js/src/jit/CacheIRGenerator.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2  * vim: set ts=8 sts=2 et sw=2 tw=80:
   3  * This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef jit_CacheIRGenerator_h
   8 #define jit_CacheIRGenerator_h
   9
  10 #include "mozilla/Assertions.h"
  11 #include "mozilla/Attributes.h"
  12 #include "mozilla/Maybe.h"
  13
  14 #include <stdint.h>
  15
  16 #include "jstypes.h"
  17 #include "NamespaceImports.h"
  18
  19 #include "jit/CacheIR.h"
  20 #include "jit/CacheIRWriter.h"
  21 #include "jit/ICState.h"
  22 #include "js/Id.h"
  23 #include "js/RootingAPI.h"
  24 #include "js/ScalarType.h"
  25 #include "js/TypeDecls.h"
  26 #include "js/Value.h"
  27 #include "js/ValueArray.h"
  28 #include "vm/Opcodes.h"
  29
  30 class JSFunction;
  31
  32 namespace JS {
  33 struct XrayJitInfo;
  34 }
  35
  36 namespace js {
  37
  38 class BoundFunctionObject;
  39 class NativeObject;
  40 class PropertyResult;
  41 class ProxyObject;
  42 enum class UnaryMathFunction : uint8_t;
  43
  44 namespace jit {
  45
  46 class BaselineFrame;
  47 class Label;
  48 class MacroAssembler;
  49 struct Register;
  50 enum class InlinableNative : uint16_t;
  51
  52 // Some ops refer to shapes that might be in other zones. Instead of putting
  53 // cross-zone pointers in the caches themselves (which would complicate tracing
  54 // enormously), these ops instead contain wrappers for objects in the target
  55 // zone, which refer to the actual shape via a reserved slot.
  56 void LoadShapeWrapperContents(MacroAssembler& masm, Register obj, Register dst,
  57                               Label* failure);
  58
  59 class MOZ_RAII IRGenerator {
  60  protected:
  61   CacheIRWriter writer;
  62   JSContext* cx_;
  63   HandleScript script_;
  64   jsbytecode* pc_;
  65   CacheKind cacheKind_;
  66   ICState::Mode mode_;
  67   bool isFirstStub_;
  68
  69   // Important: This pointer may be passed to the profiler. If this is non-null,
  70   // it must point to a C string literal with static lifetime, not a heap- or
  71   // stack- allocated string.
  72   const char* stubName_ = nullptr;
  73
  74   IRGenerator(const IRGenerator&) = delete;
  75   IRGenerator& operator=(const IRGenerator&) = delete;
  76
  77   bool maybeGuardInt32Index(const Value& index, ValOperandId indexId,
  78                             uint32_t* int32Index, Int32OperandId* int32IndexId);
  79
  80   IntPtrOperandId guardToIntPtrIndex(const Value& index, ValOperandId indexId,
  81                                      bool supportOOB);
  82
  83   ObjOperandId guardDOMProxyExpandoObjectAndShape(ProxyObject* obj,
  84                                                   ObjOperandId objId,
  85                                                   const Value& expandoVal,
  86                                                   NativeObject* expandoObj);
  87
  88   void emitIdGuard(ValOperandId valId, const Value& idVal, jsid id);
  89
  90   OperandId emitNumericGuard(ValOperandId valId, Scalar::Type type);
  91
  92   StringOperandId emitToStringGuard(ValOperandId id, const Value& v);
  93
  94   void emitCalleeGuard(ObjOperandId calleeId, JSFunction* callee);
  95
  96   void emitOptimisticClassGuard(ObjOperandId objId, JSObject* obj,
  97                                 GuardClassKind kind);
  98
  99   friend class CacheIRSpewer;
 100
 101  public:
 102   explicit IRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 103                        CacheKind cacheKind, ICState state);
 104
 105   const CacheIRWriter& writerRef() const { return writer; }
 106   CacheKind cacheKind() const { return cacheKind_; }
 107
 108   // See comment on `stubName_` above.
 109   const char* stubName() const { return stubName_; }
 110
 111   static constexpr char* NotAttached = nullptr;
 112 };
 113
 114 // GetPropIRGenerator generates CacheIR for a GetProp IC.
 115 class MOZ_RAII GetPropIRGenerator : public IRGenerator {
 116   HandleValue val_;
 117   HandleValue idVal_;
 118
 119   AttachDecision tryAttachNative(HandleObject obj, ObjOperandId objId,
 120                                  HandleId id, ValOperandId receiverId);
 121   AttachDecision tryAttachObjectLength(HandleObject obj, ObjOperandId objId,
 122                                        HandleId id);
 123   AttachDecision tryAttachTypedArray(HandleObject obj, ObjOperandId objId,
 124                                      HandleId id);
 125   AttachDecision tryAttachDataView(HandleObject obj, ObjOperandId objId,
 126                                    HandleId id);
 127   AttachDecision tryAttachArrayBufferMaybeShared(HandleObject obj,
 128                                                  ObjOperandId objId,
 129                                                  HandleId id);
 130   AttachDecision tryAttachRegExp(HandleObject obj, ObjOperandId objId,
 131                                  HandleId id);
 132   AttachDecision tryAttachMap(HandleObject obj, ObjOperandId objId,
 133                               HandleId id);
 134   AttachDecision tryAttachSet(HandleObject obj, ObjOperandId objId,
 135                               HandleId id);
 136   AttachDecision tryAttachModuleNamespace(HandleObject obj, ObjOperandId objId,
 137                                           HandleId id);
 138   AttachDecision tryAttachWindowProxy(HandleObject obj, ObjOperandId objId,
 139                                       HandleId id);
 140   AttachDecision tryAttachCrossCompartmentWrapper(HandleObject obj,
 141                                                   ObjOperandId objId,
 142                                                   HandleId id);
 143   AttachDecision tryAttachXrayCrossCompartmentWrapper(HandleObject obj,
 144                                                       ObjOperandId objId,
 145                                                       HandleId id,
 146                                                       ValOperandId receiverId);
 147   AttachDecision tryAttachFunction(HandleObject obj, ObjOperandId objId,
 148                                    HandleId id);
 149   AttachDecision tryAttachArgumentsObjectIterator(HandleObject obj,
 150                                                   ObjOperandId objId,
 151                                                   HandleId id);
 152
 153   AttachDecision tryAttachGenericProxy(Handle<ProxyObject*> obj,
 154                                        ObjOperandId objId, HandleId id,
 155                                        bool handleDOMProxies);
 156   AttachDecision tryAttachDOMProxyExpando(Handle<ProxyObject*> obj,
 157                                           ObjOperandId objId, HandleId id,
 158                                           ValOperandId receiverId);
 159   AttachDecision tryAttachDOMProxyShadowed(Handle<ProxyObject*> obj,
 160                                            ObjOperandId objId, HandleId id);
 161   AttachDecision tryAttachDOMProxyUnshadowed(Handle<ProxyObject*> obj,
 162                                              ObjOperandId objId, HandleId id,
 163                                              ValOperandId receiverId);
 164   AttachDecision tryAttachProxy(HandleObject obj, ObjOperandId objId,
 165                                 HandleId id, ValOperandId receiverId);
 166
 167   AttachDecision tryAttachPrimitive(ValOperandId valId, HandleId id);
 168   AttachDecision tryAttachStringChar(ValOperandId valId, ValOperandId indexId);
 169   AttachDecision tryAttachStringLength(ValOperandId valId, HandleId id);
 170
 171   AttachDecision tryAttachArgumentsObjectArg(HandleObject obj,
 172                                              ObjOperandId objId, uint32_t index,
 173                                              Int32OperandId indexId);
 174   AttachDecision tryAttachArgumentsObjectArgHole(HandleObject obj,
 175                                                  ObjOperandId objId,
 176                                                  uint32_t index,
 177                                                  Int32OperandId indexId);
 178   AttachDecision tryAttachArgumentsObjectCallee(HandleObject obj,
 179                                                 ObjOperandId objId,
 180                                                 HandleId id);
 181
 182   AttachDecision tryAttachDenseElement(HandleObject obj, ObjOperandId objId,
 183                                        uint32_t index, Int32OperandId indexId);
 184   AttachDecision tryAttachDenseElementHole(HandleObject obj, ObjOperandId objId,
 185                                            uint32_t index,
 186                                            Int32OperandId indexId);
 187   AttachDecision tryAttachSparseElement(HandleObject obj, ObjOperandId objId,
 188                                         uint32_t index, Int32OperandId indexId);
 189   AttachDecision tryAttachTypedArrayElement(HandleObject obj,
 190                                             ObjOperandId objId);
 191
 192   AttachDecision tryAttachGenericElement(HandleObject obj, ObjOperandId objId,
 193                                          uint32_t index, Int32OperandId indexId,
 194                                          ValOperandId receiverId);
 195
 196   AttachDecision tryAttachProxyElement(HandleObject obj, ObjOperandId objId);
 197
 198   void attachMegamorphicNativeSlot(ObjOperandId objId, jsid id);
 199
 200   ValOperandId getElemKeyValueId() const {
 201     MOZ_ASSERT(cacheKind_ == CacheKind::GetElem ||
 202                cacheKind_ == CacheKind::GetElemSuper);
 203     return ValOperandId(1);
 204   }
 205
 206   ValOperandId getSuperReceiverValueId() const {
 207     if (cacheKind_ == CacheKind::GetPropSuper) {
 208       return ValOperandId(1);
 209     }
 210
 211     MOZ_ASSERT(cacheKind_ == CacheKind::GetElemSuper);
 212     return ValOperandId(2);
 213   }
 214
 215   bool isSuper() const {
 216     return (cacheKind_ == CacheKind::GetPropSuper ||
 217             cacheKind_ == CacheKind::GetElemSuper);
 218   }
 219
 220   // If this is a GetElem cache, emit instructions to guard the incoming Value
 221   // matches |id|.
 222   void maybeEmitIdGuard(jsid id);
 223
 224   void trackAttached(const char* name /* must be a C string literal */);
 225
 226  public:
 227   GetPropIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 228                      ICState state, CacheKind cacheKind, HandleValue val,
 229                      HandleValue idVal);
 230
 231   AttachDecision tryAttachStub();
 232 };
 233
 234 // GetNameIRGenerator generates CacheIR for a GetName IC.
 235 class MOZ_RAII GetNameIRGenerator : public IRGenerator {
 236   HandleObject env_;
 237   Handle<PropertyName*> name_;
 238
 239   AttachDecision tryAttachGlobalNameValue(ObjOperandId objId, HandleId id);
 240   AttachDecision tryAttachGlobalNameGetter(ObjOperandId objId, HandleId id);
 241   AttachDecision tryAttachEnvironmentName(ObjOperandId objId, HandleId id);
 242
 243   void trackAttached(const char* name /* must be a C string literal */);
 244
 245  public:
 246   GetNameIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 247                      ICState state, HandleObject env,
 248                      Handle<PropertyName*> name);
 249
 250   AttachDecision tryAttachStub();
 251 };
 252
 253 // BindNameIRGenerator generates CacheIR for a BindName IC.
 254 class MOZ_RAII BindNameIRGenerator : public IRGenerator {
 255   HandleObject env_;
 256   Handle<PropertyName*> name_;
 257
 258   AttachDecision tryAttachGlobalName(ObjOperandId objId, HandleId id);
 259   AttachDecision tryAttachEnvironmentName(ObjOperandId objId, HandleId id);
 260
 261   void trackAttached(const char* name /* must be a C string literal */);
 262
 263  public:
 264   BindNameIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 265                       ICState state, HandleObject env,
 266                       Handle<PropertyName*> name);
 267
 268   AttachDecision tryAttachStub();
 269 };
 270
 271 // SetPropIRGenerator generates CacheIR for a SetProp IC.
 272 class MOZ_RAII SetPropIRGenerator : public IRGenerator {
 273   HandleValue lhsVal_;
 274   HandleValue idVal_;
 275   HandleValue rhsVal_;
 276
 277  public:
 278   enum class DeferType { None, AddSlot };
 279
 280  private:
 281   DeferType deferType_ = DeferType::None;
 282
 283   ValOperandId setElemKeyValueId() const {
 284     MOZ_ASSERT(cacheKind_ == CacheKind::SetElem);
 285     return ValOperandId(1);
 286   }
 287
 288   ValOperandId rhsValueId() const {
 289     if (cacheKind_ == CacheKind::SetProp) {
 290       return ValOperandId(1);
 291     }
 292     MOZ_ASSERT(cacheKind_ == CacheKind::SetElem);
 293     return ValOperandId(2);
 294   }
 295
 296   // If this is a SetElem cache, emit instructions to guard the incoming Value
 297   // matches |id|.
 298   void maybeEmitIdGuard(jsid id);
 299
 300   AttachDecision tryAttachNativeSetSlot(HandleObject obj, ObjOperandId objId,
 301                                         HandleId id, ValOperandId rhsId);
 302   AttachDecision tryAttachMegamorphicSetSlot(HandleObject obj,
 303                                              ObjOperandId objId, HandleId id,
 304                                              ValOperandId rhsId);
 305   AttachDecision tryAttachSetter(HandleObject obj, ObjOperandId objId,
 306                                  HandleId id, ValOperandId rhsId);
 307   AttachDecision tryAttachSetArrayLength(HandleObject obj, ObjOperandId objId,
 308                                          HandleId id, ValOperandId rhsId);
 309   AttachDecision tryAttachWindowProxy(HandleObject obj, ObjOperandId objId,
 310                                       HandleId id, ValOperandId rhsId);
 311
 312   AttachDecision tryAttachSetDenseElement(HandleObject obj, ObjOperandId objId,
 313                                           uint32_t index,
 314                                           Int32OperandId indexId,
 315                                           ValOperandId rhsId);
 316   AttachDecision tryAttachSetTypedArrayElement(HandleObject obj,
 317                                                ObjOperandId objId,
 318                                                ValOperandId rhsId);
 319
 320   AttachDecision tryAttachSetDenseElementHole(HandleObject obj,
 321                                               ObjOperandId objId,
 322                                               uint32_t index,
 323                                               Int32OperandId indexId,
 324                                               ValOperandId rhsId);
 325
 326   AttachDecision tryAttachAddOrUpdateSparseElement(HandleObject obj,
 327                                                    ObjOperandId objId,
 328                                                    uint32_t index,
 329                                                    Int32OperandId indexId,
 330                                                    ValOperandId rhsId);
 331
 332   AttachDecision tryAttachGenericProxy(Handle<ProxyObject*> obj,
 333                                        ObjOperandId objId, HandleId id,
 334                                        ValOperandId rhsId,
 335                                        bool handleDOMProxies);
 336   AttachDecision tryAttachDOMProxyShadowed(Handle<ProxyObject*> obj,
 337                                            ObjOperandId objId, HandleId id,
 338                                            ValOperandId rhsId);
 339   AttachDecision tryAttachDOMProxyUnshadowed(Handle<ProxyObject*> obj,
 340                                              ObjOperandId objId, HandleId id,
 341                                              ValOperandId rhsId);
 342   AttachDecision tryAttachDOMProxyExpando(Handle<ProxyObject*> obj,
 343                                           ObjOperandId objId, HandleId id,
 344                                           ValOperandId rhsId);
 345   AttachDecision tryAttachProxy(HandleObject obj, ObjOperandId objId,
 346                                 HandleId id, ValOperandId rhsId);
 347   AttachDecision tryAttachProxyElement(HandleObject obj, ObjOperandId objId,
 348                                        ValOperandId rhsId);
 349   AttachDecision tryAttachMegamorphicSetElement(HandleObject obj,
 350                                                 ObjOperandId objId,
 351                                                 ValOperandId rhsId);
 352
 353   bool canAttachAddSlotStub(HandleObject obj, HandleId id);
 354
 355  public:
 356   SetPropIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 357                      CacheKind cacheKind, ICState state, HandleValue lhsVal,
 358                      HandleValue idVal, HandleValue rhsVal);
 359
 360   AttachDecision tryAttachStub();
 361   AttachDecision tryAttachAddSlotStub(Handle<Shape*> oldShape);
 362   void trackAttached(const char* name /* must be a C string literal */);
 363
 364   DeferType deferType() const { return deferType_; }
 365 };
 366
 367 // HasPropIRGenerator generates CacheIR for a HasProp IC. Used for
 368 // CacheKind::In / CacheKind::HasOwn.
 369 class MOZ_RAII HasPropIRGenerator : public IRGenerator {
 370   HandleValue val_;
 371   HandleValue idVal_;
 372
 373   AttachDecision tryAttachDense(HandleObject obj, ObjOperandId objId,
 374                                 uint32_t index, Int32OperandId indexId);
 375   AttachDecision tryAttachDenseHole(HandleObject obj, ObjOperandId objId,
 376                                     uint32_t index, Int32OperandId indexId);
 377   AttachDecision tryAttachTypedArray(HandleObject obj, ObjOperandId objId,
 378                                      ValOperandId keyId);
 379   AttachDecision tryAttachSparse(HandleObject obj, ObjOperandId objId,
 380                                  Int32OperandId indexId);
 381   AttachDecision tryAttachArgumentsObjectArg(HandleObject obj,
 382                                              ObjOperandId objId,
 383                                              Int32OperandId indexId);
 384   AttachDecision tryAttachNamedProp(HandleObject obj, ObjOperandId objId,
 385                                     HandleId key, ValOperandId keyId);
 386   AttachDecision tryAttachMegamorphic(ObjOperandId objId, ValOperandId keyId);
 387   AttachDecision tryAttachNative(NativeObject* obj, ObjOperandId objId,
 388                                  jsid key, ValOperandId keyId,
 389                                  PropertyResult prop, NativeObject* holder);
 390   AttachDecision tryAttachSlotDoesNotExist(NativeObject* obj,
 391                                            ObjOperandId objId, jsid key,
 392                                            ValOperandId keyId);
 393   AttachDecision tryAttachDoesNotExist(HandleObject obj, ObjOperandId objId,
 394                                        HandleId key, ValOperandId keyId);
 395   AttachDecision tryAttachProxyElement(HandleObject obj, ObjOperandId objId,
 396                                        ValOperandId keyId);
 397
 398   void trackAttached(const char* name /* must be a C string literal */);
 399
 400  public:
 401   // NOTE: Argument order is PROPERTY, OBJECT
 402   HasPropIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc,
 403                      ICState state, CacheKind cacheKind, HandleValue idVal,
 404                      HandleValue val);
 405
 406   AttachDecision tryAttachStub();
 407 };
 408
 409 class MOZ_RAII CheckPrivateFieldIRGenerator : public IRGenerator {
 410   HandleValue val_;
 411   HandleValue idVal_;
 412
 413   AttachDecision tryAttachNative(NativeObject* obj, ObjOperandId objId,
 414                                  jsid key, ValOperandId keyId,
 415                                  PropertyResult prop);
 416
 417   void trackAttached(const char* name /* must be a C string literal */);
 418
 419  public:
 420   CheckPrivateFieldIRGenerator(JSContext* cx, HandleScript script,
 421                                jsbytecode* pc, ICState state,
 422                                CacheKind cacheKind, HandleValue idVal,
 423                                HandleValue val);
 424   AttachDecision tryAttachStub();
 425 };
 426
 427 class MOZ_RAII InstanceOfIRGenerator : public IRGenerator {
 428   HandleValue lhsVal_;
 429   HandleObject rhsObj_;
 430
 431   void trackAttached(const char* name /* must be a C string literal */);
 432
 433  public:
 434   InstanceOfIRGenerator(JSContext*, HandleScript, jsbytecode*, ICState,
 435                         HandleValue, HandleObject);
 436
 437   AttachDecision tryAttachStub();
 438 };
 439
 440 class MOZ_RAII TypeOfIRGenerator : public IRGenerator {
 441   HandleValue val_;
 442
 443   AttachDecision tryAttachPrimitive(ValOperandId valId);
 444   AttachDecision tryAttachObject(ValOperandId valId);
 445   void trackAttached(const char* name /* must be a C string literal */);
 446
 447  public:
 448   TypeOfIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState state,
 449                     HandleValue value);
 450
 451   AttachDecision tryAttachStub();
 452 };
 453
 454 class MOZ_RAII GetIteratorIRGenerator : public IRGenerator {
 455   HandleValue val_;
 456
 457   AttachDecision tryAttachObject(ValOperandId valId);
 458   AttachDecision tryAttachNullOrUndefined(ValOperandId valId);
 459   AttachDecision tryAttachGeneric(ValOperandId valId);
 460
 461  public:
 462   GetIteratorIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 463                          ICState state, HandleValue value);
 464
 465   AttachDecision tryAttachStub();
 466
 467   void trackAttached(const char* name /* must be a C string literal */);
 468 };
 469
 470 class MOZ_RAII OptimizeSpreadCallIRGenerator : public IRGenerator {
 471   HandleValue val_;
 472
 473   AttachDecision tryAttachArray();
 474   AttachDecision tryAttachArguments();
 475   AttachDecision tryAttachNotOptimizable();
 476
 477  public:
 478   OptimizeSpreadCallIRGenerator(JSContext* cx, HandleScript script,
 479                                 jsbytecode* pc, ICState state,
 480                                 HandleValue value);
 481
 482   AttachDecision tryAttachStub();
 483
 484   void trackAttached(const char* name /* must be a C string literal */);
 485 };
 486
 487 enum class StringChar { CodeAt, At };
 488 enum class ScriptedThisResult { NoAction, UninitializedThis, PlainObjectShape };
 489
 490 class MOZ_RAII CallIRGenerator : public IRGenerator {
 491  private:
 492   JSOp op_;
 493   uint32_t argc_;
 494   HandleValue callee_;
 495   HandleValue thisval_;
 496   HandleValue newTarget_;
 497   HandleValueArray args_;
 498
 499   friend class InlinableNativeIRGenerator;
 500
 501   ScriptedThisResult getThisShapeForScripted(HandleFunction calleeFunc,
 502                                              Handle<JSObject*> newTarget,
 503                                              MutableHandle<Shape*> result);
 504
 505   ObjOperandId emitFunCallOrApplyGuard(Int32OperandId argcId);
 506   ObjOperandId emitFunCallGuard(Int32OperandId argcId);
 507   ObjOperandId emitFunApplyGuard(Int32OperandId argcId);
 508   mozilla::Maybe<ObjOperandId> emitFunApplyArgsGuard(
 509       CallFlags::ArgFormat format);
 510
 511   void emitCallScriptedGuards(ObjOperandId calleeObjId, JSFunction* calleeFunc,
 512                               Int32OperandId argcId, CallFlags flags,
 513                               Shape* thisShape, bool isBoundFunction);
 514
 515   AttachDecision tryAttachFunCall(HandleFunction calleeFunc);
 516   AttachDecision tryAttachFunApply(HandleFunction calleeFunc);
 517   AttachDecision tryAttachCallScripted(HandleFunction calleeFunc);
 518   AttachDecision tryAttachInlinableNative(HandleFunction calleeFunc,
 519                                           CallFlags flags);
 520   AttachDecision tryAttachWasmCall(HandleFunction calleeFunc);
 521   AttachDecision tryAttachCallNative(HandleFunction calleeFunc);
 522   AttachDecision tryAttachCallHook(HandleObject calleeObj);
 523   AttachDecision tryAttachBoundFunction(Handle<BoundFunctionObject*> calleeObj);
 524
 525   void trackAttached(const char* name /* must be a C string literal */);
 526
 527  public:
 528   CallIRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc, JSOp op,
 529                   ICState state, uint32_t argc, HandleValue callee,
 530                   HandleValue thisval, HandleValue newTarget,
 531                   HandleValueArray args);
 532
 533   AttachDecision tryAttachStub();
 534 };
 535
 536 class MOZ_RAII InlinableNativeIRGenerator {
 537   CallIRGenerator& generator_;
 538   CacheIRWriter& writer;
 539   JSContext* cx_;
 540
 541   HandleFunction callee_;
 542   HandleValue newTarget_;
 543   HandleValue thisval_;
 544   HandleValueArray args_;
 545   uint32_t argc_;
 546   CallFlags flags_;
 547
 548   HandleScript script() const { return generator_.script_; }
 549   bool isFirstStub() const { return generator_.isFirstStub_; }
 550   bool ignoresResult() const { return generator_.op_ == JSOp::CallIgnoresRv; }
 551
 552   void emitNativeCalleeGuard();
 553   void emitOptimisticClassGuard(ObjOperandId objId, JSObject* obj,
 554                                 GuardClassKind kind) {
 555     generator_.emitOptimisticClassGuard(objId, obj, kind);
 556   }
 557
 558   ObjOperandId emitLoadArgsArray();
 559
 560   void initializeInputOperand() {
 561     // The input operand is already initialized for FunCall and FunApplyArray.
 562     if (flags_.getArgFormat() == CallFlags::FunCall ||
 563         flags_.getArgFormat() == CallFlags::FunApplyArray) {
 564       return;
 565     }
 566     (void)writer.setInputOperandId(0);
 567   }
 568
 569   auto emitToStringGuard(ValOperandId id, const Value& v) {
 570     return generator_.emitToStringGuard(id, v);
 571   }
 572
 573   auto emitNumericGuard(ValOperandId valId, Scalar::Type type) {
 574     return generator_.emitNumericGuard(valId, type);
 575   }
 576
 577   auto guardToIntPtrIndex(const Value& index, ValOperandId indexId,
 578                           bool supportOOB) {
 579     return generator_.guardToIntPtrIndex(index, indexId, supportOOB);
 580   }
 581
 582   bool canAttachAtomicsReadWriteModify();
 583
 584   struct AtomicsReadWriteModifyOperands {
 585     ObjOperandId objId;
 586     IntPtrOperandId intPtrIndexId;
 587     OperandId numericValueId;
 588   };
 589
 590   AtomicsReadWriteModifyOperands emitAtomicsReadWriteModifyOperands();
 591
 592   AttachDecision tryAttachArrayPush();
 593   AttachDecision tryAttachArrayPopShift(InlinableNative native);
 594   AttachDecision tryAttachArrayJoin();
 595   AttachDecision tryAttachArraySlice();
 596   AttachDecision tryAttachArrayIsArray();
 597   AttachDecision tryAttachDataViewGet(Scalar::Type type);
 598   AttachDecision tryAttachDataViewSet(Scalar::Type type);
 599   AttachDecision tryAttachFunctionBind();
 600   AttachDecision tryAttachSpecializedFunctionBind(
 601       Handle<JSObject*> target, Handle<BoundFunctionObject*> templateObj);
 602   AttachDecision tryAttachUnsafeGetReservedSlot(InlinableNative native);
 603   AttachDecision tryAttachUnsafeSetReservedSlot();
 604   AttachDecision tryAttachIsSuspendedGenerator();
 605   AttachDecision tryAttachToObject();
 606   AttachDecision tryAttachToInteger();
 607   AttachDecision tryAttachToLength();
 608   AttachDecision tryAttachIsObject();
 609   AttachDecision tryAttachIsPackedArray();
 610   AttachDecision tryAttachIsCallable();
 611   AttachDecision tryAttachIsConstructor();
 612   AttachDecision tryAttachIsCrossRealmArrayConstructor();
 613   AttachDecision tryAttachGuardToClass(InlinableNative native);
 614   AttachDecision tryAttachHasClass(const JSClass* clasp,
 615                                    bool isPossiblyWrapped);
 616   AttachDecision tryAttachRegExpMatcherSearcher(InlinableNative native);
 617   AttachDecision tryAttachRegExpPrototypeOptimizable();
 618   AttachDecision tryAttachRegExpInstanceOptimizable();
 619   AttachDecision tryAttachIntrinsicRegExpBuiltinExec(InlinableNative native);
 620   AttachDecision tryAttachIntrinsicRegExpExec(InlinableNative native);
 621   AttachDecision tryAttachGetFirstDollarIndex();
 622   AttachDecision tryAttachSubstringKernel();
 623   AttachDecision tryAttachObjectHasPrototype();
 624   AttachDecision tryAttachString();
 625   AttachDecision tryAttachStringConstructor();
 626   AttachDecision tryAttachStringToStringValueOf();
 627   AttachDecision tryAttachStringChar(StringChar kind);
 628   AttachDecision tryAttachStringCharCodeAt();
 629   AttachDecision tryAttachStringCharAt();
 630   AttachDecision tryAttachStringFromCharCode();
 631   AttachDecision tryAttachStringFromCodePoint();
 632   AttachDecision tryAttachStringIndexOf();
 633   AttachDecision tryAttachStringStartsWith();
 634   AttachDecision tryAttachStringEndsWith();
 635   AttachDecision tryAttachStringToLowerCase();
 636   AttachDecision tryAttachStringToUpperCase();
 637   AttachDecision tryAttachStringReplaceString();
 638   AttachDecision tryAttachStringSplitString();
 639   AttachDecision tryAttachMathRandom();
 640   AttachDecision tryAttachMathAbs();
 641   AttachDecision tryAttachMathClz32();
 642   AttachDecision tryAttachMathSign();
 643   AttachDecision tryAttachMathImul();
 644   AttachDecision tryAttachMathFloor();
 645   AttachDecision tryAttachMathCeil();
 646   AttachDecision tryAttachMathTrunc();
 647   AttachDecision tryAttachMathRound();
 648   AttachDecision tryAttachMathSqrt();
 649   AttachDecision tryAttachMathFRound();
 650   AttachDecision tryAttachMathHypot();
 651   AttachDecision tryAttachMathATan2();
 652   AttachDecision tryAttachMathFunction(UnaryMathFunction fun);
 653   AttachDecision tryAttachMathPow();
 654   AttachDecision tryAttachMathMinMax(bool isMax);
 655   AttachDecision tryAttachSpreadMathMinMax(bool isMax);
 656   AttachDecision tryAttachIsTypedArray(bool isPossiblyWrapped);
 657   AttachDecision tryAttachIsTypedArrayConstructor();
 658   AttachDecision tryAttachTypedArrayByteOffset();
 659   AttachDecision tryAttachTypedArrayElementSize();
 660   AttachDecision tryAttachTypedArrayLength(bool isPossiblyWrapped);
 661   AttachDecision tryAttachArrayBufferByteLength(bool isPossiblyWrapped);
 662   AttachDecision tryAttachIsConstructing();
 663   AttachDecision tryAttachGetNextMapSetEntryForIterator(bool isMap);
 664   AttachDecision tryAttachNewArrayIterator();
 665   AttachDecision tryAttachNewStringIterator();
 666   AttachDecision tryAttachNewRegExpStringIterator();
 667   AttachDecision tryAttachArrayIteratorPrototypeOptimizable();
 668   AttachDecision tryAttachObjectCreate();
 669   AttachDecision tryAttachObjectConstructor();
 670   AttachDecision tryAttachArrayConstructor();
 671   AttachDecision tryAttachTypedArrayConstructor();
 672   AttachDecision tryAttachNumber();
 673   AttachDecision tryAttachNumberParseInt();
 674   AttachDecision tryAttachNumberToString();
 675   AttachDecision tryAttachReflectGetPrototypeOf();
 676   AttachDecision tryAttachAtomicsCompareExchange();
 677   AttachDecision tryAttachAtomicsExchange();
 678   AttachDecision tryAttachAtomicsAdd();
 679   AttachDecision tryAttachAtomicsSub();
 680   AttachDecision tryAttachAtomicsAnd();
 681   AttachDecision tryAttachAtomicsOr();
 682   AttachDecision tryAttachAtomicsXor();
 683   AttachDecision tryAttachAtomicsLoad();
 684   AttachDecision tryAttachAtomicsStore();
 685   AttachDecision tryAttachAtomicsIsLockFree();
 686   AttachDecision tryAttachBoolean();
 687   AttachDecision tryAttachBailout();
 688   AttachDecision tryAttachAssertFloat32();
 689   AttachDecision tryAttachAssertRecoveredOnBailout();
 690   AttachDecision tryAttachObjectIs();
 691   AttachDecision tryAttachObjectIsPrototypeOf();
 692   AttachDecision tryAttachObjectToString();
 693   AttachDecision tryAttachBigIntAsIntN();
 694   AttachDecision tryAttachBigIntAsUintN();
 695   AttachDecision tryAttachSetHas();
 696   AttachDecision tryAttachMapHas();
 697   AttachDecision tryAttachMapGet();
 698 #ifdef FUZZING_JS_FUZZILLI
 699   AttachDecision tryAttachFuzzilliHash();
 700 #endif
 701
 702   void trackAttached(const char* name /* must be a C string literal */) {
 703     return generator_.trackAttached(name);
 704   }
 705
 706  public:
 707   InlinableNativeIRGenerator(CallIRGenerator& generator, HandleFunction callee,
 708                              HandleValue newTarget, HandleValue thisValue,
 709                              HandleValueArray args, CallFlags flags)
 710       : generator_(generator),
 711         writer(generator.writer),
 712         cx_(generator.cx_),
 713         callee_(callee),
 714         newTarget_(newTarget),
 715         thisval_(thisValue),
 716         args_(args),
 717         argc_(args.length()),
 718         flags_(flags) {}
 719
 720   AttachDecision tryAttachStub();
 721 };
 722
 723 class MOZ_RAII CompareIRGenerator : public IRGenerator {
 724   JSOp op_;
 725   HandleValue lhsVal_;
 726   HandleValue rhsVal_;
 727
 728   AttachDecision tryAttachString(ValOperandId lhsId, ValOperandId rhsId);
 729   AttachDecision tryAttachObject(ValOperandId lhsId, ValOperandId rhsId);
 730   AttachDecision tryAttachSymbol(ValOperandId lhsId, ValOperandId rhsId);
 731   AttachDecision tryAttachStrictDifferentTypes(ValOperandId lhsId,
 732                                                ValOperandId rhsId);
 733   AttachDecision tryAttachInt32(ValOperandId lhsId, ValOperandId rhsId);
 734   AttachDecision tryAttachNumber(ValOperandId lhsId, ValOperandId rhsId);
 735   AttachDecision tryAttachBigInt(ValOperandId lhsId, ValOperandId rhsId);
 736   AttachDecision tryAttachAnyNullUndefined(ValOperandId lhsId,
 737                                            ValOperandId rhsId);
 738   AttachDecision tryAttachNullUndefined(ValOperandId lhsId, ValOperandId rhsId);
 739   AttachDecision tryAttachStringNumber(ValOperandId lhsId, ValOperandId rhsId);
 740   AttachDecision tryAttachPrimitiveSymbol(ValOperandId lhsId,
 741                                           ValOperandId rhsId);
 742   AttachDecision tryAttachBigIntInt32(ValOperandId lhsId, ValOperandId rhsId);
 743   AttachDecision tryAttachBigIntNumber(ValOperandId lhsId, ValOperandId rhsId);
 744   AttachDecision tryAttachBigIntString(ValOperandId lhsId, ValOperandId rhsId);
 745
 746   void trackAttached(const char* name /* must be a C string literal */);
 747
 748  public:
 749   CompareIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState state,
 750                      JSOp op, HandleValue lhsVal, HandleValue rhsVal);
 751
 752   AttachDecision tryAttachStub();
 753 };
 754
 755 class MOZ_RAII ToBoolIRGenerator : public IRGenerator {
 756   HandleValue val_;
 757
 758   AttachDecision tryAttachBool();
 759   AttachDecision tryAttachInt32();
 760   AttachDecision tryAttachNumber();
 761   AttachDecision tryAttachString();
 762   AttachDecision tryAttachSymbol();
 763   AttachDecision tryAttachNullOrUndefined();
 764   AttachDecision tryAttachObject();
 765   AttachDecision tryAttachBigInt();
 766
 767   void trackAttached(const char* name /* must be a C string literal */);
 768
 769  public:
 770   ToBoolIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc, ICState state,
 771                     HandleValue val);
 772
 773   AttachDecision tryAttachStub();
 774 };
 775
 776 class MOZ_RAII GetIntrinsicIRGenerator : public IRGenerator {
 777   HandleValue val_;
 778
 779   void trackAttached(const char* name /* must be a C string literal */);
 780
 781  public:
 782   GetIntrinsicIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 783                           ICState state, HandleValue val);
 784
 785   AttachDecision tryAttachStub();
 786 };
 787
 788 class MOZ_RAII UnaryArithIRGenerator : public IRGenerator {
 789   JSOp op_;
 790   HandleValue val_;
 791   HandleValue res_;
 792
 793   AttachDecision tryAttachInt32();
 794   AttachDecision tryAttachNumber();
 795   AttachDecision tryAttachBitwise();
 796   AttachDecision tryAttachBigInt();
 797   AttachDecision tryAttachStringInt32();
 798   AttachDecision tryAttachStringNumber();
 799
 800   void trackAttached(const char* name /* must be a C string literal */);
 801
 802  public:
 803   UnaryArithIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 804                         ICState state, JSOp op, HandleValue val,
 805                         HandleValue res);
 806
 807   AttachDecision tryAttachStub();
 808 };
 809
 810 class MOZ_RAII ToPropertyKeyIRGenerator : public IRGenerator {
 811   HandleValue val_;
 812
 813   AttachDecision tryAttachInt32();
 814   AttachDecision tryAttachNumber();
 815   AttachDecision tryAttachString();
 816   AttachDecision tryAttachSymbol();
 817
 818   void trackAttached(const char* name /* must be a C string literal */);
 819
 820  public:
 821   ToPropertyKeyIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 822                            ICState state, HandleValue val);
 823
 824   AttachDecision tryAttachStub();
 825 };
 826
 827 class MOZ_RAII BinaryArithIRGenerator : public IRGenerator {
 828   JSOp op_;
 829   HandleValue lhs_;
 830   HandleValue rhs_;
 831   HandleValue res_;
 832
 833   void trackAttached(const char* name /* must be a C string literal */);
 834
 835   AttachDecision tryAttachInt32();
 836   AttachDecision tryAttachDouble();
 837   AttachDecision tryAttachBitwise();
 838   AttachDecision tryAttachStringConcat();
 839   AttachDecision tryAttachStringObjectConcat();
 840   AttachDecision tryAttachBigInt();
 841   AttachDecision tryAttachStringInt32Arith();
 842
 843  public:
 844   BinaryArithIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 845                          ICState state, JSOp op, HandleValue lhs,
 846                          HandleValue rhs, HandleValue res);
 847
 848   AttachDecision tryAttachStub();
 849 };
 850
 851 class MOZ_RAII NewArrayIRGenerator : public IRGenerator {
 852 #ifdef JS_CACHEIR_SPEW
 853   JSOp op_;
 854 #endif
 855   HandleObject templateObject_;
 856   BaselineFrame* frame_;
 857
 858   void trackAttached(const char* name /* must be a C string literal */);
 859
 860  public:
 861   NewArrayIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 862                       ICState state, JSOp op, HandleObject templateObj,
 863                       BaselineFrame* frame);
 864
 865   AttachDecision tryAttachStub();
 866   AttachDecision tryAttachArrayObject();
 867 };
 868
 869 class MOZ_RAII NewObjectIRGenerator : public IRGenerator {
 870 #ifdef JS_CACHEIR_SPEW
 871   JSOp op_;
 872 #endif
 873   HandleObject templateObject_;
 874   BaselineFrame* frame_;
 875
 876   void trackAttached(const char* name /* must be a C string literal */);
 877
 878  public:
 879   NewObjectIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 880                        ICState state, JSOp op, HandleObject templateObj,
 881                        BaselineFrame* frame);
 882
 883   AttachDecision tryAttachStub();
 884   AttachDecision tryAttachPlainObject();
 885 };
 886
 887 inline bool BytecodeOpCanHaveAllocSite(JSOp op) {
 888   return op == JSOp::NewArray || op == JSOp::NewObject || op == JSOp::NewInit;
 889 }
 890
 891 class MOZ_RAII CloseIterIRGenerator : public IRGenerator {
 892   HandleObject iter_;
 893   CompletionKind kind_;
 894
 895   void trackAttached(const char* name /* must be a C string literal */);
 896
 897  public:
 898   CloseIterIRGenerator(JSContext* cx, HandleScript, jsbytecode* pc,
 899                        ICState state, HandleObject iter, CompletionKind kind);
 900
 901   AttachDecision tryAttachStub();
 902   AttachDecision tryAttachNoReturnMethod();
 903   AttachDecision tryAttachScriptedReturn();
 904 };
 905
 906 // Retrieve Xray JIT info set by the embedder.
 907 extern JS::XrayJitInfo* GetXrayJitInfo();
 908
 909 }  // namespace jit
 910 }  // namespace js
 911
 912 #endif /* jit_CacheIRGenerator_h */