1/*
2 * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#pragma once
27
28#if ENABLE(DFG_JIT)
29
30#include "DFGArrayMode.h"
31#include "DFGOSRExitJumpPlaceholder.h"
32#include "DFGOperations.h"
33#include "DFGSlowPathGenerator.h"
34#include "DFGSpeculativeJIT.h"
35#include <wtf/Vector.h>
36
37namespace JSC { namespace DFG {
38
39class ArrayifySlowPathGenerator : public JumpingSlowPathGenerator<MacroAssembler::JumpList> {
40public:
41 ArrayifySlowPathGenerator(
42 const MacroAssembler::JumpList& from, SpeculativeJIT* jit, Node* node, GPRReg baseGPR,
43 GPRReg propertyGPR, GPRReg tempGPR, GPRReg structureGPR)
44 : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
45 , m_op(node->op())
46 , m_structure(node->op() == ArrayifyToStructure ? node->structure() : RegisteredStructure())
47 , m_arrayMode(node->arrayMode())
48 , m_baseGPR(baseGPR)
49 , m_propertyGPR(propertyGPR)
50 , m_tempGPR(tempGPR)
51 , m_structureGPR(structureGPR)
52 {
53 ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
54
55 jit->silentSpillAllRegistersImpl(false, m_plans, InvalidGPRReg);
56
57 if (m_propertyGPR != InvalidGPRReg) {
58 switch (m_arrayMode.type()) {
59 case Array::Int32:
60 case Array::Double:
61 case Array::Contiguous:
62 m_badPropertyJump = jit->speculationCheck(Uncountable, JSValueRegs(), 0);
63 break;
64 default:
65 break;
66 }
67 }
68 m_badIndexingTypeJump = jit->speculationCheck(BadIndexingType, JSValueSource::unboxedCell(m_baseGPR), 0);
69 }
70
71protected:
72 void generateInternal(SpeculativeJIT* jit) override
73 {
74 linkFrom(jit);
75
76 ASSERT(m_op == Arrayify || m_op == ArrayifyToStructure);
77
78 if (m_propertyGPR != InvalidGPRReg) {
79 switch (m_arrayMode.type()) {
80 case Array::Int32:
81 case Array::Double:
82 case Array::Contiguous:
83 m_badPropertyJump.fill(jit, jit->m_jit.branch32(
84 MacroAssembler::AboveOrEqual, m_propertyGPR,
85 MacroAssembler::TrustedImm32(MIN_SPARSE_ARRAY_INDEX)));
86 break;
87 default:
88 break;
89 }
90 }
91
92 for (unsigned i = 0; i < m_plans.size(); ++i)
93 jit->silentSpill(m_plans[i]);
94 VM& vm = jit->vm();
95 switch (m_arrayMode.type()) {
96 case Array::Int32:
97 jit->callOperation(operationEnsureInt32, m_tempGPR, &vm, m_baseGPR);
98 break;
99 case Array::Double:
100 jit->callOperation(operationEnsureDouble, m_tempGPR, &vm, m_baseGPR);
101 break;
102 case Array::Contiguous:
103 jit->callOperation(operationEnsureContiguous, m_tempGPR, &vm, m_baseGPR);
104 break;
105 case Array::ArrayStorage:
106 case Array::SlowPutArrayStorage:
107 jit->callOperation(operationEnsureArrayStorage, m_tempGPR, &vm, m_baseGPR);
108 break;
109 default:
110 CRASH();
111 break;
112 }
113 for (unsigned i = m_plans.size(); i--;)
114 jit->silentFill(m_plans[i]);
115 jit->m_jit.exceptionCheck();
116
117 if (m_op == ArrayifyToStructure) {
118 ASSERT(m_structure.get());
119 m_badIndexingTypeJump.fill(
120 jit, jit->m_jit.branchWeakStructure(MacroAssembler::NotEqual, MacroAssembler::Address(m_baseGPR, JSCell::structureIDOffset()), m_structure));
121 } else {
122 // Finally, check that we have the kind of array storage that we wanted to get.
123 // Note that this is a backwards speculation check, which will result in the
124 // bytecode operation corresponding to this arrayification being reexecuted.
125 // That's fine, since arrayification is not user-visible.
126 jit->m_jit.load8(
127 MacroAssembler::Address(m_baseGPR, JSCell::indexingTypeAndMiscOffset()),
128 m_structureGPR);
129 m_badIndexingTypeJump.fill(
130 jit, jit->jumpSlowForUnwantedArrayMode(m_structureGPR, m_arrayMode));
131 }
132
133 jumpTo(jit);
134 }
135
136private:
137 NodeType m_op;
138 RegisteredStructure m_structure;
139 ArrayMode m_arrayMode;
140 GPRReg m_baseGPR;
141 GPRReg m_propertyGPR;
142 GPRReg m_tempGPR;
143 GPRReg m_structureGPR;
144 OSRExitJumpPlaceholder m_badPropertyJump;
145 OSRExitJumpPlaceholder m_badIndexingTypeJump;
146 Vector<SilentRegisterSavePlan, 2> m_plans;
147};
148
149} } // namespace JSC::DFG
150
151#endif // ENABLE(DFG_JIT)
152