1/*
2 * Copyright (C) 2015 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "config.h"
27#include "DFGClobbersExitState.h"
28
29#if ENABLE(DFG_JIT)
30
31#include "DFGClobberize.h"
32#include "DFGGraph.h"
33#include "DFGNode.h"
34#include "JSCInlines.h"
35
36namespace JSC { namespace DFG {
37
38bool clobbersExitState(Graph& graph, Node* node)
39{
40 // There are certain nodes whose effect on the exit state has nothing to do with what they
41 // normally clobber.
42 switch (node->op()) {
43 case InitializeEntrypointArguments:
44 case MovHint:
45 case ZombieHint:
46 case PutHint:
47 case KillStack:
48 return true;
49
50 case SetLocal:
51 case PutStack:
52 // These nodes write to the stack, but they may only do so after we have already had a MovHint
53 // for the exact same value and the same stack location. Hence, they have no further effect on
54 // exit state.
55 return false;
56
57 case ArrayifyToStructure:
58 case Arrayify:
59 case NewObject:
60 case NewPromise:
61 case NewGenerator:
62 case NewAsyncGenerator:
63 case NewRegexp:
64 case NewSymbol:
65 case NewStringObject:
66 case PhantomNewObject:
67 case MaterializeNewObject:
68 case PhantomNewFunction:
69 case PhantomNewGeneratorFunction:
70 case PhantomNewAsyncGeneratorFunction:
71 case PhantomNewAsyncFunction:
72 case PhantomCreateActivation:
73 case MaterializeCreateActivation:
74 case PhantomNewRegexp:
75 case CountExecution:
76 case SuperSamplerBegin:
77 case SuperSamplerEnd:
78 case StoreBarrier:
79 case FencedStoreBarrier:
80 case AllocatePropertyStorage:
81 case ReallocatePropertyStorage:
82 case FilterCallLinkStatus:
83 case FilterGetByStatus:
84 case FilterPutByIdStatus:
85 case FilterInByIdStatus:
86 // These do clobber memory, but nothing that is observable. It may be nice to separate the
87 // heaps into those that are observable and those that aren't, but we don't do that right now.
88 // FIXME: https://bugs.webkit.org/show_bug.cgi?id=148440
89 return false;
90
91 case CreateActivation:
92 // Like above, but with the activation allocation caveat.
93 return node->castOperand<SymbolTable*>()->singleton().isStillValid();
94
95 case NewFunction:
96 case NewGeneratorFunction:
97 case NewAsyncGeneratorFunction:
98 case NewAsyncFunction:
99 // Like above, but with the JSFunction allocation caveat.
100 return node->castOperand<FunctionExecutable*>()->singleton().isStillValid();
101
102 default:
103 // For all other nodes, we just care about whether they write to something other than SideState.
104 bool result = false;
105 clobberize(
106 graph, node, NoOpClobberize(),
107 [&] (const AbstractHeap& heap) {
108 // There shouldn't be such a thing as a strict subtype of SideState. That's what allows
109 // us to use a fast != check, below.
110 ASSERT(!heap.isStrictSubtypeOf(SideState));
111
112 if (heap != SideState)
113 result = true;
114 },
115 NoOpClobberize());
116 return result;
117 }
118}
119
120} } // namespace JSC::DFG
121
122#endif // ENABLE(DFG_JIT)
123