1 // Copyright 2016 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/compiler/operation-typer.h"
6
7 #include "src/compiler/common-operator.h"
8 #include "src/compiler/js-heap-broker.h"
9 #include "src/compiler/type-cache.h"
10 #include "src/compiler/types.h"
11 #include "src/execution/isolate.h"
12 #include "src/heap/factory.h"
13
14 #include "src/objects/objects-inl.h"
15
16 namespace v8 {
17 namespace internal {
18 namespace compiler {
19
OperationTyper(JSHeapBroker * broker,Zone * zone)20 OperationTyper::OperationTyper(JSHeapBroker* broker, Zone* zone)
21 : zone_(zone), cache_(TypeCache::Get()) {
22 Factory* factory = broker->isolate()->factory();
23 infinity_ = Type::Constant(V8_INFINITY, zone);
24 minus_infinity_ = Type::Constant(-V8_INFINITY, zone);
25 Type truncating_to_zero = Type::MinusZeroOrNaN();
26 DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
27
28 singleton_empty_string_ =
29 Type::Constant(broker, factory->empty_string(), zone);
30 singleton_NaN_string_ = Type::Constant(broker, factory->NaN_string(), zone);
31 singleton_zero_string_ = Type::Constant(broker, factory->zero_string(), zone);
32 singleton_false_ = Type::Constant(broker, factory->false_value(), zone);
33 singleton_true_ = Type::Constant(broker, factory->true_value(), zone);
34 singleton_the_hole_ = Type::Hole();
35 signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
36 unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
37
38 falsish_ = Type::Union(
39 Type::Undetectable(),
40 Type::Union(Type::Union(singleton_false_, cache_->kZeroish, zone),
41 Type::Union(singleton_empty_string_, Type::Hole(), zone),
42 zone),
43 zone);
44 truish_ = Type::Union(
45 singleton_true_,
46 Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
47 }
48
Merge(Type left,Type right)49 Type OperationTyper::Merge(Type left, Type right) {
50 return Type::Union(left, right, zone());
51 }
52
WeakenRange(Type previous_range,Type current_range)53 Type OperationTyper::WeakenRange(Type previous_range, Type current_range) {
54 static const double kWeakenMinLimits[] = {0.0,
55 -1073741824.0,
56 -2147483648.0,
57 -4294967296.0,
58 -8589934592.0,
59 -17179869184.0,
60 -34359738368.0,
61 -68719476736.0,
62 -137438953472.0,
63 -274877906944.0,
64 -549755813888.0,
65 -1099511627776.0,
66 -2199023255552.0,
67 -4398046511104.0,
68 -8796093022208.0,
69 -17592186044416.0,
70 -35184372088832.0,
71 -70368744177664.0,
72 -140737488355328.0,
73 -281474976710656.0,
74 -562949953421312.0};
75 static const double kWeakenMaxLimits[] = {0.0,
76 1073741823.0,
77 2147483647.0,
78 4294967295.0,
79 8589934591.0,
80 17179869183.0,
81 34359738367.0,
82 68719476735.0,
83 137438953471.0,
84 274877906943.0,
85 549755813887.0,
86 1099511627775.0,
87 2199023255551.0,
88 4398046511103.0,
89 8796093022207.0,
90 17592186044415.0,
91 35184372088831.0,
92 70368744177663.0,
93 140737488355327.0,
94 281474976710655.0,
95 562949953421311.0};
96 STATIC_ASSERT(arraysize(kWeakenMinLimits) == arraysize(kWeakenMaxLimits));
97
98 double current_min = current_range.Min();
99 double new_min = current_min;
100 // Find the closest lower entry in the list of allowed
101 // minima (or negative infinity if there is no such entry).
102 if (current_min != previous_range.Min()) {
103 new_min = -V8_INFINITY;
104 for (double const min : kWeakenMinLimits) {
105 if (min <= current_min) {
106 new_min = min;
107 break;
108 }
109 }
110 }
111
112 double current_max = current_range.Max();
113 double new_max = current_max;
114 // Find the closest greater entry in the list of allowed
115 // maxima (or infinity if there is no such entry).
116 if (current_max != previous_range.Max()) {
117 new_max = V8_INFINITY;
118 for (double const max : kWeakenMaxLimits) {
119 if (max >= current_max) {
120 new_max = max;
121 break;
122 }
123 }
124 }
125
126 return Type::Range(new_min, new_max, zone());
127 }
128
Rangify(Type type)129 Type OperationTyper::Rangify(Type type) {
130 if (type.IsRange()) return type; // Shortcut.
131 if (!type.Is(cache_->kInteger)) {
132 return type; // Give up on non-integer types.
133 }
134 return Type::Range(type.Min(), type.Max(), zone());
135 }
136
137 namespace {
138
139 // Returns the array's least element, ignoring NaN.
140 // There must be at least one non-NaN element.
141 // Any -0 is converted to 0.
array_min(double a[],size_t n)142 double array_min(double a[], size_t n) {
143 DCHECK_NE(0, n);
144 double x = +V8_INFINITY;
145 for (size_t i = 0; i < n; ++i) {
146 if (!std::isnan(a[i])) {
147 x = std::min(a[i], x);
148 }
149 }
150 DCHECK(!std::isnan(x));
151 return x == 0 ? 0 : x; // -0 -> 0
152 }
153
154 // Returns the array's greatest element, ignoring NaN.
155 // There must be at least one non-NaN element.
156 // Any -0 is converted to 0.
array_max(double a[],size_t n)157 double array_max(double a[], size_t n) {
158 DCHECK_NE(0, n);
159 double x = -V8_INFINITY;
160 for (size_t i = 0; i < n; ++i) {
161 if (!std::isnan(a[i])) {
162 x = std::max(a[i], x);
163 }
164 }
165 DCHECK(!std::isnan(x));
166 return x == 0 ? 0 : x; // -0 -> 0
167 }
168
169 } // namespace
170
AddRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)171 Type OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
172 double rhs_max) {
173 double results[4];
174 results[0] = lhs_min + rhs_min;
175 results[1] = lhs_min + rhs_max;
176 results[2] = lhs_max + rhs_min;
177 results[3] = lhs_max + rhs_max;
178 // Since none of the inputs can be -0, the result cannot be -0 either.
179 // However, it can be nan (the sum of two infinities of opposite sign).
180 // On the other hand, if none of the "results" above is nan, then the
181 // actual result cannot be nan either.
182 int nans = 0;
183 for (int i = 0; i < 4; ++i) {
184 if (std::isnan(results[i])) ++nans;
185 }
186 if (nans == 4) return Type::NaN();
187 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
188 if (nans > 0) type = Type::Union(type, Type::NaN(), zone());
189 // Examples:
190 // [-inf, -inf] + [+inf, +inf] = NaN
191 // [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
192 // [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
193 // [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
194 return type;
195 }
196
SubtractRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)197 Type OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
198 double rhs_min, double rhs_max) {
199 double results[4];
200 results[0] = lhs_min - rhs_min;
201 results[1] = lhs_min - rhs_max;
202 results[2] = lhs_max - rhs_min;
203 results[3] = lhs_max - rhs_max;
204 // Since none of the inputs can be -0, the result cannot be -0.
205 // However, it can be nan (the subtraction of two infinities of same sign).
206 // On the other hand, if none of the "results" above is nan, then the actual
207 // result cannot be nan either.
208 int nans = 0;
209 for (int i = 0; i < 4; ++i) {
210 if (std::isnan(results[i])) ++nans;
211 }
212 if (nans == 4) return Type::NaN(); // [inf..inf] - [inf..inf] (all same sign)
213 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
214 return nans == 0 ? type : Type::Union(type, Type::NaN(), zone());
215 // Examples:
216 // [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
217 // [-inf, -inf] - [-inf, -inf] = NaN
218 // [-inf, -inf] - [n, +inf] = [-inf, -inf] \/ NaN
219 // [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
220 }
221
MultiplyRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)222 Type OperationTyper::MultiplyRanger(double lhs_min, double lhs_max,
223 double rhs_min, double rhs_max) {
224 double results[4];
225 results[0] = lhs_min * rhs_min;
226 results[1] = lhs_min * rhs_max;
227 results[2] = lhs_max * rhs_min;
228 results[3] = lhs_max * rhs_max;
229 // If the result may be nan, we give up on calculating a precise type,
230 // because the discontinuity makes it too complicated. Note that even if
231 // none of the "results" above is nan, the actual result may still be, so we
232 // have to do a different check:
233 for (int i = 0; i < 4; ++i) {
234 if (std::isnan(results[i])) {
235 return cache_->kIntegerOrMinusZeroOrNaN;
236 }
237 }
238 double min = array_min(results, 4);
239 double max = array_max(results, 4);
240 Type type = Type::Range(min, max, zone());
241 if (min <= 0.0 && 0.0 <= max && (lhs_min < 0.0 || rhs_min < 0.0)) {
242 type = Type::Union(type, Type::MinusZero(), zone());
243 }
244 // 0 * V8_INFINITY is NaN, regardless of sign
245 if (((lhs_min == -V8_INFINITY || lhs_max == V8_INFINITY) &&
246 (rhs_min <= 0.0 && 0.0 <= rhs_max)) ||
247 ((rhs_min == -V8_INFINITY || rhs_max == V8_INFINITY) &&
248 (lhs_min <= 0.0 && 0.0 <= lhs_max))) {
249 type = Type::Union(type, Type::NaN(), zone());
250 }
251 return type;
252 }
253
ConvertReceiver(Type type)254 Type OperationTyper::ConvertReceiver(Type type) {
255 if (type.Is(Type::Receiver())) return type;
256 bool const maybe_primitive = type.Maybe(Type::Primitive());
257 type = Type::Intersect(type, Type::Receiver(), zone());
258 if (maybe_primitive) {
259 // ConvertReceiver maps null and undefined to the JSGlobalProxy of the
260 // target function, and all other primitives are wrapped into a
261 // JSPrimitiveWrapper.
262 type = Type::Union(type, Type::OtherObject(), zone());
263 }
264 return type;
265 }
266
ToNumber(Type type)267 Type OperationTyper::ToNumber(Type type) {
268 if (type.Is(Type::Number())) return type;
269
270 // If {type} includes any receivers, we cannot tell what kind of
271 // Number their callbacks might produce. Similarly in the case
272 // where {type} includes String, it's not possible at this point
273 // to tell which exact numbers are going to be produced.
274 if (type.Maybe(Type::StringOrReceiver())) return Type::Number();
275
276 // Both Symbol and BigInt primitives will cause exceptions
277 // to be thrown from ToNumber conversions, so they don't
278 // contribute to the resulting type anyways.
279 type = Type::Intersect(type, Type::PlainPrimitive(), zone());
280
281 // This leaves us with Number\/Oddball, so deal with the individual
282 // Oddball primitives below.
283 DCHECK(type.Is(Type::NumberOrOddball()));
284 if (type.Maybe(Type::Null())) {
285 // ToNumber(null) => +0
286 type = Type::Union(type, cache_->kSingletonZero, zone());
287 }
288 if (type.Maybe(Type::Undefined())) {
289 // ToNumber(undefined) => NaN
290 type = Type::Union(type, Type::NaN(), zone());
291 }
292 if (type.Maybe(singleton_false_)) {
293 // ToNumber(false) => +0
294 type = Type::Union(type, cache_->kSingletonZero, zone());
295 }
296 if (type.Maybe(singleton_true_)) {
297 // ToNumber(true) => +1
298 type = Type::Union(type, cache_->kSingletonOne, zone());
299 }
300 return Type::Intersect(type, Type::Number(), zone());
301 }
302
ToNumberConvertBigInt(Type type)303 Type OperationTyper::ToNumberConvertBigInt(Type type) {
304 // If the {type} includes any receivers, then the callbacks
305 // might actually produce BigInt primitive values here.
306 bool maybe_bigint =
307 type.Maybe(Type::BigInt()) || type.Maybe(Type::Receiver());
308 type = ToNumber(Type::Intersect(type, Type::NonBigInt(), zone()));
309
310 // Any BigInt is rounded to an integer Number in the range [-inf, inf].
311 return maybe_bigint ? Type::Union(type, cache_->kInteger, zone()) : type;
312 }
313
ToNumeric(Type type)314 Type OperationTyper::ToNumeric(Type type) {
315 // If the {type} includes any receivers, then the callbacks
316 // might actually produce BigInt primitive values here.
317 if (type.Maybe(Type::Receiver())) {
318 type = Type::Union(type, Type::BigInt(), zone());
319 }
320 return Type::Union(ToNumber(Type::Intersect(type, Type::NonBigInt(), zone())),
321 Type::Intersect(type, Type::BigInt(), zone()), zone());
322 }
323
NumberAbs(Type type)324 Type OperationTyper::NumberAbs(Type type) {
325 DCHECK(type.Is(Type::Number()));
326 if (type.IsNone()) return type;
327
328 bool const maybe_nan = type.Maybe(Type::NaN());
329 bool const maybe_minuszero = type.Maybe(Type::MinusZero());
330
331 type = Type::Intersect(type, Type::PlainNumber(), zone());
332 if (!type.IsNone()) {
333 double const max = type.Max();
334 double const min = type.Min();
335 if (min < 0) {
336 if (type.Is(cache_->kInteger)) {
337 type =
338 Type::Range(0.0, std::max(std::fabs(min), std::fabs(max)), zone());
339 } else {
340 type = Type::PlainNumber();
341 }
342 }
343 }
344
345 if (maybe_minuszero) {
346 type = Type::Union(type, cache_->kSingletonZero, zone());
347 }
348 if (maybe_nan) {
349 type = Type::Union(type, Type::NaN(), zone());
350 }
351 return type;
352 }
353
NumberAcos(Type type)354 Type OperationTyper::NumberAcos(Type type) {
355 DCHECK(type.Is(Type::Number()));
356 return Type::Number();
357 }
358
NumberAcosh(Type type)359 Type OperationTyper::NumberAcosh(Type type) {
360 DCHECK(type.Is(Type::Number()));
361 return Type::Number();
362 }
363
NumberAsin(Type type)364 Type OperationTyper::NumberAsin(Type type) {
365 DCHECK(type.Is(Type::Number()));
366 return Type::Number();
367 }
368
NumberAsinh(Type type)369 Type OperationTyper::NumberAsinh(Type type) {
370 DCHECK(type.Is(Type::Number()));
371 return Type::Number();
372 }
373
NumberAtan(Type type)374 Type OperationTyper::NumberAtan(Type type) {
375 DCHECK(type.Is(Type::Number()));
376 return Type::Number();
377 }
378
NumberAtanh(Type type)379 Type OperationTyper::NumberAtanh(Type type) {
380 DCHECK(type.Is(Type::Number()));
381 return Type::Number();
382 }
383
NumberCbrt(Type type)384 Type OperationTyper::NumberCbrt(Type type) {
385 DCHECK(type.Is(Type::Number()));
386 return Type::Number();
387 }
388
NumberCeil(Type type)389 Type OperationTyper::NumberCeil(Type type) {
390 DCHECK(type.Is(Type::Number()));
391 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
392 type = Type::Intersect(type, Type::NaN(), zone());
393 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
394 return type;
395 }
396
NumberClz32(Type type)397 Type OperationTyper::NumberClz32(Type type) {
398 DCHECK(type.Is(Type::Number()));
399 return cache_->kZeroToThirtyTwo;
400 }
401
NumberCos(Type type)402 Type OperationTyper::NumberCos(Type type) {
403 DCHECK(type.Is(Type::Number()));
404 return Type::Number();
405 }
406
NumberCosh(Type type)407 Type OperationTyper::NumberCosh(Type type) {
408 DCHECK(type.Is(Type::Number()));
409 return Type::Number();
410 }
411
NumberExp(Type type)412 Type OperationTyper::NumberExp(Type type) {
413 DCHECK(type.Is(Type::Number()));
414 return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
415 }
416
NumberExpm1(Type type)417 Type OperationTyper::NumberExpm1(Type type) {
418 DCHECK(type.Is(Type::Number()));
419 return Type::Number();
420 }
421
NumberFloor(Type type)422 Type OperationTyper::NumberFloor(Type type) {
423 DCHECK(type.Is(Type::Number()));
424 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
425 type = Type::Intersect(type, Type::MinusZeroOrNaN(), zone());
426 type = Type::Union(type, cache_->kInteger, zone());
427 return type;
428 }
429
NumberFround(Type type)430 Type OperationTyper::NumberFround(Type type) {
431 DCHECK(type.Is(Type::Number()));
432 return Type::Number();
433 }
434
NumberLog(Type type)435 Type OperationTyper::NumberLog(Type type) {
436 DCHECK(type.Is(Type::Number()));
437 return Type::Number();
438 }
439
NumberLog1p(Type type)440 Type OperationTyper::NumberLog1p(Type type) {
441 DCHECK(type.Is(Type::Number()));
442 return Type::Number();
443 }
444
NumberLog2(Type type)445 Type OperationTyper::NumberLog2(Type type) {
446 DCHECK(type.Is(Type::Number()));
447 return Type::Number();
448 }
449
NumberLog10(Type type)450 Type OperationTyper::NumberLog10(Type type) {
451 DCHECK(type.Is(Type::Number()));
452 return Type::Number();
453 }
454
NumberRound(Type type)455 Type OperationTyper::NumberRound(Type type) {
456 DCHECK(type.Is(Type::Number()));
457 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
458 type = Type::Intersect(type, Type::NaN(), zone());
459 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
460 return type;
461 }
462
NumberSign(Type type)463 Type OperationTyper::NumberSign(Type type) {
464 DCHECK(type.Is(Type::Number()));
465 if (type.Is(cache_->kZeroish)) return type;
466 bool maybe_minuszero = type.Maybe(Type::MinusZero());
467 bool maybe_nan = type.Maybe(Type::NaN());
468 type = Type::Intersect(type, Type::PlainNumber(), zone());
469 if (type.IsNone()) {
470 // Do nothing.
471 } else if (type.Max() < 0.0) {
472 type = cache_->kSingletonMinusOne;
473 } else if (type.Max() <= 0.0) {
474 type = cache_->kMinusOneOrZero;
475 } else if (type.Min() > 0.0) {
476 type = cache_->kSingletonOne;
477 } else if (type.Min() >= 0.0) {
478 type = cache_->kZeroOrOne;
479 } else {
480 type = Type::Range(-1.0, 1.0, zone());
481 }
482 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
483 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
484 DCHECK(!type.IsNone());
485 return type;
486 }
487
NumberSin(Type type)488 Type OperationTyper::NumberSin(Type type) {
489 DCHECK(type.Is(Type::Number()));
490 return Type::Number();
491 }
492
NumberSinh(Type type)493 Type OperationTyper::NumberSinh(Type type) {
494 DCHECK(type.Is(Type::Number()));
495 return Type::Number();
496 }
497
NumberSqrt(Type type)498 Type OperationTyper::NumberSqrt(Type type) {
499 DCHECK(type.Is(Type::Number()));
500 return Type::Number();
501 }
502
NumberTan(Type type)503 Type OperationTyper::NumberTan(Type type) {
504 DCHECK(type.Is(Type::Number()));
505 return Type::Number();
506 }
507
NumberTanh(Type type)508 Type OperationTyper::NumberTanh(Type type) {
509 DCHECK(type.Is(Type::Number()));
510 return Type::Number();
511 }
512
NumberTrunc(Type type)513 Type OperationTyper::NumberTrunc(Type type) {
514 DCHECK(type.Is(Type::Number()));
515 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
516 type = Type::Intersect(type, Type::NaN(), zone());
517 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
518 return type;
519 }
520
NumberToBoolean(Type type)521 Type OperationTyper::NumberToBoolean(Type type) {
522 DCHECK(type.Is(Type::Number()));
523 if (type.IsNone()) return type;
524 if (type.Is(cache_->kZeroish)) return singleton_false_;
525 if (type.Is(Type::PlainNumber()) && (type.Max() < 0 || 0 < type.Min())) {
526 return singleton_true_; // Ruled out nan, -0 and +0.
527 }
528 return Type::Boolean();
529 }
530
NumberToInt32(Type type)531 Type OperationTyper::NumberToInt32(Type type) {
532 DCHECK(type.Is(Type::Number()));
533
534 if (type.Is(Type::Signed32())) return type;
535 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
536 if (type.Is(signed32ish_)) {
537 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
538 Type::Signed32(), zone());
539 }
540 return Type::Signed32();
541 }
542
NumberToString(Type type)543 Type OperationTyper::NumberToString(Type type) {
544 DCHECK(type.Is(Type::Number()));
545 if (type.IsNone()) return type;
546 if (type.Is(Type::NaN())) return singleton_NaN_string_;
547 if (type.Is(cache_->kZeroOrMinusZero)) return singleton_zero_string_;
548 return Type::String();
549 }
550
NumberToUint32(Type type)551 Type OperationTyper::NumberToUint32(Type type) {
552 DCHECK(type.Is(Type::Number()));
553
554 if (type.Is(Type::Unsigned32())) return type;
555 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
556 if (type.Is(unsigned32ish_)) {
557 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
558 Type::Unsigned32(), zone());
559 }
560 return Type::Unsigned32();
561 }
562
NumberToUint8Clamped(Type type)563 Type OperationTyper::NumberToUint8Clamped(Type type) {
564 DCHECK(type.Is(Type::Number()));
565
566 if (type.Is(cache_->kUint8)) return type;
567 return cache_->kUint8;
568 }
569
NumberSilenceNaN(Type type)570 Type OperationTyper::NumberSilenceNaN(Type type) {
571 DCHECK(type.Is(Type::Number()));
572 // TODO(jarin): This is a terrible hack; we definitely need a dedicated type
573 // for the hole (tagged and/or double). Otherwise if the input is the hole
574 // NaN constant, we'd just eliminate this node in JSTypedLowering.
575 if (type.Maybe(Type::NaN())) return Type::Number();
576 return type;
577 }
578
SpeculativeBigIntAsUintN(Type type)579 Type OperationTyper::SpeculativeBigIntAsUintN(Type type) {
580 return Type::BigInt();
581 }
582
CheckBigInt(Type type)583 Type OperationTyper::CheckBigInt(Type type) { return Type::BigInt(); }
584
NumberAdd(Type lhs,Type rhs)585 Type OperationTyper::NumberAdd(Type lhs, Type rhs) {
586 DCHECK(lhs.Is(Type::Number()));
587 DCHECK(rhs.Is(Type::Number()));
588
589 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
590
591 // Addition can return NaN if either input can be NaN or we try to compute
592 // the sum of two infinities of opposite sign.
593 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
594
595 // Addition can yield minus zero only if both inputs can be minus zero.
596 bool maybe_minuszero = true;
597 if (lhs.Maybe(Type::MinusZero())) {
598 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
599 } else {
600 maybe_minuszero = false;
601 }
602 if (rhs.Maybe(Type::MinusZero())) {
603 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
604 } else {
605 maybe_minuszero = false;
606 }
607
608 // We can give more precise types for integers.
609 Type type = Type::None();
610 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
611 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
612 if (!lhs.IsNone() && !rhs.IsNone()) {
613 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
614 type = AddRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
615 } else {
616 if ((lhs.Maybe(minus_infinity_) && rhs.Maybe(infinity_)) ||
617 (rhs.Maybe(minus_infinity_) && lhs.Maybe(infinity_))) {
618 maybe_nan = true;
619 }
620 type = Type::PlainNumber();
621 }
622 }
623
624 // Take into account the -0 and NaN information computed earlier.
625 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
626 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
627 return type;
628 }
629
NumberSubtract(Type lhs,Type rhs)630 Type OperationTyper::NumberSubtract(Type lhs, Type rhs) {
631 DCHECK(lhs.Is(Type::Number()));
632 DCHECK(rhs.Is(Type::Number()));
633
634 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
635
636 // Subtraction can return NaN if either input can be NaN or we try to
637 // compute the sum of two infinities of opposite sign.
638 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
639
640 // Subtraction can yield minus zero if {lhs} can be minus zero and {rhs}
641 // can be zero.
642 bool maybe_minuszero = false;
643 if (lhs.Maybe(Type::MinusZero())) {
644 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
645 maybe_minuszero = rhs.Maybe(cache_->kSingletonZero);
646 }
647 if (rhs.Maybe(Type::MinusZero())) {
648 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
649 }
650
651 // We can give more precise types for integers.
652 Type type = Type::None();
653 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
654 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
655 if (!lhs.IsNone() && !rhs.IsNone()) {
656 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
657 type = SubtractRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
658 } else {
659 if ((lhs.Maybe(infinity_) && rhs.Maybe(infinity_)) ||
660 (rhs.Maybe(minus_infinity_) && lhs.Maybe(minus_infinity_))) {
661 maybe_nan = true;
662 }
663 type = Type::PlainNumber();
664 }
665 }
666
667 // Take into account the -0 and NaN information computed earlier.
668 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
669 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
670 return type;
671 }
672
SpeculativeSafeIntegerAdd(Type lhs,Type rhs)673 Type OperationTyper::SpeculativeSafeIntegerAdd(Type lhs, Type rhs) {
674 Type result = SpeculativeNumberAdd(lhs, rhs);
675 // If we have a Smi or Int32 feedback, the representation selection will
676 // either truncate or it will check the inputs (i.e., deopt if not int32).
677 // In either case the result will be in the safe integer range, so we
678 // can bake in the type here. This needs to be in sync with
679 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
680 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
681 }
682
SpeculativeSafeIntegerSubtract(Type lhs,Type rhs)683 Type OperationTyper::SpeculativeSafeIntegerSubtract(Type lhs, Type rhs) {
684 Type result = SpeculativeNumberSubtract(lhs, rhs);
685 // If we have a Smi or Int32 feedback, the representation selection will
686 // either truncate or it will check the inputs (i.e., deopt if not int32).
687 // In either case the result will be in the safe integer range, so we
688 // can bake in the type here. This needs to be in sync with
689 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
690 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
691 }
692
NumberMultiply(Type lhs,Type rhs)693 Type OperationTyper::NumberMultiply(Type lhs, Type rhs) {
694 DCHECK(lhs.Is(Type::Number()));
695 DCHECK(rhs.Is(Type::Number()));
696
697 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
698 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
699
700 // Multiplication propagates NaN:
701 // NaN * x = NaN (regardless of sign of x)
702 // 0 * Infinity = NaN (regardless of signs)
703 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN()) ||
704 (lhs.Maybe(cache_->kZeroish) &&
705 (rhs.Min() == -V8_INFINITY || rhs.Max() == V8_INFINITY)) ||
706 (rhs.Maybe(cache_->kZeroish) &&
707 (lhs.Min() == -V8_INFINITY || lhs.Max() == V8_INFINITY));
708 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
709 DCHECK(!lhs.IsNone());
710 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
711 DCHECK(!rhs.IsNone());
712
713 // Try to rule out -0.
714 bool maybe_minuszero = lhs.Maybe(Type::MinusZero()) ||
715 rhs.Maybe(Type::MinusZero()) ||
716 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
717 (rhs.Maybe(cache_->kZeroish) && lhs.Min() < 0.0);
718 if (lhs.Maybe(Type::MinusZero())) {
719 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
720 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
721 }
722 if (rhs.Maybe(Type::MinusZero())) {
723 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
724 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
725 }
726
727 // Compute the effective type, utilizing range information if possible.
728 Type type = (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger))
729 ? MultiplyRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max())
730 : Type::OrderedNumber();
731
732 // Take into account the -0 and NaN information computed earlier.
733 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
734 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
735 return type;
736 }
737
NumberDivide(Type lhs,Type rhs)738 Type OperationTyper::NumberDivide(Type lhs, Type rhs) {
739 DCHECK(lhs.Is(Type::Number()));
740 DCHECK(rhs.Is(Type::Number()));
741
742 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
743 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
744
745 // Division is tricky, so all we do is try ruling out -0 and NaN.
746 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
747 ((lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY) &&
748 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY));
749 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
750 DCHECK(!lhs.IsNone());
751 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
752 DCHECK(!rhs.IsNone());
753
754 // Try to rule out -0.
755 bool maybe_minuszero =
756 !lhs.Is(cache_->kInteger) ||
757 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
758 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY);
759
760 // Take into account the -0 and NaN information computed earlier.
761 Type type = Type::PlainNumber();
762 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
763 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
764 return type;
765 }
766
NumberModulus(Type lhs,Type rhs)767 Type OperationTyper::NumberModulus(Type lhs, Type rhs) {
768 DCHECK(lhs.Is(Type::Number()));
769 DCHECK(rhs.Is(Type::Number()));
770
771 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
772
773 // Modulus can yield NaN if either {lhs} or {rhs} are NaN, or
774 // {lhs} is not finite, or the {rhs} is a zero value.
775 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
776 lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY;
777
778 // Deal with -0 inputs, only the signbit of {lhs} matters for the result.
779 bool maybe_minuszero = false;
780 if (lhs.Maybe(Type::MinusZero())) {
781 maybe_minuszero = true;
782 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
783 }
784 if (rhs.Maybe(Type::MinusZero())) {
785 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
786 }
787
788 // Rule out NaN and -0, and check what we can do with the remaining type info.
789 Type type = Type::None();
790 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
791 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
792
793 // We can only derive a meaningful type if both {lhs} and {rhs} are inhabited,
794 // and the {rhs} is not 0, otherwise the result is NaN independent of {lhs}.
795 if (!lhs.IsNone() && !rhs.Is(cache_->kSingletonZero)) {
796 // Determine the bounds of {lhs} and {rhs}.
797 double const lmin = lhs.Min();
798 double const lmax = lhs.Max();
799 double const rmin = rhs.Min();
800 double const rmax = rhs.Max();
801
802 // The sign of the result is the sign of the {lhs}.
803 if (lmin < 0.0) maybe_minuszero = true;
804
805 // For integer inputs {lhs} and {rhs} we can infer a precise type.
806 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
807 double labs = std::max(std::abs(lmin), std::abs(lmax));
808 double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
809 double abs = std::min(labs, rabs);
810 double min = 0.0, max = 0.0;
811 if (lmin >= 0.0) {
812 // {lhs} positive.
813 min = 0.0;
814 max = abs;
815 } else if (lmax <= 0.0) {
816 // {lhs} negative.
817 min = 0.0 - abs;
818 max = 0.0;
819 } else {
820 // {lhs} positive or negative.
821 min = 0.0 - abs;
822 max = abs;
823 }
824 type = Type::Range(min, max, zone());
825 } else {
826 type = Type::PlainNumber();
827 }
828 }
829
830 // Take into account the -0 and NaN information computed earlier.
831 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
832 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
833 return type;
834 }
835
NumberBitwiseOr(Type lhs,Type rhs)836 Type OperationTyper::NumberBitwiseOr(Type lhs, Type rhs) {
837 DCHECK(lhs.Is(Type::Number()));
838 DCHECK(rhs.Is(Type::Number()));
839
840 lhs = NumberToInt32(lhs);
841 rhs = NumberToInt32(rhs);
842
843 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
844
845 double lmin = lhs.Min();
846 double rmin = rhs.Min();
847 double lmax = lhs.Max();
848 double rmax = rhs.Max();
849 // Or-ing any two values results in a value no smaller than their minimum.
850 // Even no smaller than their maximum if both values are non-negative.
851 double min =
852 lmin >= 0 && rmin >= 0 ? std::max(lmin, rmin) : std::min(lmin, rmin);
853 double max = kMaxInt;
854
855 // Or-ing with 0 is essentially a conversion to int32.
856 if (rmin == 0 && rmax == 0) {
857 min = lmin;
858 max = lmax;
859 }
860 if (lmin == 0 && lmax == 0) {
861 min = rmin;
862 max = rmax;
863 }
864
865 if (lmax < 0 || rmax < 0) {
866 // Or-ing two values of which at least one is negative results in a negative
867 // value.
868 max = std::min(max, -1.0);
869 }
870 return Type::Range(min, max, zone());
871 }
872
NumberBitwiseAnd(Type lhs,Type rhs)873 Type OperationTyper::NumberBitwiseAnd(Type lhs, Type rhs) {
874 DCHECK(lhs.Is(Type::Number()));
875 DCHECK(rhs.Is(Type::Number()));
876
877 lhs = NumberToInt32(lhs);
878 rhs = NumberToInt32(rhs);
879
880 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
881
882 double lmin = lhs.Min();
883 double rmin = rhs.Min();
884 double lmax = lhs.Max();
885 double rmax = rhs.Max();
886 double min = kMinInt;
887 // And-ing any two values results in a value no larger than their maximum.
888 // Even no larger than their minimum if both values are non-negative.
889 double max =
890 lmin >= 0 && rmin >= 0 ? std::min(lmax, rmax) : std::max(lmax, rmax);
891 // And-ing with a non-negative value x causes the result to be between
892 // zero and x.
893 if (lmin >= 0) {
894 min = 0;
895 max = std::min(max, lmax);
896 }
897 if (rmin >= 0) {
898 min = 0;
899 max = std::min(max, rmax);
900 }
901 return Type::Range(min, max, zone());
902 }
903
NumberBitwiseXor(Type lhs,Type rhs)904 Type OperationTyper::NumberBitwiseXor(Type lhs, Type rhs) {
905 DCHECK(lhs.Is(Type::Number()));
906 DCHECK(rhs.Is(Type::Number()));
907
908 lhs = NumberToInt32(lhs);
909 rhs = NumberToInt32(rhs);
910
911 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
912
913 double lmin = lhs.Min();
914 double rmin = rhs.Min();
915 double lmax = lhs.Max();
916 double rmax = rhs.Max();
917 if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
918 // Xor-ing negative or non-negative values results in a non-negative value.
919 return Type::Unsigned31();
920 }
921 if ((lmax < 0 && rmin >= 0) || (lmin >= 0 && rmax < 0)) {
922 // Xor-ing a negative and a non-negative value results in a negative value.
923 // TODO(jarin) Use a range here.
924 return Type::Negative32();
925 }
926 return Type::Signed32();
927 }
928
NumberShiftLeft(Type lhs,Type rhs)929 Type OperationTyper::NumberShiftLeft(Type lhs, Type rhs) {
930 DCHECK(lhs.Is(Type::Number()));
931 DCHECK(rhs.Is(Type::Number()));
932
933 lhs = NumberToInt32(lhs);
934 rhs = NumberToUint32(rhs);
935
936 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
937
938 int32_t min_lhs = lhs.Min();
939 int32_t max_lhs = lhs.Max();
940 uint32_t min_rhs = rhs.Min();
941 uint32_t max_rhs = rhs.Max();
942 if (max_rhs > 31) {
943 // rhs can be larger than the bitmask
944 max_rhs = 31;
945 min_rhs = 0;
946 }
947
948 if (max_lhs > (kMaxInt >> max_rhs) || min_lhs < (kMinInt >> max_rhs)) {
949 // overflow possible
950 return Type::Signed32();
951 }
952
953 double min =
954 std::min(static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << min_rhs),
955 static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << max_rhs));
956 double max =
957 std::max(static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << min_rhs),
958 static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << max_rhs));
959
960 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
961 return Type::Range(min, max, zone());
962 }
963
NumberShiftRight(Type lhs,Type rhs)964 Type OperationTyper::NumberShiftRight(Type lhs, Type rhs) {
965 DCHECK(lhs.Is(Type::Number()));
966 DCHECK(rhs.Is(Type::Number()));
967
968 lhs = NumberToInt32(lhs);
969 rhs = NumberToUint32(rhs);
970
971 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
972
973 int32_t min_lhs = lhs.Min();
974 int32_t max_lhs = lhs.Max();
975 uint32_t min_rhs = rhs.Min();
976 uint32_t max_rhs = rhs.Max();
977 if (max_rhs > 31) {
978 // rhs can be larger than the bitmask
979 max_rhs = 31;
980 min_rhs = 0;
981 }
982 double min = std::min(min_lhs >> min_rhs, min_lhs >> max_rhs);
983 double max = std::max(max_lhs >> min_rhs, max_lhs >> max_rhs);
984
985 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
986 return Type::Range(min, max, zone());
987 }
988
NumberShiftRightLogical(Type lhs,Type rhs)989 Type OperationTyper::NumberShiftRightLogical(Type lhs, Type rhs) {
990 DCHECK(lhs.Is(Type::Number()));
991 DCHECK(rhs.Is(Type::Number()));
992
993 lhs = NumberToUint32(lhs);
994 rhs = NumberToUint32(rhs);
995
996 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
997
998 uint32_t min_lhs = lhs.Min();
999 uint32_t max_lhs = lhs.Max();
1000 uint32_t min_rhs = rhs.Min();
1001 uint32_t max_rhs = rhs.Max();
1002 if (max_rhs > 31) {
1003 // rhs can be larger than the bitmask
1004 max_rhs = 31;
1005 min_rhs = 0;
1006 }
1007
1008 double min = min_lhs >> max_rhs;
1009 double max = max_lhs >> min_rhs;
1010 DCHECK_LE(0, min);
1011 DCHECK_LE(max, kMaxUInt32);
1012
1013 if (min == 0 && max == kMaxInt) return Type::Unsigned31();
1014 if (min == 0 && max == kMaxUInt32) return Type::Unsigned32();
1015 return Type::Range(min, max, zone());
1016 }
1017
NumberAtan2(Type lhs,Type rhs)1018 Type OperationTyper::NumberAtan2(Type lhs, Type rhs) {
1019 DCHECK(lhs.Is(Type::Number()));
1020 DCHECK(rhs.Is(Type::Number()));
1021 return Type::Number();
1022 }
1023
NumberImul(Type lhs,Type rhs)1024 Type OperationTyper::NumberImul(Type lhs, Type rhs) {
1025 DCHECK(lhs.Is(Type::Number()));
1026 DCHECK(rhs.Is(Type::Number()));
1027 // TODO(turbofan): We should be able to do better here.
1028 return Type::Signed32();
1029 }
1030
NumberMax(Type lhs,Type rhs)1031 Type OperationTyper::NumberMax(Type lhs, Type rhs) {
1032 DCHECK(lhs.Is(Type::Number()));
1033 DCHECK(rhs.Is(Type::Number()));
1034
1035 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1036 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1037
1038 Type type = Type::None();
1039 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1040 type = Type::Union(type, Type::NaN(), zone());
1041 }
1042 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1043 type = Type::Union(type, Type::MinusZero(), zone());
1044 // In order to ensure monotonicity of the computation below, we additionally
1045 // pretend +0 is present (for simplicity on both sides).
1046 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1047 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1048 }
1049 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1050 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1051 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1052 }
1053
1054 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1055 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1056 DCHECK(!lhs.IsNone());
1057 DCHECK(!rhs.IsNone());
1058
1059 double min = std::max(lhs.Min(), rhs.Min());
1060 double max = std::max(lhs.Max(), rhs.Max());
1061 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1062
1063 return type;
1064 }
1065
NumberMin(Type lhs,Type rhs)1066 Type OperationTyper::NumberMin(Type lhs, Type rhs) {
1067 DCHECK(lhs.Is(Type::Number()));
1068 DCHECK(rhs.Is(Type::Number()));
1069
1070 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1071 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1072
1073 Type type = Type::None();
1074 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1075 type = Type::Union(type, Type::NaN(), zone());
1076 }
1077 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1078 type = Type::Union(type, Type::MinusZero(), zone());
1079 // In order to ensure monotonicity of the computation below, we additionally
1080 // pretend +0 is present (for simplicity on both sides).
1081 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1082 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1083 }
1084 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1085 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1086 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1087 }
1088
1089 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1090 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1091 DCHECK(!lhs.IsNone());
1092 DCHECK(!rhs.IsNone());
1093
1094 double min = std::min(lhs.Min(), rhs.Min());
1095 double max = std::min(lhs.Max(), rhs.Max());
1096 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1097
1098 return type;
1099 }
1100
NumberPow(Type lhs,Type rhs)1101 Type OperationTyper::NumberPow(Type lhs, Type rhs) {
1102 DCHECK(lhs.Is(Type::Number()));
1103 DCHECK(rhs.Is(Type::Number()));
1104 // TODO(turbofan): We should be able to do better here.
1105 return Type::Number();
1106 }
1107
1108 #define SPECULATIVE_NUMBER_BINOP(Name) \
1109 Type OperationTyper::Speculative##Name(Type lhs, Type rhs) { \
1110 lhs = SpeculativeToNumber(lhs); \
1111 rhs = SpeculativeToNumber(rhs); \
1112 return Name(lhs, rhs); \
1113 }
1114 SPECULATIVE_NUMBER_BINOP(NumberAdd)
SPECULATIVE_NUMBER_BINOP(NumberSubtract)1115 SPECULATIVE_NUMBER_BINOP(NumberSubtract)
1116 SPECULATIVE_NUMBER_BINOP(NumberMultiply)
1117 SPECULATIVE_NUMBER_BINOP(NumberPow)
1118 SPECULATIVE_NUMBER_BINOP(NumberDivide)
1119 SPECULATIVE_NUMBER_BINOP(NumberModulus)
1120 SPECULATIVE_NUMBER_BINOP(NumberBitwiseOr)
1121 SPECULATIVE_NUMBER_BINOP(NumberBitwiseAnd)
1122 SPECULATIVE_NUMBER_BINOP(NumberBitwiseXor)
1123 SPECULATIVE_NUMBER_BINOP(NumberShiftLeft)
1124 SPECULATIVE_NUMBER_BINOP(NumberShiftRight)
1125 SPECULATIVE_NUMBER_BINOP(NumberShiftRightLogical)
1126 #undef SPECULATIVE_NUMBER_BINOP
1127
1128 Type OperationTyper::BigIntAdd(Type lhs, Type rhs) {
1129 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1130 return Type::BigInt();
1131 }
1132
BigIntSubtract(Type lhs,Type rhs)1133 Type OperationTyper::BigIntSubtract(Type lhs, Type rhs) {
1134 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1135 return Type::BigInt();
1136 }
1137
BigIntNegate(Type type)1138 Type OperationTyper::BigIntNegate(Type type) {
1139 if (type.IsNone()) return type;
1140 return Type::BigInt();
1141 }
1142
SpeculativeBigIntAdd(Type lhs,Type rhs)1143 Type OperationTyper::SpeculativeBigIntAdd(Type lhs, Type rhs) {
1144 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1145 return Type::BigInt();
1146 }
1147
SpeculativeBigIntSubtract(Type lhs,Type rhs)1148 Type OperationTyper::SpeculativeBigIntSubtract(Type lhs, Type rhs) {
1149 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1150 return Type::BigInt();
1151 }
1152
SpeculativeBigIntNegate(Type type)1153 Type OperationTyper::SpeculativeBigIntNegate(Type type) {
1154 if (type.IsNone()) return type;
1155 return Type::BigInt();
1156 }
1157
SpeculativeToNumber(Type type)1158 Type OperationTyper::SpeculativeToNumber(Type type) {
1159 return ToNumber(Type::Intersect(type, Type::NumberOrOddball(), zone()));
1160 }
1161
ToPrimitive(Type type)1162 Type OperationTyper::ToPrimitive(Type type) {
1163 if (type.Is(Type::Primitive())) {
1164 return type;
1165 }
1166 return Type::Primitive();
1167 }
1168
Invert(Type type)1169 Type OperationTyper::Invert(Type type) {
1170 DCHECK(type.Is(Type::Boolean()));
1171 CHECK(!type.IsNone());
1172 if (type.Is(singleton_false())) return singleton_true();
1173 if (type.Is(singleton_true())) return singleton_false();
1174 return type;
1175 }
1176
Invert(ComparisonOutcome outcome)1177 OperationTyper::ComparisonOutcome OperationTyper::Invert(
1178 ComparisonOutcome outcome) {
1179 ComparisonOutcome result(0);
1180 if ((outcome & kComparisonUndefined) != 0) result |= kComparisonUndefined;
1181 if ((outcome & kComparisonTrue) != 0) result |= kComparisonFalse;
1182 if ((outcome & kComparisonFalse) != 0) result |= kComparisonTrue;
1183 return result;
1184 }
1185
FalsifyUndefined(ComparisonOutcome outcome)1186 Type OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
1187 if ((outcome & kComparisonFalse) != 0 ||
1188 (outcome & kComparisonUndefined) != 0) {
1189 return (outcome & kComparisonTrue) != 0 ? Type::Boolean()
1190 : singleton_false();
1191 }
1192 // Type should be non empty, so we know it should be true.
1193 DCHECK_NE(0, outcome & kComparisonTrue);
1194 return singleton_true();
1195 }
1196
1197 namespace {
1198
JSType(Type type)1199 Type JSType(Type type) {
1200 if (type.Is(Type::Boolean())) return Type::Boolean();
1201 if (type.Is(Type::String())) return Type::String();
1202 if (type.Is(Type::Number())) return Type::Number();
1203 if (type.Is(Type::BigInt())) return Type::BigInt();
1204 if (type.Is(Type::Undefined())) return Type::Undefined();
1205 if (type.Is(Type::Null())) return Type::Null();
1206 if (type.Is(Type::Symbol())) return Type::Symbol();
1207 if (type.Is(Type::Receiver())) return Type::Receiver(); // JS "Object"
1208 return Type::Any();
1209 }
1210
1211 } // namespace
1212
SameValue(Type lhs,Type rhs)1213 Type OperationTyper::SameValue(Type lhs, Type rhs) {
1214 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1215 if (lhs.Is(Type::NaN())) {
1216 if (rhs.Is(Type::NaN())) return singleton_true();
1217 if (!rhs.Maybe(Type::NaN())) return singleton_false();
1218 } else if (rhs.Is(Type::NaN())) {
1219 if (!lhs.Maybe(Type::NaN())) return singleton_false();
1220 }
1221 if (lhs.Is(Type::MinusZero())) {
1222 if (rhs.Is(Type::MinusZero())) return singleton_true();
1223 if (!rhs.Maybe(Type::MinusZero())) return singleton_false();
1224 } else if (rhs.Is(Type::MinusZero())) {
1225 if (!lhs.Maybe(Type::MinusZero())) return singleton_false();
1226 }
1227 if (lhs.Is(Type::OrderedNumber()) && rhs.Is(Type::OrderedNumber()) &&
1228 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1229 return singleton_false();
1230 }
1231 return Type::Boolean();
1232 }
1233
SameValueNumbersOnly(Type lhs,Type rhs)1234 Type OperationTyper::SameValueNumbersOnly(Type lhs, Type rhs) {
1235 // SameValue and SamevalueNumbersOnly only differ in treatment of
1236 // strings and biginits. Since the SameValue typer does not do anything
1237 // special about strings or bigints, we can just use it here.
1238 return SameValue(lhs, rhs);
1239 }
1240
StrictEqual(Type lhs,Type rhs)1241 Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
1242 CHECK(!lhs.IsNone());
1243 CHECK(!rhs.IsNone());
1244 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1245 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return singleton_false();
1246 if (lhs.Is(Type::Number()) && rhs.Is(Type::Number()) &&
1247 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1248 return singleton_false();
1249 }
1250 if (lhs.IsSingleton() && rhs.Is(lhs)) {
1251 // Types are equal and are inhabited only by a single semantic value,
1252 // which is not nan due to the earlier check.
1253 DCHECK(lhs.Is(rhs));
1254 return singleton_true();
1255 }
1256 if ((lhs.Is(Type::Unique()) || rhs.Is(Type::Unique())) && !lhs.Maybe(rhs)) {
1257 // One of the inputs has a canonical representation but types don't overlap.
1258 return singleton_false();
1259 }
1260 return Type::Boolean();
1261 }
1262
CheckBounds(Type index,Type length)1263 Type OperationTyper::CheckBounds(Type index, Type length) {
1264 DCHECK(length.Is(cache_->kPositiveSafeInteger));
1265 if (length.Is(cache_->kSingletonZero)) return Type::None();
1266 Type const upper_bound = Type::Range(0.0, length.Max() - 1, zone());
1267 if (index.Maybe(Type::String())) return upper_bound;
1268 if (index.Maybe(Type::MinusZero())) {
1269 index = Type::Union(index, cache_->kSingletonZero, zone());
1270 }
1271 return Type::Intersect(index, upper_bound, zone());
1272 }
1273
CheckFloat64Hole(Type type)1274 Type OperationTyper::CheckFloat64Hole(Type type) {
1275 if (type.Maybe(Type::Hole())) {
1276 // Turn "the hole" into undefined.
1277 type = Type::Intersect(type, Type::Number(), zone());
1278 type = Type::Union(type, Type::Undefined(), zone());
1279 }
1280 return type;
1281 }
1282
CheckNumber(Type type)1283 Type OperationTyper::CheckNumber(Type type) {
1284 return Type::Intersect(type, Type::Number(), zone());
1285 }
1286
TypeTypeGuard(const Operator * sigma_op,Type input)1287 Type OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type input) {
1288 return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
1289 }
1290
ConvertTaggedHoleToUndefined(Type input)1291 Type OperationTyper::ConvertTaggedHoleToUndefined(Type input) {
1292 if (input.Maybe(Type::Hole())) {
1293 // Turn "the hole" into undefined.
1294 Type type = Type::Intersect(input, Type::NonInternal(), zone());
1295 return Type::Union(type, Type::Undefined(), zone());
1296 }
1297 return input;
1298 }
1299
ToBoolean(Type type)1300 Type OperationTyper::ToBoolean(Type type) {
1301 if (type.Is(Type::Boolean())) return type;
1302 if (type.Is(falsish_)) return singleton_false_;
1303 if (type.Is(truish_)) return singleton_true_;
1304 if (type.Is(Type::Number())) {
1305 return NumberToBoolean(type);
1306 }
1307 return Type::Boolean();
1308 }
1309
1310 } // namespace compiler
1311 } // namespace internal
1312 } // namespace v8
1313