1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "src/compiler/verifier.h"
6 
7 #include <algorithm>
8 #include <deque>
9 #include <queue>
10 #include <sstream>
11 #include <string>
12 
13 #include "src/bit-vector.h"
14 #include "src/compiler/all-nodes.h"
15 #include "src/compiler/common-operator.h"
16 #include "src/compiler/graph.h"
17 #include "src/compiler/js-operator.h"
18 #include "src/compiler/node-properties.h"
19 #include "src/compiler/node.h"
20 #include "src/compiler/opcodes.h"
21 #include "src/compiler/operator-properties.h"
22 #include "src/compiler/operator.h"
23 #include "src/compiler/schedule.h"
24 #include "src/compiler/simplified-operator.h"
25 #include "src/compiler/type-cache.h"
26 #include "src/ostreams.h"
27 
28 namespace v8 {
29 namespace internal {
30 namespace compiler {
31 
32 
33 class Verifier::Visitor {
34  public:
Visitor(Zone * z,Typing typed,CheckInputs check_inputs,CodeType code_type)35   Visitor(Zone* z, Typing typed, CheckInputs check_inputs, CodeType code_type)
36       : zone(z),
37         typing(typed),
38         check_inputs(check_inputs),
39         code_type(code_type) {}
40 
41   void Check(Node* node, const AllNodes& all);
42 
43   Zone* zone;
44   Typing typing;
45   CheckInputs check_inputs;
46   CodeType code_type;
47 
48  private:
CheckNotTyped(Node * node)49   void CheckNotTyped(Node* node) {
50     if (NodeProperties::IsTyped(node)) {
51       std::ostringstream str;
52       str << "TypeError: node #" << node->id() << ":" << *node->op()
53           << " should never have a type";
54       FATAL("%s", str.str().c_str());
55     }
56   }
CheckTypeIs(Node * node,Type type)57   void CheckTypeIs(Node* node, Type type) {
58     if (typing == TYPED && !NodeProperties::GetType(node).Is(type)) {
59       std::ostringstream str;
60       str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
61           << NodeProperties::GetType(node) << " is not " << type;
62       FATAL("%s", str.str().c_str());
63     }
64   }
CheckTypeMaybe(Node * node,Type type)65   void CheckTypeMaybe(Node* node, Type type) {
66     if (typing == TYPED && !NodeProperties::GetType(node).Maybe(type)) {
67       std::ostringstream str;
68       str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
69           << NodeProperties::GetType(node) << " must intersect " << type;
70       FATAL("%s", str.str().c_str());
71     }
72   }
CheckValueInputIs(Node * node,int i,Type type)73   void CheckValueInputIs(Node* node, int i, Type type) {
74     Node* input = NodeProperties::GetValueInput(node, i);
75     if (typing == TYPED && !NodeProperties::GetType(input).Is(type)) {
76       std::ostringstream str;
77       str << "TypeError: node #" << node->id() << ":" << *node->op()
78           << "(input @" << i << " = " << input->opcode() << ":"
79           << input->op()->mnemonic() << ") type "
80           << NodeProperties::GetType(input) << " is not " << type;
81       FATAL("%s", str.str().c_str());
82     }
83   }
CheckOutput(Node * node,Node * use,int count,const char * kind)84   void CheckOutput(Node* node, Node* use, int count, const char* kind) {
85     if (count <= 0) {
86       std::ostringstream str;
87       str << "GraphError: node #" << node->id() << ":" << *node->op()
88           << " does not produce " << kind << " output used by node #"
89           << use->id() << ":" << *use->op();
90       FATAL("%s", str.str().c_str());
91     }
92   }
93 };
94 
Check(Node * node,const AllNodes & all)95 void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
96   int value_count = node->op()->ValueInputCount();
97   int context_count = OperatorProperties::GetContextInputCount(node->op());
98   int frame_state_count =
99       OperatorProperties::GetFrameStateInputCount(node->op());
100   int effect_count = node->op()->EffectInputCount();
101   int control_count = node->op()->ControlInputCount();
102 
103   // Verify number of inputs matches up.
104   int input_count = value_count + context_count + frame_state_count;
105   if (check_inputs == kAll) {
106     input_count += effect_count + control_count;
107   }
108   CHECK_EQ(input_count, node->InputCount());
109 
110   // If this node has any effect outputs, make sure that it is
111   // consumed as an effect input somewhere else.
112   // TODO(mvstanton): support this kind of verification for WASM
113   // compiles, too.
114   if (code_type != kWasm && node->op()->EffectOutputCount() > 0) {
115     int effect_edges = 0;
116     for (Edge edge : node->use_edges()) {
117       if (all.IsLive(edge.from()) && NodeProperties::IsEffectEdge(edge)) {
118         effect_edges++;
119       }
120     }
121     DCHECK_GT(effect_edges, 0);
122   }
123 
124   // Verify that frame state has been inserted for the nodes that need it.
125   for (int i = 0; i < frame_state_count; i++) {
126     Node* frame_state = NodeProperties::GetFrameStateInput(node);
127     CHECK(frame_state->opcode() == IrOpcode::kFrameState ||
128           // kFrameState uses Start as a sentinel.
129           (node->opcode() == IrOpcode::kFrameState &&
130            frame_state->opcode() == IrOpcode::kStart));
131   }
132 
133   // Verify all value inputs actually produce a value.
134   for (int i = 0; i < value_count; ++i) {
135     Node* value = NodeProperties::GetValueInput(node, i);
136     CheckOutput(value, node, value->op()->ValueOutputCount(), "value");
137     // Verify that only parameters and projections can have input nodes with
138     // multiple outputs.
139     CHECK(node->opcode() == IrOpcode::kParameter ||
140           node->opcode() == IrOpcode::kProjection ||
141           value->op()->ValueOutputCount() <= 1);
142   }
143 
144   // Verify all context inputs are value nodes.
145   for (int i = 0; i < context_count; ++i) {
146     Node* context = NodeProperties::GetContextInput(node);
147     CheckOutput(context, node, context->op()->ValueOutputCount(), "context");
148   }
149 
150   if (check_inputs == kAll) {
151     // Verify all effect inputs actually have an effect.
152     for (int i = 0; i < effect_count; ++i) {
153       Node* effect = NodeProperties::GetEffectInput(node);
154       CheckOutput(effect, node, effect->op()->EffectOutputCount(), "effect");
155     }
156 
157     // Verify all control inputs are control nodes.
158     for (int i = 0; i < control_count; ++i) {
159       Node* control = NodeProperties::GetControlInput(node, i);
160       CheckOutput(control, node, control->op()->ControlOutputCount(),
161                   "control");
162     }
163 
164     // Verify that nodes that can throw either have both IfSuccess/IfException
165     // projections as the only control uses or no projections at all.
166     if (!node->op()->HasProperty(Operator::kNoThrow)) {
167       Node* discovered_if_exception = nullptr;
168       Node* discovered_if_success = nullptr;
169       int total_number_of_control_uses = 0;
170       for (Edge edge : node->use_edges()) {
171         if (!NodeProperties::IsControlEdge(edge)) {
172           continue;
173         }
174         total_number_of_control_uses++;
175         Node* control_use = edge.from();
176         if (control_use->opcode() == IrOpcode::kIfSuccess) {
177           CHECK_NULL(discovered_if_success);  // Only one allowed.
178           discovered_if_success = control_use;
179         }
180         if (control_use->opcode() == IrOpcode::kIfException) {
181           CHECK_NULL(discovered_if_exception);  // Only one allowed.
182           discovered_if_exception = control_use;
183         }
184       }
185       if (discovered_if_success && !discovered_if_exception) {
186         FATAL(
187             "#%d:%s should be followed by IfSuccess/IfException, but is "
188             "only followed by single #%d:%s",
189             node->id(), node->op()->mnemonic(), discovered_if_success->id(),
190             discovered_if_success->op()->mnemonic());
191       }
192       if (discovered_if_exception && !discovered_if_success) {
193         FATAL(
194             "#%d:%s should be followed by IfSuccess/IfException, but is "
195             "only followed by single #%d:%s",
196             node->id(), node->op()->mnemonic(), discovered_if_exception->id(),
197             discovered_if_exception->op()->mnemonic());
198       }
199       if (discovered_if_success || discovered_if_exception) {
200         CHECK_EQ(2, total_number_of_control_uses);
201       }
202     }
203   }
204 
205   switch (node->opcode()) {
206     case IrOpcode::kStart:
207       // Start has no inputs.
208       CHECK_EQ(0, input_count);
209       // Type is a tuple.
210       // TODO(rossberg): Multiple outputs are currently typed as Internal.
211       CheckTypeIs(node, Type::Internal());
212       break;
213     case IrOpcode::kEnd:
214       // End has no outputs.
215       CHECK_EQ(0, node->op()->ValueOutputCount());
216       CHECK_EQ(0, node->op()->EffectOutputCount());
217       CHECK_EQ(0, node->op()->ControlOutputCount());
218       // All inputs are graph terminators.
219       for (const Node* input : node->inputs()) {
220         CHECK(IrOpcode::IsGraphTerminator(input->opcode()));
221       }
222       // Type is empty.
223       CheckNotTyped(node);
224       break;
225     case IrOpcode::kDead:
226       // Dead is never connected to the graph.
227       UNREACHABLE();
228     case IrOpcode::kDeadValue:
229       CheckValueInputIs(node, 0, Type::None());
230       CheckTypeIs(node, Type::None());
231       break;
232     case IrOpcode::kUnreachable:
233       CheckTypeIs(node, Type::None());
234       for (Edge edge : node->use_edges()) {
235         Node* use = edge.from();
236         if (NodeProperties::IsValueEdge(edge) && all.IsLive(use)) {
237           // {Unreachable} nodes can only be used by {DeadValue}, because they
238           // don't actually produce a value.
239           CHECK_EQ(IrOpcode::kDeadValue, use->opcode());
240         }
241       }
242       break;
243     case IrOpcode::kBranch: {
244       // Branch uses are IfTrue and IfFalse.
245       int count_true = 0, count_false = 0;
246       for (const Node* use : node->uses()) {
247         CHECK(all.IsLive(use) && (use->opcode() == IrOpcode::kIfTrue ||
248                                   use->opcode() == IrOpcode::kIfFalse));
249         if (use->opcode() == IrOpcode::kIfTrue) ++count_true;
250         if (use->opcode() == IrOpcode::kIfFalse) ++count_false;
251       }
252       CHECK_EQ(1, count_true);
253       CHECK_EQ(1, count_false);
254       // The condition must be a Boolean.
255       CheckValueInputIs(node, 0, Type::Boolean());
256       // Type is empty.
257       CheckNotTyped(node);
258       break;
259     }
260     case IrOpcode::kIfTrue:
261     case IrOpcode::kIfFalse: {
262       Node* control = NodeProperties::GetControlInput(node, 0);
263       CHECK_EQ(IrOpcode::kBranch, control->opcode());
264       // Type is empty.
265       CheckNotTyped(node);
266       break;
267     }
268     case IrOpcode::kIfSuccess: {
269       // IfSuccess and IfException continuation only on throwing nodes.
270       Node* input = NodeProperties::GetControlInput(node, 0);
271       CHECK(!input->op()->HasProperty(Operator::kNoThrow));
272       // Type is empty.
273       CheckNotTyped(node);
274       break;
275     }
276     case IrOpcode::kIfException: {
277       // IfSuccess and IfException continuation only on throwing nodes.
278       Node* input = NodeProperties::GetControlInput(node, 0);
279       CHECK(!input->op()->HasProperty(Operator::kNoThrow));
280       // Type can be anything.
281       CheckTypeIs(node, Type::Any());
282       break;
283     }
284     case IrOpcode::kSwitch: {
285       // Switch uses are Case and Default.
286       int count_case = 0, count_default = 0;
287       for (const Node* use : node->uses()) {
288         CHECK(all.IsLive(use));
289         switch (use->opcode()) {
290           case IrOpcode::kIfValue: {
291             for (const Node* user : node->uses()) {
292               if (user != use && user->opcode() == IrOpcode::kIfValue) {
293                 CHECK_NE(IfValueParametersOf(use->op()).value(),
294                          IfValueParametersOf(user->op()).value());
295               }
296             }
297             ++count_case;
298             break;
299           }
300           case IrOpcode::kIfDefault: {
301             ++count_default;
302             break;
303           }
304           default: {
305             FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
306                   use->op()->mnemonic());
307             break;
308           }
309         }
310       }
311       CHECK_EQ(1, count_default);
312       CHECK_EQ(node->op()->ControlOutputCount(), count_case + count_default);
313       // Type is empty.
314       CheckNotTyped(node);
315       break;
316     }
317     case IrOpcode::kIfValue:
318     case IrOpcode::kIfDefault:
319       CHECK_EQ(IrOpcode::kSwitch,
320                NodeProperties::GetControlInput(node)->opcode());
321       // Type is empty.
322       CheckNotTyped(node);
323       break;
324     case IrOpcode::kLoop: {
325       CHECK_EQ(control_count, input_count);
326       // Type is empty.
327       CheckNotTyped(node);
328       // All loops need to be connected to a {Terminate} node to ensure they
329       // stay connected to the graph end.
330       bool has_terminate = false;
331       for (const Node* use : node->uses()) {
332         if (all.IsLive(use) && use->opcode() == IrOpcode::kTerminate) {
333           has_terminate = true;
334           break;
335         }
336       }
337       CHECK(has_terminate);
338       break;
339     }
340     case IrOpcode::kMerge:
341       CHECK_EQ(control_count, input_count);
342       // Type is empty.
343       CheckNotTyped(node);
344       break;
345     case IrOpcode::kDeoptimizeIf:
346     case IrOpcode::kDeoptimizeUnless:
347       // Type is empty.
348       CheckNotTyped(node);
349       break;
350     case IrOpcode::kTrapIf:
351     case IrOpcode::kTrapUnless:
352       // Type is empty.
353       CheckNotTyped(node);
354       break;
355     case IrOpcode::kDeoptimize:
356     case IrOpcode::kReturn:
357     case IrOpcode::kThrow:
358       // Deoptimize, Return and Throw uses are End.
359       for (const Node* use : node->uses()) {
360         if (all.IsLive(use)) {
361           CHECK_EQ(IrOpcode::kEnd, use->opcode());
362         }
363       }
364       // Type is empty.
365       CheckNotTyped(node);
366       break;
367     case IrOpcode::kTerminate:
368       // Terminates take one loop and effect.
369       CHECK_EQ(1, control_count);
370       CHECK_EQ(1, effect_count);
371       CHECK_EQ(2, input_count);
372       CHECK_EQ(IrOpcode::kLoop,
373                NodeProperties::GetControlInput(node)->opcode());
374       // Terminate uses are End.
375       for (const Node* use : node->uses()) {
376         if (all.IsLive(use)) {
377           CHECK_EQ(IrOpcode::kEnd, use->opcode());
378         }
379       }
380       // Type is empty.
381       CheckNotTyped(node);
382       break;
383     case IrOpcode::kOsrNormalEntry:
384     case IrOpcode::kOsrLoopEntry:
385       // Osr entries take one control and effect.
386       CHECK_EQ(1, control_count);
387       CHECK_EQ(1, effect_count);
388       CHECK_EQ(2, input_count);
389       // Type is empty.
390       CheckNotTyped(node);
391       break;
392 
393     // Common operators
394     // ----------------
395     case IrOpcode::kParameter: {
396       // Parameters have the start node as inputs.
397       CHECK_EQ(1, input_count);
398       // Parameter has an input that produces enough values.
399       int const index = ParameterIndexOf(node->op());
400       Node* const start = NodeProperties::GetValueInput(node, 0);
401       CHECK_EQ(IrOpcode::kStart, start->opcode());
402       // Currently, parameter indices start at -1 instead of 0.
403       CHECK_LE(-1, index);
404       CHECK_LT(index + 1, start->op()->ValueOutputCount());
405       // Type can be anything.
406       CheckTypeIs(node, Type::Any());
407       break;
408     }
409     case IrOpcode::kInt32Constant:  // TODO(turbofan): rename Word32Constant?
410     case IrOpcode::kInt64Constant:  // TODO(turbofan): rename Word64Constant?
411     case IrOpcode::kFloat32Constant:
412     case IrOpcode::kFloat64Constant:
413     case IrOpcode::kRelocatableInt32Constant:
414     case IrOpcode::kRelocatableInt64Constant:
415       // Constants have no inputs.
416       CHECK_EQ(0, input_count);
417       // Type is empty.
418       CheckNotTyped(node);
419       break;
420     case IrOpcode::kNumberConstant:
421       // Constants have no inputs.
422       CHECK_EQ(0, input_count);
423       // Type is a number.
424       CheckTypeIs(node, Type::Number());
425       break;
426     case IrOpcode::kHeapConstant:
427       // Constants have no inputs.
428       CHECK_EQ(0, input_count);
429       // Type is anything.
430       CheckTypeIs(node, Type::Any());
431       break;
432     case IrOpcode::kExternalConstant:
433     case IrOpcode::kPointerConstant:
434       // Constants have no inputs.
435       CHECK_EQ(0, input_count);
436       // Type is an external pointer.
437       CheckTypeIs(node, Type::ExternalPointer());
438       break;
439     case IrOpcode::kOsrValue:
440       // OSR values have a value and a control input.
441       CHECK_EQ(1, control_count);
442       CHECK_EQ(1, input_count);
443       // Type is merged from other values in the graph and could be any.
444       CheckTypeIs(node, Type::Any());
445       break;
446     case IrOpcode::kProjection: {
447       // Projection has an input that produces enough values.
448       int index = static_cast<int>(ProjectionIndexOf(node->op()));
449       Node* input = NodeProperties::GetValueInput(node, 0);
450       CHECK_GT(input->op()->ValueOutputCount(), index);
451       // Type can be anything.
452       // TODO(rossberg): Introduce tuple types for this.
453       // TODO(titzer): Convince rossberg not to.
454       CheckTypeIs(node, Type::Any());
455       break;
456     }
457     case IrOpcode::kSelect: {
458       CHECK_EQ(0, effect_count);
459       CHECK_EQ(0, control_count);
460       CHECK_EQ(3, value_count);
461       // The condition must be a Boolean.
462       CheckValueInputIs(node, 0, Type::Boolean());
463       // Type can be anything.
464       CheckTypeIs(node, Type::Any());
465       break;
466     }
467     case IrOpcode::kPhi: {
468       // Phi input count matches parent control node.
469       CHECK_EQ(0, effect_count);
470       CHECK_EQ(1, control_count);
471       Node* control = NodeProperties::GetControlInput(node, 0);
472       CHECK_EQ(value_count, control->op()->ControlInputCount());
473       CHECK_EQ(input_count, 1 + value_count);
474       // Type must be subsumed by all input types.
475       // TODO(rossberg): for now at least, narrowing does not really hold.
476       /*
477       for (int i = 0; i < value_count; ++i) {
478         CHECK(type_of(ValueInput(node, i))->Is(type_of(node)));
479       }
480       */
481       break;
482     }
483     case IrOpcode::kInductionVariablePhi: {
484       // This is only a temporary node for the typer.
485       UNREACHABLE();
486       break;
487     }
488     case IrOpcode::kEffectPhi: {
489       // EffectPhi input count matches parent control node.
490       CHECK_EQ(0, value_count);
491       CHECK_EQ(1, control_count);
492       Node* control = NodeProperties::GetControlInput(node, 0);
493       CHECK_EQ(effect_count, control->op()->ControlInputCount());
494       CHECK_EQ(input_count, 1 + effect_count);
495       // If the control input is a Merge, then make sure that at least one
496       // of it's usages is non-phi.
497       if (control->opcode() == IrOpcode::kMerge) {
498         bool non_phi_use_found = false;
499         for (Node* use : control->uses()) {
500           if (all.IsLive(use) && use->opcode() != IrOpcode::kEffectPhi &&
501               use->opcode() != IrOpcode::kPhi) {
502             non_phi_use_found = true;
503           }
504         }
505         CHECK(non_phi_use_found);
506       }
507       break;
508     }
509     case IrOpcode::kLoopExit: {
510       CHECK_EQ(2, control_count);
511       Node* loop = NodeProperties::GetControlInput(node, 1);
512       CHECK_EQ(IrOpcode::kLoop, loop->opcode());
513       break;
514     }
515     case IrOpcode::kLoopExitValue: {
516       CHECK_EQ(1, control_count);
517       Node* loop_exit = NodeProperties::GetControlInput(node, 0);
518       CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
519       break;
520     }
521     case IrOpcode::kLoopExitEffect: {
522       CHECK_EQ(1, control_count);
523       Node* loop_exit = NodeProperties::GetControlInput(node, 0);
524       CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
525       break;
526     }
527     case IrOpcode::kCheckpoint:
528       // Type is empty.
529       CheckNotTyped(node);
530       break;
531     case IrOpcode::kBeginRegion:
532       // TODO(rossberg): what are the constraints on these?
533       break;
534     case IrOpcode::kFinishRegion: {
535       // TODO(rossberg): what are the constraints on these?
536       // Type must be subsumed by input type.
537       if (typing == TYPED) {
538         Node* val = NodeProperties::GetValueInput(node, 0);
539         CHECK(NodeProperties::GetType(val).Is(NodeProperties::GetType(node)));
540       }
541       break;
542     }
543     case IrOpcode::kFrameState: {
544       // TODO(jarin): what are the constraints on these?
545       CHECK_EQ(5, value_count);
546       CHECK_EQ(0, control_count);
547       CHECK_EQ(0, effect_count);
548       CHECK_EQ(6, input_count);
549       // Check that the parameters and registers are kStateValues or
550       // kTypedStateValues.
551       for (int i = 0; i < 2; ++i) {
552         CHECK(NodeProperties::GetValueInput(node, i)->opcode() ==
553                   IrOpcode::kStateValues ||
554               NodeProperties::GetValueInput(node, i)->opcode() ==
555                   IrOpcode::kTypedStateValues);
556       }
557       // The accumulator (InputAt(2)) cannot be kStateValues, but it can be
558       // kTypedStateValues (to signal the type). Once AST graph builder
559       // is removed, we should check this here. Until then, AST graph
560       // builder can generate expression stack as InputAt(2), which can
561       // still be kStateValues.
562       break;
563     }
564     case IrOpcode::kObjectId:
565       CheckTypeIs(node, Type::Object());
566       break;
567     case IrOpcode::kStateValues:
568     case IrOpcode::kTypedStateValues:
569     case IrOpcode::kArgumentsElementsState:
570     case IrOpcode::kArgumentsLengthState:
571     case IrOpcode::kObjectState:
572     case IrOpcode::kTypedObjectState:
573       // TODO(jarin): what are the constraints on these?
574       break;
575     case IrOpcode::kCall:
576     case IrOpcode::kCallWithCallerSavedRegisters:
577       // TODO(rossberg): what are the constraints on these?
578       break;
579     case IrOpcode::kTailCall:
580       // TODO(bmeurer): what are the constraints on these?
581       break;
582 
583     // JavaScript operators
584     // --------------------
585     case IrOpcode::kJSEqual:
586     case IrOpcode::kJSStrictEqual:
587     case IrOpcode::kJSLessThan:
588     case IrOpcode::kJSGreaterThan:
589     case IrOpcode::kJSLessThanOrEqual:
590     case IrOpcode::kJSGreaterThanOrEqual:
591       // Type is Boolean.
592       CheckTypeIs(node, Type::Boolean());
593       break;
594 
595     case IrOpcode::kJSAdd:
596       CheckTypeIs(node, Type::NumericOrString());
597       break;
598     case IrOpcode::kJSBitwiseOr:
599     case IrOpcode::kJSBitwiseXor:
600     case IrOpcode::kJSBitwiseAnd:
601     case IrOpcode::kJSShiftLeft:
602     case IrOpcode::kJSShiftRight:
603     case IrOpcode::kJSShiftRightLogical:
604     case IrOpcode::kJSSubtract:
605     case IrOpcode::kJSMultiply:
606     case IrOpcode::kJSDivide:
607     case IrOpcode::kJSModulus:
608     case IrOpcode::kJSExponentiate:
609     case IrOpcode::kJSBitwiseNot:
610     case IrOpcode::kJSDecrement:
611     case IrOpcode::kJSIncrement:
612     case IrOpcode::kJSNegate:
613       CheckTypeIs(node, Type::Numeric());
614       break;
615 
616     case IrOpcode::kToBoolean:
617       // Type is Boolean.
618       CheckTypeIs(node, Type::Boolean());
619       break;
620     case IrOpcode::kJSToInteger:
621       // Type is OrderedNumber.
622       CheckTypeIs(node, Type::OrderedNumber());
623       break;
624     case IrOpcode::kJSToLength:
625       CheckTypeIs(node, Type::Range(0, kMaxSafeInteger, zone));
626       break;
627     case IrOpcode::kJSToName:
628       // Type is Name.
629       CheckTypeIs(node, Type::Name());
630       break;
631     case IrOpcode::kJSToNumber:
632       // Type is Number.
633       CheckTypeIs(node, Type::Number());
634       break;
635     case IrOpcode::kJSToNumeric:
636       // Type is Numeric.
637       CheckTypeIs(node, Type::Numeric());
638       break;
639     case IrOpcode::kJSToString:
640       // Type is String.
641       CheckTypeIs(node, Type::String());
642       break;
643     case IrOpcode::kJSToObject:
644       // Type is Receiver.
645       CheckTypeIs(node, Type::Receiver());
646       break;
647     case IrOpcode::kJSParseInt:
648       // Type is Receiver.
649       CheckValueInputIs(node, 0, Type::Any());
650       CheckValueInputIs(node, 1, Type::Any());
651       CheckTypeIs(node, Type::Number());
652       break;
653 
654     case IrOpcode::kJSCreate:
655       // Type is Object.
656       CheckTypeIs(node, Type::Object());
657       break;
658     case IrOpcode::kJSCreateArguments:
659       // Type is Array \/ OtherObject.
660       CheckTypeIs(node, Type::ArrayOrOtherObject());
661       break;
662     case IrOpcode::kJSCreateArray:
663       // Type is Array.
664       CheckTypeIs(node, Type::Array());
665       break;
666     case IrOpcode::kJSCreateArrayIterator:
667       // Type is OtherObject.
668       CheckTypeIs(node, Type::OtherObject());
669       break;
670     case IrOpcode::kJSCreateCollectionIterator:
671       // Type is OtherObject.
672       CheckTypeIs(node, Type::OtherObject());
673       break;
674     case IrOpcode::kJSCreateBoundFunction:
675       // Type is BoundFunction.
676       CheckTypeIs(node, Type::BoundFunction());
677       break;
678     case IrOpcode::kJSCreateClosure:
679       // Type is Function.
680       CheckTypeIs(node, Type::Function());
681       break;
682     case IrOpcode::kJSCreateIterResultObject:
683       // Type is OtherObject.
684       CheckTypeIs(node, Type::OtherObject());
685       break;
686     case IrOpcode::kJSCreateStringIterator:
687       // Type is OtherObject.
688       CheckTypeIs(node, Type::OtherObject());
689       break;
690     case IrOpcode::kJSCreateKeyValueArray:
691       // Type is OtherObject.
692       CheckTypeIs(node, Type::OtherObject());
693       break;
694     case IrOpcode::kJSCreateObject:
695       // Type is Object.
696       CheckTypeIs(node, Type::OtherObject());
697       break;
698     case IrOpcode::kJSCreatePromise:
699       // Type is OtherObject.
700       CheckTypeIs(node, Type::OtherObject());
701       break;
702     case IrOpcode::kJSCreateTypedArray:
703       // Type is OtherObject.
704       CheckTypeIs(node, Type::OtherObject());
705       break;
706     case IrOpcode::kJSCreateLiteralArray:
707       // Type is Array.
708       CheckTypeIs(node, Type::Array());
709       break;
710     case IrOpcode::kJSCreateEmptyLiteralArray:
711       // Type is Array.
712       CheckTypeIs(node, Type::Array());
713       break;
714     case IrOpcode::kJSCreateLiteralObject:
715     case IrOpcode::kJSCreateEmptyLiteralObject:
716     case IrOpcode::kJSCreateLiteralRegExp:
717       // Type is OtherObject.
718       CheckTypeIs(node, Type::OtherObject());
719       break;
720     case IrOpcode::kJSLoadProperty:
721       // Type can be anything.
722       CheckTypeIs(node, Type::Any());
723       CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
724       break;
725     case IrOpcode::kJSLoadNamed:
726       // Type can be anything.
727       CheckTypeIs(node, Type::Any());
728       CHECK(NamedAccessOf(node->op()).feedback().IsValid());
729       break;
730     case IrOpcode::kJSLoadGlobal:
731       // Type can be anything.
732       CheckTypeIs(node, Type::Any());
733       CHECK(LoadGlobalParametersOf(node->op()).feedback().IsValid());
734       break;
735     case IrOpcode::kJSStoreProperty:
736       // Type is empty.
737       CheckNotTyped(node);
738       CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
739       break;
740     case IrOpcode::kJSStoreNamed:
741       // Type is empty.
742       CheckNotTyped(node);
743       CHECK(NamedAccessOf(node->op()).feedback().IsValid());
744       break;
745     case IrOpcode::kJSStoreGlobal:
746       // Type is empty.
747       CheckNotTyped(node);
748       CHECK(StoreGlobalParametersOf(node->op()).feedback().IsValid());
749       break;
750     case IrOpcode::kJSStoreNamedOwn:
751       // Type is empty.
752       CheckNotTyped(node);
753       CHECK(StoreNamedOwnParametersOf(node->op()).feedback().IsValid());
754       break;
755     case IrOpcode::kJSStoreDataPropertyInLiteral:
756     case IrOpcode::kJSStoreInArrayLiteral:
757       // Type is empty.
758       CheckNotTyped(node);
759       CHECK(FeedbackParameterOf(node->op()).feedback().IsValid());
760       break;
761     case IrOpcode::kJSDeleteProperty:
762     case IrOpcode::kJSHasProperty:
763     case IrOpcode::kJSHasInPrototypeChain:
764     case IrOpcode::kJSInstanceOf:
765     case IrOpcode::kJSOrdinaryHasInstance:
766       // Type is Boolean.
767       CheckTypeIs(node, Type::Boolean());
768       break;
769     case IrOpcode::kTypeOf:
770       // Type is InternalizedString.
771       CheckTypeIs(node, Type::InternalizedString());
772       break;
773     case IrOpcode::kJSGetSuperConstructor:
774       // We don't check the input for Type::Function because
775       // this_function can be context-allocated.
776       // Any -> Callable.
777       CheckValueInputIs(node, 0, Type::Any());
778       CheckTypeIs(node, Type::Callable());
779       break;
780 
781     case IrOpcode::kJSLoadContext:
782       // Type can be anything.
783       CheckTypeIs(node, Type::Any());
784       break;
785     case IrOpcode::kJSStoreContext:
786       // Type is empty.
787       CheckNotTyped(node);
788       break;
789     case IrOpcode::kJSCreateFunctionContext:
790     case IrOpcode::kJSCreateCatchContext:
791     case IrOpcode::kJSCreateWithContext:
792     case IrOpcode::kJSCreateBlockContext: {
793       // Type is Context, and operand is Internal.
794       Node* context = NodeProperties::GetContextInput(node);
795       // TODO(bmeurer): This should say CheckTypeIs, but we don't have type
796       // OtherInternal on certain contexts, i.e. those from OsrValue inputs.
797       CheckTypeMaybe(context, Type::OtherInternal());
798       CheckTypeIs(node, Type::OtherInternal());
799       break;
800     }
801 
802     case IrOpcode::kJSConstructForwardVarargs:
803     case IrOpcode::kJSConstruct:
804     case IrOpcode::kJSConstructWithArrayLike:
805     case IrOpcode::kJSConstructWithSpread:
806       // Type is Receiver.
807       CheckTypeIs(node, Type::Receiver());
808       break;
809     case IrOpcode::kJSCallForwardVarargs:
810     case IrOpcode::kJSCall:
811     case IrOpcode::kJSCallWithArrayLike:
812     case IrOpcode::kJSCallWithSpread:
813     case IrOpcode::kJSCallRuntime:
814       // Type can be anything.
815       CheckTypeIs(node, Type::Any());
816       break;
817 
818     case IrOpcode::kJSForInEnumerate:
819       // Any -> OtherInternal.
820       CheckValueInputIs(node, 0, Type::Any());
821       CheckTypeIs(node, Type::OtherInternal());
822       break;
823     case IrOpcode::kJSForInPrepare:
824       // TODO(bmeurer): What are the constraints on thse?
825       CheckTypeIs(node, Type::Any());
826       break;
827     case IrOpcode::kJSForInNext:
828       CheckTypeIs(node, Type::Union(Type::Name(), Type::Undefined(), zone));
829       break;
830 
831     case IrOpcode::kJSLoadMessage:
832     case IrOpcode::kJSStoreMessage:
833       break;
834 
835     case IrOpcode::kJSLoadModule:
836       CheckTypeIs(node, Type::Any());
837       break;
838     case IrOpcode::kJSStoreModule:
839       CheckNotTyped(node);
840       break;
841 
842     case IrOpcode::kJSGeneratorStore:
843       CheckNotTyped(node);
844       break;
845 
846     case IrOpcode::kJSCreateGeneratorObject:
847       CheckTypeIs(node, Type::OtherObject());
848       break;
849 
850     case IrOpcode::kJSGeneratorRestoreContinuation:
851       CheckTypeIs(node, Type::SignedSmall());
852       break;
853 
854     case IrOpcode::kJSGeneratorRestoreContext:
855       CheckTypeIs(node, Type::Any());
856       break;
857 
858     case IrOpcode::kJSGeneratorRestoreRegister:
859       CheckTypeIs(node, Type::Any());
860       break;
861 
862     case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
863       CheckTypeIs(node, Type::Any());
864       break;
865 
866     case IrOpcode::kJSStackCheck:
867     case IrOpcode::kJSDebugger:
868       // Type is empty.
869       CheckNotTyped(node);
870       break;
871 
872     case IrOpcode::kJSFulfillPromise:
873       CheckValueInputIs(node, 0, Type::Any());
874       CheckValueInputIs(node, 1, Type::Any());
875       CheckTypeIs(node, Type::Undefined());
876       break;
877     case IrOpcode::kJSPerformPromiseThen:
878       CheckValueInputIs(node, 0, Type::Any());
879       CheckValueInputIs(node, 1, Type::Any());
880       CheckValueInputIs(node, 2, Type::Any());
881       CheckValueInputIs(node, 3, Type::Any());
882       CheckTypeIs(node, Type::Receiver());
883       break;
884     case IrOpcode::kJSPromiseResolve:
885       CheckValueInputIs(node, 0, Type::Any());
886       CheckValueInputIs(node, 1, Type::Any());
887       CheckTypeIs(node, Type::Receiver());
888       break;
889     case IrOpcode::kJSRejectPromise:
890       CheckValueInputIs(node, 0, Type::Any());
891       CheckValueInputIs(node, 1, Type::Any());
892       CheckValueInputIs(node, 2, Type::Any());
893       CheckTypeIs(node, Type::Undefined());
894       break;
895     case IrOpcode::kJSResolvePromise:
896       CheckValueInputIs(node, 0, Type::Any());
897       CheckValueInputIs(node, 1, Type::Any());
898       CheckTypeIs(node, Type::Undefined());
899       break;
900     case IrOpcode::kJSObjectIsArray:
901       CheckValueInputIs(node, 0, Type::Any());
902       CheckTypeIs(node, Type::Boolean());
903       break;
904 
905     case IrOpcode::kComment:
906     case IrOpcode::kDebugAbort:
907     case IrOpcode::kDebugBreak:
908     case IrOpcode::kRetain:
909     case IrOpcode::kUnsafePointerAdd:
910     case IrOpcode::kRuntimeAbort:
911       CheckNotTyped(node);
912       break;
913 
914     // Simplified operators
915     // -------------------------------
916     case IrOpcode::kBooleanNot:
917       // Boolean -> Boolean
918       CheckValueInputIs(node, 0, Type::Boolean());
919       CheckTypeIs(node, Type::Boolean());
920       break;
921     case IrOpcode::kNumberEqual:
922       // (Number, Number) -> Boolean
923       CheckValueInputIs(node, 0, Type::Number());
924       CheckValueInputIs(node, 1, Type::Number());
925       CheckTypeIs(node, Type::Boolean());
926       break;
927     case IrOpcode::kNumberLessThan:
928     case IrOpcode::kNumberLessThanOrEqual:
929       // (Number, Number) -> Boolean
930       CheckValueInputIs(node, 0, Type::Number());
931       CheckValueInputIs(node, 1, Type::Number());
932       CheckTypeIs(node, Type::Boolean());
933       break;
934     case IrOpcode::kSpeculativeSafeIntegerAdd:
935     case IrOpcode::kSpeculativeSafeIntegerSubtract:
936     case IrOpcode::kSpeculativeNumberAdd:
937     case IrOpcode::kSpeculativeNumberSubtract:
938     case IrOpcode::kSpeculativeNumberMultiply:
939     case IrOpcode::kSpeculativeNumberDivide:
940     case IrOpcode::kSpeculativeNumberModulus:
941       CheckTypeIs(node, Type::Number());
942       break;
943     case IrOpcode::kSpeculativeNumberEqual:
944     case IrOpcode::kSpeculativeNumberLessThan:
945     case IrOpcode::kSpeculativeNumberLessThanOrEqual:
946       CheckTypeIs(node, Type::Boolean());
947       break;
948     case IrOpcode::kNumberAdd:
949     case IrOpcode::kNumberSubtract:
950     case IrOpcode::kNumberMultiply:
951     case IrOpcode::kNumberDivide:
952       // (Number, Number) -> Number
953       CheckValueInputIs(node, 0, Type::Number());
954       CheckValueInputIs(node, 1, Type::Number());
955       CheckTypeIs(node, Type::Number());
956       break;
957     case IrOpcode::kNumberModulus:
958       // (Number, Number) -> Number
959       CheckValueInputIs(node, 0, Type::Number());
960       CheckValueInputIs(node, 1, Type::Number());
961       CheckTypeIs(node, Type::Number());
962       break;
963     case IrOpcode::kNumberBitwiseOr:
964     case IrOpcode::kNumberBitwiseXor:
965     case IrOpcode::kNumberBitwiseAnd:
966       // (Signed32, Signed32) -> Signed32
967       CheckValueInputIs(node, 0, Type::Signed32());
968       CheckValueInputIs(node, 1, Type::Signed32());
969       CheckTypeIs(node, Type::Signed32());
970       break;
971     case IrOpcode::kSpeculativeNumberBitwiseOr:
972     case IrOpcode::kSpeculativeNumberBitwiseXor:
973     case IrOpcode::kSpeculativeNumberBitwiseAnd:
974       CheckTypeIs(node, Type::Signed32());
975       break;
976     case IrOpcode::kNumberShiftLeft:
977     case IrOpcode::kNumberShiftRight:
978       // (Signed32, Unsigned32) -> Signed32
979       CheckValueInputIs(node, 0, Type::Signed32());
980       CheckValueInputIs(node, 1, Type::Unsigned32());
981       CheckTypeIs(node, Type::Signed32());
982       break;
983     case IrOpcode::kSpeculativeNumberShiftLeft:
984     case IrOpcode::kSpeculativeNumberShiftRight:
985       CheckTypeIs(node, Type::Signed32());
986       break;
987     case IrOpcode::kNumberShiftRightLogical:
988       // (Unsigned32, Unsigned32) -> Unsigned32
989       CheckValueInputIs(node, 0, Type::Unsigned32());
990       CheckValueInputIs(node, 1, Type::Unsigned32());
991       CheckTypeIs(node, Type::Unsigned32());
992       break;
993     case IrOpcode::kSpeculativeNumberShiftRightLogical:
994       CheckTypeIs(node, Type::Unsigned32());
995       break;
996     case IrOpcode::kNumberImul:
997       // (Unsigned32, Unsigned32) -> Signed32
998       CheckValueInputIs(node, 0, Type::Unsigned32());
999       CheckValueInputIs(node, 1, Type::Unsigned32());
1000       CheckTypeIs(node, Type::Signed32());
1001       break;
1002     case IrOpcode::kNumberClz32:
1003       // Unsigned32 -> Unsigned32
1004       CheckValueInputIs(node, 0, Type::Unsigned32());
1005       CheckTypeIs(node, Type::Unsigned32());
1006       break;
1007     case IrOpcode::kNumberAtan2:
1008     case IrOpcode::kNumberMax:
1009     case IrOpcode::kNumberMin:
1010     case IrOpcode::kNumberPow:
1011       // (Number, Number) -> Number
1012       CheckValueInputIs(node, 0, Type::Number());
1013       CheckValueInputIs(node, 1, Type::Number());
1014       CheckTypeIs(node, Type::Number());
1015       break;
1016     case IrOpcode::kNumberAbs:
1017     case IrOpcode::kNumberCeil:
1018     case IrOpcode::kNumberFloor:
1019     case IrOpcode::kNumberFround:
1020     case IrOpcode::kNumberAcos:
1021     case IrOpcode::kNumberAcosh:
1022     case IrOpcode::kNumberAsin:
1023     case IrOpcode::kNumberAsinh:
1024     case IrOpcode::kNumberAtan:
1025     case IrOpcode::kNumberAtanh:
1026     case IrOpcode::kNumberCos:
1027     case IrOpcode::kNumberCosh:
1028     case IrOpcode::kNumberExp:
1029     case IrOpcode::kNumberExpm1:
1030     case IrOpcode::kNumberLog:
1031     case IrOpcode::kNumberLog1p:
1032     case IrOpcode::kNumberLog2:
1033     case IrOpcode::kNumberLog10:
1034     case IrOpcode::kNumberCbrt:
1035     case IrOpcode::kNumberRound:
1036     case IrOpcode::kNumberSign:
1037     case IrOpcode::kNumberSin:
1038     case IrOpcode::kNumberSinh:
1039     case IrOpcode::kNumberSqrt:
1040     case IrOpcode::kNumberTan:
1041     case IrOpcode::kNumberTanh:
1042     case IrOpcode::kNumberTrunc:
1043       // Number -> Number
1044       CheckValueInputIs(node, 0, Type::Number());
1045       CheckTypeIs(node, Type::Number());
1046       break;
1047     case IrOpcode::kNumberToBoolean:
1048       // Number -> Boolean
1049       CheckValueInputIs(node, 0, Type::Number());
1050       CheckTypeIs(node, Type::Boolean());
1051       break;
1052     case IrOpcode::kNumberToInt32:
1053       // Number -> Signed32
1054       CheckValueInputIs(node, 0, Type::Number());
1055       CheckTypeIs(node, Type::Signed32());
1056       break;
1057     case IrOpcode::kNumberToString:
1058       // Number -> String
1059       CheckValueInputIs(node, 0, Type::Number());
1060       CheckTypeIs(node, Type::String());
1061       break;
1062     case IrOpcode::kNumberToUint32:
1063     case IrOpcode::kNumberToUint8Clamped:
1064       // Number -> Unsigned32
1065       CheckValueInputIs(node, 0, Type::Number());
1066       CheckTypeIs(node, Type::Unsigned32());
1067       break;
1068     case IrOpcode::kSpeculativeToNumber:
1069       // Any -> Number
1070       CheckValueInputIs(node, 0, Type::Any());
1071       CheckTypeIs(node, Type::Number());
1072       break;
1073     case IrOpcode::kPlainPrimitiveToNumber:
1074       // PlainPrimitive -> Number
1075       CheckValueInputIs(node, 0, Type::PlainPrimitive());
1076       CheckTypeIs(node, Type::Number());
1077       break;
1078     case IrOpcode::kPlainPrimitiveToWord32:
1079       // PlainPrimitive -> Integral32
1080       CheckValueInputIs(node, 0, Type::PlainPrimitive());
1081       CheckTypeIs(node, Type::Integral32());
1082       break;
1083     case IrOpcode::kPlainPrimitiveToFloat64:
1084       // PlainPrimitive -> Number
1085       CheckValueInputIs(node, 0, Type::PlainPrimitive());
1086       CheckTypeIs(node, Type::Number());
1087       break;
1088     case IrOpcode::kStringEqual:
1089     case IrOpcode::kStringLessThan:
1090     case IrOpcode::kStringLessThanOrEqual:
1091       // (String, String) -> Boolean
1092       CheckValueInputIs(node, 0, Type::String());
1093       CheckValueInputIs(node, 1, Type::String());
1094       CheckTypeIs(node, Type::Boolean());
1095       break;
1096     case IrOpcode::kStringToNumber:
1097       // String -> Number
1098       CheckValueInputIs(node, 0, Type::String());
1099       CheckTypeIs(node, Type::Number());
1100       break;
1101     case IrOpcode::kStringCharCodeAt:
1102       // (String, Unsigned32) -> UnsignedSmall
1103       CheckValueInputIs(node, 0, Type::String());
1104       CheckValueInputIs(node, 1, Type::Unsigned32());
1105       CheckTypeIs(node, Type::UnsignedSmall());
1106       break;
1107     case IrOpcode::kStringCodePointAt:
1108       // (String, Unsigned32) -> UnsignedSmall
1109       CheckValueInputIs(node, 0, Type::String());
1110       CheckValueInputIs(node, 1, Type::Unsigned32());
1111       CheckTypeIs(node, Type::UnsignedSmall());
1112       break;
1113     case IrOpcode::kStringFromSingleCharCode:
1114       // Number -> String
1115       CheckValueInputIs(node, 0, Type::Number());
1116       CheckTypeIs(node, Type::String());
1117       break;
1118     case IrOpcode::kStringFromSingleCodePoint:
1119       // (Unsigned32) -> String
1120       CheckValueInputIs(node, 0, Type::Number());
1121       CheckTypeIs(node, Type::String());
1122       break;
1123     case IrOpcode::kStringIndexOf:
1124       // (String, String, SignedSmall) -> SignedSmall
1125       CheckValueInputIs(node, 0, Type::String());
1126       CheckValueInputIs(node, 1, Type::String());
1127       CheckValueInputIs(node, 2, Type::SignedSmall());
1128       CheckTypeIs(node, Type::SignedSmall());
1129       break;
1130     case IrOpcode::kStringLength:
1131       CheckValueInputIs(node, 0, Type::String());
1132       CheckTypeIs(node, TypeCache::Get().kStringLengthType);
1133       break;
1134     case IrOpcode::kStringToLowerCaseIntl:
1135     case IrOpcode::kStringToUpperCaseIntl:
1136       CheckValueInputIs(node, 0, Type::String());
1137       CheckTypeIs(node, Type::String());
1138       break;
1139     case IrOpcode::kStringSubstring:
1140       CheckValueInputIs(node, 0, Type::String());
1141       CheckValueInputIs(node, 1, Type::SignedSmall());
1142       CheckValueInputIs(node, 2, Type::SignedSmall());
1143       CheckTypeIs(node, Type::String());
1144       break;
1145     case IrOpcode::kReferenceEqual:
1146       // (Unique, Any) -> Boolean  and
1147       // (Any, Unique) -> Boolean
1148       CheckTypeIs(node, Type::Boolean());
1149       break;
1150     case IrOpcode::kSameValue:
1151       // (Any, Any) -> Boolean
1152       CheckValueInputIs(node, 0, Type::Any());
1153       CheckValueInputIs(node, 1, Type::Any());
1154       CheckTypeIs(node, Type::Boolean());
1155       break;
1156 
1157     case IrOpcode::kObjectIsArrayBufferView:
1158     case IrOpcode::kObjectIsBigInt:
1159     case IrOpcode::kObjectIsCallable:
1160     case IrOpcode::kObjectIsConstructor:
1161     case IrOpcode::kObjectIsDetectableCallable:
1162     case IrOpcode::kObjectIsMinusZero:
1163     case IrOpcode::kObjectIsNaN:
1164     case IrOpcode::kObjectIsNonCallable:
1165     case IrOpcode::kObjectIsNumber:
1166     case IrOpcode::kObjectIsReceiver:
1167     case IrOpcode::kObjectIsSmi:
1168     case IrOpcode::kObjectIsString:
1169     case IrOpcode::kObjectIsSymbol:
1170     case IrOpcode::kObjectIsUndetectable:
1171     case IrOpcode::kArrayBufferWasNeutered:
1172       CheckValueInputIs(node, 0, Type::Any());
1173       CheckTypeIs(node, Type::Boolean());
1174       break;
1175     case IrOpcode::kNumberIsFloat64Hole:
1176       CheckValueInputIs(node, 0, Type::NumberOrHole());
1177       CheckTypeIs(node, Type::Boolean());
1178       break;
1179     case IrOpcode::kNumberIsFinite:
1180       CheckValueInputIs(node, 0, Type::Number());
1181       CheckTypeIs(node, Type::Boolean());
1182       break;
1183     case IrOpcode::kNumberIsNaN:
1184       CheckValueInputIs(node, 0, Type::Number());
1185       CheckTypeIs(node, Type::Boolean());
1186       break;
1187     case IrOpcode::kObjectIsFiniteNumber:
1188       CheckValueInputIs(node, 0, Type::Any());
1189       CheckTypeIs(node, Type::Boolean());
1190       break;
1191     case IrOpcode::kNumberIsInteger:
1192       CheckValueInputIs(node, 0, Type::Number());
1193       CheckTypeIs(node, Type::Boolean());
1194       break;
1195     case IrOpcode::kObjectIsSafeInteger:
1196       CheckValueInputIs(node, 0, Type::Any());
1197       CheckTypeIs(node, Type::Boolean());
1198       break;
1199     case IrOpcode::kNumberIsSafeInteger:
1200       CheckValueInputIs(node, 0, Type::Number());
1201       CheckTypeIs(node, Type::Boolean());
1202       break;
1203     case IrOpcode::kObjectIsInteger:
1204       CheckValueInputIs(node, 0, Type::Any());
1205       CheckTypeIs(node, Type::Boolean());
1206       break;
1207     case IrOpcode::kFindOrderedHashMapEntry:
1208       CheckValueInputIs(node, 0, Type::Any());
1209       CheckTypeIs(node, Type::SignedSmall());
1210       break;
1211     case IrOpcode::kFindOrderedHashMapEntryForInt32Key:
1212       CheckValueInputIs(node, 0, Type::Any());
1213       CheckValueInputIs(node, 1, Type::Signed32());
1214       CheckTypeIs(node, Type::SignedSmall());
1215       break;
1216     case IrOpcode::kArgumentsLength:
1217       CheckValueInputIs(node, 0, Type::ExternalPointer());
1218       CheckTypeIs(node, TypeCache::Get().kArgumentsLengthType);
1219       break;
1220     case IrOpcode::kArgumentsFrame:
1221       CheckTypeIs(node, Type::ExternalPointer());
1222       break;
1223     case IrOpcode::kNewDoubleElements:
1224     case IrOpcode::kNewSmiOrObjectElements:
1225       CheckValueInputIs(node, 0,
1226                         Type::Range(0.0, FixedArray::kMaxLength, zone));
1227       CheckTypeIs(node, Type::OtherInternal());
1228       break;
1229     case IrOpcode::kNewArgumentsElements:
1230       CheckValueInputIs(node, 0, Type::ExternalPointer());
1231       CheckValueInputIs(node, 1, Type::Range(-Code::kMaxArguments,
1232                                              Code::kMaxArguments, zone));
1233       CheckTypeIs(node, Type::OtherInternal());
1234       break;
1235     case IrOpcode::kNewConsString:
1236       CheckValueInputIs(node, 0, TypeCache::Get().kStringLengthType);
1237       CheckValueInputIs(node, 1, Type::String());
1238       CheckValueInputIs(node, 2, Type::String());
1239       CheckTypeIs(node, Type::String());
1240       break;
1241     case IrOpcode::kAllocate:
1242       CheckValueInputIs(node, 0, Type::PlainNumber());
1243       break;
1244     case IrOpcode::kAllocateRaw:
1245       // CheckValueInputIs(node, 0, Type::PlainNumber());
1246       break;
1247     case IrOpcode::kEnsureWritableFastElements:
1248       CheckValueInputIs(node, 0, Type::Any());
1249       CheckValueInputIs(node, 1, Type::Internal());
1250       CheckTypeIs(node, Type::Internal());
1251       break;
1252     case IrOpcode::kMaybeGrowFastElements:
1253       CheckValueInputIs(node, 0, Type::Any());
1254       CheckValueInputIs(node, 1, Type::Internal());
1255       CheckValueInputIs(node, 2, Type::Unsigned31());
1256       CheckValueInputIs(node, 3, Type::Unsigned31());
1257       CheckTypeIs(node, Type::Internal());
1258       break;
1259     case IrOpcode::kTransitionElementsKind:
1260       CheckValueInputIs(node, 0, Type::Any());
1261       CheckNotTyped(node);
1262       break;
1263 
1264     case IrOpcode::kChangeTaggedSignedToInt32: {
1265       // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1266       // TODO(neis): Activate once ChangeRepresentation works in typer.
1267       // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1268       // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1269       // CheckValueInputIs(node, 0, from));
1270       // CheckTypeIs(node, to));
1271       break;
1272     }
1273     case IrOpcode::kChangeTaggedToInt32: {
1274       // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1275       // TODO(neis): Activate once ChangeRepresentation works in typer.
1276       // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1277       // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1278       // CheckValueInputIs(node, 0, from));
1279       // CheckTypeIs(node, to));
1280       break;
1281     }
1282     case IrOpcode::kChangeTaggedToUint32: {
1283       // Unsigned32 /\ Tagged -> Unsigned32 /\ UntaggedInt32
1284       // TODO(neis): Activate once ChangeRepresentation works in typer.
1285       // Type from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1286       // Type to =Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
1287       // CheckValueInputIs(node, 0, from));
1288       // CheckTypeIs(node, to));
1289       break;
1290     }
1291     case IrOpcode::kChangeTaggedToFloat64: {
1292       // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1293       // TODO(neis): Activate once ChangeRepresentation works in typer.
1294       // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1295       // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1296       // CheckValueInputIs(node, 0, from));
1297       // CheckTypeIs(node, to));
1298       break;
1299     }
1300     case IrOpcode::kChangeTaggedToTaggedSigned:
1301       break;
1302     case IrOpcode::kTruncateTaggedToFloat64: {
1303       // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1304       // TODO(neis): Activate once ChangeRepresentation works in typer.
1305       // Type from = Type::Intersect(Type::NumberOrUndefined(),
1306       // Type::Tagged());
1307       // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1308       // CheckValueInputIs(node, 0, from));
1309       // CheckTypeIs(node, to));
1310       break;
1311     }
1312     case IrOpcode::kChangeInt31ToTaggedSigned: {
1313       // Signed31 /\ UntaggedInt32 -> Signed31 /\ Tagged
1314       // TODO(neis): Activate once ChangeRepresentation works in typer.
1315       // Type from =Type::Intersect(Type::Signed31(), Type::UntaggedInt32());
1316       // Type to = Type::Intersect(Type::Signed31(), Type::Tagged());
1317       // CheckValueInputIs(node, 0, from));
1318       // CheckTypeIs(node, to));
1319       break;
1320     }
1321     case IrOpcode::kChangeInt32ToTagged: {
1322       // Signed32 /\ UntaggedInt32 -> Signed32 /\ Tagged
1323       // TODO(neis): Activate once ChangeRepresentation works in typer.
1324       // Type from =Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1325       // Type to = Type::Intersect(Type::Signed32(), Type::Tagged());
1326       // CheckValueInputIs(node, 0, from));
1327       // CheckTypeIs(node, to));
1328       break;
1329     }
1330     case IrOpcode::kChangeUint32ToTagged: {
1331       // Unsigned32 /\ UntaggedInt32 -> Unsigned32 /\ Tagged
1332       // TODO(neis): Activate once ChangeRepresentation works in typer.
1333       // Type from=Type::Intersect(Type::Unsigned32(),Type::UntaggedInt32());
1334       // Type to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1335       // CheckValueInputIs(node, 0, from));
1336       // CheckTypeIs(node, to));
1337       break;
1338     }
1339     case IrOpcode::kChangeFloat64ToTagged: {
1340       // Number /\ UntaggedFloat64 -> Number /\ Tagged
1341       // TODO(neis): Activate once ChangeRepresentation works in typer.
1342       // Type from =Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1343       // Type to = Type::Intersect(Type::Number(), Type::Tagged());
1344       // CheckValueInputIs(node, 0, from));
1345       // CheckTypeIs(node, to));
1346       break;
1347     }
1348     case IrOpcode::kChangeFloat64ToTaggedPointer:
1349       break;
1350     case IrOpcode::kChangeTaggedToBit: {
1351       // Boolean /\ TaggedPtr -> Boolean /\ UntaggedInt1
1352       // TODO(neis): Activate once ChangeRepresentation works in typer.
1353       // Type from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1354       // Type to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1355       // CheckValueInputIs(node, 0, from));
1356       // CheckTypeIs(node, to));
1357       break;
1358     }
1359     case IrOpcode::kChangeBitToTagged: {
1360       // Boolean /\ UntaggedInt1 -> Boolean /\ TaggedPtr
1361       // TODO(neis): Activate once ChangeRepresentation works in typer.
1362       // Type from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1363       // Type to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1364       // CheckValueInputIs(node, 0, from));
1365       // CheckTypeIs(node, to));
1366       break;
1367     }
1368     case IrOpcode::kTruncateTaggedToWord32: {
1369       // Number /\ Tagged -> Signed32 /\ UntaggedInt32
1370       // TODO(neis): Activate once ChangeRepresentation works in typer.
1371       // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1372       // Type to = Type::Intersect(Type::Number(), Type::UntaggedInt32());
1373       // CheckValueInputIs(node, 0, from));
1374       // CheckTypeIs(node, to));
1375       break;
1376     }
1377     case IrOpcode::kTruncateTaggedToBit:
1378     case IrOpcode::kTruncateTaggedPointerToBit:
1379       break;
1380 
1381     case IrOpcode::kCheckBounds:
1382       CheckValueInputIs(node, 0, Type::Any());
1383       CheckValueInputIs(node, 1, Type::Unsigned31());
1384       CheckTypeIs(node, Type::Unsigned31());
1385       break;
1386     case IrOpcode::kPoisonIndex:
1387       CheckValueInputIs(node, 0, Type::Unsigned32());
1388       CheckTypeIs(node, Type::Unsigned32());
1389       break;
1390     case IrOpcode::kCheckHeapObject:
1391       CheckValueInputIs(node, 0, Type::Any());
1392       break;
1393     case IrOpcode::kCheckIf:
1394       CheckValueInputIs(node, 0, Type::Boolean());
1395       CheckNotTyped(node);
1396       break;
1397     case IrOpcode::kCheckInternalizedString:
1398       CheckValueInputIs(node, 0, Type::Any());
1399       CheckTypeIs(node, Type::InternalizedString());
1400       break;
1401     case IrOpcode::kCheckMaps:
1402       CheckValueInputIs(node, 0, Type::Any());
1403       CheckNotTyped(node);
1404       break;
1405     case IrOpcode::kCompareMaps:
1406       CheckValueInputIs(node, 0, Type::Any());
1407       CheckTypeIs(node, Type::Boolean());
1408       break;
1409     case IrOpcode::kCheckNumber:
1410       CheckValueInputIs(node, 0, Type::Any());
1411       CheckTypeIs(node, Type::Number());
1412       break;
1413     case IrOpcode::kCheckReceiver:
1414       CheckValueInputIs(node, 0, Type::Any());
1415       CheckTypeIs(node, Type::Receiver());
1416       break;
1417     case IrOpcode::kCheckSmi:
1418       CheckValueInputIs(node, 0, Type::Any());
1419       break;
1420     case IrOpcode::kCheckString:
1421       CheckValueInputIs(node, 0, Type::Any());
1422       CheckTypeIs(node, Type::String());
1423       break;
1424     case IrOpcode::kCheckSymbol:
1425       CheckValueInputIs(node, 0, Type::Any());
1426       CheckTypeIs(node, Type::Symbol());
1427       break;
1428 
1429     case IrOpcode::kConvertReceiver:
1430       // (Any, Any) -> Receiver
1431       CheckValueInputIs(node, 0, Type::Any());
1432       CheckValueInputIs(node, 1, Type::Any());
1433       CheckTypeIs(node, Type::Receiver());
1434       break;
1435 
1436     case IrOpcode::kCheckedInt32Add:
1437     case IrOpcode::kCheckedInt32Sub:
1438     case IrOpcode::kCheckedInt32Div:
1439     case IrOpcode::kCheckedInt32Mod:
1440     case IrOpcode::kCheckedUint32Div:
1441     case IrOpcode::kCheckedUint32Mod:
1442     case IrOpcode::kCheckedInt32Mul:
1443     case IrOpcode::kCheckedInt32ToTaggedSigned:
1444     case IrOpcode::kCheckedUint32ToInt32:
1445     case IrOpcode::kCheckedUint32ToTaggedSigned:
1446     case IrOpcode::kCheckedFloat64ToInt32:
1447     case IrOpcode::kCheckedTaggedSignedToInt32:
1448     case IrOpcode::kCheckedTaggedToInt32:
1449     case IrOpcode::kCheckedTaggedToFloat64:
1450     case IrOpcode::kCheckedTaggedToTaggedSigned:
1451     case IrOpcode::kCheckedTaggedToTaggedPointer:
1452     case IrOpcode::kCheckedTruncateTaggedToWord32:
1453       break;
1454 
1455     case IrOpcode::kCheckFloat64Hole:
1456       CheckValueInputIs(node, 0, Type::NumberOrHole());
1457       CheckTypeIs(node, Type::NumberOrUndefined());
1458       break;
1459     case IrOpcode::kCheckNotTaggedHole:
1460       CheckValueInputIs(node, 0, Type::Any());
1461       CheckTypeIs(node, Type::NonInternal());
1462       break;
1463     case IrOpcode::kConvertTaggedHoleToUndefined:
1464       CheckValueInputIs(node, 0, Type::Any());
1465       CheckTypeIs(node, Type::NonInternal());
1466       break;
1467 
1468     case IrOpcode::kCheckEqualsInternalizedString:
1469       CheckValueInputIs(node, 0, Type::InternalizedString());
1470       CheckValueInputIs(node, 1, Type::Any());
1471       CheckNotTyped(node);
1472       break;
1473     case IrOpcode::kCheckEqualsSymbol:
1474       CheckValueInputIs(node, 0, Type::Symbol());
1475       CheckValueInputIs(node, 1, Type::Any());
1476       CheckNotTyped(node);
1477       break;
1478 
1479     case IrOpcode::kLoadFieldByIndex:
1480       CheckValueInputIs(node, 0, Type::Any());
1481       CheckValueInputIs(node, 1, Type::SignedSmall());
1482       CheckTypeIs(node, Type::NonInternal());
1483       break;
1484     case IrOpcode::kLoadField:
1485       // Object -> fieldtype
1486       // TODO(rossberg): activate once machine ops are typed.
1487       // CheckValueInputIs(node, 0, Type::Object());
1488       // CheckTypeIs(node, FieldAccessOf(node->op()).type));
1489       break;
1490     case IrOpcode::kLoadElement:
1491       // Object -> elementtype
1492       // TODO(rossberg): activate once machine ops are typed.
1493       // CheckValueInputIs(node, 0, Type::Object());
1494       // CheckTypeIs(node, ElementAccessOf(node->op()).type));
1495       break;
1496     case IrOpcode::kLoadTypedElement:
1497       break;
1498     case IrOpcode::kStoreField:
1499       // (Object, fieldtype) -> _|_
1500       // TODO(rossberg): activate once machine ops are typed.
1501       // CheckValueInputIs(node, 0, Type::Object());
1502       // CheckValueInputIs(node, 1, FieldAccessOf(node->op()).type));
1503       CheckNotTyped(node);
1504       break;
1505     case IrOpcode::kStoreElement:
1506       // (Object, elementtype) -> _|_
1507       // TODO(rossberg): activate once machine ops are typed.
1508       // CheckValueInputIs(node, 0, Type::Object());
1509       // CheckValueInputIs(node, 1, ElementAccessOf(node->op()).type));
1510       CheckNotTyped(node);
1511       break;
1512     case IrOpcode::kTransitionAndStoreElement:
1513       CheckNotTyped(node);
1514       break;
1515     case IrOpcode::kTransitionAndStoreNumberElement:
1516       CheckNotTyped(node);
1517       break;
1518     case IrOpcode::kTransitionAndStoreNonNumberElement:
1519       CheckNotTyped(node);
1520       break;
1521     case IrOpcode::kStoreSignedSmallElement:
1522       CheckNotTyped(node);
1523       break;
1524     case IrOpcode::kStoreTypedElement:
1525       CheckNotTyped(node);
1526       break;
1527     case IrOpcode::kNumberSilenceNaN:
1528       CheckValueInputIs(node, 0, Type::Number());
1529       CheckTypeIs(node, Type::Number());
1530       break;
1531     case IrOpcode::kMapGuard:
1532       CheckNotTyped(node);
1533       break;
1534     case IrOpcode::kTypeGuard:
1535       CheckTypeIs(node, TypeGuardTypeOf(node->op()));
1536       break;
1537     case IrOpcode::kDateNow:
1538       CHECK_EQ(0, value_count);
1539       CheckTypeIs(node, Type::Number());
1540       break;
1541 
1542     // Machine operators
1543     // -----------------------
1544     case IrOpcode::kLoad:
1545     case IrOpcode::kPoisonedLoad:
1546     case IrOpcode::kProtectedLoad:
1547     case IrOpcode::kProtectedStore:
1548     case IrOpcode::kStore:
1549     case IrOpcode::kStackSlot:
1550     case IrOpcode::kWord32And:
1551     case IrOpcode::kWord32Or:
1552     case IrOpcode::kWord32Xor:
1553     case IrOpcode::kWord32Shl:
1554     case IrOpcode::kWord32Shr:
1555     case IrOpcode::kWord32Sar:
1556     case IrOpcode::kWord32Ror:
1557     case IrOpcode::kWord32Equal:
1558     case IrOpcode::kWord32Clz:
1559     case IrOpcode::kWord32Ctz:
1560     case IrOpcode::kWord32ReverseBits:
1561     case IrOpcode::kWord32ReverseBytes:
1562     case IrOpcode::kInt32AbsWithOverflow:
1563     case IrOpcode::kWord32Popcnt:
1564     case IrOpcode::kWord64And:
1565     case IrOpcode::kWord64Or:
1566     case IrOpcode::kWord64Xor:
1567     case IrOpcode::kWord64Shl:
1568     case IrOpcode::kWord64Shr:
1569     case IrOpcode::kWord64Sar:
1570     case IrOpcode::kWord64Ror:
1571     case IrOpcode::kWord64Clz:
1572     case IrOpcode::kWord64Popcnt:
1573     case IrOpcode::kWord64Ctz:
1574     case IrOpcode::kWord64ReverseBits:
1575     case IrOpcode::kWord64ReverseBytes:
1576     case IrOpcode::kInt64AbsWithOverflow:
1577     case IrOpcode::kWord64Equal:
1578     case IrOpcode::kInt32Add:
1579     case IrOpcode::kInt32AddWithOverflow:
1580     case IrOpcode::kInt32Sub:
1581     case IrOpcode::kInt32SubWithOverflow:
1582     case IrOpcode::kInt32Mul:
1583     case IrOpcode::kInt32MulWithOverflow:
1584     case IrOpcode::kInt32MulHigh:
1585     case IrOpcode::kInt32Div:
1586     case IrOpcode::kInt32Mod:
1587     case IrOpcode::kInt32LessThan:
1588     case IrOpcode::kInt32LessThanOrEqual:
1589     case IrOpcode::kUint32Div:
1590     case IrOpcode::kUint32Mod:
1591     case IrOpcode::kUint32MulHigh:
1592     case IrOpcode::kUint32LessThan:
1593     case IrOpcode::kUint32LessThanOrEqual:
1594     case IrOpcode::kInt64Add:
1595     case IrOpcode::kInt64AddWithOverflow:
1596     case IrOpcode::kInt64Sub:
1597     case IrOpcode::kInt64SubWithOverflow:
1598     case IrOpcode::kInt64Mul:
1599     case IrOpcode::kInt64Div:
1600     case IrOpcode::kInt64Mod:
1601     case IrOpcode::kInt64LessThan:
1602     case IrOpcode::kInt64LessThanOrEqual:
1603     case IrOpcode::kUint64Div:
1604     case IrOpcode::kUint64Mod:
1605     case IrOpcode::kUint64LessThan:
1606     case IrOpcode::kUint64LessThanOrEqual:
1607     case IrOpcode::kFloat32Add:
1608     case IrOpcode::kFloat32Sub:
1609     case IrOpcode::kFloat32Neg:
1610     case IrOpcode::kFloat32Mul:
1611     case IrOpcode::kFloat32Div:
1612     case IrOpcode::kFloat32Abs:
1613     case IrOpcode::kFloat32Sqrt:
1614     case IrOpcode::kFloat32Equal:
1615     case IrOpcode::kFloat32LessThan:
1616     case IrOpcode::kFloat32LessThanOrEqual:
1617     case IrOpcode::kFloat32Max:
1618     case IrOpcode::kFloat32Min:
1619     case IrOpcode::kFloat64Add:
1620     case IrOpcode::kFloat64Sub:
1621     case IrOpcode::kFloat64Neg:
1622     case IrOpcode::kFloat64Mul:
1623     case IrOpcode::kFloat64Div:
1624     case IrOpcode::kFloat64Mod:
1625     case IrOpcode::kFloat64Max:
1626     case IrOpcode::kFloat64Min:
1627     case IrOpcode::kFloat64Abs:
1628     case IrOpcode::kFloat64Acos:
1629     case IrOpcode::kFloat64Acosh:
1630     case IrOpcode::kFloat64Asin:
1631     case IrOpcode::kFloat64Asinh:
1632     case IrOpcode::kFloat64Atan:
1633     case IrOpcode::kFloat64Atan2:
1634     case IrOpcode::kFloat64Atanh:
1635     case IrOpcode::kFloat64Cbrt:
1636     case IrOpcode::kFloat64Cos:
1637     case IrOpcode::kFloat64Cosh:
1638     case IrOpcode::kFloat64Exp:
1639     case IrOpcode::kFloat64Expm1:
1640     case IrOpcode::kFloat64Log:
1641     case IrOpcode::kFloat64Log1p:
1642     case IrOpcode::kFloat64Log10:
1643     case IrOpcode::kFloat64Log2:
1644     case IrOpcode::kFloat64Pow:
1645     case IrOpcode::kFloat64Sin:
1646     case IrOpcode::kFloat64Sinh:
1647     case IrOpcode::kFloat64Sqrt:
1648     case IrOpcode::kFloat64Tan:
1649     case IrOpcode::kFloat64Tanh:
1650     case IrOpcode::kFloat32RoundDown:
1651     case IrOpcode::kFloat64RoundDown:
1652     case IrOpcode::kFloat32RoundUp:
1653     case IrOpcode::kFloat64RoundUp:
1654     case IrOpcode::kFloat32RoundTruncate:
1655     case IrOpcode::kFloat64RoundTruncate:
1656     case IrOpcode::kFloat64RoundTiesAway:
1657     case IrOpcode::kFloat32RoundTiesEven:
1658     case IrOpcode::kFloat64RoundTiesEven:
1659     case IrOpcode::kFloat64Equal:
1660     case IrOpcode::kFloat64LessThan:
1661     case IrOpcode::kFloat64LessThanOrEqual:
1662     case IrOpcode::kTruncateInt64ToInt32:
1663     case IrOpcode::kRoundFloat64ToInt32:
1664     case IrOpcode::kRoundInt32ToFloat32:
1665     case IrOpcode::kRoundInt64ToFloat32:
1666     case IrOpcode::kRoundInt64ToFloat64:
1667     case IrOpcode::kRoundUint32ToFloat32:
1668     case IrOpcode::kRoundUint64ToFloat64:
1669     case IrOpcode::kRoundUint64ToFloat32:
1670     case IrOpcode::kTruncateFloat64ToFloat32:
1671     case IrOpcode::kTruncateFloat64ToWord32:
1672     case IrOpcode::kBitcastFloat32ToInt32:
1673     case IrOpcode::kBitcastFloat64ToInt64:
1674     case IrOpcode::kBitcastInt32ToFloat32:
1675     case IrOpcode::kBitcastInt64ToFloat64:
1676     case IrOpcode::kBitcastTaggedToWord:
1677     case IrOpcode::kBitcastWordToTagged:
1678     case IrOpcode::kBitcastWordToTaggedSigned:
1679     case IrOpcode::kChangeInt32ToInt64:
1680     case IrOpcode::kChangeUint32ToUint64:
1681     case IrOpcode::kChangeInt32ToFloat64:
1682     case IrOpcode::kChangeUint32ToFloat64:
1683     case IrOpcode::kChangeFloat32ToFloat64:
1684     case IrOpcode::kChangeFloat64ToInt32:
1685     case IrOpcode::kChangeFloat64ToUint32:
1686     case IrOpcode::kChangeFloat64ToUint64:
1687     case IrOpcode::kFloat64SilenceNaN:
1688     case IrOpcode::kTruncateFloat64ToUint32:
1689     case IrOpcode::kTruncateFloat32ToInt32:
1690     case IrOpcode::kTruncateFloat32ToUint32:
1691     case IrOpcode::kTryTruncateFloat32ToInt64:
1692     case IrOpcode::kTryTruncateFloat64ToInt64:
1693     case IrOpcode::kTryTruncateFloat32ToUint64:
1694     case IrOpcode::kTryTruncateFloat64ToUint64:
1695     case IrOpcode::kFloat64ExtractLowWord32:
1696     case IrOpcode::kFloat64ExtractHighWord32:
1697     case IrOpcode::kFloat64InsertLowWord32:
1698     case IrOpcode::kFloat64InsertHighWord32:
1699     case IrOpcode::kInt32PairAdd:
1700     case IrOpcode::kInt32PairSub:
1701     case IrOpcode::kInt32PairMul:
1702     case IrOpcode::kWord32PairShl:
1703     case IrOpcode::kWord32PairShr:
1704     case IrOpcode::kWord32PairSar:
1705     case IrOpcode::kTaggedPoisonOnSpeculation:
1706     case IrOpcode::kWord32PoisonOnSpeculation:
1707     case IrOpcode::kWord64PoisonOnSpeculation:
1708     case IrOpcode::kLoadStackPointer:
1709     case IrOpcode::kLoadFramePointer:
1710     case IrOpcode::kLoadParentFramePointer:
1711     case IrOpcode::kLoadRootsPointer:
1712     case IrOpcode::kUnalignedLoad:
1713     case IrOpcode::kUnalignedStore:
1714     case IrOpcode::kWord32AtomicLoad:
1715     case IrOpcode::kWord32AtomicStore:
1716     case IrOpcode::kWord32AtomicExchange:
1717     case IrOpcode::kWord32AtomicCompareExchange:
1718     case IrOpcode::kWord32AtomicAdd:
1719     case IrOpcode::kWord32AtomicSub:
1720     case IrOpcode::kWord32AtomicAnd:
1721     case IrOpcode::kWord32AtomicOr:
1722     case IrOpcode::kWord32AtomicXor:
1723     case IrOpcode::kWord64AtomicLoad:
1724     case IrOpcode::kWord64AtomicStore:
1725     case IrOpcode::kWord64AtomicAdd:
1726     case IrOpcode::kWord64AtomicSub:
1727     case IrOpcode::kWord64AtomicAnd:
1728     case IrOpcode::kWord64AtomicOr:
1729     case IrOpcode::kWord64AtomicXor:
1730     case IrOpcode::kWord64AtomicExchange:
1731     case IrOpcode::kWord64AtomicCompareExchange:
1732     case IrOpcode::kSpeculationFence:
1733     case IrOpcode::kSignExtendWord8ToInt32:
1734     case IrOpcode::kSignExtendWord16ToInt32:
1735     case IrOpcode::kSignExtendWord8ToInt64:
1736     case IrOpcode::kSignExtendWord16ToInt64:
1737     case IrOpcode::kSignExtendWord32ToInt64:
1738 
1739 #define SIMD_MACHINE_OP_CASE(Name) case IrOpcode::k##Name:
1740       MACHINE_SIMD_OP_LIST(SIMD_MACHINE_OP_CASE)
1741 #undef SIMD_MACHINE_OP_CASE
1742 
1743       // TODO(rossberg): Check.
1744       break;
1745   }
1746 }  // NOLINT(readability/fn_size)
1747 
Run(Graph * graph,Typing typing,CheckInputs check_inputs,CodeType code_type)1748 void Verifier::Run(Graph* graph, Typing typing, CheckInputs check_inputs,
1749                    CodeType code_type) {
1750   CHECK_NOT_NULL(graph->start());
1751   CHECK_NOT_NULL(graph->end());
1752   Zone zone(graph->zone()->allocator(), ZONE_NAME);
1753   Visitor visitor(&zone, typing, check_inputs, code_type);
1754   AllNodes all(&zone, graph);
1755   for (Node* node : all.reachable) visitor.Check(node, all);
1756 
1757   // Check the uniqueness of projections.
1758   for (Node* proj : all.reachable) {
1759     if (proj->opcode() != IrOpcode::kProjection) continue;
1760     Node* node = proj->InputAt(0);
1761     for (Node* other : node->uses()) {
1762       if (all.IsLive(other) && other != proj &&
1763           other->opcode() == IrOpcode::kProjection &&
1764           other->InputAt(0) == node &&
1765           ProjectionIndexOf(other->op()) == ProjectionIndexOf(proj->op())) {
1766         FATAL("Node #%d:%s has duplicate projections #%d and #%d", node->id(),
1767               node->op()->mnemonic(), proj->id(), other->id());
1768       }
1769     }
1770   }
1771 }
1772 
1773 
1774 // -----------------------------------------------------------------------------
1775 
HasDominatingDef(Schedule * schedule,Node * node,BasicBlock * container,BasicBlock * use_block,int use_pos)1776 static bool HasDominatingDef(Schedule* schedule, Node* node,
1777                              BasicBlock* container, BasicBlock* use_block,
1778                              int use_pos) {
1779   BasicBlock* block = use_block;
1780   while (true) {
1781     while (use_pos >= 0) {
1782       if (block->NodeAt(use_pos) == node) return true;
1783       use_pos--;
1784     }
1785     block = block->dominator();
1786     if (block == nullptr) break;
1787     use_pos = static_cast<int>(block->NodeCount()) - 1;
1788     if (node == block->control_input()) return true;
1789   }
1790   return false;
1791 }
1792 
1793 
Dominates(Schedule * schedule,Node * dominator,Node * dominatee)1794 static bool Dominates(Schedule* schedule, Node* dominator, Node* dominatee) {
1795   BasicBlock* dom = schedule->block(dominator);
1796   BasicBlock* sub = schedule->block(dominatee);
1797   while (sub != nullptr) {
1798     if (sub == dom) {
1799       return true;
1800     }
1801     sub = sub->dominator();
1802   }
1803   return false;
1804 }
1805 
1806 
CheckInputsDominate(Schedule * schedule,BasicBlock * block,Node * node,int use_pos)1807 static void CheckInputsDominate(Schedule* schedule, BasicBlock* block,
1808                                 Node* node, int use_pos) {
1809   for (int j = node->op()->ValueInputCount() - 1; j >= 0; j--) {
1810     BasicBlock* use_block = block;
1811     if (node->opcode() == IrOpcode::kPhi) {
1812       use_block = use_block->PredecessorAt(j);
1813       use_pos = static_cast<int>(use_block->NodeCount()) - 1;
1814     }
1815     Node* input = node->InputAt(j);
1816     if (!HasDominatingDef(schedule, node->InputAt(j), block, use_block,
1817                           use_pos)) {
1818       FATAL("Node #%d:%s in B%d is not dominated by input@%d #%d:%s",
1819             node->id(), node->op()->mnemonic(), block->rpo_number(), j,
1820             input->id(), input->op()->mnemonic());
1821     }
1822   }
1823   // Ensure that nodes are dominated by their control inputs;
1824   // kEnd is an exception, as unreachable blocks resulting from kMerge
1825   // are not in the RPO.
1826   if (node->op()->ControlInputCount() == 1 &&
1827       node->opcode() != IrOpcode::kEnd) {
1828     Node* ctl = NodeProperties::GetControlInput(node);
1829     if (!Dominates(schedule, ctl, node)) {
1830       FATAL("Node #%d:%s in B%d is not dominated by control input #%d:%s",
1831             node->id(), node->op()->mnemonic(), block->rpo_number(), ctl->id(),
1832             ctl->op()->mnemonic());
1833     }
1834   }
1835 }
1836 
1837 
Run(Schedule * schedule)1838 void ScheduleVerifier::Run(Schedule* schedule) {
1839   const size_t count = schedule->BasicBlockCount();
1840   Zone tmp_zone(schedule->zone()->allocator(), ZONE_NAME);
1841   Zone* zone = &tmp_zone;
1842   BasicBlock* start = schedule->start();
1843   BasicBlockVector* rpo_order = schedule->rpo_order();
1844 
1845   // Verify the RPO order contains only blocks from this schedule.
1846   CHECK_GE(count, rpo_order->size());
1847   for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1848        ++b) {
1849     CHECK_EQ((*b), schedule->GetBlockById((*b)->id()));
1850     // All predecessors and successors should be in rpo and in this schedule.
1851     for (BasicBlock const* predecessor : (*b)->predecessors()) {
1852       CHECK_GE(predecessor->rpo_number(), 0);
1853       CHECK_EQ(predecessor, schedule->GetBlockById(predecessor->id()));
1854     }
1855     for (BasicBlock const* successor : (*b)->successors()) {
1856       CHECK_GE(successor->rpo_number(), 0);
1857       CHECK_EQ(successor, schedule->GetBlockById(successor->id()));
1858     }
1859   }
1860 
1861   // Verify RPO numbers of blocks.
1862   CHECK_EQ(start, rpo_order->at(0));  // Start should be first.
1863   for (size_t b = 0; b < rpo_order->size(); b++) {
1864     BasicBlock* block = rpo_order->at(b);
1865     CHECK_EQ(static_cast<int>(b), block->rpo_number());
1866     BasicBlock* dom = block->dominator();
1867     if (b == 0) {
1868       // All blocks except start should have a dominator.
1869       CHECK_NULL(dom);
1870     } else {
1871       // Check that the immediate dominator appears somewhere before the block.
1872       CHECK_NOT_NULL(dom);
1873       CHECK_LT(dom->rpo_number(), block->rpo_number());
1874     }
1875   }
1876 
1877   // Verify that all blocks reachable from start are in the RPO.
1878   BoolVector marked(static_cast<int>(count), false, zone);
1879   {
1880     ZoneQueue<BasicBlock*> queue(zone);
1881     queue.push(start);
1882     marked[start->id().ToSize()] = true;
1883     while (!queue.empty()) {
1884       BasicBlock* block = queue.front();
1885       queue.pop();
1886       for (size_t s = 0; s < block->SuccessorCount(); s++) {
1887         BasicBlock* succ = block->SuccessorAt(s);
1888         if (!marked[succ->id().ToSize()]) {
1889           marked[succ->id().ToSize()] = true;
1890           queue.push(succ);
1891         }
1892       }
1893     }
1894   }
1895   // Verify marked blocks are in the RPO.
1896   for (size_t i = 0; i < count; i++) {
1897     BasicBlock* block = schedule->GetBlockById(BasicBlock::Id::FromSize(i));
1898     if (marked[i]) {
1899       CHECK_GE(block->rpo_number(), 0);
1900       CHECK_EQ(block, rpo_order->at(block->rpo_number()));
1901     }
1902   }
1903   // Verify RPO blocks are marked.
1904   for (size_t b = 0; b < rpo_order->size(); b++) {
1905     CHECK(marked[rpo_order->at(b)->id().ToSize()]);
1906   }
1907 
1908   {
1909     // Verify the dominance relation.
1910     ZoneVector<BitVector*> dominators(zone);
1911     dominators.resize(count, nullptr);
1912 
1913     // Compute a set of all the nodes that dominate a given node by using
1914     // a forward fixpoint. O(n^2).
1915     ZoneQueue<BasicBlock*> queue(zone);
1916     queue.push(start);
1917     dominators[start->id().ToSize()] =
1918         new (zone) BitVector(static_cast<int>(count), zone);
1919     while (!queue.empty()) {
1920       BasicBlock* block = queue.front();
1921       queue.pop();
1922       BitVector* block_doms = dominators[block->id().ToSize()];
1923       BasicBlock* idom = block->dominator();
1924       if (idom != nullptr && !block_doms->Contains(idom->id().ToInt())) {
1925         FATAL("Block B%d is not dominated by B%d", block->rpo_number(),
1926               idom->rpo_number());
1927       }
1928       for (size_t s = 0; s < block->SuccessorCount(); s++) {
1929         BasicBlock* succ = block->SuccessorAt(s);
1930         BitVector* succ_doms = dominators[succ->id().ToSize()];
1931 
1932         if (succ_doms == nullptr) {
1933           // First time visiting the node. S.doms = B U B.doms
1934           succ_doms = new (zone) BitVector(static_cast<int>(count), zone);
1935           succ_doms->CopyFrom(*block_doms);
1936           succ_doms->Add(block->id().ToInt());
1937           dominators[succ->id().ToSize()] = succ_doms;
1938           queue.push(succ);
1939         } else {
1940           // Nth time visiting the successor. S.doms = S.doms ^ (B U B.doms)
1941           bool had = succ_doms->Contains(block->id().ToInt());
1942           if (had) succ_doms->Remove(block->id().ToInt());
1943           if (succ_doms->IntersectIsChanged(*block_doms)) queue.push(succ);
1944           if (had) succ_doms->Add(block->id().ToInt());
1945         }
1946       }
1947     }
1948 
1949     // Verify the immediateness of dominators.
1950     for (BasicBlockVector::iterator b = rpo_order->begin();
1951          b != rpo_order->end(); ++b) {
1952       BasicBlock* block = *b;
1953       BasicBlock* idom = block->dominator();
1954       if (idom == nullptr) continue;
1955       BitVector* block_doms = dominators[block->id().ToSize()];
1956 
1957       for (BitVector::Iterator it(block_doms); !it.Done(); it.Advance()) {
1958         BasicBlock* dom =
1959             schedule->GetBlockById(BasicBlock::Id::FromInt(it.Current()));
1960         if (dom != idom &&
1961             !dominators[idom->id().ToSize()]->Contains(dom->id().ToInt())) {
1962           FATAL("Block B%d is not immediately dominated by B%d",
1963                 block->rpo_number(), idom->rpo_number());
1964         }
1965       }
1966     }
1967   }
1968 
1969   // Verify phis are placed in the block of their control input.
1970   for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1971        ++b) {
1972     for (BasicBlock::const_iterator i = (*b)->begin(); i != (*b)->end(); ++i) {
1973       Node* phi = *i;
1974       if (phi->opcode() != IrOpcode::kPhi) continue;
1975       // TODO(titzer): Nasty special case. Phis from RawMachineAssembler
1976       // schedules don't have control inputs.
1977       if (phi->InputCount() > phi->op()->ValueInputCount()) {
1978         Node* control = NodeProperties::GetControlInput(phi);
1979         CHECK(control->opcode() == IrOpcode::kMerge ||
1980               control->opcode() == IrOpcode::kLoop);
1981         CHECK_EQ((*b), schedule->block(control));
1982       }
1983     }
1984   }
1985 
1986   // Verify that all uses are dominated by their definitions.
1987   for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1988        ++b) {
1989     BasicBlock* block = *b;
1990 
1991     // Check inputs to control for this block.
1992     Node* control = block->control_input();
1993     if (control != nullptr) {
1994       CHECK_EQ(block, schedule->block(control));
1995       CheckInputsDominate(schedule, block, control,
1996                           static_cast<int>(block->NodeCount()) - 1);
1997     }
1998     // Check inputs for all nodes in the block.
1999     for (size_t i = 0; i < block->NodeCount(); i++) {
2000       Node* node = block->NodeAt(i);
2001       CheckInputsDominate(schedule, block, node, static_cast<int>(i) - 1);
2002     }
2003   }
2004 }
2005 
2006 
2007 #ifdef DEBUG
2008 
2009 // static
VerifyNode(Node * node)2010 void Verifier::VerifyNode(Node* node) {
2011   DCHECK_EQ(OperatorProperties::GetTotalInputCount(node->op()),
2012             node->InputCount());
2013   // If this node has no effect or no control outputs,
2014   // we check that none of its uses are effect or control inputs.
2015   bool check_no_control = node->op()->ControlOutputCount() == 0;
2016   bool check_no_effect = node->op()->EffectOutputCount() == 0;
2017   bool check_no_frame_state = node->opcode() != IrOpcode::kFrameState;
2018   int effect_edges = 0;
2019   if (check_no_effect || check_no_control) {
2020     for (Edge edge : node->use_edges()) {
2021       Node* const user = edge.from();
2022       DCHECK(!user->IsDead());
2023       if (NodeProperties::IsControlEdge(edge)) {
2024         DCHECK(!check_no_control);
2025       } else if (NodeProperties::IsEffectEdge(edge)) {
2026         DCHECK(!check_no_effect);
2027         effect_edges++;
2028       } else if (NodeProperties::IsFrameStateEdge(edge)) {
2029         DCHECK(!check_no_frame_state);
2030       }
2031     }
2032   }
2033 
2034   // Frame state input should be a frame state (or sentinel).
2035   if (OperatorProperties::GetFrameStateInputCount(node->op()) > 0) {
2036     Node* input = NodeProperties::GetFrameStateInput(node);
2037     DCHECK(input->opcode() == IrOpcode::kFrameState ||
2038            input->opcode() == IrOpcode::kStart ||
2039            input->opcode() == IrOpcode::kDead ||
2040            input->opcode() == IrOpcode::kDeadValue);
2041   }
2042   // Effect inputs should be effect-producing nodes (or sentinels).
2043   for (int i = 0; i < node->op()->EffectInputCount(); i++) {
2044     Node* input = NodeProperties::GetEffectInput(node, i);
2045     DCHECK(input->op()->EffectOutputCount() > 0 ||
2046            input->opcode() == IrOpcode::kDead);
2047   }
2048   // Control inputs should be control-producing nodes (or sentinels).
2049   for (int i = 0; i < node->op()->ControlInputCount(); i++) {
2050     Node* input = NodeProperties::GetControlInput(node, i);
2051     DCHECK(input->op()->ControlOutputCount() > 0 ||
2052            input->opcode() == IrOpcode::kDead);
2053   }
2054 }
2055 
2056 
VerifyEdgeInputReplacement(const Edge & edge,const Node * replacement)2057 void Verifier::VerifyEdgeInputReplacement(const Edge& edge,
2058                                           const Node* replacement) {
2059   // Check that the user does not misuse the replacement.
2060   DCHECK(!NodeProperties::IsControlEdge(edge) ||
2061          replacement->op()->ControlOutputCount() > 0);
2062   DCHECK(!NodeProperties::IsEffectEdge(edge) ||
2063          replacement->op()->EffectOutputCount() > 0);
2064   DCHECK(!NodeProperties::IsFrameStateEdge(edge) ||
2065          replacement->opcode() == IrOpcode::kFrameState ||
2066          replacement->opcode() == IrOpcode::kDead ||
2067          replacement->opcode() == IrOpcode::kDeadValue);
2068 }
2069 
2070 #endif  // DEBUG
2071 
2072 }  // namespace compiler
2073 }  // namespace internal
2074 }  // namespace v8
2075