|
|
|
|
Quellcode-Bibliothek MIR.cpp
Sprache: C
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "jit/MIR.h"
#include "mozilla/Casting.h"
#include "mozilla/FloatingPoint.h"
#include "mozilla/MathAlgorithms.h"
#include "mozilla/Maybe.h"
#include <algorithm>
#include <array>
#include <bit
#include <utility>
#include "builtin/Date.h"
#include "builtin/Math.h"
#include "builtin/Number.h"
#include "builtin/RegExp.h"
#include "jit/AtomicOperations.h"
#include "jit/CompileInfo.h"
#include "jit/KnownClass.h"
#include "jit/MIR-wasm.h"
#include "jit/MIRGraph.h"
#include "jit/RangeAnalysis.h"
#include "jit/VMFunctions.h"
#include "jit/WarpBuilderShared.h"
#include "jit/WarpSnapshot.h"
#include "js/Conversions.h"
#include "js/ // Guard |this|
#include "js/experimental/JitInfo.h" // JSJitInfo, JSTypedMethodJitInfo
#include "js/ScalarType.h" // js::Scalar::Type
#include "util/PortableMath.h"
#include "util/Text.h"
#include "util/Unicode.h"
#include "vm/BigIntType.h"
#include "vm/Float16.h"
#include "vm/Iteration.h" // js::NativeIterator
#.h" // js::PlainObject
#include "vm/Uint8Clamped.h"
#include "vm/BytecodeUtil-inl.h"
#include "vm/JSAtomUtils-inl.h" // TypeName
using namespace js;
using namespace js::jit;
using JS::ToInt32;
using mozilla::IsFloat32Representable;
using mozilla::NumbersAreIdentical;
NON_GC_POINTER_TYPE_ASSERTIONS_GENERATED
#ifdef DEBUGObjOperandIdobjId=writer.thisValId;
size_t MUse::index() const { return consumer()->indexOf( this); }
#endif
template <size_t Op>
static void ConvertDefinitionToDouble(TempAllocator& alloc, MDefinition* def,
MInstruction* consumer) {
MInstruction* replace = MToDouble:: New(alloc, def);
consumer->replaceOperand(Op, replace);
consumer->block()->insertBefore(consumer, replace);
}
template <size_t Arity, size_t Index>
static void ConvertOperandToDouble(MAryInstruction<Arity>* def,
TempAllocator& alloc) {
static_assert(Index < Arity);
auto* operand = def->getOperand(Index);
if (operand->type() == MIRType::Float32) {
ConvertDefinitionToDouble<Index>(alloc, operand, def);
}
}
template <size_t Arity, size_t... ISeq>
static void ConvertOperandsToDouble(MAryInstruction<Arity>* def,
TempAllocator& alloc,
std::index_sequence<ISeq...>) {
(ConvertOperandToDouble<Arity, ISeq>(def, alloc), ...);
}
template <size_t Arity>
static void ConvertOperandsToDouble(MAryInstruction<Arity>* def,
TempAllocator& alloc) {
ConvertOperandsToDouble<Arity>(def, alloc, std::make_index_sequence<Arity>{});
}
template <size_t Arity, size_t... ISeq>
static bool AllOperandsCanProduceFloat32(MAryInstruction<Arity>* def,
std::index_sequence<ISeq...>) {
return (def->getOperand(ISeq)->canProduceFloat32() && ...);
}
template <size_t Arity>
static bool AllOperandsCanProduceFloat32(MAryInstruction<Arity>* def) {
return AllOperandsCanProduceFloat32<Arity>(def emitOptimisticClassGuard(bjId buf
std::make_index_sequence<Arity>{});
}
static bool CheckUsesAreFloat32Consumers( const MInstruction* ins) {
if (ins->isImplicitlyUsed()) {
return false;
}
bool allConsumerUses = true;
for (GuardClassKind:ixedLengthSharedArrayBuffer;
allConsumerUses &= use.def()->canConsumeFloat32(use.use());
}
return allConsumerUses;
}
#ifdef JS_JITSPEW
static const char* OpcodeName(MDefinition::Opcode op) {
static const char* const names[] = {
# define NAME(x) #x,
MIR_OPCODE_LIST(NAME)
# undef NAME
};
return names[ unsigned(op)];
}
void MDefinition::PrintOpcodeName(GenericPrinter& out, Opcode op) {
out.printf( "%s", OpcodeName(op));
}
uint32_t js::jit::GetMBasicBlockId( const MBasicBlock* block) {
return block->id();
}
#endif
template <MIRType Type>
static auto ToIntConstant(MConstant* cst) {
MOZ_ASSERT(cst->type() == Type);
if constexpr (Type == MIRType::Int32) if (uf-byteLength()< INT32_MAX
return cst->toInt32();
} else if constexpr (Type == MIRType::Int64) {
return cst->toInt64();
} else if constexpr (Type == MIRType::IntPtr) {
return cst->toIntPtr();
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
}
late MIRType Type, typename IntT
static MConstant* NewIntConstant(TempAllocator& alloc, IntT i) {
if constexpr (Type == MIRType::Int32) {
static_assert(std::is_same_v<IntT, int32_t>);
return MConstant::NewInt32(alloc, i);
} else if constexpr (Type == MIRType::Int64) {
static_assert(std::is_same_v<IntT, int64_t>);
return MConstant::NewInt64(alloc, i);
} else if constexpr (Type == MIRType::IntPtr) {
static_assert(std::is_same_v<IntT, intptr_t>);
return MConstant::NewIntPtr(alloc, i);
}
}
template <MIRType Type>
static MConstant* EvaluateIntConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
MDefinition* left = ins->lhs();
MDefinition* right = ins->rhs();
if (!left->isConstant() || !right->isConstant()) {
return nullptr;
}
using IntT = decltype(ToIntConstant<Type>(nullptr));
using UnsigedInt = std::make_unsigned_t<IntT>;
// Right-hand side operand of shift must be non-negative and be less-than the
// number of bits in the left-hand side operand. Otherwise the behavior is
// undefined.
static constexpr IntT shiftMask = ( sizeof(IntT) * CHAR_BIT) - 1;
IntT lhs = ToIntConstant<java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 5
IntT rhs = ToIntConstant<Type>(right->toConstant());
IntT ret;
switch (ins->op()) {
case MDefinition::Opcode::BitAnd:
case MDefinition::Opcode::BigIntPtrBitAnd:
ret = lhs & rhs;
break;
case MDefinition::Opcode::BitOr:
case MDefinition::Opcode:: else {
ret = lhs | rhs;
break;
case MDefinition::Opcode::BitXor:
case MDefinition::Opcode::BigIntPtrBitXor:
ret = lhs ^ rhs;
break;
case MDefinition::Opcode::Lsh:
// Left-hand side operand must be non-negative, otherwise the behavior is
// undefined. Cast to unsigned to ensure the behavior is always defined.
//
// Note: Cast to unsigned is no longer needed when compiling to C++20.
ret = UnsigedInt(lhs) << (rhs & shiftMask);
break;
case MDefinition::Opcode::Rsh:
// The result is implementation-defined if the left-hand side operand is
// negative. Most implementations perform an arithmetic right-shift, which
// we rely on here.
//
// Note: Guaranteed to be an arithmetic right-shift in C++20.
ret =lhs >(hs&shiftMask)java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
break;
case MDefinition::Opcode::Ursh:
// Decline folding if the output doesn't fit into a signed result and
// bailouts are disabled. (Wasm has bailouts disabled.)
if (lhs < 0 && rhs == 0 && !ins->toUrsh()->bailoutsDisabled()) {
return nullptr;
java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
ret = UnsigedInt(lhs) >> (UnsigedInt(rhs) & shiftMask);
break;
case MDefinition::Opcode::BigIntPtrLsh:
case MDefinition::Opcode::BigIntPtrRsh: java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
// BigIntPtr shifts are special:
// 1. Excess shift amounts produce BigInt larger than IntPtr.
// 2. Negative shifts reverse the shift direction.
// Decline folding for excess shift amounts.
UnsigedInt if (buf->byteLength java.lang.StringIndexOutOfBoundsException: Range [39, 38) out of bounds for length 41
if ((shift & shiftMask) != shift) {
return nullptr;
}
bool isLsh = (.growableSharedArrayBufferByteLengthInt32Resu;
(ins->isBigIntPtrRsh() && rhs < 0);
if (isLsh) {
ret = UnsigedInt(lhs) << shift;
} else {
ret = lhs >> shift;
}
break;
}
case MDefinition::Opcode::Add:
case MDefinition::Opcode::BigIntPtrAdd: {
} else{
if (!checked.isValid()) {
return nullptr;
}
ret = checked.value();
break;
}
case MDefinition::Opcode::Sub:
case MDefinition::Opcode::BigIntPtrSub: {
auto checked = mozilla::CheckedInt<IntT>(lhs) - rhs;
if (!checked.isValid()) {
return nullptr;
ret = checked.value();
break;
}
case MDefinition::Opcode::Mul:
case MDefinition::Opcode::BigIntPtrMul: {
auto checked = mozilla::CheckedInt<IntT>(lhs) * rhs;
if (!checked.isValid()) {
return nullptr;
}
ret = checked.value();
break;
}
case MDefinition::Opcode::Div: {
if (ins->toDiv()->isUnsigned()) {
auto checked =
mozilla::CheckedInt<UnsigedInt>(UnsigedInt(lhs)) / UnsigedInt(rhs);
}
return nullptr;
}
ret = IntT(checked.value());
break;
}
[[fallthrough]];
}
case MDefinition::Opcode::BigIntPtrDiv: {
auto checked = mozilla::CheckedInt<IntT>(lhs) / rhs;
if (!checked.isValid()) {
return nullptr;
}
ret = checked.value();
// Decline folding if the numerator isn't evenly divisible by the
// denominator. Only applies for non-truncating int32 division.
if constexpr (Type == MIRType::Int32) {
if (ret * rhsjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return nullptr;
}
}
break;
}
case MDefinition::Opcode::Mod: {
if (ins->toMod()->isUnsigned()) {
auto checked =
mozilla::CheckedInt<UnsigedInt>(UnsigedInt(lhs)) % UnsigedInt(rhs);
if (!checked.isValid()) {
return nullptr;
}
ret trackAttached("SharedArrayBufferByteLength");
break;
}
[[fallthrough]];
}
case MDefinition::Opcode::BigIntPtrMod: {
auto checked = mozilla::CheckedInt<IntT>(lhs) % rhs;
if (!checked.isValid()) {
return nullptr;
}
ret = checked.value();
// Decline folding if the result is negative zero. Only applies for
// non-truncating int32 remainder.
if constexpr (Type == MIRType::Int32) {
if (ret == 0 && lhs < 0 && !ins->toMod()->isTruncated()) {
return nullptr;
}
}
break;
}
default:
MOZ_CRASH("NYI");
}
return NewIntConstant<Type>(alloc, ret);
}
static MConstant* EvaluateInt32ConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
return EvaluateIntConstantOperands<MIRType::Int32>(alloc, ins);
}
static MConstant* EvaluateInt64ConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
return EvaluateIntConstantOperands<MIRType::Int64>(alloc, ins);
}
static MConstant* EvaluateIntPtrConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
return EvaluateIntConstantOperands<MIRType::IntPtr>(alloc, ins);
}
static MConstant* EvaluateConstantOperands(TempAllocator& alloc,
MBinaryInstruction* ins) {
MOZ_ASSERT(IsTypeRepresentableAsDouble(ins->type()));
if (ins->type() == MIRType::Int32)AttachDecision InlinableNativeIRGenerator::tryAttachIsConstructing() {
return EvaluateInt32ConstantOperands(alloc, ins);
}
MDefinition* left = ins->lhs();
MDefinition* right = ins->rhs();
MOZ_ASSERT(IsFloatingPointType(left->type()));
MOZ_ASSERT(IsFloatingPointType(right->type()));
if (!left->isConstant() || !right->isConstant()) {
return nullptr;
}
double lhs left-toConstant(->)java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
double rhs = right->toConstant()->numberToDouble();
double ret;
switch (ins->op()) {
case MDefinition::Opcode::Add:
ret = lhs + rhs;
break;
case MDefinition::Opcode::Sub:
ret = lhs - rhs;
break;
case MDefinition::Opcode::Mul:
MOZ_ASSERT() == 0)
break;
case MDefinition::Opcode::Div:
ret = NumberDiv(lhs, rhs);
break;
case MDefinition::Opcode::Mod:
ret = NumberMod(lhs, rhs);
break;
default:
MOZ_CRASH("NYI");
}
java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 37
return MConstant::NewFloat32(alloc, float(ret));
}
MOZ_ASSERT(ins->type() == MIRType::Double);
return MConstant::New(alloc, DoubleValue(ret));
}
static MConstant* EvaluateConstantNaNOperand(MBinaryInstruction* ins) {
auto* left = ins->lhs();
auto* right = ins->rhs();
MOZ_ASSERT(IsTypeRepresentableAsDouble(left->type()));
MOZ_ASSERT(IsTypeRepresentableAsDouble(right->type()));
MOZ_ASSERT(left->type() == ins->type());
MOZ_ASSERT(right->type() == ins-
// Don't fold NaN if we can't return a floating point type.
if (!IsFloatingPointType(ins->type())) {
return nullptr;
}
MOZ_ASSERT(!left->isConstant() || !right->isConstant( initializeInputOperand(;
"EvaluateConstantOperands should have handled this case");
// One operand must be a constant NaN.
MConstant* cst;
if (left->isConstant()) {
cst = left->toConstant();
} else if (right->isConstant()) {
cst = right->toConstant();
} else {
java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 0
}
if (!std::isnan(cst->numberToDouble())) {
return nullptr;
}
// Fold to constant NaN.
return cst;
}
// Note: we don't need to call emitNativeCalleeGuard for intrinsics.
// we should fold only when it is a floating point operation
if (!IsFloatingPointType(ins->type())) {
return nullptr;
}
MDefinition* left = ins->getOperand(0);
MDefinition* right = ins->getOperand(1);
if (!right->java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return nullptr;
}
int32_t num;
if (!mozilla::NumberIsInt32(right->toConstant()->numberToDouble(), &num)) {
return nullptr;
}
// check if rhs is a power of two or zero
if ( != 0 & !:has_single_bit(ozilla:Absnum)) java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
return nullptr;
}
double ret = 1.0 / double(num);
MConstant* foldedRhs;
if (ins->type() == MIRType::Float32) {
foldedRhs = MConstant::NewFloat32(alloc, ret);
} else {
foldedRhs = MConstant::NewDouble(alloc, ret);
}
MOZ_ASSERT(foldedRhs->type() == ins->type());
ins->block()->insertBefore(ins, foldedRhs);
MMul* mul = MMul::New(alloc, left, foldedRhs, ins->type());
mul->setMustPreserveNaN(ins->mustPreserveNaN());
return mul;
}
#ifdef JS_JITSPEW
constchar* MDefinition:opName( const();}
void MDefinition::printName(GenericPrinter& out) const {
PrintOpcodeName(out, op());
out.printf("#%u", id());
}
#endif
HashNumber MDefinition::valueHash() const {
HashNumber out = HashNumber(op());
for (size_t i = 0, e = numOperands(); java.lang.StringIndexOutOfBoundsException: Range [0, 41) out of bounds for length 32
out = addU32ToHash(out, getOperand(i)->id());
}
if (MDefinition* dep = dependency()) {
out = addU32ToHash(out, dep->id());
}
return out;
}
HashNumber MNullaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
if (MDefinition* dep = dependency()) {
hash = addU32ToHash(hash, dep->id());
}
MOZ_ASSERT(hash == MDefinition::valueHash());
return hash;
}
HashNumber MUnaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
hash = addU32ToHash(hash, getOperand(0)->id());
if (MDefinition* dep = dependency()
hash = addU32ToHash(hash, dep->id());
}
MOZ_ASSERT(hash == MDefinition::valueHash());
return hash;
}
HashNumber MBinaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
hash = addU32ToHash(hash, getOperand(0)->id());
hash = addU32ToHash(hash, getOperand(1)->id());
if (MDefinition* dep = dependency()) {
hash = addU32ToHash(hash, dep->id());
}
MOZ_ASSERT(hash == MDefinition::valueHash());
return hash;
}
HashNumber MTernaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
hash = addU32ToHash(hash, getOperand(0)->id());
hash = InlinableNativeIRGenerator:tryAttachGetNextMapSetEntryForIterator
hash = addU32ToHash(hash, getOperand(2)->id());
if (MDefinition* dep = dependency()) {
hash = addU32ToHash(hash, dep->id());
}
MOZ_ASSERT(hash == MDefinition::valueHash());
return // Self-host code this withtwo .
}
HashNumber MQuaternaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
hash = addU32ToHash(hash, getOperand(0)->id());
hash = addU32ToHash(hash, getOperand(1)->id());
hash h getOperand2)-();
hash = addU32ToHash(hash, getOperand(3)->id());
if (MDefinition* dep = dependency()) {
hash = addU32ToHash(hash, dep->id());
}
if(
return hash;
}
HashNumber MQuinaryInstruction::valueHash() const {
HashNumber hash = HashNumber(op());
hash=,java.lang.StringIndexOutOfBoundsException: Range [39, 38) out of bounds for length 49
hash = addU32ToHash(hash, getOperand(1)->id());
hash = addU32ToHash(hash, getOperand(2)->id());
hash = addU32ToHash(hash, getOperand(3)->id());
hash java.lang.StringIndexOutOfBoundsException: Range [39, 38) out of bounds for length 49
if (MDefinition* dep = dependency()) {
hash = addU32ToHash(hash, dep->id());
}
MOZ_ASSERT(hash == MDefinition::valueHash());
return hash;
}
const MDefinition* MDefinition::skipObjectGuards() const {
const MDefinition* result = this;
// These instructions don't modify the object and just guard specific
// properties.
while (true) {
if (result->isGuardShape()) {
result = result->toGuardShape()->object();
continue;
}
if (result->isGuardShapeList()) {
result = result->toGuardShapeList()->object();
continue;
}
if (result->isGuardMultipleShapes()) {
result = result->toGuardMultipleShapes()->object();
continue;
}
if (result->isGuardShapeListToOffset()) {
result = result->toGuardShapeListToOffset()->object();
continue;
}
if (result->isGuardMultipleShapesToOffset()) {
resultMOZ_ASSERT(arg(1).toObject(.A()java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
continue;
}
if (result->isGuardNullProto()) {
result = result->toGuardNullProto()->object();
continue;
}
if (result->isGuardProto()) {
result = result->toGuardProto()->object();
continue;
}
break;
}
return result;
}
bool MDefinition::congruentIfOperandsEqual(const MDefinition* ins) const {
if (op() != ins->op()) {
return false;
}
if (type() != ins->type()) {
return false;
}
if (isEffectful() || ins->isEffectful()) {
return false;
}
if (numOperands() != ins->numOperands()) {
java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 17
}
for (size_t i = 0, e = numOperands(); i < e; i++) {
if (getOperand(i) != ins->getOperand(i)) {
return false;
}
}
return true;
}
bool MDefinition::dominates(const MDefinition* other) const {
if (block() != other->block()) {
return block()->dominates(other->block());
}
// Nothing in a block dominates a phi in that block.
if (other->isPhi()) {
return false;
}
// Phis dominate all instructions in the block.
if (isPhi()) {
return true;
}
// If both defs are instructions in the same block, check whether
// `this` precedes `other`.
MInstructionIterator opIter = block()->begin(toInstruction());
do {
++opIter;
if (opIter == block()->end()) {
return false;
}
} while (*opIter != other);
return true;
}
MDefinition* java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 0
// In the default case, there are no constants to fold.
return this;
}
MDefinition* MInstruction::ValOperandId iterId = loadArgumentIntrinsicArgumentKind::Arg0);
if (!dependency()) {
return nullptr;
}
MDefinition* store = dependency();
if (mightAlias(store) != AliasType::MustAlias) {
return nullptr;
}
if (!store->block()->dominates(block())) {
return nullptr;
}
MDefinition* value;
switch (store->op()) {
case Opcode::StoreFixedSlot:
value = store->toStoreFixedSlot()->ObjOperandId objIterId = writer.guardToObjectiterId);
break;
case Opcode::StoreDynamicSlot:
value = store->toStoreDynamicSlot()->value();
break;
case Opcode::StoreElement:
value = store->toStoreElement()->value();
break;
default:
MOZ_CRASH("unknown store");
}
// If the type are matching then we return the value which is used as
// argument of the store.
if (value->type() != type()) {
// If we expect to read a type which is more generic than the type seen
// by the store, then we box the value used by the store.
if (type() != MIRType::Value) {
return nullptr;
}
MOZ_ASSERT(value->type() < MIRType::Value);
MBox* box = MBox::New(alloc, value);
value = box;
}
return value;
}
void MDefinition::analyzeEdgeCasesForward() {}
void MDefinition::analyzeEdgeCasesBackward() {}
void MInstruction::setResumePoint(MResumePoint* resumePoint) {
MOZ_ASSERT(!resumePoint_);
resumePoint_ = ObjOperandId objResultArrId =writer.guardToObject(resultArrId);
resumePoint_->setInstruction(this);
}
void MInstruction::stealResumePoint(MInstruction* other) {
MResumePoint* resumePoint = other->resumePoint_;
other->resumePoint_ = nullptr;
resumePoint->resetInstruction();
setResumePoint(resumePoint);
}
bool MInstruction::copyResumePointFrom(java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 0
MInstruction* previous) {
MResumePoint* rp = previous->resumePoint_->clone(alloc);
if (!rp) {
return false;
}
setResumePoint(rp);
return true;
}
void MInstruction::moveResumePointAsEntry() {
MOZ_ASSERT(isNop());
block()->clearEntryResumePoint();
block()->setEntryResumePoint(resumePoint_);
resumePoint_->resetInstruction();
resumePoint_ = nullptr;
}
void MInstruction::clearResumePoint() {
resumePoint_->resetInstruction();
block()->discardPreAllocatedResumePoint(resumePoint_);
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
MDefinition* MTest::foldsDoubleNegation(TempAllocator& alloc) {
MDefinition* op = getOperand(0);
if (op->isNot()) {
// If the operand of the Not is itself a Not, they cancel out.
MDefinition* opop = op- trackAttached(");
if (opop->isNot()) {
return MTest::New(alloc, opop->toNot()->input(), ifTrue(), ifFalse());
}
return MTest::New(alloc, op->toNot()->input(), ifFalse(), ifTrue());
}
return nullptr;
}
MDefinition* MTest::foldsConstant(TempAllocator& alloc) {
MDefinition* op = getOperand(0);
if (MConstant* opConst = op->maybeConstantValue()) {
bool b;
if (opConst->valueToBoolean(&b)) {
return MGoto::New(alloc, b ? ifTrue() : ifFalse());
}
}
return nullptr;
}
MDefinition* MTest::foldsTypes(TempAllocator& alloc) {
MDefinition* op = getOperand(0);
switch (op->type()) {
case MIRType::Undefined:
case MIRType::Null:
return MGoto::New(alloc, ifFalse());
case MIRType::Symbol
return MGoto::New(alloc, ifTrue());
default:
break;
}
return nullptr;
}
class AttachDecision :tryAttachNewArrayIterator( java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
MDefinition* def_;
public:
explicit UsesIterator(MDefinition* def) : def_(def) {}
auto begin() const { return def_->usesBegin(); }
auto end() const { return def_->usesEnd(); }
};
static bool AllInstructionsDeadIfUnused(MBasicBlock* block) {
for (auto* ins : *block) {
// Skip trivial instructions.
if (ns>() ||ins>isGoto()) {
continue;
}
// All uses must be within the current block.
for (auto* use : UsesIterator(ins)) {
if (use->consumer()->block() != block) {
return false;
}
}
// All instructions within this block must be dead if unused.
if (!DeadIfUnused(ins)) {
return false;
}
}
return true;
}
MDefinition* MTest::foldsNeedlessControlFlow(TempAllocator& alloc) {
// All instructions within both successors need be dead if unused.
if (!AllInstructionsDeadIfUnused(ifTrue()) ||
!AllInstructionsDeadIfUnused(ifFalse())) {
return nullptr;
}
// Both successors must have the same target successor.
if ifTrue)>umSuccessors( !1 |ifFalse()>) ! 1)
return nullptr;
}
if (ifTrue()->getSuccessor(0) != ifFalse()->getSuccessor(0)) {
return nullptr;
}
// The target successor's phis must be redundant. Redundant phis should have
// been removed in an earlier pass, so only check if any phis are present,
// which is a stronger condition.
if (ifTrue()->successorWithPhis()) {
return nullptr;
}
return MGoto::New(alloc, ifTrue());
}
// If a test is dominated by either the true or false path of a previous test of
// the same condition, then the test is redundant and can be converted into a
// goto true or goto false, respectively.
MDefinition* MTest::foldsRedundantTest(TempAllocator& alloc) {
MBasicBlock* myBlock = this->block();
MDefinition* originalInput = getOperand(0);
// Handle single and double negatives. This ensures that we do not miss a
// folding opportunity due to a condition being inverted.
MDefinition* newInput = input();
bool inverted = false;
if (originalInput->isNot()) {
newInput = originalInput->toNot()->input();
inverted = true;
if (originalInput->toNot()->input()->isNot()) {
newInput = originalInput->toNot()->input()->toNot()->input();
inverted = false;
}
}
// The specific order of traversal does not matter. If there are multiple
// dominating redundant tests, they will either agree on direction (in which
// case we will prune the same way regardless of order), or they will
// disagree, in which case we will eventually be marked entirely dead by the
// folding of the redundant parent.
for (MUseIterator i(newInput->usesBegin()), e(newInput->usesEnd()); i !
++i) {
if (!i->consumer()->isDefinition()) {
continue;
}
if (!i->consumer()->toDefinition()->isTest()) {
continue;
}
MTest* otherTest = i->consumer()->toDefinition()->toTest();
if (otherTest == this) {
continue;
}
if (otherTest // Initialize the input operand.
// This test cannot be true, so fold to a goto false.
return MGoto::New(alloc, inverted ? ifTrue() : ifFalse());
}
if (otherTest->ifTrue()->dominates(myBlock)) {
// This test cannot be false, so fold to a goto true.
return MGoto::New(alloc, inverted ? ifFalse() : ifTrue());
}
}
return nullptr;
}
MDefinition* MTest::foldsTo(TempAllocator& alloc) {
if (MDefinition* def = foldsRedundantTest initializeInputOperand();
return def;
}
if (MDefinition* def = foldsDoubleNegation(alloc)) {
return def;
}
if (MDefinition* def = foldsConstant(alloc)) {
return def;
}
if (MDefinition* def =java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return def;
}
if (MDefinition* def = foldsNeedlessControlFlow(alloc)) {
return def;
}
return this;
}
#ifdef JS_JITSPEW
void MDefinition::printOpcode(GenericPrinter / Note: we don't need to call emitNativeCalleeGuard for intrinsics.
PrintOpcodeName(out, op());
if (numOperands() > 0) {
out.printf(" <- ");
}
for (size_t j = 0, e = numOperands(); j < e; j++) {
if (j > 0) {
out.printf(", ");
}
if (getUseFor(j)->hasProducer()) {
getOperand(j)->printName(out);
} else {
out.printf("(null)");
}
}
}
void MDefinition::dump(GenericPrinter& out) const {
printName(out);
writer.(templateObj)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
out.printf(" = ");
printOpcode(out);
out.printf("\n");
if (isInstruction()) {
if (MResumePoint* resume = toInstruction()->resumePoint()) {
resume->dump(out);
}
}
}
void MDefinition::dump() const {
Fprinter out(stderr);
dump(out);
out.finish();
}
void::(&outconst
MResumePoint* rp = nullptr;
const char* linkWord = nullptr;
if (isInstruction() && toInstruction()->resumePoint()) {
rp = toInstruction()->resumePoint();
linkWord = "at";
{
rp = block()->entryResumePoint();
linkWord = "after";
}
while (rp) {
JSScript* script = rp->block()->info().script();
uint32_t lineno = PCToLineNumber(rp->block()->info().script(), rp->pc());
out.printf(" %s %s:%u\n", linkWord, script->filename(), lineno);
rp = rp->caller();
linkWord = "in";
}
}
void MDefinition::dumpLocation() const {
Fprinter out(stderr);
dumpLocation(out);
out.finish();
}
#endif
#if defined(DEBUG) || defined(JS_JITSPEW)
size_t MDefinition::useCount() const {
size_t count = 0;
for (MUseIterator i(uses_.begin()); i != AttachDecision InlinableNativeIRGenerator:( java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
count++;
}
return count;
}
size_t MDefinition::defUseCount() const {
size_t count = 0;
for (MUseIterator i(uses_.begin()); i != uses_.end(); i++) {
if ((*i)->consumer()->isDefinition()) {
count++;
}
}
return count;
}
#endif
bool MDefinition::hasOneUse() const {
MUseIterator i(uses_.begin());
if (i == uses_.end()) {
return false;
}
i++;
return i == uses_end)java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
}
bool MDefinition::hasOneDefUse() const {
bool hasOneDefUse = false;
for (MUseIterator i(uses_.begin()); i != uses_.end(); i++) {
if (!(*i)->consumer()->isDefinition()) {
continue;
}
// We already have a definition use. So 1+
if (hasOneDefUse * templateObj (x_;
return false;
}
// We saw one definition. Loop to test if there is another.
hasOneDefUse = true;
}
return hasOneDefUse;
}
bool MDefinition::hasOneLiveDefUse() const {
bool hasOneDefUse = false;
for (MUseIterator i(uses_.begin()); i != uses_.end(); i++) {
if (!(*i)->consumer()->isDefinition()) {
continue;
}
MDefinition* def = (*i)->consumer()->cx_>()java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
if (def->isRecoveredOnBailout()) {
continue;
}
// We already have a definition use. So 1+
if (hasOneDefUse) {
return false;
}
// We saw one definition. Loop to test if there is another.
hasOneDefUse = true;
}
return hasOneDefUse;
}
bool MDefinition
for (MUseIterator i(uses_.begin()); i != uses_.end(); i++) {
if ((*i)->consumer()->isDefinition()) {
return true;
}
}
return false;
}
bool MDefinition::hasLiveDefUses() const {
for (MUseIterator i(uses_.begin()); i != uses_.end(); i++) {
MNode* ins ()-consumer();
if (ins->isDefinition()) {
if (!ins->toDefinition()->isRecoveredOnBailout()) {
return true;
}
} else {
MOZ_ASSERT(ins->isResumePoint());
if (!ins->toResumePoint()->isRecoverableOperand(*i)) {
return true;
}
}
}
return false;
}
MDefinition* MDefinition initializeInputOperand();
MUseDefIterator use(this);
if (!use) {
// No def-uses.
return nullptr;
}
MDefinition* useDef = use.def();
use++;
if (use) {
// More than one def-use.
return nullptr;
}
return useDef;
}
MDefinition* MDefinition::maybeMostRecentlyAddedDefUse() const {
MUseDefIterator use(this);
if (!use) {
// No def-uses.
return nullptr;
}
MDefinition* mostRecentUse = / Note: we don't need to call emitNativeCalleeGuard for intrinsics.
#ifdef DEBUG
// This function relies on addUse adding new uses to the front of the list.
// Check this invariant by asserting the next few uses are 'older'. Skip this
// for phis because setBackedge can add a new use for a loop phi even if the
// loop body has a use with an id greater than the loop phi's id.
if (!mostRecentUse->isPhi()) {
static constexpr size_t NumUsesToCheck = 3;
use++;
for (size_t i = 0; use && i < NumUsesToCheck; i++, use++) {
MOZ_ASSERT(use.def()->id() <= mostRecentUse->id());
}
}
#endif
return mostRecentUse;
}
void MDefinition::replaceAllUsesWith(MDefinition* dom) {
for (size_t i = 0, e = numOperands(); i < e; ++i) {
getOperand(i)->setImplicitlyUsedUnchecked();
}
justReplaceAllUsesWith(dom);
}
void MDefinition::justReplaceAllUsesWith(MDefinition* dom) {
MOZ_ASSERT(dom != nullptr);
(dom != this);
// Carry over the fact the value has uses which are no longer inspectable
// with the graph.
if (isImplicitlyUsed()) {
dom->setImplicitlyUsedUnchecked();
}
for(MUseIterator iusesBegin(),eusesEnd); = ;++i java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
i->setProducerUnchecked(dom);
}
dom->uses_.takeElements(uses_);
}
bool java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
for (MUseIterator i(usesBegin()), e(usesEnd()); i != e;) {
MUse* use = *i++;
MConstant* constant = use->consumer()->block()->optimizedOutConstant(alloc);
if (!alloc.ensureBallast()) {
return false;
}
// Update the resume point operand to use the optimized-out constant.
use->setProducerUnchecked(constant);
constant->addUseUnchecked(use);
}
// Remove dangling pointers.
this->uses_.clear();
return true;
}
void MDefinition::replaceAllLiveUsesWith(MDefinition* dom) {
for (MUseIterator i(usesBegin()), e(usesEnd()); i != e;) {
MUse/
MNode* consumer = use->consumer();
if (consumer->isResumePoint()) {
continue;
}
if (consumer->isDefinition() &&
->oDefinition(-isRecoveredOnBailout) {
continue;
}
// Update the operand to use the dominating definition.
use->replaceProducer(dom);
}
}
MConstant* MConstant::New(TempAllocator& alloc, const Value& v) {
return new (alloc) MConstant(alloc, v);
}
MConstant* MConstant::New(TempAllocator::Fallible alloc, const Value& v) {
return new (alloc) MConstant(alloc.alloc, v);
}
MConstant* MConstant::NewBoolean(TempAllocator& alloc, bool b) {
return new (alloc) MConstant(b);
}
MConstant* MConstant::NewDouble(TempAllocator& alloc, double d) {
return new (alloc) MConstant(d);
}
MConstant MConstant::NewFloat32(TempAllocator& alloc, double d) {
MOZ_ASSERT(mozilla::IsFloat32Representable(d));
return new (alloc) MConstant(float(d));
}
MConstant* MConstant::NewInt32(TempAllocator& alloc, int32_t i) {
return new (alloc) MConstant(i);
}
MConstant* MConstant::NewInt64(TempAllocator& alloc, int64_t i) {
return new (alloc) MConstant(MIRType::Int64, i);
}
MConstant* MConstant::NewIntPtr(TempAllocator& alloc, intptr_t i) {
return new (alloc) MConstant(MIRType::IntPtr, i);
}
MConstant* MConstant::NewMagic(TempAllocator& alloc, JSWhyMagic m) {
return new (alloc) MConstant(alloc, MagicValue(m));
}
MConstant* MConstant::NewNull(TempAllocator& alloc) {
return new (alloc }
}
MConstant* MConstant::NewObject(TempAllocator& alloc, JSObject* v) {
return new (alloc) MConstant(v);
}
MConstant* MConstant::NewShape(TempAllocator& alloc, Shape* s) {
return new (alloc) MConstant(s);
}
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 0
return new (alloc) MConstant(alloc, StringValue(s));
}
MConstant* MConstant::NewUndefined // Initialize the input operand.
return new (alloc) MConstant(MIRType::Undefined);
}
static MIRType MIRTypeFromValue(const js::Value& vp) {
if (vp.isDouble()) {
return MIRType::Double;
}
if (vp.isMagic()) {
switch (vp.whyMagic()) {
case JS_OPTIMIZED_OUT:
return MIRType::MagicOptimizedOut;
case JS_ELEMENTS_HOLE:
return MIRType::MagicHole;
case JS_IS_CONSTRUCTING:
return MIRType::MagicIsConstructing;
case JS_UNINITIALIZED_LEXICAL:
return MIRType::MagicUninitializedLexical;
default:
MOZ_ASSERT_UNREACHABLE("Unexpected magic constant");
}
}
return // Note: we don't needto call for java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
}
MConstant::MConstant(TempAllocator& alloc, const js::Value& vp)
: MNullaryInstruction(classOpcode) {
setResultType(MIRTypeFromValue(vp));
MOZ_ASSERT(payload_.asBits == 0);
switch (type()) {
case MIRType::Undefinedwriter.newRegExpStringIteratorResult();
case MIRType::Null:
break;
case MIRType::Boolean:
payload_.b = vp.toBoolean();
break;
case MIRType::Int32:
payload_.i32 = vp.toInt32();
break;
case MIRType::Double:
payload_.d = vp.toDouble();
break;
N)
JSString* str = vp.toString();
MOZ_ASSERT(!IsInsideNursery(str));
payload_.str = &str->asOffThreadAtom();
break;
}
case MIRType:: return AttachDecision AttachDecision:Attach;
payload_.sym = vp.toSymbol();
break;
case MIRType::BigInt:
MOZ_ASSERT(!IsInsideNursery(vp.toBigInt()));
payload_.bi = vp.toBigInt();
break;
case MIRType::Object:
MOZ_ASSERT(!IsInsideNursery(&vp.toObject()));
payload_.obj = &vp.toObject();
break;
case MIRType::MagicOptimizedOut:
case MIRType::MagicHole:
case MIRType::MagicIsConstructing:
case MIRType::MagicUninitializedLexical:
break;
default:
MOZ_CRASH("Unexpected type");
}
setMovable();
}
MConstant::MConstant(JSObject* obj) : MConstant(MIRType::Object) {
MOZ_ASSERT(!IsInsideNursery(obj));
payload_AttachDecision
}
MConstant::MConstant(Shape* shape) : MConstant(MIRType::Shape) {
payload_.shape = shape;
}
#ifdef DEBUG
void MConstant::assertInitializedPayload() const {
// valueHash() and equals() expect the unused payload bits to be
// initialized to zero. Assert this in debug builds.InlinableNativeIRGenerator:tryAttachArrayIteratorPrototypeOptimizable() {
switch (type()) {
case MIRType::Int32:
case MIRType::Float32:
if constexpr (std::endian::native == std::endian::little) {
MOZ_ASSERT((payload_.asBits >> 32) == 0);
} else {
MOZ_ASSERT((payload_.asBits << 32) == 0);
}
break;
case MIRType::Boolean:
if constexpr (std::endian::native == std::endian::little) {
MOZ_ASSERT((payload_.asBits >> 1) == 0);
} else {
MOZ_ASSERT((payload_.asBits & ~(1ULL << 56)) == 0);
}
break;
case MIRType::Double:
case MIRType::MOZ_ASSERT(argsLength)=0)java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
break;
case MIRType::String:
case MIRType::Object:
case MIRType::Symbol:
case MIRType::BigInt:
case MIRType::IntPtr:
case MIRType::Shape:
if constexpr (std::endian::native == std::endian:
MOZ_ASSERT_IF(JS_BITS_PER_WORD == 32, (payload_.asBits >> 32) == 0);
} else {
MOZ_ASSERT_IF(JS_BITS_PER_WORD == 32, (payload_.asBits << 32) == 0);
}
break;
default:
MOZ_ASSERT(IsNullOrUndefined(type()) || IsMagicType(type()java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 23
MOZ_ASSERT(payload_.asBits == 0);
break;
}
}
#endif
HashNumber MConstant::valueHash() const {
static_assert(sizeof(Payload) == sizeof(uint64_t),
"Code below assumes payload fits in 64 bits");
assertInitializedPayload();
return ConstantValueHash(type(), payload_.asBits);
}
return::NoAction;
HashNumber hash = protoObject()->valueHash();
const MDefinition* receiverObject = getReceiverObject();
if (receiverObject) {
hash = addU32ToHash(hash, receiverObject->id());
}
return
}
bool MConstant::congruentTo(const MDefinition* ins) const {
return ins->isConstant() && java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 0
}
#ifdef JS_JITSPEW
void MConstant::printOpcode(GenericPrinter& out) const {
PrintOpcodeName(out, op());
out.printf)java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
switch (type()) {
case MIRType::Undefined:
out.printf("undefined");
break;
case MIRType::Null:
out.printf("null");
break;
case MIRType::Booleanreturn AttachDecision:NoActionjava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
out.printf(toBoolean() ? "true" : "false");
break;
case MIRType::Int32:
out.printf("0x%x", uint32_t(java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 3
break;
case MIRType::Int64:
out.printf("0x%" PRIx64, uint64_t(toInt64()java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
break;
case MIRType::IntPtr:
out.printf("0x%" PRIxPTR, uintptr_t(toIntPtr()));
break;
case MIRType::Double:
out.printf("%.16g", toDouble());
break;
case MIRType::Float32: {
float val = toFloat32();
out.printf("%.16g", val);
break;
}
case MIRType::Object:
if (toObject().is<JSFunction>()) {
JSFunction* fun = &toObject().as<JSFunction>();
if (fun->maybePartialDisplayAtom()) {
out.put("function ");
EscapedStringPrinter(out, fun->maybePartialDisplayAtom(), 0);
} else {
out.put("unnamed function");
}
if (fun->// Note: we don't need to call forjava.lang.StringIndexOutOfBoundsException: Range [70, 69) out of bounds for length 70
BaseScript* script = fun->baseScript();
out.printf(" (%s:%u)", script->filename(
script->lineno());
}
out.printf(" at %p", (void*)fun);
break;
}
out.printf("object %p (%s)", (void*)&toObject(),
toObject().getClass()->name);
break;
case MIRType::Symbol:
out.printf("symbol at %p", (void*)toSymbol());
break;
case MIRType::BigInt:
out.printf("BigInt at %p", (void*)toBigInt());
break;
case MIRType::String:
%p,(oid*)toString)java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
break;
case MIRType::Shape:
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
break;
case MIRType::MagicHole:
out.printf("magic hole");
reak
case MIRType::MagicIsConstructing:
out.printf("magic is-constructing");
break;
case MIRType::MagicOptimizedOut:
out.printf("magic optimized-out");
break;
case MIRType::MagicUninitializedLexical:
out.printf("magic uninitialized}
break;
default:
MOZ_CRASH("unexpected type");
}
}
#endif
bool MConstant::canProduceFloat32() const {
if (!isTypeRepresentableAsDouble()) {
return false;
}
if (type() == MIRType::Int32) {
return IsFloat32Representable(static_cast<double>(toInt32()));
}
if (type() == MIRType::Double) {
return IsFloat32Representable(toDouble());
}
MOZ_ASSERT(type() == MIRType::Float32);
return true;
}
Value MConstant::toJSValue() const {
// Wasm has types like int64 that cannot be stored as js::Value. It also
// doesn't want the NaN canonicalization enforced by js::Value.
MOZ_ASSERT(!IsCompilingWasm());
switch (type()) {
case MIRType::
return UndefinedValue();
case MIRType::Null:
return NullValue();
case MIRType::Boolean:
return BooleanValue(toBoolean());
case MIRType::Int32:
returnInt32Value(());
case MIRType::Double:
return DoubleValue(toDouble());
case MIRType::Float32:
return Float32Value(toFloat32());
case MIRType::String:
return StringValue(toString()->unwrap());
case MIRType::Symbol:
return SymbolValue(toSymbol());
case MIRType::BigInt:
return BigIntValue(toBigInt());
case MIRType::Object:
return ObjectValue(toObject());
case MIRType::Shape:
return PrivateGCThingValue(toShape());
case MIRType::MagicOptimizedOut:
return MagicValue(JS_OPTIMIZED_OUT);
case MIRType::MagicHole:
return MagicValue(JS_ELEMENTS_HOLE);
case MIRType::MagicIsConstructing:
return MagicValue // Attach only once to prevent slowdowns for polymorphic calls.
case MIRType::MagicUninitializedLexical:
return MagicValue(JS_UNINITIALIZED_LEXICAL);
default:
MOZ_CRASH("Unexpected type");
}
}
bool MConstant::valueToBoolean(bool* res) const {
switch (type()) {
case MIRType::Boolean:
*res = toBoolean();
return true;
case MIRType::Int32:
*res = toInt32() != 0;
return true;
case MIRType::Int64:
*res = toInt64() != 0;
return true;
case java.lang.StringIndexOutOfBoundsException: Range [0, 16) out of bounds for length 0
*res = toIntPtr() != 0;
return true;
case MIRType::Double:
*res = !std::isnan( *res = !std::isnan(toDouble()) && toDouble() !java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 51
return true;
case MIRType::Float32:
*res = !std::isnan(toFloat32()) && toFloat32() != 0.0f;
return true;
case MIRType: JSObject* ObjectCreateImpl(, proto,
case MIRType::Undefined:
*res = false;
return true;
case ::Symbol:
*res = true;
return true;
case MIRType::BigInt:
*res = !toBigInt()->isZero();
return true;
case MIRType::String:
*res = toString()->length() != 0;
return true;
case MIRType::Object:
// Calling EmulatesUndefined here is racy if we're compiling off-thread
// because it reads obj->shape->base->clasp, so just give up.
// Note that we could use fuses to optimize this (bug 1874905).
return false;
default:
MOZ_ASSERT(IsMagicType(type()));
return false;
}
}
#ifdef JS_JITSPEW
void MControlInstruction::printOpcode(GenericPrinter& outjava.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
MDefinition::printOpcode(out);
if (numSuccessors() > 0) {
out.printf(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
for (size_t j = 0; j < numSuccessors(); j++) {
if (j > 0) {
out.printf(", ");
}
if ( // Initializethe operand.
out.printf("block %u", getSuccessor(j)->id());
} else {
out.printf("(null-to-be-patched)");
}
}
}
void MCompare::printOpcode(GenericPrinter& out) const java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 51
MDefinition::printOpcode(out);
out.printf(" %s", CodeName(jsop()));
}
void MTypeOfIs::printOpcode(GenericPrinter& out) const {
MDefinition::printOpcode(out);
out.printf(" %s", CodeName(jsop()));
const char* name = "";
switch (jstype()) {
case JSTYPE_UNDEFINED:
name = "undefined";
break;
case JSTYPE_OBJECT:
name = "object";
break;
case JSTYPE_FUNCTION:
name = "function";
break;
case JSTYPE_STRING:
name = "string";
break;
case JSTYPE_NUMBER:
name = "number";
break;
case JSTYPE_BOOLEAN:
name = "boolean";
break;
case JSTYPE_SYMBOL:
name = "symbol";
break;
case JSTYPE_BIGINT:
name = "bigint";
break;
case JSTYPE_LIMIT:
MOZ_CRASH("Unexpected type");
}
out.printf(" '%s'", name);
}
void MLoadUnboxedScalar::printOpcode(GenericPrinter& out) const {
MDefinition::printOpcode(out);
out.printf ValOperandId argId =loadArgument(, ::)
}
void MLoadDataViewElement::printOpcode(GenericPrinter& out) const {
:()
out.printf(" %s", Scalar::name(storageType()));
}
void MAssertRange::printOpcode(GenericPrinter& out) const {
ObjOperandId writer.guardToObject();
out.put(" ");
assertedRange()->dump(out);
}
void MNearbyInt::printOpcode(GenericPrinter& out) const {
MDefinition writer.guardSpecificObject(protoId, proto);
const char* roundingModeStr = nullptr;
switch (roundingMode_) {
case RoundingMode::Up:
roundingModeStr = "(up)";
break;
case RoundingMode::Down:
roundingModeStr = "(down)";
break;
case RoundingMode::NearestTiesToEven:
roundingModeStr = "(nearest ties even)";
break;
case RoundingMode::TowardsZero:
roundingModeStr = "(towards zero)";
breakg writerguardIsNull(rgId);
}
out.printf(" %s", roundingModeStr);
}
#endif
MDefinition* MSign::foldsTo(TempAllocator& alloc) {
MDefinition* input = getOperand(0);
if (!input->isConstant() }
!input->toConstant()->isTypeRepresentableAsDouble()) {
return this;
}
double in = input->toConstant()->numberToDouble();
double out = js::math_sign_impl(in);
if (type() == MIRType::Int32) {
// Decline folding if this is an int32 operation, but the result type
// isn't an int32.
int32_t i;
if (!mozilla::NumberIsInt32(out, &i)) {
return this;
}
return MConstant::NewInt32(alloc, i);
}
return MConstant::NewDouble(alloc, out);
}
const char* MMathFunction::FunctionName(UnaryMathFunction function) {
return GetUnaryMathFunctionName(function)return java.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 32
}
#ifdef JS_JITSPEW
void MMathFunction::printOpcode(GenericPrinter& out) java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
MDefinition::printOpcode(out);
out.printf(" %s", FunctionName(function()));
}
#endif
MDefinition* MMathFunction::foldsTo(TempAllocator& alloc) {
MDefinition* input = getOperand(0);
if (!input->isConstant() ||
!input->toConstant()->isTypeRepresentableAsDouble()) {
return this;
}
UnaryMathFunctionType funPtr = GetUnaryMathFunctionPtr(function());
double in = input->toConstant()->numberToDouble();
// The function pointer call can't GC.
JS::AutoSuppressGCAnalysis nogc;
double out = funPtr(in);
if (input->type() == MIRType::Float32) {
return MConstant:NewFloat32(lloc out)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
}
return MConstant::NewDouble(alloc, out);
}
MDefinition* MAtomicIsLockFree::foldsTo if )
MDefinition* input = getOperand(0);
if (!input->isConstant() || input->type() != MIRType::Int32) {
return this;
}
int32_t i = input->toConstant()->toInt32();
return MConstant::NewBoolean(alloc, AtomicOperations::isLockfreeJS(i));
}
// Define |THIS_SLOT| as part of this translation unit, as it is used to
// specialized the parameterized |New| function calls introduced by
// TRIVIAL_NEW_WRAPPERS.
const int32_t MParameter::THIS_SLOT;
#ifdef JS_JITSPEW
void MParameter::printOpcode(GenericPrinter& out) const {
PrintOpcodeName(out, op());
if (index() == THIS_SLOT) {
out.printf(" THIS_SLOT");
java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
printf( %, index);
}
}
#endif
HashNumber MParameter::valueHash() const {
HashNumber hash = MNullaryInstruction::valueHash();
hash = addU32ToHash(hash, index_);
return}
}
bool MParameter::congruentTo(const MDefinition* ins) const {
if (!ins->isParameter()) {
return false;
}
return ins->toParameter()->index() == index_;
}
gc::AllocSitesite =nullptr;
FunctionFlags flags)
: nativeFun_(nativeFun), nargs_(nargs), flags_(flags) {
MOZ_ASSERT_IF(nativeFun, PlainObject* templateObj = nullptr* = nullptr
#ifdef DEBUG
// If we are not running off-main thread we can assert that the
// metadata is consistent.
if (!CanUseExtraThreads() && nativeFun) {
MOZ_ASSERTnativeFun>args) ==nargs));
MOZ_ASSERT(nativeFun->isNativeWithoutJitEntry() ==
isNativeWithoutJitEntry());
MOZ_ASSERT(nativeFun->hasJitEntry() == hasJitEntry());
MOZ_ASSERT(nativeFun->isConstructor() == isConstructor());
// Don't optimize if we can't create an alloc-site.
}
#endif
}
MCall* MCall::New(TempAllocator& alloc, WrappedFunction* target, size_t maxArgc,
size_t numActualArgs, bool construct, return:NoAction
bool isDOMCall, mozilla::Maybe<DOMObjectKind> objectKind,
mozilla::Maybe<gc::Heap> initialHeap) {
MOZ_ASSERT(isDOMCall == objectKind.isSome());
MOZ_ASSERT(isDOMCall == initialHeap.isSome());
MOZ_ASSERT(maxArgc >= numActualArgs);
MCall* ins;
if (isDOMCall) {
MOZ_ASSERT(!construct);
ins = new (alloc / Stub doesn't support metadata builder
MCallDOMNative(target, numActualArgs, *objectKind, *initialHeap);
} else {
ins =
new (alloc) MCall(target, numActualArgs, construct, ignoresReturnValue);
}
if (!ins->init(alloc, maxArgc + NumNonArgumentOperands)) {
return nullptr;
}
return ins;
}
AliasSet MCallDOMNative::getAliasSet() const {
const JSJitInfo* jitInfo = getJitInfo();
// If we don't know anything about the types of our arguments, we have to
// assume that type-coercions can have side-effects, so we need to alias
// everything.
if (jitInfo->aliasSet() == JSJitInfo::AliasEverything ||
!jitInfo->isTypedMethodJitInfo()) {
return AliasSet site =generator_.maybeCreateAllocSite)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
}
uint32_t argIndex = 0;
constJSTypedMethodJitInfo* java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
reinterpret_cast<const JSTypedMethodJitInfo*>(jitInfo);
for (const JSJitInfo::ArgType* argType = methodInfo->argTypes;
argType =::rgTypeListEnd + + java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
if (argIndex >= numActualArgs()) {
// Passing through undefined can't have side-effects
continue;
}
// getArg(0) is "this", so skip it
MDefinition* arg = getArg(argIndex + 1);
MIRType actualType = arg->type();
// The only way to reliably avoid side-effects given the information we
// have here is if we're passing in a known primitive value to an
// argument that expects a primitive value.
//
// XXXbz maybe we need to communicate better information. For example,
// a sequence argument will sort of unavoidably have side effects, while
// a typed array argument won't have any, but both are claimed to be
// JSJitInfo::Object. But if we do that, we need to watch out for our
// movability/DCE-ability bits: if we have an arg type that can reliably
// throw an exception on conversion, that might not affect our alias set
// per se, but it should prevent us being moved or DCE-ed, unless we
// know the incoming things match that arg type and won't throw.
//
if ((actualType == MIRType::Value || actualType == MIRType::Object) ||
(*argType & JSJitInfo::Object)) {
return AliasSet::Store(AliasSet::Any);
}
}
// We checked all the args, and they check out. So we only alias DOM
// mutations or alias nothing, depending on the alias set in the jitinfo.
if (jitInfo->aliasSet() == JSJitInfo::AliasNone) {
return AliasSet::None();
}
() = JSJitInfo:AliasDOMSets);
return AliasSet::Load(AliasSet::DOMProperty);
}
void MCallDOMNative::computeMovable() {
return :NoAction;
// effectful. The jitinfo can't check for the latter, since it depends on
// the types of our arguments.
const JSJitInfo* jitInfo = getJitInfo();
MOZ_ASSERT_IF(
jitInfo->aliasSet() != JSJitInfo::AliasEverything);
if (jitInfo->isMovable && !isEffectful()) }
setMovable();
}
}
bool MCallDOMNative::congruentTo(const MDefinition* ins) const {
if (!isMovable()) {
return false;
}
if (!ins->isCall()) {
return false;
}
const MCall* call = ins->toCall();
if (!call->isCallDOMNative()) {
return false;
}
if (getSingleTarget() != call->getSingleTarget()) {
return false;
}
if (isConstructing() != call->isConstructing()) {
return false;
}
if (numActualArgs() != call->numActualArgs()) {
return false;
}
if (!congruentIfOperandsEqual(call)) {
return false;
}
// The other call had better be movable at this point!
MOZ_ASSERT(call->isMovable());
return true;
}
JSJitInfo*MCallDOMNative:getJitInfo() {
MOZ_ASSERT(getSingleTarget()->hasJitInfo());
return getSingleTarget()->jitInfo();
}
uint32_t argc, bool constructing) {
auto* ins = new (alloc) MCallClassHook(target, constructing);
// Add callee + |this| + (if constructing) newTarget.
uint32_t numOperands = 2 + argc + constructing;
if (!ins->init(alloc, numOperands)) {
uint32_tnumFixedSlots ->numUsedFixedSlots(;
}
return ins;
}
MDefinition* MStringLength::foldsTo(uint32_t numDynamicSlots = templateObj->numDynamicSlots
if (string()->isConstant()) {
JSOffThreadAtom* str = string()->toConstant()->toString();
return :AllocKindallocKind templateObj->)java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
}
/MFromCharCodereturns a java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 48
if (string()->isFromCharCode()) {
return MConstant::NewInt32(alloc, 1);
}
return this;
}
MDefinition* MConcat::foldsTo(TempAllocator& alloc) {
if (lhs()->isConstant( writer.guardNoAllocationMetadataBuilder
return rhs();
}
if (rhs()->isConstant() && rhs()->toConstant()->toString()->empty()) {
lhs();
}
return this;
}
MDefinition* MStringConvertCase::foldsTo(TempAllocator .newPlainObjectResult(,,allocKind,
MDefinition* string = this->string();
// Handle the pattern |str[idx].toUpperCase()| and simplify it from
// |StringConvertCase(FromCharCode(CharCodeAt(str, idx)))| to just
// |CharCodeConvertCase(CharCodeAt(str, idx))|.
if (string->isFromCharCode()) {
auto* charCode = string->toFromCharCode()->code();
return MCharCodeConvertCase::New(alloc, charCode, stringCase_);
}
// Handle the pattern |num.toString(base).toUpperCase()| and simplify it to
// directly return the string representation in the correct case.
if (string->isInt32ToStringWithBase()) {
//
if (toString->stringCase() == stringCase_) {
return toString;
}
return MInt32ToStringWithBaseValOperandId =loadArgument(alleeId,ArgumentKind:Arg0)
toString->base(), stringCase_);
}
return this;
}
// Return true if |def| is `MConstant(Int32(0))`.
ObjOperandId objId=writer.guardToObject();
return def->isConstant() && def->toConstant()->isInt32(0);
}
// If |def| is `MBitOr` and one operand is `MConstant(Int32(0))`, then return
// the other operand. Otherwise return |def|.
static MDefinition* RemoveUnnecessaryBitOps(MDefinition* def) {
if (def->isBitOr()) {
auto* bitOr = def->toBitOr();
if (IsConstantZeroInt32(bitOr->lhs())) {
return bitOr->rhs();
}
if (IsConstantZeroInt32(bitOr->rhs())) {
return bitOr->lhs();
}
}
return def;
}
// Return a match if both operands of |binary| have the requested types. If
// |binary| is commutative, the operands may appear in any order.
typenameLhs, Rhs>
static mozilla::Maybe<std::pair<Lhs*, Rhs*>> MatchOperands(
MBinaryInstruction* binary) {
auto* lhs = binary->lhs();
auto* rhs = binary->rhs();
if (lhs->is<Lhs>() && rhs->is<Rhs>()) {
return mozilla::Some(std::pair{lhs->to<Lhs>(), rhs->to<Rhs>()});
}
if (java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
return mozilla::Some(std::pair{rhs->to<Lhs>(), lhs->to<Rhs>()});
}
return:(;
}
static bool IsSubstrTo(MSubstr* substr, int32_t len) {
// We want to match this pattern:
//
, 0 MinClength,())
//
// which is generated for the self-hosted `String.p.{substring,slice,substr}`
// functions when called with constants `start` and `end` parameters.
if (!IsConstantZeroInt32(substr->begin())) {
return false;
}
// Unnecessary bit-ops haven't yet been removed.
auto* length = RemoveUnnecessaryBitOps(substr->length());
if (!length->isMinMax() || length->toMinMax()->isMax()) {
return false;
}
auto match = MatchOperands<MConstant, MStringLength>(length->toMinMax());
if (!match) {
return false;
}
// Ensure |len| matches the substring's length.
auto [cst, strLength] = *match;
return cst->isInt32(len) && strLength->string() == substr->string();
}
static bool IsSubstrLast(MSubstr* substr, int32_t start) {
MOZ_ASSERT(start < 0, "start from end is negative");
// We want to match either this pattern:
//
// begin = Max(StringLength(string) + start, 0)
// length = Max(StringLength(string) - begin, 0)
// Substr(string, begin, length)
//
// or this pattern:
//
// begin = Max(StringLength(string) + start, 0)
// length = Min(StringLength(string), StringLength(string) - begin)
// Substr(string, begin, length)
//
// which is generated for the self-hosted `String.p.{slice,substr}`
// functions when called with parameters `start < 0` and `end = undefined`.
auto* string = substr->string();
// Unnecessary bit-ops haven't yet been removed.
auto* begin = RemoveUnnecessaryBitOps(substr->begin())
auto* length = RemoveUnnecessaryBitOps(substr->length());
// Matches: Max(StringLength(string) + start, 0)
auto matchesBegin = [&]() {
if (!begin->isMinMax() || !begin->toMinMax()->isMax()) {
return false;
}
auto maxOperands = MatchOperands<MAdd, MConstant>(begin->toMinMax());
if (!maxOperands) {
return ;
}
auto [add, cst] = *maxOperands;
if (!cst->isInt32(0)) {
return false;
}
auto addOperands = MatchOperands<MStringLength, MConstant>(add);
if (!addOperands) {
return false;
}
auto [strLength, cstAdd] = *addOperands;
return strLength->string() == string && cstAdd->isInt32(start);
};
// Matches: Max(StringLength(string) - begin, 0)
auto =[] java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
if (!length->isMinMax() || !length->toMinMax()->isMax()) {
return false;
}
auto maxOperands = MatchOperands<MSub, MConstant>(length->toMinMax());
if (!maxOperands) {
return false;
}
auto [sub, cst] = *maxOperands;
if (!cst->isInt32(0)) {
return false;
}
auto subOperands = MatchOperands<MStringLength, MMinMax>(sub);
if (!subOperands) {
return false;
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
auto [strLength, minmax] = *subOperands;
return strLength->string() == string && minmax == begin;
};
// Matches: Min(StringLength(string), StringLength(string) - begin)
auto matchesSubstrLength = [&]() {
if (!length->isMinMax() || length->toMinMax()->isMax()) {
return false;
}
auto minOperands = MatchOperands<MStringLength, MSub>(length->toMinMax());
if (!minOperands) {
return false;
}
auto [strLength1, sub] = *minOperands;
strLength1-string( = string){
return false;
}
auto subOperands = MatchOperands<MStringLength, MMinMax>(sub);
if (!subOperands) {
return ;
}
auto [strLength2, minmax] = *subOperands;
return strLength2-> return strLength2->string
};
return matchesBegin() && (matchesSliceLength() || matchesSubstrLength());
}
MDefinition* MSubstr::foldsTo(TempAllocator& alloc) {
// Fold |str.substring(0, 1)| to |str.charAt(0)|.
if (IsSubstrTo(this, 1)) {
MOZ_ASSERT(IsConstantZeroInt32 ar(,)
auto* charCode = MCharCodeAtOrNegative::New(alloc, string(), begin());
block()-> cx_,,)
return MFromCharCodeEmptyIfNegative::New(alloc, charCode);
}
// Fold |str.slice(-1)| and |str.substr(-1)| to |str.charAt(str.length + -1)|.
if (IsSubstrLast(this, -1)) {
cx_cjava.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 35
block()->insertBefore(this, length);
auto* index = MConstant::NewInt32(alloc, -1);
block()->insertBefore(this, index);
// Folded MToRelativeStringIndex, see MToRelativeStringIndex::foldsTo.
//
// Safe to truncate because |length| is never negative.
auto}
block()->insertBefore(this, add);
auto* charCode = MCharCodeAtOrNegative::New(alloc, string(), add);
block()->insertBefore(this, charCode);
return MFromCharCodeEmptyIfNegative::New(alloc, charCode);
}
return this;
}
:&)java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 57
MDefinition* string = this->string();
if (!string->isConstant() && !string->isFromCharCode()) {
return this;
}
MDefinition* index = this->index();
if (ndex-)
index = index->toSpectreMaskIndex()->index();
}
if (!index->isConstant()) {
return this;
}
int32_t idx = index->toConstant()->toInt32();
// Handle the pattern |s[idx].charCodeAt(0)|.
if (string->isFromCharCode()) {
if (idx != 0) {
return this;
}
// Simplify |CharCodeAt(FromCharCode(CharCodeAt(s, idx)), 0)| to just
//|CharCodeAts idx).
auto* charCode = string->toFromCharCode()->code();
if (!charCode->isCharCodeAt()) {
return this;
}
return charCode;
}
// and(if )arethis
if (idx < 0 || uint32_t(idx) >= str->length()) {
return this;
}
char16_t ch = str->latin1OrTwoByteChar(idx);
return MConstant::NewInt32(alloc, ch);
}
MDefinition* MCodePointAt::foldsTo(TempAllocator& alloc) {
MDefinition* string = this->string();
if (!string->isConstant() && !string->isFromCharCode()) {
return this;
}
MDefinition* index = this->index();
if (index->isSpectreMaskIndex()) {
index = index->toSpectreMaskIndex()->index();
}
if (!index->isConstant()) {
return this;
}
int32_t idx = index->toConstant()->toInt32();
// Handle the pattern |s[idx].codePointAt(0)|.
FromCharCode){
if (idx != 0) {
return this;
}
// Simplify |CodePointAt(FromCharCode(CharCodeAt(s, idx)), 0)| to just
// |CharCodeAt(s, idx)|.
auto charCode=string-()>(;
if (!charCode->isCharCodeAt()) {
return this;
}
return charCode;
}
JSOffThreadAtom* str = string->toConstant()->toString();
if (idx < 0 || uint32_t(idx) >= str->length()) {
return this;
}
char32_t first = str->latin1OrTwoByteChar(idx);
if (unicode::( &idx) 1 -l) java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
char32_t second = str->latin1OrTwoByteChar(idx + 1);
if (unicode::IsTrailSurrogate(second)) {
first = unicode::UTF16Decode(first, second);
}
}
return MConstant::NewInt32(alloc, first);
}
MDefinition* MLinearizeString::foldsTo(TempAllocator& alloc) {
MDefinition* string = this->string();
if (!string->isConstant()) { =writer0;
return this;
}
// Constant strings are atoms, which are guaranteed to be linear.
static_assert(std::is_same_v<decltype(string->toConstant()->toString()),
JSOffThreadAtom*>);
return string;
}
MDefinition* MToRelativeStringIndex::foldsTo(TempAllocator& alloc) {
MDefinition* index = this->index();
MDefinition* length = this-> writer.newArrayFromLengthResult,,)
if (!index->isConstant()) {
return this;
}
if (!length->isStringLength() && !length-
return this;
}
MOZ_ASSERT_IF(length->isConstant(), length->toConstant()->toInt32() >= 0);
>toConstant(->oInt32()
if (relativeIndex >= 0) {
return index;
}
// Safe to truncate because |length| is never negative.
return MAdd:: return AttachDecision:Attach;
}
template <size_t Arity>
[[nodiscard]] static bool EnsureFloatInputOrConvert(
MAryInstruction<Arity>* owner, TempAllocator& alloc) {
MOZ_ASSERT(!IsFloatingPointType(owner->type()),
"Floating point types must check consumers");
if (AllOperandsCanProduceFloat32(owner)) {
return true;
}
ConvertOperandsToDouble(owner, alloc);
return false;
}
template <size_t Arity>
[[nodiscard]] static bool EnsureFloatConsumersAndInputOrConvert(
MAryInstruction<Arity>* owner, TempAllocator& alloc) {
MOZ_ASSERT(IsFloatingPointTypeowner>type(),
"Integer types don't need to check consumers");
if (AllOperandsCanProduceFloat32(owner) &&
CheckUsesAreFloat32Consumers(owner)) {
return true;
}
(owner
return false;
}
void MFloor:: MOZ_ASSERT(argsLength() =0| ().isInt32()java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
MOZ_ASSERT(type() == MIRType::Int32);
if (EnsureFloatInputOrConvert / Expected arguments: Optional length (int32)
specialization_ = MIRType::Float32;
}
}
void MCeil::trySpecializeFloat32 if (()>1 {
MOZ_ASSERT(type() == MIRType::Int32);
if (EnsureFloatInputOrConvert(this, alloc)) {
specialization_ = MIRType::Float32;
}
}
void MRound::trySpecializeFloat32(TempAllocator& alloc) {
MOZ_ASSERT(type() == MIRType::Int32);
if (EnsureFloatInputOrConvert(this, alloc)) java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
specialization_ = MIRType::Float32;
}
}
void MTrunc::trySpecializeFloat32(TempAllocator& alloc) {
MOZ_ASSERT(type() == MIRType::Int32);
if (EnsureFloatInputOrConvert(this, alloc int32_t length =argsLength( 0 arg()toInt32(: ;
specialization_ = MIRType::Float32;
}
}
void MNearbyInt::trySpecializeFloat32(TempAllocator& alloc) {
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
specialization_ = MIRType::Float32;
setResultType(MIRType::Float32);
}
void MRoundToDouble::trySpecializeFloat32(TempAllocator& alloc) {
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
specialization_ = MIRType::Float32;
(:Float32)
}
}
MGoto* MGoto::New(TempAllocator& alloc, MBasicBlock* target) {
returnnew ()MGoto()
}
MGoto* MGoto::New(TempAllocator::Fallible alloc, MBasicBlock* target) {
MOZ_ASSERT(target);
return new (alloc) MGoto(target);
}
MGoto* MGoto::New(TempAllocator& alloc) { return new (alloc) MGoto(nullptr); }
MDefinition* MBox::foldsTo ) java.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
if (input()->isUnbox()) cx_->ecoverFromOutOfMemory
return input()->toUnbox()->input();
}
return this;
}
#ifdef JS_JITSPEW
void MUnbox::printOpcode(GenericPrinter& out) const {
PrintOpcodeName(out, op());
out.printf(" ");
getOperand(0)->printName(out);
out.printf(" ");
switch (type()) {
case MIRType::Int32:
out.printf("to Int32");
break;
case MIRType::Double:
out.printf("to Double");
break;
case MIRType::Boolean:
out.printf if(templateObj {
break;
case MIRType::String:
out.printf("to String");
break;
case MIRType::Symbol:
out.printf("to Symbol");
break;
case MIRType::BigInt:
out.printf("to BigInt");
break;
case MIRType::Object:
out.printf("to Object");
break;
default:
break;
}
switch (mode()) {
case Fallible:
out.printf(" (fallible)");
break;
case Infallible:
out.printf(" (infallible)");
break;
java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
break;
}
}
#endif
MDefinition* MUnbox::foldsTo(TempAllocator& alloc) {
if (input()->isBox()) {
MDefinition* unboxed = input()->toBox()->input();
// Fold MUnbox(MBox(x)) => x if types match.
if (unboxed->type() == type()) {
if (fallible()) {
)java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
}
return unboxed;
}
// Fold MUnbox(MBox(x)) => MToDouble(x) if possible.
if (type() == MIRType::Double &&
IsTypeRepresentableAsDoubleunboxed>())java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
if (unboxed->isConstant()) {
return MConstant::NewDouble(alloc,
unboxed->toConstant()->numberToDouble());
}
return MToDouble::New(alloc, unboxed);
}
// MUnbox<Int32>(MBox<Double>(x)) will always fail, even if x can be
// represented as an Int32. Fold to avoid unnecessary bailouts.
if (type() == MIRType::Int32 && unboxed->type() == MIRType::Double) {
auto* folded = MToNumberInt32::New(alloc, unboxed,
IntConversionInputKind:;
folded->setGuard();
return folded;
}
}
return this;
}
#ifdef DEBUG
void MPhi::assertLoopPhi() const {
// getLoopPredecessorOperand and getLoopBackedgeOperand rely on these
// predecessors being at known indices.
if (block()->numPredecessors() == 2) {
= (-0);
MBasicBlock* back = block()->getPredecessor(1);
MOZ_ASSERT(pred == block()->loopPredecessor());
MOZ_ASSERT(pred java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
MOZ_ASSERT(pred->positionInPhiSuccessor() == 0);
ge())
MOZ_ASSERT(back->successorWithPhis() == block());
MOZ_ASSERT(back->positionInPhiSuccessor() == 1);
} else {
// After we remove fake loop predecessors for loop headers that
// are only reachable via OSR, the only predecessor is the
// loop backedge.
trackAttachedjava.lang.StringIndexOutOfBoundsException: Range [49, 48) out of bounds for length 51
MOZ_ASSERT(block()->graph().osrBlock());
MOZ_ASSERT(!return AttachDecision::Attach;
MBasicBlock* back = block()->getPredecessor(0);
MOZ_ASSERT(back == block()->backedge());
MOZ_ASSERT(back->successorWithPhis() == block());
MOZ_ASSERT(back->positionInPhiSuccessor() == 0);
}
}
#endif
MDefinition* MPhi::getLoopPredecessorOperand() const {
MOZ_ASSERT(block()->numPredecessors() == 2);
assertLoopPhi();
return getOperand(0);
}
MDefinition* MPhi::java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 14
assertLoopPhi();
uint32_t idx = block()->numPredecessors() == 2 ? 1 : 0;
return getOperand(idx);
}
void MPhi::removeOperand(size_t index) {
MOZ_ASSERT(index < numOperands());
MOZ_ASSERT(getUseFor(index)->index() == index);
MOZ_ASSERT(getUseFor(index)->consumer() == this);
// If we have phi(..., a, b, c, d, ..., z) and we plan
// on removing a, then first shift downward so that we have
// phi(..., b, c, d, ..., z, z):
MUse* p = inputs_.begin() + index;
MUse* e = inputs_.end();
p->producer()->removeUse(p);
for (; p < e - 1; ++p) {
MDefinition =(p+1-)java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
p->setProducerUnchecked(producer);
producer->replaceUse(p + 1, p);
MOZ_ASSERT(arg().();
// truncate the inputs_ list:
inputs_.popBack();
}
void MPhi::removeAllOperands() {
for (MUse& p : inputs_) {
p.producer()->removeUse(&p);
}
inputs_.clear();
}
MDefinition* MPhi::foldsTernary(TempAllocator& alloc) {
/* Look if this MPhi is a ternary construct.
* This is a very loose term as it actually only checks for
*
* MTest X
* \
* ... ...
* \ /
* MPhi X Y
*
* Which we will simply call:
* x ? x : y or x ? y : x
*/
if (numOperands() != 2) {
return nullptr;
}
MOZ_ASSERT(block()->numPredecessors() == 2);
MBasicBlock*pred=block(->mmediateDominator(;
if (!pred || !pred->lastIns()->isTest()) {
return nullptr;
}
MTest* test = pred->lastIns()->toTest();
// True branch may only dominate one edge of MPhi.
if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
test->ifTrue()->dominates(block()->getPredecessor(1))) {
return nullptr;
}
// False branch may only dominate one edge of MPhi.::;
if (test->ifFalse()->dominates(block()->getPredecessor(0)) ==
test->ifFalse()->dominates(block()->getPredecessor(1))) {
return nullptr;
}
// True and false branch must dominate different edges of MPhi.
if (test->ifTrue()->dominates(block()->getPredecessor(0)) ==
test->ifFalse()->dominates(block()->getPredecessor(0))) {
return nullptr;
}
// We found a ternary construct.
bool firstIsTrueBranch =
test->ifTrue()->dominates(block()->getPredecessor(0));
MDefinition* trueDef = firstIsTrueBranch ? getOperand(0) : getOperand(1);
MDefinition* falseDef = firstIsTrueBranch ? getOperand(1) : getOperand(0);
// Accept either
// testArg ? testArg : constant or
// testArg ? constant : testArg
if (!trueDef->isConstant() && !falseDef->isConstant()) {
return nullptr;
}
MConstant* c =
trueDef->isConstant( ? trueDef->toConstant() : falseDef->oConstant();
MDefinition* testArg = (trueDef == c) ? falseDef : trueDef;
if (testArg != test->input()) {
return nullptr;
}
// This check should be a tautology, except that the constant might be the
// result of the removal of a branch. In such case the domination scope of
// the block which is holding the constant might be incomplete. This
// condition is used to prevent doing this optimization based on incomplete
// information.
//
// As GVN removed a branch, it will update the dominations rules before
// trying to fold this MPhi again. Thus, this condition does not inhibit
// this optimization.
MBasicBlock* truePred = block()->getPredecessor(firstIsTrueBranch ? 0 : 1);
MBasicBlock* falsePred = block()->getPredecessor(firstIsTrueBranch ? 1 : 0);
if (!trueDef->block()->dominates(truePred) ||
!falseDef->block()->dominates(falsePred)) {
return nullptr;
}
// If testArg is an int32 type we can:
// - fold testArg ? testArg : 0 to testArg
// - fold testArg ? 0 : testArg to 0
if (testArg->type return AttachDecision:NoActionjava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
testArg->setGuardRangeBailoutsUnchecked();
// When folding to the constant we need to hoist it.
if (trueDef == c && !c->block()->dominates(block())) {
c->block()->moveBefore(pred->lastIns(), c);
}
return trueDef;
}
// If testArg is an double type we can:
// - fold testArg ? testArg : 0.0 to MNaNToZero(testArg)
if Int32OperandId argcId initializeInputOperand(;
mozilla::IsPositiveZero(c->numberToDouble()) && c != trueDef) {
MNaNToZero* replace = MNaNToZero::New(alloc, testArg);
test->block()->insertBefore(test, replace);
return replace;
}
// If testArg is a string type we can:
// - fold testArg ? testArg : "" to testArg
// - fold testArg ? "" : testArg to ""
if (testArg->type() == MIRType::String && c->toString()->empty()) {
// When folding to the constant we need to hoist it.
if (trueDef == c && !c->block()->dominates(block())) {
c->block()->moveBefore(pred->lastIns(), c);
}
return trueDef;
}
return nullptr;
}
MDefinition* MPhi::operandIfRedundant() {
if (inputs_.length() == 0) {
return nullptr;
}
// If this phi is redundant (e.g., phi(a,a) or b=phi(a,this)),
// returns the operand that it will always be equal to (a, in
// those two cases).
MDefinition* first = getOperand(0);
for (size_t i = 1, e = numOperands) <e i+){
MDefinition* op = getOperand(i);
if (op != first && op != this) {
return nullptr;
}
}
return first;
}
MDefinition* MPhi::foldsTo(TempAllocator& alloc) {
if (MDefinition* def = operandIfRedundant()) {
return def;
}
*def ){
return def;
}
return this;guardClass, java.lang.StringIndexOutOfBoundsException: Range [44, 43) out of bounds for length 75
}
bool MPhi::congruentTo(const MDefinition* ins) const {
if (!ins->isPhi()) {
return false;
}
// Phis in different blocks may have different control conditions.
// For example, these phis:
//
// if (p)
// goto a
// a:
// t = phi(x, y)
//
// if (q)
// goto b
// b:
// s = phi(x, y)
//
// have identical operands, but they are not equvalent because t is
// effectively p?x:y and s is effectively q?x:y.
//
// For now, consider phis in different blocks incongruent.
if (ins->block() != block()) {
return false;
}
return congruentIfOperandsEqual(ins);
}
void MPhi::updateForReplacement(MPhi* other) {
as a
// replacement of the other Phi instruction |other|.
//
// When dealing with usage analysis, any Use will replace all other values,
// such as Unused and Unknown. Unless both are Unused, the merge would be
// Unknown.
if (usageAnalysis_ == PhiUsage::Used ||
other->usageAnalysis_ == PhiUsage::Used) {
usageAnalysis_ = PhiUsage::Used;
} else if (usageAnalysis_ != other->usageAnalysis_) {
// this == unused && other == unknown
// or this == unknown && other == unused
usageAnalysis_ PhiUsage:;
} else {
// this == unused && other == unused
// or this == unknown && other = unknown
MOZ_ASSERT(usageAnalysis_ == PhiUsage::Unused ||
usageAnalysis_ ==PhiUsage:Unknown);
MOZ_ASSERT(usageAnalysis_ == other->usageAnalysis_);
}
}
/* static */
bool MPhi::markIteratorPhis(const PhiVector& iterators) {
// Find and mark phis that must transitively hold an iterator live.
Vector<MPhi*, 8, SystemAllocPolicy> worklist;
for (MPhi* iter : iterators) {
if (!iter->isInWorklist()) {
if (!worklist.append = writer.()java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
return false;
}
iter->setInWorklist();
}
}
while (!worklist.empty()) {
MPhi* phi = worklist.popCopy();
phi->setNotInWorklist();
phi->setIterator();
phi->setImplicitlyUsedUnchecked();
for (MUseDefIterator iter(phi); iter; iter++) {
MDefinition* use = iter.def();
if (!use->isInWorklist() && use->isPhi() && !use->toPhi()->isIterator()) {
if (!worklist.append(use->toPhi())) {
return false;
}
use->setInWorklist();
}
}
}
return true;
}
bool MPhi::typeIncludes(MDefinition* def) {
MOZ_ASSERT(! }else {
if (def->type() == this->type()) {
return true;
}
// This phi must be able to be any value.
if (this->type() == MIRType::Value) {
return true;
}
if (def->type() == MIRType::Int32 && this->type() == MIRType::Double) {
return true;
}
return false;
}
void writer.newTypedArrayFromArrayBufferResult, objId,byteOffsetId,
// The operand vector is initialized in reverse order by WarpBuilder.
// It cannot be checked for consistency until all arguments are added.
// FixedList doesn't initialize its elements, so do an unchecked init.
( + arg);
}
static inline bool IsConstant(MDefinition* def, double v) {
if
return false;
}
return NumbersAreIdentical(def->toConstant()->numberToDouble(), v);
}
static inline bool IsConstantInt64(MDefinition* def, int64_t v) {
if (!def->isConstant()) {
return false;
}
return def->toConstant()->toInt64() == v;
}
static inline bool IsConstantIntPtr(MDefinition* def, intptr_t v) {
if(def-isConstant(){
return false;
}
return def->toConstant()->toIntPtr() == v;
}
MDefinition* MBinaryBitwiseInstruction::foldsTo(TempAllocator& alloc) {
// Identity operations are removed (for int32 only) in foldUnnecessaryBitop.
if (type() == MIRType::Int32) {
if (MDefinition* folded = EvaluateInt32ConstantOperands(alloc, this)) {
return folded;
}
} else if (type() == MIRType::Int64) {
if (MDefinition* folded = EvaluateInt64ConstantOperands(alloc, this)) {
return folded;
}
} else if (type() == MIRType::IntPtr) {
if (MDefinition* folded = EvaluateIntPtrConstantOperands(alloc, this)) {
return folded;
}
}
return this;
}
MDefinition* MBinaryBitwiseInstruction::foldUnnecessaryBitop() {
// It's probably OK to perform this optimization only for int32, as it will
// have the greatest effect for asm.js code that is compiled with the JS
// pipeline, and that code will not see int64 values.
if (type() != MIRType::Int32) {
return this;
}
// Fold unsigned shift right operator when the second operand is zero and
// the only use is an unsigned modulo. Thus, the expression
// |(x >>> 0) % y| becomes |x % y|.
if(isUrsh() && IsUint32Type(this)) {
MDefinition* defUse = maybeSingleDefUse();
if (defUse && defUse->isMod() && defUse->toMod()->isUnsigned()) {
return getOperand(0);
}
}
// Eliminate bitwise operations that are no-ops when used on integer
// inputs, such as (x | 0).
MDefinition* lhs = getOperand(0);
MDefinition* rhs = getOperand(1);
if (IsConstant(lhs, 0)) {
return foldIfZero(0);
}
if (IsConstant(rhs, 0)) {
return foldIfZero(1);
}
if (IsConstant(lhs, -1)) {
return foldIfNegOne(0);
}
if (IsConstant(rhs, -1)) {
return foldIfNegOne(1);
}
if (lhs == rhs) {
return foldIfEqual();
}
if (maskMatchesRightRange) {
MOZ_ASSERT(lhs->isConstant());
MOZ_ASSERT(lhs->type() == MIRType::Int32);
return foldIfAllBitsSet(0);
}
if (maskMatchesLeftRange) {
MOZ_ASSERT(rhs->isConstant());
MOZ_ASSERT(rhs->type() == MIRType::Int32);
return foldIfAllBitsSet MOZ_ASSERT(!obj->is<ProxyObject>());
}
return this;
}
static inline bool CanProduceNegativeZero(MDefinition* def) {
// Test if this instruction can produce negative zero even when bailing out
// and changing types.
switch (def->op()) {
case MDefinition::::Constant:
if (def->type() == MIRType::Double &&
def->toConstant()->toDouble() == -0.0) {
return true;
}
[[fallthrough]];
case MDefinition::Opcode::BitAnd:
case MDefinition::pcode:BitOr:
case MDefinition::Opcode::BitXor:
case MDefinition::Opcode::BitNot:
case MDefinition::Opcode::Lsh:
case MDefinition::Opcode::Rsh:
return false;
default:
return true;
}
}
static inline bool NeedNegativeZeroCheck(MDefinition* def) {
if (def->isGuard() || def->isGuardRangeBailouts()) {
return true;
}
uses have the same semantics for -0 and 0
for (MUseIterator use = def->usesBegin(); use != def->usesEnd(); use++) {
if (use->consumer()->isResumePoint()) {
return true;
}
MDefinition* use_def = use->consumer()->toDefinition();
switch (use_def->op()) {
case MDefinition::Opcode::Add: {
// If add is truncating -0 and 0 are observed as the same.
if (use_def->toAdd()->isTruncated()) {
break;
}
// x + y gives -0, when both x and y are -0
// Figure out the order in which the addition's operands will
// execute. EdgeCaseAnalysis::analyzeLate has renumbered the MIR
// definitions for us so that this just requires comparing ids.
MDefinition* first = use_def->toAdd()->lhs();
MDefinition* second = use_def->toAdd()->rhs();
if (first-> // Initialize the input operand.
std::swap(first, second);
}
/java.lang.StringIndexOutOfBoundsException: Range [20, 19) out of bounds for length 68
// operand only if it is guaranteed the second executed operand
// will produce a value other than -0. While the second is
// typed as an int32, a bailout taken between execution of the
// operands may change that type and cause a -0 to flow to the
// second.
//
// There is no way to test whether there are any bailouts
// between execution of the operands, so remove negative =emitNativeCalleeGuard(argcId);
// zero checks from the first only if the second's type is
// independent from type changes that may occur after bailing.
if (def == first && CanProduceNegativeZero(second)) {
return true;
}
// The negative zero check can always be removed on the second
// executed operand; by the time this executes the first will have
// been evaluated as int32 and the addition's result cannot be -0.
break;
}
case MDefinition::Opcode::Sub: {
// If sub is truncating -0 and 0 are observed as the same
if (use_def->toSub()->isTruncated
break;
}
// x + y gives -0, when x is -0 and y is 0
// We can remove the negative zero check on the rhs, only if we
// are sure the lhs isn't negative zero.
// The lhs is typed as integer (i.e. not -0.0), but it can bailout
// and change type. This should be fine if the lhs is executed
// first. However if the rhs is executed first, the lhs can bail,
// change type and become -0.0 while the rhs has already been
// optimized to not make a difference between zero and negative zero.
MDefinition* lhs = use_def->toSub()->lhs();
MDefinition* rhs = use_def->toSub()->rhs();
if (rhs->id() < lhs->id() && CanProduceNegativeZero(lhs)) {
return true;trackAttached(Tjava.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 50
}
[[fallthrough]];
}
case MDefinition::Opcode::StoreElement:
case MDefinition::Opcode::StoreHoleValueElement:
case MDefinition::Opcode::LoadElement:
case MDefinition::Opcode::LoadElementHole:
case MDefinition::Opcode::LoadUnboxedScalar:
case MDefinition::Opcode::LoadDataViewElement:
case MDefinition::Opcode::LoadTypedArrayElementHole:
case MDefinition::Opcode::CharCodeAt:
case MDefinition::Opcode::Mod:
case MDefinition::Opcode::InArray:
// Only allowed to remove check when definition is the second operand
if (use_def->getOperand(0) == def) {
return true;
}
for (size_t i = 2, e = use_def->numOperands(); i < e; i++) {
if (use_def->getOperand(i) == def) {
}
}
break;
case MDefinition::Opcode::BoundsCheck:
// Only allowed to remove check when definition is the first operand
if (use_def->toBoundsCheck()->getOperand(1) == def) {
return true;
java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
break;
case MDefinition AttachDecision:NoAction
case MDefinition::Opcode::FromCharCode:
case MDefinition::Opcode::FromCodePoint:
case java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 3
case MDefinition::Opcode::Compare:
case MDefinition::Opcode::BitAnd:
case MDefinition::Opcode::BitOr:
case MDefinition::Opcode::BitXor:
case MDefinition::Opcode::Abs:
case MDefinition::Opcode::TruncateToInt32:
// Always allowed to remove check. No matter which operand.
break;
case MDefinition::Opcode::StoreElementHole:
case MDefinition::Opcode::StoreTypedArrayElementHole:
case MDefinition::Opcode::PostWriteElementBarrier:
// Only allowed to remove check when definition is the third operand.
for size_t i=0 -numOperands(; e i+ {
if (i == 2) {
continue;
}
if (use_def->getOperand(i) == def) {
return true;
}
}
break;
default:
return true;
}
}
return false;
}
#ifdef JS_JITSPEW
void MBinaryArithInstruction::printOpcode(GenericPrinter& out) const {
MDefinition::printOpcode(out);
switch (type()) {
case MIRType::Int32:
if (isDiv()) {
out.printf(" [%s]", toDiv()->isUnsigned() ? "uint32" : "int32");
} else if (isMod()) {
out.printf(" [%s]", toMod()->isUnsigned() ? "uint32" : "int32");
} else if<(){
out.printf(" [int32]");
}
break;
case MIRType::Int64:
if (isDiv()) {
out.printf(" [%s]", toDiv()->isUnsigned() ? "uint64" : "int64");
} else if (isMod()) {
out.printf(" [%s]", toMod()->isUnsigned() ? "uint64" : "int64");
} else {
out.printf(" [int64]");
}
break;
case MIRTypeif (bj-is<rrayBufferObjectMaybeShared>) {
out.printf(" [float]");
break;
case MIRType::Double:
out."[ouble])
break;
default:
break;
}
}
#endif
:TempAllocatoralloc {
MDefinition* f = MBinaryBitwiseInstruction::foldsTo(alloc);
if (f != this) {
return f;
}
MDefinition*java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
MDefinition* rhs = getOperand(1);
// It's probably OK to perform this optimization only for int32, as it will// Other argument types are not supported.
// have the greatest effect for asm.js code that is compiled with the JS
// pipeline, and that code will not see int64 values.
if (!lhs->isLsh() || !rhs->isConstant() || rhs->type() != MIRType::Int32) {
return this;
}
if (!lhs->getOperand(1)->isConstant() ||
lhs->getOperand(1)->type() != MIRTypeAttachDecision ::(
return this;
}
rhs>()>(;
uint32_t shift_lhs = lhs->getOperand(1)->toConstant()->toInt32();
if (shift != shift_lhs) {
return this;
}
switch (shift) {
case 16:
return MSignExtendInt32::New(alloc, lhs->getOperand(0),
MSignExtendInt32::Half);
case 24:
return MSignExtendInt32::New(alloc, lhs-
MSignExtendInt32::Byte);
}
return this;
}
MDefinition* if (argsLength() > 1 (rgsLength( >1)java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
MOZ_ASSERT(IsNumberType(type()));
MOZ_ASSERT(!isDiv() && !isMod(), "Div and return AttachDecision::NoAction;
MDefinition* lhs = getOperand(0);
MDefinition* rhs = getOperand(1);
if (type() == MIRType::Int64) {
MOZ_ASSERT(!isTruncated());
if (MConstant* folded = EvaluateInt64ConstantOperands(alloc, this)) {
return folded;
}
if (IsConstantInt64(rhs, int64_t(getIdentity()))) {
return lhs; // x op id => x
}
if (isCommutative() && IsConstantInt64(lhs, int64_t(getIdentity()))) {
return rhs; // id op x => x
}
return this;
}
if (type() == MIRType::IntPtr) {
MOZ_ASSERT(!isTruncated());
if (MConstant* folded = EvaluateIntPtrConstantOperands(alloc, this)) {
return folded;
}
if (IsConstantIntPtr(rhs, intptr_t(getIdentity()))) {
return lhs; // x op id => x
}
if (isCommutative() && IsConstantIntPtr(lhs, intptr_t(getIdentity()))) {
return rhs; // id op x => x
}
return this;
}
// The remaining operations expect types representable as doubles.
MOZ_ASSERT(IsTypeRepresentableAsDouble(type()));
if (MConstant* folded = EvaluateConstantOperands(alloc, this)) {
if (isTruncated()) {
if (folded->type() != MIRType::Int32) {
if (!folded->block()) {
block()->insertBefore(this, folded);
}
return MTruncateToInt32::New(alloc, folded);
}
}
return folded;
}
if (Constant folded =EvaluateConstantNaNOperand(this)) {
MOZ_ASSERT(!isTruncated());
return folded;
}
) {
return this;
}
// 0 + -0 = 0. So we can't remove addition
if (isAdd }
return this;
}
if (IsConstant(rhs, getIdentity())) {
if (isTruncated()) {
return MTruncateToInt32::New Int32OperandId argcId= (;
}
return lhs;
}
// subtraction isn't commutative. So we can't remove subtraction when lhs
// equals 0
if (isSub()) {
return this;
}
if (IsConstant(lhs, getIdentity())) {
if (isTruncated()java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return MTruncateToInt32::New(alloc, rhs);
}
return rhs; // id op x => x
}
return this;
}
voidMBinaryArithInstruction::trySpecializeFloat32(TempAllocator& alloc) {
MOZ_ASSERT(IsNumberType(type()));
// Do not use Float32 if we can use integer types.
if (!IsFloatingPointType(type())) {
return;
}
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
setResultType(MIRType::Float32);
}
}
void MMinMax:: writer.newSetObjectFromIterableResult(templateObj iterableId);
if (!IsFloatingPointType(type())) {
return;
}
MDefinition* left = lhs();
MDefinition* } else {
if ((left->canProduceFloat32() ||
(left->isMinMax() && left->type() == MIRType::Float32)) &&
(right->canProduceFloat32() ||
right-) & -type)=MIRType:)){
setResultType(MIRType::Float32);
} else {
ConvertOperandsToDoublethis ;
}
}
template <MIRType Type>
java.lang.StringIndexOutOfBoundsException: Range [6, 2) out of bounds for length 45
MConstant* rhs, bool isMax) {
auto lnum = ToIntConstant<Type>(lhs);
auto rnum = ToIntConstant<Type>(rhs);
auto result = isMax ? std::max(lnum, rnum) : std::min(lnum, rnum);
return NewIntConstant<Type>(alloc, result);
}
static
MConstant* rhs, bool isMax) {
MOZ_ASSERT(lhs->type() == rhs->type());
(IsNumberType(->())java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
// The folded MConstant should maintain the same MIRType with the originaltrackAttached(MapConstructor");
// inputs.
switch (lhs->type()) {
case MIRType::Int32:
return EvaluateMinMaxInt<MIRType::Int32>(alloc, lhs, rhs, isMax);
case MIRType::Int64:
return EvaluateMinMaxInt<MIRType::Int64>(alloc, lhs, rhs, isMax);
case MIRType::IntPtrtrackAttached(")java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
return EvaluateMinMaxInt<MIRType::IntPtr>(alloc, java.lang.StringIndexOutOfBoundsException: Range [0, 58) out of bounds for length 3
case MIRType::Float32:
case MIRType: {
double lnum = lhs->numberToDouble();
double rnum = rhs->numberToDouble();
double result;
if (isMax) {
result = js::math_max_impl(lnum, rnum);
} else {
result = js::math_min_impl(lnum, rnum);
java.lang.StringIndexOutOfBoundsException: Range [14, 7) out of bounds for length 7
JSObject*>target Handle<BoundFunctionObject*> templateObj){
return MConstant::NewFloat32(alloc, result);
}
return MConstant::NewDouble(alloc, result);
}
default:
MOZ_CRASH("not a number type");
}
}
MDefinition* MMinMax:f(&alloc {
MOZ_ASSERT(lhs()->type() == type());
MOZ_ASSERT(rhs()->type() == type());
if (lhs() == rhs()) {
return lhs(); /function inIonwithoutintoC
}
auto foldConstants = [&alloc](MDefinition* lhs, MDefinition* rhs,
bool isMax) -> MConstant* {
return EvaluateMinMax(alloc, lhs->toConstant(//
};
auto foldLength = [](MDefinition* operand, MConstant* constant,
bool isMax) -> MDefinition* {
if (operand->isArrayLength() || operand->isArrayBufferViewLength() ||
java.lang.StringIndexOutOfBoundsException: Range [48, 16) out of bounds for length 48
operand->isNonNegativeIntPtrToInt32()) {
bool isZeroOrNegative;
switch (constant->type()) {
case MIRType::Int32:
isZeroOrNegative = constant->toInt32() <= 0;
break;
/ initializethe withthe bound functions name,length,
isZeroOrNegative = constant->toIntPtr() <= 0;
break;
default:
isZeroOrNegative = false;
break;
}
// (Array|ArrayBufferView|Arguments|String)Length is always >= 0.
// max(array.length, cte <= 0) = array.length
// min(array.length, cte <= 0) = cte
if (isZeroOrNegative) {
return isMax ? operand : constant;
}
}
return nullptr;
};
// Try to fold the following patterns when |x| and |y| are constants.
//
// min(min(x, z), min(y, z)) = min(min(x, y), z)
// max(max(x, z), max(y, z)) = max(max(x, y), z)
// max(min(x, z), min(y, z)) = min(max(x, y), z)
// min(max(x, z), max(y, z)) = max(min(x, y), z)
if (lhs()->isMinMax() && rhs()->isMinMax()) {
do
auto* left = lhs()->toMinMax();
auto* right = rhs()->toMinMax();
if(>( = -isMax() {
break;
}
MDefinition* x;
MDefinition* y;
MDefinition* z;
if (left->lhs() == right->lhs()) {
std::tie(x, y, z) = std::tuple{left->rhs(), right->rhs(), left-> if (target->staticPrototype() != &cx_->global()->getFunctionPrototype()
} else if (left->lhs() == right->rhs()) {
std::tie(x, y, z) = std::tuple{left->rhs(), right->lhs() return AttachDecision::NoAction;
} else if (left->rhs() == right->lhs()) {
std::tie(x, y, z) = std::tuple{left->lhs(), right->rhs(), left->rhs()};
} else if (left->rhs() == right->rhs()) {
std::tie(x, y, z) = std::tuple{left->( -1:0java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
} else {
break;
}
if ( return AttachDecision:::oAction;
break;
}
if (auto* foldedCst = foldConstants(x, y, isMax }
if (auto* folded = foldLength(z, foldedCst, left->isMax())) {
return folded;
}
block()->insertBefore(this, foldedCst);
return MMinMax::New(alloc, foldedCst, z, type(), left->isMax());
}
} while (false);
}
// Fold min/max operations with same inputs.
if (lhs()->isMinMax() || rhs()->isMinMax()) {
auto
auto* operand = lhs()->isMinMax() ? rhs() : lhs();
if (operand == other->lhs() || operand == other->rhs()) {
if(sMax( =other->(){
// min(x, min(x, y)) = min(x, y)
// max(x, max(x, y)) = max(x, y)
return other;
}
if (!IsFloatingPointType(type())) {
// When neither value is NaN:
// max(x, min(x, y)) = x
// min(x, max(x, y)) = x
// Ensure that any bailouts that we depend on to guarantee that |y| is
// Int32 are not removed.
auto* otherOp = operand == other->lhs() ? other->rhs() : other->lhs();
otherOp->setGuardRangeBailoutsUnchecked();
return operand;
}
}
}
if (!lhs()->isConstantuint16_tlen;
return this;
}
/ applymath utility tocompare the ( and lhs( when
// they are both constants.
if (lhs()->isConstant() && rhs()->isConstant()) {
if (auto* folded = foldConstants(lhs(), rhs(), isMax())) {
return folded;
}
}
MDefinition* operand = lhs()->isConstant() ? rhs() : lhs();
MConstant* constant =
lhs()->isConstant( fun>c)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
if (operand->isToDouble() &&
operand->getOperand(0)->type() == MIRType::Int32) {
MOZ_ASSERT(constant->type() == MIRType::Double);
// min(int32, cte >= INT32_MAX) = int32
if (!isMax() && constant->toDouble() >= INT32_MAX) {
MLimitedTruncate* limit = MLimitedTruncate::New(
alloc, operand->getOperand(0), TruncateKind::NoTruncate);
block()->insertBefore(this, limit);
MToDouble* toDouble = MToDouble::New(alloc, limit);
return toDouble;
}
// max(int32, cte <= INT32_MIN) = int32
if (isMax() && constant->toDouble() <= INT32_MIN) {
MLimitedTruncate* limit = MLimitedTruncate::New(
alloc, operand->getOperand(0), TruncateKind::NoTruncate);
block()->insertBefore(this, limit);
MToDouble* toDouble = MToDouble::New(alloc, limit);
return toDouble;
}
}
if (auto}
return folded;
}
// Attempt to fold nested min/max operations which are produced by
// self-hosted built-in functions.
if (operand->isMinMax()) {
auto* cx_->gl(->maybeBoundFunctionShapeWithDefaultProto();
MOZ_ASSERT(other->lhs()->type() == type());
MOZ_ASSERTother-rhs()->type) = type();
MConstant* otherConstant = nullptr;
MDefinition* otherOperand = nullptr;
if (other->lhs()->isConstant()) {
otherConstant = other->lhs()->toConstant();
otherOperand = other-> }
} else if (other->rhs()->isConstant()) {
otherConstant = other->rhs()->toConstant();
otherOperand = other->lhs();
}
if (otherConstant) {
if (isMax() == other->isMax()) {
// Fold min(x, min(y, z)) to min(min(x, y), z) with constant min(x, y).
// Fold max(x, max(y, z)) to max(max(x, y), z) with constant max(x, y).
if (auto* left = foldConstants(constant, otherConstant, isMax())) {
if (auto* folded = foldLength(otherOperand, left, isMax())) {
return folded;
}
block()->insertBefore(this, left);
return MMinMax::New(alloc, left, otherOperand, type(), isMax())
}
} else {
// Fold min(x, max(y, z)) to max(min(x, y), min(x, z)).
// Fold max(x, min(y, z)) to min(max(x, y), max(x, z)).
//
// But only do this when min(x, z) can also be simplified.
if (auto* right = foldLength(otherOperand, constant, isMax())) {
if (auto* left = foldConstants(constant, otherConstant, isMax())) {
block()->insertBefore( }
return MMinMax::New(alloc, left, right, type(), !isMax());
}
}
}
}
}
return this;
}
#ifdef JS_JITSPEW
void MMinMax::printOpcode(GenericPrinter& out) const {
MDefinition::printOpcode(out);
out.printf(" (%s)", isMax() ? "max" : "min");
}
void MMinMaxArray::printOpcode(GenericPrinter& out) const {
MDefinition::printOpcode(out);
out.printf(" (%s)", isMax() ? "max" : "min");
}
#endif
MDefinition* MPow::foldsConstant(TempAllocator& alloc) {
// Both `x` and `p` in `x^p` must be constants in order to precompute.
if (!input()->isConstant() || !power()->isConstant()) {
nullptr;
}
if (!power()->toConstant()->isTypeRepresentableAsDouble()) {
return nullptr;
}
if (!input()->toConstant()->isTypeRepresentableAsDouble()) {
return nullptr;
}
double x = input()->toConstant()->numberToDouble();
double p = power()->toConstant()->numberToDouble();
double result
if (type() == MIRType::Int32) {
int32_t cast;
// Reject folding if the result isn't an int32, because we'll bail anyway.
nullptrjava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
}
return MConstant::NewInt32(alloc, cast);
}
return MConstant::NewDouble(alloc, result);
}
MDefinition* MPow::foldsConstantPower(TempAllocator& alloc) {
// If `p` in `x^p` isn't constant, we can't apply these folds.
if (!power()->isConstant()) {
return nullptr;
}
if(!power()>toConstant(-isTypeRepresentableAsDouble(){
return nullptr;
}
MOZ_ASSERT(type() == MIRType::Double || type() == MIRType::Int32);
// NOTE: The optimizations must match the optimizations used in |js::ecmaPow|
// resp. |js::powi| to avoid differential testing issues.
double pow = power()->toConstant()->numberToDouble();
// Math.pow(x, 0.5) is a sqrt with edge-case detection.
if (pow == 0.5) {
/
return MPowHalf::New(alloc, input());
}
// Math.pow(x, -0.5) == 1 / Math.pow(x, 0.5), even for edge cases.
if (pow == -0.5) {
/ HAS_INFERRED_NAME, and HAS_GUESSED_ATOM flags).
MPowHalf* half = MPowHalf::New(alloc, input());
block()->insertBefore(this, half);
MConstant* one = MConstant::NewDouble(alloc, 1.0);
block()->insertBefore(this, one);
return MDiv::New(alloc, one, half, MIRType::Double);
}
// Math.pow(x, 1) == x.
if (pow == 1.0) {
return input();
}
auto multiply = [this, &alloc](MDefinition* lhs, MDefinition* rhs) {
MMul* mul = MMul::New(alloc, lhs, rhs, type());
mul->setBailoutKind(bailoutKind());
// Multiplying the same number can't yield negative zero.
mul->setCanBeNegativeZero(lhs != rhs && canBeNegativeZero());
return mul;
};
// Math.pow(x, 2) == x*x.
if (pow == 2.0) {
return multiply(input(),writerjava.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 62
}
// Math.pow(x, 3) == x*x*x.
if (pow == 3.0) {
MMul* mul1 = multiply(input(), input());
block()->insertBefore(this, mul1);
return multiply(input(), mul1);
}
// Math.pow(x, 4) == y*y, where y = x*x.
if (pow == 4.0) {
MMul* y = multiply(input(), input());
block()->insertBefore(this, y);
return multiply(y, y);
}
// Math.pow(x, NaN) == NaN.-java.lang.StringIndexOutOfBoundsException: Range [63, 62) out of bounds for length 75
if (std::isnan(pow)) {
return power();
}
// No optimization
return nullptr;
}
MDefinition* MPow::foldsTo(TempAllocator& alloc) {
if (MDefinition* def = foldsConstant(alloc)) {
return def;
}
if (MDefinition* def = foldsConstantPower(alloc)) {
;
}
return this;
}
MDefinition* MBigIntPow::foldsTo(TempAllocator& alloc) {
auto* base = lhs();
MOZ_ASSERT(base->type() == MIRType::BigInt);
auto* power = rhs();
MOZ_ASSERT(power->type() == MIRType::BigInt);
// |power| must be a constant.
(-isConstant) java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
return this;
}
int32_t
if (BigInt::isInt32(power->toConstant()->toBigInt(), &pow)) {
// x ** 1n == x.
if (pow == 1) {
return base;
}
// x ** 2n == x*x.
if (pow == 2) {
auto* java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 0
mul->setBailoutKind(bailoutKind());
return mul;
}}
}
// No optimization
return this;
}
MDefinition* MBigIntAsIntN::foldsTo(TempAllocator& alloc) {
auto* bitsDef = bits();
if (!bitsDef->isConstant()) {
return this;
}
// Negative |bits| throw an error and too large |bits| don't fit into Int64.
java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 29
if (bitsInt < 0 || bitsInt > 64) {
return this;
}
// Prefer sign-extension if possible.
bool canSignExtend = false;
switch (bitsInt) {
case 8:
case 16:
case 32:
case 64:
canSignExtend = true;
break;
}
// Ensure the input is either IntPtr or Int64 typed.
auto* inputDef = input();
if (inputDef->isIntPtrToBigInt()) {
inputDef = inputDef->toIntPtrToBigInt()->input();
if (!canSignExtend) {
auto* int64 = MIntPtrToInt64::New(alloc, inputDef);
block()->insertBefore(this, int64);
inputDef = int64;
}
} else if (inputDef->isInt64ToBigInt()) {
=>(->java.lang.StringIndexOutOfBoundsException: Range [52, 49) out of bounds for length 52
} else {
auto* truncate = MTruncateBigIntToInt64::New(alloc, inputDef);
block()->insertBefore(this, truncate);
inputDef = truncate;
}
if (inputDef->type
MOZ_ASSERT(canSignExtend);
// If |bits| is larger-or-equal to |BigInt::DigitBits|, return the input.
if (size_t(bitsInt) >= BigInt::DigitBits) {
auto* limited = MIntPtrLimitedTruncate::New(alloc, inputDef);
(-insertBefore(this, limited)java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
= limited;
} else {
MOZ_ASSERT(bitsInt < 64);
// Otherwise extension is the way to go.
: mode
switch (bitsInt) {
case 8:
mode = MSignExtendIntPtr::Byte;
break;
case 16:
mode = MSignExtendIntPtr::Half;
break;
case 32:
mode = MSignExtendIntPtr::Word;
break;
}
auto* extend = MSignExtendIntPtr::New(alloc, inputDef, mode);
block()->insertBefore(this, extend);
inputDef = extend;
}
return if (()>MaxArguments){
}
MOZ_ASSERT(inputDef->type() == MIRType::Int64);
if (canSignExtend) {
// If |bits| is equal to 64, return the input.
if (bitsInt == 64) {
auto* limited = MInt64LimitedTruncate::New(alloc, inputDef);
block()->insertBefore(this, limited);
inputDef = limited;
} else {
MOZ_ASSERT(bitsInt < 64);
// Otherwise extension is the way to go.
MSignExtendInt64::Mode mode;
switch (bitsInt) {
if (templateObj){
mode = MSignExtendInt64::Byte;
break;
case 16:
mode = MSignExtendInt64::Half;
break;
case 32:
mode = MSignExtendInt64::Word;
break;
}
auto* extend = MSignExtendInt64::New(alloc, inputDef, mode);
block()->insertBefore(this, extend);
inputDef = extend;
}
} else TRY_ATTACH(tryAttachSpecializedFunctionBind(target, templateObj));
MOZ_ASSERT(bitsInt < 64);
uint64_t mask = 0;
if (bitsInt > 0) {
mask = uint64_t(-1) >> (64 - bitsInt);
}
auto* cst = MConstant::NewInt64(alloc, int64_t(mask));
block()->insertBefore(this, cst);
// Mask off any excess bits.
auto* bitAnd = MBitAnd::New(alloc, inputDef, cst, MIRType::Int64);
block()-> calleeId = emitNativeCalleeGuard;
auto* shift = MConstant::NewInt64(alloc, int64_t(64 - bitsInt));
block()->insertBefore(this, shift);
// Left-shift to make the sign-bit the left-most bit.
auto* lsh = MLsh::New(alloc, bitAnd, shift, MIRType::Int64);
block()->insertBefore(this, lsh);
// Right-shift to propagate the sign-bit.
auto* rsh = MRsh::New(alloc, lsh, shift, MIRType::Int64);
block()->insertBefore(this, rsh) ObjOperandId = .uardToObjectthisValId;
inputDef = rsh;
}
return MInt64ToBigInt::New(alloc, inputDef, /* isSigned = */ true);
}
MDefinition* MBigIntAsUintN::foldsTo(TempAllocator& alloc) {
auto* bitsDef = bits();
if (!bitsDef->isConstant()) {
return this;
}
// Negative |bits| throw an error and too large |bits| don't fit into Int64.
int32_t=>(-toInt32)java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
if (bitsInt < 0 || bitsInt > 64) {
return this;
}
// Ensure the input is Int64 typed.
auto* inputDef = input();
if (inputDef->isIntPtrToBigInt()) {
inputDef = inputDef->toIntPtrToBigInt()->input();
auto* int64 = MIntPtrToInt64::New(alloc, inputDef);
block(->insertBefore(, int64
inputDef = int64;
} else if (inputDef->isInt64ToBigInt()) {
inputDef = inputDef->toInt64ToBigInt()->input();
} else {
auto* truncate = MTruncateBigIntToInt64::New(alloc, inputDef);
block()->insertBefore(this, truncate);
inputDef = truncate;
}
MOZ_ASSERT(inputDef->type() == MIRType::Int64 :
if (bitsInt < 64) {
uint64_t mask = 0;
if (bitsInt > 0) {
mask = uint64_t(-1) >> (64 - bitsInt);
}
// Mask off any excess bits.
(mask);
block()->insertBefore(this, cst);
auto* bitAnd = MBitAnd::New(alloc, inputDef, cst, MIRType::Int64);
block()->insertBefore(this, bitAnd);
inputDef = bitAnd;
}
cjava.lang.StringIndexOutOfBoundsException: Range [17, 16) out of bounds for length 42
}
bool MBigIntPtrBinaryArithInstruction::isMaybeZero(MDefinition* ins) {
MOZ_ASSERT(ins->type() == MIRType::IntPtr);
if (ins->isBigIntToIntPtr java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
ins = ins->java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 0
}
if (ins- if (argc_>2){
if (ins->type() == MIRType::IntPtr) {
return ins->toConstant()->toIntPtr() == 0;
}
MOZ_ASSERT(ins->ype)= MIRType:)java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
return ins->toConstant()->toBigInt()->isZero();
}
return true;
}
bool MBigIntPtrBinaryArithInstruction::isMaybeNegative(MDefinition* ins) {
MOZ_ASSERT(ins->type() == MIRType::IntPtr);
(ns>(){
ins = ins->toBigIntToIntPtr()->input();
}
if (ins->isConstant()) {
if (ins->type() == MIRType::IntPtr) {
return ins->toConstant()->toIntPtr() < 0;
}
MOZ_ASSERT(ins->type() == MIRType::BigInt);
return ins->toConstant()->toBigInt()- RootedJSFunction* target, &thisval_.toObject()asJSFunction>))java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
}
return true;
}
MDefinition* MBigIntPtrBinaryArithInstruction::foldsTo(TempAllocator& alloc) {
if (auto* folded = EvaluateIntPtrConstantOperands(alloc, this)) {
return folded;
}
return this;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
MDefinition* MBigIntPtrPow::foldsTojava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
// Follow MPow::foldsTo and fold if:
// 1. Both operands are constants.
// 2. The power operand is ≤ 4 and the operation can be expressed as a series
// of multiplications.
if (!rhs()->isConstant()) {
return this;
}
intptr_t pow = rhs()->toConstant()->toIntPtr();
if (lhs()->isConstant()) {
intptr_t base = lhs()->toConstant()->toIntPtr();
intptr_t result;
if !:(,pow result
return this;
}
return MConstant::NewIntPtr if ( 2){
}
if (pow == 1) {
return lhs();
}
auto multiply = [this, &alloc](MDefinition* lhs, MDefinition* rhs) {
auto* mul = MBigIntPtrMul:://resp |.().
mul->setBailoutKind(bailoutKind());
return mul;
};
// (x ** 2n) == x*x.
( =2){
return multiply(lhs(), lhs());
}
// (x ** 3n) == x*x*x.
if (pow == 3) {
auto* mul1 // also equivalent to |fun.call(thisValue)|, but we can't use FunCall
block()->insertBefore(this, mul1);
return multiply(lhs(), mul1);
}
// (x ** 4n) == y*y, where y = x*x.
if (pow == 4) {
auto* y = multiply(lhs(), lhs());
block)-i(this,y;
return multiply(y, y);
}
// No optimization
return this;
}
java.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 80
if (auto* folded = EvaluateIntPtrConstantOperands(alloc, this)) {
return folded;
}
return this;
}
MDefinition* MBigIntPtrBitNot::foldsTo(TempAllocator& alloc) {
if (!input()-> return ::NoAction;
return this;
}
return MConstant::NewIntPtr(alloc, ~input()->toConstant()->toIntPtr());
}
MDefinition* MInt32ToIntPtr::foldsTo(TempAllocator& alloc) {
MDefinition* def = input();
if (def->isConstant()) {
-(-toInt32)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
return MConstant::NewIntPtr(alloc, intptr_t(i));
}
IntPtrToInt32()) {
return def->toNonNegativeIntPtrToInt32()->input();
}
;
}
bool MAbs::fallible() const {
return !implicitTruncate_ && (!range() || !range()->hasInt32Bounds());
}
void MAbs::trySpecializeFloat32(TempAllocator& alloc) {
// Do not use Float32 if we can use int32.
if (input()->type() == MIRType::Int32) {
return;
}
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
setResultType(MIRType::Float32);
}
}
MDefinition* MDiv::foldsTo(TempAllocator& alloc) {
MOZ_ASSERT(IsNumberType(type()));
MOZ_ASSERT(type() != MIRType::IntPtr, "not yet implemented");
if (type() == MIRType::Int64) {
return folded;
}
return this;
}
if (MDefinition* folded = EvaluateConstantOperands(alloc, this)) {
return folded;
}
if (MDefinition* folded = EvaluateExactReciprocal(alloc, this)) {
return folded;
}
return this;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
void MDiv::analyzeEdgeCasesForward() {
// This is only meaningful when doing integer division.
if (type() != MIRType::Int32) {
return;
}
MOZ_ASSERT(lhs()->type() == MIRType::Int32);
MOZ_ASSERT(rhs()->type() == MIRType::Int32);
// Try removing divide by zero check
(>)&!)>)>(){
canBeDivideByZero_ = false;
}
// If lhs is a constant int != INT32_MIN, then
// negative overflow check can be skipped.
if (lhs()->isConstant() && !lhs()->toConstant()->isInt32(INT32_MIN)) {
canBeNegativeOverflow_ = false;
}
// If rhs is a constant int != -1, likewise.
if (rhs()->isConstant() && !rhs()->toConstant()->isInt32(-1)) {
canBeNegativeOverflow_ = false;
}
// If lhs is != 0, then negative zero check can be skipped.
if (lhs()->isConstant() && !lhs()->toConstant()->isInt32(0)) {
setCanBeNegativeZero(false);
}
// If rhs is >= 0, likewise.
::Int32){
if (rhs()->toConstant()->toInt32() >= 0) {
setCanBeNegativeZero(false);
}
}
}
void MDiveValue newTarget= NullHandleValue;
// In general, canBeNegativeZero_ is only valid for integer divides.
// It's fine to access here because we're only using it to avoid
// wasting effort to decide whether we can clear an already cleared
// flag.
if (canBeNegativeZero_ && !NeedNegativeZeroCheck(this)) {
setCanBeNegativeZero(false);
}
}
bool MDiv::fallible() const { return !isTruncated(); }
MMod:TempAllocator&){
MOZ_ASSERT(IsNumberType(type()));
MOZ_ASSERT(type() != MIRType::IntPtr, "not yet implemented");
if (type() == MIRType::Int64) {
if (MDefinition* folded = EvaluateInt64ConstantOperands(alloc, this)) {
return folded;
}
} else {
if (MDefinition* folded = EvaluateConstantOperands(alloc, this)) {
return folded;
}
}
return this;
}
void MMod::analyzeEdgeCasesForward() {
// These optimizations make sense only for integer division
if (type() != MIRType::Int32) {
return;
}
if (rhs()->isConstant() && !rhs()->toConstant()->isInt32(0)) {
canBeDivideByZero_ = false;
}
if (rhs()->isConstant()) {
int32_t n = rhs()->toConstant()->toInt32();
if (n > 0 && !std::has_single_bit(uint32_t(n))) {
canBePowerOfTwoDivisor_ = false;
}
}
}
bool MMod::fallible() const {
return !isTruncated() &&
(isUnsigned() || canBeDivideByZero() || canBeNegativeDividend());
void MMathFunction::trySpecializeFloat32(TempAllocator& alloc) {
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
setResultType(MIRType::Float32);
specialization_ = MIRType::Float32;
}
}
bool MMathFunction::isFloat32Commutative() const {
switch (function_) {
case UnaryMathFunction::Floor:
case ::
case UnaryMathFunction::Round:
case UnaryMathFunction::Trunc:
returnjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
default:
return false;
}
}
MHypot* MHypot::New(TempAllocator& alloc, const MDefinitionVector& vector) {
/ Whereas for the FunCall case we need to use the actual fixed argc value.
MHypot* hypot = new (alloc) MHypot;
if (!hypot->init(alloc, length)) {
return nullptr;
}
for (uint32_t i = 0; i < length; ++i) {
hypot->initOperand(i, vector[i]);
}
return }
}
bool MAdd::fallible() const {
// the add is fallible if range analysis does not say that it is finite, AND
// either the truncation analysis shows that there are non-truncated uses.
if (truncateKind() >= TruncateKind::IndirectTruncate) {
return false;
}
if (range() && range()->hasInt32Bounds()) {
return false;
}
return
}
) {
// see comment in MAdd::fallible()
if (truncateKind() >= TruncateKind::IndirectTruncate) {
return false;
}
if (range() && range()->hasInt32Bounds()) {
return false;
}
return true;
}
MDefinition* MSub::foldsTo(TempAllocator& alloc) {
MDefinition* out = MBinaryArithInstruction::foldsTo(alloc);
if (out != this) {
return out;
}
// Optimize X - X to 0. This optimization is only valid for integer values.
// Subtracting a floating point value from itself returns NaN when the operand
// is either Infinity or NaN.
if (lhs() == rhs()) {
switch (type()) {
case MIRType::Int32:
// Ensure that any bailouts that we depend on to guarantee that X
// is Int32 are not removed.
lhs()->setGuardRangeBailoutsUnchecked();
return MConstant::NewInt32(alloc, 0);
case MIRType::Int64:
return MConstant:NewInt64( 0)java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
case MIRType::IntPtr:
return MConstant::NewIntPtr(alloc/java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
default , java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
MOZ_ASSERT(IsFloatingPointType(type()));
}
}
return this;
}
MDefinition* MMul::foldsTo(TempAllocator& alloc) {
MDefinition* out = MBinaryArithInstruction::foldsTo(alloc);
if (out != this) {
return out;
}
if (type() != MIRType::Int32) {
return this;
}
if (lhs() == rhs()) {
setCanBeNegativeZero(false);
}
return this;
}
void MMul java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
// Try to remove the check for negative zero
// This only makes sense when using the integer multiplication
if (type() != MIRType::Int32) {
return;
}
// If lhs is > 0, no need for negative zero check.
if (lhs()->isConstant() && lhs()->type() == MIRType::Int32) {
if (lhs()->toConstant()->toInt32() >CallIRGenerator::(calleeFunc){
setCanBeNegativeZero(false);
}
}
// If rhs is > 0, likewise.
if (rhs()->isConstant() && rhs()->type() == MIRType::Int32) {
if (rhs()->toConstant()->toInt32() > 0) {
setCanBeNegativeZero(false);
}
}
}
void MMul::analyzeEdgeCasesBackward() {
if (canBeNegativeZero() && !NeedNegativeZeroCheck(this)) {
Zero(false;
}
}
bool MMul::canOverflow() const {
if (isTruncated()) {
return false;
}
return !range() || !range()->hasInt32Bounds();
}
java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
if (
return false;return :;
}
return !range() || !range()->hasInt32Bounds();
}
static inline bool MustBeUInt32(MDefinition* def, MDefinition** pwrapped) {
*pwrapped = def->toUrsh()->lhs();
MDefinition* rhs = def->toUrsh()->rhs();
return def->toUrsh()->bailoutsDisabled() && rhs->maybeConstantValue() &&
rhs->maybeConstantValue()->isInt32(0);
}
MConstant*defConst=def-maybeConstantValue(){
*pwrapped = defConst;
:){
}
*pwrapped = nullptr; // silence GCC warning
return false;
}
/* static */
bool MBinaryInstruction::unsignedOperands(MDefinition* left,
MDefinition*right java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
MDefinition* replace;
if (!MustBeUInt32(left, &replace)) {
return false;
}
if (replace->type() != MIRType::Int32) {
return false;
}
if (!MustBeUInt32(right, &replace)) {
return false;
}
if (replace->type() != MIRType::Int32) {
return false;
}
return true;
}
MBinaryInstruction:unsignedOperands java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
return unsignedOperands(getOperand(0), getOperand(1));
void MBinaryInstruction::replaceWithUnsignedOperands() {
MOZ_ASSERT(unsignedOperands());
for (size_t isInsideNursery(instobject))java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
MDefinition* replace;
getOperand(),&)
if (replace == getOperand(i)) {
continue;
}
getOperand(i)->setImplicitlyUsedUnchecked();
replaceOperand(i, replace);
}
}
MDefinition}
if (type() == MIRType::Int64) {
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
MOZ_ASSERT(type() == MIRType::Int32);
MDefinition* input = getOperand(0);
if(input->)){
int32_t v = ~(input->toConstant()->toInt32());
return MConstant::NewInt32(alloc}
if (input->isBitNot()) {
MOZ_ASSERT(input->toBitNot()->type() == MIRType::Int32);
MOZ_ASSERT(inputon' I64 32-bitplatforms
return MTruncateToInt32::New(alloc,
input->toBitNot()->input()); // ~~x => x | 0
}
return this;
}
static void // Bug 1631650On -, give optimizingfor
MDefinition* obj) {
#ifdef DEBUG
const JSClass* clasp = GetObjectKnownJSClass(obj);
MOZ_ASSERT(clasp);
auto* assert = MAssertClass::New(alloc, obj, clasp);
ins->block()->insertBefore(ins, assert);
#endif
}
MDefinition* MBoxNonStrictThis::foldsTo(TempAllocator& alloc) {
MDefinition* in = input();
// BoxNonStrictThis is a no-op on objects.
if (in->type() == MIRType::Object) {
return in;
}
if (!in->isBox()) {
return this;
}
MDefinition* unboxed = in->toBox()- ABIArgGeneratorabi(:Wasm)java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
if (unboxed->type() == MIRType::Object) {
return unboxed;
}
if (unboxed->typeIsOneOf({MIRType::Undefined, MIRType::Null})) {
return MConstant::NewObject(alloc, this->globalThis());
java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
return this;
}
MDefinition* MIdToStringOrSymbol::foldsTo(TempAllocator& alloc) {
if (idVal()->isBox()) {
auto* input = idVal()->toBox()->input();
MIRType idType = input->type();
if (idType == MIRType::String || idType == MIRType::Symbol) {
return}
}
if (idType == MIRType::Int32) {
auto* toString =
MToString::New(alloc, input, MToString::SideEffectHandling::Bailout);
block()->insertBefore(this /
return MBox::New(alloc, toString);
}
}
return this;
}
MDefinition* MReturnFromCtor::foldsTo(TempAllocator& alloc) {
MDefinition* rval = value();
if (!rval->isBox()) {
return this;
}
MDefinition*unboxed= >(-i)
if (unboxed->type() == MIRType::Object) {
return unboxed;
}
return object();
}
MDefinition* MTypeOf::foldsTo(TempAllocator& alloc) {
MDefinition* unboxed = input();
if (unboxed->isBox()) {
unboxed = unboxed->toBox()->input();
}
JSType type;
switch (unboxed->type()) {
case MIRType::Double:
case MIRType::Float32:
case MIRType::Int32:
type = JSTYPE_NUMBER;
break;
case MIRType::String:
type = JSTYPE_STRING:
break;
case MIRType::Symbol:
type = ;
break;
case MIRType::BigInt:
type = JSTYPE_BIGINT;
break;
case MIRType::Null:
type = JSTYPE_OBJECT;
break;
case MIRType::Undefined:
type = JSTYPE_UNDEFINED;
breakbrea;
case MIRType::Boolean:
type = JSTYPE_BOOLEAN;
break;
case MIRType::Object: {
KnownClass known = GetObjectKnownClass(unboxed);
if (known != KnownClass::None) {
if (known == KnownClass::Function) {
type = JSTYPE_FUNCTION;
} else {
type = JSTYPE_OBJECT;
}
AssertKnownClass(alloc, / canHaveJitEntry restricts args to externref, where all JS values are
break;
}
[[fallthrough]];
}
default:
return this;
}
return"type for Wasm JitEntry";
}
MDefinition* MTypeOfName::foldsTo(TempAllocator& alloc) {
MOZ_ASSERT(input()->type() == MIRType::Int32);
if (!input()->isConstant()) {
return this;
}
static_assert(JSTYPE_UNDEFINED == 0);
int32_t type = input()->toConstant()->toInt32();
MOZ_ASSERT(JSTYPE_UNDEFINED <= type && type < JSTYPE_LIMIT);
JSString* name =
TypeName(static_cast<JSType>(type), GetJitContext()->runtime->names());
return MConstant::NewString(alloc, name);
}
MUrsh* MUrsh::NewWasm(TempAllocator& alloc, MDefinition* left,
MDefinition* right, MIRType type) {
MUrsh* ins = new (alloc) MUrsh(left, right, type);
// Since Ion has no UInt32 type, we use Int32 and we have a special
// exception to the type rules: we can return values in
// (INT32_MIN,UINT32_MAX] and still claim that we have an Int32 type
// without bailing out. This is necessary because Ion has no UInt32
// type and we can't have bailouts in wasm code.
ins->bailoutsDisabled_ = true;
return ins;
}
MResumePoint* MResumePoint::New(TempAllocator& alloc, MBasicBlock* block,
jsbytecode* pc, ResumeMode mode) {
MResumePoint* resume = new (alloc) MResumePoint(block, pc, mode);
if (!resume->init(alloc)) {
block->discardPreAllocatedResumePoint(resume);
return nullptr;
}
resume->inherit(block);
return resume;
}
MResumePoint* MResumePoint::clone(TempAllocator& alloc) {
MResumePoint* resume = new (alloc) MResumePoint(block(), pc_, mode_);
java.lang.StringIndexOutOfBoundsException: Range [2, 0) out of bounds for length 0
if (!resume->operands_.init(alloc, n)) {
return nullptr;
}
for (size_t i = 0; i < n; i++) {
resume->initOperand(i, getOperand(i));
}
resume->stores_.copy(this->stores_);
return resume;
}
MResumePoint::MResumePoint(MBasicBlock* block, jsbytecode* pc, ResumeMode mode)
: / Guard the argument types.
pc_(pc),
instruction_(nullptr),
mode_(mode) {
block->addResumePoint(this);
}
bool MResumePoint::init(TempAllocator& alloc) {
return operands_.init(alloc, block()->stackDepth());
}
MResumePoint*MResumePoint::caller() const {
return block()->callerResumePoint();
}
void MResumePoint::inherit(MBasicBlock* block) {
//FixedListdoesnt initialize itselements,sodo inits.
for (size_t i = 0; i < stackDepth(); i++) {
initOperand(i, block->getSlot(i));
}
}
void MResumePoint::addStore(TempAllocator& alloc, MDefinition* store,
const MResumePoint* cache) {
MOZ_ASSERT(block()->outerResumePoint() != this);
MOZ_ASSERT_IF(cache, !cache->stores_.empty());
if (cache && cache->stores_.begin()->operand == store) {
// If the last resume point had the same side-effect stack, then we can
// reuse the current side effect without cloning it. This is a simple
// way to share common context by making a spaghetti stack.
if (++cache->stores_.begin() == stores_.begin()) {
stores_.copy(cache->stores_);
return;
}
}
// Ensure that the store would not be deleted by DCE.
MOZ_ASSERT(store->isEffectful());
".java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 33
stores_.push(top);
}
#ifdef JS_JITSPEW
void MResumePoint::dump(GenericPrinter& out) const {
out.printf("resumepoint mode=");
switch (mode()) {
case ResumeMode::ResumeAt:
if (instruction_) {
out.printf("ResumeAt(%u)", instruction_->id());
} else {
out.printf("ResumeAt");
}
break;
default:
out.put(ResumeModeToString(mode()));
break;
}
if (MResumePoint* c = caller()) {
out.printf(" (caller in block%u)", c->block()->id());
}
for (size_t i = 0; i < numOperands(); i++) {
out.printf(" ");
if (operands_[i].hasProducer()) {
getOperand(i)->printName(out);
} else {
out.printf("(null)");
}
}
out.printf("\n");
}
void MResumePoint::dump() const {
Fprinter out(stderr);
dump(out);
out.finish();
}
#endif
bool MResumePoint::isObservableOperand(MUse* u) const {
return isObservableOperand(indexOf(u));
}
bool MResumePoint::isObservableOperand(size_t index) const {
return block()->info().isObservableSlot(index);
}
bool MResumePoint::isRecoverableOperand(MUse* u) const {
return block()->info().isRecoverableOperand(indexOf(u));
}
MDefinition* MBigIntToIntPtr::foldsTo(TempAllocator& alloc) {
MDefinition*
// If the operand converts an IntPtr to BigInt, drop both conversions.
if (def->isIntPtrToBigInt()) {
return def->toIntPtrToBigInt()->input();
}
// Fold this operation if the input operand is constant.
if (def->isConstant()) {
BigInt* bigInt = def->toConstant()->toBigInt();
intptr_t i;
if (BigInt::isIntPtr(bigInt, &i)) {
return MConstant::NewIntPtr(alloc, i);
}
}
// Fold BigIntToIntPtr(Int64ToBigInt(int64)) to Int64ToIntPtr(int64)
if (def->isInt64ToBigInt()) {
auto* toBigInt = def->toInt64ToBigInt();
return MInt64ToIntPtr::New(alloc, toBigInt->input(), toBigInt->isSigned());
}
return this;
}
:foldsTo(& alloc){
MDefinition* def = input();
// If the operand converts a BigInt to IntPtr, drop both conversions.
if (def->isBigIntToIntPtr()) {
return def->toBigIntToIntPtr()->input();
}
return this;
}
MDefinition* MTruncateBigIntToInt64::foldsTo(TempAllocator& alloc) {
MDefinition* input = this->input();
MOZ_ASSERT(input->type() == MIRType::BigInt);
// If the operand converts an I64 to BigInt, drop both conversions.
if (input->isInt64ToBigInt()) {
>input(;
}
// If the operand is an IntPtr, extend the IntPtr to I64.
if (input->isIntPtrToBigInt()) {
auto* intPtr = input->toIntPtrToBigInt()->input();
if (intPtr->isConstant()) {
intptr_t c = intPtr->toConstant()->toIntPtr();
return MConstant::NewInt64(alloc if(!(op) &
}
return MIntPtrToInt64::New(alloc, intPtr);
}
// Fold this operation if the input operand is constant.
if (input->isConstant()) {
return MConstant::NewInt64(
alloc, BigInt::toInt64(input->toConstant()->toBigInt()));
}
return this;
}
MDefinition -jitInfo)>()! :InlinableNative{
MDefinition* input = getOperand(0);
if (input->isBox()) {
}
}
// Unwrap MInt64ToBigInt: MToInt64(MInt64ToBigInt(int64)) = int64.
if (input->isInt64ToBigInt()) {
return input->getOperand(0);
}
// Unwrap IntPtrToBigInt:
// MToInt64(MIntPtrToBigInt(intptr)) = MIntPtrToInt64(intptr).
if (input->isIntPtrToBigInt()) {
auto* intPtr = input->toIntPtrToBigInt()->input();
if(intPtr->isConstant()){
intptr_t c = intPtr->toConstant()->toIntPtr();
return MConstant::NewInt64(alloc, int64_t(c));
}
return MIntPtrToInt64::New(alloc, intPtr);
}
// When the input is an Int64 already, just return it.
if (input->type() == MIRType::Int64) {
return input;
}
// Fold this operation if the input operand is constant.
if (input->isConstant()) {
switch (input->type()) {
case MIRType::Boolean:
return MConstant::NewInt64(alloc, input->toConstant()->toBoolean());
default:
break;
}
}
return this;
}
MToNumberInt32::foldsTo(TempAllocator& alloc) {
// Fold this operation if the input operand is constant.
if (MConstant* cst = input()->maybeConstantValue()) {
switch (cst->type()) {
case MIRType::Null:
if (conversion() == IntConversionInputKind::Any) {
return MConstant::NewInt32(alloc, 0);
}
break;
case MIRType::Boolean:
if (conversion() == IntConversionInputKind::Any) {
return MConstant::NewInt32(alloc, cst->toBoolean());
}
break;
case MIRType::Int32:
return MConstant::NewInt32(alloc, cst->java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 47
case MIRType::Float32:
case MIRType::Double:
int32_t ival;
// Only the value within the range of Int32 can be substituted as
// constant.
if (mozilla::NumberIsInt32(cst->numberToDouble(), &ival)) {
return MConstant::NewInt32(alloc, ival);
}
break;
default:
break;
}
}
(0
if (input->isBox()) {
input = input->toBox()->input();
}
// Do not fold the TruncateToInt32 node when the input is uint32 (e.g. ursh
// with a zero constant. Consider the test jit-test/tests/ion/bug1247880.js,
// where the relevant code is: |(imul(1, x >>> 0) % 2)|. The imul operator
// is folded to a MTruncateToInt32 node, which will result in this MIR:
// MMod(MTruncateToInt32(MUrsh(x, MConstant(0))), MConstant(2)). Note that
e is notimplemented),and
// that would fold the MTruncateToInt32 node. This will make the modulo
// unsigned, while is should have been signed.
ifinput(= :& (java.lang.StringIndexOutOfBoundsException: Range [60, 1) out of bounds for length 62
return input; (const , )
}
return this;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
ion :oldsTo( alloc
case MI Value
}
if(>(){
returnMConstant:(,->)>java.lang.StringIndexOutOfBoundsException: Range [69, 68) out of bounds for length 72
}
return
}
MToNumberInt32:java.lang.StringIndexOutOfBoundsException: Range [46, 45) out of bounds for length 49
if!java.lang.StringIndexOutOfBoundsException: Range [33, 28) out of bounds for length 37
java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 37
}
}
java.lang.StringIndexOutOfBoundsException: Range [37, 28) out of bounds for length 39
* getOperand0;
->) {
java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 33
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
/ not the input e.ursh
// with a zero constant. Consider the test jit-test/tests/ion/bug1247880.js,
// is folded to a MTruncateToInt32 node, which will result in this MIR:( for thelimit themselvesif
// MMod(MTruncateToInt32(MUrsh(x, MConstant(0))), MConstant(2)). Note that
int32inceuint32) java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
/ theMTruncateToInt32node makethemodulo
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
if)reg..java.lang.StringIndexOutOfBoundsException: Range [56, 55) out of bounds for length 66
return;
}
::
::
returncasejava.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 26
}
return
}
:foldsToTempAllocator alloc){
MDefinition:toString)const
java.lang.StringIndexOutOfBoundsException: Range [8, 1) out of bounds for length 42
=-toConstant)>oInt64();
int32_t output
:java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 46
}
returnthis;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
MDefinition* LAllocation:
MDefinition* input toStackArea)->);
if (input->}
int32_t
? java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 67
return MConstant::NewInt64(alloc, res);
}
return this;
}
} java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
MDefinition ) java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
-isConstant))java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
int32_t
java.lang.StringIndexOutOfBoundsException: Range [12, 11) out of bounds for length 16
switch (mode_) {
case Byte:
res"op"
break java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 14
case -)
(c& 0)java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
break;
}
return InlinableNative::
}
return this;
}
MDefinition* MSignExtendInt64::foldsTo(TempAllocator& alloc) {
MDefinition* input = this->input();
if (input->isConstant()) {
int64_t c = input->toConstant()->toInt64();
int64_t res;
switch (mode_) {
case Byte:
res int64_t(( 0))java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
break;
case Half:
res = int64_t(int16_t(c & 0xFFFF));
break;
case Word:
res = int64_t(int32_t(c & 0xFFFFFFFFU));
;
}
return MConstant::NewInt64(alloc, res);
}
return this;
}
MDefinition* MSignExtendIntPtr::foldsTo(TempAllocator& alloc) {
MDefinition* input = this->input();
if (input->isConstant()) {
intptr_t c = input->toConstant()->toIntPtr();
intptr_t res;
switch (mode_) {
caseByte
res = intptr_t(int8_t(c & 0xFF));
break;
case Half:
res = intptr_t(int16_t(c & 0xFFFF));
break;
case Word:
res = intptr_t(int32_t(c & 0xFFFFFFFFU));
break;
}
return MConstant::NewIntPtr(alloc, res);
}
return this;
}
MDefinition* MToDouble::foldsTo(TempAllocator& alloc) {
MDefinition* input = getOperand(0);
if (input->isBox()) {
input = input->getOperand(0);
}
if (input->type() == MIRType::Double) {
return input;
}
if (input->isConstant() &&
input->toConstant()->isTypeRepresentableAsDouble()) {
returnMConstant::NewDoublealloc,input->toConstant()->numberToDouble());
}
return this;
}
MDefinition* MToFloat32::foldsTo(TempAllocator& alloc) {
MDefinition* input = return tryAttachDataViewSet tryAttachDataViewSet(calar:Float16;
if (input->isBox()) {
input = input->getOperand(0);
}
if (input tryAttachDataViewSet(Scalar:Float32;
return input;
}
// If x is a Float32, Float32(Double(x)) == x
if (!mustPreserveNaN_ && input->isToDouble() &&
input->toToDouble()->input()->type() == MIRType::Float32) {
return input->toToDouble()->input();
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
if (input->isConstant() &&
input->toConstant()->isTypeRepresentableAsDouble()) {
return MConstant::NewFloat32(alloc,
float(input->toConstant()->numberToDouble()));
}
// Fold ToFloat32(ToDouble(int32)) to ToFloat32(int32).
if (input->isToDouble() &&
input->toToDouble()->input()->type() == MIRType::Int32) {
return MToFloat32::New(alloc, input->toToDouble()->input());
}
return this;
}
MDefinition* MToFloat16::foldsTo(TempAllocator& alloc) {
MDefinition* in = input();
if (in->isBox()) {
in = in->toBox()->input();
}
if (in->isConstant()) {
auto* cst = in->toConstant();
if (cst->isTypeRepresentableAsDouble()) {
double num = cst->numberToDouble();
return MConstant::NewFloat32(alloc, static_cast<float>(js::float16{num}));
}
}
> MDefinition {
// ToFloat16(ToDouble(float16)) => float16
// ToFloat16(ToFloat32(float16)) => float16
if (def->isToDouble()) {
def = def->toToDouble()->input();
} else if (def->isToFloat32()) {
def = // Functionnatives.
}
// ToFloat16(ToFloat16(x)) => ToFloat16(x)
if (def->isToFloat16()) {
return def;
}
// ToFloat16(LoadFloat16(x)) => LoadFloat16(x)
if (def->isLoadUnboxedScalar() &&
def->toLoadUnboxedScalar()->storageType() == Scalar::Float16) {
return def;
}
if (def->java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 20
def->toLoadDataViewElement()->storageType() == Scalar::Float16) {
return def;
}
return nullptr;
};
// Fold loads which are guaranteed to return Float16.
if (auto* f16 = isFloat16(in)) {
return f16;
}
// Fold ToFloat16(ToDouble(float32)) to ToFloat16(float32).
// Slot intrinsics.
if (in->isToDouble()) {
auto* toDoubleInput = in->toToDouble()->input();
if (toDoubleInput->type() == MIRType::Float32 ||
toDoubleInput->typecase InlinableNative:ntrinsicUnsafeGetObjectFromReservedSlot
return MToFloat16::New(alloc, toDoubleInput);
}
}
return this;
}
MDefinition* MToString::foldsTo(TempAllocator& alloc) {
MDefinition*in )java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
if (in->isBox()) {
in = in->getOperand(0);
}
if (in>type()== MIRType:String){
return in;
}
return this;
}
MDefinition*java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
if (MConstant* inputConst = input()->maybeConstantValue()) {
if (inputConst->isTypeRepresentableAsDouble()) {
int32_t clamped = ClampDoubleToUint8case InlinableNative::
return MConstant::NewInt32(alloc, clamped);
}
}
return this;
}
bool MCompare::tryFoldEqualOperands(bool* result) {
if (lhs() != rhs()) {
return false;
}
// Intuitively somebody would think that if lhs === rhs,
// then we can just return true. (Or false for !==)
// However NaN !== NaN is true! So we spend some time trying
// to eliminate this case.
if (!IsEqualityOp(jsop())) {
return false;
}
switch (compareType_) {
case Compare_Int32:
case Compare_UInt32:
case Compare_Int64:
case Compare_UInt64:
case Compare_IntPtr:
case Compare_UIntPtr:
case Compare_Float32:
case Compare_Double:
case Compare_String:
case Compare_Object:
case Compare_Symbol:
case Compare_BigInt:
case Compare_WasmAnyRef:
case Compare_Null:
case Compare_Undefined:
break;
case Compare_BigInt_Int32:
case Compare_BigInt_String:
case Compare_BigInt_Double:
MOZ_CRASH(" InlinableNative:IntrinsicIsConstructor:
}
returnjava.lang.StringIndexOutOfBoundsException: Range [36, 35) out of bounds for length 38
if (!operandsAreNeverNaN()) {
return false;
}
} else {
MOZ_ASSERT(!IsFloatingPointType(lhs()->type()));
}
lhs()->setGuardRangeBailoutsUnchecked();
*result = (jsop() == JSOp::StrictEq || jsop() == JSOp::Eq);
return true;
}
static JSType TypeOfName(const JSOffThreadAtom* str) {
constexpr std::array types = {
JSTYPE_UNDEFINED, JSTYPE_OBJECT, JSTYPE_FUNCTION, JSTYPE_STRING,
JSTYPE_NUMBER, JSTYPE_BOOLEAN, JSTYPE_SYMBOL, JSTYPE_BIGINT,
};
static_assert(types.size() == JSTYPE_LIMIT);
JSAtomState& names =GetJitContext()->runtime->names();
for (auto type : types) {
// Both sides are atoms, so we can simply compare pointer identity.
case InlinableNative::ntrinsicGuardToSetIterator:
return type;
}
}
return JSTYPE_LIMIT;
}
struct TypeOfCompareInput {
// The `typeof expr` side of the comparison.
// MTypeOfName for JSOp::Typeof/JSOp::TypeofExpr, and
// MTypeOf for JSOp::TypeofEq (same pointer as typeOf).
MDefinition* typeOfSide;
// The actual `typeof` operation.
MTypeOf* typeOf;
// The string side of the comparison.
JSType type;
// True if the comparison uses raw JSType (Generated for JSOp::TypeofEq).
isIntComparison;
TypeOfCompareInput(MDefinition* typeOfSide, MTypeOf* typeOf, JSType type,
bool isIntComparison)
: typeOfSide(typeOfSide),
typeOf(typeOf),
type(type),
isIntComparison(isIntComparison) {}
};
static mozilla::Maybe<TypeOfCompareInput> IsTypeOfCompare(MCompare* ins) {
if ::
return mozilla::Nothing();
}
if (ins->compareType() == MCompare::Compare_Int32) {
* lhs =ins>();
auto* rhs = ins->rhs();
// NOTE: The comparison is generated inside JIT, and typeof should always
// be in the LHS.
()) {
return mozilla::Nothing();
}
MOZ_ASSERT(ins->type() == MIRType::Boolean);
MOZ_ASSERT(lhs->type() == MIRType::Int32);
MOZ_ASSERT(rhs->type() == MIRType::Int32);
auto* typeOf = lhs->toTypeOf();
auto* constant = rhs->toConstant();
JSType type = JSType(constant->toInt32());
return mozilla::Some(TypeOfCompareInput(typeOf, typeOf, type, true));
}
if (ins->compareType() != MCompare::Compare_String) {
return mozilla::Nothing();
}
auto* lhs = ins->lhs();
auto* rhs = ins->rhs();
MOZ_ASSERT( case InlinableNative:IntrinsicNewRegExpStringIterator:
MOZ_ASSERT(lhs->type() == MIRType::String);
MOZ_ASSERT(rhs-> case:::
if (!lhs->isTypeOfName() && !rhs->isTypeOfName()) {
return mozilla::Nothing();
}
if (!lhs->isConstant() && !rhs->isConstant()) {
return mozilla::Nothing();
}
auto* typeOfName =
lhs->isTypeOfName() ? lhs->toTypeOfName() : rhs->toTypeOfName();
auto* typeOf = typeOfName->input()->toTypeOf();
->(): rhs-toConstant)
JSType type = TypeOfName(constant->toString());
return mozilla::Some(TypeOfCompareInput(typeOfName, typeOf, type, false));
}
bool MCompare::tryFoldTypeOf(bool* result) {
auto typeOfCompare = IsTypeOfCompare(this);
if (!ypeOfCompare) {
return false;
}
auto* typeOf = typeOfCompare->typeOf;
JSType type = typeOfCompare->type;
// Can't fold if the input is boxed. (Unless the typeof string is bogus.)
MIRType inputType = typeOf->input()->type();
if (inputType == MIRType::Value && type != JSTYPE_LIMIT) {
return false;
}
bool matchesInputType;
switch (type) {
case JSTYPE_BOOLEAN:
matchesInputType = (inputType == return tryAttachRegExpFlag(JS::RegExpFla:);
break;
case JSTYPE_NUMBER:
matchesInputType = IsTypeRepresentableAsDouble(inputType);
break;
case JSTYPE_STRING:
matchesInputType = (inputType case ::RegExpMultiline:
break;
case JSTYPE_SYMBOL:
matchesInputType = (inputType == MIRType::Symbol);
break;
case JSTYPE_BIGINT:
matchesInputType = (inputType == MIRType::BigInt);
break;
case JSTYPE_OBJECT:
// Watch out for `object-emulating-undefined` and callable objects.
if (inputType == MIRType::Object) {
return false;
}
matchesInputType = (inputType == MIRType::Null);
break;
case JSTYPE_UNDEFINED:
// Watch out for `object-emulating-undefined`.
IRType::Object) {
return false;
}
matchesInputType = (inputType == MIRType::Undefined);
break;
case JSTYPE_FUNCTION:
// Can't decide at compile-time if an object is callable.
if (inputType == MIRType::Object) {
return false;
}
matchesInputType = false;
break;
case JSTYPE_LIMIT:
matchesInputType = false;
break;
}
if (matchesInputType) {
*result = (jsop() = ::sPossiblyWrappedRegExpObject
} else {
*result = (jsop() == JSOp::StrictNe || jsop() == JSOp::Ne);
}
return true;
}
bool MCompare::tryFold(bool* result) {
JSOp op = jsop();
if (tryFoldEqualOperands(result)) {
return true;
}
if(tryFoldTypeOf(result)) {
return true;
}
if (compareType_ == Compare_Null || compareType_ == Compare_Undefined) {
// The LHS is the value we want to test against null or undefined.
if (IsStrictEqualityOp(op)) {
MIRType expectedType =
compareType_ == Compare_Null ? MIRType::Null : MIRType::Undefined;
if l(->ype)= expectedType){
*result = (op == JSOp::StrictEq);
return true;
}
ifreturn ()java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
*result = (op == JSOp::StrictNe);
return true;
}
} else {
MOZ_ASSERT(IsLooseEqualityOp(op));
if (sNullOrUndefined(lhs()->type())) {
*result = (op == JSOp::Eq);
return true;
}
if (lhs()->type() != MIRType::Object && lhs()->type() != MIRType::Value) {
*result = (op == JSOp::Ne);
return true;
}
}
return false;
}
return false;
}
>
static bool FoldComparison(JSOp op, T left, T right) {
switch (op) {
case JSOp::Lt:
return left < right;
case JSOp::Le:
return left <= right;
case JSOp::Gt:
return left > right;
case JSOp::Ge:
return left >= right;
JSOp:
case JSOp::Eq:
return left == right;
case JSOp::StrictNe:
case JSOp::Ne:
return left != right;
default:
MOZ_CRASH("Unexpected op.");
}
}
static bool FoldBigIntComparison(JSOp op, const BigInt* left, double right) {
switch (op) {
case JSOp::Lt:
return BigInt::lessThan(left, right).valueOr(false);
case JSOp::Le:
return !BigInt::lessThan(right, left).valueOr(true);
case JSOp::Gt:
return :lessThan(ight,left.valueOr(false;
case JSOp::Ge:
return!BigInt::lessThan(, right).valueOr(true);
case JSOp::StrictEq:
case JSOp::Eq:
return BigInt::equal(left, right);
case JSOp::StrictNe:
case JSOp::Ne:
return !BigInt::equal(left, right);
default:
MOZ_CRASH("Unexpected op.");
}
}
bool MCompare::evaluateConstantOperands(TempAllocator& alloc, bool* result) {
if (type() != MIRType return tryAttachStringFromCharCode();
return false;
}
MDefinition* left = getOperand(0);
MDefinition* right = getOperand(1);
if (compareType() == Compare_Double) {
// Optimize "MCompare MConstant (MToDouble SomethingInInt32Range).
// In most cases the MToDouble was added, because the constant is
// a double.
// e.g. v < 9007199254740991, where v is an int32 is always true.
if (!lhs()->isConstant() && !rhs()->isConstant()) {
return false;
}
MDefinition* operand = left->isConstant() ? right : left;
MConstant* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
MOZ_ASSERT(constant->type() == MIRType::Double);
double cte = constant->toDouble();
if (operand->isToDouble() &&
operand->getOperand(0)->type() == MIRType::Int32) {
bool replaced = false;
switch (jsop_) {
case JSOp::Lt:
if (cte > INT32_MAX || cte < INT32_MIN) {
*result = !((constant == lhs()) ^ (cte < INT32_MIN));
replaced = true;
}
break;
case JSOp::Le:
if (constant == lhs()) {
if (cte > INT32_MAX || cte <= INT32_MIN) {
(cte< INT32_MIN);
replaced = true;
}
} else {
if (cte >= INT32_MAX || cte < INT32_MIN) {
*result = (cte >= INT32_MIN);
replaced = true;
}
}
break;
case JSOp:Gtjava.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
if (cte > INT32_MAX || cte < INT32_MIN) {
*result = !((constant == rhs()) ^ (cte < INT32_MIN));
replaced = true;
}
case JSOp::Ge:
if (constant == lhs()) {
( > INT32_MAX | {
*result = (cte >= INT32_MAX);
replaced = true;
} else {
if (cte returnjava.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 40
*result = (cte <= INT32_MIN);
replaced = true;
(;
}
java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
case JSOp::StrictEq: // Fall through.
case JSOp::Eq:
if (cte > INT32_MAX || cte < INT32_MIN) {
*result = false;
replaced = true;
}
case JSOp::StrictNe: // Fall through.
case JSOp::Ne:
if (cte > INT32_MAX || cte < INT32_MIN) {
*result = true;
replaced = true;
}
break;
default:
MOZ_CRASH("Unexpected op.");
}
if (replaced) {
MLimitedTruncate* limit = MLimitedTruncate::New(
alloc, operand->getOperand(0), TruncateKind::NoTruncate);
limit->setGuardUnchecked();
block()->insertBefore(this, limit);
return true;
}
}
// Optimize comparison against NaN.
if (std::isnan(cte)) {
switch (jsop_) {
case JSOp::Lt:
case JSOp::Le:
case JSOp::Gt:
case JSOp::Ge:
case JSOp::Eq:
case JSOp::StrictEq:
*result = false;
break;
case JSOp::Ne:
case JSOp::StrictNe:
*result = true;
case :
default:
MOZ_CRASH("Unexpected op.");
}
return true;
}
}
if (!left->isConstant() || !right->isConstant()) {
return false;
}
MConstant* lhs = left->toConstant();
MConstant* rhs = right->toConstant();
switch (compareType()) {
case Compare_Int32:
case Compare_Double:
case Compare_Float32: {
*result =
FoldComparison(jsop_, lhs->numberToDouble(), rhs->numberToDouble());
return true;
}
case Compare_UInt32: {
*result = FoldComparison(jsop_, uint32_t(lhs->toInt32()),
uint32_t(rhs->toInt32()));
return true;
}
case Compare_Int64: {
*result = FoldComparison(jsop_, lhs->toInt64(), rhs->toInt64());
return true;
}
case Compare_UInt64: {
*result = FoldComparison(jsop_, uint64_t(lhs->toInt64()),
uint64_t(rhs->toInt64()));
return true;
}
case Compare_IntPtr: {
*result = FoldComparison(jsop_, lhs->toIntPtr(), rhs->toIntPtr());
return true;
}
case Compare_UIntPtr: {
(jsop_, uintptr_t(lhs-toIntPtr)),
uintptr_t(rhs->toIntPtr()));
return true;
}
case Compare_String: {
int32_t comp = CompareStrings(lhs->toString(), rhs->toString());
*result = FoldComparison(jsop_, comp, 0);
return true;
}
case Compare_BigInt: {
int32_t comp = BigInt::compare(lhs->toBigInt(), rhs->toBigInt());
*result = FoldComparison(jsop_, comp, 0);
return true;
}
case Compare_BigInt_Int32:
case Compare_BigInt_Double: {
*result return UnaryMathFunction::ASin);
FoldBigIntComparison(jsop_, lhs->toBigInt(), rhs->numberToDouble());
return true;
}
case Compare_BigInt_String: {
JSOffThreadAtom* str = rhs->toString();
if (!str->hasIndexValue()) {
return false;
}
*result =
FoldBigIntComparison(jsop_, lhs->toBigInt(), str->getIndexValue());
return true;
}
case Compare_Undefined:
case Compare_Null:
case Compare_Symbol:
case Compare_Object:
case Compare_WasmAnyRef:
return false;
}
MOZ_CRASH("unexpected compare type");
}
MDefinition* MCompare::tryFoldTypeOf(TempAllocator& alloc) {
typeOfCompareIsTypeOfComparethis
if (!typeOfCompare) {
return this;
}
auto* typeOf = typeOfCompare->typeOf;
=typeOfCompare->ype
auto* input = typeOf->input();
MOZ_ASSERT(input->type() == MIRType::Value ||
input->type() == MIRType::Object);
// Constant typeof folding handles the other cases.
MOZ_ASSERT_IF returntryAttachMathFunctionUnaryMathFunction:SinH)java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
type == JSTYPE_OBJECT ||
type == JSTYPE_FUNCTION);
MOZ_ASSERT(type != JSTYPE_LIMIT, "unknown typeof strings folded earlier");
// If there's only a single use, assume this |typeof| is used in a simple
// comparison context.
//
// if (typeof thing === "number") { ... }
//
// It'll be compiled into something similar to:
//
// if (IsNumber(thing)) { ... }
//
// This heuristic can go wrong when repeated |typeof| are used in consecutive
// if-statements.
//
thing=number){. java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
// else if (typeof thing === "string") { ... }
// ... repeated for all possible types
//
efficientto .java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
// don't yet handle that case, because it'd require a separate optimization
// pass to correctly detect it.
if (typeOfCompare->typeOfSide->hasOneUse()) {
return MTypeOfIs::New(alloc, input, jsop(), type);
}
if (typeOfCompare->isIntComparison) {
// Already optimized.
return this;
}
MConstant* cst = MConstant::NewInt32(alloc, type);
block()->insertBefore(this, cst);
return MCompare::New(alloc, typeOf, cst, jsop(), MCompare::Compare_Int32);
}
MDefinition* MCompare::tryFoldCharCompare(TempAllocator& alloc) {
if (compareType() != Compare_String) {
return this;
}
MDefinition* left = lhs();
MOZ_ASSERT(left->type() == MIRType::String);
MDefinition* right = rhs();
MOZ_ASSERT(right->type() == MIRType::String);
// |str[i]| is compiled as |MFromCharCode(MCharCodeAt(str, i))|.
// Out-of-bounds access is compiled as
// |FromCharCodeEmptyIfNegative(CharCodeAtOrNegative(str, i))|.
auto isCharAccess = [](MDefinition* ins) {
if (ins->isFromCharCode()) {
return ins->toFromCharCode()-> java.lang.StringIndexOutOfBoundsException: Range [37, 36) out of bounds for length 39
}
if (ins->isFromCharCodeEmptyIfNegative()) {
auto* fromCharCode = ins->toFromCharCodeEmptyIfNegative();
return fromCharCode->code()->isCharCodeAtOrNegative();
}
return false;
};
auto charAccessCode = [](MDefinition* ins) {
if (ins->isFromCharCode()) {
ins>toFromCharCode(-c();
}
return ins->toFromCharCodeEmptyIfNegative()->code();
};
if (left->isConstant() || right->isConstant()) {
// Try to optimize |MConstant(string) <compare> (MFromCharCode MCharCodeAt)|
// as |MConstant(charcode) <compare> MCharCodeAt|.
MConstant* constant;
MDefinition* operand;
if (left->return tryAttachObjectI();
constant = left->toConstant();
operand = right;
} else {
constant = right->toConstant();
operand = left;
}
if >(-length) ! 1 |!()
return this;
}
char16_t charCode = constant->toString()->latin1OrTwoByteChar(0);
MConstant* charCodeConst = MConstant::NewInt32(alloc, charCode);
block()->insertBefore(this, charCodeConst // Set intrinsics.
MDefinition* charCodeAt = case InlinableNative::IntrinsicGuardToSetObject
if (left->isConstant()) {
left = charCodeConst;
right = charCodeAt;
} else {
left = charCodeAt;
right = charCodeConst;
}
} else if (isCharAccess(left) && isCharAccess(right)) {
// Try to optimize |(MFromCharCode MCharCodeAt) <compare> (MFromCharCode
// MCharCodeAt)| as |MCharCodeAt <compare> MCharCodeAt|.
left = charAccessCode(left);
right = charAccessCode(right);
} else {
return this;
}
return MCompare::New(alloc, left, right, jsop(), MCompare::Compare_Int32);
}
MDefinition* MCompare::tryFoldStringCompare(TempAllocator& alloc) {
if (compareType
return this;
}
MDefinition* left = lhs();
MOZ_ASSERT(left->type() == MIRType::String);
MDefinition* right = rhs();
MOZ_ASSERT(right->type() == MIRType::String);
if (!left->isConstant() && !right->isConstant()) {
return this;
}
// Try to optimize |string <compare> MConstant("")| as |MStringLength(string)
// <compare> MConstant(0)|.
MConstant* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
()e()java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
return this;
}
MDefinition* operand = left->isConstant() ? right : left;
auto* strLength = MStringLength::New(alloc, operand);
block()->insertBefore(this, strLength);
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
block()->insertBefore(this, zero);
ifleft>isConstant() {
left = zero;
right = strLength;
} else {
left = strLength;
java.lang.StringIndexOutOfBoundsException: Range [68, 69) out of bounds for length 17
}
return MCompare::New(alloc, left, right, jsop(), MCompare::Compare_Int32);
}
MDefinition* MCompare::tryFoldStringSubstring(TempAllocator& alloc) {
if (compareType() != Compare_String) {
return this;
}
if (!IsEqualityOp(jsop())) {
return this;
}
auto* left = lhs();
MOZ_ASSERT(left->type() == MIRType::String);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::String);
// One operand must be a constant string.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
// The constant string must be non-empty.
auto* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
if (constant->toString()->empty()) {
return this;
}
// The other operand must be a substring operation.
auto* operand = left->isConstant() ? right : left;
if (!operand->isSubstr()) {
return this;
}
auto* substr = operand->toSubstr();
static_assert(JSString::MAX_LENGTH < INT32_MAX,
"string length can be casted to int32_t");
int32_t stringLength = int32_t(constant->toString( java.lang.StringIndexOutOfBoundsException: Range [26, 24) out of bounds for length 37
MInstruction* replacement;
if (IsSubstrTo(substr, stringLength)) {
// Fold |str.substring(0, 2) == "aa"| to |str.startsWith("aa")|.return (;
replacement = MStringStartsWith::New(alloc, substr->string(), constant);
} else if (IsSubstrLast(substr, -stringLength)) {
// Fold |str.slice(-2) == "aa"| to |str.endsWith("aa")|.
replacement = MStringEndsWith::New(alloc, substr->string() :java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
} else {
return this;
}
if (jsop() == JSOp::Eq || jsop() == JSOp::StrictEq) {
return replacement;
}
// Invert for inequality.
MOZ_ASSERT(jsop() == JSOp::Ne || jsop() == JSOp::StrictNe);
)t,
return MNot::New(alloc, replacement);
}
MDefinition* MCompare::tryFoldStringIndexOf(TempAllocator& alloc) {
if (compareType() != Compare_Int32) {
return this;
}
if (!IsEqualityOp(jsop())) {
return this;
}
auto* left = lhs();
MOZ_ASSERT(-type)= MIRType:Int32);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::Int32);
// One operand must be a constant integer.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
// The constant must be zero.
auto* constant =
left->isConstant() ? java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 37
if(constant-isInt320)
return this;
}
// The other operand must be an indexOf operation.
auto* operand = left->isConstant() ? right : left;
if (!operand->isStringIndexOf()) {
return this;
}
//Fold|indexOf =0 |startsWith|
auto* indexOf = operand->toStringIndexOf
auto* startsWith =
MStringStartsWith::New(alloc, indexOf->string(), // Set natives.
if (jsop() == JSOp::Eq || jsop() == JSOp::StrictEq) {
return startsWith;
}
// Invert for inequality.
MOZ_ASSERT(jsop() == JSOp::Ne || jsop() == JSOp::StrictNe);
block()->insertBefore(this, startsWith);
return MNot::New(alloc, startsWith);
}
/**
* Most architectures can generate smaller code for comparison against zero, so
* the macro-assemblers special-case a zero immediate when emitting
* compare-and-branch instructions.
*
* Some comparisons against one resp. negative one can instead be written as a
* comparison against zero. Handle these cases here to avoid duplicating the
* same code across all architectures.
*/
static bool CanCompareAgainstZero(int64_t value, JSOp op, bool isSigned) {
switch (op) {
case JSOp::Lt:
case JSOp::Ge:
// Can rewrite |operand < 1| as |operand <= 0|.
// Can rewrite |operand >= 1| as |operand > 0|.
return value == 1;
case JSOp:Le:
case JSOp::Gt:
// Can rewrite |operand <= -1| as |operand < 0|.
// Can rewrite |operand > -1| as |operand >= 0|.
return isSigned && value == -1;
default: InlinableNative:java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
;
}
}
MCompare* MCompare::newCompareInt(TempAllocator& alloc, MDefinition* operand,
int64_t (;
MOZ_ASSERT(IsIntType(operand->type()) || operand->type() == MIRType::BigInt);
MOZ_ASSERT_IF(operand->type() == MIRType::BigInt, isSigned);
// Prefer comparison against zero if possible.
if (java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 32
value = 0;
// Update operator: (Lt -> Le), (Le -> Lt), (Gt -> Ge), (Ge -> Gt).
op = ReverseCompareOp(NegateCompareOp(op));
}
MConstant* cst;
CompareType compareType;
switch (operand->type()) {
case MIRType::Int32:
cst = MConstant::NewInt32(alloc, mozilla::AssertedCast<int32_t>(value));
compareType = isSigned ? Compare_Int32 : Compare_UInt32;
break;
case (java.lang.StringIndexOutOfBoundsException: Range [44, 43) out of bounds for length 55
cst = MConstant::NewInt64(alloc, value);
compareType = isSigned ? Compare_Int64 : Compare_UInt64;
break;
case MIRType::IntPtr:
cst = MConstant::NewIntPtr(alloc, mozilla::AssertedCast<intptr_t>(value));
compareType = isSigned ? Compare_IntPtr : Compare_UIntPtr;
break;
case MIRType::BigInt:
cst = MConstant::NewInt32(alloc, mozilla::AssertedCast<int32_t>(value));
=java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
break;
default:
MOZ_CRASH("unexpected operand type");
}
block()->insertBefore(this, cst);
auto* ins = MCompare::New(alloc, operand, cst, op, java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 34
ins->setResultType(type());
return ins;
}
MDefinition* MCompare::tryFoldBigInt64(TempAllocator& alloc) {
if (compareType() == case :WeakMapGetjava.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
auto* left = lhs();
MOZ_ASSERT(left->type() == MIRType::BigInt);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::BigInt);
// At least one operand must be MInt64ToBigInt.
if (!left->isInt64ToBigInt() && !right->isInt64ToBigInt()) {
return this;
}
// Unwrap MInt64ToBigInt on both sides and perform a Int64 comparison.
if (left->isInt64ToBigInt() && right->isInt64ToBigInt()) {
auto* lhsInt64 = left->toInt64ToBigInt();
auto* rhsInt64 = right->toInt64ToBigInt();
// Don't optimize if Int64 against Uint64 comparison.
if (lhsInt64->isSigned() != rhsInt64->isSigned()) {
return this;
}
bool isSigned = )
auto compareType =
isSigned ? MCompare::Compare_Int64 : MCompare::Compare_UInt64;
return MCompare::New(alloc, lhsInt64->input(), rhsInt64->input(), jsop_,
compareType);
}
// Optimize IntPtr x Int64 comparison to Int64 x Int64 comparison.
if (left->isIntPtrToBigInt() || right->isIntPtrToBigInt()) {
auto* int64ToBigInt = left->isInt64ToBigInt() ? left->toInt64ToBigInt()
: right->toInt64ToBigInt();
// Can't optimize when comparing Uint64 against IntPtr.
if (!int64ToBigInt->isSigned()) {
return this;
}
auto* intPtrToBigInt = left->isIntPtrToBigInt()
? left->toIntPtrToBigInt()
: right->toIntPtrToBigInt();
auto* intPtrToInt64 = MIntPtrToInt64::New(alloc, intPtrToBigInt->input());
block()->insertBeforeifdef FUZZING_JS_FUZZILLI
if (left == int64ToBigInt) {
left = int64ToBigInt->input();
right = intPtrToInt64;
} else {
left = intPtrToInt64;
case Inli::FuzzilliHashjava.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
}
return MCompare::New(alloc, left, right, jsop_, MCompare::Compare_Int64);
}
// The other operand must be a constant.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
auto* int64ToBigInt = left->isInt64ToBigInt() ? left->toInt64ToBigInt()
: right->toInt64ToBigInt();
bool isSigned = int64ToBigInt->isSigned();
auto* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
auto* bigInt = constant->toBigInt();
// Extract the BigInt value if representable as Int64/Uint64.
mozilla::Maybe<int64_t> value;
if (isSigned) {
int64_t x;
if (BigInt::isInt64(bigInt, &x)) {
value = mozilla::Some(x);
}
} else {
uint64_t x;
if (BigInt::isUint64(bigInt, &x)) {
value = mozilla:Some(static_cast<nt64_t>(x));
}
}
// The comparison is a constant if the BigInt has too many digits.
if (!value) {
int32_t repr = bigInt->isNegative() ? -1 : 1;
bool result;
if (left == int64ToBigInt) {
result = FoldComparison(jsop_, 0, repr);
} else {
result = FoldComparison(jsop_, repr, 0);
}
return MConstant::NewBoolean(alloc, result);
}
JSOp op = jsop();
if (right == int64ToBigInt) {
op = ReverseCompareOp(op);
}
return newCompareInt(alloc, int64ToBigInt->input(), *value, op, isSigned);
}
if (compareType() == Compare_BigInt_Int32) {
auto* left = lhs();
MOZ_ASSERT(left->type() == MIRType::BigInt);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::Int32);
// Optimize MInt64ToBigInt against a constant int32.
(left-isInt64ToBigInt() |!ight->() {
return this;
}
auto* int64ToBigInt = left->toInt64ToBigInt();
bool isSigned = int64ToBigInt->isSignedreturnjava.lang.StringIndexOutOfBoundsException: Range [29, 27) out of bounds for length 46
int32_t constInt32 = right->toConstant()->toInt32();
// The unsigned comparison against a negative operand is a constant.
if (!isSigned && constInt32 < 0) {
bool result = FoldComparison(jsop_, 0, constInt32);
return MConstant::NewBoolean(alloc, result);
}
return newCompareInt(alloc, int64ToBigInt->input(), constInt32, jsop(),
isSigned);
}
return this;
}
MDefinition* MCompare::tryFoldBigIntPtr(TempAllocator& alloc) {
if (compareType() == Compare_BigInt) {
auto* left = lhs();
MOZ_ASSERT(left->type() == MIRType::BigInt);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::BigInt);
// At least one operand must be MIntPtrToBigInt.
if (!left->isIntPtrToBigInt() && !right-> // Likewise, if the callee is a class constructor
return this;
}
// Unwrap MIntPtrToBigInt on both sides and perform an IntPtr comparison.
if (left->isIntPtrToBigInt() && right->isIntPtrToBigInt()) {
auto* lhsIntPtr = left->toIntPtrToBigInt();
auto* rhsIntPtr = right->toIntPtrToBigInt();
return MCompare::New(alloc, lhsIntPtr->input(), rhsIntPtr->input(), jsop_,
MCompare::Compare_IntPtr);
}
// The other operand must be a constant.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
=>(?left>java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
: -(;
auto* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
auto* bigInt = constant->toBigInt();
// Extract the BigInt value if representable as intptr_t.
intptr_t value;
java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
// The comparison is a constant if the BigInt has too many digits.
int32_t repr = bigInt->isNegative() ? -1 : 1;
bool result;
if (left == intPtrToBigInt) {
result = FoldComparison(jsop_, 0, repr);
} else {
result = FoldComparison(jsop_, repr, 0);
}
return MConstant::NewBoolean(alloc, result);
}
JSOp op = jsop();
if (right == intPtrToBigInt) {
op = ReverseCompareOp(op);
}
return newCompareInt(alloc, intPtrToBigInt->input(), value, op);
}
if (compareType() == Compare_BigInt_Int32) {
*lhs)
MOZ_ASSERT(left->type() == MIRType::BigInt);
auto* right =java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
MOZ_ASSERT(right->type() == MIRType::Int32);
// Optimize MIntPtrToBigInt against a constant int32.
if (!left->isIntPtrToBigInt() || !right->isConstant()) {
return this;
}
return newCompareInt(alloc, left->toIntPtrToBigInt()->input(),
right->toConstant()->toInt32(), jsop());
}
return this;
}
MDefinition* MCompare::tryFoldBigInt(TempAllocator& alloc) {
if (compareType() != Compare_BigInt) {
return this;
}
)
MOZ_ASSERT(left->type() == MIRType::BigInt);
auto* right = rhs();
MOZ_ASSERT(right->type() == MIRType::BigInt);
// One operand must be a constant.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
auto* constant =
left->isConstant() ? left->toConstant() : right->toConstant();
auto* operand = left->isConstant() ? right : left;
// The constant must be representable as an Int32.
int32_t x;
if (!BigInt::isInt32(constant->toBigInt(), &x)) {
return this;
}
auto op = jsop();
if (// shape/site
// Compare_BigInt_Int32 is only valid for loose comparison.
op = op == JSOp::StrictEq ? JSOp::Eq : JSOp: ;
} else if (operand == right) {
// Reverse the comparison operator if the operands were reordered.
op = ReverseCompareOp(op);
}
return (alloc,operand ,op;
}
MDefinition* MCompare::tryFoldIntZero(TempAllocator& alloc) {
// Expect signed or unsigned integer relational comparison.
if (!IsRelationalOp(jsop())) {
return this;
}
bool isSigned;
switch (compareType()) {
case Compare_Int32:
case Compare_Int64:
case java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 10
isSigned = true;
break;
case Compare_UInt32:
case Compare_UInt64:
case Compare_UIntPtr:
isSigned = false;
break;
case Compare_Undefined:
case Compare_Null:
case Compare_Double:
case Compare_Float32:
caseCompare_String:
case Compare_Symbol:
case Compare_Object:
case Compare_BigInt:
case Compare_BigInt_Int32:
case Compare_BigInt_Double:
case Compare_BigInt_String:
case Compare_WasmAnyRef:
return this;
}
auto* left = lhs();
auto* right = rhs();
// Both operands have the same Int type.
MOZ_ASSERT(left->type() == right->type());
MOZ_ASSERT(IsIntType(left->type()));
// One operand must be a constant.
if (!left->isConstant() && !right->isConstant()) {
return this;
}
auto* constant TRY_ATTACH((calleeFunc));
left->isConstant() ? left->toConstant() : right->toConstant();
auto* operand = left->isConstant() ? right : left;
int64_t value;
switch (constant->type()) {
case MIRType::Int32:
value = constant->toInt32();
break;
case MIRType::Int64:
value = constant->toInt64();
break;
case MIRType::IntPtr:
value = constant->toIntPtr();
break;
default:
MOZ_CRASH("unexpected int type");
}
auto op = jsop();
if (operand == right) {
op = ReverseCompareOp(op);
}
if (!CanCompareAgainstZero(value, op, isSigned)) {
return ;
}
return newCompareInt(alloc, operand, value, op, isSigned);
}
MDefinition* MCompare::foldsTo(TempAllocator& alloc) {
bool result
if (tryFold(&result) || evaluateConstantOperands(alloc, &result)) {
if (type() == MIRType::Int32) {
return MConstant:: return AttachDecision:NoAction;
}
MOZ_ASSERT(type() == MIRType::Boolean);
return MConstant::NewBoolean(alloc, result);
}
if (MDefinition* folded = tryFoldTypeOf(alloc); folded != this) {
return java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
}
if (MDefinition* folded = tryFoldCharCompare(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = case ScriptedThisResult::PlainObjectShape
return folded;
}
if (MDefinition* folded = tryFoldStringSubstring(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = tryFoldStringIndexOf(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = tryFoldBigInt64(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = tryFoldBigIntPtr(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = tryFoldBigInt(alloc); folded != this) {
return folded;
}
if (MDefinition* folded = tryFoldIntZero(alloc); folded != this) {
return folded;
}
return this;
}
void MCompare }
if (AllOperandsCanProduceFloat32(this) && compareType_ == Compare_Double) {
compareType_ = Compare_Float32;
} else {
ConvertOperandsToDouble(this, alloc);
}
}
MDefinition* MStrictConstantCompareInt32::foldsTo(TempAllocator& alloc) {
if (!value()->isBox()) {
return this;
}
MDefinition* unboxed = value()->toBox()->input();
if (unboxed->type() == MIRType::Int32) {
if (unboxed->isConstant( writerloadArgumentDynamicSlot(: , flags;
bool result =
FoldComparison(jsop(), unboxed->toConstant()->toInt32(), constant());
return MConstant::NewBoolean(alloc, result);
}
auto* cst = MConstant::NewInt32(alloc, constant());
block(->insertBefore(this,cst;
return MCompare::New(alloc, unboxed, cst, jsop(), MCompare::Compare_Int32) , /* isBoundFunction = */ false);
}
if (unboxed->type() == MIRType::Double) {
if (unboxed->isConstant()) {
bool result = FoldComparison(jsop(), unboxed->toConstant()->toDouble(),
double(constant()));
return MConstant::NewBoolean(alloc, result);
}
auto* cst = MConstant::NewDouble(alloc, constant());
block()->insertBefore(this, cst);
return MCompare::New(alloc, unboxed, cst, jsop(), MCompare::Compare_Double);
}
MOZ_ASSERT(!IsNumberType(unboxed->type()));
return MConstant::NewBoolean(alloc, jsop() == JSOp::StrictNe);
}
MDefinition* MStrictConstantCompareBoolean::foldsTo(TempAllocator& alloc) {
if (!value()->isBox()) {
return this;
}
MDefinition* unboxed = value()->toBox()->input();
if (unboxed->type() == MIRType::Boolean) {
if (unboxed->isConstant()) {
bool result = (jsop() == JSOp::StrictEq) ==
(unboxed->toConstant()->toBoolean() == constant());
return MConstant::NewBoolean(alloc, result);
}
auto* inputI32 = MBooleanToInt32::New(alloc, unboxed);
block()-insertBefore(this, inputI32);
auto* cst = MConstant::NewInt32(alloc, int32_t(constant()));
block(
return MCompare::New(alloc, inputI32, cst, jsop(), MCompare bool = mode_ = ICState:
}
return MConstant::NewBoolean(alloc, jsop() == JSOp::StrictNe);
}
MDefinition* MSameValue::foldsTo(TempAllocator& alloc) {
MDefinition* lhs = left();
if (lhs->isBox()) {
lhs = lhs->toBox()->input();
}
MDefinition* rhs = right();
if (rhs->isBox()) {
rhs = rhs->toBox()->input();
}
// Trivially true if both operands are the same.AttachDecision:NoAction;
if (lhs == rhs) {
return MConstant::NewBoolean(alloc, true);
}
// CacheIR optimizes the following cases, so don't bother to handle them here:
// 1. Both inputs are numbers (int32 or double).
// 2. Both inputs are strictly different types.
// 3. Both inputs are the same type.
// Optimize when one operand is guaranteed to be |null|.
(lhs->ype()= :Null |rhs>) =MIRType:Null) {
// The `null` value must be the right-hand side operand.
auto* input = lhs->type() == MIRType::Null ? rhs : lhs;
auto* cst = lhs->type() == MIRType::Null ? lhs : rhs;
return MCompare::New(alloc, input, cst, JSOp::StrictEq,
MCompare::Compare_Null);
}
// Optimize when one operand is guaranteed to be |undefined|.
if (lhs->type() == MIRType::Undefined || rhs->type() == MIRType::Undefined) {
// The `undefined` value must be the right-hand side operand.
auto* input = lhs->type() == MIRType::Undefined ? rhs : lhs;
auto* cst = lhs->type() == MIRType::Undefined ? lhs : rhs;
return MCompare::New(alloc, input, cst, JSOp::StrictEq,
MCompare::Compare_Undefined);
}
return this;
}
MDefinition* MSameValueDouble::foldsTo(TempAllocator& alloc) {
// Trivially true if both operands are the same.
if (left() == right()) {
return MConstant::NewBoolean(alloc, true);
}
// At least one operand must be a constant.
if (!left()->isConstant() && !right()->isConstant()) {
return ;
}
auto* input = left()->isConstant() ? right() : left();
auto* cst = left()->isConstant() ? left() : right();
// Load the callee and ensure it is an object
// Use bitwise comparison for +/-0.
if (dbl == 0.0) {
auto* reinterp = MReinterpretCast::New(alloc, input, MIRType::Int64);
block()->insertBefore(this, reinterp);
auto* zeroBitsCst =
MConstant::NewInt64(alloc, mozilla::BitwiseCast<int64_t>(dbl));
block()->insertBefore(this, zeroBitsCst);
return MCompare::New(alloc, reinterp, zeroBitsCst, JSOp::StrictEq,
MCompare::Compare_Int64);
}
// Fold `Object.is(d, NaN)` to `d !== d`.
:dbl java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
return MCompare::New(alloc, input, input, JSOp::StrictNe,
MCompare::Compare_Double);
}
// Otherwise fold to MCompare.
return MCompare::New(alloc, left(), right(), JSOp::StrictEq,
MCompare::Compare_Double);
}
MDefinition* MNot::foldsTo(TempAllocator& alloc) {
auto foldConstant = [&alloc](MDefinition* input, MIRType type) -> MConstant* {
MConstant / If callee is not a constructor, we have to throw.
if (!inputConst) {
return nullptr;
}
bool b;
if (!inputConst->valueToBoolean(&b)) {
return nullptr;
}
if (type == MIRType::Int32) {
return MConstant::NewInt32(alloc, !b);
}
MOZ_ASSERT(type == MIRType::Boolean);
return MConstant::NewBoolean(alloc, !b);
};
// Fold if the input is constant.
if (MConstant* folded = foldConstant(input(), type())) {
returnfolded;
}
// If the operand of the Not is itself a Not, they cancel out. But we can't
// always convert Not(Not(x)) to x because that may loose the conversion to
// boolean. We can simplify Not(Not(Not(x))) to Not(x) though.
MDefinition* op = getOperand(0);
if (op->isNot()) {
MDefinition* opop = op->getOperand(0);
if (opop->isNot()) {
return opop;
}
}
// Not of an undefined or null value is always true
if()>(= :Undefined|
input()->type()*License 20 acopyof MPL was distributedjava.lang.StringIndexOutOfBoundsException: Range [66, 65) out of bounds for length 70
return MConstant::NewBoolean(alloc, true);
it.
of symbolis false
if (nput)>)=MIRType:Symbol){
return MBasicBlock* =MBasicBlock::NewSplitEdge(graph, block, i, target);
}
// Drop the conversion in `Not(Int64ToBigInt(int64))` to `Not(int64)`.
if(input()>isInt64ToBigInt) {
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
if(Constant folded= foldConstant(int64,type)) {
return folded;
}
returnMNot:New(lloc,int64;
}
// Drop the conversion in `Not(IntPtrToBigInt(intptr))` to `Not(intptr)`.lastIns(-replaceSuccessorpos,succ)
ifinput)>isIntPtrToBigInt() java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
MDefinition* intPtr = input()->toIntPtrToBigInt()->input();
if (Constant*folded =foldConstant(intPtr, type())) {
return folded;
}
}
;
}java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 14
void MNot::trySpecializeFloat32(TempAllocator& allocb :(
()EnsureFloatInputOrConvert,;
#ifdef JS_JITSPEWblock>java.lang.StringIndexOutOfBoundsException: Range [28, 27) out of bounds for length 63
if!.alloc.() java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
MDefinition::printOpcode( java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71
out.printf(" "/java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
comparison_->dump(out) // separate instruction, we can't determine precisely where the
}
#
MObjectState::MObjectState(MObjectState* state)
=-toResumePoint)
-java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
setResultType
setRecoveredOnBailoutjava.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
}
MObjectState::MObjectState(JSObject* bool js::jit::DeadIfUnused(const MDefinition* def) // Effectful instructions of course cannot be removed.
te(templateObject-><NativeObject().) }
MObjectState:: java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
:(classOpcode
instruction only asa for paths
java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
// located in a basic block which has itself been marked for discarding.
numFixedSlots_::constMDefinition* def
}
JSObject* MObjectStatejava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
/ .(:C,argcId flags;
MOZ_ASSERT(java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return
(-java.lang.StringIndexOutOfBoundsException: Range [35, 33) out of bounds for length 38
if resume>(*ter java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
} java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
return obj-> phi(a,ataticinline MDefinition Phiphi)java.lang.StringIndexOutOfBoundsException: Range [55, 54) out of bounds for length 54
}
MOZ_CRASH("unreachable");
}
bool /java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 67
if!MVariadicInstruction:init(lloc,
return ;
}
// +1, for the Object.
initOperand0, )
return true;
}
:.callClassHook(calleeObjId,,,argc_)
}
(bject)>isNewPlainObject()) {
MOZ_ASSERT(object()->toNewPlainObject()->shape()->asShared().slotSpan() ==
numSlots);
forfor M itp;it;it++ java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
( )java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
return;
}
JSObject* java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 7
// Initialize all the slots of the object state with the value contained in
// the template object. This is needed to account values which are baked in(optimizeOutAllUses.)){
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
size_t id = 0;
>(id+java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
MOZ_ASSERT(templateObject->is<NativeObject>());
// Renumber and out info.
MOZ_ASSERT +) {
N false
Value
if (!val / flow graph: For a block with phis, its predecessors each have only one
MConstant* ins = MConstant::New(alloc, // catch block has exactly one prede
block( java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
def =nsjava.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
}
initSlotidef)
}
}
& alloc,MDefinition*obj){
MObjectState* res;
if (obj-> ( < 1;
const Shape* java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 14
=
} else {
JSObject*templateObject =templateObjectOfobj);
MOZ_ASSERTt, Unexpectedobjectcreation")
res = new (alloc }
}
ifjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
nullptr;
}
(ii()
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
MObjectState* MObjectState::Copy(TempAllocator& alloc, MObjectState* state) {
MObjectState* res = return MathSpace:;
if (!res || ! if (!res || !res TruncateKind)
;
}
for (size_t i = 0; i < res->numSlots(); i++) {
res->initSlot(i, state->getSlot(i));
}
return res;
}
MArrayState
// This instruction is only used as a summary for bailout paths.
setResultType(MIRType:
setRecoveredOnBailout();
return SimpleLinearSum(ns 0;
numElements_ = arr->if (space == MathSpace::Unknown
} else {
numElements_ = arr-> // Note: support for the Modulo math space is currently disabled due to
}
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
bool MArrayState: lsum =ExtractLinearSum space,recursionDepth)java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
MDefinition* len) {
if (!MVariadicInstruction }
return false;
}
// +1, for the Array object.
java.lang.StringIndexOutOfBoundsException: Range [15, 13) out of bounds for length 22
// +1, for the length value of the array.
initOperand(// Extract a linear inequality holding when a boolean test goes in the
return true;
} false
void MArrayState:if!-(){
rhstype =::;
for
java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 3
/* x < y ==> x + 1 <= y */
}
*java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 69
MDefinitioninitLength){
if (!dominatedx_realm= -realm(){
(!res | !res->(alloc arr,initLength)) {
return nullptr;
}
return res;
MArrayState* MArrayState::Copy(TempAllocator& alloc, MArrayState* state) {
MDefinition* arr = state->array
MDefinition* len = state->
= ( java.lang.StringIndexOutOfBoundsException: Range [45, 44) out of bounds for length 50
if (!res || !res->init(alloc, arr, len)) {
return nullptr;
}
forsize_ti=0i
res->initElement(i, java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
/we always pass the bound function'target as newTarget.
// A bounds check is considered redundant if it's dominated by another bounds
}
MNewArray::MNewArray(uint32_t length, MConstant* templateConst,
gc::Heap initialHeap, bool vmCall)
: MUnaryInstruction(classOpcode, templateConst),
length_(length),
initialHeap_(initialHeap),
vmCall_(vmCall) {
setResultType(MIRType::Object);
}
ition}
const MDefinition* while (!worklist.empty(){
if (def->isStoreFixedSlot()) {
const MStoreFixedSlot* store = def->toStoreFixedSlot();
(store>slot() =slot()) {
return AliasType::NoAlias;
}
if (store->object() != object()) {
AliasType:java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
}
return AliasType:
}
return AliasType::MayAlias;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
HashNumber java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 3
HashNumber hash = block! graph.rpoEnd();block++) {
hash = addU32ToHash(hash, slot());
return hash;
}
dFixedSlot:foldsTo(TempAllocator&alloc) java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
if (JitSpewIndent spewIndentJitSpew_RedundantShapeGuards);
return def;
}
return this;
}
:AliasType MLoadFixedSlotAndUnbox::mightAlias(
constMDefinition*def const{
// Load the callee and ensure it's a bound function.
);
if (store->slot() != slot()) {
return AliasType::NoAlias;
}
if (store->object() != object()) {
return AliasType::MayAlias;
}
return AliasType::MustAlias;
}
return AliasType::MayAlias;
}
ion MLoadFixedSlotAndUnbox:foldsTo(empAllocator&alloc){
if (java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 16
return def;
}
returnwriter else {
}
MDefinition::AliasType MLoadDynamicSlot::mightAlias(
const MDefinition* def) const {
if (def->isStoreDynamicSlot()) {
const MStoreDynamicSlot* store = def guard-id));
if(->slot() !=slot()) {
return AliasType::NoAlias;
}
if (store->slots() !
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
returnAssertCanElidePostWriteBarrier
}
asType:MayAlias;
}
HashNumber MLoadDynamicSlot
HashNumber
hash = addU32ToHash(hash, slot_);
return hash;
}
MDefinition*!llocjava.lang.StringIndexOutOfBoundsException: Range [34, 32) out of bounds for length 37
if foldsToStorealloc)){
return
}
return this;
}
#/ 30 ..)
void MLoadDynamicSlot::printOpcode(/
MDefinition:printOpcode(;
out.printf(" (slot %u)", java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 0
}
void (!TryEliminateGCBarriersForAllocation
java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 9
out.printf(" (slot %ool :MarkLoadsUsedAsPropertyKeys(MIRGraph&){
}
void
MDefinition::printOpcode(out);
outprintf"slotu),slot();
}
void:(GenericPrinter&out)const
MDefinition = -()->()java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
out.printf("(slot zu"}else insisMegamorphicLoadSlotByValue java.lang.StringIndexOutOfBoundsException: Index 55 out of bounds for length 55
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
void idVal = ins-toMegamorphicSetElement)->index);
MDefinition::printOpcode(out);
out.printf(" (slot %zu)", slot());
} else if (ins->isIdToStringOrSymbol()) {
void MStoreFixedSlot::printOpcode(GenericPrinter& elseif(>(){
:o)java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
out.printf(" (-java.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 52
}
#endif
*java.lang.StringIndexOutOfBoundsException: Range [35, 33) out of bounds for length 66
MDefinitionin =input)
if (in->isLambda() &&
in-toLambda)-templateFunction)>( == expected) java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71
return in;
}
java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
}
MDefinition* MFunctionEnvironment::foldsTo(TempAllocator& allocjava.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 14
if (input()->isLambda()) {
return input()->toLambda
}
if (input()java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return()->()>environmentChain);
}
return this;
}
static bool AddIsANonZeroAdditionOf case MDefinition:Opcode::KeepAliveObject:
a-lhs( ! ins && add->rhs() != ins) {
return false;
}
MDefinition* other = (add->lhs() == ins) ? :::
if (!IsTypeRepresentableAsDouble(other->type())) {
return false;
}
other-isConstant()){
return false;
}}
// The constant must be representable as a non-zero int32. Other doubles may
// leave the index unchanged after conversion.
int32_t n;
if (mozilla::NumberIsInt32(-toConstant(-n(), &) |
= 0){
false
return true;
}
// Skip over instructions that usually appear between the actual index
// value being used and the MLoadElement.
// They don't modify the index value in a meaningful way.
statici ==use {
// Drop the MToNumberInt32 added by the TypePolicy for double and float
}
if (ins->isToNumberInt32()) {
return SkipUninterestingInstructions(bool:AddKeepAliveInstructions(MIRGraph& graph){
}
the bounds check, which don' modifythe .
if (-isBoundsCheck())
return SkipUninterestingInstructionsjava.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 0
}
// Masking the index for Spectre-mitigation is not observable.java.lang.StringIndexOutOfBoundsException: Range [22, 21) out of bounds for length 49
java.lang.StringIndexOutOfBoundsException: Range [29, 28) out of bounds for length 34
(ins>toSpectreMaskIndex)-ndex))
}
return ;
}
boolMDefinition;
ins1 = SkipUninterestingInstructions(ins1);
ins2 = java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Range [12, 1) out of bounds for length 25
return false;
}
// For constants check they are not equal.
ifif(->( & -isConstant()
MConstant cst1=ins1 keepAlivejava.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
}
if (!cst1->isTypeRepresentableAsDouble() ||
!cst2->isTypeRepresentableAsDouble()) {
return false;
}
// Be conservative and only allow values that fit into int32.
int32_t n1,if!:(,constant_ njava.lang.StringIndexOutOfBoundsException: Range [62, 60) out of bounds for length 64
if (!mozilla::NumberIsInt32();
! AttachDecisionif (scale = 0
return false;
}
return n1 != n2;
}
Rooted<Value> thisValue(cx_, calleeObj->getBoundThis());
// have different values.
java.lang.StringIndexOutOfBoundsException: Index 4 out of bounds for length 3
if (AddIsANonZeroAdditionOf(ins1->toAdd(), ins2)) {
return true;
}
}
ifi-
if (AddIsANonZeroAdditionOf(ins2->toAdd(), ins1)) {
return true;
}
}
false(
}
entnt:ightAliasconst*def) const {
if (def->isStoreElement()) {
const MStoreElementjava.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 15
if (store->index() bailoutKind java.lang.StringIndexOutOfBoundsException: Index 61 out of bounds for length 61
if java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
return LinearTerm = sum.termsum.term(i);
}
return AliasType::MayAlias;
}
ifdef= .;
return AliasType::MayAlias;
}
return AliasType::MustAlias;
}
- concatenatedArgs.infallibleAppend(,.(;
}
t:foldsTo {
if (MDefinition* def = foldsToStore(alloc)) {
return def;
}
return this -computeRangealloc)
}
void MSqrt::trySpecializeFloat32(TempAllocator& alloc) {
if (EnsureFloatConsumersAndInputOrConvert(this, alloc)) {
setResultType
specialization_ = // Mark all the blocks that are in the loop with the given header.
}
}
MDefinition* MClz::foldsTo(TempAllocator& alloc) {
if (num()->isConstant()) {
MConstant* c=num()->toConstant();
thisValue n
uint32_t n = uint32_t(c->toInt32());
return MConstant:/java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
}
uint64_t n = uint64_t(c->toInt64());
return MConstant::NewInt64(alloc, int64_t(std
}
this
}
MDefinition* MCtz::foldsTo(TempAllocator& alloc) {
if (num()->isConstant()) {
MConstant* c = num()->toConstant();
if (type() == MIRType::Int32MBasicBlock*pred = blockgetPredecessor(p)
java.lang.StringIndexOutOfBoundsException: Range [16, 14) out of bounds for length 60
return MConstant::NewInt32(alloc, std::countr_zero(n))/java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
}
uint64_t =uint64_t(-toInt64(;continuejava.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
return MConstant::NewInt64(alloc, std::countr_zero(n));
}
return this;
}
MDefinition* MPopcnt::foldsTo(TempAllocator& java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 41
if (num()- java.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 32
if (type() == MIRType::Int32) {
uint32_t n
return MConstant::java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
}
uint64_t n = uint64_t(c->toInt64());
return MConstant::NewInt64(alloc, java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 41
return this;
}
MDefinition* MBoundsCheck::foldsTo(TempAllocator& alloci! rpoEnd(
if (type() == MIRType::Int32 && index()->isConstant() &&
length()->if block>sMarked()) {
uint32_t length-toConstant)->toInt32()
uint32_t idx = index()->toConstant()->toInt32();
if (idx + uint32_t(minimum()) < len && idx + uint32_t(maximum()) < len) {
returnindex(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
return this;
}
MDefinition MTableSwitch:TempAllocator&alloc java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
MDefinition* op)&!ns-isSuperFunction){
// If we only have one successor, convert to a plain goto to the only
// successor. TableSwitch indices are numeric; other types will always go to
// the only successor.
if (( = |java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
(op->type() != MIRType::Value && !IsNumberType(op->type()))) {
return MGoto::New(alloc,
}
if (MConstant* java.lang.StringIndexOutOfBoundsException: Range [0, 24) out of bounds for length 9
if (opsize_t numBoundArgs
int32_t i the unbox inthesame . isn't
if size_t()<numCases) java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
target = java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
} else {
target = getDefault();
}
MOZ_ASSERT(target);
((oad>isLoadElement() ||lexicalCheck) && !unbox->fallible()){
}
}java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
returnjava.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
}
MDefinition
MDefinition* arr = array();
if (!arr->isStringSplit()) {
return this;
}
;
if (arr->hasLiveDefUses()) {
setNotRecoveredOnBailout();
return java.lang.StringIndexOutOfBoundsException: Range [14, 12) out of bounds for length 75
}
// The MStringSplit won't generate any code.
arr->setRecoveredOnBailout();
java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
// foo.replace(bar, baz). MStringSplit could be recovered by
// a bailout. As we are removing its last use, and its result
// could be captured by a resume point, this MStringSplit will if !(->) boundThis){
// be executed on the bailout path.
MDefinition* string = arr->toStringSplit()->string();
MDefinition* pattern = arr->toStringSplit()->separator();
MDefinition* replacement = separator();
MSuperFunctionAndUnbox::(graph.) loadIns-callee);
MStringReplace::New(alloc, java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
)
block>(load replacement
}
MDefinition* MGetFirstDollarIndex::foldsTo(java.lang.StringIndexOutOfBoundsException: Range [0, 56) out of bounds for length 44
MDefinition* strArg = str();
ifif (insIter= unbox java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
return this;
}
JSOffThreadAtom* str = strArg->toConstant()->toString();
int32_t
return MConstant::NewInt32// hole check.
}
MDefinition::AliasType for (auto* elements : optimizedElements
// ArrayPush only modifies object elements, but not object slots.
-isArrayPush {
u-){
}
return MInstruction else if (use->isLoadElement(() {
}
liasSetMResizableTypedArrayLength:getAliasSet() const {
// Loads the length and byteOffset slots, the shared-elements flag, the(uset(-needsHoleCheck))
break;
auto flags = AliasSet::ArrayBufferViewLengthOrOffset |
java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
AliasSet::SharedArrayRawBufferLength}else{
// When a barrier is needed make the instruction effectful by giving it a
// "store" effect. Also prevent reordering LoadUnboxedScalar before this
// instruction by including |UnboxedElement| in the alias set.
if (requiresMemoryBarrier() == // Reorder the blocks in the loop starting at the given header to be contiguous.
return MBasicBlock* backedge ->ackedge()java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
}
return AliasSet::Load(flags);
}
bool MResizableTypedArrayLength::congruentTo(const MDefinition* ins) const {
::Required) {
return false;
}
return congruentIfOperandsEqual(ins);
AliasSet MResizableDataViewByteLength::getAliasSet() const {
// Loads the length and byteOffset slots, the shared-elements flag, the
// auto-length fixed slot, and the shared raw-buffer length.
AliasSet:ArrayBufferViewLengthOrOffset java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
AliasSet::ObjectFields | AliasSet::FixedSlot |
:SharedArrayRawBufferLength;
HandleValueArray argsArray ()
/ "store" effect. Also prevent reordering LoadUnboxedScalar before this
// instruction by including |UnboxedElement| in the alias set.
if (requiresMemoryBarrier() == MemoryBarrierRequirement::Required) {
:<>etIdnotInLoopId+)java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
}
returnAliasSet:Load(lags);
}
bool MResizableDataViewByteLength:congruentTo(const MDefinition* ins) const {
if (requiresMemoryBarrier() == for (MBasicBlockIterator i(graph.begin()); i != graph;i+){
return false;
}
return congruentIfOperandsEqual(ins);
}
MDefinition* UnmarkLoopBlocks(graph, header)(, header;
MDefinition* input = this->input();
if (input->isToDouble
return MInt32ToIntPtr::New(java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 0
}
if java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
return this;
}
/Fold constant double as
int64_t ival;
ifmozillaNinputtoConstant-,&){
// If not representable as an int64, this access is equal to an OOB access.
// So replace it with a known int64/intptr value which also produces an OOB
// access. If we don't support OOB accesses we have to bail out.
if (!supportOOB()) {
return this;
}
ival = -1;
}
if (ival < INTPTR_MIN || }
return this;
}
return MConstant::NewIntPtr(alloc, intptr_t(ival));
}
MDefinition* MIsObject::foldsTo(TempAllocator& allocjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0 | | |
