1 // Copyright 2016 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/compiler/operation-typer.h"
6
7 #include "src/compiler/common-operator.h"
8 #include "src/compiler/js-heap-broker.h"
9 #include "src/compiler/type-cache.h"
10 #include "src/compiler/types.h"
11 #include "src/execution/isolate.h"
12 #include "src/heap/factory.h"
13
14 #include "src/objects/objects-inl.h"
15
16 namespace v8 {
17 namespace internal {
18 namespace compiler {
19
OperationTyper(JSHeapBroker * broker,Zone * zone)20 OperationTyper::OperationTyper(JSHeapBroker* broker, Zone* zone)
21 : zone_(zone), cache_(TypeCache::Get()) {
22 Factory* factory = broker->isolate()->factory();
23 infinity_ = Type::Constant(V8_INFINITY, zone);
24 minus_infinity_ = Type::Constant(-V8_INFINITY, zone);
25 Type truncating_to_zero = Type::MinusZeroOrNaN();
26 DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
27
28 singleton_empty_string_ =
29 Type::Constant(broker, factory->empty_string(), zone);
30 singleton_NaN_string_ = Type::Constant(broker, factory->NaN_string(), zone);
31 singleton_zero_string_ = Type::Constant(broker, factory->zero_string(), zone);
32 singleton_false_ = Type::Constant(broker, factory->false_value(), zone);
33 singleton_true_ = Type::Constant(broker, factory->true_value(), zone);
34 singleton_the_hole_ = Type::Hole();
35 signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
36 unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
37
38 falsish_ = Type::Union(
39 Type::Undetectable(),
40 Type::Union(Type::Union(singleton_false_, cache_->kZeroish, zone),
41 Type::Union(singleton_empty_string_, Type::Hole(), zone),
42 zone),
43 zone);
44 truish_ = Type::Union(
45 singleton_true_,
46 Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
47 }
48
Merge(Type left,Type right)49 Type OperationTyper::Merge(Type left, Type right) {
50 return Type::Union(left, right, zone());
51 }
52
WeakenRange(Type previous_range,Type current_range)53 Type OperationTyper::WeakenRange(Type previous_range, Type current_range) {
54 static const double kWeakenMinLimits[] = {0.0,
55 -1073741824.0,
56 -2147483648.0,
57 -4294967296.0,
58 -8589934592.0,
59 -17179869184.0,
60 -34359738368.0,
61 -68719476736.0,
62 -137438953472.0,
63 -274877906944.0,
64 -549755813888.0,
65 -1099511627776.0,
66 -2199023255552.0,
67 -4398046511104.0,
68 -8796093022208.0,
69 -17592186044416.0,
70 -35184372088832.0,
71 -70368744177664.0,
72 -140737488355328.0,
73 -281474976710656.0,
74 -562949953421312.0};
75 static const double kWeakenMaxLimits[] = {0.0,
76 1073741823.0,
77 2147483647.0,
78 4294967295.0,
79 8589934591.0,
80 17179869183.0,
81 34359738367.0,
82 68719476735.0,
83 137438953471.0,
84 274877906943.0,
85 549755813887.0,
86 1099511627775.0,
87 2199023255551.0,
88 4398046511103.0,
89 8796093022207.0,
90 17592186044415.0,
91 35184372088831.0,
92 70368744177663.0,
93 140737488355327.0,
94 281474976710655.0,
95 562949953421311.0};
96 STATIC_ASSERT(arraysize(kWeakenMinLimits) == arraysize(kWeakenMaxLimits));
97
98 double current_min = current_range.Min();
99 double new_min = current_min;
100 // Find the closest lower entry in the list of allowed
101 // minima (or negative infinity if there is no such entry).
102 if (current_min != previous_range.Min()) {
103 new_min = -V8_INFINITY;
104 for (double const min : kWeakenMinLimits) {
105 if (min <= current_min) {
106 new_min = min;
107 break;
108 }
109 }
110 }
111
112 double current_max = current_range.Max();
113 double new_max = current_max;
114 // Find the closest greater entry in the list of allowed
115 // maxima (or infinity if there is no such entry).
116 if (current_max != previous_range.Max()) {
117 new_max = V8_INFINITY;
118 for (double const max : kWeakenMaxLimits) {
119 if (max >= current_max) {
120 new_max = max;
121 break;
122 }
123 }
124 }
125
126 return Type::Range(new_min, new_max, zone());
127 }
128
Rangify(Type type)129 Type OperationTyper::Rangify(Type type) {
130 if (type.IsRange()) return type; // Shortcut.
131 if (!type.Is(cache_->kInteger)) {
132 return type; // Give up on non-integer types.
133 }
134 return Type::Range(type.Min(), type.Max(), zone());
135 }
136
137 namespace {
138
139 // Returns the array's least element, ignoring NaN.
140 // There must be at least one non-NaN element.
141 // Any -0 is converted to 0.
array_min(double a[],size_t n)142 double array_min(double a[], size_t n) {
143 DCHECK_NE(0, n);
144 double x = +V8_INFINITY;
145 for (size_t i = 0; i < n; ++i) {
146 if (!std::isnan(a[i])) {
147 x = std::min(a[i], x);
148 }
149 }
150 DCHECK(!std::isnan(x));
151 return x == 0 ? 0 : x; // -0 -> 0
152 }
153
154 // Returns the array's greatest element, ignoring NaN.
155 // There must be at least one non-NaN element.
156 // Any -0 is converted to 0.
array_max(double a[],size_t n)157 double array_max(double a[], size_t n) {
158 DCHECK_NE(0, n);
159 double x = -V8_INFINITY;
160 for (size_t i = 0; i < n; ++i) {
161 if (!std::isnan(a[i])) {
162 x = std::max(a[i], x);
163 }
164 }
165 DCHECK(!std::isnan(x));
166 return x == 0 ? 0 : x; // -0 -> 0
167 }
168
169 } // namespace
170
AddRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)171 Type OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
172 double rhs_max) {
173 double results[4];
174 results[0] = lhs_min + rhs_min;
175 results[1] = lhs_min + rhs_max;
176 results[2] = lhs_max + rhs_min;
177 results[3] = lhs_max + rhs_max;
178 // Since none of the inputs can be -0, the result cannot be -0 either.
179 // However, it can be nan (the sum of two infinities of opposite sign).
180 // On the other hand, if none of the "results" above is nan, then the
181 // actual result cannot be nan either.
182 int nans = 0;
183 for (int i = 0; i < 4; ++i) {
184 if (std::isnan(results[i])) ++nans;
185 }
186 if (nans == 4) return Type::NaN();
187 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
188 if (nans > 0) type = Type::Union(type, Type::NaN(), zone());
189 // Examples:
190 // [-inf, -inf] + [+inf, +inf] = NaN
191 // [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
192 // [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
193 // [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
194 return type;
195 }
196
SubtractRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)197 Type OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
198 double rhs_min, double rhs_max) {
199 double results[4];
200 results[0] = lhs_min - rhs_min;
201 results[1] = lhs_min - rhs_max;
202 results[2] = lhs_max - rhs_min;
203 results[3] = lhs_max - rhs_max;
204 // Since none of the inputs can be -0, the result cannot be -0.
205 // However, it can be nan (the subtraction of two infinities of same sign).
206 // On the other hand, if none of the "results" above is nan, then the actual
207 // result cannot be nan either.
208 int nans = 0;
209 for (int i = 0; i < 4; ++i) {
210 if (std::isnan(results[i])) ++nans;
211 }
212 if (nans == 4) return Type::NaN(); // [inf..inf] - [inf..inf] (all same sign)
213 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
214 return nans == 0 ? type : Type::Union(type, Type::NaN(), zone());
215 // Examples:
216 // [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
217 // [-inf, -inf] - [-inf, -inf] = NaN
218 // [-inf, -inf] - [n, +inf] = [-inf, -inf] \/ NaN
219 // [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
220 }
221
MultiplyRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)222 Type OperationTyper::MultiplyRanger(double lhs_min, double lhs_max,
223 double rhs_min, double rhs_max) {
224 double results[4];
225 results[0] = lhs_min * rhs_min;
226 results[1] = lhs_min * rhs_max;
227 results[2] = lhs_max * rhs_min;
228 results[3] = lhs_max * rhs_max;
229 // If the result may be nan, we give up on calculating a precise type,
230 // because the discontinuity makes it too complicated. Note that even if
231 // none of the "results" above is nan, the actual result may still be, so we
232 // have to do a different check:
233 for (int i = 0; i < 4; ++i) {
234 if (std::isnan(results[i])) {
235 return cache_->kIntegerOrMinusZeroOrNaN;
236 }
237 }
238 double min = array_min(results, 4);
239 double max = array_max(results, 4);
240 Type type = Type::Range(min, max, zone());
241 if (min <= 0.0 && 0.0 <= max && (lhs_min < 0.0 || rhs_min < 0.0)) {
242 type = Type::Union(type, Type::MinusZero(), zone());
243 }
244 // 0 * V8_INFINITY is NaN, regardless of sign
245 if (((lhs_min == -V8_INFINITY || lhs_max == V8_INFINITY) &&
246 (rhs_min <= 0.0 && 0.0 <= rhs_max)) ||
247 ((rhs_min == -V8_INFINITY || rhs_max == V8_INFINITY) &&
248 (lhs_min <= 0.0 && 0.0 <= lhs_max))) {
249 type = Type::Union(type, Type::NaN(), zone());
250 }
251 return type;
252 }
253
ConvertReceiver(Type type)254 Type OperationTyper::ConvertReceiver(Type type) {
255 if (type.Is(Type::Receiver())) return type;
256 bool const maybe_primitive = type.Maybe(Type::Primitive());
257 type = Type::Intersect(type, Type::Receiver(), zone());
258 if (maybe_primitive) {
259 // ConvertReceiver maps null and undefined to the JSGlobalProxy of the
260 // target function, and all other primitives are wrapped into a
261 // JSPrimitiveWrapper.
262 type = Type::Union(type, Type::OtherObject(), zone());
263 }
264 return type;
265 }
266
ToNumber(Type type)267 Type OperationTyper::ToNumber(Type type) {
268 if (type.Is(Type::Number())) return type;
269
270 // If {type} includes any receivers, we cannot tell what kind of
271 // Number their callbacks might produce. Similarly in the case
272 // where {type} includes String, it's not possible at this point
273 // to tell which exact numbers are going to be produced.
274 if (type.Maybe(Type::StringOrReceiver())) return Type::Number();
275
276 // Both Symbol and BigInt primitives will cause exceptions
277 // to be thrown from ToNumber conversions, so they don't
278 // contribute to the resulting type anyways.
279 type = Type::Intersect(type, Type::PlainPrimitive(), zone());
280
281 // This leaves us with Number\/Oddball, so deal with the individual
282 // Oddball primitives below.
283 DCHECK(type.Is(Type::NumberOrOddball()));
284 if (type.Maybe(Type::Null())) {
285 // ToNumber(null) => +0
286 type = Type::Union(type, cache_->kSingletonZero, zone());
287 }
288 if (type.Maybe(Type::Undefined())) {
289 // ToNumber(undefined) => NaN
290 type = Type::Union(type, Type::NaN(), zone());
291 }
292 if (type.Maybe(singleton_false_)) {
293 // ToNumber(false) => +0
294 type = Type::Union(type, cache_->kSingletonZero, zone());
295 }
296 if (type.Maybe(singleton_true_)) {
297 // ToNumber(true) => +1
298 type = Type::Union(type, cache_->kSingletonOne, zone());
299 }
300 return Type::Intersect(type, Type::Number(), zone());
301 }
302
ToNumberConvertBigInt(Type type)303 Type OperationTyper::ToNumberConvertBigInt(Type type) {
304 // If the {type} includes any receivers, then the callbacks
305 // might actually produce BigInt primitive values here.
306 bool maybe_bigint =
307 type.Maybe(Type::BigInt()) || type.Maybe(Type::Receiver());
308 type = ToNumber(Type::Intersect(type, Type::NonBigInt(), zone()));
309
310 // Any BigInt is rounded to an integer Number in the range [-inf, inf].
311 return maybe_bigint ? Type::Union(type, cache_->kInteger, zone()) : type;
312 }
313
ToNumeric(Type type)314 Type OperationTyper::ToNumeric(Type type) {
315 // If the {type} includes any receivers, then the callbacks
316 // might actually produce BigInt primitive values here.
317 if (type.Maybe(Type::Receiver())) {
318 type = Type::Union(type, Type::BigInt(), zone());
319 }
320 return Type::Union(ToNumber(Type::Intersect(type, Type::NonBigInt(), zone())),
321 Type::Intersect(type, Type::BigInt(), zone()), zone());
322 }
323
NumberAbs(Type type)324 Type OperationTyper::NumberAbs(Type type) {
325 DCHECK(type.Is(Type::Number()));
326 if (type.IsNone()) return type;
327
328 bool const maybe_nan = type.Maybe(Type::NaN());
329 bool const maybe_minuszero = type.Maybe(Type::MinusZero());
330
331 type = Type::Intersect(type, Type::PlainNumber(), zone());
332 if (!type.IsNone()) {
333 double const max = type.Max();
334 double const min = type.Min();
335 if (min < 0) {
336 if (type.Is(cache_->kInteger)) {
337 type =
338 Type::Range(0.0, std::max(std::fabs(min), std::fabs(max)), zone());
339 } else {
340 type = Type::PlainNumber();
341 }
342 }
343 }
344
345 if (maybe_minuszero) {
346 type = Type::Union(type, cache_->kSingletonZero, zone());
347 }
348 if (maybe_nan) {
349 type = Type::Union(type, Type::NaN(), zone());
350 }
351 return type;
352 }
353
NumberAcos(Type type)354 Type OperationTyper::NumberAcos(Type type) {
355 DCHECK(type.Is(Type::Number()));
356 return Type::Number();
357 }
358
NumberAcosh(Type type)359 Type OperationTyper::NumberAcosh(Type type) {
360 DCHECK(type.Is(Type::Number()));
361 return Type::Number();
362 }
363
NumberAsin(Type type)364 Type OperationTyper::NumberAsin(Type type) {
365 DCHECK(type.Is(Type::Number()));
366 return Type::Number();
367 }
368
NumberAsinh(Type type)369 Type OperationTyper::NumberAsinh(Type type) {
370 DCHECK(type.Is(Type::Number()));
371 return Type::Number();
372 }
373
NumberAtan(Type type)374 Type OperationTyper::NumberAtan(Type type) {
375 DCHECK(type.Is(Type::Number()));
376 return Type::Number();
377 }
378
NumberAtanh(Type type)379 Type OperationTyper::NumberAtanh(Type type) {
380 DCHECK(type.Is(Type::Number()));
381 return Type::Number();
382 }
383
NumberCbrt(Type type)384 Type OperationTyper::NumberCbrt(Type type) {
385 DCHECK(type.Is(Type::Number()));
386 return Type::Number();
387 }
388
NumberCeil(Type type)389 Type OperationTyper::NumberCeil(Type type) {
390 DCHECK(type.Is(Type::Number()));
391 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
392 type = Type::Intersect(type, Type::NaN(), zone());
393 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
394 return type;
395 }
396
NumberClz32(Type type)397 Type OperationTyper::NumberClz32(Type type) {
398 DCHECK(type.Is(Type::Number()));
399 return cache_->kZeroToThirtyTwo;
400 }
401
NumberCos(Type type)402 Type OperationTyper::NumberCos(Type type) {
403 DCHECK(type.Is(Type::Number()));
404 return Type::Number();
405 }
406
NumberCosh(Type type)407 Type OperationTyper::NumberCosh(Type type) {
408 DCHECK(type.Is(Type::Number()));
409 return Type::Number();
410 }
411
NumberExp(Type type)412 Type OperationTyper::NumberExp(Type type) {
413 DCHECK(type.Is(Type::Number()));
414 return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
415 }
416
NumberExpm1(Type type)417 Type OperationTyper::NumberExpm1(Type type) {
418 DCHECK(type.Is(Type::Number()));
419 return Type::Number();
420 }
421
NumberFloor(Type type)422 Type OperationTyper::NumberFloor(Type type) {
423 DCHECK(type.Is(Type::Number()));
424 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
425 type = Type::Intersect(type, Type::MinusZeroOrNaN(), zone());
426 type = Type::Union(type, cache_->kInteger, zone());
427 return type;
428 }
429
NumberFround(Type type)430 Type OperationTyper::NumberFround(Type type) {
431 DCHECK(type.Is(Type::Number()));
432 return Type::Number();
433 }
434
NumberLog(Type type)435 Type OperationTyper::NumberLog(Type type) {
436 DCHECK(type.Is(Type::Number()));
437 return Type::Number();
438 }
439
NumberLog1p(Type type)440 Type OperationTyper::NumberLog1p(Type type) {
441 DCHECK(type.Is(Type::Number()));
442 return Type::Number();
443 }
444
NumberLog2(Type type)445 Type OperationTyper::NumberLog2(Type type) {
446 DCHECK(type.Is(Type::Number()));
447 return Type::Number();
448 }
449
NumberLog10(Type type)450 Type OperationTyper::NumberLog10(Type type) {
451 DCHECK(type.Is(Type::Number()));
452 return Type::Number();
453 }
454
NumberRound(Type type)455 Type OperationTyper::NumberRound(Type type) {
456 DCHECK(type.Is(Type::Number()));
457 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
458 type = Type::Intersect(type, Type::NaN(), zone());
459 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
460 return type;
461 }
462
NumberSign(Type type)463 Type OperationTyper::NumberSign(Type type) {
464 DCHECK(type.Is(Type::Number()));
465 if (type.Is(cache_->kZeroish)) return type;
466 bool maybe_minuszero = type.Maybe(Type::MinusZero());
467 bool maybe_nan = type.Maybe(Type::NaN());
468 type = Type::Intersect(type, Type::PlainNumber(), zone());
469 if (type.IsNone()) {
470 // Do nothing.
471 } else if (type.Max() < 0.0) {
472 type = cache_->kSingletonMinusOne;
473 } else if (type.Max() <= 0.0) {
474 type = cache_->kMinusOneOrZero;
475 } else if (type.Min() > 0.0) {
476 type = cache_->kSingletonOne;
477 } else if (type.Min() >= 0.0) {
478 type = cache_->kZeroOrOne;
479 } else {
480 type = Type::Range(-1.0, 1.0, zone());
481 }
482 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
483 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
484 DCHECK(!type.IsNone());
485 return type;
486 }
487
NumberSin(Type type)488 Type OperationTyper::NumberSin(Type type) {
489 DCHECK(type.Is(Type::Number()));
490 return Type::Number();
491 }
492
NumberSinh(Type type)493 Type OperationTyper::NumberSinh(Type type) {
494 DCHECK(type.Is(Type::Number()));
495 return Type::Number();
496 }
497
NumberSqrt(Type type)498 Type OperationTyper::NumberSqrt(Type type) {
499 DCHECK(type.Is(Type::Number()));
500 return Type::Number();
501 }
502
NumberTan(Type type)503 Type OperationTyper::NumberTan(Type type) {
504 DCHECK(type.Is(Type::Number()));
505 return Type::Number();
506 }
507
NumberTanh(Type type)508 Type OperationTyper::NumberTanh(Type type) {
509 DCHECK(type.Is(Type::Number()));
510 return Type::Number();
511 }
512
NumberTrunc(Type type)513 Type OperationTyper::NumberTrunc(Type type) {
514 DCHECK(type.Is(Type::Number()));
515 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
516 type = Type::Intersect(type, Type::NaN(), zone());
517 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
518 return type;
519 }
520
NumberToBoolean(Type type)521 Type OperationTyper::NumberToBoolean(Type type) {
522 DCHECK(type.Is(Type::Number()));
523 if (type.IsNone()) return type;
524 if (type.Is(cache_->kZeroish)) return singleton_false_;
525 if (type.Is(Type::PlainNumber()) && (type.Max() < 0 || 0 < type.Min())) {
526 return singleton_true_; // Ruled out nan, -0 and +0.
527 }
528 return Type::Boolean();
529 }
530
NumberToInt32(Type type)531 Type OperationTyper::NumberToInt32(Type type) {
532 DCHECK(type.Is(Type::Number()));
533
534 if (type.Is(Type::Signed32())) return type;
535 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
536 if (type.Is(signed32ish_)) {
537 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
538 Type::Signed32(), zone());
539 }
540 return Type::Signed32();
541 }
542
NumberToString(Type type)543 Type OperationTyper::NumberToString(Type type) {
544 DCHECK(type.Is(Type::Number()));
545 if (type.IsNone()) return type;
546 if (type.Is(Type::NaN())) return singleton_NaN_string_;
547 if (type.Is(cache_->kZeroOrMinusZero)) return singleton_zero_string_;
548 return Type::String();
549 }
550
NumberToUint32(Type type)551 Type OperationTyper::NumberToUint32(Type type) {
552 DCHECK(type.Is(Type::Number()));
553
554 if (type.Is(Type::Unsigned32())) return type;
555 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
556 if (type.Is(unsigned32ish_)) {
557 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
558 Type::Unsigned32(), zone());
559 }
560 return Type::Unsigned32();
561 }
562
NumberToUint8Clamped(Type type)563 Type OperationTyper::NumberToUint8Clamped(Type type) {
564 DCHECK(type.Is(Type::Number()));
565
566 if (type.Is(cache_->kUint8)) return type;
567 return cache_->kUint8;
568 }
569
NumberSilenceNaN(Type type)570 Type OperationTyper::NumberSilenceNaN(Type type) {
571 DCHECK(type.Is(Type::Number()));
572 // TODO(jarin): This is a terrible hack; we definitely need a dedicated type
573 // for the hole (tagged and/or double). Otherwise if the input is the hole
574 // NaN constant, we'd just eliminate this node in JSTypedLowering.
575 if (type.Maybe(Type::NaN())) return Type::Number();
576 return type;
577 }
578
SpeculativeBigIntAsIntN(Type)579 Type OperationTyper::SpeculativeBigIntAsIntN(Type) {
580 return Type::SignedBigInt64();
581 }
582
SpeculativeBigIntAsUintN(Type)583 Type OperationTyper::SpeculativeBigIntAsUintN(Type) {
584 return Type::UnsignedBigInt64();
585 }
586
CheckBigInt(Type type)587 Type OperationTyper::CheckBigInt(Type type) { return Type::BigInt(); }
588
NumberAdd(Type lhs,Type rhs)589 Type OperationTyper::NumberAdd(Type lhs, Type rhs) {
590 DCHECK(lhs.Is(Type::Number()));
591 DCHECK(rhs.Is(Type::Number()));
592
593 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
594
595 // Addition can return NaN if either input can be NaN or we try to compute
596 // the sum of two infinities of opposite sign.
597 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
598
599 // Addition can yield minus zero only if both inputs can be minus zero.
600 bool maybe_minuszero = true;
601 if (lhs.Maybe(Type::MinusZero())) {
602 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
603 } else {
604 maybe_minuszero = false;
605 }
606 if (rhs.Maybe(Type::MinusZero())) {
607 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
608 } else {
609 maybe_minuszero = false;
610 }
611
612 // We can give more precise types for integers.
613 Type type = Type::None();
614 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
615 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
616 if (!lhs.IsNone() && !rhs.IsNone()) {
617 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
618 type = AddRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
619 } else {
620 if ((lhs.Maybe(minus_infinity_) && rhs.Maybe(infinity_)) ||
621 (rhs.Maybe(minus_infinity_) && lhs.Maybe(infinity_))) {
622 maybe_nan = true;
623 }
624 type = Type::PlainNumber();
625 }
626 }
627
628 // Take into account the -0 and NaN information computed earlier.
629 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
630 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
631 return type;
632 }
633
NumberSubtract(Type lhs,Type rhs)634 Type OperationTyper::NumberSubtract(Type lhs, Type rhs) {
635 DCHECK(lhs.Is(Type::Number()));
636 DCHECK(rhs.Is(Type::Number()));
637
638 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
639
640 // Subtraction can return NaN if either input can be NaN or we try to
641 // compute the sum of two infinities of opposite sign.
642 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
643
644 // Subtraction can yield minus zero if {lhs} can be minus zero and {rhs}
645 // can be zero.
646 bool maybe_minuszero = false;
647 if (lhs.Maybe(Type::MinusZero())) {
648 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
649 maybe_minuszero = rhs.Maybe(cache_->kSingletonZero);
650 }
651 if (rhs.Maybe(Type::MinusZero())) {
652 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
653 }
654
655 // We can give more precise types for integers.
656 Type type = Type::None();
657 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
658 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
659 if (!lhs.IsNone() && !rhs.IsNone()) {
660 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
661 type = SubtractRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
662 } else {
663 if ((lhs.Maybe(infinity_) && rhs.Maybe(infinity_)) ||
664 (rhs.Maybe(minus_infinity_) && lhs.Maybe(minus_infinity_))) {
665 maybe_nan = true;
666 }
667 type = Type::PlainNumber();
668 }
669 }
670
671 // Take into account the -0 and NaN information computed earlier.
672 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
673 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
674 return type;
675 }
676
SpeculativeSafeIntegerAdd(Type lhs,Type rhs)677 Type OperationTyper::SpeculativeSafeIntegerAdd(Type lhs, Type rhs) {
678 Type result = SpeculativeNumberAdd(lhs, rhs);
679 // If we have a Smi or Int32 feedback, the representation selection will
680 // either truncate or it will check the inputs (i.e., deopt if not int32).
681 // In either case the result will be in the safe integer range, so we
682 // can bake in the type here. This needs to be in sync with
683 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
684 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
685 }
686
SpeculativeSafeIntegerSubtract(Type lhs,Type rhs)687 Type OperationTyper::SpeculativeSafeIntegerSubtract(Type lhs, Type rhs) {
688 Type result = SpeculativeNumberSubtract(lhs, rhs);
689 // If we have a Smi or Int32 feedback, the representation selection will
690 // either truncate or it will check the inputs (i.e., deopt if not int32).
691 // In either case the result will be in the safe integer range, so we
692 // can bake in the type here. This needs to be in sync with
693 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
694 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
695 }
696
NumberMultiply(Type lhs,Type rhs)697 Type OperationTyper::NumberMultiply(Type lhs, Type rhs) {
698 DCHECK(lhs.Is(Type::Number()));
699 DCHECK(rhs.Is(Type::Number()));
700
701 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
702 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
703
704 // Multiplication propagates NaN:
705 // NaN * x = NaN (regardless of sign of x)
706 // 0 * Infinity = NaN (regardless of signs)
707 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN()) ||
708 (lhs.Maybe(cache_->kZeroish) &&
709 (rhs.Min() == -V8_INFINITY || rhs.Max() == V8_INFINITY)) ||
710 (rhs.Maybe(cache_->kZeroish) &&
711 (lhs.Min() == -V8_INFINITY || lhs.Max() == V8_INFINITY));
712 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
713 DCHECK(!lhs.IsNone());
714 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
715 DCHECK(!rhs.IsNone());
716
717 // Try to rule out -0.
718 bool maybe_minuszero = lhs.Maybe(Type::MinusZero()) ||
719 rhs.Maybe(Type::MinusZero()) ||
720 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
721 (rhs.Maybe(cache_->kZeroish) && lhs.Min() < 0.0);
722 if (lhs.Maybe(Type::MinusZero())) {
723 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
724 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
725 }
726 if (rhs.Maybe(Type::MinusZero())) {
727 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
728 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
729 }
730
731 // Compute the effective type, utilizing range information if possible.
732 Type type = (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger))
733 ? MultiplyRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max())
734 : Type::OrderedNumber();
735
736 // Take into account the -0 and NaN information computed earlier.
737 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
738 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
739 return type;
740 }
741
NumberDivide(Type lhs,Type rhs)742 Type OperationTyper::NumberDivide(Type lhs, Type rhs) {
743 DCHECK(lhs.Is(Type::Number()));
744 DCHECK(rhs.Is(Type::Number()));
745
746 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
747 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
748
749 // Division is tricky, so all we do is try ruling out -0 and NaN.
750 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
751 ((lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY) &&
752 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY));
753 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
754 DCHECK(!lhs.IsNone());
755 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
756 DCHECK(!rhs.IsNone());
757
758 // Try to rule out -0.
759 bool maybe_minuszero =
760 !lhs.Is(cache_->kInteger) ||
761 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
762 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY);
763
764 // Take into account the -0 and NaN information computed earlier.
765 Type type = Type::PlainNumber();
766 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
767 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
768 return type;
769 }
770
NumberModulus(Type lhs,Type rhs)771 Type OperationTyper::NumberModulus(Type lhs, Type rhs) {
772 DCHECK(lhs.Is(Type::Number()));
773 DCHECK(rhs.Is(Type::Number()));
774
775 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
776
777 // Modulus can yield NaN if either {lhs} or {rhs} are NaN, or
778 // {lhs} is not finite, or the {rhs} is a zero value.
779 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
780 lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY;
781
782 // Deal with -0 inputs, only the signbit of {lhs} matters for the result.
783 bool maybe_minuszero = false;
784 if (lhs.Maybe(Type::MinusZero())) {
785 maybe_minuszero = true;
786 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
787 }
788 if (rhs.Maybe(Type::MinusZero())) {
789 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
790 }
791
792 // Rule out NaN and -0, and check what we can do with the remaining type info.
793 Type type = Type::None();
794 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
795 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
796
797 // We can only derive a meaningful type if both {lhs} and {rhs} are inhabited,
798 // and the {rhs} is not 0, otherwise the result is NaN independent of {lhs}.
799 if (!lhs.IsNone() && !rhs.Is(cache_->kSingletonZero)) {
800 // Determine the bounds of {lhs} and {rhs}.
801 double const lmin = lhs.Min();
802 double const lmax = lhs.Max();
803 double const rmin = rhs.Min();
804 double const rmax = rhs.Max();
805
806 // The sign of the result is the sign of the {lhs}.
807 if (lmin < 0.0) maybe_minuszero = true;
808
809 // For integer inputs {lhs} and {rhs} we can infer a precise type.
810 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
811 double labs = std::max(std::abs(lmin), std::abs(lmax));
812 double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
813 double abs = std::min(labs, rabs);
814 double min = 0.0, max = 0.0;
815 if (lmin >= 0.0) {
816 // {lhs} positive.
817 min = 0.0;
818 max = abs;
819 } else if (lmax <= 0.0) {
820 // {lhs} negative.
821 min = 0.0 - abs;
822 max = 0.0;
823 } else {
824 // {lhs} positive or negative.
825 min = 0.0 - abs;
826 max = abs;
827 }
828 type = Type::Range(min, max, zone());
829 } else {
830 type = Type::PlainNumber();
831 }
832 }
833
834 // Take into account the -0 and NaN information computed earlier.
835 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
836 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
837 return type;
838 }
839
NumberBitwiseOr(Type lhs,Type rhs)840 Type OperationTyper::NumberBitwiseOr(Type lhs, Type rhs) {
841 DCHECK(lhs.Is(Type::Number()));
842 DCHECK(rhs.Is(Type::Number()));
843
844 lhs = NumberToInt32(lhs);
845 rhs = NumberToInt32(rhs);
846
847 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
848
849 double lmin = lhs.Min();
850 double rmin = rhs.Min();
851 double lmax = lhs.Max();
852 double rmax = rhs.Max();
853 // Or-ing any two values results in a value no smaller than their minimum.
854 // Even no smaller than their maximum if both values are non-negative.
855 double min =
856 lmin >= 0 && rmin >= 0 ? std::max(lmin, rmin) : std::min(lmin, rmin);
857 double max = kMaxInt;
858
859 // Or-ing with 0 is essentially a conversion to int32.
860 if (rmin == 0 && rmax == 0) {
861 min = lmin;
862 max = lmax;
863 }
864 if (lmin == 0 && lmax == 0) {
865 min = rmin;
866 max = rmax;
867 }
868
869 if (lmax < 0 || rmax < 0) {
870 // Or-ing two values of which at least one is negative results in a negative
871 // value.
872 max = std::min(max, -1.0);
873 }
874 return Type::Range(min, max, zone());
875 }
876
NumberBitwiseAnd(Type lhs,Type rhs)877 Type OperationTyper::NumberBitwiseAnd(Type lhs, Type rhs) {
878 DCHECK(lhs.Is(Type::Number()));
879 DCHECK(rhs.Is(Type::Number()));
880
881 lhs = NumberToInt32(lhs);
882 rhs = NumberToInt32(rhs);
883
884 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
885
886 double lmin = lhs.Min();
887 double rmin = rhs.Min();
888 double lmax = lhs.Max();
889 double rmax = rhs.Max();
890 double min = kMinInt;
891 // And-ing any two values results in a value no larger than their maximum.
892 // Even no larger than their minimum if both values are non-negative.
893 double max =
894 lmin >= 0 && rmin >= 0 ? std::min(lmax, rmax) : std::max(lmax, rmax);
895 // And-ing with a non-negative value x causes the result to be between
896 // zero and x.
897 if (lmin >= 0) {
898 min = 0;
899 max = std::min(max, lmax);
900 }
901 if (rmin >= 0) {
902 min = 0;
903 max = std::min(max, rmax);
904 }
905 return Type::Range(min, max, zone());
906 }
907
NumberBitwiseXor(Type lhs,Type rhs)908 Type OperationTyper::NumberBitwiseXor(Type lhs, Type rhs) {
909 DCHECK(lhs.Is(Type::Number()));
910 DCHECK(rhs.Is(Type::Number()));
911
912 lhs = NumberToInt32(lhs);
913 rhs = NumberToInt32(rhs);
914
915 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
916
917 double lmin = lhs.Min();
918 double rmin = rhs.Min();
919 double lmax = lhs.Max();
920 double rmax = rhs.Max();
921 if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
922 // Xor-ing negative or non-negative values results in a non-negative value.
923 return Type::Unsigned31();
924 }
925 if ((lmax < 0 && rmin >= 0) || (lmin >= 0 && rmax < 0)) {
926 // Xor-ing a negative and a non-negative value results in a negative value.
927 // TODO(jarin) Use a range here.
928 return Type::Negative32();
929 }
930 return Type::Signed32();
931 }
932
NumberShiftLeft(Type lhs,Type rhs)933 Type OperationTyper::NumberShiftLeft(Type lhs, Type rhs) {
934 DCHECK(lhs.Is(Type::Number()));
935 DCHECK(rhs.Is(Type::Number()));
936
937 lhs = NumberToInt32(lhs);
938 rhs = NumberToUint32(rhs);
939
940 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
941
942 int32_t min_lhs = lhs.Min();
943 int32_t max_lhs = lhs.Max();
944 uint32_t min_rhs = rhs.Min();
945 uint32_t max_rhs = rhs.Max();
946 if (max_rhs > 31) {
947 // rhs can be larger than the bitmask
948 max_rhs = 31;
949 min_rhs = 0;
950 }
951
952 if (max_lhs > (kMaxInt >> max_rhs) || min_lhs < (kMinInt >> max_rhs)) {
953 // overflow possible
954 return Type::Signed32();
955 }
956
957 double min =
958 std::min(static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << min_rhs),
959 static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << max_rhs));
960 double max =
961 std::max(static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << min_rhs),
962 static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << max_rhs));
963
964 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
965 return Type::Range(min, max, zone());
966 }
967
NumberShiftRight(Type lhs,Type rhs)968 Type OperationTyper::NumberShiftRight(Type lhs, Type rhs) {
969 DCHECK(lhs.Is(Type::Number()));
970 DCHECK(rhs.Is(Type::Number()));
971
972 lhs = NumberToInt32(lhs);
973 rhs = NumberToUint32(rhs);
974
975 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
976
977 int32_t min_lhs = lhs.Min();
978 int32_t max_lhs = lhs.Max();
979 uint32_t min_rhs = rhs.Min();
980 uint32_t max_rhs = rhs.Max();
981 if (max_rhs > 31) {
982 // rhs can be larger than the bitmask
983 max_rhs = 31;
984 min_rhs = 0;
985 }
986 double min = std::min(min_lhs >> min_rhs, min_lhs >> max_rhs);
987 double max = std::max(max_lhs >> min_rhs, max_lhs >> max_rhs);
988
989 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
990 return Type::Range(min, max, zone());
991 }
992
NumberShiftRightLogical(Type lhs,Type rhs)993 Type OperationTyper::NumberShiftRightLogical(Type lhs, Type rhs) {
994 DCHECK(lhs.Is(Type::Number()));
995 DCHECK(rhs.Is(Type::Number()));
996
997 lhs = NumberToUint32(lhs);
998 rhs = NumberToUint32(rhs);
999
1000 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1001
1002 uint32_t min_lhs = lhs.Min();
1003 uint32_t max_lhs = lhs.Max();
1004 uint32_t min_rhs = rhs.Min();
1005 uint32_t max_rhs = rhs.Max();
1006 if (max_rhs > 31) {
1007 // rhs can be larger than the bitmask
1008 max_rhs = 31;
1009 min_rhs = 0;
1010 }
1011
1012 double min = min_lhs >> max_rhs;
1013 double max = max_lhs >> min_rhs;
1014 DCHECK_LE(0, min);
1015 DCHECK_LE(max, kMaxUInt32);
1016
1017 if (min == 0 && max == kMaxInt) return Type::Unsigned31();
1018 if (min == 0 && max == kMaxUInt32) return Type::Unsigned32();
1019 return Type::Range(min, max, zone());
1020 }
1021
NumberAtan2(Type lhs,Type rhs)1022 Type OperationTyper::NumberAtan2(Type lhs, Type rhs) {
1023 DCHECK(lhs.Is(Type::Number()));
1024 DCHECK(rhs.Is(Type::Number()));
1025 return Type::Number();
1026 }
1027
NumberImul(Type lhs,Type rhs)1028 Type OperationTyper::NumberImul(Type lhs, Type rhs) {
1029 DCHECK(lhs.Is(Type::Number()));
1030 DCHECK(rhs.Is(Type::Number()));
1031 // TODO(turbofan): We should be able to do better here.
1032 return Type::Signed32();
1033 }
1034
NumberMax(Type lhs,Type rhs)1035 Type OperationTyper::NumberMax(Type lhs, Type rhs) {
1036 DCHECK(lhs.Is(Type::Number()));
1037 DCHECK(rhs.Is(Type::Number()));
1038
1039 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1040 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1041
1042 Type type = Type::None();
1043 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1044 type = Type::Union(type, Type::NaN(), zone());
1045 }
1046 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1047 type = Type::Union(type, Type::MinusZero(), zone());
1048 // In order to ensure monotonicity of the computation below, we additionally
1049 // pretend +0 is present (for simplicity on both sides).
1050 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1051 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1052 }
1053 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1054 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1055 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1056 }
1057
1058 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1059 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1060 DCHECK(!lhs.IsNone());
1061 DCHECK(!rhs.IsNone());
1062
1063 double min = std::max(lhs.Min(), rhs.Min());
1064 double max = std::max(lhs.Max(), rhs.Max());
1065 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1066
1067 return type;
1068 }
1069
NumberMin(Type lhs,Type rhs)1070 Type OperationTyper::NumberMin(Type lhs, Type rhs) {
1071 DCHECK(lhs.Is(Type::Number()));
1072 DCHECK(rhs.Is(Type::Number()));
1073
1074 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1075 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1076
1077 Type type = Type::None();
1078 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1079 type = Type::Union(type, Type::NaN(), zone());
1080 }
1081 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1082 type = Type::Union(type, Type::MinusZero(), zone());
1083 // In order to ensure monotonicity of the computation below, we additionally
1084 // pretend +0 is present (for simplicity on both sides).
1085 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1086 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1087 }
1088 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1089 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1090 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1091 }
1092
1093 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1094 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1095 DCHECK(!lhs.IsNone());
1096 DCHECK(!rhs.IsNone());
1097
1098 double min = std::min(lhs.Min(), rhs.Min());
1099 double max = std::min(lhs.Max(), rhs.Max());
1100 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1101
1102 return type;
1103 }
1104
NumberPow(Type lhs,Type rhs)1105 Type OperationTyper::NumberPow(Type lhs, Type rhs) {
1106 DCHECK(lhs.Is(Type::Number()));
1107 DCHECK(rhs.Is(Type::Number()));
1108 // TODO(turbofan): We should be able to do better here.
1109 return Type::Number();
1110 }
1111
1112 #define SPECULATIVE_NUMBER_BINOP(Name) \
1113 Type OperationTyper::Speculative##Name(Type lhs, Type rhs) { \
1114 lhs = SpeculativeToNumber(lhs); \
1115 rhs = SpeculativeToNumber(rhs); \
1116 return Name(lhs, rhs); \
1117 }
1118 SPECULATIVE_NUMBER_BINOP(NumberAdd)
SPECULATIVE_NUMBER_BINOP(NumberSubtract)1119 SPECULATIVE_NUMBER_BINOP(NumberSubtract)
1120 SPECULATIVE_NUMBER_BINOP(NumberMultiply)
1121 SPECULATIVE_NUMBER_BINOP(NumberPow)
1122 SPECULATIVE_NUMBER_BINOP(NumberDivide)
1123 SPECULATIVE_NUMBER_BINOP(NumberModulus)
1124 SPECULATIVE_NUMBER_BINOP(NumberBitwiseOr)
1125 SPECULATIVE_NUMBER_BINOP(NumberBitwiseAnd)
1126 SPECULATIVE_NUMBER_BINOP(NumberBitwiseXor)
1127 SPECULATIVE_NUMBER_BINOP(NumberShiftLeft)
1128 SPECULATIVE_NUMBER_BINOP(NumberShiftRight)
1129 SPECULATIVE_NUMBER_BINOP(NumberShiftRightLogical)
1130 #undef SPECULATIVE_NUMBER_BINOP
1131
1132 Type OperationTyper::BigIntAdd(Type lhs, Type rhs) {
1133 DCHECK(lhs.Is(Type::BigInt()));
1134 DCHECK(rhs.Is(Type::BigInt()));
1135
1136 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1137 return Type::BigInt();
1138 }
1139
BigIntSubtract(Type lhs,Type rhs)1140 Type OperationTyper::BigIntSubtract(Type lhs, Type rhs) {
1141 DCHECK(lhs.Is(Type::BigInt()));
1142 DCHECK(rhs.Is(Type::BigInt()));
1143
1144 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1145 return Type::BigInt();
1146 }
1147
BigIntNegate(Type type)1148 Type OperationTyper::BigIntNegate(Type type) {
1149 DCHECK(type.Is(Type::BigInt()));
1150
1151 if (type.IsNone()) return type;
1152 return Type::BigInt();
1153 }
1154
SpeculativeBigIntAdd(Type lhs,Type rhs)1155 Type OperationTyper::SpeculativeBigIntAdd(Type lhs, Type rhs) {
1156 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1157 return Type::BigInt();
1158 }
1159
SpeculativeBigIntSubtract(Type lhs,Type rhs)1160 Type OperationTyper::SpeculativeBigIntSubtract(Type lhs, Type rhs) {
1161 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1162 return Type::BigInt();
1163 }
1164
SpeculativeBigIntNegate(Type type)1165 Type OperationTyper::SpeculativeBigIntNegate(Type type) {
1166 if (type.IsNone()) return type;
1167 return Type::BigInt();
1168 }
1169
SpeculativeToNumber(Type type)1170 Type OperationTyper::SpeculativeToNumber(Type type) {
1171 return ToNumber(Type::Intersect(type, Type::NumberOrOddball(), zone()));
1172 }
1173
ToPrimitive(Type type)1174 Type OperationTyper::ToPrimitive(Type type) {
1175 if (type.Is(Type::Primitive())) {
1176 return type;
1177 }
1178 return Type::Primitive();
1179 }
1180
Invert(Type type)1181 Type OperationTyper::Invert(Type type) {
1182 DCHECK(type.Is(Type::Boolean()));
1183 CHECK(!type.IsNone());
1184 if (type.Is(singleton_false())) return singleton_true();
1185 if (type.Is(singleton_true())) return singleton_false();
1186 return type;
1187 }
1188
Invert(ComparisonOutcome outcome)1189 OperationTyper::ComparisonOutcome OperationTyper::Invert(
1190 ComparisonOutcome outcome) {
1191 ComparisonOutcome result(0);
1192 if ((outcome & kComparisonUndefined) != 0) result |= kComparisonUndefined;
1193 if ((outcome & kComparisonTrue) != 0) result |= kComparisonFalse;
1194 if ((outcome & kComparisonFalse) != 0) result |= kComparisonTrue;
1195 return result;
1196 }
1197
FalsifyUndefined(ComparisonOutcome outcome)1198 Type OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
1199 if ((outcome & kComparisonFalse) != 0 ||
1200 (outcome & kComparisonUndefined) != 0) {
1201 return (outcome & kComparisonTrue) != 0 ? Type::Boolean()
1202 : singleton_false();
1203 }
1204 // Type should be non empty, so we know it should be true.
1205 DCHECK_NE(0, outcome & kComparisonTrue);
1206 return singleton_true();
1207 }
1208
1209 namespace {
1210
JSType(Type type)1211 Type JSType(Type type) {
1212 if (type.Is(Type::Boolean())) return Type::Boolean();
1213 if (type.Is(Type::String())) return Type::String();
1214 if (type.Is(Type::Number())) return Type::Number();
1215 if (type.Is(Type::BigInt())) return Type::BigInt();
1216 if (type.Is(Type::Undefined())) return Type::Undefined();
1217 if (type.Is(Type::Null())) return Type::Null();
1218 if (type.Is(Type::Symbol())) return Type::Symbol();
1219 if (type.Is(Type::Receiver())) return Type::Receiver(); // JS "Object"
1220 return Type::Any();
1221 }
1222
1223 } // namespace
1224
SameValue(Type lhs,Type rhs)1225 Type OperationTyper::SameValue(Type lhs, Type rhs) {
1226 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1227 if (lhs.Is(Type::NaN())) {
1228 if (rhs.Is(Type::NaN())) return singleton_true();
1229 if (!rhs.Maybe(Type::NaN())) return singleton_false();
1230 } else if (rhs.Is(Type::NaN())) {
1231 if (!lhs.Maybe(Type::NaN())) return singleton_false();
1232 }
1233 if (lhs.Is(Type::MinusZero())) {
1234 if (rhs.Is(Type::MinusZero())) return singleton_true();
1235 if (!rhs.Maybe(Type::MinusZero())) return singleton_false();
1236 } else if (rhs.Is(Type::MinusZero())) {
1237 if (!lhs.Maybe(Type::MinusZero())) return singleton_false();
1238 }
1239 if (lhs.Is(Type::OrderedNumber()) && rhs.Is(Type::OrderedNumber()) &&
1240 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1241 return singleton_false();
1242 }
1243 return Type::Boolean();
1244 }
1245
SameValueNumbersOnly(Type lhs,Type rhs)1246 Type OperationTyper::SameValueNumbersOnly(Type lhs, Type rhs) {
1247 // SameValue and SamevalueNumbersOnly only differ in treatment of
1248 // strings and biginits. Since the SameValue typer does not do anything
1249 // special about strings or bigints, we can just use it here.
1250 return SameValue(lhs, rhs);
1251 }
1252
StrictEqual(Type lhs,Type rhs)1253 Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
1254 CHECK(!lhs.IsNone());
1255 CHECK(!rhs.IsNone());
1256 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1257 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return singleton_false();
1258 if (lhs.Is(Type::Number()) && rhs.Is(Type::Number()) &&
1259 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1260 return singleton_false();
1261 }
1262 if (lhs.IsSingleton() && rhs.Is(lhs)) {
1263 // Types are equal and are inhabited only by a single semantic value,
1264 // which is not nan due to the earlier check.
1265 DCHECK(lhs.Is(rhs));
1266 return singleton_true();
1267 }
1268 if ((lhs.Is(Type::Unique()) || rhs.Is(Type::Unique())) && !lhs.Maybe(rhs)) {
1269 // One of the inputs has a canonical representation but types don't overlap.
1270 return singleton_false();
1271 }
1272 return Type::Boolean();
1273 }
1274
CheckBounds(Type index,Type length)1275 Type OperationTyper::CheckBounds(Type index, Type length) {
1276 DCHECK(length.Is(cache_->kPositiveSafeInteger));
1277 if (length.Is(cache_->kSingletonZero)) return Type::None();
1278 Type const upper_bound = Type::Range(0.0, length.Max() - 1, zone());
1279 if (index.Maybe(Type::String())) return upper_bound;
1280 if (index.Maybe(Type::MinusZero())) {
1281 index = Type::Union(index, cache_->kSingletonZero, zone());
1282 }
1283 return Type::Intersect(index, upper_bound, zone());
1284 }
1285
CheckFloat64Hole(Type type)1286 Type OperationTyper::CheckFloat64Hole(Type type) {
1287 if (type.Maybe(Type::Hole())) {
1288 // Turn "the hole" into undefined.
1289 type = Type::Intersect(type, Type::Number(), zone());
1290 type = Type::Union(type, Type::Undefined(), zone());
1291 }
1292 return type;
1293 }
1294
CheckNumber(Type type)1295 Type OperationTyper::CheckNumber(Type type) {
1296 return Type::Intersect(type, Type::Number(), zone());
1297 }
1298
TypeTypeGuard(const Operator * sigma_op,Type input)1299 Type OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type input) {
1300 return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
1301 }
1302
ConvertTaggedHoleToUndefined(Type input)1303 Type OperationTyper::ConvertTaggedHoleToUndefined(Type input) {
1304 if (input.Maybe(Type::Hole())) {
1305 // Turn "the hole" into undefined.
1306 Type type = Type::Intersect(input, Type::NonInternal(), zone());
1307 return Type::Union(type, Type::Undefined(), zone());
1308 }
1309 return input;
1310 }
1311
ToBoolean(Type type)1312 Type OperationTyper::ToBoolean(Type type) {
1313 if (type.Is(Type::Boolean())) return type;
1314 if (type.Is(falsish_)) return singleton_false_;
1315 if (type.Is(truish_)) return singleton_true_;
1316 if (type.Is(Type::Number())) {
1317 return NumberToBoolean(type);
1318 }
1319 return Type::Boolean();
1320 }
1321
1322 } // namespace compiler
1323 } // namespace internal
1324 } // namespace v8
1325