1/*
2 * Copyright (C) 2012-2018 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "config.h"
27#include "DFGArrayMode.h"
28
29#if ENABLE(DFG_JIT)
30
31#include "ArrayPrototype.h"
32#include "DFGAbstractValue.h"
33#include "DFGGraph.h"
34#include "JSCInlines.h"
35
36namespace JSC { namespace DFG {
37
38ArrayMode ArrayMode::fromObserved(const ConcurrentJSLocker& locker, ArrayProfile* profile, Array::Action action, bool makeSafe)
39{
40 Array::Class nonArray;
41 if (profile->usesOriginalArrayStructures(locker))
42 nonArray = Array::OriginalNonArray;
43 else
44 nonArray = Array::NonArray;
45
46 auto handleContiguousModes = [&] (Array::Type type, ArrayModes observed) {
47 Array::Class isArray;
48 Array::Conversion converts;
49
50 RELEASE_ASSERT((observed & (asArrayModesIgnoringTypedArrays(toIndexingShape(type)) | asArrayModesIgnoringTypedArrays(toIndexingShape(type) | ArrayClass) | asArrayModesIgnoringTypedArrays(toIndexingShape(type) | ArrayClass | CopyOnWrite))) == observed);
51
52 if (observed & asArrayModesIgnoringTypedArrays(toIndexingShape(type))) {
53 if ((observed & asArrayModesIgnoringTypedArrays(toIndexingShape(type))) == observed)
54 isArray = nonArray;
55 else
56 isArray = Array::PossiblyArray;
57 } else
58 isArray = Array::Array;
59
60 if (action == Array::Write && (observed & asArrayModesIgnoringTypedArrays(toIndexingShape(type) | ArrayClass | CopyOnWrite)))
61 converts = Array::Convert;
62 else
63 converts = Array::AsIs;
64
65 return ArrayMode(type, isArray, converts, action).withProfile(locker, profile, makeSafe);
66 };
67
68 ArrayModes observed = profile->observedArrayModes(locker);
69 switch (observed) {
70 case 0:
71 return ArrayMode(Array::Unprofiled);
72 case asArrayModesIgnoringTypedArrays(NonArray):
73 if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
74 return ArrayMode(Array::SelectUsingArguments, nonArray, Array::OutOfBounds, Array::Convert, action);
75 return ArrayMode(Array::SelectUsingPredictions, nonArray, action).withSpeculationFromProfile(locker, profile, makeSafe);
76
77 case asArrayModesIgnoringTypedArrays(ArrayWithUndecided):
78 if (action == Array::Write)
79 return ArrayMode(Array::SelectUsingArguments, Array::Array, Array::OutOfBounds, Array::Convert, action);
80 return ArrayMode(Array::Undecided, Array::Array, Array::OutOfBounds, Array::AsIs, action).withProfile(locker, profile, makeSafe);
81
82 case asArrayModesIgnoringTypedArrays(NonArray) | asArrayModesIgnoringTypedArrays(ArrayWithUndecided):
83 if (action == Array::Write && !profile->mayInterceptIndexedAccesses(locker))
84 return ArrayMode(Array::SelectUsingArguments, Array::PossiblyArray, Array::OutOfBounds, Array::Convert, action);
85 return ArrayMode(Array::SelectUsingPredictions, action).withSpeculationFromProfile(locker, profile, makeSafe);
86
87 case asArrayModesIgnoringTypedArrays(NonArrayWithInt32):
88 case asArrayModesIgnoringTypedArrays(ArrayWithInt32):
89 case asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithInt32):
90 case asArrayModesIgnoringTypedArrays(NonArrayWithInt32) | asArrayModesIgnoringTypedArrays(ArrayWithInt32):
91 case asArrayModesIgnoringTypedArrays(NonArrayWithInt32) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithInt32):
92 case asArrayModesIgnoringTypedArrays(ArrayWithInt32) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithInt32):
93 case asArrayModesIgnoringTypedArrays(NonArrayWithInt32) | asArrayModesIgnoringTypedArrays(ArrayWithInt32) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithInt32):
94 return handleContiguousModes(Array::Int32, observed);
95
96 case asArrayModesIgnoringTypedArrays(NonArrayWithDouble):
97 case asArrayModesIgnoringTypedArrays(ArrayWithDouble):
98 case asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithDouble):
99 case asArrayModesIgnoringTypedArrays(NonArrayWithDouble) | asArrayModesIgnoringTypedArrays(ArrayWithDouble):
100 case asArrayModesIgnoringTypedArrays(NonArrayWithDouble) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithDouble):
101 case asArrayModesIgnoringTypedArrays(ArrayWithDouble) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithDouble):
102 case asArrayModesIgnoringTypedArrays(NonArrayWithDouble) | asArrayModesIgnoringTypedArrays(ArrayWithDouble) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithDouble):
103 return handleContiguousModes(Array::Double, observed);
104
105 case asArrayModesIgnoringTypedArrays(NonArrayWithContiguous):
106 case asArrayModesIgnoringTypedArrays(ArrayWithContiguous):
107 case asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithContiguous):
108 case asArrayModesIgnoringTypedArrays(NonArrayWithContiguous) | asArrayModesIgnoringTypedArrays(ArrayWithContiguous):
109 case asArrayModesIgnoringTypedArrays(NonArrayWithContiguous) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithContiguous):
110 case asArrayModesIgnoringTypedArrays(ArrayWithContiguous) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithContiguous):
111 case asArrayModesIgnoringTypedArrays(NonArrayWithContiguous) | asArrayModesIgnoringTypedArrays(ArrayWithContiguous) | asArrayModesIgnoringTypedArrays(CopyOnWriteArrayWithContiguous):
112 return handleContiguousModes(Array::Contiguous, observed);
113
114 case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage):
115 return ArrayMode(Array::ArrayStorage, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
116 case asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage):
117 case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage):
118 return ArrayMode(Array::SlowPutArrayStorage, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
119 case asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage):
120 return ArrayMode(Array::ArrayStorage, Array::Array, Array::AsIs, action).withProfile(locker, profile, makeSafe);
121 case asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
122 case asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
123 return ArrayMode(Array::SlowPutArrayStorage, Array::Array, Array::AsIs, action).withProfile(locker, profile, makeSafe);
124 case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage):
125 return ArrayMode(Array::ArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
126 case asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
127 case asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage):
128 return ArrayMode(Array::SlowPutArrayStorage, Array::PossiblyArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
129 case Int8ArrayMode:
130 return ArrayMode(Array::Int8Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
131 case Int16ArrayMode:
132 return ArrayMode(Array::Int16Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
133 case Int32ArrayMode:
134 return ArrayMode(Array::Int32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
135 case Uint8ArrayMode:
136 return ArrayMode(Array::Uint8Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
137 case Uint8ClampedArrayMode:
138 return ArrayMode(Array::Uint8ClampedArray, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
139 case Uint16ArrayMode:
140 return ArrayMode(Array::Uint16Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
141 case Uint32ArrayMode:
142 return ArrayMode(Array::Uint32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
143 case Float32ArrayMode:
144 return ArrayMode(Array::Float32Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
145 case Float64ArrayMode:
146 return ArrayMode(Array::Float64Array, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
147
148 default:
149 // If we have seen multiple TypedArray types, or a TypedArray and non-typed array, it doesn't make sense to try to convert the object since you can't convert typed arrays.
150 if (observed & ALL_TYPED_ARRAY_MODES)
151 return ArrayMode(Array::Generic, nonArray, Array::AsIs, action).withProfile(locker, profile, makeSafe);
152
153 if ((observed & asArrayModesIgnoringTypedArrays(NonArray)) && profile->mayInterceptIndexedAccesses(locker))
154 return ArrayMode(Array::SelectUsingPredictions).withSpeculationFromProfile(locker, profile, makeSafe);
155
156 Array::Type type;
157 Array::Class arrayClass;
158
159 if (shouldUseSlowPutArrayStorage(observed))
160 type = Array::SlowPutArrayStorage;
161 else if (shouldUseFastArrayStorage(observed))
162 type = Array::ArrayStorage;
163 else if (shouldUseContiguous(observed))
164 type = Array::Contiguous;
165 else if (shouldUseDouble(observed))
166 type = Array::Double;
167 else if (shouldUseInt32(observed))
168 type = Array::Int32;
169 else
170 type = Array::SelectUsingArguments;
171
172 if (hasSeenArray(observed) && hasSeenNonArray(observed))
173 arrayClass = Array::PossiblyArray;
174 else if (hasSeenArray(observed))
175 arrayClass = Array::Array;
176 else if (hasSeenNonArray(observed))
177 arrayClass = nonArray;
178 else
179 arrayClass = Array::PossiblyArray;
180
181 return ArrayMode(type, arrayClass, Array::Convert, action).withProfile(locker, profile, makeSafe);
182 }
183}
184
185static bool canBecomeGetArrayLength(Graph& graph, Node* node)
186{
187 if (node->op() != GetById)
188 return false;
189 auto uid = graph.identifiers()[node->identifierNumber()];
190 return uid == graph.m_vm.propertyNames->length.impl();
191}
192
193ArrayMode ArrayMode::refine(
194 Graph& graph, Node* node,
195 SpeculatedType base, SpeculatedType index, SpeculatedType value) const
196{
197 if (!base || !index) {
198 // It can be that we had a legitimate arrayMode but no incoming predictions. That'll
199 // happen if we inlined code based on, say, a global variable watchpoint, but later
200 // realized that the callsite could not have possibly executed. It may be worthwhile
201 // to fix that, but for now I'm leaving it as-is.
202 return ArrayMode(Array::ForceExit, action());
203 }
204
205 if (!isInt32Speculation(index))
206 return ArrayMode(Array::Generic, action());
207
208 // If we had exited because of an exotic object behavior, then don't try to specialize.
209 if (graph.hasExitSite(node->origin.semantic, ExoticObjectMode))
210 return ArrayMode(Array::Generic, action());
211
212 // Note: our profiling currently doesn't give us good information in case we have
213 // an unlikely control flow path that sets the base to a non-cell value. Value
214 // profiling and prediction propagation will probably tell us that the value is
215 // either a cell or not, but that doesn't tell us which is more likely: that this
216 // is an array access on a cell (what we want and can optimize) or that the user is
217 // doing a crazy by-val access on a primitive (we can't easily optimize this and
218 // don't want to). So, for now, we assume that if the base is not a cell according
219 // to value profiling, but the array profile tells us something else, then we
220 // should just trust the array profile.
221
222 auto typedArrayResult = [&] (ArrayMode result) -> ArrayMode {
223 if (node->op() == PutByValDirect) {
224 // This is semantically identical to defineOwnProperty({configurable: true, writable:true, enumerable:true}),
225 // which we can't model as a simple store to the typed array since typed array indexed properties
226 // are non-configurable.
227 return ArrayMode(Array::Generic, action());
228 }
229 return result;
230 };
231
232 switch (type()) {
233 case Array::SelectUsingArguments:
234 if (!value)
235 return withType(Array::ForceExit);
236 if (isInt32Speculation(value))
237 return withTypeAndConversion(Array::Int32, Array::Convert);
238 if (isFullNumberSpeculation(value))
239 return withTypeAndConversion(Array::Double, Array::Convert);
240 return withTypeAndConversion(Array::Contiguous, Array::Convert);
241 case Array::Undecided: {
242 // If we have an OriginalArray and the JSArray prototype chain is sane,
243 // any indexed access always return undefined. We have a fast path for that.
244 JSGlobalObject* globalObject = graph.globalObjectFor(node->origin.semantic);
245 Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(graph.m_vm);
246 Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(graph.m_vm);
247 if ((node->op() == GetByVal || canBecomeGetArrayLength(graph, node))
248 && isJSArrayWithOriginalStructure()
249 && !graph.hasExitSite(node->origin.semantic, OutOfBounds)
250 && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
251 && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
252 && globalObject->arrayPrototypeChainIsSane()) {
253 graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
254 graph.registerAndWatchStructureTransition(objectPrototypeStructure);
255 if (globalObject->arrayPrototypeChainIsSane())
256 return withSpeculation(Array::SaneChain);
257 }
258 return ArrayMode(Array::Generic, action());
259 }
260 case Array::Int32:
261 if (!value || isInt32Speculation(value))
262 return *this;
263 if (isFullNumberSpeculation(value))
264 return withTypeAndConversion(Array::Double, Array::Convert);
265 return withTypeAndConversion(Array::Contiguous, Array::Convert);
266
267 case Array::Double:
268 if (!value || isFullNumberSpeculation(value))
269 return *this;
270 return withTypeAndConversion(Array::Contiguous, Array::Convert);
271
272 case Array::Contiguous:
273 return *this;
274
275 case Array::Int8Array:
276 case Array::Int16Array:
277 case Array::Int32Array:
278 case Array::Uint8Array:
279 case Array::Uint8ClampedArray:
280 case Array::Uint16Array:
281 case Array::Uint32Array:
282 case Array::Float32Array:
283 case Array::Float64Array:
284 if (node->op() == PutByVal) {
285 if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
286 return typedArrayResult(withSpeculation(Array::OutOfBounds));
287 }
288 return typedArrayResult(withSpeculation(Array::InBounds));
289 case Array::Unprofiled:
290 case Array::SelectUsingPredictions: {
291 base &= ~SpecOther;
292
293 if (isStringSpeculation(base))
294 return withType(Array::String);
295
296 if (isDirectArgumentsSpeculation(base) || isScopedArgumentsSpeculation(base)) {
297 // Handle out-of-bounds accesses as generic accesses.
298 Array::Type type = isDirectArgumentsSpeculation(base) ? Array::DirectArguments : Array::ScopedArguments;
299 if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds()) {
300 // FIXME: Support OOB access for ScopedArguments.
301 // https://bugs.webkit.org/show_bug.cgi?id=179596
302 if (type == Array::DirectArguments)
303 return ArrayMode(type, Array::NonArray, Array::OutOfBounds, Array::AsIs, action());
304 return ArrayMode(Array::Generic, action());
305 }
306 if (isX86() && is32Bit() && isScopedArgumentsSpeculation(base))
307 return ArrayMode(Array::Generic, action());
308 return withType(type);
309 }
310
311 ArrayMode result;
312 switch (node->op()) {
313 case PutByVal:
314 if (graph.hasExitSite(node->origin.semantic, OutOfBounds) || !isInBounds())
315 result = withSpeculation(Array::OutOfBounds);
316 else
317 result = withSpeculation(Array::InBounds);
318 break;
319
320 default:
321 result = withSpeculation(Array::InBounds);
322 break;
323 }
324
325 if (isInt8ArraySpeculation(base))
326 return typedArrayResult(result.withType(Array::Int8Array));
327
328 if (isInt16ArraySpeculation(base))
329 return typedArrayResult(result.withType(Array::Int16Array));
330
331 if (isInt32ArraySpeculation(base))
332 return typedArrayResult(result.withType(Array::Int32Array));
333
334 if (isUint8ArraySpeculation(base))
335 return typedArrayResult(result.withType(Array::Uint8Array));
336
337 if (isUint8ClampedArraySpeculation(base))
338 return typedArrayResult(result.withType(Array::Uint8ClampedArray));
339
340 if (isUint16ArraySpeculation(base))
341 return typedArrayResult(result.withType(Array::Uint16Array));
342
343 if (isUint32ArraySpeculation(base))
344 return typedArrayResult(result.withType(Array::Uint32Array));
345
346 if (isFloat32ArraySpeculation(base))
347 return typedArrayResult(result.withType(Array::Float32Array));
348
349 if (isFloat64ArraySpeculation(base))
350 return typedArrayResult(result.withType(Array::Float64Array));
351
352 if (type() == Array::Unprofiled)
353 return ArrayMode(Array::ForceExit, action());
354 return ArrayMode(Array::Generic, action());
355 }
356
357 default:
358 return *this;
359 }
360}
361
362Structure* ArrayMode::originalArrayStructure(Graph& graph, const CodeOrigin& codeOrigin) const
363{
364 JSGlobalObject* globalObject = graph.globalObjectFor(codeOrigin);
365
366 switch (arrayClass()) {
367 case Array::OriginalCopyOnWriteArray: {
368 if (conversion() == Array::AsIs) {
369 switch (type()) {
370 case Array::Int32:
371 return globalObject->originalArrayStructureForIndexingType(CopyOnWriteArrayWithInt32);
372 case Array::Double:
373 return globalObject->originalArrayStructureForIndexingType(CopyOnWriteArrayWithDouble);
374 case Array::Contiguous:
375 return globalObject->originalArrayStructureForIndexingType(CopyOnWriteArrayWithContiguous);
376 default:
377 CRASH();
378 return nullptr;
379 }
380 }
381 FALLTHROUGH;
382 }
383
384 case Array::OriginalArray: {
385 switch (type()) {
386 case Array::Int32:
387 return globalObject->originalArrayStructureForIndexingType(ArrayWithInt32);
388 case Array::Double:
389 return globalObject->originalArrayStructureForIndexingType(ArrayWithDouble);
390 case Array::Contiguous:
391 return globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous);
392 case Array::Undecided:
393 return globalObject->originalArrayStructureForIndexingType(ArrayWithUndecided);
394 case Array::ArrayStorage:
395 return globalObject->originalArrayStructureForIndexingType(ArrayWithArrayStorage);
396 default:
397 CRASH();
398 return nullptr;
399 }
400 }
401
402 case Array::OriginalNonArray: {
403 TypedArrayType type = typedArrayType();
404 if (type == NotTypedArray)
405 return nullptr;
406
407 return globalObject->typedArrayStructureConcurrently(type);
408 }
409
410 default:
411 return nullptr;
412 }
413}
414
415Structure* ArrayMode::originalArrayStructure(Graph& graph, Node* node) const
416{
417 return originalArrayStructure(graph, node->origin.semantic);
418}
419
420bool ArrayMode::alreadyChecked(Graph& graph, Node* node, const AbstractValue& value, IndexingType shape) const
421{
422 switch (arrayClass()) {
423 case Array::OriginalArray: {
424 if (value.m_structure.isTop())
425 return false;
426 for (unsigned i = value.m_structure.size(); i--;) {
427 RegisteredStructure structure = value.m_structure[i];
428 if ((structure->indexingType() & IndexingShapeMask) != shape)
429 return false;
430 if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
431 return false;
432 if (!(structure->indexingType() & IsArray))
433 return false;
434 if (!graph.globalObjectFor(node->origin.semantic)->isOriginalArrayStructure(structure.get()))
435 return false;
436 }
437 return true;
438 }
439
440 case Array::Array: {
441 if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape | IsArray)))
442 return true;
443 if (value.m_structure.isTop())
444 return false;
445 for (unsigned i = value.m_structure.size(); i--;) {
446 RegisteredStructure structure = value.m_structure[i];
447 if ((structure->indexingMode() & IndexingShapeMask) != shape)
448 return false;
449 if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
450 return false;
451 if (!(structure->indexingType() & IsArray))
452 return false;
453 }
454 return true;
455 }
456
457 default: {
458 if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(shape) | asArrayModesIgnoringTypedArrays(shape | IsArray)))
459 return true;
460 if (value.m_structure.isTop())
461 return false;
462 for (unsigned i = value.m_structure.size(); i--;) {
463 RegisteredStructure structure = value.m_structure[i];
464 if ((structure->indexingMode() & IndexingShapeMask) != shape)
465 return false;
466 if (isCopyOnWrite(structure->indexingMode()) && action() == Array::Write)
467 return false;
468 }
469 return true;
470 } }
471}
472
473bool ArrayMode::alreadyChecked(Graph& graph, Node* node, const AbstractValue& value) const
474{
475 switch (type()) {
476 case Array::Generic:
477 return true;
478
479 case Array::ForceExit:
480 return false;
481
482 case Array::String:
483 return speculationChecked(value.m_type, SpecString);
484
485 case Array::Int32:
486 return alreadyChecked(graph, node, value, Int32Shape);
487
488 case Array::Double:
489 return alreadyChecked(graph, node, value, DoubleShape);
490
491 case Array::Contiguous:
492 return alreadyChecked(graph, node, value, ContiguousShape);
493
494 case Array::ArrayStorage:
495 return alreadyChecked(graph, node, value, ArrayStorageShape);
496
497 case Array::Undecided:
498 return alreadyChecked(graph, node, value, UndecidedShape);
499
500 case Array::SlowPutArrayStorage:
501 switch (arrayClass()) {
502 case Array::OriginalArray: {
503 CRASH();
504 return false;
505 }
506
507 case Array::Array: {
508 if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage)))
509 return true;
510 if (value.m_structure.isTop())
511 return false;
512 for (unsigned i = value.m_structure.size(); i--;) {
513 RegisteredStructure structure = value.m_structure[i];
514 if (!hasAnyArrayStorage(structure->indexingType()))
515 return false;
516 if (!(structure->indexingType() & IsArray))
517 return false;
518 }
519 return true;
520 }
521
522 default: {
523 if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModesIgnoringTypedArrays(NonArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithArrayStorage) | asArrayModesIgnoringTypedArrays(NonArrayWithSlowPutArrayStorage) | asArrayModesIgnoringTypedArrays(ArrayWithSlowPutArrayStorage)))
524 return true;
525 if (value.m_structure.isTop())
526 return false;
527 for (unsigned i = value.m_structure.size(); i--;) {
528 RegisteredStructure structure = value.m_structure[i];
529 if (!hasAnyArrayStorage(structure->indexingType()))
530 return false;
531 }
532 return true;
533 } }
534
535 case Array::DirectArguments:
536 return speculationChecked(value.m_type, SpecDirectArguments);
537
538 case Array::ScopedArguments:
539 return speculationChecked(value.m_type, SpecScopedArguments);
540
541 case Array::Int8Array:
542 return speculationChecked(value.m_type, SpecInt8Array);
543
544 case Array::Int16Array:
545 return speculationChecked(value.m_type, SpecInt16Array);
546
547 case Array::Int32Array:
548 return speculationChecked(value.m_type, SpecInt32Array);
549
550 case Array::Uint8Array:
551 return speculationChecked(value.m_type, SpecUint8Array);
552
553 case Array::Uint8ClampedArray:
554 return speculationChecked(value.m_type, SpecUint8ClampedArray);
555
556 case Array::Uint16Array:
557 return speculationChecked(value.m_type, SpecUint16Array);
558
559 case Array::Uint32Array:
560 return speculationChecked(value.m_type, SpecUint32Array);
561
562 case Array::Float32Array:
563 return speculationChecked(value.m_type, SpecFloat32Array);
564
565 case Array::Float64Array:
566 return speculationChecked(value.m_type, SpecFloat64Array);
567
568 case Array::AnyTypedArray:
569 return speculationChecked(value.m_type, SpecTypedArrayView);
570
571 case Array::SelectUsingPredictions:
572 case Array::Unprofiled:
573 case Array::SelectUsingArguments:
574 break;
575 }
576
577 CRASH();
578 return false;
579}
580
581const char* arrayActionToString(Array::Action action)
582{
583 switch (action) {
584 case Array::Read:
585 return "Read";
586 case Array::Write:
587 return "Write";
588 default:
589 return "Unknown!";
590 }
591}
592
593const char* arrayTypeToString(Array::Type type)
594{
595 switch (type) {
596 case Array::SelectUsingPredictions:
597 return "SelectUsingPredictions";
598 case Array::SelectUsingArguments:
599 return "SelectUsingArguments";
600 case Array::Unprofiled:
601 return "Unprofiled";
602 case Array::Generic:
603 return "Generic";
604 case Array::ForceExit:
605 return "ForceExit";
606 case Array::String:
607 return "String";
608 case Array::Undecided:
609 return "Undecided";
610 case Array::Int32:
611 return "Int32";
612 case Array::Double:
613 return "Double";
614 case Array::Contiguous:
615 return "Contiguous";
616 case Array::ArrayStorage:
617 return "ArrayStorage";
618 case Array::SlowPutArrayStorage:
619 return "SlowPutArrayStorage";
620 case Array::DirectArguments:
621 return "DirectArguments";
622 case Array::ScopedArguments:
623 return "ScopedArguments";
624 case Array::Int8Array:
625 return "Int8Array";
626 case Array::Int16Array:
627 return "Int16Array";
628 case Array::Int32Array:
629 return "Int32Array";
630 case Array::Uint8Array:
631 return "Uint8Array";
632 case Array::Uint8ClampedArray:
633 return "Uint8ClampedArray";
634 case Array::Uint16Array:
635 return "Uint16Array";
636 case Array::Uint32Array:
637 return "Uint32Array";
638 case Array::Float32Array:
639 return "Float32Array";
640 case Array::Float64Array:
641 return "Float64Array";
642 case Array::AnyTypedArray:
643 return "AnyTypedArray";
644 default:
645 // Better to return something then it is to crash. Remember, this method
646 // is being called from our main diagnostic tool, the IR dumper. It's like
647 // a stack trace. So if we get here then probably something has already
648 // gone wrong.
649 return "Unknown!";
650 }
651}
652
653const char* arrayClassToString(Array::Class arrayClass)
654{
655 switch (arrayClass) {
656 case Array::Array:
657 return "Array";
658 case Array::OriginalArray:
659 return "OriginalArray";
660 case Array::OriginalCopyOnWriteArray:
661 return "OriginalCopyOnWriteArray";
662 case Array::NonArray:
663 return "NonArray";
664 case Array::OriginalNonArray:
665 return "OriginalNonArray";
666 case Array::PossiblyArray:
667 return "PossiblyArray";
668 default:
669 return "Unknown!";
670 }
671}
672
673const char* arraySpeculationToString(Array::Speculation speculation)
674{
675 switch (speculation) {
676 case Array::SaneChain:
677 return "SaneChain";
678 case Array::InBounds:
679 return "InBounds";
680 case Array::ToHole:
681 return "ToHole";
682 case Array::OutOfBounds:
683 return "OutOfBounds";
684 default:
685 return "Unknown!";
686 }
687}
688
689const char* arrayConversionToString(Array::Conversion conversion)
690{
691 switch (conversion) {
692 case Array::AsIs:
693 return "AsIs";
694 case Array::Convert:
695 return "Convert";
696 default:
697 return "Unknown!";
698 }
699}
700
701IndexingType toIndexingShape(Array::Type type)
702{
703 switch (type) {
704 case Array::Int32:
705 return Int32Shape;
706 case Array::Double:
707 return DoubleShape;
708 case Array::Contiguous:
709 return ContiguousShape;
710 case Array::Undecided:
711 return UndecidedShape;
712 case Array::ArrayStorage:
713 return ArrayStorageShape;
714 case Array::SlowPutArrayStorage:
715 return SlowPutArrayStorageShape;
716 default:
717 return NoIndexingShape;
718 }
719}
720
721TypedArrayType toTypedArrayType(Array::Type type)
722{
723 switch (type) {
724 case Array::Int8Array:
725 return TypeInt8;
726 case Array::Int16Array:
727 return TypeInt16;
728 case Array::Int32Array:
729 return TypeInt32;
730 case Array::Uint8Array:
731 return TypeUint8;
732 case Array::Uint8ClampedArray:
733 return TypeUint8Clamped;
734 case Array::Uint16Array:
735 return TypeUint16;
736 case Array::Uint32Array:
737 return TypeUint32;
738 case Array::Float32Array:
739 return TypeFloat32;
740 case Array::Float64Array:
741 return TypeFloat64;
742 case Array::AnyTypedArray:
743 RELEASE_ASSERT_NOT_REACHED();
744 return NotTypedArray;
745 default:
746 return NotTypedArray;
747 }
748}
749
750Array::Type toArrayType(TypedArrayType type)
751{
752 switch (type) {
753 case TypeInt8:
754 return Array::Int8Array;
755 case TypeInt16:
756 return Array::Int16Array;
757 case TypeInt32:
758 return Array::Int32Array;
759 case TypeUint8:
760 return Array::Uint8Array;
761 case TypeUint8Clamped:
762 return Array::Uint8ClampedArray;
763 case TypeUint16:
764 return Array::Uint16Array;
765 case TypeUint32:
766 return Array::Uint32Array;
767 case TypeFloat32:
768 return Array::Float32Array;
769 case TypeFloat64:
770 return Array::Float64Array;
771 default:
772 return Array::Generic;
773 }
774}
775
776Array::Type refineTypedArrayType(Array::Type oldType, TypedArrayType newType)
777{
778 if (oldType == Array::Generic)
779 return oldType;
780 Array::Type newArrayType = toArrayType(newType);
781 if (newArrayType == Array::Generic)
782 return newArrayType;
783
784 if (oldType != newArrayType)
785 return Array::AnyTypedArray;
786 return oldType;
787}
788
789bool permitsBoundsCheckLowering(Array::Type type)
790{
791 switch (type) {
792 case Array::Int32:
793 case Array::Double:
794 case Array::Contiguous:
795 case Array::ArrayStorage:
796 case Array::SlowPutArrayStorage:
797 case Array::Int8Array:
798 case Array::Int16Array:
799 case Array::Int32Array:
800 case Array::Uint8Array:
801 case Array::Uint8ClampedArray:
802 case Array::Uint16Array:
803 case Array::Uint32Array:
804 case Array::Float32Array:
805 case Array::Float64Array:
806 case Array::AnyTypedArray:
807 return true;
808 default:
809 // These don't allow for bounds check lowering either because the bounds
810 // check isn't a speculation (like String, sort of) or because the type implies an impure access.
811 return false;
812 }
813}
814
815bool ArrayMode::permitsBoundsCheckLowering() const
816{
817 return DFG::permitsBoundsCheckLowering(type()) && isInBounds();
818}
819
820void ArrayMode::dump(PrintStream& out) const
821{
822 out.print(type(), "+", arrayClass(), "+", speculation(), "+", conversion(), "+", action());
823}
824
825} } // namespace JSC::DFG
826
827namespace WTF {
828
829void printInternal(PrintStream& out, JSC::DFG::Array::Action action)
830{
831 out.print(JSC::DFG::arrayActionToString(action));
832}
833
834void printInternal(PrintStream& out, JSC::DFG::Array::Type type)
835{
836 out.print(JSC::DFG::arrayTypeToString(type));
837}
838
839void printInternal(PrintStream& out, JSC::DFG::Array::Class arrayClass)
840{
841 out.print(JSC::DFG::arrayClassToString(arrayClass));
842}
843
844void printInternal(PrintStream& out, JSC::DFG::Array::Speculation speculation)
845{
846 out.print(JSC::DFG::arraySpeculationToString(speculation));
847}
848
849void printInternal(PrintStream& out, JSC::DFG::Array::Conversion conversion)
850{
851 out.print(JSC::DFG::arrayConversionToString(conversion));
852}
853
854} // namespace WTF
855
856#endif // ENABLE(DFG_JIT)
857
858