child1());
1213             break;
1214         }
1215
1216         case TryGetById: {
1217             if (node->child1()->shouldSpeculateCell())
1218                 fixEdge<CellUse>(node->child1());
1219             break;
1220         }
1221
1222         case GetById:
1223         case GetByIdFlush: {
1224             // FIXME: This should be done in the ByteCodeParser based on reading the
1225             // PolymorphicAccess, which will surely tell us that this is a AccessCase::ArrayLength.
1226             // https://bugs.webkit.org/show_bug.cgi?id=154990
1227             if (node->child1()->shouldSpeculateCellOrOther()
1228                 && !m_graph.hasExitSite(node->origin.semantic, BadType)
1229                 && !m_graph.hasExitSite(node->origin.semantic, BadCache)
1230                 && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)
1231                 && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {
1232                 
1233                 auto uid = m_graph.identifiers()[node->identifierNumber()];
1234                 
1235                 if (uid == vm().propertyNames->length.impl()) {
1236                     attemptToMakeGetArrayLength(node);
1237                     break;
1238                 }
1239
1240                 if (uid == vm().propertyNames->lastIndex.impl()
1241                     && node->child1()->shouldSpeculateRegExpObject()) {
1242                     node->setOp(GetRegExpObjectLastIndex);
1243                     node->clearFlags(NodeMustGenerate);
1244                     fixEdge<RegExpObjectUse>(node->child1());
1245                     break;
1246                 }
1247             }
1248
1249             if (node->child1()->shouldSpeculateCell())
1250                 fixEdge<CellUse>(node->child1());
1251             break;
1252         }
1253         
1254         case GetByIdWithThis: {
1255             if (node->child1()->shouldSpeculateCell() && node->child2()->shouldSpeculateCell()) {
1256                 fixEdge<CellUse>(node->child1());
1257                 fixEdge<CellUse>(node->child2());
1258             }
1259             break;
1260         }
1261
1262         case PutById:
1263         case PutByIdFlush:
1264         case PutByIdDirect: {
1265             if (node->child1()->shouldSpeculateCellOrOther()
1266                 && !m_graph.hasExitSite(node->origin.semantic, BadType)
1267                 && !m_graph.hasExitSite(node->origin.semantic, BadCache)
1268                 && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)
1269                 && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {
1270                 
1271                 auto uid = m_graph.identifiers()[node->identifierNumber()];
1272                 
1273                 if (uid == vm().propertyNames->lastIndex.impl()
1274                     && node->child1()->shouldSpeculateRegExpObject()) {
1275                     node->setOp(SetRegExpObjectLastIndex);
1276                     fixEdge<RegExpObjectUse>(node->child1());
1277                     speculateForBarrier(node->child2());
1278                     break;
1279                 }
1280             }
1281             
1282             fixEdge<CellUse>(node->child1());
1283             break;
1284         }
1285
1286         case PutGetterById:
1287         case PutSetterById: {
1288             fixEdge<KnownCellUse>(node->child1());
1289             fixEdge<KnownCellUse>(node->child2());
1290             break;
1291         }
1292
1293         case PutGetterSetterById: {
1294             fixEdge<KnownCellUse>(node->child1());
1295             break;
1296         }
1297
1298         case PutGetterByVal:
1299         case PutSetterByVal: {
1300             fixEdge<KnownCellUse>(node->child1());
1301             fixEdge<KnownCellUse>(node->child3());
1302             break;
1303         }
1304
1305         case GetExecutable: {
1306             fixEdge<FunctionUse>(node->child1());
1307             break;
1308         }
1309
1310         case OverridesHasInstance:
1311         case CheckStructure:
1312         case CheckCell:
1313         case CreateThis:
1314         case GetButterfly: {
1315             fixEdge<CellUse>(node->child1());
1316             break;
1317         }
1318
1319         case CheckStringIdent: {
1320             fixEdge<StringIdentUse>(node->child1());
1321             break;
1322         }
1323             
1324         case Arrayify:
1325         case ArrayifyToStructure: {
1326             fixEdge<CellUse>(node->child1());
1327             if (node->child2())
1328                 fixEdge<Int32Use>(node->child2());
1329             break;
1330         }
1331             
1332         case GetByOffset:
1333         case GetGetterSetterByOffset: {
1334             if (!node->child1()->hasStorageResult())
1335                 fixEdge<KnownCellUse>(node->child1());
1336             fixEdge<KnownCellUse>(node->child2());
1337             break;
1338         }
1339             
1340         case MultiGetByOffset: {
1341             fixEdge<CellUse>(node->child1());
1342             break;
1343         }
1344             
1345         case PutByOffset: {
1346             if (!node->child1()->hasStorageResult())
1347                 fixEdge<KnownCellUse>(node->child1());
1348             fixEdge<KnownCellUse>(node->child2());
1349             unsigned index = indexForChecks();
1350             insertInferredTypeCheck(
1351                 m_insertionSet, index, originForCheck(index), node->child3().node(),
1352                 node->storageAccessData().inferredType);
1353             speculateForBarrier(node->child3());
1354             break;
1355         }
1356             
1357         case MultiPutByOffset: {
1358             fixEdge<CellUse>(node->child1());
1359             break;
1360         }
1361             
1362         case InstanceOf: {
1363             if (!(node->child1()->prediction() & ~SpecCell))
1364                 fixEdge<CellUse>(node->child1());
1365             fixEdge<CellUse>(node->child2());
1366             break;
1367         }
1368
1369         case InstanceOfCustom:
1370             fixEdge<CellUse>(node->child2());
1371             break;
1372
1373         case In: {
1374             if (node->child2()->shouldSpeculateInt32()) {
1375                 convertToHasIndexedProperty(node);
1376                 break;
1377             }
1378
1379             fixEdge<CellUse>(node->child1());
1380             break;
1381         }
1382
1383         case HasOwnProperty: {
1384             fixEdge<ObjectUse>(node->child1());
1385 #if CPU(X86) && USE(JSVALUE32_64)
1386             // We don't have enough registers to do anything interesting on x86.
1387             fixEdge<UntypedUse>(node->child2());
1388 #else
1389             if (node->child2()->shouldSpeculateString())
1390                 fixEdge<StringUse>(node->child2());
1391             else if (node->child2()->shouldSpeculateSymbol())
1392                 fixEdge<SymbolUse>(node->child2());
1393             else
1394                 fixEdge<UntypedUse>(node->child2());
1395 #endif
1396             break;
1397         }
1398
1399         case Check: {
1400             m_graph.doToChildren(
1401                 node,
1402                 [&] (Edge& edge) {
1403                     switch (edge.useKind()) {
1404                     case NumberUse:
1405                         if (edge->shouldSpeculateInt32ForArithmetic())
1406                             edge.setUseKind(Int32Use);
1407                         break;
1408                     default:
1409                         break;
1410                     }
1411                     observeUseKindOnEdge(edge);
1412                 });
1413             break;
1414         }
1415
1416         case Phantom:
1417             // Phantoms are meaningless past Fixup. We recreate them on-demand in the backend.
1418             node->remove();
1419             break;
1420
1421         case FiatInt52: {
1422             RELEASE_ASSERT(enableInt52());
1423             node->convertToIdentity();
1424             fixEdge<Int52RepUse>(node->child1());
1425             node->setResult(NodeResultInt52);
1426             break;
1427         }
1428
1429         case GetArrayLength: {
1430             fixEdge<KnownCellUse>(node->child1());
1431             break;
1432         }
1433
1434         case GetTypedArrayByteOffset: {
1435             fixEdge<KnownCellUse>(node->child1());
1436             break;
1437         }
1438
1439         case Phi:
1440         case Upsilon:
1441         case GetIndexedPropertyStorage:
1442         case LastNodeType:
1443         case CheckTierUpInLoop:
1444         case CheckTierUpAtReturn:
1445         case CheckTierUpAndOSREnter:
1446         case InvalidationPoint:
1447         case CheckArray:
1448         case CheckInBounds:
1449         case ConstantStoragePointer:
1450         case DoubleAsInt32:
1451         case ValueToInt32:
1452         case DoubleRep:
1453         case ValueRep:
1454         case Int52Rep:
1455         case Int52Constant:
1456         case Identity: // This should have been cleaned up.
1457         case BooleanToNumber:
1458         case PhantomNewObject:
1459         case PhantomNewFunction:
1460         case PhantomNewGeneratorFunction:
1461         case PhantomNewAsyncFunction:
1462         case PhantomCreateActivation:
1463         case PhantomDirectArguments:
1464         case PhantomCreateRest:
1465         case PhantomSpread:
1466         case PhantomNewArrayWithSpread:
1467         case PhantomClonedArguments:
1468         case GetMyArgumentByVal:
1469         case GetMyArgumentByValOutOfBounds:
1470         case PutHint:
1471         case CheckStructureImmediate:
1472         case MaterializeNewObject:
1473         case MaterializeCreateActivation:
1474         case PutStack:
1475         case KillStack:
1476         case GetStack:
1477         case StoreBarrier:
1478         case FencedStoreBarrier:
1479         case GetRegExpObjectLastIndex:
1480         case SetRegExpObjectLastIndex:
1481         case RecordRegExpCachedResult:
1482             // These are just nodes that we don't currently expect to see during fixup.
1483             // If we ever wanted to insert them prior to fixup, then we just have to create
1484             // fixup rules for them.
1485             DFG_CRASH(m_graph, node, "Unexpected node during fixup");
1486             break;
1487         
1488         case PutGlobalVariable: {
1489             fixEdge<CellUse>(node->child1());
1490             speculateForBarrier(node->child2());
1491             break;
1492         }
1493
1494         case IsObject:
1495             if (node->child1()->shouldSpeculateObject()) {
1496                 m_insertionSet.insertNode(
1497                     m_indexInBlock, SpecNone, Check, node->origin,
1498                     Edge(node->child1().node(), ObjectUse));
1499                 m_graph.convertToConstant(node, jsBoolean(true));
1500                 observeUseKindOnNode<ObjectUse>(node);
1501             }
1502             break;
1503
1504         case IsCellWithType: {
1505             fixupIsCellWithType(node);
1506             break;
1507         }
1508
1509         case GetEnumerableLength: {
1510             fixEdge<CellUse>(node->child1());
1511             break;
1512         }
1513         case HasGenericProperty: {
1514             fixEdge<CellUse>(node->child2());
1515             break;
1516         }
1517         case HasStructureProperty: {
1518             fixEdge<StringUse>(node->child2());
1519             fixEdge<KnownCellUse>(node->child3());
1520             break;
1521         }
1522         case HasIndexedProperty: {
1523             node->setArrayMode(
1524                 node->arrayMode().refine(
1525                     m_graph, node,
1526                     node->child1()->prediction(),
1527                     node->child2()->prediction(),
1528                     SpecNone));
1529             
1530             blessArrayOperation(node->child1(), node->child2(), node->child3());
1531             fixEdge<CellUse>(node->child1());
1532             fixEdge<KnownInt32Use>(node->child2());
1533             break;
1534         }
1535         case GetDirectPname: {
1536             Edge& base = m_graph.varArgChild(node, 0);
1537             Edge& property = m_graph.varArgChild(node, 1);
1538             Edge& index = m_graph.varArgChild(node, 2);
1539             Edge& enumerator = m_graph.varArgChild(node, 3);
1540             fixEdge<CellUse>(base);
1541             fixEdge<KnownCellUse>(property);
1542             fixEdge<KnownInt32Use>(index);
1543             fixEdge<KnownCellUse>(enumerator);
1544             break;
1545         }
1546         case GetPropertyEnumerator: {
1547             fixEdge<CellUse>(node->child1());
1548             break;
1549         }
1550         case GetEnumeratorStructurePname: {
1551             fixEdge<KnownCellUse>(node->child1());
1552             fixEdge<KnownInt32Use>(node->child2());
1553             break;
1554         }
1555         case GetEnumeratorGenericPname: {
1556             fixEdge<KnownCellUse>(node->child1());
1557             fixEdge<KnownInt32Use>(node->child2());
1558             break;
1559         }
1560         case ToIndexString: {
1561             fixEdge<KnownInt32Use>(node->child1());
1562             break;
1563         }
1564         case ProfileType: {
1565             // We want to insert type checks based on the instructionTypeSet of the TypeLocation, not the globalTypeSet.
1566             // Because the instructionTypeSet is contained in globalTypeSet, if we produce a type check for
1567             // type T for the instructionTypeSet, the global type set must also have information for type T.
1568             // So if it the type check succeeds for type T in the instructionTypeSet, a type check for type T 
1569             // in the globalTypeSet would've also succeeded.
1570             // (The other direction does not hold in general).
1571
1572             RefPtr<TypeSet> typeSet = node->typeLocation()->m_instructionTypeSet;
1573             RuntimeTypeMask seenTypes = typeSet->seenTypes();
1574             if (typeSet->doesTypeConformTo(TypeAnyInt)) {
1575                 if (node->child1()->shouldSpeculateInt32()) {
1576                     fixEdge<Int32Use>(node->child1());
1577                     node->remove();
1578                     break;
1579                 }
1580
1581                 if (enableInt52()) {
1582                     fixEdge<AnyIntUse>(node->child1());
1583                     node->remove();
1584                     break;
1585                 }
1586
1587                 // Must not perform fixEdge<NumberUse> here since the type set only includes TypeAnyInt. Double values should be logged.
1588             }
1589
1590             if (typeSet->doesTypeConformTo(TypeNumber | TypeAnyInt)) {
1591                 fixEdge<NumberUse>(node->child1());
1592                 node->remove();
1593             } else if (typeSet->doesTypeConformTo(TypeString)) {
1594                 fixEdge<StringUse>(node->child1());
1595                 node->remove();
1596             } else if (typeSet->doesTypeConformTo(TypeBoolean)) {
1597                 fixEdge<BooleanUse>(node->child1());
1598                 node->remove();
1599             } else if (typeSet->doesTypeConformTo(TypeUndefined | TypeNull) && (seenTypes & TypeUndefined) && (seenTypes & TypeNull)) {
1600                 fixEdge<OtherUse>(node->child1());
1601                 node->remove();
1602             } else if (typeSet->doesTypeConformTo(TypeObject)) {
1603                 StructureSet set;
1604                 {
1605                     ConcurrentJSLocker locker(typeSet->m_lock);
1606                     set = typeSet->structureSet(locker);
1607                 }
1608                 if (!set.isEmpty()) {
1609                     fixEdge<CellUse>(node->child1());
1610                     node->convertToCheckStructure(m_graph.addStructureSet(set));
1611                 }
1612             }
1613
1614             break;
1615         }
1616
1617         case CreateClonedArguments: {
1618             watchHavingABadTime(node);
1619             break;
1620         }
1621
1622         case CreateScopedArguments:
1623         case CreateActivation:
1624         case NewFunction:
1625         case NewGeneratorFunction:
1626         case NewAsyncFunction: {
1627             fixEdge<CellUse>(node->child1());
1628             break;
1629         }
1630
1631         case SetFunctionName: {
1632             // The first child is guaranteed to be a cell because op_set_function_name is only used
1633             // on a newly instantiated function object (the first child).
1634             fixEdge<KnownCellUse>(node->child1());
1635             fixEdge<UntypedUse>(node->child2());
1636             break;
1637         }
1638
1639         case CreateRest: {
1640             watchHavingABadTime(node);
1641             fixEdge<KnownInt32Use>(node->child1());
1642             break;
1643         }
1644
1645         case ResolveScope:
1646         case GetDynamicVar:
1647         case PutDynamicVar: {
1648             fixEdge<KnownCellUse>(node->child1());
1649             break;
1650         }
1651
1652         case LogShadowChickenPrologue: {
1653             fixEdge<KnownCellUse>(node->child1());
1654             break;
1655         }
1656         case LogShadowChickenTail: {
1657             fixEdge<UntypedUse>(node->child1());
1658             fixEdge<KnownCellUse>(node->child2());
1659             break;
1660         }
1661
1662         case GetMapBucket:
1663             if (node->child1().useKind() == MapObjectUse)
1664                 fixEdge<MapObjectUse>(node->child1());
1665             else if (node->child1().useKind() == SetObjectUse)
1666                 fixEdge<SetObjectUse>(node->child1());
1667             else
1668                 RELEASE_ASSERT_NOT_REACHED();
1669
1670 #if USE(JSVALUE64)
1671             if (node->child2()->shouldSpeculateBoolean())
1672                 fixEdge<BooleanUse>(node->child2());
1673             else if (node->child2()->shouldSpeculateInt32())
1674                 fixEdge<Int32Use>(node->child2());
1675             else if (node->child2()->shouldSpeculateSymbol())
1676                 fixEdge<SymbolUse>(node->child2());
1677             else if (node->child2()->shouldSpeculateObject())
1678                 fixEdge<ObjectUse>(node->child2());
1679             else if (node->child2()->shouldSpeculateString())
1680                 fixEdge<StringUse>(node->child2());
1681             else if (node->child2()->shouldSpeculateCell())
1682                 fixEdge<CellUse>(node->child2());
1683             else
1684                 fixEdge<UntypedUse>(node->child2());
1685 #else
1686             fixEdge<UntypedUse>(node->child2());
1687 #endif // USE(JSVALUE64)
1688
1689             fixEdge<Int32Use>(node->child3());
1690             break;
1691
1692         case LoadFromJSMapBucket:
1693             fixEdge<KnownCellUse>(node->child1());
1694             break;
1695
1696         case IsNonEmptyMapBucket:
1697             fixEdge<KnownCellUse>(node->child1());
1698             break;
1699
1700         case MapHash: {
1701 #if USE(JSVALUE64)
1702             if (node->child1()->shouldSpeculateBoolean()) {
1703                 fixEdge<BooleanUse>(node->child1());
1704                 break;
1705             }
1706
1707             if (node->child1()->shouldSpeculateInt32()) {
1708                 fixEdge<Int32Use>(node->child1());
1709                 break;
1710             }
1711
1712             if (node->child1()->shouldSpeculateSymbol()) {
1713                 fixEdge<SymbolUse>(node->child1());
1714                 break;
1715             }
1716
1717             if (node->child1()->shouldSpeculateObject()) {
1718                 fixEdge<ObjectUse>(node->child1());
1719                 break;
1720             }
1721
1722             if (node->child1()->shouldSpeculateString()) {
1723                 fixEdge<StringUse>(node->child1());
1724                 break;
1725             }
1726
1727             if (node->child1()->shouldSpeculateCell()) {
1728                 fixEdge<CellUse>(node->child1());
1729                 break;
1730             }
1731
1732             fixEdge<UntypedUse>(node->child1());
1733 #else
1734             fixEdge<UntypedUse>(node->child1());
1735 #endif // USE(JSVALUE64)
1736             break;
1737         }
1738
1739         case DefineDataProperty: {
1740             fixEdge<CellUse>(m_graph.varArgChild(node, 0));
1741             Edge& propertyEdge = m_graph.varArgChild(node, 1);
1742             if (propertyEdge->shouldSpeculateSymbol())
1743                 fixEdge<SymbolUse>(propertyEdge);
1744             else if (propertyEdge->shouldSpeculateStringIdent())
1745                 fixEdge<StringIdentUse>(propertyEdge);
1746             else if (propertyEdge->shouldSpeculateString())
1747                 fixEdge<StringUse>(propertyEdge);
1748             else
1749                 fixEdge<UntypedUse>(propertyEdge);
1750             fixEdge<UntypedUse>(m_graph.varArgChild(node, 2));
1751             fixEdge<KnownInt32Use>(m_graph.varArgChild(node, 3));
1752             break;
1753         }
1754
1755         case ToLowerCase: {
1756             // We currently only support StringUse since that will ensure that
1757             // ToLowerCase is a pure operation. If we decide to update this with
1758             // more types in the future, we need to ensure that the clobberize rules
1759             // are correct.
1760             fixEdge<StringUse>(node->child1());
1761             break;
1762         }
1763
1764         case DefineAccessorProperty: {
1765             fixEdge<CellUse>(m_graph.varArgChild(node, 0));
1766             Edge& propertyEdge = m_graph.varArgChild(node, 1);
1767             if (propertyEdge->shouldSpeculateSymbol())
1768                 fixEdge<SymbolUse>(propertyEdge);
1769             else if (propertyEdge->shouldSpeculateStringIdent())
1770                 fixEdge<StringIdentUse>(propertyEdge);
1771             else if (propertyEdge->shouldSpeculateString())
1772                 fixEdge<StringUse>(propertyEdge);
1773             else
1774                 fixEdge<UntypedUse>(propertyEdge);
1775             fixEdge<CellUse>(m_graph.varArgChild(node, 2));
1776             fixEdge<CellUse>(m_graph.varArgChild(node, 3));
1777             fixEdge<KnownInt32Use>(m_graph.varArgChild(node, 4));
1778             break;
1779         }
1780
1781         case CheckDOM: {
1782             fixupCheckDOM(node);
1783             break;
1784         }
1785
1786         case CallDOMGetter: {
1787             DOMJIT::CallDOMGetterPatchpoint* patchpoint = node->callDOMGetterData()->patchpoint;
1788             fixEdge<CellUse>(node->child1()); // DOM.
1789             if (patchpoint->requireGlobalObject)
1790                 fixEdge<KnownCellUse>(node->child2()); // GlobalObject.
1791             break;
1792         }
1793
1794         case CallDOM: {
1795             fixupCallDOM(node);
1796             break;
1797         }
1798
1799         case Call: {
1800             attemptToMakeCallDOM(node);
1801             break;
1802         }
1803
1804         case ParseInt: {
1805             if (node->child1()->shouldSpeculateInt32() && !node->child2()) {
1806                 fixEdge<Int32Use>(node->child1());
1807                 node->convertToIdentity();
1808                 break;
1809             }
1810
1811             if (node->child1()->shouldSpeculateString()) {
1812                 fixEdge<StringUse>(node->child1());
1813                 node->clearFlags(NodeMustGenerate);
1814             }
1815
1816             if (node->child2())
1817                 fixEdge<Int32Use>(node->child2());
1818
1819             break;
1820         }
1821
1822 #if !ASSERT_DISABLED
1823         // Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
1824         case SetArgument:
1825         case JSConstant:
1826         case LazyJSConstant:
1827         case DoubleConstant:
1828         case GetLocal:
1829         case GetCallee:
1830         case GetArgumentCountIncludingThis:
1831         case GetRestLength:
1832         case GetArgument:
1833         case Flush:
1834         case PhantomLocal:
1835         case GetLocalUnlinked:
1836         case GetGlobalVar:
1837         case GetGlobalLexicalVariable:
1838         case NotifyWrite:
1839         case DirectCall:
1840         case CheckTypeInfoFlags:
1841         case TailCallInlinedCaller:
1842         case DirectTailCallInlinedCaller:
1843         case Construct:
1844         case DirectConstruct:
1845         case CallVarargs:
1846         case CallEval:
1847         case TailCallVarargsInlinedCaller:
1848         case ConstructVarargs:
1849         case CallForwardVarargs:
1850         case ConstructForwardVarargs:
1851         case TailCallForwardVarargs:
1852         case TailCallForwardVarargsInlinedCaller:
1853         case LoadVarargs:
1854         case ForwardVarargs:
1855         case ProfileControlFlow:
1856         case NewObject:
1857         case NewRegexp:
1858         case DeleteById:
1859         case DeleteByVal:
1860         case IsTypedArrayView:
1861         case IsEmpty:
1862         case IsUndefined:
1863         case IsBoolean:
1864         case IsNumber:
1865         case IsObjectOrNull:
1866         case IsFunction:
1867         case CreateDirectArguments:
1868         case Jump:
1869         case Return:
1870         case TailCall:
1871         case DirectTailCall:
1872         case TailCallVarargs:
1873         case Throw:
1874         case ThrowStaticError:
1875         case CountExecution:
1876         case ForceOSRExit:
1877         case CheckBadCell:
1878         case CheckNotEmpty:
1879         case CheckTraps:
1880         case Unreachable:
1881         case ExtractOSREntryLocal:
1882         case LoopHint:
1883         case MovHint:
1884         case ZombieHint:
1885         case ExitOK:
1886         case BottomValue:
1887         case TypeOf:
1888         case PutByIdWithThis:
1889         case PutByValWithThis:
1890         case GetByValWithThis:
1891         case CompareEqPtr:
1892             break;
1893 #else
1894         default:
1895             break;
1896 #endif
1897         }
1898     }
1899
1900     void watchHavingABadTime(Node* node)
1901     {
1902         JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
1903
1904         // If this global object is not having a bad time, watch it. We go down this path anytime the code
1905         // does an array allocation. The types of array allocations may change if we start to have a bad
1906         // time. It's easier to reason about this if we know that whenever the types change after we start
1907         // optimizing, the code just gets thrown out. Doing this at FixupPhase is just early enough, since
1908         // prior to this point nobody should have been doing optimizations based on the indexing type of
1909         // the allocation.
1910         if (!globalObject->isHavingABadTime()) {
1911             m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
1912             m_graph.freeze(globalObject);
1913         }
1914     }
1915     
1916     template<UseKind useKind>
1917     void createToString(Node* node, Edge& edge)
1918     {
1919         edge.setNode(m_insertionSet.insertNode(
1920             m_indexInBlock, SpecString, ToString, node->origin,
1921             Edge(edge.node(), useKind)));
1922     }
1923     
1924     template<UseKind useKind>
1925     void attemptToForceStringArrayModeByToStringConversion(ArrayMode& arrayMode, Node* node)
1926     {
1927         ASSERT(arrayMode == ArrayMode(Array::Generic));
1928         
1929         if (!m_graph.canOptimizeStringObjectAccess(node->origin.semantic))
1930             return;
1931         
1932         createToString<useKind>(node, node->child1());
1933         arrayMode = ArrayMode(Array::String);
1934     }
1935     
1936     template<UseKind useKind>
1937     bool isStringObjectUse()
1938     {
1939         switch (useKind) {
1940         case StringObjectUse:
1941         case StringOrStringObjectUse:
1942             return true;
1943         default:
1944             return false;
1945         }
1946     }
1947     
1948     template<UseKind useKind>
1949     void convertStringAddUse(Node* node, Edge& edge)
1950     {
1951         if (useKind == StringUse) {
1952             observeUseKindOnNode<StringUse>(edge.node());
1953             m_insertionSet.insertNode(
1954                 m_indexInBlock, SpecNone, Check, node->origin,
1955                 Edge(edge.node(), StringUse));
1956             edge.setUseKind(KnownStringUse);
1957             return;
1958         }
1959         
1960         observeUseKindOnNode<useKind>(edge.node());
1961         createToString<useKind>(node, edge);
1962     }
1963     
1964     void convertToMakeRope(Node* node)
1965     {
1966         node->setOpAndDefaultFlags(MakeRope);
1967         fixupMakeRope(node);
1968     }
1969     
1970     void fixupMakeRope(Node* node)
1971     {
1972         for (unsigned i = 0; i < AdjacencyList::Size; ++i) {
1973             Edge& edge = node->children.child(i);
1974             if (!edge)
1975                 break;
1976             edge.setUseKind(KnownStringUse);
1977             JSString* string = edge->dynamicCastConstant<JSString*>(vm());
1978             if (!string)
1979                 continue;
1980             if (string->length())
1981                 continue;
1982             
1983             // Don't allow the MakeRope to have zero children.
1984             if (!i && !node->child2())
1985                 break;
1986             
1987             node->children.removeEdge(i--);
1988         }
1989         
1990         if (!node->child2()) {
1991             ASSERT(!node->child3());
1992             node->convertToIdentity();
1993         }
1994     }
1995
1996     void fixupIsCellWithType(Node* node)
1997     {
1998         switch (node->speculatedTypeForQuery()) {
1999         case SpecString:
2000             if (node->child1()->shouldSpeculateString()) {
2001                 m_insertionSet.insertNode(
2002                     m_indexInBlock, SpecNone, Check, node->origin,
2003                     Edge(node->child1().node(), StringUse));
2004                 m_graph.convertToConstant(node, jsBoolean(true));
2005                 observeUseKindOnNode<StringUse>(node);
2006                 return;
2007             }
2008             break;
2009
2010         case SpecProxyObject:
2011             if (node->child1()->shouldSpeculateProxyObject()) {
2012                 m_insertionSet.insertNode(
2013                     m_indexInBlock, SpecNone, Check, node->origin,
2014                     Edge(node->child1().node(), ProxyObjectUse));
2015                 m_graph.convertToConstant(node, jsBoolean(true));
2016                 observeUseKindOnNode<ProxyObjectUse>(node);
2017                 return;
2018             }
2019             break;
2020
2021         case SpecRegExpObject:
2022             if (node->child1()->shouldSpeculateRegExpObject()) {
2023                 m_insertionSet.insertNode(
2024                     m_indexInBlock, SpecNone, Check, node->origin,
2025                     Edge(node->child1().node(), RegExpObjectUse));
2026                 m_graph.convertToConstant(node, jsBoolean(true));
2027                 observeUseKindOnNode<RegExpObjectUse>(node);
2028                 return;
2029             }
2030             break;
2031
2032         case SpecArray:
2033             if (node->child1()->shouldSpeculateArray()) {
2034                 m_insertionSet.insertNode(
2035                     m_indexInBlock, SpecNone, Check, node->origin,
2036                     Edge(node->child1().node(), ArrayUse));
2037                 m_graph.convertToConstant(node, jsBoolean(true));
2038                 observeUseKindOnNode<ArrayUse>(node);
2039                 return;
2040             }
2041             break;
2042
2043         case SpecDerivedArray:
2044             if (node->child1()->shouldSpeculateDerivedArray()) {
2045                 m_insertionSet.insertNode(
2046                     m_indexInBlock, SpecNone, Check, node->origin,
2047                     Edge(node->child1().node(), DerivedArrayUse));
2048                 m_graph.convertToConstant(node, jsBoolean(true));
2049                 observeUseKindOnNode<DerivedArrayUse>(node);
2050                 return;
2051             }
2052             break;
2053         }
2054
2055         if (node->child1()->shouldSpeculateCell()) {
2056             fixEdge<CellUse>(node->child1());
2057             return;
2058         }
2059
2060         if (node->child1()->shouldSpeculateNotCell()) {
2061             m_insertionSet.insertNode(
2062                 m_indexInBlock, SpecNone, Check, node->origin,
2063                 Edge(node->child1().node(), NotCellUse));
2064             m_graph.convertToConstant(node, jsBoolean(false));
2065             observeUseKindOnNode<NotCellUse>(node);
2066             return;
2067         }
2068     }
2069
2070     void fixupToThis(Node* node)
2071     {
2072         ECMAMode ecmaMode = m_graph.executableFor(node->origin.semantic)->isStrictMode() ? StrictMode : NotStrictMode;
2073
2074         if (ecmaMode == StrictMode) {
2075             if (node->child1()->shouldSpeculateBoolean()) {
2076                 fixEdge<BooleanUse>(node->child1());
2077                 node->convertToIdentity();
2078                 return;
2079             }
2080
2081             if (node->child1()->shouldSpeculateInt32()) {
2082                 fixEdge<Int32Use>(node->child1());
2083                 node->convertToIdentity();
2084                 return;
2085             }
2086
2087             if (enableInt52() && node->child1()->shouldSpeculateAnyInt()) {
2088                 fixEdge<Int52RepUse>(node->child1());
2089                 node->convertToIdentity();
2090                 node->setResult(NodeResultInt52);
2091                 return;
2092             }
2093
2094             if (node->child1()->shouldSpeculateNumber()) {
2095                 fixEdge<DoubleRepUse>(node->child1());
2096                 node->convertToIdentity();
2097                 node->setResult(NodeResultDouble);
2098                 return;
2099             }
2100
2101             if (node->child1()->shouldSpeculateSymbol()) {
2102                 fixEdge<SymbolUse>(node->child1());
2103                 node->convertToIdentity();
2104                 return;
2105             }
2106
2107             if (node->child1()->shouldSpeculateStringIdent()) {
2108                 fixEdge<StringIdentUse>(node->child1());
2109                 node->convertToIdentity();
2110                 return;
2111             }
2112
2113             if (node->child1()->shouldSpeculateString()) {
2114                 fixEdge<StringUse>(node->child1());
2115                 node->convertToIdentity();
2116                 return;
2117             }
2118         }
2119
2120         if (node->child1()->shouldSpeculateOther()) {
2121             if (ecmaMode == StrictMode) {
2122                 fixEdge<OtherUse>(node->child1());
2123                 node->convertToIdentity();
2124                 return;
2125             }
2126
2127             m_insertionSet.insertNode(
2128                 m_indexInBlock, SpecNone, Check, node->origin,
2129                 Edge(node->child1().node(), OtherUse));
2130             observeUseKindOnNode<OtherUse>(node->child1().node());
2131             m_graph.convertToConstant(
2132                 node, m_graph.globalThisObjectFor(node->origin.semantic));
2133             return;
2134         }
2135
2136         // FIXME: This should cover other use cases but we don't have use kinds for them. It's not critical,
2137         // however, since we cover all the missing cases in constant folding.
2138         // https://bugs.webkit.org/show_bug.cgi?id=157213
2139         if (node->child1()->shouldSpeculateStringObject()) {
2140             fixEdge<StringObjectUse>(node->child1());
2141             node->convertToIdentity();
2142             return;
2143         }
2144
2145         if (isFinalObjectSpeculation(node->child1()->prediction())) {
2146             fixEdge<FinalObjectUse>(node->child1());
2147             node->convertToIdentity();
2148             return;
2149         }
2150     }
2151     
2152     void fixupToPrimitive(Node* node)
2153     {
2154         if (node->child1()->shouldSpeculateInt32()) {
2155             fixEdge<Int32Use>(node->child1());
2156             node->convertToIdentity();
2157             return;
2158         }
2159         
2160         if (node->child1()->shouldSpeculateString()) {
2161             fixEdge<StringUse>(node->child1());
2162             node->convertToIdentity();
2163             return;
2164         }
2165         
2166         if (node->child1()->shouldSpeculateStringObject()
2167             && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
2168             fixEdge<StringObjectUse>(node->child1());
2169             node->convertToToString();
2170             return;
2171         }
2172         
2173         if (node->child1()->shouldSpeculateStringOrStringObject()
2174             && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
2175             fixEdge<StringOrStringObjectUse>(node->child1());
2176             node->convertToToString();
2177             return;
2178         }
2179     }
2180
2181     void fixupToNumber(Node* node)
2182     {
2183         // If the prediction of the child is Number, we attempt to convert ToNumber to Identity.
2184         if (node->child1()->shouldSpeculateNumber()) {
2185             if (isInt32Speculation(node->getHeapPrediction())) {
2186                 // If the both predictions of this node and the child is Int32, we just convert ToNumber to Identity, that's simple.
2187                 if (node->child1()->shouldSpeculateInt32()) {
2188                     fixEdge<Int32Use>(node->child1());
2189                     node->convertToIdentity();
2190                     return;
2191                 }
2192
2193                 // The another case is that the predicted type of the child is Int32, but the heap prediction tell the users that this will produce non Int32 values.
2194                 // In that case, let's receive the child value as a Double value and convert it to Int32. This case happens in misc-bugs-847389-jpeg2000.
2195                 fixEdge<DoubleRepUse>(node->child1());
2196                 node->setOp(DoubleAsInt32);
2197                 if (bytecodeCanIgnoreNegativeZero(node->arithNodeFlags()))
2198                     node->setArithMode(Arith::CheckOverflow);
2199                 else
2200                     node->setArithMode(Arith::CheckOverflowAndNegativeZero);
2201                 return;
2202             }
2203
2204             fixEdge<DoubleRepUse>(node->child1());
2205             node->convertToIdentity();
2206             node->setResult(NodeResultDouble);
2207             return;
2208         }
2209
2210         fixEdge<UntypedUse>(node->child1());
2211         node->setResult(NodeResultJS);
2212     }
2213     
2214     void fixupToStringOrCallStringConstructor(Node* node)
2215     {
2216         if (node->child1()->shouldSpeculateString()) {
2217             fixEdge<StringUse>(node->child1());
2218             node->convertToIdentity();
2219             return;
2220         }
2221         
2222         if (node->child1()->shouldSpeculateStringObject()
2223             && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
2224             fixEdge<StringObjectUse>(node->child1());
2225             return;
2226         }
2227         
2228         if (node->child1()->shouldSpeculateStringOrStringObject()
2229             && m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
2230             fixEdge<StringOrStringObjectUse>(node->child1());
2231             return;
2232         }
2233         
2234         if (node->child1()->shouldSpeculateCell()) {
2235             fixEdge<CellUse>(node->child1());
2236             return;
2237         }
2238
2239         // ToString(Symbol) throws an error. So if the child1 can include Symbols,
2240         // we need to care about it in the clobberize. In the following case,
2241         // since NotCellUse edge filter is used and this edge filters Symbols,
2242         // we can say that ToString never throws an error!
2243         if (node->child1()->shouldSpeculateNotCell()) {
2244             fixEdge<NotCellUse>(node->child1());
2245             node->clearFlags(NodeMustGenerate);
2246             return;
2247         }
2248     }
2249
2250     bool attemptToMakeFastStringAdd(Node* node)
2251     {
2252         bool goodToGo = true;
2253         m_graph.doToChildren(
2254             node,
2255             [&] (Edge& edge) {
2256                 if (edge->shouldSpeculateString())
2257                     return;
2258                 if (m_graph.canOptimizeStringObjectAccess(node->origin.semantic)) {
2259                     if (edge->shouldSpeculateStringObject())
2260                         return;
2261                     if (edge->shouldSpeculateStringOrStringObject())
2262                         return;
2263                 }
2264                 goodToGo = false;
2265             });
2266         if (!goodToGo)
2267             return false;
2268
2269         m_graph.doToChildren(
2270             node,
2271             [&] (Edge& edge) {
2272                 if (edge->shouldSpeculateString()) {
2273                     convertStringAddUse<StringUse>(node, edge);
2274                     return;
2275                 }
2276                 ASSERT(m_graph.canOptimizeStringObjectAccess(node->origin.semantic));
2277                 if (edge->shouldSpeculateStringObject()) {
2278                     convertStringAddUse<StringObjectUse>(node, edge);
2279                     return;
2280                 }
2281                 if (edge->shouldSpeculateStringOrStringObject()) {
2282                     convertStringAddUse<StringOrStringObjectUse>(node, edge);
2283                     return;
2284                 }
2285                 RELEASE_ASSERT_NOT_REACHED();
2286             });
2287         
2288         convertToMakeRope(node);
2289         return true;
2290     }
2291
2292     void fixupGetAndSetLocalsInBlock(BasicBlock* block)
2293     {
2294         if (!block)
2295             return;
2296         ASSERT(block->isReachable);
2297         m_block = block;
2298         for (m_indexInBlock = 0; m_indexInBlock < block->size(); ++m_indexInBlock) {
2299             Node* node = m_currentNode = block->at(m_indexInBlock);
2300             if (node->op() != SetLocal && node->op() != GetLocal)
2301                 continue;
2302             
2303             VariableAccessData* variable = node->variableAccessData();
2304             switch (node->op()) {
2305             case GetLocal:
2306                 switch (variable->flushFormat()) {
2307                 case FlushedDouble:
2308                     node->setResult(NodeResultDouble);
2309                     break;
2310                 case FlushedInt52:
2311                     node->setResult(NodeResultInt52);
2312                     break;
2313                 default:
2314                     break;
2315                 }
2316                 break;
2317                 
2318             case SetLocal:
2319                 // NOTE: Any type checks we put here may get hoisted by fixupChecksInBlock(). So, if we
2320                 // add new type checking use kind for SetLocals, we need to modify that code as well.
2321                 
2322                 switch (variable->flushFormat()) {
2323                 case FlushedJSValue:
2324                     break;
2325                 case FlushedDouble:
2326                     fixEdge<DoubleRepUse>(node->child1());
2327                     break;
2328                 case FlushedInt32:
2329                     fixEdge<Int32Use>(node->child1());
2330                     break;
2331                 case FlushedInt52:
2332                     fixEdge<Int52RepUse>(node->child1());
2333                     break;
2334                 case FlushedCell:
2335                     fixEdge<CellUse>(node->child1());
2336                     break;
2337                 case FlushedBoolean:
2338                     fixEdge<BooleanUse>(node->child1());
2339                     break;
2340                 default:
2341                     RELEASE_ASSERT_NOT_REACHED();
2342                     break;
2343                 }
2344                 break;
2345                 
2346             default:
2347                 RELEASE_ASSERT_NOT_REACHED();
2348                 break;
2349             }
2350         }
2351         m_insertionSet.execute(block);
2352     }
2353     
2354     void addStringReplacePrimordialChecks(Node* searchRegExp)
2355     {
2356         Node* node = m_currentNode;
2357
2358         // Check that structure of searchRegExp is RegExp object
2359         m_insertionSet.insertNode(
2360             m_indexInBlock, SpecNone, Check, node->origin,
2361             Edge(searchRegExp, RegExpObjectUse));
2362
2363         auto emitPrimordialCheckFor = [&] (JSValue primordialProperty, UniquedStringImpl* propertyUID) {
2364             unsigned index = m_graph.identifiers().ensure(propertyUID);
2365
2366             Node* actualProperty = m_insertionSet.insertNode(
2367                 m_indexInBlock, SpecNone, TryGetById, node->origin,
2368                 OpInfo(index), OpInfo(SpecFunction), Edge(searchRegExp, CellUse));
2369
2370             m_insertionSet.insertNode(
2371                 m_indexInBlock, SpecNone, CheckCell, node->origin,
2372                 OpInfo(m_graph.freeze(primordialProperty)), Edge(actualProperty, CellUse));
2373         };
2374
2375         JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
2376
2377         // Check that searchRegExp.exec is the primordial RegExp.prototype.exec
2378         emitPrimordialCheckFor(globalObject->regExpProtoExecFunction(), vm().propertyNames->exec.impl());
2379         // Check that searchRegExp.global is the primordial RegExp.prototype.global
2380         emitPrimordialCheckFor(globalObject->regExpProtoGlobalGetter(), vm().propertyNames->global.impl());
2381         // Check that searchRegExp.unicode is the primordial RegExp.prototype.unicode
2382         emitPrimordialCheckFor(globalObject->regExpProtoUnicodeGetter(), vm().propertyNames->unicode.impl());
2383         // Check that searchRegExp[Symbol.match] is the primordial RegExp.prototype[Symbol.replace]
2384         emitPrimordialCheckFor(globalObject->regExpProtoSymbolReplaceFunction(), vm().propertyNames->replaceSymbol.impl());
2385     }
2386
2387     Node* checkArray(ArrayMode arrayMode, const NodeOrigin& origin, Node* array, Node* index, bool (*storageCheck)(const ArrayMode&) = canCSEStorage)
2388     {
2389         ASSERT(arrayMode.isSpecific());
2390         
2391         if (arrayMode.type() == Array::String) {
2392             m_insertionSet.insertNode(
2393                 m_indexInBlock, SpecNone, Check, origin, Edge(array, StringUse));
2394         } else {
2395             // Note that we only need to be using a structure check if we opt for SaneChain, since
2396             // that needs to protect against JSArray's __proto__ being changed.
2397             Structure* structure = arrayMode.originalArrayStructure(m_graph, origin.semantic);
2398         
2399             Edge indexEdge = index ? Edge(index, Int32Use) : Edge();
2400             
2401             if (arrayMode.doesConversion()) {
2402                 if (structure) {
2403                     m_insertionSet.insertNode(
2404                         m_indexInBlock, SpecNone, ArrayifyToStructure, origin,
2405                         OpInfo(m_graph.registerStructure(structure)), OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);
2406                 } else {
2407                     m_insertionSet.insertNode(
2408                         m_indexInBlock, SpecNone, Arrayify, origin,
2409                         OpInfo(arrayMode.asWord()), Edge(array, CellUse), indexEdge);
2410                 }
2411             } else {
2412                 if (structure) {
2413                     m_insertionSet.insertNode(
2414                         m_indexInBlock, SpecNone, CheckStructure, origin,
2415                         OpInfo(m_graph.addStructureSet(structure)), Edge(array, CellUse));
2416                 } else {
2417                     m_insertionSet.insertNode(
2418                         m_indexInBlock, SpecNone, CheckArray, origin,
2419                         OpInfo(arrayMode.asWord()), Edge(array, CellUse));
2420                 }
2421             }
2422         }
2423         
2424         if (!storageCheck(arrayMode))
2425             return nullptr;
2426         
2427         if (arrayMode.usesButterfly()) {
2428             return m_insertionSet.insertNode(
2429                 m_indexInBlock, SpecNone, GetButterfly, origin, Edge(array, CellUse));
2430         }
2431         
2432         return m_insertionSet.insertNode(
2433             m_indexInBlock, SpecNone, GetIndexedPropertyStorage, origin,
2434             OpInfo(arrayMode.asWord()), Edge(array, KnownCellUse));
2435     }
2436     
2437     void blessArrayOperation(Edge base, Edge index, Edge& storageChild)
2438     {
2439         Node* node = m_currentNode;
2440         
2441         switch (node->arrayMode().type()) {
2442         case Array::ForceExit: {
2443             m_insertionSet.insertNode(
2444                 m_indexInBlock, SpecNone, ForceOSRExit, node->origin);
2445             return;
2446         }
2447             
2448         case Array::SelectUsingPredictions:
2449         case Array::Unprofiled:
2450             RELEASE_ASSERT_NOT_REACHED();
2451             return;
2452             
2453         case Array::Generic:
2454             return;
2455             
2456         default: {
2457             Node* storage = checkArray(node->arrayMode(), node->origin, base.node(), index.node());
2458             if (!storage)
2459                 return;
2460             
2461             storageChild = Edge(storage);
2462             return;
2463         } }
2464     }
2465     
2466     bool alwaysUnboxSimplePrimitives()
2467     {
2468 #if USE(JSVALUE64)
2469         return false;
2470 #else
2471         // Any boolean, int, or cell value is profitable to unbox on 32-bit because it
2472         // reduces traffic.
2473         return true;
2474 #endif
2475     }
2476
2477     template<UseKind useKind>
2478     void observeUseKindOnNode(Node* node)
2479     {
2480         if (useKind == UntypedUse)
2481             return;
2482         observeUseKindOnNode(node, useKind);
2483     }
2484
2485     void observeUseKindOnEdge(Edge edge)
2486     {
2487         observeUseKindOnNode(edge.node(), edge.useKind());
2488     }
2489
2490     void observeUseKindOnNode(Node* node, UseKind useKind)
2491     {
2492         if (node->op() != GetLocal)
2493             return;
2494         
2495         // FIXME: The way this uses alwaysUnboxSimplePrimitives() is suspicious.
2496         // https://bugs.webkit.org/show_bug.cgi?id=121518
2497         
2498         VariableAccessData* variable = node->variableAccessData();
2499         switch (useKind) {
2500         case Int32Use:
2501         case KnownInt32Use:
2502             if (alwaysUnboxSimplePrimitives()
2503                 || isInt32Speculation(variable->prediction()))
2504                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
2505             break;
2506         case NumberUse:
2507         case RealNumberUse:
2508         case DoubleRepUse:
2509         case DoubleRepRealUse:
2510             if (variable->doubleFormatState() == UsingDoubleFormat)
2511                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
2512             break;
2513         case BooleanUse:
2514         case KnownBooleanUse:
2515             if (alwaysUnboxSimplePrimitives()
2516                 || isBooleanSpeculation(variable->prediction()))
2517                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
2518             break;
2519         case Int52RepUse:
2520             if (isAnyIntSpeculation(variable->prediction()))
2521                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
2522             break;
2523         case CellUse:
2524         case KnownCellUse:
2525         case ObjectUse:
2526         case FunctionUse:
2527         case StringUse:
2528         case KnownStringUse:
2529         case SymbolUse:
2530         case StringObjectUse:
2531         case StringOrStringObjectUse:
2532             if (alwaysUnboxSimplePrimitives()
2533                 || isCellSpeculation(variable->prediction()))
2534                 m_profitabilityChanged |= variable->mergeIsProfitableToUnbox(true);
2535             break;
2536         default:
2537             break;
2538         }
2539     }
2540     
2541     template<UseKind useKind>
2542     void fixEdge(Edge& edge)
2543     {
2544         observeUseKindOnNode<useKind>(edge.node());
2545         edge.setUseKind(useKind);
2546     }
2547     
2548     unsigned indexForChecks()
2549     {
2550         unsigned index = m_indexInBlock;
2551         while (!m_block->at(index)->origin.exitOK)
2552             index--;
2553         return index;
2554     }
2555     
2556     NodeOrigin originForCheck(unsigned index)
2557     {
2558         return m_block->at(index)->origin.withSemantic(m_currentNode->origin.semantic);
2559     }
2560     
2561     void speculateForBarrier(Edge value)
2562     {
2563         // Currently, the DFG won't take advantage of this speculation. But, we want to do it in
2564         // the DFG anyway because if such a speculation would be wrong, we want to know before
2565         // we do an expensive compile.
2566         
2567         if (value->shouldSpeculateInt32()) {
2568             insertCheck<Int32Use>(value.node());
2569             return;
2570         }
2571             
2572         if (value->shouldSpeculateBoolean()) {
2573             insertCheck<BooleanUse>(value.node());
2574             return;
2575         }
2576             
2577         if (value->shouldSpeculateOther()) {
2578             insertCheck<OtherUse>(value.node());
2579             return;
2580         }
2581             
2582         if (value->shouldSpeculateNumber()) {
2583             insertCheck<NumberUse>(value.node());
2584             return;
2585         }
2586             
2587         if (value->shouldSpeculateNotCell()) {
2588             insertCheck<NotCellUse>(value.node());
2589             return;
2590         }
2591     }
2592     
2593     template<UseKind useKind>
2594     void insertCheck(Node* node)
2595     {
2596         observeUseKindOnNode<useKind>(node);
2597         unsigned index = indexForChecks();
2598         m_insertionSet.insertNode(index, SpecNone, Check, originForCheck(index), Edge(node, useKind));
2599     }
2600
2601     void fixIntConvertingEdge(Edge& edge)
2602     {
2603         Node* node = edge.node();
2604         if (node->shouldSpeculateInt32OrBoolean()) {
2605             fixIntOrBooleanEdge(edge);
2606             return;
2607         }
2608         
2609         UseKind useKind;
2610         if (node->shouldSpeculateAnyInt())
2611             useKind = Int52RepUse;
2612         else if (node->shouldSpeculateNumber())
2613             useKind = DoubleRepUse;
2614         else
2615             useKind = NotCellUse;
2616         Node* newNode = m_insertionSet.insertNode(
2617             m_indexInBlock, SpecInt32Only, ValueToInt32, m_currentNode->origin,
2618             Edge(node, useKind));
2619         observeUseKindOnNode(node, useKind);
2620         
2621         edge = Edge(newNode, KnownInt32Use);
2622     }
2623     
2624     void fixIntOrBooleanEdge(Edge& edge)
2625     {
2626         Node* node = edge.node();
2627         if (!node->sawBooleans()) {
2628             fixEdge<Int32Use>(edge);
2629             return;
2630         }
2631         
2632         UseKind useKind;
2633         if (node->shouldSpeculateBoolean())
2634             useKind = BooleanUse;
2635         else
2636             useKind = UntypedUse;
2637         Node* newNode = m_insertionSet.insertNode(
2638             m_indexInBlock, SpecInt32Only, BooleanToNumber, m_currentNode->origin,
2639             Edge(node, useKind));
2640         observeUseKindOnNode(node, useKind);
2641         
2642         edge = Edge(newNode, Int32Use);
2643     }
2644     
2645     void fixDoubleOrBooleanEdge(Edge& edge)
2646     {
2647         Node* node = edge.node();
2648         if (!node->sawBooleans()) {
2649             fixEdge<DoubleRepUse>(edge);
2650             return;
2651         }
2652         
2653         UseKind useKind;
2654         if (node->shouldSpeculateBoolean())
2655             useKind = BooleanUse;
2656         else
2657             useKind = UntypedUse;
2658         Node* newNode = m_insertionSet.insertNode(
2659             m_indexInBlock, SpecInt32Only, BooleanToNumber, m_currentNode->origin,
2660             Edge(node, useKind));
2661         observeUseKindOnNode(node, useKind);
2662         
2663         edge = Edge(newNode, DoubleRepUse);
2664     }
2665     
2666     void truncateConstantToInt32(Edge& edge)
2667     {
2668         Node* oldNode = edge.node();
2669         
2670         JSValue value = oldNode->asJSValue();
2671         if (value.isInt32())
2672             return;
2673         
2674         value = jsNumber(JSC::toInt32(value.asNumber()));
2675         ASSERT(value.isInt32());
2676         edge.setNode(m_insertionSet.insertNode(
2677             m_indexInBlock, SpecInt32Only, JSConstant, m_currentNode->origin,
2678             OpInfo(m_graph.freeze(value))));
2679     }
2680     
2681     void truncateConstantsIfNecessary(Node* node, AddSpeculationMode mode)
2682     {
2683         if (mode != SpeculateInt32AndTruncateConstants)
2684             return;
2685         
2686         ASSERT(node->child1()->hasConstant() || node->child2()->hasConstant());
2687         if (node->child1()->hasConstant())
2688             truncateConstantToInt32(node->child1());
2689         else
2690             truncateConstantToInt32(node->child2());
2691     }
2692
2693     bool attemptToMakeIntegerAdd(Node* node)
2694     {
2695         AddSpeculationMode mode = m_graph.addSpeculationMode(node, FixupPass);
2696         if (mode != DontSpeculateInt32) {
2697             truncateConstantsIfNecessary(node, mode);
2698             fixIntOrBooleanEdge(node->child1());
2699             fixIntOrBooleanEdge(node->child2());
2700             if (bytecodeCanTruncateInteger(node->arithNodeFlags()))
2701                 node->setArithMode(Arith::Unchecked);
2702             else
2703                 node->setArithMode(Arith::CheckOverflow);
2704             return true;
2705         }
2706         
2707         if (m_graph.addShouldSpeculateAnyInt(node)) {
2708             fixEdge<Int52RepUse>(node->child1());
2709             fixEdge<Int52RepUse>(node->child2());
2710             node->setArithMode(Arith::CheckOverflow);
2711             node->setResult(NodeResultInt52);
2712             return true;
2713         }
2714         
2715         return false;
2716     }
2717     
2718     bool attemptToMakeGetArrayLength(Node* node)
2719     {
2720         if (!isInt32Speculation(node->prediction()))
2721             return false;
2722         CodeBlock* profiledBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
2723         ArrayProfile* arrayProfile = 
2724             profiledBlock->getArrayProfile(node->origin.semantic.bytecodeIndex);
2725         ArrayMode arrayMode = ArrayMode(Array::SelectUsingPredictions);
2726         if (arrayProfile) {
2727             ConcurrentJSLocker locker(profiledBlock->m_lock);
2728             arrayProfile->computeUpdatedPrediction(locker, profiledBlock);
2729             arrayMode = ArrayMode::fromObserved(locker, arrayProfile, Array::Read, false);
2730             if (arrayMode.type() == Array::Unprofiled) {
2731                 // For normal array operations, it makes sense to treat Unprofiled
2732                 // accesses as ForceExit and get more data rather than using
2733                 // predictions and then possibly ending up with a Generic. But here,
2734                 // we treat anything that is Unprofiled as Generic and keep the
2735                 // GetById. I.e. ForceExit = Generic. So, there is no harm - and only
2736                 // profit - from treating the Unprofiled case as
2737                 // SelectUsingPredictions.
2738                 arrayMode = ArrayMode(Array::SelectUsingPredictions);
2739             }
2740         }
2741             
2742         arrayMode = arrayMode.refine(
2743             m_graph, node, node->child1()->prediction(), node->prediction());
2744             
2745         if (arrayMode.type() == Array::Generic) {
2746             // Check if the input is something that we can't get array length for, but for which we
2747             // could insert some conversions in order to transform it into something that we can do it
2748             // for.
2749             if (node->child1()->shouldSpeculateStringObject())
2750                 attemptToForceStringArrayModeByToStringConversion<StringObjectUse>(arrayMode, node);
2751             else if (node->child1()->shouldSpeculateStringOrStringObject())
2752                 attemptToForceStringArrayModeByToStringConversion<StringOrStringObjectUse>(arrayMode, node);
2753         }
2754             
2755         if (!arrayMode.supportsSelfLength())
2756             return false;
2757         
2758         convertToGetArrayLength(node, arrayMode);
2759         return true;
2760     }
2761
2762     void convertToGetArrayLength(Node* node, ArrayMode arrayMode)
2763     {
2764         node->setOp(GetArrayLength);
2765         node->clearFlags(NodeMustGenerate);
2766         fixEdge<KnownCellUse>(node->child1());
2767         node->setArrayMode(arrayMode);
2768             
2769         Node* storage = checkArray(arrayMode, node->origin, node->child1().node(), 0, lengthNeedsStorage);
2770         if (!storage)
2771             return;
2772             
2773         node->child2() = Edge(storage);
2774     }
2775     
2776     Node* prependGetArrayLength(NodeOrigin origin, Node* child, ArrayMode arrayMode)
2777     {
2778         Node* storage = checkArray(arrayMode, origin, child, 0, lengthNeedsStorage);
2779         return m_insertionSet.insertNode(
2780             m_indexInBlock, SpecInt32Only, GetArrayLength, origin,
2781             OpInfo(arrayMode.asWord()), Edge(child, KnownCellUse), Edge(storage));
2782     }
2783
2784     void convertToHasIndexedProperty(Node* node)
2785     {
2786         node->setOp(HasIndexedProperty);
2787         node->clearFlags(NodeMustGenerate);
2788         node->setArrayMode(
2789             node->arrayMode().refine(
2790                 m_graph, node,
2791                 node->child1()->prediction(),
2792                 node->child2()->prediction(),
2793                 SpecNone));
2794         node->setInternalMethodType(PropertySlot::InternalMethodType::HasProperty);
2795
2796         blessArrayOperation(node->child1(), node->child2(), node->child3());
2797
2798         fixEdge<CellUse>(node->child1());
2799         fixEdge<Int32Use>(node->child2());
2800     }
2801
2802     bool attemptToMakeCallDOM(Node* node)
2803     {
2804         if (m_graph.hasExitSite(node->origin.semantic, BadType))
2805             return false;
2806
2807         const DOMJIT::Signature* signature = node->signature();
2808         if (!signature)
2809             return false;
2810
2811         {
2812             unsigned index = 0;
2813             bool shouldConvertToCallDOM = true;
2814             m_graph.doToChildren(node, [&](Edge& edge) {
2815                 // Callee. Ignore this. DFGByteCodeParser already emit appropriate checks.
2816                 if (!index)
2817                     return;
2818
2819                 if (index == 1) {
2820                     // DOM node case.
2821                     if (edge->shouldSpeculateNotCell())
2822                         shouldConvertToCallDOM = false;
2823                 } else {
2824                     switch (signature->arguments[index - 2]) {
2825                     case SpecString:
2826                         if (edge->shouldSpeculateNotString())
2827                             shouldConvertToCallDOM = false;
2828                         break;
2829                     case SpecInt32Only:
2830                         if (edge->shouldSpeculateNotInt32())
2831                             shouldConvertToCallDOM = false;
2832                         break;
2833                     case SpecBoolean:
2834                         if (edge->shouldSpeculateNotBoolean())
2835                             shouldConvertToCallDOM = false;
2836                         break;
2837                     default:
2838                         RELEASE_ASSERT_NOT_REACHED();
2839                         break;
2840                     }
2841                 }
2842                 ++index;
2843             });
2844             if (!shouldConvertToCallDOM)
2845                 return false;
2846         }
2847
2848         Node* thisNode = m_graph.varArgChild(node, 1).node();
2849         Ref<DOMJIT::Patchpoint> checkDOMPatchpoint = signature->checkDOM();
2850         m_graph.m_domJITPatchpoints.append(checkDOMPatchpoint.ptr());
2851         Node* checkDOM = m_insertionSet.insertNode(m_indexInBlock, SpecNone, CheckDOM, node->origin, OpInfo(checkDOMPatchpoint.ptr()), OpInfo(signature->classInfo), Edge(thisNode));
2852         node->convertToCallDOM(m_graph);
2853         fixupCheckDOM(checkDOM);
2854         fixupCallDOM(node);
2855         return true;
2856     }
2857
2858     void fixupCheckDOM(Node* node)
2859     {
2860         fixEdge<CellUse>(node->child1());
2861     }
2862
2863     void fixupCallDOM(Node* node)
2864     {
2865         const DOMJIT::Signature* signature = node->signature();
2866         auto fixup = [&](Edge& edge, unsigned argumentIndex) {
2867             if (!edge)
2868                 return;
2869             switch (signature->arguments[argumentIndex]) {
2870             case SpecString:
2871                 fixEdge<StringUse>(edge);
2872                 break;
2873             case SpecInt32Only:
2874                 fixEdge<Int32Use>(edge);
2875                 break;
2876             case SpecBoolean:
2877                 fixEdge<BooleanUse>(edge);
2878                 break;
2879             default:
2880                 RELEASE_ASSERT_NOT_REACHED();
2881                 break;
2882             }
2883         };
2884         fixEdge<CellUse>(node->child1()); // DOM.
2885         fixup(node->child2(), 0);
2886         fixup(node->child3(), 1);
2887     }
2888
2889     void fixupChecksInBlock(BasicBlock* block)
2890     {
2891         if (!block)
2892             return;
2893         ASSERT(block->isReachable);
2894         m_block = block;
2895         unsigned indexForChecks = UINT_MAX;
2896         NodeOrigin originForChecks;
2897         for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
2898             Node* node = block->at(indexInBlock);
2899
2900             // If this is a node at which we could exit, then save its index. If nodes after this one
2901             // cannot exit, then we will hoist checks to here.
2902             if (node->origin.exitOK) {
2903                 indexForChecks = indexInBlock;
2904                 originForChecks = node->origin;
2905             }
2906
2907             originForChecks = originForChecks.withSemantic(node->origin.semantic);
2908             
2909             // First, try to relax the representational demands of each node, in order to have
2910             // fewer conversions.
2911             switch (node->op()) {
2912             case MovHint:
2913             case Check:
2914                 m_graph.doToChildren(
2915                     node,
2916                     [&] (Edge& edge) {
2917                         switch (edge.useKind()) {
2918                         case DoubleRepUse:
2919                         case DoubleRepRealUse:
2920                             if (edge->hasDoubleResult())
2921                                 break;
2922             
2923                             if (edge->hasInt52Result())
2924                                 edge.setUseKind(Int52RepUse);
2925                             else if (edge.useKind() == DoubleRepUse)
2926                                 edge.setUseKind(NumberUse);
2927                             break;
2928             
2929                         case Int52RepUse:
2930                             // Nothing we can really do.
2931                             break;
2932             
2933                         case UntypedUse:
2934                         case NumberUse:
2935                             if (edge->hasDoubleResult())
2936                                 edge.setUseKind(DoubleRepUse);
2937                             else if (edge->hasInt52Result())
2938                                 edge.setUseKind(Int52RepUse);
2939                             break;
2940             
2941                         case RealNumberUse:
2942                             if (edge->hasDoubleResult())
2943                                 edge.setUseKind(DoubleRepRealUse);
2944                             else if (edge->hasInt52Result())
2945                                 edge.setUseKind(Int52RepUse);
2946                             break;
2947             
2948                         default:
2949                             break;
2950                         }
2951                     });
2952                 break;
2953                 
2954             case ValueToInt32:
2955                 if (node->child1().useKind() == DoubleRepUse
2956                     && !node->child1()->hasDoubleResult()) {
2957                     node->child1().setUseKind(NumberUse);
2958                     break;
2959                 }
2960                 break;
2961                 
2962             default:
2963                 break;
2964             }
2965
2966             // Now, insert type conversions if necessary.
2967             m_graph.doToChildren(
2968                 node,
2969                 [&] (Edge& edge) {
2970                     Node* result = nullptr;
2971
2972                     switch (edge.useKind()) {
2973                     case DoubleRepUse:
2974                     case DoubleRepRealUse:
2975                     case DoubleRepAnyIntUse: {
2976                         if (edge->hasDoubleResult())
2977                             break;
2978             
2979                         if (edge->isNumberConstant()) {
2980                             result = m_insertionSet.insertNode(
2981                                 indexForChecks, SpecBytecodeDouble, DoubleConstant, originForChecks,
2982                                 OpInfo(m_graph.freeze(jsDoubleNumber(edge->asNumber()))));
2983                         } else if (edge->hasInt52Result()) {
2984                             result = m_insertionSet.insertNode(
2985                                 indexForChecks, SpecAnyIntAsDouble, DoubleRep, originForChecks,
2986                                 Edge(edge.node(), Int52RepUse));
2987                         } else {
2988                             UseKind useKind;
2989                             if (edge->shouldSpeculateDoubleReal())
2990                                 useKind = RealNumberUse;
2991                             else if (edge->shouldSpeculateNumber())
2992                                 useKind = NumberUse;
2993                             else
2994                                 useKind = NotCellUse;
2995
2996                             result = m_insertionSet.insertNode(
2997                                 indexForChecks, SpecBytecodeDouble, DoubleRep, originForChecks,
2998                                 Edge(edge.node(), useKind));
2999                         }
3000
3001                         edge.setNode(result);
3002                         break;
3003                     }
3004             
3005                     case Int52RepUse: {
3006                         if (edge->hasInt52Result())
3007                             break;
3008             
3009                         if (edge->isAnyIntConstant()) {
3010                             result = m_insertionSet.insertNode(
3011                                 indexForChecks, SpecAnyInt, Int52Constant, originForChecks,
3012                                 OpInfo(edge->constant()));
3013                         } else if (edge->hasDoubleResult()) {
3014                             result = m_insertionSet.insertNode(
3015                                 indexForChecks, SpecAnyInt, Int52Rep, originForChecks,
3016                                 Edge(edge.node(), DoubleRepAnyIntUse));
3017                         } else if (edge->shouldSpeculateInt32ForArithmetic()) {
3018                             result = m_insertionSet.insertNode(
3019                                 indexForChecks, SpecInt32Only, Int52Rep, originForChecks,
3020                                 Edge(edge.node(), Int32Use));
3021                         } else {
3022                             result = m_insertionSet.insertNode(
3023                                 indexForChecks, SpecAnyInt, Int52Rep, originForChecks,
3024                                 Edge(edge.node(), AnyIntUse));
3025                         }
3026
3027                         edge.setNode(result);
3028                         break;
3029                     }
3030
3031                     default: {
3032                         if (!edge->hasDoubleResult() && !edge->hasInt52Result())
3033                             break;
3034             
3035                         if (edge->hasDoubleResult()) {
3036                             result = m_insertionSet.insertNode(
3037                                 indexForChecks, SpecBytecodeDouble, ValueRep, originForChecks,
3038                                 Edge(edge.node(), DoubleRepUse));
3039                         } else {
3040                             result = m_insertionSet.insertNode(
3041                                 indexForChecks, SpecInt32Only | SpecAnyIntAsDouble, ValueRep,
3042                                 originForChecks, Edge(edge.node(), Int52RepUse));
3043                         }
3044
3045                         edge.setNode(result);
3046                         break;
3047                     } }
3048
3049                     // It's remotely possible that this node cannot do type checks, but we now have a
3050                     // type check on this node. We don't have to handle the general form of this
3051                     // problem. It only arises when ByteCodeParser emits an immediate SetLocal, rather
3052                     // than a delayed one. So, we only worry about those checks that we may have put on
3053                     // a SetLocal. Note that "indexForChecks != indexInBlock" is just another way of
3054                     // saying "!node->origin.exitOK".
3055                     if (indexForChecks != indexInBlock && mayHaveTypeCheck(edge.useKind())) {
3056                         UseKind knownUseKind;
3057     &nb