Google Git
Sign in
android / platform / external / v8 / 958fae7 / . / src / compiler / typer.cc
blob: 137829e92d9bb1b077fc31b10b4fa14e6b6c181c [file] [log] [blame]
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "src/bootstrapper.h"
#include "src/compiler/graph-inl.h"
#include "src/compiler/graph-reducer.h"
#include "src/compiler/js-operator.h"
#include "src/compiler/node.h"
#include "src/compiler/node-properties-inl.h"
#include "src/compiler/node-properties.h"
#include "src/compiler/simplified-operator.h"
#include "src/compiler/typer.h"
namespace v8 {
namespace internal {
namespace compiler {
#define NATIVE_TYPES(V) \
V(Int8) \
V(Uint8) \
V(Int16) \
V(Uint16) \
V(Int32) \
V(Uint32) \
V(Float32) \
V(Float64)
enum LazyCachedType {
kNumberFunc0,
kNumberFunc1,
kNumberFunc2,
kImulFunc,
kClz32Func,
kArrayBufferFunc,
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
k##Type, k##Type##Array, k##Type##ArrayFunc,
TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
kNumLazyCachedTypes
};
// Constructs and caches types lazily.
// TODO(turbofan): these types could be globally cached or cached per isolate.
class LazyTypeCache FINAL : public ZoneObject {
public:
explicit LazyTypeCache(Zone* zone) : zone_(zone) {
memset(cache_, 0, sizeof(cache_));
}
inline Type* Get(LazyCachedType type) {
int index = static_cast<int>(type);
DCHECK(index < kNumLazyCachedTypes);
if (cache_[index] == NULL) cache_[index] = Create(type);
return cache_[index];
}
private:
Type* Create(LazyCachedType type) {
switch (type) {
case kInt8:
return CreateNative(CreateRange<int8_t>(), Type::UntaggedSigned8());
case kUint8:
return CreateNative(CreateRange<uint8_t>(), Type::UntaggedUnsigned8());
case kInt16:
return CreateNative(CreateRange<int16_t>(), Type::UntaggedSigned16());
case kUint16:
return CreateNative(CreateRange<uint16_t>(),
Type::UntaggedUnsigned16());
case kInt32:
return CreateNative(Type::Signed32(), Type::UntaggedSigned32());
case kUint32:
return CreateNative(Type::Unsigned32(), Type::UntaggedUnsigned32());
case kFloat32:
return CreateNative(Type::Number(), Type::UntaggedFloat32());
case kFloat64:
return CreateNative(Type::Number(), Type::UntaggedFloat64());
case kUint8Clamped:
return Get(kUint8);
case kNumberFunc0:
return Type::Function(Type::Number(), zone());
case kNumberFunc1:
return Type::Function(Type::Number(), Type::Number(), zone());
case kNumberFunc2:
return Type::Function(Type::Number(), Type::Number(), Type::Number(),
zone());
case kImulFunc:
return Type::Function(Type::Signed32(), Type::Integral32(),
Type::Integral32(), zone());
case kClz32Func:
return Type::Function(CreateRange(0, 32), Type::Number(), zone());
case kArrayBufferFunc:
return Type::Function(Type::Object(zone()), Type::Unsigned32(), zone());
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
case k##Type##Array: \
return CreateArray(Get(k##Type)); \
case k##Type##ArrayFunc: \
return CreateArrayFunction(Get(k##Type##Array));
TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
case kNumLazyCachedTypes:
break;
}
UNREACHABLE();
return NULL;
}
Type* CreateArray(Type* element) const {
return Type::Array(element, zone());
}
Type* CreateArrayFunction(Type* array) const {
Type* arg1 = Type::Union(Type::Unsigned32(), Type::Object(), zone());
Type* arg2 = Type::Union(Type::Unsigned32(), Type::Undefined(), zone());
Type* arg3 = arg2;
return Type::Function(array, arg1, arg2, arg3, zone());
}
Type* CreateNative(Type* semantic, Type* representation) const {
return Type::Intersect(semantic, representation, zone());
}
template <typename T>
Type* CreateRange() const {
return CreateRange(std::numeric_limits<T>::min(),
std::numeric_limits<T>::max());
}
Type* CreateRange(double min, double max) const {
return Type::Range(factory()->NewNumber(min), factory()->NewNumber(max),
zone());
}
Factory* factory() const { return isolate()->factory(); }
Isolate* isolate() const { return zone()->isolate(); }
Zone* zone() const { return zone_; }
Type* cache_[kNumLazyCachedTypes];
Zone* zone_;
};
class Typer::Decorator FINAL : public GraphDecorator {
public:
explicit Decorator(Typer* typer) : typer_(typer) {}
void Decorate(Node* node) FINAL;
private:
Typer* typer_;
};
Typer::Typer(Graph* graph, MaybeHandle<Context> context)
: graph_(graph),
context_(context),
decorator_(NULL),
cache_(new (graph->zone()) LazyTypeCache(graph->zone())),
weaken_min_limits_(graph->zone()),
weaken_max_limits_(graph->zone()) {
Zone* zone = this->zone();
Factory* f = zone->isolate()->factory();
Handle<Object> zero = f->NewNumber(0);
Handle<Object> one = f->NewNumber(1);
Handle<Object> infinity = f->NewNumber(+V8_INFINITY);
Handle<Object> minusinfinity = f->NewNumber(-V8_INFINITY);
Type* number = Type::Number();
Type* signed32 = Type::Signed32();
Type* unsigned32 = Type::Unsigned32();
Type* nan_or_minuszero = Type::Union(Type::NaN(), Type::MinusZero(), zone);
Type* truncating_to_zero =
Type::Union(Type::Union(Type::Constant(infinity, zone),
Type::Constant(minusinfinity, zone), zone),
nan_or_minuszero, zone);
boolean_or_number = Type::Union(Type::Boolean(), Type::Number(), zone);
undefined_or_null = Type::Union(Type::Undefined(), Type::Null(), zone);
undefined_or_number = Type::Union(Type::Undefined(), Type::Number(), zone);
singleton_false = Type::Constant(f->false_value(), zone);
singleton_true = Type::Constant(f->true_value(), zone);
singleton_zero = Type::Range(zero, zero, zone);
singleton_one = Type::Range(one, one, zone);
zero_or_one = Type::Union(singleton_zero, singleton_one, zone);
zeroish = Type::Union(singleton_zero, nan_or_minuszero, zone);
signed32ish = Type::Union(signed32, truncating_to_zero, zone);
unsigned32ish = Type::Union(unsigned32, truncating_to_zero, zone);
falsish = Type::Union(Type::Undetectable(),
Type::Union(Type::Union(singleton_false, zeroish, zone),
undefined_or_null, zone),
zone);
truish = Type::Union(
singleton_true,
Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
integer = Type::Range(minusinfinity, infinity, zone);
weakint = Type::Union(integer, nan_or_minuszero, zone);
number_fun0_ = Type::Function(number, zone);
number_fun1_ = Type::Function(number, number, zone);
number_fun2_ = Type::Function(number, number, number, zone);
weakint_fun1_ = Type::Function(weakint, number, zone);
random_fun_ = Type::Function(Type::OrderedNumber(), zone);
const int limits_count = 20;
weaken_min_limits_.reserve(limits_count + 1);
weaken_max_limits_.reserve(limits_count + 1);
double limit = 1 << 30;
weaken_min_limits_.push_back(f->NewNumber(0));
weaken_max_limits_.push_back(f->NewNumber(0));
for (int i = 0; i < limits_count; i++) {
weaken_min_limits_.push_back(f->NewNumber(-limit));
weaken_max_limits_.push_back(f->NewNumber(limit - 1));
limit *= 2;
}
decorator_ = new (zone) Decorator(this);
graph_->AddDecorator(decorator_);
}
Typer::~Typer() {
graph_->RemoveDecorator(decorator_);
}
class Typer::Visitor : public Reducer {
public:
explicit Visitor(Typer* typer) : typer_(typer) {}
Reduction Reduce(Node* node) OVERRIDE {
if (node->op()->ValueOutputCount() == 0) return NoChange();
switch (node->opcode()) {
#define DECLARE_CASE(x) \
case IrOpcode::k##x: \
return UpdateBounds(node, TypeBinaryOp(node, x##Typer));
JS_SIMPLE_BINOP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
#define DECLARE_CASE(x) \
case IrOpcode::k##x: \
return UpdateBounds(node, Type##x(node));
DECLARE_CASE(Start)
// VALUE_OP_LIST without JS_SIMPLE_BINOP_LIST:
COMMON_OP_LIST(DECLARE_CASE)
SIMPLIFIED_OP_LIST(DECLARE_CASE)
MACHINE_OP_LIST(DECLARE_CASE)
JS_SIMPLE_UNOP_LIST(DECLARE_CASE)
JS_OBJECT_OP_LIST(DECLARE_CASE)
JS_CONTEXT_OP_LIST(DECLARE_CASE)
JS_OTHER_OP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
#define DECLARE_CASE(x) case IrOpcode::k##x:
DECLARE_CASE(End)
INNER_CONTROL_OP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
break;
}
return NoChange();
}
Bounds TypeNode(Node* node) {
switch (node->opcode()) {
#define DECLARE_CASE(x) \
case IrOpcode::k##x: return TypeBinaryOp(node, x##Typer);
JS_SIMPLE_BINOP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
#define DECLARE_CASE(x) case IrOpcode::k##x: return Type##x(node);
DECLARE_CASE(Start)
// VALUE_OP_LIST without JS_SIMPLE_BINOP_LIST:
COMMON_OP_LIST(DECLARE_CASE)
SIMPLIFIED_OP_LIST(DECLARE_CASE)
MACHINE_OP_LIST(DECLARE_CASE)
JS_SIMPLE_UNOP_LIST(DECLARE_CASE)
JS_OBJECT_OP_LIST(DECLARE_CASE)
JS_CONTEXT_OP_LIST(DECLARE_CASE)
JS_OTHER_OP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
#define DECLARE_CASE(x) case IrOpcode::k##x:
DECLARE_CASE(End)
INNER_CONTROL_OP_LIST(DECLARE_CASE)
#undef DECLARE_CASE
break;
}
UNREACHABLE();
return Bounds();
}
Type* TypeConstant(Handle<Object> value);
private:
Typer* typer_;
MaybeHandle<Context> context_;
#define DECLARE_METHOD(x) inline Bounds Type##x(Node* node);
DECLARE_METHOD(Start)
VALUE_OP_LIST(DECLARE_METHOD)
#undef DECLARE_METHOD
Bounds BoundsOrNone(Node* node) {
return NodeProperties::IsTyped(node) ? NodeProperties::GetBounds(node)
: Bounds(Type::None());
}
Bounds Operand(Node* node, int i) {
Node* operand_node = NodeProperties::GetValueInput(node, i);
return BoundsOrNone(operand_node);
}
Bounds ContextOperand(Node* node) {
Bounds result = BoundsOrNone(NodeProperties::GetContextInput(node));
DCHECK(result.upper->Maybe(Type::Internal()));
// TODO(rossberg): More precisely, instead of the above assertion, we should
// back-propagate the constraint that it has to be a subtype of Internal.
return result;
}
Type* Weaken(Type* current_type, Type* previous_type);
Zone* zone() { return typer_->zone(); }
Isolate* isolate() { return typer_->isolate(); }
Graph* graph() { return typer_->graph(); }
MaybeHandle<Context> context() { return typer_->context(); }
typedef Type* (*UnaryTyperFun)(Type*, Typer* t);
typedef Type* (*BinaryTyperFun)(Type*, Type*, Typer* t);
Bounds TypeUnaryOp(Node* node, UnaryTyperFun);
Bounds TypeBinaryOp(Node* node, BinaryTyperFun);
static Type* Invert(Type*, Typer*);
static Type* FalsifyUndefined(Type*, Typer*);
static Type* Rangify(Type*, Typer*);
static Type* ToPrimitive(Type*, Typer*);
static Type* ToBoolean(Type*, Typer*);
static Type* ToNumber(Type*, Typer*);
static Type* ToString(Type*, Typer*);
static Type* NumberToInt32(Type*, Typer*);
static Type* NumberToUint32(Type*, Typer*);
static Type* JSAddRanger(Type::RangeType*, Type::RangeType*, Typer*);
static Type* JSSubtractRanger(Type::RangeType*, Type::RangeType*, Typer*);
static Type* JSMultiplyRanger(Type::RangeType*, Type::RangeType*, Typer*);
static Type* JSDivideRanger(Type::RangeType*, Type::RangeType*, Typer*);
static Type* JSModulusRanger(Type::RangeType*, Type::RangeType*, Typer*);
static Type* JSCompareTyper(Type*, Type*, Typer*);
#define DECLARE_METHOD(x) static Type* x##Typer(Type*, Type*, Typer*);
JS_SIMPLE_BINOP_LIST(DECLARE_METHOD)
#undef DECLARE_METHOD
static Type* JSUnaryNotTyper(Type*, Typer*);
static Type* JSLoadPropertyTyper(Type*, Type*, Typer*);
static Type* JSCallFunctionTyper(Type*, Typer*);
Reduction UpdateBounds(Node* node, Bounds current) {
if (NodeProperties::IsTyped(node)) {
// Widen the bounds of a previously typed node.
Bounds previous = NodeProperties::GetBounds(node);
// Speed up termination in the presence of range types:
current.upper = Weaken(current.upper, previous.upper);
current.lower = Weaken(current.lower, previous.lower);
// Types should not get less precise.
DCHECK(previous.lower->Is(current.lower));
DCHECK(previous.upper->Is(current.upper));
NodeProperties::SetBounds(node, current);
if (!(previous.Narrows(current) && current.Narrows(previous))) {
// If something changed, revisit all uses.
return Changed(node);
}
return NoChange();
} else {
// No previous type, simply update the bounds.
NodeProperties::SetBounds(node, current);
return Changed(node);
}
}
};
void Typer::Run() {
{
// TODO(titzer): this is a hack. Reset types for interior nodes first.
NodeDeque deque(zone());
NodeMarker<bool> marked(graph(), 2);
deque.push_front(graph()->end());
marked.Set(graph()->end(), true);
while (!deque.empty()) {
Node* node = deque.front();
deque.pop_front();
// TODO(titzer): there shouldn't be a need to retype constants.
if (node->op()->ValueOutputCount() > 0)
NodeProperties::RemoveBounds(node);
for (Node* input : node->inputs()) {
if (!marked.Get(input)) {
marked.Set(input, true);
deque.push_back(input);
}
}
}
}
Visitor visitor(this);
GraphReducer graph_reducer(graph(), zone());
graph_reducer.AddReducer(&visitor);
graph_reducer.ReduceGraph();
}
void Typer::Decorator::Decorate(Node* node) {
if (node->op()->ValueOutputCount() > 0) {
// Only eagerly type-decorate nodes with known input types.
// Other cases will generally require a proper fixpoint iteration with Run.
bool is_typed = NodeProperties::IsTyped(node);
if (is_typed || NodeProperties::AllValueInputsAreTyped(node)) {
Visitor typing(typer_);
Bounds bounds = typing.TypeNode(node);
if (is_typed) {
bounds =
Bounds::Both(bounds, NodeProperties::GetBounds(node), typer_->zone());
}
NodeProperties::SetBounds(node, bounds);
}
}
}
// -----------------------------------------------------------------------------
// Helper functions that lift a function f on types to a function on bounds,
// and uses that to type the given node. Note that f is never called with None
// as an argument.
Bounds Typer::Visitor::TypeUnaryOp(Node* node, UnaryTyperFun f) {
Bounds input = Operand(node, 0);
Type* upper = input.upper->Is(Type::None())
? Type::None()
: f(input.upper, typer_);
Type* lower = input.lower->Is(Type::None())
? Type::None()
: (input.lower == input.upper || upper->IsConstant())
? upper // TODO(neis): Extend this to Range(x,x), NaN, MinusZero, ...?
: f(input.lower, typer_);
// TODO(neis): Figure out what to do with lower bound.
return Bounds(lower, upper);
}
Bounds Typer::Visitor::TypeBinaryOp(Node* node, BinaryTyperFun f) {
Bounds left = Operand(node, 0);
Bounds right = Operand(node, 1);
Type* upper = left.upper->Is(Type::None()) || right.upper->Is(Type::None())
? Type::None()
: f(left.upper, right.upper, typer_);
Type* lower = left.lower->Is(Type::None()) || right.lower->Is(Type::None())
? Type::None()
: ((left.lower == left.upper && right.lower == right.upper) ||
upper->IsConstant())
? upper
: f(left.lower, right.lower, typer_);
// TODO(neis): Figure out what to do with lower bound.
return Bounds(lower, upper);
}
Type* Typer::Visitor::Invert(Type* type, Typer* t) {
if (type->Is(t->singleton_false)) return t->singleton_true;
if (type->Is(t->singleton_true)) return t->singleton_false;
return type;
}
Type* Typer::Visitor::FalsifyUndefined(Type* type, Typer* t) {
if (type->Is(Type::Undefined())) return t->singleton_false;
return type;
}
Type* Typer::Visitor::Rangify(Type* type, Typer* t) {
if (type->IsRange()) return type; // Shortcut.
if (!type->Is(t->integer) && !type->Is(Type::Integral32())) {
return type; // Give up on non-integer types.
}
double min = type->Min();
double max = type->Max();
// Handle the degenerate case of empty bitset types (such as
// OtherUnsigned31 and OtherSigned32 on 64-bit architectures).
if (std::isnan(min)) {
DCHECK(std::isnan(max));
return type;
}
Factory* f = t->isolate()->factory();
return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
}
// Type conversion.
Type* Typer::Visitor::ToPrimitive(Type* type, Typer* t) {
if (type->Is(Type::Primitive()) && !type->Maybe(Type::Receiver())) {
return type;
}
return Type::Primitive();
}
Type* Typer::Visitor::ToBoolean(Type* type, Typer* t) {
if (type->Is(Type::Boolean())) return type;
if (type->Is(t->falsish)) return t->singleton_false;
if (type->Is(t->truish)) return t->singleton_true;
if (type->Is(Type::PlainNumber()) && (type->Max() < 0 || 0 < type->Min())) {
return t->singleton_true; // Ruled out nan, -0 and +0.
}
return Type::Boolean();
}
Type* Typer::Visitor::ToNumber(Type* type, Typer* t) {
if (type->Is(Type::Number())) return type;
if (type->Is(Type::Null())) return t->singleton_zero;
if (type->Is(Type::Undefined())) return Type::NaN();
if (type->Is(t->undefined_or_null)) {
return Type::Union(Type::NaN(), t->singleton_zero, t->zone());
}
if (type->Is(t->undefined_or_number)) {
return Type::Union(Type::Intersect(type, Type::Number(), t->zone()),
Type::NaN(), t->zone());
}
if (type->Is(t->singleton_false)) return t->singleton_zero;
if (type->Is(t->singleton_true)) return t->singleton_one;
if (type->Is(Type::Boolean())) return t->zero_or_one;
if (type->Is(t->boolean_or_number)) {
return Type::Union(Type::Intersect(type, Type::Number(), t->zone()),
t->zero_or_one, t->zone());
}
return Type::Number();
}
Type* Typer::Visitor::ToString(Type* type, Typer* t) {
if (type->Is(Type::String())) return type;
return Type::String();
}
Type* Typer::Visitor::NumberToInt32(Type* type, Typer* t) {
// TODO(neis): DCHECK(type->Is(Type::Number()));
if (type->Is(Type::Signed32())) return type;
if (type->Is(t->zeroish)) return t->singleton_zero;
if (type->Is(t->signed32ish)) {
return Type::Intersect(Type::Union(type, t->singleton_zero, t->zone()),
Type::Signed32(), t->zone());
}
return Type::Signed32();
}
Type* Typer::Visitor::NumberToUint32(Type* type, Typer* t) {
// TODO(neis): DCHECK(type->Is(Type::Number()));
if (type->Is(Type::Unsigned32())) return type;
if (type->Is(t->zeroish)) return t->singleton_zero;
if (type->Is(t->unsigned32ish)) {
return Type::Intersect(Type::Union(type, t->singleton_zero, t->zone()),
Type::Unsigned32(), t->zone());
}
return Type::Unsigned32();
}
// -----------------------------------------------------------------------------
// Control operators.
Bounds Typer::Visitor::TypeStart(Node* node) {
return Bounds(Type::None(zone()), Type::Internal(zone()));
}
// Common operators.
Bounds Typer::Visitor::TypeParameter(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeInt32Constant(Node* node) {
Factory* f = isolate()->factory();
Handle<Object> number = f->NewNumber(OpParameter<int32_t>(node));
return Bounds(Type::Intersect(
Type::Range(number, number, zone()), Type::UntaggedSigned32(), zone()));
}
Bounds Typer::Visitor::TypeInt64Constant(Node* node) {
// TODO(rossberg): This actually seems to be a PointerConstant so far...
return Bounds(Type::Internal()); // TODO(rossberg): Add int64 bitset type?
}
Bounds Typer::Visitor::TypeFloat32Constant(Node* node) {
return Bounds(Type::Intersect(
Type::Of(OpParameter<float>(node), zone()),
Type::UntaggedFloat32(), zone()));
}
Bounds Typer::Visitor::TypeFloat64Constant(Node* node) {
return Bounds(Type::Intersect(
Type::Of(OpParameter<double>(node), zone()),
Type::UntaggedFloat64(), zone()));
}
Bounds Typer::Visitor::TypeNumberConstant(Node* node) {
Factory* f = isolate()->factory();
return Bounds(Type::Constant(
f->NewNumber(OpParameter<double>(node)), zone()));
}
Bounds Typer::Visitor::TypeHeapConstant(Node* node) {
return Bounds(TypeConstant(OpParameter<Unique<HeapObject> >(node).handle()));
}
Bounds Typer::Visitor::TypeExternalConstant(Node* node) {
return Bounds(Type::None(zone()), Type::Internal(zone()));
}
Bounds Typer::Visitor::TypeSelect(Node* node) {
return Bounds::Either(Operand(node, 1), Operand(node, 2), zone());
}
Bounds Typer::Visitor::TypePhi(Node* node) {
int arity = node->op()->ValueInputCount();
Bounds bounds = Operand(node, 0);
for (int i = 1; i < arity; ++i) {
bounds = Bounds::Either(bounds, Operand(node, i), zone());
}
return bounds;
}
Bounds Typer::Visitor::TypeEffectPhi(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeValueEffect(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeFinish(Node* node) {
return Operand(node, 0);
}
Bounds Typer::Visitor::TypeFrameState(Node* node) {
// TODO(rossberg): Ideally FrameState wouldn't have a value output.
return Bounds(Type::None(zone()), Type::Internal(zone()));
}
Bounds Typer::Visitor::TypeStateValues(Node* node) {
return Bounds(Type::None(zone()), Type::Internal(zone()));
}
Bounds Typer::Visitor::TypeCall(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeProjection(Node* node) {
// TODO(titzer): use the output type of the input to determine the bounds.
return Bounds::Unbounded(zone());
}
// JS comparison operators.
Type* Typer::Visitor::JSEqualTyper(Type* lhs, Type* rhs, Typer* t) {
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return t->singleton_false;
if (lhs->Is(t->undefined_or_null) && rhs->Is(t->undefined_or_null)) {
return t->singleton_true;
}
if (lhs->Is(Type::Number()) && rhs->Is(Type::Number()) &&
(lhs->Max() < rhs->Min() || lhs->Min() > rhs->Max())) {
return t->singleton_false;
}
if (lhs->IsConstant() && rhs->Is(lhs)) {
// Types are equal and are inhabited only by a single semantic value,
// which is not nan due to the earlier check.
// TODO(neis): Extend this to Range(x,x), MinusZero, ...?
return t->singleton_true;
}
return Type::Boolean();
}
Type* Typer::Visitor::JSNotEqualTyper(Type* lhs, Type* rhs, Typer* t) {
return Invert(JSEqualTyper(lhs, rhs, t), t);
}
static Type* JSType(Type* type) {
if (type->Is(Type::Boolean())) return Type::Boolean();
if (type->Is(Type::String())) return Type::String();
if (type->Is(Type::Number())) return Type::Number();
if (type->Is(Type::Undefined())) return Type::Undefined();
if (type->Is(Type::Null())) return Type::Null();
if (type->Is(Type::Symbol())) return Type::Symbol();
if (type->Is(Type::Receiver())) return Type::Receiver(); // JS "Object"
return Type::Any();
}
Type* Typer::Visitor::JSStrictEqualTyper(Type* lhs, Type* rhs, Typer* t) {
if (!JSType(lhs)->Maybe(JSType(rhs))) return t->singleton_false;
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return t->singleton_false;
if (lhs->Is(Type::Number()) && rhs->Is(Type::Number()) &&
(lhs->Max() < rhs->Min() || lhs->Min() > rhs->Max())) {
return t->singleton_false;
}
if (lhs->IsConstant() && rhs->Is(lhs)) {
// Types are equal and are inhabited only by a single semantic value,
// which is not nan due to the earlier check.
return t->singleton_true;
}
return Type::Boolean();
}
Type* Typer::Visitor::JSStrictNotEqualTyper(Type* lhs, Type* rhs, Typer* t) {
return Invert(JSStrictEqualTyper(lhs, rhs, t), t);
}
// The EcmaScript specification defines the four relational comparison operators
// (<, <=, >=, >) with the help of a single abstract one. It behaves like <
// but returns undefined when the inputs cannot be compared.
// We implement the typing analogously.
Type* Typer::Visitor::JSCompareTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = ToPrimitive(lhs, t);
rhs = ToPrimitive(rhs, t);
if (lhs->Maybe(Type::String()) && rhs->Maybe(Type::String())) {
return Type::Boolean();
}
lhs = ToNumber(lhs, t);
rhs = ToNumber(rhs, t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::Undefined();
if (lhs->IsConstant() && rhs->Is(lhs)) {
// Types are equal and are inhabited only by a single semantic value,
// which is not NaN due to the previous check.
return t->singleton_false;
}
if (lhs->Min() >= rhs->Max()) return t->singleton_false;
if (lhs->Max() < rhs->Min() &&
!lhs->Maybe(Type::NaN()) && !rhs->Maybe(Type::NaN())) {
return t->singleton_true;
}
return Type::Boolean();
}
Type* Typer::Visitor::JSLessThanTyper(Type* lhs, Type* rhs, Typer* t) {
return FalsifyUndefined(JSCompareTyper(lhs, rhs, t), t);
}
Type* Typer::Visitor::JSGreaterThanTyper(Type* lhs, Type* rhs, Typer* t) {
return FalsifyUndefined(JSCompareTyper(rhs, lhs, t), t);
}
Type* Typer::Visitor::JSLessThanOrEqualTyper(Type* lhs, Type* rhs, Typer* t) {
return FalsifyUndefined(Invert(JSCompareTyper(rhs, lhs, t), t), t);
}
Type* Typer::Visitor::JSGreaterThanOrEqualTyper(
Type* lhs, Type* rhs, Typer* t) {
return FalsifyUndefined(Invert(JSCompareTyper(lhs, rhs, t), t), t);
}
// JS bitwise operators.
Type* Typer::Visitor::JSBitwiseOrTyper(Type* lhs, Type* rhs, Typer* t) {
Factory* f = t->isolate()->factory();
lhs = NumberToInt32(ToNumber(lhs, t), t);
rhs = NumberToInt32(ToNumber(rhs, t), t);
double lmin = lhs->Min();
double rmin = rhs->Min();
double lmax = lhs->Max();
double rmax = rhs->Max();
// Or-ing any two values results in a value no smaller than their minimum.
// Even no smaller than their maximum if both values are non-negative.
double min =
lmin >= 0 && rmin >= 0 ? std::max(lmin, rmin) : std::min(lmin, rmin);
double max = Type::Signed32()->Max();
// Or-ing with 0 is essentially a conversion to int32.
if (rmin == 0 && rmax == 0) {
min = lmin;
max = lmax;
}
if (lmin == 0 && lmax == 0) {
min = rmin;
max = rmax;
}
if (lmax < 0 || rmax < 0) {
// Or-ing two values of which at least one is negative results in a negative
// value.
max = std::min(max, -1.0);
}
return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
// TODO(neis): Be precise for singleton inputs, here and elsewhere.
}
Type* Typer::Visitor::JSBitwiseAndTyper(Type* lhs, Type* rhs, Typer* t) {
Factory* f = t->isolate()->factory();
lhs = NumberToInt32(ToNumber(lhs, t), t);
rhs = NumberToInt32(ToNumber(rhs, t), t);
double lmin = lhs->Min();
double rmin = rhs->Min();
double lmax = lhs->Max();
double rmax = rhs->Max();
double min = Type::Signed32()->Min();
// And-ing any two values results in a value no larger than their maximum.
// Even no larger than their minimum if both values are non-negative.
double max =
lmin >= 0 && rmin >= 0 ? std::min(lmax, rmax) : std::max(lmax, rmax);
// And-ing with a non-negative value x causes the result to be between
// zero and x.
if (lmin >= 0) {
min = 0;
max = std::min(max, lmax);
}
if (rmin >= 0) {
min = 0;
max = std::min(max, rmax);
}
return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
}
Type* Typer::Visitor::JSBitwiseXorTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = NumberToInt32(ToNumber(lhs, t), t);
rhs = NumberToInt32(ToNumber(rhs, t), t);
double lmin = lhs->Min();
double rmin = rhs->Min();
double lmax = lhs->Max();
double rmax = rhs->Max();
if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
// Xor-ing negative or non-negative values results in a non-negative value.
return Type::NonNegativeSigned32();
}
if ((lmax < 0 && rmin >= 0) || (lmin >= 0 && rmax < 0)) {
// Xor-ing a negative and a non-negative value results in a negative value.
// TODO(jarin) Use a range here.
return Type::NegativeSigned32();
}
return Type::Signed32();
}
Type* Typer::Visitor::JSShiftLeftTyper(Type* lhs, Type* rhs, Typer* t) {
return Type::Signed32();
}
Type* Typer::Visitor::JSShiftRightTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = NumberToInt32(ToNumber(lhs, t), t);
rhs = NumberToUint32(ToNumber(rhs, t), t);
double min = kMinInt;
double max = kMaxInt;
if (lhs->Min() >= 0) {
// Right-shifting a non-negative value cannot make it negative, nor larger.
min = std::max(min, 0.0);
max = std::min(max, lhs->Max());
}
if (lhs->Max() < 0) {
// Right-shifting a negative value cannot make it non-negative, nor smaller.
min = std::max(min, lhs->Min());
max = std::min(max, -1.0);
}
if (rhs->Min() > 0 && rhs->Max() <= 31) {
// Right-shifting by a positive value yields a small integer value.
double shift_min = kMinInt >> static_cast<int>(rhs->Min());
double shift_max = kMaxInt >> static_cast<int>(rhs->Min());
min = std::max(min, shift_min);
max = std::min(max, shift_max);
}
// TODO(jarin) Ideally, the following micro-optimization should be performed
// by the type constructor.
if (max != Type::Signed32()->Max() || min != Type::Signed32()->Min()) {
Factory* f = t->isolate()->factory();
return Type::Range(f->NewNumber(min), f->NewNumber(max), t->zone());
}
return Type::Signed32();
}
Type* Typer::Visitor::JSShiftRightLogicalTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = NumberToUint32(ToNumber(lhs, t), t);
Factory* f = t->isolate()->factory();
// Logical right-shifting any value cannot make it larger.
Handle<Object> min = f->NewNumber(0);
Handle<Object> max = f->NewNumber(lhs->Max());
return Type::Range(min, max, t->zone());
}
// JS arithmetic operators.
// Returns the array's least element, ignoring NaN.
// There must be at least one non-NaN element.
// Any -0 is converted to 0.
static double array_min(double a[], size_t n) {
DCHECK(n != 0);
double x = +V8_INFINITY;
for (size_t i = 0; i < n; ++i) {
if (!std::isnan(a[i])) {
x = std::min(a[i], x);
}
}
DCHECK(!std::isnan(x));
return x == 0 ? 0 : x; // -0 -> 0
}
// Returns the array's greatest element, ignoring NaN.
// There must be at least one non-NaN element.
// Any -0 is converted to 0.
static double array_max(double a[], size_t n) {
DCHECK(n != 0);
double x = -V8_INFINITY;
for (size_t i = 0; i < n; ++i) {
if (!std::isnan(a[i])) {
x = std::max(a[i], x);
}
}
DCHECK(!std::isnan(x));
return x == 0 ? 0 : x; // -0 -> 0
}
Type* Typer::Visitor::JSAddRanger(Type::RangeType* lhs, Type::RangeType* rhs,
Typer* t) {
double results[4];
results[0] = lhs->Min()->Number() + rhs->Min()->Number();
results[1] = lhs->Min()->Number() + rhs->Max()->Number();
results[2] = lhs->Max()->Number() + rhs->Min()->Number();
results[3] = lhs->Max()->Number() + rhs->Max()->Number();
// Since none of the inputs can be -0, the result cannot be -0 either.
// However, it can be nan (the sum of two infinities of opposite sign).
// On the other hand, if none of the "results" above is nan, then the actual
// result cannot be nan either.
int nans = 0;
for (int i = 0; i < 4; ++i) {
if (std::isnan(results[i])) ++nans;
}
if (nans == 4) return Type::NaN(); // [-inf..-inf] + [inf..inf] or vice versa
Factory* f = t->isolate()->factory();
Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
f->NewNumber(array_max(results, 4)), t->zone());
return nans == 0 ? range : Type::Union(range, Type::NaN(), t->zone());
// Examples:
// [-inf, -inf] + [+inf, +inf] = NaN
// [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
// [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
// [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
}
Type* Typer::Visitor::JSAddTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = ToPrimitive(lhs, t);
rhs = ToPrimitive(rhs, t);
if (lhs->Maybe(Type::String()) || rhs->Maybe(Type::String())) {
if (lhs->Is(Type::String()) || rhs->Is(Type::String())) {
return Type::String();
} else {
return Type::NumberOrString();
}
}
lhs = Rangify(ToNumber(lhs, t), t);
rhs = Rangify(ToNumber(rhs, t), t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
if (lhs->IsRange() && rhs->IsRange()) {
return JSAddRanger(lhs->AsRange(), rhs->AsRange(), t);
}
// TODO(neis): Deal with numeric bitsets here and elsewhere.
return Type::Number();
}
Type* Typer::Visitor::JSSubtractRanger(Type::RangeType* lhs,
Type::RangeType* rhs, Typer* t) {
double results[4];
results[0] = lhs->Min()->Number() - rhs->Min()->Number();
results[1] = lhs->Min()->Number() - rhs->Max()->Number();
results[2] = lhs->Max()->Number() - rhs->Min()->Number();
results[3] = lhs->Max()->Number() - rhs->Max()->Number();
// Since none of the inputs can be -0, the result cannot be -0.
// However, it can be nan (the subtraction of two infinities of same sign).
// On the other hand, if none of the "results" above is nan, then the actual
// result cannot be nan either.
int nans = 0;
for (int i = 0; i < 4; ++i) {
if (std::isnan(results[i])) ++nans;
}
if (nans == 4) return Type::NaN(); // [inf..inf] - [inf..inf] (all same sign)
Factory* f = t->isolate()->factory();
Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
f->NewNumber(array_max(results, 4)), t->zone());
return nans == 0 ? range : Type::Union(range, Type::NaN(), t->zone());
// Examples:
// [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
// [-inf, -inf] - [-inf, -inf] = NaN
// [-inf, -inf] - [n, +inf] = [-inf, -inf] \/ NaN
// [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
}
Type* Typer::Visitor::JSSubtractTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = Rangify(ToNumber(lhs, t), t);
rhs = Rangify(ToNumber(rhs, t), t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
if (lhs->IsRange() && rhs->IsRange()) {
return JSSubtractRanger(lhs->AsRange(), rhs->AsRange(), t);
}
return Type::Number();
}
Type* Typer::Visitor::JSMultiplyRanger(Type::RangeType* lhs,
Type::RangeType* rhs, Typer* t) {
double results[4];
double lmin = lhs->Min()->Number();
double lmax = lhs->Max()->Number();
double rmin = rhs->Min()->Number();
double rmax = rhs->Max()->Number();
results[0] = lmin * rmin;
results[1] = lmin * rmax;
results[2] = lmax * rmin;
results[3] = lmax * rmax;
// If the result may be nan, we give up on calculating a precise type, because
// the discontinuity makes it too complicated. Note that even if none of the
// "results" above is nan, the actual result may still be, so we have to do a
// different check:
bool maybe_nan = (lhs->Maybe(t->singleton_zero) &&
(rmin == -V8_INFINITY || rmax == +V8_INFINITY)) ||
(rhs->Maybe(t->singleton_zero) &&
(lmin == -V8_INFINITY || lmax == +V8_INFINITY));
if (maybe_nan) return t->weakint; // Giving up.
bool maybe_minuszero = (lhs->Maybe(t->singleton_zero) && rmin < 0) ||
(rhs->Maybe(t->singleton_zero) && lmin < 0);
Factory* f = t->isolate()->factory();
Type* range = Type::Range(f->NewNumber(array_min(results, 4)),
f->NewNumber(array_max(results, 4)), t->zone());
return maybe_minuszero ? Type::Union(range, Type::MinusZero(), t->zone())
: range;
}
Type* Typer::Visitor::JSMultiplyTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = Rangify(ToNumber(lhs, t), t);
rhs = Rangify(ToNumber(rhs, t), t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
if (lhs->IsRange() && rhs->IsRange()) {
return JSMultiplyRanger(lhs->AsRange(), rhs->AsRange(), t);
}
return Type::Number();
}
Type* Typer::Visitor::JSDivideTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = ToNumber(lhs, t);
rhs = ToNumber(rhs, t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
// Division is tricky, so all we do is try ruling out nan.
// TODO(neis): try ruling out -0 as well?
bool maybe_nan =
lhs->Maybe(Type::NaN()) || rhs->Maybe(t->zeroish) ||
((lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY) &&
(rhs->Min() == -V8_INFINITY || rhs->Max() == +V8_INFINITY));
return maybe_nan ? Type::Number() : Type::OrderedNumber();
}
Type* Typer::Visitor::JSModulusRanger(Type::RangeType* lhs,
Type::RangeType* rhs, Typer* t) {
double lmin = lhs->Min()->Number();
double lmax = lhs->Max()->Number();
double rmin = rhs->Min()->Number();
double rmax = rhs->Max()->Number();
double labs = std::max(std::abs(lmin), std::abs(lmax));
double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
double abs = std::min(labs, rabs);
bool maybe_minus_zero = false;
double omin = 0;
double omax = 0;
if (lmin >= 0) { // {lhs} positive.
omin = 0;
omax = abs;
} else if (lmax <= 0) { // {lhs} negative.
omin = 0 - abs;
omax = 0;
maybe_minus_zero = true;
} else {
omin = 0 - abs;
omax = abs;
maybe_minus_zero = true;
}
Factory* f = t->isolate()->factory();
Type* result = Type::Range(f->NewNumber(omin), f->NewNumber(omax), t->zone());
if (maybe_minus_zero)
result = Type::Union(result, Type::MinusZero(), t->zone());
return result;
}
Type* Typer::Visitor::JSModulusTyper(Type* lhs, Type* rhs, Typer* t) {
lhs = ToNumber(lhs, t);
rhs = ToNumber(rhs, t);
if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
if (lhs->Maybe(Type::NaN()) || rhs->Maybe(t->zeroish) ||
lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY) {
// Result maybe NaN.
return Type::Number();
}
lhs = Rangify(lhs, t);
rhs = Rangify(rhs, t);
if (lhs->IsRange() && rhs->IsRange()) {
return JSModulusRanger(lhs->AsRange(), rhs->AsRange(), t);
}
return Type::OrderedNumber();
}
// JS unary operators.
Type* Typer::Visitor::JSUnaryNotTyper(Type* type, Typer* t) {
return Invert(ToBoolean(type, t), t);
}
Bounds Typer::Visitor::TypeJSUnaryNot(Node* node) {
return TypeUnaryOp(node, JSUnaryNotTyper);
}
Bounds Typer::Visitor::TypeJSTypeOf(Node* node) {
return Bounds(Type::None(zone()), Type::InternalizedString(zone()));
}
// JS conversion operators.
Bounds Typer::Visitor::TypeJSToBoolean(Node* node) {
return TypeUnaryOp(node, ToBoolean);
}
Bounds Typer::Visitor::TypeJSToNumber(Node* node) {
return TypeUnaryOp(node, ToNumber);
}
Bounds Typer::Visitor::TypeJSToString(Node* node) {
return TypeUnaryOp(node, ToString);
}
Bounds Typer::Visitor::TypeJSToName(Node* node) {
return Bounds(Type::None(), Type::Name());
}
Bounds Typer::Visitor::TypeJSToObject(Node* node) {
return Bounds(Type::None(), Type::Receiver());
}
// JS object operators.
Bounds Typer::Visitor::TypeJSCreate(Node* node) {
return Bounds(Type::None(), Type::Object());
}
Type* Typer::Visitor::JSLoadPropertyTyper(Type* object, Type* name, Typer* t) {
// TODO(rossberg): Use range types and sized array types to filter undefined.
if (object->IsArray() && name->Is(Type::Integral32())) {
return Type::Union(
object->AsArray()->Element(), Type::Undefined(), t->zone());
}
return Type::Any();
}
Bounds Typer::Visitor::TypeJSLoadProperty(Node* node) {
return TypeBinaryOp(node, JSLoadPropertyTyper);
}
Bounds Typer::Visitor::TypeJSLoadNamed(Node* node) {
return Bounds::Unbounded(zone());
}
// Returns a somewhat larger range if we previously assigned
// a (smaller) range to this node. This is used to speed up
// the fixpoint calculation in case there appears to be a loop
// in the graph. In the current implementation, we are
// increasing the limits to the closest power of two.
Type* Typer::Visitor::Weaken(Type* current_type, Type* previous_type) {
Type::RangeType* previous = previous_type->GetRange();
Type::RangeType* current = current_type->GetRange();
if (previous != NULL && current != NULL) {
double current_min = current->Min()->Number();
Handle<Object> new_min = current->Min();
// Find the closest lower entry in the list of allowed
// minima (or negative infinity if there is no such entry).
if (current_min != previous->Min()->Number()) {
new_min = typer_->integer->AsRange()->Min();
for (const auto val : typer_->weaken_min_limits_) {
if (val->Number() <= current_min) {
new_min = val;
break;
}
}
}
double current_max = current->Max()->Number();
Handle<Object> new_max = current->Max();
// Find the closest greater entry in the list of allowed
// maxima (or infinity if there is no such entry).
if (current_max != previous->Max()->Number()) {
new_max = typer_->integer->AsRange()->Max();
for (const auto val : typer_->weaken_max_limits_) {
if (val->Number() >= current_max) {
new_max = val;
break;
}
}
}
return Type::Union(current_type,
Type::Range(new_min, new_max, typer_->zone()),
typer_->zone());
}
return current_type;
}
Bounds Typer::Visitor::TypeJSStoreProperty(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeJSStoreNamed(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeJSDeleteProperty(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeJSHasProperty(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeJSInstanceOf(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
// JS context operators.
Bounds Typer::Visitor::TypeJSLoadContext(Node* node) {
Bounds outer = Operand(node, 0);
Type* context_type = outer.upper;
if (context_type->Is(Type::None())) {
// Upper bound of context is not yet known.
return Bounds(Type::None(), Type::Any());
}
DCHECK(context_type->Maybe(Type::Internal()));
// TODO(rossberg): More precisely, instead of the above assertion, we should
// back-propagate the constraint that it has to be a subtype of Internal.
ContextAccess access = OpParameter<ContextAccess>(node);
MaybeHandle<Context> context;
if (context_type->IsConstant()) {
context = Handle<Context>::cast(context_type->AsConstant()->Value());
}
// Walk context chain (as far as known), mirroring dynamic lookup.
// Since contexts are mutable, the information is only useful as a lower
// bound.
// TODO(rossberg): Could use scope info to fix upper bounds for constant
// bindings if we know that this code is never shared.
for (size_t i = access.depth(); i > 0; --i) {
if (context_type->IsContext()) {
context_type = context_type->AsContext()->Outer();
if (context_type->IsConstant()) {
context = Handle<Context>::cast(context_type->AsConstant()->Value());
}
} else if (!context.is_null()) {
context = handle(context.ToHandleChecked()->previous(), isolate());
}
}
if (context.is_null()) {
return Bounds::Unbounded(zone());
} else {
Handle<Object> value =
handle(context.ToHandleChecked()->get(static_cast<int>(access.index())),
isolate());
Type* lower = TypeConstant(value);
return Bounds(lower, Type::Any());
}
}
Bounds Typer::Visitor::TypeJSStoreContext(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
Bounds Typer::Visitor::TypeJSCreateCatchContext(Node* node) {
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
Bounds Typer::Visitor::TypeJSCreateWithContext(Node* node) {
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
Bounds Typer::Visitor::TypeJSCreateBlockContext(Node* node) {
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
Bounds Typer::Visitor::TypeJSCreateModuleContext(Node* node) {
// TODO(rossberg): this is probably incorrect
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
Bounds Typer::Visitor::TypeJSCreateScriptContext(Node* node) {
Bounds outer = ContextOperand(node);
return Bounds(Type::Context(outer.upper, zone()));
}
// JS other operators.
Bounds Typer::Visitor::TypeJSYield(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeJSCallConstruct(Node* node) {
return Bounds(Type::None(), Type::Receiver());
}
Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
return fun->IsFunction() ? fun->AsFunction()->Result() : Type::Any();
}
Bounds Typer::Visitor::TypeJSCallFunction(Node* node) {
return TypeUnaryOp(node, JSCallFunctionTyper); // We ignore argument types.
}
Bounds Typer::Visitor::TypeJSCallRuntime(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeJSDebugger(Node* node) {
return Bounds::Unbounded(zone());
}
// Simplified operators.
Bounds Typer::Visitor::TypeAnyToBoolean(Node* node) {
return TypeUnaryOp(node, ToBoolean);
}
Bounds Typer::Visitor::TypeBooleanNot(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeBooleanToNumber(Node* node) {
return Bounds(Type::None(zone()), typer_->zero_or_one);
}
Bounds Typer::Visitor::TypeNumberEqual(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeNumberLessThan(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeNumberLessThanOrEqual(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeNumberAdd(Node* node) {
return Bounds(Type::None(zone()), Type::Number(zone()));
}
Bounds Typer::Visitor::TypeNumberSubtract(Node* node) {
return Bounds(Type::None(zone()), Type::Number(zone()));
}
Bounds Typer::Visitor::TypeNumberMultiply(Node* node) {
return Bounds(Type::None(zone()), Type::Number(zone()));
}
Bounds Typer::Visitor::TypeNumberDivide(Node* node) {
return Bounds(Type::None(zone()), Type::Number(zone()));
}
Bounds Typer::Visitor::TypeNumberModulus(Node* node) {
return Bounds(Type::None(zone()), Type::Number(zone()));
}
Bounds Typer::Visitor::TypeNumberToInt32(Node* node) {
return TypeUnaryOp(node, NumberToInt32);
}
Bounds Typer::Visitor::TypeNumberToUint32(Node* node) {
return TypeUnaryOp(node, NumberToUint32);
}
Bounds Typer::Visitor::TypeReferenceEqual(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeStringEqual(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeStringLessThan(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeStringLessThanOrEqual(Node* node) {
return Bounds(Type::None(zone()), Type::Boolean(zone()));
}
Bounds Typer::Visitor::TypeStringAdd(Node* node) {
return Bounds(Type::None(zone()), Type::String(zone()));
}
static Type* ChangeRepresentation(Type* type, Type* rep, Zone* zone) {
// TODO(neis): Enable when expressible.
/*
return Type::Union(
Type::Intersect(type, Type::Semantic(), zone),
Type::Intersect(rep, Type::Representation(), zone), zone);
*/
return type;
}
Bounds Typer::Visitor::TypeChangeTaggedToInt32(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Signed32()));
return Bounds(
ChangeRepresentation(arg.lower, Type::UntaggedSigned32(), zone()),
ChangeRepresentation(arg.upper, Type::UntaggedSigned32(), zone()));
}
Bounds Typer::Visitor::TypeChangeTaggedToUint32(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Unsigned32()));
return Bounds(
ChangeRepresentation(arg.lower, Type::UntaggedUnsigned32(), zone()),
ChangeRepresentation(arg.upper, Type::UntaggedUnsigned32(), zone()));
}
Bounds Typer::Visitor::TypeChangeTaggedToFloat64(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Number()));
return Bounds(
ChangeRepresentation(arg.lower, Type::UntaggedFloat64(), zone()),
ChangeRepresentation(arg.upper, Type::UntaggedFloat64(), zone()));
}
Bounds Typer::Visitor::TypeChangeInt32ToTagged(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Signed32()));
return Bounds(
ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
ChangeRepresentation(arg.upper, Type::Tagged(), zone()));
}
Bounds Typer::Visitor::TypeChangeUint32ToTagged(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Unsigned32()));
return Bounds(
ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
ChangeRepresentation(arg.upper, Type::Tagged(), zone()));
}
Bounds Typer::Visitor::TypeChangeFloat64ToTagged(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): CHECK(arg.upper->Is(Type::Number()));
return Bounds(
ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
ChangeRepresentation(arg.upper, Type::Tagged(), zone()));
}
Bounds Typer::Visitor::TypeChangeBoolToBit(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Boolean()));
return Bounds(
ChangeRepresentation(arg.lower, Type::UntaggedBit(), zone()),
ChangeRepresentation(arg.upper, Type::UntaggedBit(), zone()));
}
Bounds Typer::Visitor::TypeChangeBitToBool(Node* node) {
Bounds arg = Operand(node, 0);
// TODO(neis): DCHECK(arg.upper->Is(Type::Boolean()));
return Bounds(
ChangeRepresentation(arg.lower, Type::TaggedPointer(), zone()),
ChangeRepresentation(arg.upper, Type::TaggedPointer(), zone()));
}
Bounds Typer::Visitor::TypeLoadField(Node* node) {
return Bounds(FieldAccessOf(node->op()).type);
}
Bounds Typer::Visitor::TypeLoadBuffer(Node* node) {
// TODO(bmeurer): This typing is not yet correct. Since we can still access
// out of bounds, the type in the general case has to include Undefined.
switch (BufferAccessOf(node->op()).external_array_type()) {
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
case kExternal##Type##Array: \
return Bounds(typer_->cache_->Get(k##Type));
TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
}
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeLoadElement(Node* node) {
return Bounds(ElementAccessOf(node->op()).type);
}
Bounds Typer::Visitor::TypeStoreField(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeStoreBuffer(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeStoreElement(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeObjectIsSmi(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeObjectIsNonNegativeSmi(Node* node) {
return Bounds(Type::Boolean());
}
// Machine operators.
Bounds Typer::Visitor::TypeLoad(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeStore(Node* node) {
UNREACHABLE();
return Bounds();
}
Bounds Typer::Visitor::TypeWord32And(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Or(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Xor(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Shl(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Shr(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Sar(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Ror(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeWord32Equal(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeWord64And(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Or(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Xor(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Shl(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Shr(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Sar(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Ror(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeWord64Equal(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeInt32Add(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeInt32AddWithOverflow(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt32Sub(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeInt32SubWithOverflow(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt32Mul(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeInt32MulHigh(Node* node) {
return Bounds(Type::Signed32());
}
Bounds Typer::Visitor::TypeInt32Div(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeInt32Mod(Node* node) {
return Bounds(Type::Integral32());
}
Bounds Typer::Visitor::TypeInt32LessThan(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeInt32LessThanOrEqual(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeUint32Div(Node* node) {
return Bounds(Type::Unsigned32());
}
Bounds Typer::Visitor::TypeUint32LessThan(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeUint32LessThanOrEqual(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeUint32Mod(Node* node) {
return Bounds(Type::Unsigned32());
}
Bounds Typer::Visitor::TypeUint32MulHigh(Node* node) {
return Bounds(Type::Unsigned32());
}
Bounds Typer::Visitor::TypeInt64Add(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt64Sub(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt64Mul(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt64Div(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt64Mod(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeInt64LessThan(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeInt64LessThanOrEqual(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeUint64Div(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeUint64LessThan(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeUint64Mod(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeChangeFloat32ToFloat64(Node* node) {
return Bounds(Type::Intersect(
Type::Number(), Type::UntaggedFloat64(), zone()));
}
Bounds Typer::Visitor::TypeChangeFloat64ToInt32(Node* node) {
return Bounds(Type::Intersect(
Type::Signed32(), Type::UntaggedSigned32(), zone()));
}
Bounds Typer::Visitor::TypeChangeFloat64ToUint32(Node* node) {
return Bounds(Type::Intersect(
Type::Unsigned32(), Type::UntaggedUnsigned32(), zone()));
}
Bounds Typer::Visitor::TypeChangeInt32ToFloat64(Node* node) {
return Bounds(Type::Intersect(
Type::Signed32(), Type::UntaggedFloat64(), zone()));
}
Bounds Typer::Visitor::TypeChangeInt32ToInt64(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeChangeUint32ToFloat64(Node* node) {
return Bounds(Type::Intersect(
Type::Unsigned32(), Type::UntaggedFloat64(), zone()));
}
Bounds Typer::Visitor::TypeChangeUint32ToUint64(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeTruncateFloat64ToFloat32(Node* node) {
return Bounds(Type::Intersect(
Type::Number(), Type::UntaggedFloat32(), zone()));
}
Bounds Typer::Visitor::TypeTruncateFloat64ToInt32(Node* node) {
return Bounds(Type::Intersect(
Type::Signed32(), Type::UntaggedSigned32(), zone()));
}
Bounds Typer::Visitor::TypeTruncateInt64ToInt32(Node* node) {
return Bounds(Type::Intersect(
Type::Signed32(), Type::UntaggedSigned32(), zone()));
}
Bounds Typer::Visitor::TypeFloat64Add(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Sub(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Mul(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Div(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Mod(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Sqrt(Node* node) {
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Equal(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeFloat64LessThan(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeFloat64LessThanOrEqual(Node* node) {
return Bounds(Type::Boolean());
}
Bounds Typer::Visitor::TypeFloat64Floor(Node* node) {
// TODO(sigurds): We could have a tighter bound here.
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64Ceil(Node* node) {
// TODO(sigurds): We could have a tighter bound here.
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64RoundTruncate(Node* node) {
// TODO(sigurds): We could have a tighter bound here.
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeFloat64RoundTiesAway(Node* node) {
// TODO(sigurds): We could have a tighter bound here.
return Bounds(Type::Number());
}
Bounds Typer::Visitor::TypeLoadStackPointer(Node* node) {
return Bounds(Type::Internal());
}
Bounds Typer::Visitor::TypeCheckedLoad(Node* node) {
return Bounds::Unbounded(zone());
}
Bounds Typer::Visitor::TypeCheckedStore(Node* node) {
UNREACHABLE();
return Bounds();
}
// Heap constants.
Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
if (value->IsJSFunction()) {
if (JSFunction::cast(*value)->shared()->HasBuiltinFunctionId()) {
switch (JSFunction::cast(*value)->shared()->builtin_function_id()) {
case kMathRandom:
return typer_->random_fun_;
case kMathFloor:
return typer_->weakint_fun1_;
case kMathRound:
return typer_->weakint_fun1_;
case kMathCeil:
return typer_->weakint_fun1_;
// Unary math functions.
case kMathAbs: // TODO(rossberg): can't express overloading
case kMathLog:
case kMathExp:
case kMathSqrt:
case kMathCos:
case kMathSin:
case kMathTan:
case kMathAcos:
case kMathAsin:
case kMathAtan:
case kMathFround:
return typer_->cache_->Get(kNumberFunc1);
// Binary math functions.
case kMathAtan2:
case kMathPow:
case kMathMax:
case kMathMin:
return typer_->cache_->Get(kNumberFunc2);
case kMathImul:
return typer_->cache_->Get(kImulFunc);
case kMathClz32:
return typer_->cache_->Get(kClz32Func);
default:
break;
}
} else if (JSFunction::cast(*value)->IsBuiltin() && !context().is_null()) {
Handle<Context> native =
handle(context().ToHandleChecked()->native_context(), isolate());
if (*value == native->array_buffer_fun()) {
return typer_->cache_->Get(kArrayBufferFunc);
} else if (*value == native->int8_array_fun()) {
return typer_->cache_->Get(kInt8ArrayFunc);
} else if (*value == native->int16_array_fun()) {
return typer_->cache_->Get(kInt16ArrayFunc);
} else if (*value == native->int32_array_fun()) {
return typer_->cache_->Get(kInt32ArrayFunc);
} else if (*value == native->uint8_array_fun()) {
return typer_->cache_->Get(kUint8ArrayFunc);
} else if (*value == native->uint16_array_fun()) {
return typer_->cache_->Get(kUint16ArrayFunc);
} else if (*value == native->uint32_array_fun()) {
return typer_->cache_->Get(kUint32ArrayFunc);
} else if (*value == native->float32_array_fun()) {
return typer_->cache_->Get(kFloat32ArrayFunc);
} else if (*value == native->float64_array_fun()) {
return typer_->cache_->Get(kFloat64ArrayFunc);
}
}
} else if (value->IsJSTypedArray()) {
switch (JSTypedArray::cast(*value)->type()) {
#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
case kExternal##Type##Array: \
return typer_->cache_->Get(k##Type##Array);
TYPED_ARRAYS(TYPED_ARRAY_CASE)
#undef TYPED_ARRAY_CASE
}
}
return Type::Constant(value, zone());
}
} // namespace compiler
} // namespace internal
} // namespace v8