1 // Copyright 2014 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/compiler/verifier.h"
6
7 #include <algorithm>
8 #include <deque>
9 #include <queue>
10 #include <sstream>
11 #include <string>
12
13 #include "src/bit-vector.h"
14 #include "src/compiler/all-nodes.h"
15 #include "src/compiler/common-operator.h"
16 #include "src/compiler/graph.h"
17 #include "src/compiler/js-operator.h"
18 #include "src/compiler/node-properties.h"
19 #include "src/compiler/node.h"
20 #include "src/compiler/opcodes.h"
21 #include "src/compiler/operator-properties.h"
22 #include "src/compiler/operator.h"
23 #include "src/compiler/schedule.h"
24 #include "src/compiler/simplified-operator.h"
25 #include "src/compiler/type-cache.h"
26 #include "src/ostreams.h"
27
28 namespace v8 {
29 namespace internal {
30 namespace compiler {
31
32
33 class Verifier::Visitor {
34 public:
Visitor(Zone * z,Typing typed,CheckInputs check_inputs,CodeType code_type)35 Visitor(Zone* z, Typing typed, CheckInputs check_inputs, CodeType code_type)
36 : zone(z),
37 typing(typed),
38 check_inputs(check_inputs),
39 code_type(code_type) {}
40
41 void Check(Node* node, const AllNodes& all);
42
43 Zone* zone;
44 Typing typing;
45 CheckInputs check_inputs;
46 CodeType code_type;
47
48 private:
CheckNotTyped(Node * node)49 void CheckNotTyped(Node* node) {
50 if (NodeProperties::IsTyped(node)) {
51 std::ostringstream str;
52 str << "TypeError: node #" << node->id() << ":" << *node->op()
53 << " should never have a type";
54 FATAL("%s", str.str().c_str());
55 }
56 }
CheckTypeIs(Node * node,Type type)57 void CheckTypeIs(Node* node, Type type) {
58 if (typing == TYPED && !NodeProperties::GetType(node).Is(type)) {
59 std::ostringstream str;
60 str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
61 << NodeProperties::GetType(node) << " is not " << type;
62 FATAL("%s", str.str().c_str());
63 }
64 }
CheckTypeMaybe(Node * node,Type type)65 void CheckTypeMaybe(Node* node, Type type) {
66 if (typing == TYPED && !NodeProperties::GetType(node).Maybe(type)) {
67 std::ostringstream str;
68 str << "TypeError: node #" << node->id() << ":" << *node->op() << " type "
69 << NodeProperties::GetType(node) << " must intersect " << type;
70 FATAL("%s", str.str().c_str());
71 }
72 }
CheckValueInputIs(Node * node,int i,Type type)73 void CheckValueInputIs(Node* node, int i, Type type) {
74 Node* input = NodeProperties::GetValueInput(node, i);
75 if (typing == TYPED && !NodeProperties::GetType(input).Is(type)) {
76 std::ostringstream str;
77 str << "TypeError: node #" << node->id() << ":" << *node->op()
78 << "(input @" << i << " = " << input->opcode() << ":"
79 << input->op()->mnemonic() << ") type "
80 << NodeProperties::GetType(input) << " is not " << type;
81 FATAL("%s", str.str().c_str());
82 }
83 }
CheckOutput(Node * node,Node * use,int count,const char * kind)84 void CheckOutput(Node* node, Node* use, int count, const char* kind) {
85 if (count <= 0) {
86 std::ostringstream str;
87 str << "GraphError: node #" << node->id() << ":" << *node->op()
88 << " does not produce " << kind << " output used by node #"
89 << use->id() << ":" << *use->op();
90 FATAL("%s", str.str().c_str());
91 }
92 }
93 };
94
Check(Node * node,const AllNodes & all)95 void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
96 int value_count = node->op()->ValueInputCount();
97 int context_count = OperatorProperties::GetContextInputCount(node->op());
98 int frame_state_count =
99 OperatorProperties::GetFrameStateInputCount(node->op());
100 int effect_count = node->op()->EffectInputCount();
101 int control_count = node->op()->ControlInputCount();
102
103 // Verify number of inputs matches up.
104 int input_count = value_count + context_count + frame_state_count;
105 if (check_inputs == kAll) {
106 input_count += effect_count + control_count;
107 }
108 CHECK_EQ(input_count, node->InputCount());
109
110 // If this node has any effect outputs, make sure that it is
111 // consumed as an effect input somewhere else.
112 // TODO(mvstanton): support this kind of verification for WASM
113 // compiles, too.
114 if (code_type != kWasm && node->op()->EffectOutputCount() > 0) {
115 int effect_edges = 0;
116 for (Edge edge : node->use_edges()) {
117 if (all.IsLive(edge.from()) && NodeProperties::IsEffectEdge(edge)) {
118 effect_edges++;
119 }
120 }
121 DCHECK_GT(effect_edges, 0);
122 }
123
124 // Verify that frame state has been inserted for the nodes that need it.
125 for (int i = 0; i < frame_state_count; i++) {
126 Node* frame_state = NodeProperties::GetFrameStateInput(node);
127 CHECK(frame_state->opcode() == IrOpcode::kFrameState ||
128 // kFrameState uses Start as a sentinel.
129 (node->opcode() == IrOpcode::kFrameState &&
130 frame_state->opcode() == IrOpcode::kStart));
131 }
132
133 // Verify all value inputs actually produce a value.
134 for (int i = 0; i < value_count; ++i) {
135 Node* value = NodeProperties::GetValueInput(node, i);
136 CheckOutput(value, node, value->op()->ValueOutputCount(), "value");
137 // Verify that only parameters and projections can have input nodes with
138 // multiple outputs.
139 CHECK(node->opcode() == IrOpcode::kParameter ||
140 node->opcode() == IrOpcode::kProjection ||
141 value->op()->ValueOutputCount() <= 1);
142 }
143
144 // Verify all context inputs are value nodes.
145 for (int i = 0; i < context_count; ++i) {
146 Node* context = NodeProperties::GetContextInput(node);
147 CheckOutput(context, node, context->op()->ValueOutputCount(), "context");
148 }
149
150 if (check_inputs == kAll) {
151 // Verify all effect inputs actually have an effect.
152 for (int i = 0; i < effect_count; ++i) {
153 Node* effect = NodeProperties::GetEffectInput(node);
154 CheckOutput(effect, node, effect->op()->EffectOutputCount(), "effect");
155 }
156
157 // Verify all control inputs are control nodes.
158 for (int i = 0; i < control_count; ++i) {
159 Node* control = NodeProperties::GetControlInput(node, i);
160 CheckOutput(control, node, control->op()->ControlOutputCount(),
161 "control");
162 }
163
164 // Verify that nodes that can throw either have both IfSuccess/IfException
165 // projections as the only control uses or no projections at all.
166 if (!node->op()->HasProperty(Operator::kNoThrow)) {
167 Node* discovered_if_exception = nullptr;
168 Node* discovered_if_success = nullptr;
169 int total_number_of_control_uses = 0;
170 for (Edge edge : node->use_edges()) {
171 if (!NodeProperties::IsControlEdge(edge)) {
172 continue;
173 }
174 total_number_of_control_uses++;
175 Node* control_use = edge.from();
176 if (control_use->opcode() == IrOpcode::kIfSuccess) {
177 CHECK_NULL(discovered_if_success); // Only one allowed.
178 discovered_if_success = control_use;
179 }
180 if (control_use->opcode() == IrOpcode::kIfException) {
181 CHECK_NULL(discovered_if_exception); // Only one allowed.
182 discovered_if_exception = control_use;
183 }
184 }
185 if (discovered_if_success && !discovered_if_exception) {
186 FATAL(
187 "#%d:%s should be followed by IfSuccess/IfException, but is "
188 "only followed by single #%d:%s",
189 node->id(), node->op()->mnemonic(), discovered_if_success->id(),
190 discovered_if_success->op()->mnemonic());
191 }
192 if (discovered_if_exception && !discovered_if_success) {
193 FATAL(
194 "#%d:%s should be followed by IfSuccess/IfException, but is "
195 "only followed by single #%d:%s",
196 node->id(), node->op()->mnemonic(), discovered_if_exception->id(),
197 discovered_if_exception->op()->mnemonic());
198 }
199 if (discovered_if_success || discovered_if_exception) {
200 CHECK_EQ(2, total_number_of_control_uses);
201 }
202 }
203 }
204
205 switch (node->opcode()) {
206 case IrOpcode::kStart:
207 // Start has no inputs.
208 CHECK_EQ(0, input_count);
209 // Type is a tuple.
210 // TODO(rossberg): Multiple outputs are currently typed as Internal.
211 CheckTypeIs(node, Type::Internal());
212 break;
213 case IrOpcode::kEnd:
214 // End has no outputs.
215 CHECK_EQ(0, node->op()->ValueOutputCount());
216 CHECK_EQ(0, node->op()->EffectOutputCount());
217 CHECK_EQ(0, node->op()->ControlOutputCount());
218 // All inputs are graph terminators.
219 for (const Node* input : node->inputs()) {
220 CHECK(IrOpcode::IsGraphTerminator(input->opcode()));
221 }
222 // Type is empty.
223 CheckNotTyped(node);
224 break;
225 case IrOpcode::kDead:
226 // Dead is never connected to the graph.
227 UNREACHABLE();
228 case IrOpcode::kDeadValue:
229 CheckValueInputIs(node, 0, Type::None());
230 CheckTypeIs(node, Type::None());
231 break;
232 case IrOpcode::kUnreachable:
233 CheckTypeIs(node, Type::None());
234 for (Edge edge : node->use_edges()) {
235 Node* use = edge.from();
236 if (NodeProperties::IsValueEdge(edge) && all.IsLive(use)) {
237 // {Unreachable} nodes can only be used by {DeadValue}, because they
238 // don't actually produce a value.
239 CHECK_EQ(IrOpcode::kDeadValue, use->opcode());
240 }
241 }
242 break;
243 case IrOpcode::kBranch: {
244 // Branch uses are IfTrue and IfFalse.
245 int count_true = 0, count_false = 0;
246 for (const Node* use : node->uses()) {
247 CHECK(all.IsLive(use) && (use->opcode() == IrOpcode::kIfTrue ||
248 use->opcode() == IrOpcode::kIfFalse));
249 if (use->opcode() == IrOpcode::kIfTrue) ++count_true;
250 if (use->opcode() == IrOpcode::kIfFalse) ++count_false;
251 }
252 CHECK_EQ(1, count_true);
253 CHECK_EQ(1, count_false);
254 // The condition must be a Boolean.
255 CheckValueInputIs(node, 0, Type::Boolean());
256 // Type is empty.
257 CheckNotTyped(node);
258 break;
259 }
260 case IrOpcode::kIfTrue:
261 case IrOpcode::kIfFalse: {
262 Node* control = NodeProperties::GetControlInput(node, 0);
263 CHECK_EQ(IrOpcode::kBranch, control->opcode());
264 // Type is empty.
265 CheckNotTyped(node);
266 break;
267 }
268 case IrOpcode::kIfSuccess: {
269 // IfSuccess and IfException continuation only on throwing nodes.
270 Node* input = NodeProperties::GetControlInput(node, 0);
271 CHECK(!input->op()->HasProperty(Operator::kNoThrow));
272 // Type is empty.
273 CheckNotTyped(node);
274 break;
275 }
276 case IrOpcode::kIfException: {
277 // IfSuccess and IfException continuation only on throwing nodes.
278 Node* input = NodeProperties::GetControlInput(node, 0);
279 CHECK(!input->op()->HasProperty(Operator::kNoThrow));
280 // Type can be anything.
281 CheckTypeIs(node, Type::Any());
282 break;
283 }
284 case IrOpcode::kSwitch: {
285 // Switch uses are Case and Default.
286 int count_case = 0, count_default = 0;
287 for (const Node* use : node->uses()) {
288 CHECK(all.IsLive(use));
289 switch (use->opcode()) {
290 case IrOpcode::kIfValue: {
291 for (const Node* user : node->uses()) {
292 if (user != use && user->opcode() == IrOpcode::kIfValue) {
293 CHECK_NE(IfValueParametersOf(use->op()).value(),
294 IfValueParametersOf(user->op()).value());
295 }
296 }
297 ++count_case;
298 break;
299 }
300 case IrOpcode::kIfDefault: {
301 ++count_default;
302 break;
303 }
304 default: {
305 FATAL("Switch #%d illegally used by #%d:%s", node->id(), use->id(),
306 use->op()->mnemonic());
307 break;
308 }
309 }
310 }
311 CHECK_EQ(1, count_default);
312 CHECK_EQ(node->op()->ControlOutputCount(), count_case + count_default);
313 // Type is empty.
314 CheckNotTyped(node);
315 break;
316 }
317 case IrOpcode::kIfValue:
318 case IrOpcode::kIfDefault:
319 CHECK_EQ(IrOpcode::kSwitch,
320 NodeProperties::GetControlInput(node)->opcode());
321 // Type is empty.
322 CheckNotTyped(node);
323 break;
324 case IrOpcode::kLoop: {
325 CHECK_EQ(control_count, input_count);
326 // Type is empty.
327 CheckNotTyped(node);
328 // All loops need to be connected to a {Terminate} node to ensure they
329 // stay connected to the graph end.
330 bool has_terminate = false;
331 for (const Node* use : node->uses()) {
332 if (all.IsLive(use) && use->opcode() == IrOpcode::kTerminate) {
333 has_terminate = true;
334 break;
335 }
336 }
337 CHECK(has_terminate);
338 break;
339 }
340 case IrOpcode::kMerge:
341 CHECK_EQ(control_count, input_count);
342 // Type is empty.
343 CheckNotTyped(node);
344 break;
345 case IrOpcode::kDeoptimizeIf:
346 case IrOpcode::kDeoptimizeUnless:
347 // Type is empty.
348 CheckNotTyped(node);
349 break;
350 case IrOpcode::kTrapIf:
351 case IrOpcode::kTrapUnless:
352 // Type is empty.
353 CheckNotTyped(node);
354 break;
355 case IrOpcode::kDeoptimize:
356 case IrOpcode::kReturn:
357 case IrOpcode::kThrow:
358 // Deoptimize, Return and Throw uses are End.
359 for (const Node* use : node->uses()) {
360 if (all.IsLive(use)) {
361 CHECK_EQ(IrOpcode::kEnd, use->opcode());
362 }
363 }
364 // Type is empty.
365 CheckNotTyped(node);
366 break;
367 case IrOpcode::kTerminate:
368 // Terminates take one loop and effect.
369 CHECK_EQ(1, control_count);
370 CHECK_EQ(1, effect_count);
371 CHECK_EQ(2, input_count);
372 CHECK_EQ(IrOpcode::kLoop,
373 NodeProperties::GetControlInput(node)->opcode());
374 // Terminate uses are End.
375 for (const Node* use : node->uses()) {
376 if (all.IsLive(use)) {
377 CHECK_EQ(IrOpcode::kEnd, use->opcode());
378 }
379 }
380 // Type is empty.
381 CheckNotTyped(node);
382 break;
383 case IrOpcode::kOsrNormalEntry:
384 case IrOpcode::kOsrLoopEntry:
385 // Osr entries take one control and effect.
386 CHECK_EQ(1, control_count);
387 CHECK_EQ(1, effect_count);
388 CHECK_EQ(2, input_count);
389 // Type is empty.
390 CheckNotTyped(node);
391 break;
392
393 // Common operators
394 // ----------------
395 case IrOpcode::kParameter: {
396 // Parameters have the start node as inputs.
397 CHECK_EQ(1, input_count);
398 // Parameter has an input that produces enough values.
399 int const index = ParameterIndexOf(node->op());
400 Node* const start = NodeProperties::GetValueInput(node, 0);
401 CHECK_EQ(IrOpcode::kStart, start->opcode());
402 // Currently, parameter indices start at -1 instead of 0.
403 CHECK_LE(-1, index);
404 CHECK_LT(index + 1, start->op()->ValueOutputCount());
405 // Type can be anything.
406 CheckTypeIs(node, Type::Any());
407 break;
408 }
409 case IrOpcode::kInt32Constant: // TODO(turbofan): rename Word32Constant?
410 case IrOpcode::kInt64Constant: // TODO(turbofan): rename Word64Constant?
411 case IrOpcode::kFloat32Constant:
412 case IrOpcode::kFloat64Constant:
413 case IrOpcode::kRelocatableInt32Constant:
414 case IrOpcode::kRelocatableInt64Constant:
415 // Constants have no inputs.
416 CHECK_EQ(0, input_count);
417 // Type is empty.
418 CheckNotTyped(node);
419 break;
420 case IrOpcode::kNumberConstant:
421 // Constants have no inputs.
422 CHECK_EQ(0, input_count);
423 // Type is a number.
424 CheckTypeIs(node, Type::Number());
425 break;
426 case IrOpcode::kHeapConstant:
427 // Constants have no inputs.
428 CHECK_EQ(0, input_count);
429 // Type is anything.
430 CheckTypeIs(node, Type::Any());
431 break;
432 case IrOpcode::kExternalConstant:
433 case IrOpcode::kPointerConstant:
434 // Constants have no inputs.
435 CHECK_EQ(0, input_count);
436 // Type is an external pointer.
437 CheckTypeIs(node, Type::ExternalPointer());
438 break;
439 case IrOpcode::kOsrValue:
440 // OSR values have a value and a control input.
441 CHECK_EQ(1, control_count);
442 CHECK_EQ(1, input_count);
443 // Type is merged from other values in the graph and could be any.
444 CheckTypeIs(node, Type::Any());
445 break;
446 case IrOpcode::kProjection: {
447 // Projection has an input that produces enough values.
448 int index = static_cast<int>(ProjectionIndexOf(node->op()));
449 Node* input = NodeProperties::GetValueInput(node, 0);
450 CHECK_GT(input->op()->ValueOutputCount(), index);
451 // Type can be anything.
452 // TODO(rossberg): Introduce tuple types for this.
453 // TODO(titzer): Convince rossberg not to.
454 CheckTypeIs(node, Type::Any());
455 break;
456 }
457 case IrOpcode::kSelect: {
458 CHECK_EQ(0, effect_count);
459 CHECK_EQ(0, control_count);
460 CHECK_EQ(3, value_count);
461 // The condition must be a Boolean.
462 CheckValueInputIs(node, 0, Type::Boolean());
463 // Type can be anything.
464 CheckTypeIs(node, Type::Any());
465 break;
466 }
467 case IrOpcode::kPhi: {
468 // Phi input count matches parent control node.
469 CHECK_EQ(0, effect_count);
470 CHECK_EQ(1, control_count);
471 Node* control = NodeProperties::GetControlInput(node, 0);
472 CHECK_EQ(value_count, control->op()->ControlInputCount());
473 CHECK_EQ(input_count, 1 + value_count);
474 // Type must be subsumed by all input types.
475 // TODO(rossberg): for now at least, narrowing does not really hold.
476 /*
477 for (int i = 0; i < value_count; ++i) {
478 CHECK(type_of(ValueInput(node, i))->Is(type_of(node)));
479 }
480 */
481 break;
482 }
483 case IrOpcode::kInductionVariablePhi: {
484 // This is only a temporary node for the typer.
485 UNREACHABLE();
486 break;
487 }
488 case IrOpcode::kEffectPhi: {
489 // EffectPhi input count matches parent control node.
490 CHECK_EQ(0, value_count);
491 CHECK_EQ(1, control_count);
492 Node* control = NodeProperties::GetControlInput(node, 0);
493 CHECK_EQ(effect_count, control->op()->ControlInputCount());
494 CHECK_EQ(input_count, 1 + effect_count);
495 // If the control input is a Merge, then make sure that at least one
496 // of it's usages is non-phi.
497 if (control->opcode() == IrOpcode::kMerge) {
498 bool non_phi_use_found = false;
499 for (Node* use : control->uses()) {
500 if (all.IsLive(use) && use->opcode() != IrOpcode::kEffectPhi &&
501 use->opcode() != IrOpcode::kPhi) {
502 non_phi_use_found = true;
503 }
504 }
505 CHECK(non_phi_use_found);
506 }
507 break;
508 }
509 case IrOpcode::kLoopExit: {
510 CHECK_EQ(2, control_count);
511 Node* loop = NodeProperties::GetControlInput(node, 1);
512 CHECK_EQ(IrOpcode::kLoop, loop->opcode());
513 break;
514 }
515 case IrOpcode::kLoopExitValue: {
516 CHECK_EQ(1, control_count);
517 Node* loop_exit = NodeProperties::GetControlInput(node, 0);
518 CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
519 break;
520 }
521 case IrOpcode::kLoopExitEffect: {
522 CHECK_EQ(1, control_count);
523 Node* loop_exit = NodeProperties::GetControlInput(node, 0);
524 CHECK_EQ(IrOpcode::kLoopExit, loop_exit->opcode());
525 break;
526 }
527 case IrOpcode::kCheckpoint:
528 // Type is empty.
529 CheckNotTyped(node);
530 break;
531 case IrOpcode::kBeginRegion:
532 // TODO(rossberg): what are the constraints on these?
533 break;
534 case IrOpcode::kFinishRegion: {
535 // TODO(rossberg): what are the constraints on these?
536 // Type must be subsumed by input type.
537 if (typing == TYPED) {
538 Node* val = NodeProperties::GetValueInput(node, 0);
539 CHECK(NodeProperties::GetType(val).Is(NodeProperties::GetType(node)));
540 }
541 break;
542 }
543 case IrOpcode::kFrameState: {
544 // TODO(jarin): what are the constraints on these?
545 CHECK_EQ(5, value_count);
546 CHECK_EQ(0, control_count);
547 CHECK_EQ(0, effect_count);
548 CHECK_EQ(6, input_count);
549 // Check that the parameters and registers are kStateValues or
550 // kTypedStateValues.
551 for (int i = 0; i < 2; ++i) {
552 CHECK(NodeProperties::GetValueInput(node, i)->opcode() ==
553 IrOpcode::kStateValues ||
554 NodeProperties::GetValueInput(node, i)->opcode() ==
555 IrOpcode::kTypedStateValues);
556 }
557 // The accumulator (InputAt(2)) cannot be kStateValues, but it can be
558 // kTypedStateValues (to signal the type). Once AST graph builder
559 // is removed, we should check this here. Until then, AST graph
560 // builder can generate expression stack as InputAt(2), which can
561 // still be kStateValues.
562 break;
563 }
564 case IrOpcode::kObjectId:
565 CheckTypeIs(node, Type::Object());
566 break;
567 case IrOpcode::kStateValues:
568 case IrOpcode::kTypedStateValues:
569 case IrOpcode::kArgumentsElementsState:
570 case IrOpcode::kArgumentsLengthState:
571 case IrOpcode::kObjectState:
572 case IrOpcode::kTypedObjectState:
573 // TODO(jarin): what are the constraints on these?
574 break;
575 case IrOpcode::kCall:
576 case IrOpcode::kCallWithCallerSavedRegisters:
577 // TODO(rossberg): what are the constraints on these?
578 break;
579 case IrOpcode::kTailCall:
580 // TODO(bmeurer): what are the constraints on these?
581 break;
582
583 // JavaScript operators
584 // --------------------
585 case IrOpcode::kJSEqual:
586 case IrOpcode::kJSStrictEqual:
587 case IrOpcode::kJSLessThan:
588 case IrOpcode::kJSGreaterThan:
589 case IrOpcode::kJSLessThanOrEqual:
590 case IrOpcode::kJSGreaterThanOrEqual:
591 // Type is Boolean.
592 CheckTypeIs(node, Type::Boolean());
593 break;
594
595 case IrOpcode::kJSAdd:
596 CheckTypeIs(node, Type::NumericOrString());
597 break;
598 case IrOpcode::kJSBitwiseOr:
599 case IrOpcode::kJSBitwiseXor:
600 case IrOpcode::kJSBitwiseAnd:
601 case IrOpcode::kJSShiftLeft:
602 case IrOpcode::kJSShiftRight:
603 case IrOpcode::kJSShiftRightLogical:
604 case IrOpcode::kJSSubtract:
605 case IrOpcode::kJSMultiply:
606 case IrOpcode::kJSDivide:
607 case IrOpcode::kJSModulus:
608 case IrOpcode::kJSExponentiate:
609 case IrOpcode::kJSBitwiseNot:
610 case IrOpcode::kJSDecrement:
611 case IrOpcode::kJSIncrement:
612 case IrOpcode::kJSNegate:
613 CheckTypeIs(node, Type::Numeric());
614 break;
615
616 case IrOpcode::kToBoolean:
617 // Type is Boolean.
618 CheckTypeIs(node, Type::Boolean());
619 break;
620 case IrOpcode::kJSToInteger:
621 // Type is OrderedNumber.
622 CheckTypeIs(node, Type::OrderedNumber());
623 break;
624 case IrOpcode::kJSToLength:
625 CheckTypeIs(node, Type::Range(0, kMaxSafeInteger, zone));
626 break;
627 case IrOpcode::kJSToName:
628 // Type is Name.
629 CheckTypeIs(node, Type::Name());
630 break;
631 case IrOpcode::kJSToNumber:
632 // Type is Number.
633 CheckTypeIs(node, Type::Number());
634 break;
635 case IrOpcode::kJSToNumeric:
636 // Type is Numeric.
637 CheckTypeIs(node, Type::Numeric());
638 break;
639 case IrOpcode::kJSToString:
640 // Type is String.
641 CheckTypeIs(node, Type::String());
642 break;
643 case IrOpcode::kJSToObject:
644 // Type is Receiver.
645 CheckTypeIs(node, Type::Receiver());
646 break;
647 case IrOpcode::kJSParseInt:
648 // Type is Receiver.
649 CheckValueInputIs(node, 0, Type::Any());
650 CheckValueInputIs(node, 1, Type::Any());
651 CheckTypeIs(node, Type::Number());
652 break;
653
654 case IrOpcode::kJSCreate:
655 // Type is Object.
656 CheckTypeIs(node, Type::Object());
657 break;
658 case IrOpcode::kJSCreateArguments:
659 // Type is Array \/ OtherObject.
660 CheckTypeIs(node, Type::ArrayOrOtherObject());
661 break;
662 case IrOpcode::kJSCreateArray:
663 // Type is Array.
664 CheckTypeIs(node, Type::Array());
665 break;
666 case IrOpcode::kJSCreateArrayIterator:
667 // Type is OtherObject.
668 CheckTypeIs(node, Type::OtherObject());
669 break;
670 case IrOpcode::kJSCreateCollectionIterator:
671 // Type is OtherObject.
672 CheckTypeIs(node, Type::OtherObject());
673 break;
674 case IrOpcode::kJSCreateBoundFunction:
675 // Type is BoundFunction.
676 CheckTypeIs(node, Type::BoundFunction());
677 break;
678 case IrOpcode::kJSCreateClosure:
679 // Type is Function.
680 CheckTypeIs(node, Type::Function());
681 break;
682 case IrOpcode::kJSCreateIterResultObject:
683 // Type is OtherObject.
684 CheckTypeIs(node, Type::OtherObject());
685 break;
686 case IrOpcode::kJSCreateStringIterator:
687 // Type is OtherObject.
688 CheckTypeIs(node, Type::OtherObject());
689 break;
690 case IrOpcode::kJSCreateKeyValueArray:
691 // Type is OtherObject.
692 CheckTypeIs(node, Type::OtherObject());
693 break;
694 case IrOpcode::kJSCreateObject:
695 // Type is Object.
696 CheckTypeIs(node, Type::OtherObject());
697 break;
698 case IrOpcode::kJSCreatePromise:
699 // Type is OtherObject.
700 CheckTypeIs(node, Type::OtherObject());
701 break;
702 case IrOpcode::kJSCreateTypedArray:
703 // Type is OtherObject.
704 CheckTypeIs(node, Type::OtherObject());
705 break;
706 case IrOpcode::kJSCreateLiteralArray:
707 // Type is Array.
708 CheckTypeIs(node, Type::Array());
709 break;
710 case IrOpcode::kJSCreateEmptyLiteralArray:
711 // Type is Array.
712 CheckTypeIs(node, Type::Array());
713 break;
714 case IrOpcode::kJSCreateLiteralObject:
715 case IrOpcode::kJSCreateEmptyLiteralObject:
716 case IrOpcode::kJSCreateLiteralRegExp:
717 // Type is OtherObject.
718 CheckTypeIs(node, Type::OtherObject());
719 break;
720 case IrOpcode::kJSLoadProperty:
721 // Type can be anything.
722 CheckTypeIs(node, Type::Any());
723 CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
724 break;
725 case IrOpcode::kJSLoadNamed:
726 // Type can be anything.
727 CheckTypeIs(node, Type::Any());
728 CHECK(NamedAccessOf(node->op()).feedback().IsValid());
729 break;
730 case IrOpcode::kJSLoadGlobal:
731 // Type can be anything.
732 CheckTypeIs(node, Type::Any());
733 CHECK(LoadGlobalParametersOf(node->op()).feedback().IsValid());
734 break;
735 case IrOpcode::kJSStoreProperty:
736 // Type is empty.
737 CheckNotTyped(node);
738 CHECK(PropertyAccessOf(node->op()).feedback().IsValid());
739 break;
740 case IrOpcode::kJSStoreNamed:
741 // Type is empty.
742 CheckNotTyped(node);
743 CHECK(NamedAccessOf(node->op()).feedback().IsValid());
744 break;
745 case IrOpcode::kJSStoreGlobal:
746 // Type is empty.
747 CheckNotTyped(node);
748 CHECK(StoreGlobalParametersOf(node->op()).feedback().IsValid());
749 break;
750 case IrOpcode::kJSStoreNamedOwn:
751 // Type is empty.
752 CheckNotTyped(node);
753 CHECK(StoreNamedOwnParametersOf(node->op()).feedback().IsValid());
754 break;
755 case IrOpcode::kJSStoreDataPropertyInLiteral:
756 case IrOpcode::kJSStoreInArrayLiteral:
757 // Type is empty.
758 CheckNotTyped(node);
759 CHECK(FeedbackParameterOf(node->op()).feedback().IsValid());
760 break;
761 case IrOpcode::kJSDeleteProperty:
762 case IrOpcode::kJSHasProperty:
763 case IrOpcode::kJSHasInPrototypeChain:
764 case IrOpcode::kJSInstanceOf:
765 case IrOpcode::kJSOrdinaryHasInstance:
766 // Type is Boolean.
767 CheckTypeIs(node, Type::Boolean());
768 break;
769 case IrOpcode::kTypeOf:
770 // Type is InternalizedString.
771 CheckTypeIs(node, Type::InternalizedString());
772 break;
773 case IrOpcode::kJSGetSuperConstructor:
774 // We don't check the input for Type::Function because
775 // this_function can be context-allocated.
776 // Any -> Callable.
777 CheckValueInputIs(node, 0, Type::Any());
778 CheckTypeIs(node, Type::Callable());
779 break;
780
781 case IrOpcode::kJSLoadContext:
782 // Type can be anything.
783 CheckTypeIs(node, Type::Any());
784 break;
785 case IrOpcode::kJSStoreContext:
786 // Type is empty.
787 CheckNotTyped(node);
788 break;
789 case IrOpcode::kJSCreateFunctionContext:
790 case IrOpcode::kJSCreateCatchContext:
791 case IrOpcode::kJSCreateWithContext:
792 case IrOpcode::kJSCreateBlockContext: {
793 // Type is Context, and operand is Internal.
794 Node* context = NodeProperties::GetContextInput(node);
795 // TODO(bmeurer): This should say CheckTypeIs, but we don't have type
796 // OtherInternal on certain contexts, i.e. those from OsrValue inputs.
797 CheckTypeMaybe(context, Type::OtherInternal());
798 CheckTypeIs(node, Type::OtherInternal());
799 break;
800 }
801
802 case IrOpcode::kJSConstructForwardVarargs:
803 case IrOpcode::kJSConstruct:
804 case IrOpcode::kJSConstructWithArrayLike:
805 case IrOpcode::kJSConstructWithSpread:
806 // Type is Receiver.
807 CheckTypeIs(node, Type::Receiver());
808 break;
809 case IrOpcode::kJSCallForwardVarargs:
810 case IrOpcode::kJSCall:
811 case IrOpcode::kJSCallWithArrayLike:
812 case IrOpcode::kJSCallWithSpread:
813 case IrOpcode::kJSCallRuntime:
814 // Type can be anything.
815 CheckTypeIs(node, Type::Any());
816 break;
817
818 case IrOpcode::kJSForInEnumerate:
819 // Any -> OtherInternal.
820 CheckValueInputIs(node, 0, Type::Any());
821 CheckTypeIs(node, Type::OtherInternal());
822 break;
823 case IrOpcode::kJSForInPrepare:
824 // TODO(bmeurer): What are the constraints on thse?
825 CheckTypeIs(node, Type::Any());
826 break;
827 case IrOpcode::kJSForInNext:
828 CheckTypeIs(node, Type::Union(Type::Name(), Type::Undefined(), zone));
829 break;
830
831 case IrOpcode::kJSLoadMessage:
832 case IrOpcode::kJSStoreMessage:
833 break;
834
835 case IrOpcode::kJSLoadModule:
836 CheckTypeIs(node, Type::Any());
837 break;
838 case IrOpcode::kJSStoreModule:
839 CheckNotTyped(node);
840 break;
841
842 case IrOpcode::kJSGeneratorStore:
843 CheckNotTyped(node);
844 break;
845
846 case IrOpcode::kJSCreateGeneratorObject:
847 CheckTypeIs(node, Type::OtherObject());
848 break;
849
850 case IrOpcode::kJSGeneratorRestoreContinuation:
851 CheckTypeIs(node, Type::SignedSmall());
852 break;
853
854 case IrOpcode::kJSGeneratorRestoreContext:
855 CheckTypeIs(node, Type::Any());
856 break;
857
858 case IrOpcode::kJSGeneratorRestoreRegister:
859 CheckTypeIs(node, Type::Any());
860 break;
861
862 case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
863 CheckTypeIs(node, Type::Any());
864 break;
865
866 case IrOpcode::kJSStackCheck:
867 case IrOpcode::kJSDebugger:
868 // Type is empty.
869 CheckNotTyped(node);
870 break;
871
872 case IrOpcode::kJSFulfillPromise:
873 CheckValueInputIs(node, 0, Type::Any());
874 CheckValueInputIs(node, 1, Type::Any());
875 CheckTypeIs(node, Type::Undefined());
876 break;
877 case IrOpcode::kJSPerformPromiseThen:
878 CheckValueInputIs(node, 0, Type::Any());
879 CheckValueInputIs(node, 1, Type::Any());
880 CheckValueInputIs(node, 2, Type::Any());
881 CheckValueInputIs(node, 3, Type::Any());
882 CheckTypeIs(node, Type::Receiver());
883 break;
884 case IrOpcode::kJSPromiseResolve:
885 CheckValueInputIs(node, 0, Type::Any());
886 CheckValueInputIs(node, 1, Type::Any());
887 CheckTypeIs(node, Type::Receiver());
888 break;
889 case IrOpcode::kJSRejectPromise:
890 CheckValueInputIs(node, 0, Type::Any());
891 CheckValueInputIs(node, 1, Type::Any());
892 CheckValueInputIs(node, 2, Type::Any());
893 CheckTypeIs(node, Type::Undefined());
894 break;
895 case IrOpcode::kJSResolvePromise:
896 CheckValueInputIs(node, 0, Type::Any());
897 CheckValueInputIs(node, 1, Type::Any());
898 CheckTypeIs(node, Type::Undefined());
899 break;
900 case IrOpcode::kJSObjectIsArray:
901 CheckValueInputIs(node, 0, Type::Any());
902 CheckTypeIs(node, Type::Boolean());
903 break;
904
905 case IrOpcode::kComment:
906 case IrOpcode::kDebugAbort:
907 case IrOpcode::kDebugBreak:
908 case IrOpcode::kRetain:
909 case IrOpcode::kUnsafePointerAdd:
910 case IrOpcode::kRuntimeAbort:
911 CheckNotTyped(node);
912 break;
913
914 // Simplified operators
915 // -------------------------------
916 case IrOpcode::kBooleanNot:
917 // Boolean -> Boolean
918 CheckValueInputIs(node, 0, Type::Boolean());
919 CheckTypeIs(node, Type::Boolean());
920 break;
921 case IrOpcode::kNumberEqual:
922 // (Number, Number) -> Boolean
923 CheckValueInputIs(node, 0, Type::Number());
924 CheckValueInputIs(node, 1, Type::Number());
925 CheckTypeIs(node, Type::Boolean());
926 break;
927 case IrOpcode::kNumberLessThan:
928 case IrOpcode::kNumberLessThanOrEqual:
929 // (Number, Number) -> Boolean
930 CheckValueInputIs(node, 0, Type::Number());
931 CheckValueInputIs(node, 1, Type::Number());
932 CheckTypeIs(node, Type::Boolean());
933 break;
934 case IrOpcode::kSpeculativeSafeIntegerAdd:
935 case IrOpcode::kSpeculativeSafeIntegerSubtract:
936 case IrOpcode::kSpeculativeNumberAdd:
937 case IrOpcode::kSpeculativeNumberSubtract:
938 case IrOpcode::kSpeculativeNumberMultiply:
939 case IrOpcode::kSpeculativeNumberDivide:
940 case IrOpcode::kSpeculativeNumberModulus:
941 CheckTypeIs(node, Type::Number());
942 break;
943 case IrOpcode::kSpeculativeNumberEqual:
944 case IrOpcode::kSpeculativeNumberLessThan:
945 case IrOpcode::kSpeculativeNumberLessThanOrEqual:
946 CheckTypeIs(node, Type::Boolean());
947 break;
948 case IrOpcode::kNumberAdd:
949 case IrOpcode::kNumberSubtract:
950 case IrOpcode::kNumberMultiply:
951 case IrOpcode::kNumberDivide:
952 // (Number, Number) -> Number
953 CheckValueInputIs(node, 0, Type::Number());
954 CheckValueInputIs(node, 1, Type::Number());
955 CheckTypeIs(node, Type::Number());
956 break;
957 case IrOpcode::kNumberModulus:
958 // (Number, Number) -> Number
959 CheckValueInputIs(node, 0, Type::Number());
960 CheckValueInputIs(node, 1, Type::Number());
961 CheckTypeIs(node, Type::Number());
962 break;
963 case IrOpcode::kNumberBitwiseOr:
964 case IrOpcode::kNumberBitwiseXor:
965 case IrOpcode::kNumberBitwiseAnd:
966 // (Signed32, Signed32) -> Signed32
967 CheckValueInputIs(node, 0, Type::Signed32());
968 CheckValueInputIs(node, 1, Type::Signed32());
969 CheckTypeIs(node, Type::Signed32());
970 break;
971 case IrOpcode::kSpeculativeNumberBitwiseOr:
972 case IrOpcode::kSpeculativeNumberBitwiseXor:
973 case IrOpcode::kSpeculativeNumberBitwiseAnd:
974 CheckTypeIs(node, Type::Signed32());
975 break;
976 case IrOpcode::kNumberShiftLeft:
977 case IrOpcode::kNumberShiftRight:
978 // (Signed32, Unsigned32) -> Signed32
979 CheckValueInputIs(node, 0, Type::Signed32());
980 CheckValueInputIs(node, 1, Type::Unsigned32());
981 CheckTypeIs(node, Type::Signed32());
982 break;
983 case IrOpcode::kSpeculativeNumberShiftLeft:
984 case IrOpcode::kSpeculativeNumberShiftRight:
985 CheckTypeIs(node, Type::Signed32());
986 break;
987 case IrOpcode::kNumberShiftRightLogical:
988 // (Unsigned32, Unsigned32) -> Unsigned32
989 CheckValueInputIs(node, 0, Type::Unsigned32());
990 CheckValueInputIs(node, 1, Type::Unsigned32());
991 CheckTypeIs(node, Type::Unsigned32());
992 break;
993 case IrOpcode::kSpeculativeNumberShiftRightLogical:
994 CheckTypeIs(node, Type::Unsigned32());
995 break;
996 case IrOpcode::kNumberImul:
997 // (Unsigned32, Unsigned32) -> Signed32
998 CheckValueInputIs(node, 0, Type::Unsigned32());
999 CheckValueInputIs(node, 1, Type::Unsigned32());
1000 CheckTypeIs(node, Type::Signed32());
1001 break;
1002 case IrOpcode::kNumberClz32:
1003 // Unsigned32 -> Unsigned32
1004 CheckValueInputIs(node, 0, Type::Unsigned32());
1005 CheckTypeIs(node, Type::Unsigned32());
1006 break;
1007 case IrOpcode::kNumberAtan2:
1008 case IrOpcode::kNumberMax:
1009 case IrOpcode::kNumberMin:
1010 case IrOpcode::kNumberPow:
1011 // (Number, Number) -> Number
1012 CheckValueInputIs(node, 0, Type::Number());
1013 CheckValueInputIs(node, 1, Type::Number());
1014 CheckTypeIs(node, Type::Number());
1015 break;
1016 case IrOpcode::kNumberAbs:
1017 case IrOpcode::kNumberCeil:
1018 case IrOpcode::kNumberFloor:
1019 case IrOpcode::kNumberFround:
1020 case IrOpcode::kNumberAcos:
1021 case IrOpcode::kNumberAcosh:
1022 case IrOpcode::kNumberAsin:
1023 case IrOpcode::kNumberAsinh:
1024 case IrOpcode::kNumberAtan:
1025 case IrOpcode::kNumberAtanh:
1026 case IrOpcode::kNumberCos:
1027 case IrOpcode::kNumberCosh:
1028 case IrOpcode::kNumberExp:
1029 case IrOpcode::kNumberExpm1:
1030 case IrOpcode::kNumberLog:
1031 case IrOpcode::kNumberLog1p:
1032 case IrOpcode::kNumberLog2:
1033 case IrOpcode::kNumberLog10:
1034 case IrOpcode::kNumberCbrt:
1035 case IrOpcode::kNumberRound:
1036 case IrOpcode::kNumberSign:
1037 case IrOpcode::kNumberSin:
1038 case IrOpcode::kNumberSinh:
1039 case IrOpcode::kNumberSqrt:
1040 case IrOpcode::kNumberTan:
1041 case IrOpcode::kNumberTanh:
1042 case IrOpcode::kNumberTrunc:
1043 // Number -> Number
1044 CheckValueInputIs(node, 0, Type::Number());
1045 CheckTypeIs(node, Type::Number());
1046 break;
1047 case IrOpcode::kNumberToBoolean:
1048 // Number -> Boolean
1049 CheckValueInputIs(node, 0, Type::Number());
1050 CheckTypeIs(node, Type::Boolean());
1051 break;
1052 case IrOpcode::kNumberToInt32:
1053 // Number -> Signed32
1054 CheckValueInputIs(node, 0, Type::Number());
1055 CheckTypeIs(node, Type::Signed32());
1056 break;
1057 case IrOpcode::kNumberToString:
1058 // Number -> String
1059 CheckValueInputIs(node, 0, Type::Number());
1060 CheckTypeIs(node, Type::String());
1061 break;
1062 case IrOpcode::kNumberToUint32:
1063 case IrOpcode::kNumberToUint8Clamped:
1064 // Number -> Unsigned32
1065 CheckValueInputIs(node, 0, Type::Number());
1066 CheckTypeIs(node, Type::Unsigned32());
1067 break;
1068 case IrOpcode::kSpeculativeToNumber:
1069 // Any -> Number
1070 CheckValueInputIs(node, 0, Type::Any());
1071 CheckTypeIs(node, Type::Number());
1072 break;
1073 case IrOpcode::kPlainPrimitiveToNumber:
1074 // PlainPrimitive -> Number
1075 CheckValueInputIs(node, 0, Type::PlainPrimitive());
1076 CheckTypeIs(node, Type::Number());
1077 break;
1078 case IrOpcode::kPlainPrimitiveToWord32:
1079 // PlainPrimitive -> Integral32
1080 CheckValueInputIs(node, 0, Type::PlainPrimitive());
1081 CheckTypeIs(node, Type::Integral32());
1082 break;
1083 case IrOpcode::kPlainPrimitiveToFloat64:
1084 // PlainPrimitive -> Number
1085 CheckValueInputIs(node, 0, Type::PlainPrimitive());
1086 CheckTypeIs(node, Type::Number());
1087 break;
1088 case IrOpcode::kStringEqual:
1089 case IrOpcode::kStringLessThan:
1090 case IrOpcode::kStringLessThanOrEqual:
1091 // (String, String) -> Boolean
1092 CheckValueInputIs(node, 0, Type::String());
1093 CheckValueInputIs(node, 1, Type::String());
1094 CheckTypeIs(node, Type::Boolean());
1095 break;
1096 case IrOpcode::kStringToNumber:
1097 // String -> Number
1098 CheckValueInputIs(node, 0, Type::String());
1099 CheckTypeIs(node, Type::Number());
1100 break;
1101 case IrOpcode::kStringCharCodeAt:
1102 // (String, Unsigned32) -> UnsignedSmall
1103 CheckValueInputIs(node, 0, Type::String());
1104 CheckValueInputIs(node, 1, Type::Unsigned32());
1105 CheckTypeIs(node, Type::UnsignedSmall());
1106 break;
1107 case IrOpcode::kStringCodePointAt:
1108 // (String, Unsigned32) -> UnsignedSmall
1109 CheckValueInputIs(node, 0, Type::String());
1110 CheckValueInputIs(node, 1, Type::Unsigned32());
1111 CheckTypeIs(node, Type::UnsignedSmall());
1112 break;
1113 case IrOpcode::kStringFromSingleCharCode:
1114 // Number -> String
1115 CheckValueInputIs(node, 0, Type::Number());
1116 CheckTypeIs(node, Type::String());
1117 break;
1118 case IrOpcode::kStringFromSingleCodePoint:
1119 // (Unsigned32) -> String
1120 CheckValueInputIs(node, 0, Type::Number());
1121 CheckTypeIs(node, Type::String());
1122 break;
1123 case IrOpcode::kStringIndexOf:
1124 // (String, String, SignedSmall) -> SignedSmall
1125 CheckValueInputIs(node, 0, Type::String());
1126 CheckValueInputIs(node, 1, Type::String());
1127 CheckValueInputIs(node, 2, Type::SignedSmall());
1128 CheckTypeIs(node, Type::SignedSmall());
1129 break;
1130 case IrOpcode::kStringLength:
1131 CheckValueInputIs(node, 0, Type::String());
1132 CheckTypeIs(node, TypeCache::Get().kStringLengthType);
1133 break;
1134 case IrOpcode::kStringToLowerCaseIntl:
1135 case IrOpcode::kStringToUpperCaseIntl:
1136 CheckValueInputIs(node, 0, Type::String());
1137 CheckTypeIs(node, Type::String());
1138 break;
1139 case IrOpcode::kStringSubstring:
1140 CheckValueInputIs(node, 0, Type::String());
1141 CheckValueInputIs(node, 1, Type::SignedSmall());
1142 CheckValueInputIs(node, 2, Type::SignedSmall());
1143 CheckTypeIs(node, Type::String());
1144 break;
1145 case IrOpcode::kReferenceEqual:
1146 // (Unique, Any) -> Boolean and
1147 // (Any, Unique) -> Boolean
1148 CheckTypeIs(node, Type::Boolean());
1149 break;
1150 case IrOpcode::kSameValue:
1151 // (Any, Any) -> Boolean
1152 CheckValueInputIs(node, 0, Type::Any());
1153 CheckValueInputIs(node, 1, Type::Any());
1154 CheckTypeIs(node, Type::Boolean());
1155 break;
1156
1157 case IrOpcode::kObjectIsArrayBufferView:
1158 case IrOpcode::kObjectIsBigInt:
1159 case IrOpcode::kObjectIsCallable:
1160 case IrOpcode::kObjectIsConstructor:
1161 case IrOpcode::kObjectIsDetectableCallable:
1162 case IrOpcode::kObjectIsMinusZero:
1163 case IrOpcode::kObjectIsNaN:
1164 case IrOpcode::kObjectIsNonCallable:
1165 case IrOpcode::kObjectIsNumber:
1166 case IrOpcode::kObjectIsReceiver:
1167 case IrOpcode::kObjectIsSmi:
1168 case IrOpcode::kObjectIsString:
1169 case IrOpcode::kObjectIsSymbol:
1170 case IrOpcode::kObjectIsUndetectable:
1171 case IrOpcode::kArrayBufferWasNeutered:
1172 CheckValueInputIs(node, 0, Type::Any());
1173 CheckTypeIs(node, Type::Boolean());
1174 break;
1175 case IrOpcode::kNumberIsFloat64Hole:
1176 CheckValueInputIs(node, 0, Type::NumberOrHole());
1177 CheckTypeIs(node, Type::Boolean());
1178 break;
1179 case IrOpcode::kNumberIsFinite:
1180 CheckValueInputIs(node, 0, Type::Number());
1181 CheckTypeIs(node, Type::Boolean());
1182 break;
1183 case IrOpcode::kNumberIsNaN:
1184 CheckValueInputIs(node, 0, Type::Number());
1185 CheckTypeIs(node, Type::Boolean());
1186 break;
1187 case IrOpcode::kObjectIsFiniteNumber:
1188 CheckValueInputIs(node, 0, Type::Any());
1189 CheckTypeIs(node, Type::Boolean());
1190 break;
1191 case IrOpcode::kNumberIsInteger:
1192 CheckValueInputIs(node, 0, Type::Number());
1193 CheckTypeIs(node, Type::Boolean());
1194 break;
1195 case IrOpcode::kObjectIsSafeInteger:
1196 CheckValueInputIs(node, 0, Type::Any());
1197 CheckTypeIs(node, Type::Boolean());
1198 break;
1199 case IrOpcode::kNumberIsSafeInteger:
1200 CheckValueInputIs(node, 0, Type::Number());
1201 CheckTypeIs(node, Type::Boolean());
1202 break;
1203 case IrOpcode::kObjectIsInteger:
1204 CheckValueInputIs(node, 0, Type::Any());
1205 CheckTypeIs(node, Type::Boolean());
1206 break;
1207 case IrOpcode::kFindOrderedHashMapEntry:
1208 CheckValueInputIs(node, 0, Type::Any());
1209 CheckTypeIs(node, Type::SignedSmall());
1210 break;
1211 case IrOpcode::kFindOrderedHashMapEntryForInt32Key:
1212 CheckValueInputIs(node, 0, Type::Any());
1213 CheckValueInputIs(node, 1, Type::Signed32());
1214 CheckTypeIs(node, Type::SignedSmall());
1215 break;
1216 case IrOpcode::kArgumentsLength:
1217 CheckValueInputIs(node, 0, Type::ExternalPointer());
1218 CheckTypeIs(node, TypeCache::Get().kArgumentsLengthType);
1219 break;
1220 case IrOpcode::kArgumentsFrame:
1221 CheckTypeIs(node, Type::ExternalPointer());
1222 break;
1223 case IrOpcode::kNewDoubleElements:
1224 case IrOpcode::kNewSmiOrObjectElements:
1225 CheckValueInputIs(node, 0,
1226 Type::Range(0.0, FixedArray::kMaxLength, zone));
1227 CheckTypeIs(node, Type::OtherInternal());
1228 break;
1229 case IrOpcode::kNewArgumentsElements:
1230 CheckValueInputIs(node, 0, Type::ExternalPointer());
1231 CheckValueInputIs(node, 1, Type::Range(-Code::kMaxArguments,
1232 Code::kMaxArguments, zone));
1233 CheckTypeIs(node, Type::OtherInternal());
1234 break;
1235 case IrOpcode::kNewConsString:
1236 CheckValueInputIs(node, 0, TypeCache::Get().kStringLengthType);
1237 CheckValueInputIs(node, 1, Type::String());
1238 CheckValueInputIs(node, 2, Type::String());
1239 CheckTypeIs(node, Type::String());
1240 break;
1241 case IrOpcode::kAllocate:
1242 CheckValueInputIs(node, 0, Type::PlainNumber());
1243 break;
1244 case IrOpcode::kAllocateRaw:
1245 // CheckValueInputIs(node, 0, Type::PlainNumber());
1246 break;
1247 case IrOpcode::kEnsureWritableFastElements:
1248 CheckValueInputIs(node, 0, Type::Any());
1249 CheckValueInputIs(node, 1, Type::Internal());
1250 CheckTypeIs(node, Type::Internal());
1251 break;
1252 case IrOpcode::kMaybeGrowFastElements:
1253 CheckValueInputIs(node, 0, Type::Any());
1254 CheckValueInputIs(node, 1, Type::Internal());
1255 CheckValueInputIs(node, 2, Type::Unsigned31());
1256 CheckValueInputIs(node, 3, Type::Unsigned31());
1257 CheckTypeIs(node, Type::Internal());
1258 break;
1259 case IrOpcode::kTransitionElementsKind:
1260 CheckValueInputIs(node, 0, Type::Any());
1261 CheckNotTyped(node);
1262 break;
1263
1264 case IrOpcode::kChangeTaggedSignedToInt32: {
1265 // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1266 // TODO(neis): Activate once ChangeRepresentation works in typer.
1267 // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1268 // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1269 // CheckValueInputIs(node, 0, from));
1270 // CheckTypeIs(node, to));
1271 break;
1272 }
1273 case IrOpcode::kChangeTaggedToInt32: {
1274 // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
1275 // TODO(neis): Activate once ChangeRepresentation works in typer.
1276 // Type from = Type::Intersect(Type::Signed32(), Type::Tagged());
1277 // Type to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1278 // CheckValueInputIs(node, 0, from));
1279 // CheckTypeIs(node, to));
1280 break;
1281 }
1282 case IrOpcode::kChangeTaggedToUint32: {
1283 // Unsigned32 /\ Tagged -> Unsigned32 /\ UntaggedInt32
1284 // TODO(neis): Activate once ChangeRepresentation works in typer.
1285 // Type from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1286 // Type to =Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
1287 // CheckValueInputIs(node, 0, from));
1288 // CheckTypeIs(node, to));
1289 break;
1290 }
1291 case IrOpcode::kChangeTaggedToFloat64: {
1292 // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1293 // TODO(neis): Activate once ChangeRepresentation works in typer.
1294 // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1295 // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1296 // CheckValueInputIs(node, 0, from));
1297 // CheckTypeIs(node, to));
1298 break;
1299 }
1300 case IrOpcode::kChangeTaggedToTaggedSigned:
1301 break;
1302 case IrOpcode::kTruncateTaggedToFloat64: {
1303 // NumberOrUndefined /\ Tagged -> Number /\ UntaggedFloat64
1304 // TODO(neis): Activate once ChangeRepresentation works in typer.
1305 // Type from = Type::Intersect(Type::NumberOrUndefined(),
1306 // Type::Tagged());
1307 // Type to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1308 // CheckValueInputIs(node, 0, from));
1309 // CheckTypeIs(node, to));
1310 break;
1311 }
1312 case IrOpcode::kChangeInt31ToTaggedSigned: {
1313 // Signed31 /\ UntaggedInt32 -> Signed31 /\ Tagged
1314 // TODO(neis): Activate once ChangeRepresentation works in typer.
1315 // Type from =Type::Intersect(Type::Signed31(), Type::UntaggedInt32());
1316 // Type to = Type::Intersect(Type::Signed31(), Type::Tagged());
1317 // CheckValueInputIs(node, 0, from));
1318 // CheckTypeIs(node, to));
1319 break;
1320 }
1321 case IrOpcode::kChangeInt32ToTagged: {
1322 // Signed32 /\ UntaggedInt32 -> Signed32 /\ Tagged
1323 // TODO(neis): Activate once ChangeRepresentation works in typer.
1324 // Type from =Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
1325 // Type to = Type::Intersect(Type::Signed32(), Type::Tagged());
1326 // CheckValueInputIs(node, 0, from));
1327 // CheckTypeIs(node, to));
1328 break;
1329 }
1330 case IrOpcode::kChangeUint32ToTagged: {
1331 // Unsigned32 /\ UntaggedInt32 -> Unsigned32 /\ Tagged
1332 // TODO(neis): Activate once ChangeRepresentation works in typer.
1333 // Type from=Type::Intersect(Type::Unsigned32(),Type::UntaggedInt32());
1334 // Type to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
1335 // CheckValueInputIs(node, 0, from));
1336 // CheckTypeIs(node, to));
1337 break;
1338 }
1339 case IrOpcode::kChangeFloat64ToTagged: {
1340 // Number /\ UntaggedFloat64 -> Number /\ Tagged
1341 // TODO(neis): Activate once ChangeRepresentation works in typer.
1342 // Type from =Type::Intersect(Type::Number(), Type::UntaggedFloat64());
1343 // Type to = Type::Intersect(Type::Number(), Type::Tagged());
1344 // CheckValueInputIs(node, 0, from));
1345 // CheckTypeIs(node, to));
1346 break;
1347 }
1348 case IrOpcode::kChangeFloat64ToTaggedPointer:
1349 break;
1350 case IrOpcode::kChangeTaggedToBit: {
1351 // Boolean /\ TaggedPtr -> Boolean /\ UntaggedInt1
1352 // TODO(neis): Activate once ChangeRepresentation works in typer.
1353 // Type from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1354 // Type to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1355 // CheckValueInputIs(node, 0, from));
1356 // CheckTypeIs(node, to));
1357 break;
1358 }
1359 case IrOpcode::kChangeBitToTagged: {
1360 // Boolean /\ UntaggedInt1 -> Boolean /\ TaggedPtr
1361 // TODO(neis): Activate once ChangeRepresentation works in typer.
1362 // Type from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
1363 // Type to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
1364 // CheckValueInputIs(node, 0, from));
1365 // CheckTypeIs(node, to));
1366 break;
1367 }
1368 case IrOpcode::kTruncateTaggedToWord32: {
1369 // Number /\ Tagged -> Signed32 /\ UntaggedInt32
1370 // TODO(neis): Activate once ChangeRepresentation works in typer.
1371 // Type from = Type::Intersect(Type::Number(), Type::Tagged());
1372 // Type to = Type::Intersect(Type::Number(), Type::UntaggedInt32());
1373 // CheckValueInputIs(node, 0, from));
1374 // CheckTypeIs(node, to));
1375 break;
1376 }
1377 case IrOpcode::kTruncateTaggedToBit:
1378 case IrOpcode::kTruncateTaggedPointerToBit:
1379 break;
1380
1381 case IrOpcode::kCheckBounds:
1382 CheckValueInputIs(node, 0, Type::Any());
1383 CheckValueInputIs(node, 1, Type::Unsigned31());
1384 CheckTypeIs(node, Type::Unsigned31());
1385 break;
1386 case IrOpcode::kPoisonIndex:
1387 CheckValueInputIs(node, 0, Type::Unsigned32());
1388 CheckTypeIs(node, Type::Unsigned32());
1389 break;
1390 case IrOpcode::kCheckHeapObject:
1391 CheckValueInputIs(node, 0, Type::Any());
1392 break;
1393 case IrOpcode::kCheckIf:
1394 CheckValueInputIs(node, 0, Type::Boolean());
1395 CheckNotTyped(node);
1396 break;
1397 case IrOpcode::kCheckInternalizedString:
1398 CheckValueInputIs(node, 0, Type::Any());
1399 CheckTypeIs(node, Type::InternalizedString());
1400 break;
1401 case IrOpcode::kCheckMaps:
1402 CheckValueInputIs(node, 0, Type::Any());
1403 CheckNotTyped(node);
1404 break;
1405 case IrOpcode::kCompareMaps:
1406 CheckValueInputIs(node, 0, Type::Any());
1407 CheckTypeIs(node, Type::Boolean());
1408 break;
1409 case IrOpcode::kCheckNumber:
1410 CheckValueInputIs(node, 0, Type::Any());
1411 CheckTypeIs(node, Type::Number());
1412 break;
1413 case IrOpcode::kCheckReceiver:
1414 CheckValueInputIs(node, 0, Type::Any());
1415 CheckTypeIs(node, Type::Receiver());
1416 break;
1417 case IrOpcode::kCheckSmi:
1418 CheckValueInputIs(node, 0, Type::Any());
1419 break;
1420 case IrOpcode::kCheckString:
1421 CheckValueInputIs(node, 0, Type::Any());
1422 CheckTypeIs(node, Type::String());
1423 break;
1424 case IrOpcode::kCheckSymbol:
1425 CheckValueInputIs(node, 0, Type::Any());
1426 CheckTypeIs(node, Type::Symbol());
1427 break;
1428
1429 case IrOpcode::kConvertReceiver:
1430 // (Any, Any) -> Receiver
1431 CheckValueInputIs(node, 0, Type::Any());
1432 CheckValueInputIs(node, 1, Type::Any());
1433 CheckTypeIs(node, Type::Receiver());
1434 break;
1435
1436 case IrOpcode::kCheckedInt32Add:
1437 case IrOpcode::kCheckedInt32Sub:
1438 case IrOpcode::kCheckedInt32Div:
1439 case IrOpcode::kCheckedInt32Mod:
1440 case IrOpcode::kCheckedUint32Div:
1441 case IrOpcode::kCheckedUint32Mod:
1442 case IrOpcode::kCheckedInt32Mul:
1443 case IrOpcode::kCheckedInt32ToTaggedSigned:
1444 case IrOpcode::kCheckedUint32ToInt32:
1445 case IrOpcode::kCheckedUint32ToTaggedSigned:
1446 case IrOpcode::kCheckedFloat64ToInt32:
1447 case IrOpcode::kCheckedTaggedSignedToInt32:
1448 case IrOpcode::kCheckedTaggedToInt32:
1449 case IrOpcode::kCheckedTaggedToFloat64:
1450 case IrOpcode::kCheckedTaggedToTaggedSigned:
1451 case IrOpcode::kCheckedTaggedToTaggedPointer:
1452 case IrOpcode::kCheckedTruncateTaggedToWord32:
1453 break;
1454
1455 case IrOpcode::kCheckFloat64Hole:
1456 CheckValueInputIs(node, 0, Type::NumberOrHole());
1457 CheckTypeIs(node, Type::NumberOrUndefined());
1458 break;
1459 case IrOpcode::kCheckNotTaggedHole:
1460 CheckValueInputIs(node, 0, Type::Any());
1461 CheckTypeIs(node, Type::NonInternal());
1462 break;
1463 case IrOpcode::kConvertTaggedHoleToUndefined:
1464 CheckValueInputIs(node, 0, Type::Any());
1465 CheckTypeIs(node, Type::NonInternal());
1466 break;
1467
1468 case IrOpcode::kCheckEqualsInternalizedString:
1469 CheckValueInputIs(node, 0, Type::InternalizedString());
1470 CheckValueInputIs(node, 1, Type::Any());
1471 CheckNotTyped(node);
1472 break;
1473 case IrOpcode::kCheckEqualsSymbol:
1474 CheckValueInputIs(node, 0, Type::Symbol());
1475 CheckValueInputIs(node, 1, Type::Any());
1476 CheckNotTyped(node);
1477 break;
1478
1479 case IrOpcode::kLoadFieldByIndex:
1480 CheckValueInputIs(node, 0, Type::Any());
1481 CheckValueInputIs(node, 1, Type::SignedSmall());
1482 CheckTypeIs(node, Type::NonInternal());
1483 break;
1484 case IrOpcode::kLoadField:
1485 // Object -> fieldtype
1486 // TODO(rossberg): activate once machine ops are typed.
1487 // CheckValueInputIs(node, 0, Type::Object());
1488 // CheckTypeIs(node, FieldAccessOf(node->op()).type));
1489 break;
1490 case IrOpcode::kLoadElement:
1491 // Object -> elementtype
1492 // TODO(rossberg): activate once machine ops are typed.
1493 // CheckValueInputIs(node, 0, Type::Object());
1494 // CheckTypeIs(node, ElementAccessOf(node->op()).type));
1495 break;
1496 case IrOpcode::kLoadTypedElement:
1497 break;
1498 case IrOpcode::kStoreField:
1499 // (Object, fieldtype) -> _|_
1500 // TODO(rossberg): activate once machine ops are typed.
1501 // CheckValueInputIs(node, 0, Type::Object());
1502 // CheckValueInputIs(node, 1, FieldAccessOf(node->op()).type));
1503 CheckNotTyped(node);
1504 break;
1505 case IrOpcode::kStoreElement:
1506 // (Object, elementtype) -> _|_
1507 // TODO(rossberg): activate once machine ops are typed.
1508 // CheckValueInputIs(node, 0, Type::Object());
1509 // CheckValueInputIs(node, 1, ElementAccessOf(node->op()).type));
1510 CheckNotTyped(node);
1511 break;
1512 case IrOpcode::kTransitionAndStoreElement:
1513 CheckNotTyped(node);
1514 break;
1515 case IrOpcode::kTransitionAndStoreNumberElement:
1516 CheckNotTyped(node);
1517 break;
1518 case IrOpcode::kTransitionAndStoreNonNumberElement:
1519 CheckNotTyped(node);
1520 break;
1521 case IrOpcode::kStoreSignedSmallElement:
1522 CheckNotTyped(node);
1523 break;
1524 case IrOpcode::kStoreTypedElement:
1525 CheckNotTyped(node);
1526 break;
1527 case IrOpcode::kNumberSilenceNaN:
1528 CheckValueInputIs(node, 0, Type::Number());
1529 CheckTypeIs(node, Type::Number());
1530 break;
1531 case IrOpcode::kMapGuard:
1532 CheckNotTyped(node);
1533 break;
1534 case IrOpcode::kTypeGuard:
1535 CheckTypeIs(node, TypeGuardTypeOf(node->op()));
1536 break;
1537 case IrOpcode::kDateNow:
1538 CHECK_EQ(0, value_count);
1539 CheckTypeIs(node, Type::Number());
1540 break;
1541
1542 // Machine operators
1543 // -----------------------
1544 case IrOpcode::kLoad:
1545 case IrOpcode::kPoisonedLoad:
1546 case IrOpcode::kProtectedLoad:
1547 case IrOpcode::kProtectedStore:
1548 case IrOpcode::kStore:
1549 case IrOpcode::kStackSlot:
1550 case IrOpcode::kWord32And:
1551 case IrOpcode::kWord32Or:
1552 case IrOpcode::kWord32Xor:
1553 case IrOpcode::kWord32Shl:
1554 case IrOpcode::kWord32Shr:
1555 case IrOpcode::kWord32Sar:
1556 case IrOpcode::kWord32Ror:
1557 case IrOpcode::kWord32Equal:
1558 case IrOpcode::kWord32Clz:
1559 case IrOpcode::kWord32Ctz:
1560 case IrOpcode::kWord32ReverseBits:
1561 case IrOpcode::kWord32ReverseBytes:
1562 case IrOpcode::kInt32AbsWithOverflow:
1563 case IrOpcode::kWord32Popcnt:
1564 case IrOpcode::kWord64And:
1565 case IrOpcode::kWord64Or:
1566 case IrOpcode::kWord64Xor:
1567 case IrOpcode::kWord64Shl:
1568 case IrOpcode::kWord64Shr:
1569 case IrOpcode::kWord64Sar:
1570 case IrOpcode::kWord64Ror:
1571 case IrOpcode::kWord64Clz:
1572 case IrOpcode::kWord64Popcnt:
1573 case IrOpcode::kWord64Ctz:
1574 case IrOpcode::kWord64ReverseBits:
1575 case IrOpcode::kWord64ReverseBytes:
1576 case IrOpcode::kInt64AbsWithOverflow:
1577 case IrOpcode::kWord64Equal:
1578 case IrOpcode::kInt32Add:
1579 case IrOpcode::kInt32AddWithOverflow:
1580 case IrOpcode::kInt32Sub:
1581 case IrOpcode::kInt32SubWithOverflow:
1582 case IrOpcode::kInt32Mul:
1583 case IrOpcode::kInt32MulWithOverflow:
1584 case IrOpcode::kInt32MulHigh:
1585 case IrOpcode::kInt32Div:
1586 case IrOpcode::kInt32Mod:
1587 case IrOpcode::kInt32LessThan:
1588 case IrOpcode::kInt32LessThanOrEqual:
1589 case IrOpcode::kUint32Div:
1590 case IrOpcode::kUint32Mod:
1591 case IrOpcode::kUint32MulHigh:
1592 case IrOpcode::kUint32LessThan:
1593 case IrOpcode::kUint32LessThanOrEqual:
1594 case IrOpcode::kInt64Add:
1595 case IrOpcode::kInt64AddWithOverflow:
1596 case IrOpcode::kInt64Sub:
1597 case IrOpcode::kInt64SubWithOverflow:
1598 case IrOpcode::kInt64Mul:
1599 case IrOpcode::kInt64Div:
1600 case IrOpcode::kInt64Mod:
1601 case IrOpcode::kInt64LessThan:
1602 case IrOpcode::kInt64LessThanOrEqual:
1603 case IrOpcode::kUint64Div:
1604 case IrOpcode::kUint64Mod:
1605 case IrOpcode::kUint64LessThan:
1606 case IrOpcode::kUint64LessThanOrEqual:
1607 case IrOpcode::kFloat32Add:
1608 case IrOpcode::kFloat32Sub:
1609 case IrOpcode::kFloat32Neg:
1610 case IrOpcode::kFloat32Mul:
1611 case IrOpcode::kFloat32Div:
1612 case IrOpcode::kFloat32Abs:
1613 case IrOpcode::kFloat32Sqrt:
1614 case IrOpcode::kFloat32Equal:
1615 case IrOpcode::kFloat32LessThan:
1616 case IrOpcode::kFloat32LessThanOrEqual:
1617 case IrOpcode::kFloat32Max:
1618 case IrOpcode::kFloat32Min:
1619 case IrOpcode::kFloat64Add:
1620 case IrOpcode::kFloat64Sub:
1621 case IrOpcode::kFloat64Neg:
1622 case IrOpcode::kFloat64Mul:
1623 case IrOpcode::kFloat64Div:
1624 case IrOpcode::kFloat64Mod:
1625 case IrOpcode::kFloat64Max:
1626 case IrOpcode::kFloat64Min:
1627 case IrOpcode::kFloat64Abs:
1628 case IrOpcode::kFloat64Acos:
1629 case IrOpcode::kFloat64Acosh:
1630 case IrOpcode::kFloat64Asin:
1631 case IrOpcode::kFloat64Asinh:
1632 case IrOpcode::kFloat64Atan:
1633 case IrOpcode::kFloat64Atan2:
1634 case IrOpcode::kFloat64Atanh:
1635 case IrOpcode::kFloat64Cbrt:
1636 case IrOpcode::kFloat64Cos:
1637 case IrOpcode::kFloat64Cosh:
1638 case IrOpcode::kFloat64Exp:
1639 case IrOpcode::kFloat64Expm1:
1640 case IrOpcode::kFloat64Log:
1641 case IrOpcode::kFloat64Log1p:
1642 case IrOpcode::kFloat64Log10:
1643 case IrOpcode::kFloat64Log2:
1644 case IrOpcode::kFloat64Pow:
1645 case IrOpcode::kFloat64Sin:
1646 case IrOpcode::kFloat64Sinh:
1647 case IrOpcode::kFloat64Sqrt:
1648 case IrOpcode::kFloat64Tan:
1649 case IrOpcode::kFloat64Tanh:
1650 case IrOpcode::kFloat32RoundDown:
1651 case IrOpcode::kFloat64RoundDown:
1652 case IrOpcode::kFloat32RoundUp:
1653 case IrOpcode::kFloat64RoundUp:
1654 case IrOpcode::kFloat32RoundTruncate:
1655 case IrOpcode::kFloat64RoundTruncate:
1656 case IrOpcode::kFloat64RoundTiesAway:
1657 case IrOpcode::kFloat32RoundTiesEven:
1658 case IrOpcode::kFloat64RoundTiesEven:
1659 case IrOpcode::kFloat64Equal:
1660 case IrOpcode::kFloat64LessThan:
1661 case IrOpcode::kFloat64LessThanOrEqual:
1662 case IrOpcode::kTruncateInt64ToInt32:
1663 case IrOpcode::kRoundFloat64ToInt32:
1664 case IrOpcode::kRoundInt32ToFloat32:
1665 case IrOpcode::kRoundInt64ToFloat32:
1666 case IrOpcode::kRoundInt64ToFloat64:
1667 case IrOpcode::kRoundUint32ToFloat32:
1668 case IrOpcode::kRoundUint64ToFloat64:
1669 case IrOpcode::kRoundUint64ToFloat32:
1670 case IrOpcode::kTruncateFloat64ToFloat32:
1671 case IrOpcode::kTruncateFloat64ToWord32:
1672 case IrOpcode::kBitcastFloat32ToInt32:
1673 case IrOpcode::kBitcastFloat64ToInt64:
1674 case IrOpcode::kBitcastInt32ToFloat32:
1675 case IrOpcode::kBitcastInt64ToFloat64:
1676 case IrOpcode::kBitcastTaggedToWord:
1677 case IrOpcode::kBitcastWordToTagged:
1678 case IrOpcode::kBitcastWordToTaggedSigned:
1679 case IrOpcode::kChangeInt32ToInt64:
1680 case IrOpcode::kChangeUint32ToUint64:
1681 case IrOpcode::kChangeInt32ToFloat64:
1682 case IrOpcode::kChangeUint32ToFloat64:
1683 case IrOpcode::kChangeFloat32ToFloat64:
1684 case IrOpcode::kChangeFloat64ToInt32:
1685 case IrOpcode::kChangeFloat64ToUint32:
1686 case IrOpcode::kChangeFloat64ToUint64:
1687 case IrOpcode::kFloat64SilenceNaN:
1688 case IrOpcode::kTruncateFloat64ToUint32:
1689 case IrOpcode::kTruncateFloat32ToInt32:
1690 case IrOpcode::kTruncateFloat32ToUint32:
1691 case IrOpcode::kTryTruncateFloat32ToInt64:
1692 case IrOpcode::kTryTruncateFloat64ToInt64:
1693 case IrOpcode::kTryTruncateFloat32ToUint64:
1694 case IrOpcode::kTryTruncateFloat64ToUint64:
1695 case IrOpcode::kFloat64ExtractLowWord32:
1696 case IrOpcode::kFloat64ExtractHighWord32:
1697 case IrOpcode::kFloat64InsertLowWord32:
1698 case IrOpcode::kFloat64InsertHighWord32:
1699 case IrOpcode::kInt32PairAdd:
1700 case IrOpcode::kInt32PairSub:
1701 case IrOpcode::kInt32PairMul:
1702 case IrOpcode::kWord32PairShl:
1703 case IrOpcode::kWord32PairShr:
1704 case IrOpcode::kWord32PairSar:
1705 case IrOpcode::kTaggedPoisonOnSpeculation:
1706 case IrOpcode::kWord32PoisonOnSpeculation:
1707 case IrOpcode::kWord64PoisonOnSpeculation:
1708 case IrOpcode::kLoadStackPointer:
1709 case IrOpcode::kLoadFramePointer:
1710 case IrOpcode::kLoadParentFramePointer:
1711 case IrOpcode::kLoadRootsPointer:
1712 case IrOpcode::kUnalignedLoad:
1713 case IrOpcode::kUnalignedStore:
1714 case IrOpcode::kWord32AtomicLoad:
1715 case IrOpcode::kWord32AtomicStore:
1716 case IrOpcode::kWord32AtomicExchange:
1717 case IrOpcode::kWord32AtomicCompareExchange:
1718 case IrOpcode::kWord32AtomicAdd:
1719 case IrOpcode::kWord32AtomicSub:
1720 case IrOpcode::kWord32AtomicAnd:
1721 case IrOpcode::kWord32AtomicOr:
1722 case IrOpcode::kWord32AtomicXor:
1723 case IrOpcode::kWord64AtomicLoad:
1724 case IrOpcode::kWord64AtomicStore:
1725 case IrOpcode::kWord64AtomicAdd:
1726 case IrOpcode::kWord64AtomicSub:
1727 case IrOpcode::kWord64AtomicAnd:
1728 case IrOpcode::kWord64AtomicOr:
1729 case IrOpcode::kWord64AtomicXor:
1730 case IrOpcode::kWord64AtomicExchange:
1731 case IrOpcode::kWord64AtomicCompareExchange:
1732 case IrOpcode::kSpeculationFence:
1733 case IrOpcode::kSignExtendWord8ToInt32:
1734 case IrOpcode::kSignExtendWord16ToInt32:
1735 case IrOpcode::kSignExtendWord8ToInt64:
1736 case IrOpcode::kSignExtendWord16ToInt64:
1737 case IrOpcode::kSignExtendWord32ToInt64:
1738
1739 #define SIMD_MACHINE_OP_CASE(Name) case IrOpcode::k##Name:
1740 MACHINE_SIMD_OP_LIST(SIMD_MACHINE_OP_CASE)
1741 #undef SIMD_MACHINE_OP_CASE
1742
1743 // TODO(rossberg): Check.
1744 break;
1745 }
1746 } // NOLINT(readability/fn_size)
1747
Run(Graph * graph,Typing typing,CheckInputs check_inputs,CodeType code_type)1748 void Verifier::Run(Graph* graph, Typing typing, CheckInputs check_inputs,
1749 CodeType code_type) {
1750 CHECK_NOT_NULL(graph->start());
1751 CHECK_NOT_NULL(graph->end());
1752 Zone zone(graph->zone()->allocator(), ZONE_NAME);
1753 Visitor visitor(&zone, typing, check_inputs, code_type);
1754 AllNodes all(&zone, graph);
1755 for (Node* node : all.reachable) visitor.Check(node, all);
1756
1757 // Check the uniqueness of projections.
1758 for (Node* proj : all.reachable) {
1759 if (proj->opcode() != IrOpcode::kProjection) continue;
1760 Node* node = proj->InputAt(0);
1761 for (Node* other : node->uses()) {
1762 if (all.IsLive(other) && other != proj &&
1763 other->opcode() == IrOpcode::kProjection &&
1764 other->InputAt(0) == node &&
1765 ProjectionIndexOf(other->op()) == ProjectionIndexOf(proj->op())) {
1766 FATAL("Node #%d:%s has duplicate projections #%d and #%d", node->id(),
1767 node->op()->mnemonic(), proj->id(), other->id());
1768 }
1769 }
1770 }
1771 }
1772
1773
1774 // -----------------------------------------------------------------------------
1775
HasDominatingDef(Schedule * schedule,Node * node,BasicBlock * container,BasicBlock * use_block,int use_pos)1776 static bool HasDominatingDef(Schedule* schedule, Node* node,
1777 BasicBlock* container, BasicBlock* use_block,
1778 int use_pos) {
1779 BasicBlock* block = use_block;
1780 while (true) {
1781 while (use_pos >= 0) {
1782 if (block->NodeAt(use_pos) == node) return true;
1783 use_pos--;
1784 }
1785 block = block->dominator();
1786 if (block == nullptr) break;
1787 use_pos = static_cast<int>(block->NodeCount()) - 1;
1788 if (node == block->control_input()) return true;
1789 }
1790 return false;
1791 }
1792
1793
Dominates(Schedule * schedule,Node * dominator,Node * dominatee)1794 static bool Dominates(Schedule* schedule, Node* dominator, Node* dominatee) {
1795 BasicBlock* dom = schedule->block(dominator);
1796 BasicBlock* sub = schedule->block(dominatee);
1797 while (sub != nullptr) {
1798 if (sub == dom) {
1799 return true;
1800 }
1801 sub = sub->dominator();
1802 }
1803 return false;
1804 }
1805
1806
CheckInputsDominate(Schedule * schedule,BasicBlock * block,Node * node,int use_pos)1807 static void CheckInputsDominate(Schedule* schedule, BasicBlock* block,
1808 Node* node, int use_pos) {
1809 for (int j = node->op()->ValueInputCount() - 1; j >= 0; j--) {
1810 BasicBlock* use_block = block;
1811 if (node->opcode() == IrOpcode::kPhi) {
1812 use_block = use_block->PredecessorAt(j);
1813 use_pos = static_cast<int>(use_block->NodeCount()) - 1;
1814 }
1815 Node* input = node->InputAt(j);
1816 if (!HasDominatingDef(schedule, node->InputAt(j), block, use_block,
1817 use_pos)) {
1818 FATAL("Node #%d:%s in B%d is not dominated by input@%d #%d:%s",
1819 node->id(), node->op()->mnemonic(), block->rpo_number(), j,
1820 input->id(), input->op()->mnemonic());
1821 }
1822 }
1823 // Ensure that nodes are dominated by their control inputs;
1824 // kEnd is an exception, as unreachable blocks resulting from kMerge
1825 // are not in the RPO.
1826 if (node->op()->ControlInputCount() == 1 &&
1827 node->opcode() != IrOpcode::kEnd) {
1828 Node* ctl = NodeProperties::GetControlInput(node);
1829 if (!Dominates(schedule, ctl, node)) {
1830 FATAL("Node #%d:%s in B%d is not dominated by control input #%d:%s",
1831 node->id(), node->op()->mnemonic(), block->rpo_number(), ctl->id(),
1832 ctl->op()->mnemonic());
1833 }
1834 }
1835 }
1836
1837
Run(Schedule * schedule)1838 void ScheduleVerifier::Run(Schedule* schedule) {
1839 const size_t count = schedule->BasicBlockCount();
1840 Zone tmp_zone(schedule->zone()->allocator(), ZONE_NAME);
1841 Zone* zone = &tmp_zone;
1842 BasicBlock* start = schedule->start();
1843 BasicBlockVector* rpo_order = schedule->rpo_order();
1844
1845 // Verify the RPO order contains only blocks from this schedule.
1846 CHECK_GE(count, rpo_order->size());
1847 for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1848 ++b) {
1849 CHECK_EQ((*b), schedule->GetBlockById((*b)->id()));
1850 // All predecessors and successors should be in rpo and in this schedule.
1851 for (BasicBlock const* predecessor : (*b)->predecessors()) {
1852 CHECK_GE(predecessor->rpo_number(), 0);
1853 CHECK_EQ(predecessor, schedule->GetBlockById(predecessor->id()));
1854 }
1855 for (BasicBlock const* successor : (*b)->successors()) {
1856 CHECK_GE(successor->rpo_number(), 0);
1857 CHECK_EQ(successor, schedule->GetBlockById(successor->id()));
1858 }
1859 }
1860
1861 // Verify RPO numbers of blocks.
1862 CHECK_EQ(start, rpo_order->at(0)); // Start should be first.
1863 for (size_t b = 0; b < rpo_order->size(); b++) {
1864 BasicBlock* block = rpo_order->at(b);
1865 CHECK_EQ(static_cast<int>(b), block->rpo_number());
1866 BasicBlock* dom = block->dominator();
1867 if (b == 0) {
1868 // All blocks except start should have a dominator.
1869 CHECK_NULL(dom);
1870 } else {
1871 // Check that the immediate dominator appears somewhere before the block.
1872 CHECK_NOT_NULL(dom);
1873 CHECK_LT(dom->rpo_number(), block->rpo_number());
1874 }
1875 }
1876
1877 // Verify that all blocks reachable from start are in the RPO.
1878 BoolVector marked(static_cast<int>(count), false, zone);
1879 {
1880 ZoneQueue<BasicBlock*> queue(zone);
1881 queue.push(start);
1882 marked[start->id().ToSize()] = true;
1883 while (!queue.empty()) {
1884 BasicBlock* block = queue.front();
1885 queue.pop();
1886 for (size_t s = 0; s < block->SuccessorCount(); s++) {
1887 BasicBlock* succ = block->SuccessorAt(s);
1888 if (!marked[succ->id().ToSize()]) {
1889 marked[succ->id().ToSize()] = true;
1890 queue.push(succ);
1891 }
1892 }
1893 }
1894 }
1895 // Verify marked blocks are in the RPO.
1896 for (size_t i = 0; i < count; i++) {
1897 BasicBlock* block = schedule->GetBlockById(BasicBlock::Id::FromSize(i));
1898 if (marked[i]) {
1899 CHECK_GE(block->rpo_number(), 0);
1900 CHECK_EQ(block, rpo_order->at(block->rpo_number()));
1901 }
1902 }
1903 // Verify RPO blocks are marked.
1904 for (size_t b = 0; b < rpo_order->size(); b++) {
1905 CHECK(marked[rpo_order->at(b)->id().ToSize()]);
1906 }
1907
1908 {
1909 // Verify the dominance relation.
1910 ZoneVector<BitVector*> dominators(zone);
1911 dominators.resize(count, nullptr);
1912
1913 // Compute a set of all the nodes that dominate a given node by using
1914 // a forward fixpoint. O(n^2).
1915 ZoneQueue<BasicBlock*> queue(zone);
1916 queue.push(start);
1917 dominators[start->id().ToSize()] =
1918 new (zone) BitVector(static_cast<int>(count), zone);
1919 while (!queue.empty()) {
1920 BasicBlock* block = queue.front();
1921 queue.pop();
1922 BitVector* block_doms = dominators[block->id().ToSize()];
1923 BasicBlock* idom = block->dominator();
1924 if (idom != nullptr && !block_doms->Contains(idom->id().ToInt())) {
1925 FATAL("Block B%d is not dominated by B%d", block->rpo_number(),
1926 idom->rpo_number());
1927 }
1928 for (size_t s = 0; s < block->SuccessorCount(); s++) {
1929 BasicBlock* succ = block->SuccessorAt(s);
1930 BitVector* succ_doms = dominators[succ->id().ToSize()];
1931
1932 if (succ_doms == nullptr) {
1933 // First time visiting the node. S.doms = B U B.doms
1934 succ_doms = new (zone) BitVector(static_cast<int>(count), zone);
1935 succ_doms->CopyFrom(*block_doms);
1936 succ_doms->Add(block->id().ToInt());
1937 dominators[succ->id().ToSize()] = succ_doms;
1938 queue.push(succ);
1939 } else {
1940 // Nth time visiting the successor. S.doms = S.doms ^ (B U B.doms)
1941 bool had = succ_doms->Contains(block->id().ToInt());
1942 if (had) succ_doms->Remove(block->id().ToInt());
1943 if (succ_doms->IntersectIsChanged(*block_doms)) queue.push(succ);
1944 if (had) succ_doms->Add(block->id().ToInt());
1945 }
1946 }
1947 }
1948
1949 // Verify the immediateness of dominators.
1950 for (BasicBlockVector::iterator b = rpo_order->begin();
1951 b != rpo_order->end(); ++b) {
1952 BasicBlock* block = *b;
1953 BasicBlock* idom = block->dominator();
1954 if (idom == nullptr) continue;
1955 BitVector* block_doms = dominators[block->id().ToSize()];
1956
1957 for (BitVector::Iterator it(block_doms); !it.Done(); it.Advance()) {
1958 BasicBlock* dom =
1959 schedule->GetBlockById(BasicBlock::Id::FromInt(it.Current()));
1960 if (dom != idom &&
1961 !dominators[idom->id().ToSize()]->Contains(dom->id().ToInt())) {
1962 FATAL("Block B%d is not immediately dominated by B%d",
1963 block->rpo_number(), idom->rpo_number());
1964 }
1965 }
1966 }
1967 }
1968
1969 // Verify phis are placed in the block of their control input.
1970 for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1971 ++b) {
1972 for (BasicBlock::const_iterator i = (*b)->begin(); i != (*b)->end(); ++i) {
1973 Node* phi = *i;
1974 if (phi->opcode() != IrOpcode::kPhi) continue;
1975 // TODO(titzer): Nasty special case. Phis from RawMachineAssembler
1976 // schedules don't have control inputs.
1977 if (phi->InputCount() > phi->op()->ValueInputCount()) {
1978 Node* control = NodeProperties::GetControlInput(phi);
1979 CHECK(control->opcode() == IrOpcode::kMerge ||
1980 control->opcode() == IrOpcode::kLoop);
1981 CHECK_EQ((*b), schedule->block(control));
1982 }
1983 }
1984 }
1985
1986 // Verify that all uses are dominated by their definitions.
1987 for (BasicBlockVector::iterator b = rpo_order->begin(); b != rpo_order->end();
1988 ++b) {
1989 BasicBlock* block = *b;
1990
1991 // Check inputs to control for this block.
1992 Node* control = block->control_input();
1993 if (control != nullptr) {
1994 CHECK_EQ(block, schedule->block(control));
1995 CheckInputsDominate(schedule, block, control,
1996 static_cast<int>(block->NodeCount()) - 1);
1997 }
1998 // Check inputs for all nodes in the block.
1999 for (size_t i = 0; i < block->NodeCount(); i++) {
2000 Node* node = block->NodeAt(i);
2001 CheckInputsDominate(schedule, block, node, static_cast<int>(i) - 1);
2002 }
2003 }
2004 }
2005
2006
2007 #ifdef DEBUG
2008
2009 // static
VerifyNode(Node * node)2010 void Verifier::VerifyNode(Node* node) {
2011 DCHECK_EQ(OperatorProperties::GetTotalInputCount(node->op()),
2012 node->InputCount());
2013 // If this node has no effect or no control outputs,
2014 // we check that none of its uses are effect or control inputs.
2015 bool check_no_control = node->op()->ControlOutputCount() == 0;
2016 bool check_no_effect = node->op()->EffectOutputCount() == 0;
2017 bool check_no_frame_state = node->opcode() != IrOpcode::kFrameState;
2018 int effect_edges = 0;
2019 if (check_no_effect || check_no_control) {
2020 for (Edge edge : node->use_edges()) {
2021 Node* const user = edge.from();
2022 DCHECK(!user->IsDead());
2023 if (NodeProperties::IsControlEdge(edge)) {
2024 DCHECK(!check_no_control);
2025 } else if (NodeProperties::IsEffectEdge(edge)) {
2026 DCHECK(!check_no_effect);
2027 effect_edges++;
2028 } else if (NodeProperties::IsFrameStateEdge(edge)) {
2029 DCHECK(!check_no_frame_state);
2030 }
2031 }
2032 }
2033
2034 // Frame state input should be a frame state (or sentinel).
2035 if (OperatorProperties::GetFrameStateInputCount(node->op()) > 0) {
2036 Node* input = NodeProperties::GetFrameStateInput(node);
2037 DCHECK(input->opcode() == IrOpcode::kFrameState ||
2038 input->opcode() == IrOpcode::kStart ||
2039 input->opcode() == IrOpcode::kDead ||
2040 input->opcode() == IrOpcode::kDeadValue);
2041 }
2042 // Effect inputs should be effect-producing nodes (or sentinels).
2043 for (int i = 0; i < node->op()->EffectInputCount(); i++) {
2044 Node* input = NodeProperties::GetEffectInput(node, i);
2045 DCHECK(input->op()->EffectOutputCount() > 0 ||
2046 input->opcode() == IrOpcode::kDead);
2047 }
2048 // Control inputs should be control-producing nodes (or sentinels).
2049 for (int i = 0; i < node->op()->ControlInputCount(); i++) {
2050 Node* input = NodeProperties::GetControlInput(node, i);
2051 DCHECK(input->op()->ControlOutputCount() > 0 ||
2052 input->opcode() == IrOpcode::kDead);
2053 }
2054 }
2055
2056
VerifyEdgeInputReplacement(const Edge & edge,const Node * replacement)2057 void Verifier::VerifyEdgeInputReplacement(const Edge& edge,
2058 const Node* replacement) {
2059 // Check that the user does not misuse the replacement.
2060 DCHECK(!NodeProperties::IsControlEdge(edge) ||
2061 replacement->op()->ControlOutputCount() > 0);
2062 DCHECK(!NodeProperties::IsEffectEdge(edge) ||
2063 replacement->op()->EffectOutputCount() > 0);
2064 DCHECK(!NodeProperties::IsFrameStateEdge(edge) ||
2065 replacement->opcode() == IrOpcode::kFrameState ||
2066 replacement->opcode() == IrOpcode::kDead ||
2067 replacement->opcode() == IrOpcode::kDeadValue);
2068 }
2069
2070 #endif // DEBUG
2071
2072 } // namespace compiler
2073 } // namespace internal
2074 } // namespace v8
2075