1/*
2 * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#pragma once
27
28#if ENABLE(DFG_JIT)
29
30#include "DFGArrayMode.h"
31#include "DFGOSRExitJumpPlaceholder.h"
32#include "DFGOperations.h"
33#include "DFGSlowPathGenerator.h"
34#include "DFGSpeculativeJIT.h"
35#include <wtf/Vector.h>
36
37namespace JSC { namespace DFG {
38
39class ArrayifySlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
40public:
41 ArrayifySlowPathGenerator(
42 const MacroAssembler::JumpList& from, SpeculativeJIT* jit, Node* node, GPRReg baseGPR,
43 GPRReg propertyGPR, GPRReg tempGPR, GPRReg structureGPR)
44 : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
45 , m_op(node->op())
46 , m_structure(node->op() == ArrayifyToStructure ? node->structure() : RegisteredStructure())
47 , m_arrayMode(node->arrayMode())
48 , m_baseGPR(baseGPR)
49 , m_propertyGPR(propertyGPR)
50 , m_tempGPR(tempGPR)
51 , m_structureGPR(structureGPR)
52 {
53 ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
54
55 jit->silentSpillAllRegistersImpl(false, m_plans, InvalidGPRReg);
56
57 if (m_propertyGPR != InvalidGPRReg) {
58 switch (m_arrayMode.type()) {
59 case Array::Int32:
60 case Array::Double:
61 case Array::Contiguous:
62 m_badPropertyJump = jit->speculationCheck(Uncountable, JSValueRegs(), 0);
63 break;
64 default:
65 break;
66 }
67 }
68 m_badIndexingTypeJump = jit->speculationCheck(BadIndexingType, JSValueSource::unboxedCell(m_baseGPR), 0);
69 }
70
71protected:
72 void generateInternal(SpeculativeJIT* jit) override
73 {
74 linkFrom(jit);
75
76 ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
77
78 if (m_propertyGPR != InvalidGPRReg) {
79 switch (m_arrayMode.type()) {
80 case Array::Int32:
81 case Array::Double:
82 case Array::Contiguous:
83 m_badPropertyJump.fill(jit, jit->m_jit.branch32(
84 MacroAssembler::AboveOrEqual, m_propertyGPR,
85 MacroAssembler::TrustedImm32(MIN_SPARSE_ARRAY_INDEX)));
86 break;
87 default:
88 break;
89 }
90 }
91
92 for (unsigned i = 0; i < m_plans.size(); ++i)
93 jit->silentSpill(m_plans[i]);
94 switch (m_arrayMode.type()) {
95 case Array::Int32:
96 jit->callOperation(operationEnsureInt32, m_tempGPR, m_baseGPR);
97 break;
98 case Array::Double:
99 jit->callOperation(operationEnsureDouble, m_tempGPR, m_baseGPR);
100 break;
101 case Array::Contiguous:
102 jit->callOperation(operationEnsureContiguous, m_tempGPR, m_baseGPR);
103 break;
104 case Array::ArrayStorage:
105 case Array::SlowPutArrayStorage:
106 jit->callOperation(operationEnsureArrayStorage, m_tempGPR, m_baseGPR);
107 break;
108 default:
109 CRASH();
110 break;
111 }
112 for (unsigned i = m_plans.size(); i--;)
113 jit->silentFill(m_plans[i]);
114 jit->m_jit.exceptionCheck();
115
116 if (m_op == ArrayifyToStructure) {
117 ASSERT(m_structure.get());
118 m_badIndexingTypeJump.fill(
119 jit, jit->m_jit.branchWeakStructure(MacroAssembler::NotEqual, MacroAssembler::Address(m_baseGPR, JSCell::structureIDOffset()), m_structure));
120 } else {
121 // Finally, check that we have the kind of array storage that we wanted to get.
122 // Note that this is a backwards speculation check, which will result in the
123 // bytecode operation corresponding to this arrayification being reexecuted.
124 // That's fine, since arrayification is not user-visible.
125 jit->m_jit.load8(
126 MacroAssembler::Address(m_baseGPR, JSCell::indexingTypeAndMiscOffset()),
127 m_structureGPR);
128 m_badIndexingTypeJump.fill(
129 jit, jit->jumpSlowForUnwantedArrayMode(m_structureGPR, m_arrayMode));
130 }
131
132 jumpTo(jit);
133 }
134
135private:
136 NodeType m_op;
137 RegisteredStructure m_structure;
138 ArrayMode m_arrayMode;
139 GPRReg m_baseGPR;
140 GPRReg m_propertyGPR;
141 GPRReg m_tempGPR;
142 GPRReg m_structureGPR;
143 OSRExitJumpPlaceholder m_badPropertyJump;
144 OSRExitJumpPlaceholder m_badIndexingTypeJump;
145 Vector<SilentRegisterSavePlan, 2> m_plans;
146};
147
148} } // namespace JSC::DFG
149
150#endif // ENABLE(DFG_JIT)
151