2 * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 #include "DFGNodeFlags.h"
33 namespace JSC { namespace DFG {
35 // This macro defines a set of information about all known node types, used to populate NodeId, NodeType below.
36 #define FOR_EACH_DFG_OP(macro) \
37 /* A constant in the CodeBlock's constant pool. */\
38 macro(JSConstant, NodeResultJS) \
40 /* Constants with specific representations. */\
41 macro(DoubleConstant, NodeResultDouble) \
42 macro(Int52Constant, NodeResultInt52) \
44 /* Lazy JSValue constant. We don't know the JSValue bits of it yet. */\
45 macro(LazyJSConstant, NodeResultJS) \
47 /* Marker to indicate that an operation was optimized entirely and all that is left */\
48 /* is to make one node alias another. CSE will later usually eliminate this node, */\
49 /* though it may choose not to if it would corrupt predictions (very rare). */\
50 macro(Identity, NodeResultJS) \
52 /* Nodes for handling functions (both as call and as construct). */\
53 macro(ToThis, NodeResultJS) \
54 macro(CreateThis, NodeResultJS) /* Note this is not MustGenerate since we're returning it anyway. */ \
55 macro(GetCallee, NodeResultJS) \
56 macro(GetArgumentCountIncludingThis, NodeResultInt32) \
58 /* Nodes for local variable access. These nodes are linked together using Phi nodes. */\
59 /* Any two nodes that are part of the same Phi graph will share the same */\
60 /* VariableAccessData, and thus will share predictions. FIXME: We should come up with */\
61 /* better names for a lot of these. https://bugs.webkit.org/show_bug.cgi?id=137307. */\
62 /* Note that GetLocal is MustGenerate because it's our only way of knowing that some other */\
63 /* basic block might have read a local variable in bytecode. We only remove GetLocals if it */\
64 /* is redundant because of an earlier GetLocal or SetLocal in the same block. We could make */\
65 /* these not MustGenerate and use a more sophisticated analysis to insert PhantomLocals in */\
66 /* the same way that we insert Phantoms. That's hard and probably not profitable. See */\
67 /* https://bugs.webkit.org/show_bug.cgi?id=144086 */\
68 macro(GetLocal, NodeResultJS | NodeMustGenerate) \
71 macro(PutStack, NodeMustGenerate) \
72 macro(KillStack, NodeMustGenerate) \
73 macro(GetStack, NodeResultJS) \
75 macro(MovHint, NodeMustGenerate) \
76 macro(ZombieHint, NodeMustGenerate) \
77 macro(ExitOK, NodeMustGenerate) /* Indicates that exit state is intact. */ \
78 macro(Phantom, NodeMustGenerate) \
79 macro(Check, NodeMustGenerate) /* Used if we want just a type check but not liveness. Non-checking uses will be removed. */\
82 macro(Flush, NodeMustGenerate) \
83 macro(PhantomLocal, NodeMustGenerate) \
85 /* Hint that this is where bytecode thinks is a good place to OSR. Note that this */\
86 /* will exist even in inlined loops. This has no execution semantics but it must */\
87 /* survive all DCE. We treat this as being a can-exit because tier-up to FTL may */\
88 /* want all state. */\
89 macro(LoopHint, NodeMustGenerate) \
91 /* Special node for OSR entry into the FTL. Indicates that we're loading a local */\
92 /* variable from the scratch buffer. */\
93 macro(ExtractOSREntryLocal, NodeResultJS) \
95 /* Tier-up checks from the DFG to the FTL. */\
96 macro(CheckTierUpInLoop, NodeMustGenerate) \
97 macro(CheckTierUpAndOSREnter, NodeMustGenerate) \
98 macro(CheckTierUpAtReturn, NodeMustGenerate) \
100 /* Get the value of a local variable, without linking into the VariableAccessData */\
101 /* network. This is only valid for variable accesses whose predictions originated */\
102 /* as something other than a local access, and thus had their own profiling. */\
103 macro(GetLocalUnlinked, NodeResultJS) \
105 /* Marker for an argument being set at the prologue of a function. */\
106 macro(SetArgument, 0) \
108 /* Marker of location in the IR where we may possibly perform jump replacement to */\
109 /* invalidate this code block. */\
110 macro(InvalidationPoint, NodeMustGenerate) \
112 /* Nodes for bitwise operations. */\
113 macro(BitAnd, NodeResultInt32) \
114 macro(BitOr, NodeResultInt32) \
115 macro(BitXor, NodeResultInt32) \
116 macro(BitLShift, NodeResultInt32) \
117 macro(BitRShift, NodeResultInt32) \
118 macro(BitURShift, NodeResultInt32) \
119 /* Bitwise operators call ToInt32 on their operands. */\
120 macro(ValueToInt32, NodeResultInt32) \
121 /* Used to box the result of URShift nodes (result has range 0..2^32-1). */\
122 macro(UInt32ToNumber, NodeResultNumber | NodeMustGenerate) \
123 /* Converts booleans to numbers but passes everything else through. */\
124 macro(BooleanToNumber, NodeResultJS) \
126 /* Attempt to truncate a double to int32; this will exit if it can't do it. */\
127 macro(DoubleAsInt32, NodeResultInt32) \
129 /* Change the representation of a value. */\
130 macro(DoubleRep, NodeResultDouble) \
131 macro(Int52Rep, NodeResultInt52) \
132 macro(ValueRep, NodeResultJS) \
134 /* Bogus type asserting node. Useful for testing, disappears during Fixup. */\
135 macro(FiatInt52, NodeResultJS) \
137 /* Nodes for arithmetic operations. Note that if they do checks other than just type checks, */\
138 /* then they are MustGenerate. This is probably stricter than it needs to be - for example */\
139 /* they won't do checks if they are speculated double. Also, we could kill these if we do it */\
140 /* before AI starts eliminating downstream operations based on proofs, for example in the */\
141 /* case of "var tmp = a + b; return (tmp | 0) == tmp;". If a, b are speculated integer then */\
142 /* this is only true if we do the overflow check - hence the need to keep it alive. More */\
143 /* generally, we need to keep alive any operation whose checks cause filtration in AI. */\
144 macro(ArithAdd, NodeResultNumber | NodeMustGenerate) \
145 macro(ArithClz32, NodeResultInt32 | NodeMustGenerate) \
146 macro(ArithSub, NodeResultNumber | NodeMustGenerate) \
147 macro(ArithNegate, NodeResultNumber | NodeMustGenerate) \
148 macro(ArithMul, NodeResultNumber | NodeMustGenerate) \
149 macro(ArithIMul, NodeResultInt32) \
150 macro(ArithDiv, NodeResultNumber | NodeMustGenerate) \
151 macro(ArithMod, NodeResultNumber | NodeMustGenerate) \
152 macro(ArithAbs, NodeResultNumber | NodeMustGenerate) \
153 macro(ArithMin, NodeResultNumber) \
154 macro(ArithMax, NodeResultNumber) \
155 macro(ArithFRound, NodeResultDouble | NodeMustGenerate) \
156 macro(ArithPow, NodeResultDouble) \
157 macro(ArithRandom, NodeResultDouble | NodeMustGenerate) \
158 macro(ArithRound, NodeResultNumber) \
159 macro(ArithFloor, NodeResultNumber) \
160 macro(ArithCeil, NodeResultNumber) \
161 macro(ArithTrunc, NodeResultNumber) \
162 macro(ArithSqrt, NodeResultDouble | NodeMustGenerate) \
163 macro(ArithSin, NodeResultDouble | NodeMustGenerate) \
164 macro(ArithCos, NodeResultDouble | NodeMustGenerate) \
165 macro(ArithLog, NodeResultDouble | NodeMustGenerate) \
167 /* Add of values may either be arithmetic, or result in string concatenation. */\
168 macro(ValueAdd, NodeResultJS | NodeMustGenerate) \
170 /* Add of values that always convers its inputs to strings. May have two or three kids. */\
171 macro(StrCat, NodeResultJS | NodeMustGenerate) \
173 /* Property access. */\
174 /* PutByValAlias indicates a 'put' aliases a prior write to the same property. */\
175 /* Since a put to 'length' may invalidate optimizations here, */\
176 /* this must be the directly subsequent property put. Note that PutByVal */\
177 /* opcodes use VarArgs beause they may have up to 4 children. */\
178 macro(GetByVal, NodeResultJS | NodeMustGenerate) \
179 macro(GetByValWithThis, NodeResultJS | NodeMustGenerate) \
180 macro(GetMyArgumentByVal, NodeResultJS | NodeMustGenerate) \
181 macro(GetMyArgumentByValOutOfBounds, NodeResultJS | NodeMustGenerate) \
182 macro(LoadVarargs, NodeMustGenerate) \
183 macro(ForwardVarargs, NodeMustGenerate) \
184 macro(PutByValDirect, NodeMustGenerate | NodeHasVarArgs) \
185 macro(PutByVal, NodeMustGenerate | NodeHasVarArgs) \
186 macro(PutByValAlias, NodeMustGenerate | NodeHasVarArgs) \
187 macro(TryGetById, NodeResultJS) \
188 macro(GetById, NodeResultJS | NodeMustGenerate) \
189 macro(GetByIdFlush, NodeResultJS | NodeMustGenerate) \
190 macro(GetByIdWithThis, NodeResultJS | NodeMustGenerate) \
191 macro(PutById, NodeMustGenerate) \
192 macro(PutByIdFlush, NodeMustGenerate) \
193 macro(PutByIdDirect, NodeMustGenerate) \
194 macro(PutByIdWithThis, NodeMustGenerate) \
195 macro(PutByValWithThis, NodeMustGenerate | NodeHasVarArgs) \
196 macro(PutGetterById, NodeMustGenerate) \
197 macro(PutSetterById, NodeMustGenerate) \
198 macro(PutGetterSetterById, NodeMustGenerate) \
199 macro(PutGetterByVal, NodeMustGenerate) \
200 macro(PutSetterByVal, NodeMustGenerate) \
201 macro(DeleteById, NodeResultBoolean | NodeMustGenerate) \
202 macro(DeleteByVal, NodeResultBoolean | NodeMustGenerate) \
203 macro(CheckStructure, NodeMustGenerate) \
204 macro(GetExecutable, NodeResultJS) \
205 macro(PutStructure, NodeMustGenerate) \
206 macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
207 macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
208 macro(GetButterfly, NodeResultStorage) \
209 macro(CheckArray, NodeMustGenerate) \
210 macro(Arrayify, NodeMustGenerate) \
211 macro(ArrayifyToStructure, NodeMustGenerate) \
212 macro(GetIndexedPropertyStorage, NodeResultStorage) \
213 macro(ConstantStoragePointer, NodeResultStorage) \
214 macro(GetGetter, NodeResultJS) \
215 macro(GetSetter, NodeResultJS) \
216 macro(GetByOffset, NodeResultJS) \
217 macro(GetGetterSetterByOffset, NodeResultJS) \
218 macro(MultiGetByOffset, NodeResultJS | NodeMustGenerate) \
219 macro(PutByOffset, NodeMustGenerate) \
220 macro(MultiPutByOffset, NodeMustGenerate) \
221 macro(GetArrayLength, NodeResultInt32) \
222 macro(GetTypedArrayByteOffset, NodeResultInt32) \
223 macro(GetScope, NodeResultJS) \
224 macro(SkipScope, NodeResultJS) \
225 macro(ResolveScope, NodeResultJS | NodeMustGenerate) \
226 macro(GetGlobalObject, NodeResultJS) \
227 macro(GetClosureVar, NodeResultJS) \
228 macro(PutClosureVar, NodeMustGenerate) \
229 macro(GetGlobalVar, NodeResultJS) \
230 macro(GetGlobalLexicalVariable, NodeResultJS) \
231 macro(PutGlobalVariable, NodeMustGenerate) \
232 macro(GetDynamicVar, NodeResultJS | NodeMustGenerate) \
233 macro(PutDynamicVar, NodeMustGenerate) \
234 macro(NotifyWrite, NodeMustGenerate) \
235 macro(GetRegExpObjectLastIndex, NodeResultJS) \
236 macro(SetRegExpObjectLastIndex, NodeMustGenerate) \
237 macro(RecordRegExpCachedResult, NodeMustGenerate | NodeHasVarArgs) \
238 macro(CheckCell, NodeMustGenerate) \
239 macro(CheckNotEmpty, NodeMustGenerate) \
240 macro(CheckBadCell, NodeMustGenerate) \
241 macro(CheckInBounds, NodeMustGenerate) \
242 macro(CheckStringIdent, NodeMustGenerate) \
243 macro(CheckTypeInfoFlags, NodeMustGenerate) /* Takes an OpInfo with the flags you want to test are set */\
245 /* Optimizations for array mutation. */\
246 macro(ArrayPush, NodeResultJS | NodeMustGenerate) \
247 macro(ArrayPop, NodeResultJS | NodeMustGenerate) \
249 /* Optimizations for regular expression matching. */\
250 macro(RegExpExec, NodeResultJS | NodeMustGenerate) \
251 macro(RegExpTest, NodeResultJS | NodeMustGenerate) \
252 macro(StringReplace, NodeResultJS | NodeMustGenerate) \
253 macro(StringReplaceRegExp, NodeResultJS | NodeMustGenerate) \
255 /* Optimizations for string access */ \
256 macro(StringCharCodeAt, NodeResultInt32) \
257 macro(StringCharAt, NodeResultJS) \
258 macro(StringFromCharCode, NodeResultJS) \
260 /* Nodes for comparison operations. */\
261 macro(CompareLess, NodeResultBoolean | NodeMustGenerate) \
262 macro(CompareLessEq, NodeResultBoolean | NodeMustGenerate) \
263 macro(CompareGreater, NodeResultBoolean | NodeMustGenerate) \
264 macro(CompareGreaterEq, NodeResultBoolean | NodeMustGenerate) \
265 macro(CompareEq, NodeResultBoolean | NodeMustGenerate) \
266 macro(CompareStrictEq, NodeResultBoolean) \
267 macro(CompareEqPtr, NodeResultBoolean) \
270 macro(Call, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
271 macro(Construct, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
272 macro(CallVarargs, NodeResultJS | NodeMustGenerate) \
273 macro(CallForwardVarargs, NodeResultJS | NodeMustGenerate) \
274 macro(ConstructVarargs, NodeResultJS | NodeMustGenerate) \
275 macro(ConstructForwardVarargs, NodeResultJS | NodeMustGenerate) \
276 macro(TailCallInlinedCaller, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
277 macro(TailCallVarargsInlinedCaller, NodeResultJS | NodeMustGenerate) \
278 macro(TailCallForwardVarargsInlinedCaller, NodeResultJS | NodeMustGenerate) \
279 macro(CallEval, NodeResultJS | NodeMustGenerate | NodeHasVarArgs) \
281 /* Shadow Chicken */\
282 macro(LogShadowChickenPrologue, NodeMustGenerate) \
283 macro(LogShadowChickenTail, NodeMustGenerate) \
286 macro(NewObject, NodeResultJS) \
287 macro(NewArray, NodeResultJS | NodeHasVarArgs) \
288 macro(NewArrayWithSize, NodeResultJS | NodeMustGenerate) \
289 macro(NewArrayBuffer, NodeResultJS) \
290 macro(NewTypedArray, NodeResultJS | NodeMustGenerate) \
291 macro(NewRegexp, NodeResultJS) \
292 /* Rest Parameter */\
293 macro(GetRestLength, NodeResultInt32) \
294 macro(CreateRest, NodeResultJS | NodeMustGenerate) \
296 /* Support for allocation sinking. */\
297 macro(PhantomNewObject, NodeResultJS | NodeMustGenerate) \
298 macro(PutHint, NodeMustGenerate) \
299 macro(CheckStructureImmediate, NodeMustGenerate) \
300 macro(MaterializeNewObject, NodeResultJS | NodeHasVarArgs) \
301 macro(PhantomNewFunction, NodeResultJS | NodeMustGenerate) \
302 macro(PhantomNewGeneratorFunction, NodeResultJS | NodeMustGenerate) \
303 macro(PhantomCreateActivation, NodeResultJS | NodeMustGenerate) \
304 macro(MaterializeCreateActivation, NodeResultJS | NodeHasVarArgs) \
306 /* Nodes for misc operations. */\
307 macro(OverridesHasInstance, NodeMustGenerate | NodeResultBoolean) \
308 macro(InstanceOf, NodeResultBoolean) \
309 macro(InstanceOfCustom, NodeMustGenerate | NodeResultBoolean) \
311 macro(IsJSArray, NodeResultBoolean) \
312 macro(IsEmpty, NodeResultBoolean) \
313 macro(IsUndefined, NodeResultBoolean) \
314 macro(IsBoolean, NodeResultBoolean) \
315 macro(IsNumber, NodeResultBoolean) \
316 macro(IsString, NodeResultBoolean) \
317 macro(IsObject, NodeResultBoolean) \
318 macro(IsObjectOrNull, NodeResultBoolean) \
319 macro(IsFunction, NodeResultBoolean) \
320 macro(IsRegExpObject, NodeResultBoolean) \
321 macro(IsTypedArrayView, NodeResultBoolean) \
322 macro(TypeOf, NodeResultJS) \
323 macro(LogicalNot, NodeResultBoolean) \
324 macro(ToPrimitive, NodeResultJS | NodeMustGenerate) \
325 macro(ToString, NodeResultJS | NodeMustGenerate) \
326 macro(ToNumber, NodeResultJS | NodeMustGenerate) \
327 macro(CallObjectConstructor, NodeResultJS) \
328 macro(CallStringConstructor, NodeResultJS | NodeMustGenerate) \
329 macro(NewStringObject, NodeResultJS) \
330 macro(MakeRope, NodeResultJS) \
331 macro(In, NodeResultBoolean | NodeMustGenerate) \
332 macro(ProfileType, NodeMustGenerate) \
333 macro(ProfileControlFlow, NodeMustGenerate) \
334 macro(SetFunctionName, NodeMustGenerate) \
336 macro(CreateActivation, NodeResultJS) \
338 macro(CreateDirectArguments, NodeResultJS) \
339 macro(PhantomDirectArguments, NodeResultJS | NodeMustGenerate) \
340 macro(CreateScopedArguments, NodeResultJS) \
341 macro(CreateClonedArguments, NodeResultJS) \
342 macro(PhantomClonedArguments, NodeResultJS | NodeMustGenerate) \
343 macro(GetFromArguments, NodeResultJS) \
344 macro(PutToArguments, NodeMustGenerate) \
346 macro(NewFunction, NodeResultJS) \
348 macro(NewGeneratorFunction, NodeResultJS) \
350 /* These aren't terminals but always exit */ \
351 macro(Throw, NodeMustGenerate) \
352 macro(ThrowReferenceError, NodeMustGenerate) \
354 /* Block terminals. */\
355 macro(Jump, NodeMustGenerate) \
356 macro(Branch, NodeMustGenerate) \
357 macro(Switch, NodeMustGenerate) \
358 macro(Return, NodeMustGenerate) \
359 macro(TailCall, NodeMustGenerate | NodeHasVarArgs) \
360 macro(TailCallVarargs, NodeMustGenerate) \
361 macro(TailCallForwardVarargs, NodeMustGenerate) \
362 macro(Unreachable, NodeMustGenerate) \
364 /* Count execution. */\
365 macro(CountExecution, NodeMustGenerate) \
367 /* This is a pseudo-terminal. It means that execution should fall out of DFG at */\
368 /* this point, but execution does continue in the basic block - just in a */\
369 /* different compiler. */\
370 macro(ForceOSRExit, NodeMustGenerate) \
372 /* Vends a bottom JS value. It is invalid to ever execute this. Useful for cases */\
373 /* where we know that we would have exited but we'd like to still track the control */\
375 macro(BottomValue, NodeResultJS) \
377 /* Checks the watchdog timer. If the timer has fired, we call operation operationHandleWatchdogTimer*/ \
378 macro(CheckWatchdogTimer, NodeMustGenerate) \
379 /* Write barriers ! */\
380 macro(StoreBarrier, NodeMustGenerate) \
382 /* For-in enumeration opcodes */\
383 macro(GetEnumerableLength, NodeMustGenerate | NodeResultJS) \
384 macro(HasIndexedProperty, NodeResultBoolean) \
385 macro(HasStructureProperty, NodeResultBoolean) \
386 macro(HasGenericProperty, NodeResultBoolean) \
387 macro(GetDirectPname, NodeMustGenerate | NodeHasVarArgs | NodeResultJS) \
388 macro(GetPropertyEnumerator, NodeMustGenerate | NodeResultJS) \
389 macro(GetEnumeratorStructurePname, NodeMustGenerate | NodeResultJS) \
390 macro(GetEnumeratorGenericPname, NodeMustGenerate | NodeResultJS) \
391 macro(ToIndexString, NodeResultJS)
393 // This enum generates a monotonically increasing id for all Node types,
394 // and is used by the subsequent enum to fill out the id (as accessed via the NodeIdMask).
396 #define DFG_OP_ENUM(opcode, flags) opcode,
397 FOR_EACH_DFG_OP(DFG_OP_ENUM)
402 // Specifies the default flags for each node.
403 inline NodeFlags defaultFlags(NodeType op)
406 #define DFG_OP_ENUM(opcode, flags) case opcode: return flags;
407 FOR_EACH_DFG_OP(DFG_OP_ENUM)
410 RELEASE_ASSERT_NOT_REACHED();
415 } } // namespace JSC::DFG
417 #endif // ENABLE(DFG_JIT)
419 #endif // DFGNodeType_h