Attachment #702295 for bug #568953

Attachment #702295: Bytecode emitter support for bug #568953

View | Details | Raw Unified | Return to bug 568953
Collapse All | Expand All





#include "jsversion.h"
#include "jsfun.h"
#include "jsnum.h"
#include "jsopcode.h"
#include "jsscope.h"
#include "jsscript.h"
#include "jsautooplen.h"        // generated headers last

#include "builtin/Module.h"
#include "ds/LifoAlloc.h"
#include "frontend/BytecodeEmitter.h"
#include "frontend/Parser.h"
#include "frontend/TokenStream.h"
#include "vm/Debugger.h"
#include "vm/RegExpObject.h"

#include "jsatominlines.h"

 * block object or compiler created function.
 */
static JSObject *
EnclosingStaticScope(BytecodeEmitter *bce)
{
    if (bce->blockChain)
        return bce->blockChain;

    if (bce->sc->isGlobalSharedContext()) {
        JS_ASSERT(!bce->parent);
        return NULL;
    } else if (bce->sc->isModuleBox()) {
        return bce->sc->asModuleBox()->module();
    } else {
        return bce->sc->asFunctionBox()->function();
    }
}

// Push a block scope statement and link blockObj into bce->blockChain.
static void
PushBlockScopeBCE(BytecodeEmitter *bce, StmtInfoBCE *stmt, StaticBlockObject &blockObj,
                  ptrdiff_t top)
{
    PushStatementBCE(bce, stmt, STMT_BLOCK, top);

    }

    return EmitAliasedVarOp(cx, op, sc, bce);
}

static bool
EmitVarOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
{
    JS_ASSERT(pn->isKind(PNK_MODULE) || pn->isKind(PNK_FUNCTION) || pn->isKind(PNK_NAME));
    JS_ASSERT_IF(pn->isKind(PNK_NAME), IsArgOp(op) || IsLocalOp(op));
    JS_ASSERT(!pn->pn_cookie.isFree());

    if (!bce->isAliasedName(pn)) {
        JS_ASSERT(pn->isUsed() || pn->isDefn());
        JS_ASSERT_IF(pn->isUsed(), pn->pn_cookie.level() == 0);
        JS_ASSERT_IF(pn->isDefn(), pn->pn_cookie.level() == bce->script->staticLevel);
        return EmitUnaliasedVarOp(cx, op, pn->pn_cookie.slot(), bce);

     * bloat where a single live function keeps its whole global script
     * alive.), ScopeCoordinateToTypeSet is not able to find the var/let's
     * associated types::TypeSet.
     */
    if (skip) {
        BytecodeEmitter *bceSkipped = bce;
        for (unsigned i = 0; i < skip; i++)
            bceSkipped = bceSkipped->parent;
        if (bceSkipped->sc->isGlobalSharedContext())
            return true;
    }

    JS_ASSERT(!pn->isOp(op));
    pn->setOp(op);
    if (!pn->pn_cookie.set(bce->sc->context, skip, dn->pn_cookie.slot()))
        return false;


            return true;
    }
    return false;
}

void
BytecodeEmitter::tellDebuggerAboutCompiledScript(JSContext *cx)
{
    RootedFunction function(cx, script->isFunctionScript() ? script->function() : NULL);
    CallNewScriptHook(cx, script, function);
    if (!parent) {
        GlobalObject *compileAndGoGlobal = NULL;
        if (script->compileAndGo)
            compileAndGoGlobal = &script->global();
        Debugger::onNewScript(cx, script, compileAndGoGlobal);
    }
}

EmitFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
{
    JS_ASSERT(pn->pn_left->isKind(PNK_FORIN) || pn->pn_left->isKind(PNK_FORHEAD));
    return pn->pn_left->isKind(PNK_FORIN)
           ? EmitForIn(cx, bce, pn, top)
           : EmitNormalFor(cx, bce, pn, top);
}

static bool
EmitModule(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
{
    if (pn->pn_modulebox->module()->script()) {
        return EmitIndex32(cx, JSOP_INITMODULE,
                           bce->objectList.indexOf(pn->pn_modulebox->module()),
                           bce);
    }

    RootedScript enclosingScript(cx, bce->script);
    RootedObject enclosingScope(cx, EnclosingStaticScope(bce));
    CompileOptions options(cx);
    options.setPrincipals(enclosingScript->principals)
           .setOriginPrincipals(enclosingScript->originPrincipals)
           .setCompileAndGo(enclosingScript->compileAndGo)
           .setNoScriptRval(false)
           .setVersion(enclosingScript->getVersion());
    RootedScript script(cx, JSScript::Create(cx, enclosingScope, false, options,
                                             enclosingScript->staticLevel + 1,
                                             enclosingScript->scriptSource(),
                                             pn->pn_modulebox->bufStart,
                                             pn->pn_modulebox->bufEnd));
    if (!script)
        return false;
    script->bindings = pn->pn_modulebox->bindings;
    BytecodeEmitter bce2(bce, bce->parser, pn->pn_modulebox, script,
                         bce->callerFrame, bce->hasGlobalScope,
                         pn->pn_pos.begin.lineno, bce->selfHostingMode);
    if (!bce2.init())
        return false;
    if (!EmitTree(cx, &bce2, pn->pn_body))
        return false;
    if (Emit1(cx, &bce2, JSOP_STOP) < 0)
        return false;
    if (!JSScript::fullyInitFromEmitter(cx, bce2.script, &bce2))
        return false;
    pn->pn_modulebox->module()->setScript(script);

    if (bce->sc->isGlobalSharedContext()) {
        unsigned index = bce->objectList.add(pn->pn_modulebox);
        bce->switchToProlog();
        if (!EmitIndex32(cx, JSOP_DEFMODULE, index, bce))
            return false;
        bce->switchToMain();
        if (!EmitIndex32(cx, JSOP_INITMODULE, index, bce))
            return false;
    } else {
        JS_ASSERT(bce->sc->isModuleBox());
        if (!EmitObjectOp(cx, pn->pn_modulebox, JSOP_MODULE, bce))
            return false;
        if (!EmitVarOp(cx, pn, JSOP_SETLOCAL, bce))
            return false;
        if (Emit1(cx, bce, JSOP_POP) < 0)
            return false;
    }
    return true;
}

static JS_NEVER_INLINE bool
EmitFunc(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
{
    AssertCanGC();
    RootedFunction fun(cx, pn->pn_funbox->function());
    JS_ASSERT(fun->isInterpreted());
    if (fun->hasScript()) {
        /*

     * For a script we emit the code as we parse. Thus the bytecode for
     * top-level functions should go in the prolog to predefine their
     * names in the variable object before the already-generated main code
     * is executed. This extra work for top-level scripts is not necessary
     * when we emit the code for a function. It is fully parsed prior to
     * invocation of the emitter and calls to EmitTree for function
     * definitions can be scheduled before generating the rest of code.
     */
    if (bce->sc->isGlobalSharedContext()) {
        JS_ASSERT(pn->pn_cookie.isFree());
        JS_ASSERT(pn->getOp() == JSOP_NOP);
        JS_ASSERT(!bce->topStmt);
        bce->switchToProlog();
        if (!EmitIndex32(cx, JSOP_DEFFUN, index, bce))
            return false;
        if (!UpdateSourceCoordNotes(cx, bce, pn->pn_pos.begin))
            return false;

    ptrdiff_t top = bce->offset();
    pn->pn_offset = top;

    /* Emit notes to tell the current bytecode's source line number. */
    if (!UpdateLineNumberNotes(cx, bce, pn->pn_pos.begin.lineno))
        return false;

    switch (pn->getKind()) {
      case PNK_MODULE:
        ok = EmitModule(cx, bce, pn);
        break;

      case PNK_FUNCTION:
        ok = EmitFunc(cx, bce, pn);
        break;

      case PNK_ARGSBODY:
      {
        RootedFunction fun(cx, bce->sc->asFunctionBox()->function());
        ParseNode *pnlast = pn->last();

        if (!EmitTree(cx, bce, pn->pn_kid))
            return false;
        if (Emit1(cx, bce, pn->getOp()) < 0)
            return false;
        break;
#endif

      case PNK_STATEMENTLIST:
        if (pn->pn_xflags & PNX_MODULEDEFS) {
            for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
                if (pn2->isKind(PNK_MODULE)) {
                    if (!EmitTree(cx, bce, pn2))
                        return false;
                }
            }
        }
        ok = EmitStatementList(cx, bce, pn, top);
        break;

      case PNK_SEQ:
        ok = EmitSyntheticStatements(cx, bce, pn, top);
        break;

      case PNK_SEMI:


#if JS_HAS_BLOCK_SCOPE
      case PNK_LET:
        ok = pn->isArity(PN_BINARY)
             ? EmitLet(cx, bce, pn)
             : EmitVariables(cx, bce, pn, InitializeVars);
        break;
#endif /* JS_HAS_BLOCK_SCOPE */

      case PNK_EXPORT:
        ok = EmitTree(cx, bce, pn->pn_kid);
        break;

#if JS_HAS_GENERATORS
      case PNK_ARRAYPUSH: {
        int slot;

        /*
         * The array object's stack index is in bce->arrayCompDepth. See below
         * under the array initialiser code generator for array comprehension
         * special casing. Note that the array object is a pure stack value,





            for (;;) {
                CloseLiveIterators(cx, frames);

                // When profiling, each frame popped needs a notification that
                // the function has exited, so invoke the probe that a function
                // is exiting.
                AutoAssertNoGC nogc;
                RawScript script = frames.script();
                Probes::exitScript(cx, script,
                                   script->isFunctionScript() ? script->function() : NULL,
                                   NULL);
                if (!frames.more())
                    break;
                ++frames;
            }

            IonScript *ionScript;
            if (iter.checkInvalidation(&ionScript))
                ionScript->decref(cx->runtime->defaultFreeOp());





    // scripts. This means we have to subtract 1 for global/eval scripts.
    JS_ASSERT(ThisSlot() == 1);
    JS_ASSERT(ArgSlot(0) == 2);

#ifdef DEBUG
    uint32_t stackDepth = analysis->getCode(osrPc).stackDepth;
#endif

    if (script()->isFunctionScript()) {
        JS_ASSERT(slotTypes.length() == TotalSlots(script()) + stackDepth);

        for (size_t i = ThisSlot(); i < TotalSlots(script()); i++)
            slotTypes[i] = getMIRType(slotTypeSets[i]);
    } else {
        JS_ASSERT(slotTypes.length() == TotalSlots(script()) + stackDepth - 1);

        for (size_t i = ArgSlot(0); i < TotalSlots(script()); i++)






    /*
     * If the script is in debug mode, JS_SetFrameReturnValue can be called at
     * any safe point.
     */
    if (cx->compartment->debugMode())
        usesReturnValue_ = true;

    bool heavyweight = script_->isFunctionScript() && script_->function() && script_->function()->isHeavyweight();

    isJaegerCompileable = true;

    isJaegerInlineable = isIonInlineable = true;
    if (heavyweight || cx->compartment->debugMode())
        isJaegerInlineable = isIonInlineable = false;
    if (script_->argumentsHasVarBinding())
        isJaegerInlineable = false;





}
static inline uint32_t ThisSlot() {
    return 1;
}
static inline uint32_t ArgSlot(uint32_t arg) {
    return 2 + arg;
}
static inline uint32_t LocalSlot(UnrootedScript script, uint32_t local) {
    return 2 + (script->isFunctionScript() ? script->function()->nargs : 0) + local;
}
static inline uint32_t TotalSlots(UnrootedScript script) {
    return LocalSlot(script, 0) + script->nfixed;
}

static inline uint32_t StackSlot(UnrootedScript script, uint32_t index) {
    return TotalSlots(script) + index;
}





JS_PUBLIC_API(JSString *)
JS_DecompileScript(JSContext *cx, JSScript *scriptArg, const char *name, unsigned indent)
{
    JS_THREADSAFE_ASSERT(cx->compartment != cx->runtime->atomsCompartment);

    AssertHeapIsIdle(cx);
    CHECK_REQUEST(cx);
    RootedScript script(cx, scriptArg);
    RootedFunction fun(cx, script->isFunctionScript() ? script->function() : NULL);
    if (fun)
        return JS_DecompileFunction(cx, fun, indent);
    bool haveSource = script->scriptSource()->hasSourceData();
    if (!haveSource && !JSScript::loadSource(cx, script, &haveSource))
        return NULL;
    return haveSource ? script->sourceData(cx) : js_NewStringCopyZ(cx, "[no source]");
}






    if (!XDRScript(xdr, enclosingScope, enclosingScript, fun, &script))
        return false;

    if (mode == XDR_DECODE) {
        fun->nargs = flagsword >> 16;
        fun->flags = uint16_t(flagsword);
        fun->initAtom(atom);
        fun->initScript(script);
        script->setOwner(fun);
        if (!JSFunction::setTypeForScriptedFunction(cx, fun))
            return false;
        JS_ASSERT(fun->nargs == fun->nonLazyScript()->bindings.numArgs());
        RootedScript script(cx, fun->nonLazyScript());
        CallNewScriptHook(cx, script, fun);
        objp.set(fun);
    }


    RootedScript clonedScript(cx, CloneScript(cx, enclosingScope, clone, srcScript));
    if (!clonedScript)
        return NULL;

    clone->nargs = srcFun->nargs;
    clone->flags = srcFun->flags;
    clone->initAtom(srcFun->displayAtom());
    clone->initScript(clonedScript);
    clonedScript->setOwner(clone);
    if (!JSFunction::setTypeForScriptedFunction(cx, clone))
        return NULL;

    RootedScript cloneScript(cx, clone->nonLazyScript());
    CallNewScriptHook(cx, cloneScript, clone);
    return clone;
}






        }
    }

    /*
     * When one script is inlined into another the caller listens to state
     * changes on the callee's script, so trigger these to force recompilation
     * of any such callers.
     */
    if (script->isFunctionScript() && !script->function()->hasLazyType())
        ObjectStateChange(cx, script->function()->type(), false, true);
}

/*
 * As for TypeConstraintFreeze, but describes an implicit freeze constraint
 * added for stack types within a script. Applies to all compilations of the
 * script, not just a single one.
 */

types::UseNewTypeForInitializer(JSContext *cx, HandleScript script, jsbytecode *pc, JSProtoKey key)
{
    /*
     * Objects created outside loops in global and eval scripts should have
     * singleton types. For now this is only done for plain objects and typed
     * arrays, but not normal arrays.
     */

    if (!cx->typeInferenceEnabled() || script->isFunctionScript())
        return false;

    if (key != JSProto_Object && !(key >= JSProto_Int8Array && key <= JSProto_Uint8ClampedArray))
        return false;

    AutoEnterTypeInference enter(cx);

    if (!JSScript::ensureRanAnalysis(cx, script))

        break;

      case JSOP_OBJECT:
        pushed[0].addType(cx, Type::ObjectType(script_->getObject(GET_UINT32_INDEX(pc))));
        break;

      case JSOP_STOP:
        /* If a stop is reachable then the return type may be void. */
          if (script_->isFunctionScript())
            TypeScript::ReturnTypes(script_)->addType(cx, Type::UndefinedType());
        break;

      case JSOP_OR:
      case JSOP_AND:
        /* OR/AND push whichever operand determined the result. */
        poppedTypes(pc, 0)->addSubset(cx, &pushed[0]);
        break;

                  i, id());
    InferSpew(ISpewOps, "typeSet: %sT%p%s return #%u",
              InferSpewColor(returnTypes), returnTypes, InferSpewColorReset(),
              id());
    TypeSet *thisTypes = TypeScript::ThisTypes(this);
    InferSpew(ISpewOps, "typeSet: %sT%p%s this #%u",
              InferSpewColor(thisTypes), thisTypes, InferSpewColorReset(),
              id());
    unsigned nargs = isFunctionScript() ? function()->nargs : 0;
    for (unsigned i = 0; i < nargs; i++) {
        TypeSet *types = TypeScript::ArgTypes(this, i);
        InferSpew(ISpewOps, "typeSet: %sT%p%s arg%u #%u",
                  InferSpewColor(types), types, InferSpewColorReset(),
                  i, id());
    }
    for (unsigned i = 0; i < nfixed; i++) {
        TypeSet *types = TypeScript::LocalTypes(this, i);

(-)a/js/src/jsopcode.tbl (+4 lines)

Line	Link Here

Lines 539-546 OPDEF(JSOP_TOID, 225, "toid",	Link Here

539

/* Push the implicit 'this' value for calls to the associated name. */

539

/* Push the implicit 'this' value for calls to the associated name. */

540

OPDEF(JSOP_IMPLICITTHIS,  226, "implicitthis", "",    5,  0,  1,  0,  JOF_ATOM)

540

OPDEF(JSOP_IMPLICITTHIS,  226, "implicitthis", "",    5,  0,  1,  0,  JOF_ATOM)

541

542

/* This opcode is the target of the entry jump for some loop. */

542

/* This opcode is the target of the entry jump for some loop. */

543

OPDEF(JSOP_LOOPENTRY,     227, "loopentry",    NULL,  1,  0,  0,  0,  JOF_BYTE)

543

OPDEF(JSOP_LOOPENTRY,     227, "loopentry",    NULL,  1,  0,  0,  0,  JOF_BYTE)

544

545

/* Notes the point at which a value is pushed as an argument. */

545

/* Notes the point at which a value is pushed as an argument. */

546

OPDEF(JSOP_NOTEARG,       228, "notearg",      NULL,  1,  0,  0,  0,  JOF_BYTE)

546

OPDEF(JSOP_NOTEARG,       228, "notearg",      NULL,  1,  0,  0,  0,  JOF_BYTE)

547

548

OPDEF(JSOP_DEFMODULE,     229, "defmodule",    NULL,  5,  0,  0,  0,  JOF_OBJECT)

549

OPDEF(JSOP_MODULE,        230, "module",       NULL,  5,  0,  1,  0,  JOF_OBJECT)

550

OPDEF(JSOP_INITMODULE,    231, "initmodule",   NULL,  5,  0,  0,  0,  JOF_OBJECT)





#include "jsgc.h"
#include "jsinterp.h"
#include "jslock.h"
#include "jsnum.h"
#include "jsopcode.h"
#include "jsscope.h"
#include "jsscript.h"

#include "builtin/Module.h"
#include "gc/Marking.h"
#include "frontend/BytecodeEmitter.h"
#include "frontend/Parser.h"
#include "js/MemoryMetrics.h"
#include "methodjit/MethodJIT.h"
#include "ion/IonCode.h"
#include "methodjit/Retcon.h"
#include "vm/Debugger.h"

    }
    script->lineno = bce->firstLine;
    if (script->nfixed + bce->maxStackDepth >= JS_BIT(16)) {
        bce->reportError(NULL, JSMSG_NEED_DIET, "script");
        return false;
    }
    script->nslots = script->nfixed + bce->maxStackDepth;

    FunctionBox *funbox = bce->sc->isFunctionBox() ? bce->sc->asFunctionBox() : NULL;

    if (!FinishTakingSrcNotes(cx, bce, script->notes()))
        return false;
    if (bce->tryNoteList.length() != 0)
        bce->tryNoteList.finish(script->trynotes());
    if (bce->objectList.length != 0)
        bce->objectList.finish(script->objects());
    if (bce->regexpList.length != 0)
        bce->regexpList.finish(script->regexps());
    if (bce->constList.length() != 0)
        bce->constList.finish(script->consts());
    script->strict = bce->sc->strict;
    script->explicitUseStrict = bce->sc->hasExplicitUseStrict();
    script->bindingsAccessedDynamically = bce->sc->bindingsAccessedDynamically();
    script->funHasExtensibleScope = funbox ? funbox->hasExtensibleScope() : false;
    script->hasSingletons = bce->hasSingletons;
#ifdef JS_METHODJIT
    if (cx->compartment->debugMode())
        script->debugMode = true;
#endif

    if (bce->sc->isModuleBox()) {
        script->setOwner(bce->sc->asModuleBox()->module());
    } else if (bce->sc->isFunctionBox()) {
        FunctionBox *funbox = bce->sc->asFunctionBox();
        script->funHasExtensibleScope = funbox->hasExtensibleScope();

        if (funbox->argumentsHasLocalBinding()) {
            // This must precede the script->bindings.transfer() call below
            script->setArgumentsHasVarBinding();
            if (funbox->definitelyNeedsArgsObj())
                script->setNeedsArgsObj(true);
        } else {
            JS_ASSERT(!funbox->definitelyNeedsArgsObj());
        }

        script->ndefaults = funbox->ndefaults;
    }

    RootedFunction fun(cx, NULL);
    if (funbox) {
        JS_ASSERT(!bce->script->noScriptRval);
        script->isGenerator = funbox->isGenerator();
        script->isGeneratorExp = funbox->inGenexpLambda;
        script->setOwner(funbox->function());
    }

    /*
     * initScriptCounts updates scriptCountsMap if necessary. The other script
     * maps in JSCompartment are populated lazily.
     */
    if (cx->hasRunOption(JSOPTION_PCCOUNT))
        (void) script->initScriptCounts(cx);


    clone->mutableScript().init(NULL);

    RawScript cscript = CloneScript(cx, scope, clone, script);
    if (!cscript)
        return false;

    clone->setScript(cscript);
    cscript->setOwner(clone);

    GlobalObject *global = script->compileAndGo ? &script->global() : NULL;

    script = clone->nonLazyScript();
    CallNewScriptHook(cx, script, clone);
    Debugger::onNewScript(cx, script, global);

    return true;

        MarkObjectRange(trc, objarray->length, objarray->vector, "objects");
    }

    if (hasConsts()) {
        ConstArray *constarray = consts();
        MarkValueRange(trc, constarray->length, constarray->vector, "consts");
    }

    if (owner_)
        MarkObject(trc, &owner_, "owner");

    if (enclosingScope_)
        MarkObject(trc, &enclosingScope_, "enclosing");

    if (IS_GC_MARKING_TRACER(trc) && filename)
        MarkScriptFilename(trc->runtime, filename);

    bindings.trace(trc);






  private:
    js::ScriptSource *scriptSource_; /* source code */
#ifdef JS_METHODJIT
    JITScriptSet *mJITInfo;
#else
    void         *mJITInfoPad;
#endif
    js::HeapPtrObject   owner_;
    js::HeapPtrObject   enclosingScope_;

    // 32-bit fields.

  public:
    uint32_t        length;     /* length of code vector */

    uint32_t        lineno;     /* base line number of script */

        JS_ASSERT(hasParallelIonScript());
        return parallelIon;
    }

    /*
     * Original compiled function for the script, if it has a function.
     * NULL for global and eval scripts.
     */
    bool isGlobalScript() const { return !owner_; }
    bool isModuleScript() const { return owner_ && owner_->isModule(); }
    bool isFunctionScript() const { return owner_ && owner_->isFunction(); }
    js::Module *module() const { JS_ASSERT(owner_->isModule()); return &owner_->asModule(); }
    JSFunction *function() const { JS_ASSERT(owner_->isFunction()); return owner_->toFunction(); }
    void setOwner(JSObject *owner) { owner_ = owner; }

    JSFlatString *sourceData(JSContext *cx);

    static bool loadSource(JSContext *cx, js::HandleScript scr, bool *worked);

    js::ScriptSource *scriptSource() {
        return scriptSource_;
    }





     * to preserve this invariant, only mark during a full gc.
     */
    if (rt->gcIsFull)
        ScriptFilenameEntry::fromFilename(filename)->marked = true;
}

} // namespace js

inline void
JSScript::setFunction(JSFunction *fun)
{
    function_ = fun;
}

inline JSFunction *
JSScript::getFunction(size_t index)
{
    JSObject *funobj = getObject(index);
    JS_ASSERT(funobj->isFunction() && funobj->toFunction()->isInterpreted());
    return funobj->toFunction();
}






    CompileStatus status = performCompilation();
    if (status != Compile_Okay && status != Compile_Retry) {
        if (!outerScript->ensureHasMJITInfo(cx))
            return Compile_Error;
        JSScript::JITScriptHandle *jith = outerScript->jitHandle(isConstructing, cx->compartment->compileBarriers());
        JSScript::ReleaseCode(cx->runtime->defaultFreeOp(), jith);
        jith->setUnjittable();

        if (outerScript->isFunctionScript()) {
            outerScript->uninlineable = true;
            types::MarkTypeObjectFlags(cx, outerScript->function(),
                                       types::OBJECT_FLAG_UNINLINEABLE);
        }
    }

    return status;
}

mjit::Compiler::generatePrologue()
{
    fastEntryLabel = masm.label();

    /*
     * If there is no function, then this can only be called via JaegerShot(),
     * which expects an existing frame to be initialized like the interpreter.
     */
    if (script_->isFunctionScript()) {
        Jump j = masm.jump();

        /*
         * Entry point #2: The caller has partially constructed a frame, and
         * either argc >= nargs or the arity check has corrected the frame.
         */
        fastEntryLabel = masm.label();


            hasArgs.linkTo(masm.label(), &masm);
        }

        j.linkTo(masm.label(), &masm);
    }

    if (cx->typeInferenceEnabled()) {
#ifdef DEBUG
        if (script_->isFunctionScript()) {
            prepareStubCall(Uses(0));
            INLINE_STUBCALL(stubs::AssertArgumentTypes, REJOIN_NONE);
        }
#endif
        ensureDoubleArguments();
    }

    /* Inline StackFrame::prologue. */
    if (script_->isActiveEval && script_->strict) {
        prepareStubCall(Uses(0));
        INLINE_STUBCALL(stubs::StrictEvalPrologue, REJOIN_EVAL_PROLOGUE);
    } else if (script_->isFunctionScript()) {
        if (script_->function()->isHeavyweight()) {
            prepareStubCall(Uses(0));
            INLINE_STUBCALL(stubs::HeavyweightFunctionPrologue, REJOIN_FUNCTION_PROLOGUE);
        }

        if (isConstructing && !constructThis())
            return Compile_Error;
    }


    return status;
}

void
mjit::Compiler::ensureDoubleArguments()
{
    /* Convert integer arguments which were inferred as (int|double) to doubles. */
    for (uint32_t i = 0; script_->isFunctionScript() && i < script_->function()->nargs; i++) {
        uint32_t slot = ArgSlot(i);
        if (a->varTypes[slot].getTypeTag() == JSVAL_TYPE_DOUBLE && analysis->trackSlot(slot))
            frame.ensureDouble(frame.getArg(i));
    }
}

void
mjit::Compiler::markUndefinedLocal(uint32_t offset, uint32_t i)


    JS_ASSERT(outerScript == script_);

    chunk->code = JSC::MacroAssemblerCodeRef(result, execPool, masm.size() + stubcc.size());
    chunk->pcLengths = pcLengths;

    if (chunkIndex == 0) {
        jit->invokeEntry = result;
        if (script_->isFunctionScript()) {
            jit->arityCheckEntry = stubCode.locationOf(arityLabel).executableAddress();
            jit->argsCheckEntry = stubCode.locationOf(argsCheckLabel).executableAddress();
            jit->fastEntry = fullCode.locationOf(fastEntryLabel).executableAddress();
        }
    }

    /*
     * WARNING: mics(), callICs() et al depend on the ordering of these


    uint32_t *jitTypeBarrierBytecodes = (uint32_t *)cursor;
    chunk->nTypeBarrierBytecodes = typeBarrierBytecodes.length();
    cursor += sizeof(uint32_t) * chunk->nTypeBarrierBytecodes;
    for (size_t i = 0; i < chunk->nTypeBarrierBytecodes; i++)
        jitTypeBarrierBytecodes[i] = typeBarrierBytecodes[i];

#if defined JS_MONOIC
    if (chunkIndex == 0 && script_->isFunctionScript()) {
        JS_ASSERT(jit->argsCheckPool == NULL);
        if (cx->typeInferenceEnabled()) {
            jit->argsCheckStub = stubCode.locationOf(argsCheckStub);
            jit->argsCheckFallthrough = stubCode.locationOf(argsCheckFallthrough);
            jit->argsCheckJump = stubCode.locationOf(argsCheckJump);
        }
    }


    a->returnSet = true;
    if (a->exitState)
        a->exitState->setUnassigned(a->returnRegister);
}

void
mjit::Compiler::emitReturn(FrameEntry *fe)
{
    JS_ASSERT_IF(!script_->isFunctionScript(), JSOp(*PC) == JSOP_STOP);

    /* Only the top of the stack can be returned. */
    JS_ASSERT_IF(fe, fe == frame.peek(-1));

    if (debugMode()) {
        /* If the return value isn't in the frame's rval slot, move it there. */
        if (fe) {
            frame.storeTo(fe, Address(JSFrameReg, StackFrame::offsetOfReturnValue()), true);

{
    frame.pushThis();

    /*
     * In strict mode and self-hosted code, we don't wrap 'this'.
     * In direct-call eval code, we wrapped 'this' before entering the eval.
     * In global code, 'this' is always an object.
     */
    if (script_->isFunctionScript() && !script_->strict &&
        !script_->function()->isSelfHostedBuiltin())
    {
        FrameEntry *thisFe = frame.peek(-1);

        if (!thisFe->isType(JSVAL_TYPE_OBJECT)) {
            /*
             * Watch out for an obscure case where we don't know we are pushing
             * an object: the script has not yet had a 'this' value assigned,





    /* Note: fe == a->sp is allowed for addressOfTop */
    JS_ASSERT(fe >= a->callee_ && fe <= a->sp);

    if (fe >= a->locals)
        return StackFrame::offsetOfFixed(uint32_t(fe - a->locals));
    if (fe >= a->args)
        return StackFrame::offsetOfFormalArg(a->script->function(), uint32_t(fe - a->args));
    if (fe == a->this_)
        return StackFrame::offsetOfThis(a->script->isFunctionScript()
                                        ? a->script->function() : NULL);
    if (fe == a->callee_)
        return StackFrame::offsetOfCallee(a->script->function());
    JS_NOT_REACHED("Bad fe");
    return 0;
}

inline JSC::MacroAssembler::Address
FrameState::addressOf(const FrameEntry *fe) const





        THROW();
    fp->thisValue() = ObjectValue(*obj);
}

void JS_FASTCALL
stubs::ScriptDebugPrologue(VMFrame &f)
{
    AssertCanGC();
    Probes::enterScript(f.cx, f.script(),
                        f.script()->isFunctionScript() ? f.script()->function() : NULL,
                        f.fp());
    JSTrapStatus status = js::ScriptDebugPrologue(f.cx, f.fp());
    switch (status) {
      case JSTRAP_CONTINUE:
        break;
      case JSTRAP_RETURN:
        *f.returnAddressLocation() = f.cx->jaegerRuntime().forceReturnFromFastCall();
        return;
      case JSTRAP_ERROR:






    this->alloc = alloc;
    this->loopRegs = Registers::AvailAnyRegs;

    /*
     * Don't hoist bounds checks or loop invariant code in scripts that have
     * had indirect modification of their arguments.
     */
    if (outerScript->isFunctionScript()) {
        if (HeapTypeSet::HasObjectFlags(cx, outerScript->function()->getType(cx), OBJECT_FLAG_UNINLINEABLE))
            this->skipAnalysis = true;
    }

    /*
     * Don't hoist bounds checks or loop invariant code in loops with safe
     * points in the middle, which the interpreter can join at directly without
     * performing hoisted bounds checks or doing initial computation of loop





        types::TypeScript::Monitor(f.cx, fscript, f.pc(), args.rval());

        /*
         * Native stubs are not generated for inline frames. The overhead of
         * bailing out from the IC is far greater than the time saved by
         * inlining the parent frame in the first place, so mark the immediate
         * caller as uninlineable.
         */
        if (fscript->isFunctionScript()) {
            fscript->uninlineable = true;
            MarkTypeObjectFlags(cx, fscript->function(), types::OBJECT_FLAG_UNINLINEABLE);
        }

        /* Don't touch the IC if the call triggered a recompilation. */
        if (monitor.recompiled())
            return true;






                                                 ss,
                                                 0,
                                                 ss->length()));
        if (!script || !JSScript::fullyInitTrivial(cx, script))
            return NULL;

        functionProto->initScript(script);
        functionProto->getType(cx)->interpretedFunction = functionProto;
        script->setOwner(functionProto);

        if (!JSObject::setSingletonType(cx, functionProto))
            return NULL;

        /*
         * The default 'new' type of Function.prototype is required by type
         * inference to have unknown properties, to simplify handling of e.g.
         * CloneFunctionObject.






    RootedFunction sourceFun(cx, funVal.toObject().toFunction());
    Rooted<JSScript*> sourceScript(cx, sourceFun->nonLazyScript());
    JS_ASSERT(!sourceScript->enclosingStaticScope());
    RawScript cscript = CloneScript(cx, NullPtr(), targetFun, sourceScript);
    if (!cscript)
        return false;
    targetFun->setScript(cscript);
    cscript->setOwner(targetFun);
    JS_ASSERT(sourceFun->nargs == targetFun->nargs);
    targetFun->flags = sourceFun->flags | JSFunction::EXTENDED;
    return true;
}

bool
JSRuntime::cloneSelfHostedValue(JSContext *cx, Handle<PropertyName*> name, MutableHandleValue vp)
{






void
StackFrame::epilogue(JSContext *cx)
{
    JS_ASSERT(!isYielding());
    JS_ASSERT(!hasBlockChain());

    RootedScript script(cx, this->script());
    Probes::exitScript(cx, script, script->isFunctionScript() ? script->function() : NULL, this);

    if (isEvalFrame()) {
        if (isStrictEvalFrame()) {
            JS_ASSERT_IF(hasCallObj(), scopeChain()->asCall().isForEval());
            if (cx->compartment->debugMode())
                DebugScopes::onPopStrictEvalScope(this);
        } else if (isDirectEvalFrame()) {
            if (isDebuggerFrame())

Return to bug 568953