1 // Copyright 2016 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/compiler/operation-typer.h"
6
7 #include "src/compiler/common-operator.h"
8 #include "src/compiler/js-heap-broker.h"
9 #include "src/compiler/type-cache.h"
10 #include "src/compiler/types.h"
11 #include "src/execution/isolate.h"
12 #include "src/heap/factory.h"
13
14 #include "src/objects/objects-inl.h"
15
16 namespace v8 {
17 namespace internal {
18 namespace compiler {
19
OperationTyper(JSHeapBroker * broker,Zone * zone)20 OperationTyper::OperationTyper(JSHeapBroker* broker, Zone* zone)
21 : zone_(zone), cache_(TypeCache::Get()) {
22 Factory* factory = broker->isolate()->factory();
23 infinity_ = Type::Constant(V8_INFINITY, zone);
24 minus_infinity_ = Type::Constant(-V8_INFINITY, zone);
25 Type truncating_to_zero = Type::MinusZeroOrNaN();
26 DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
27
28 singleton_empty_string_ =
29 Type::Constant(broker, factory->empty_string(), zone);
30 singleton_NaN_string_ = Type::Constant(broker, factory->NaN_string(), zone);
31 singleton_zero_string_ = Type::Constant(broker, factory->zero_string(), zone);
32 singleton_false_ = Type::Constant(broker, factory->false_value(), zone);
33 singleton_true_ = Type::Constant(broker, factory->true_value(), zone);
34 singleton_the_hole_ = Type::Hole();
35 signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
36 unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
37
38 falsish_ = Type::Union(
39 Type::Undetectable(),
40 Type::Union(Type::Union(singleton_false_, cache_->kZeroish, zone),
41 Type::Union(singleton_empty_string_, Type::Hole(), zone),
42 zone),
43 zone);
44 truish_ = Type::Union(
45 singleton_true_,
46 Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone), zone);
47 }
48
Merge(Type left,Type right)49 Type OperationTyper::Merge(Type left, Type right) {
50 return Type::Union(left, right, zone());
51 }
52
WeakenRange(Type previous_range,Type current_range)53 Type OperationTyper::WeakenRange(Type previous_range, Type current_range) {
54 static const double kWeakenMinLimits[] = {0.0,
55 -1073741824.0,
56 -2147483648.0,
57 -4294967296.0,
58 -8589934592.0,
59 -17179869184.0,
60 -34359738368.0,
61 -68719476736.0,
62 -137438953472.0,
63 -274877906944.0,
64 -549755813888.0,
65 -1099511627776.0,
66 -2199023255552.0,
67 -4398046511104.0,
68 -8796093022208.0,
69 -17592186044416.0,
70 -35184372088832.0,
71 -70368744177664.0,
72 -140737488355328.0,
73 -281474976710656.0,
74 -562949953421312.0};
75 static const double kWeakenMaxLimits[] = {0.0,
76 1073741823.0,
77 2147483647.0,
78 4294967295.0,
79 8589934591.0,
80 17179869183.0,
81 34359738367.0,
82 68719476735.0,
83 137438953471.0,
84 274877906943.0,
85 549755813887.0,
86 1099511627775.0,
87 2199023255551.0,
88 4398046511103.0,
89 8796093022207.0,
90 17592186044415.0,
91 35184372088831.0,
92 70368744177663.0,
93 140737488355327.0,
94 281474976710655.0,
95 562949953421311.0};
96 STATIC_ASSERT(arraysize(kWeakenMinLimits) == arraysize(kWeakenMaxLimits));
97
98 double current_min = current_range.Min();
99 double new_min = current_min;
100 // Find the closest lower entry in the list of allowed
101 // minima (or negative infinity if there is no such entry).
102 if (current_min != previous_range.Min()) {
103 new_min = -V8_INFINITY;
104 for (double const min : kWeakenMinLimits) {
105 if (min <= current_min) {
106 new_min = min;
107 break;
108 }
109 }
110 }
111
112 double current_max = current_range.Max();
113 double new_max = current_max;
114 // Find the closest greater entry in the list of allowed
115 // maxima (or infinity if there is no such entry).
116 if (current_max != previous_range.Max()) {
117 new_max = V8_INFINITY;
118 for (double const max : kWeakenMaxLimits) {
119 if (max >= current_max) {
120 new_max = max;
121 break;
122 }
123 }
124 }
125
126 return Type::Range(new_min, new_max, zone());
127 }
128
Rangify(Type type)129 Type OperationTyper::Rangify(Type type) {
130 if (type.IsRange()) return type; // Shortcut.
131 if (!type.Is(cache_->kInteger)) {
132 return type; // Give up on non-integer types.
133 }
134 return Type::Range(type.Min(), type.Max(), zone());
135 }
136
137 namespace {
138
139 // Returns the array's least element, ignoring NaN.
140 // There must be at least one non-NaN element.
141 // Any -0 is converted to 0.
array_min(double a[],size_t n)142 double array_min(double a[], size_t n) {
143 DCHECK_NE(0, n);
144 double x = +V8_INFINITY;
145 for (size_t i = 0; i < n; ++i) {
146 if (!std::isnan(a[i])) {
147 x = std::min(a[i], x);
148 }
149 }
150 DCHECK(!std::isnan(x));
151 return x == 0 ? 0 : x; // -0 -> 0
152 }
153
154 // Returns the array's greatest element, ignoring NaN.
155 // There must be at least one non-NaN element.
156 // Any -0 is converted to 0.
array_max(double a[],size_t n)157 double array_max(double a[], size_t n) {
158 DCHECK_NE(0, n);
159 double x = -V8_INFINITY;
160 for (size_t i = 0; i < n; ++i) {
161 if (!std::isnan(a[i])) {
162 x = std::max(a[i], x);
163 }
164 }
165 DCHECK(!std::isnan(x));
166 return x == 0 ? 0 : x; // -0 -> 0
167 }
168
169 } // namespace
170
AddRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)171 Type OperationTyper::AddRanger(double lhs_min, double lhs_max, double rhs_min,
172 double rhs_max) {
173 double results[4];
174 results[0] = lhs_min + rhs_min;
175 results[1] = lhs_min + rhs_max;
176 results[2] = lhs_max + rhs_min;
177 results[3] = lhs_max + rhs_max;
178 // Since none of the inputs can be -0, the result cannot be -0 either.
179 // However, it can be nan (the sum of two infinities of opposite sign).
180 // On the other hand, if none of the "results" above is nan, then the
181 // actual result cannot be nan either.
182 int nans = 0;
183 for (int i = 0; i < 4; ++i) {
184 if (std::isnan(results[i])) ++nans;
185 }
186 if (nans == 4) return Type::NaN();
187 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
188 if (nans > 0) type = Type::Union(type, Type::NaN(), zone());
189 // Examples:
190 // [-inf, -inf] + [+inf, +inf] = NaN
191 // [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
192 // [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
193 // [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
194 return type;
195 }
196
SubtractRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)197 Type OperationTyper::SubtractRanger(double lhs_min, double lhs_max,
198 double rhs_min, double rhs_max) {
199 double results[4];
200 results[0] = lhs_min - rhs_min;
201 results[1] = lhs_min - rhs_max;
202 results[2] = lhs_max - rhs_min;
203 results[3] = lhs_max - rhs_max;
204 // Since none of the inputs can be -0, the result cannot be -0.
205 // However, it can be nan (the subtraction of two infinities of same sign).
206 // On the other hand, if none of the "results" above is nan, then the actual
207 // result cannot be nan either.
208 int nans = 0;
209 for (int i = 0; i < 4; ++i) {
210 if (std::isnan(results[i])) ++nans;
211 }
212 if (nans == 4) return Type::NaN(); // [inf..inf] - [inf..inf] (all same sign)
213 Type type = Type::Range(array_min(results, 4), array_max(results, 4), zone());
214 return nans == 0 ? type : Type::Union(type, Type::NaN(), zone());
215 // Examples:
216 // [-inf, +inf] - [-inf, +inf] = [-inf, +inf] \/ NaN
217 // [-inf, -inf] - [-inf, -inf] = NaN
218 // [-inf, -inf] - [n, +inf] = [-inf, -inf] \/ NaN
219 // [m, +inf] - [-inf, n] = [-inf, +inf] \/ NaN
220 }
221
MultiplyRanger(double lhs_min,double lhs_max,double rhs_min,double rhs_max)222 Type OperationTyper::MultiplyRanger(double lhs_min, double lhs_max,
223 double rhs_min, double rhs_max) {
224 double results[4];
225 results[0] = lhs_min * rhs_min;
226 results[1] = lhs_min * rhs_max;
227 results[2] = lhs_max * rhs_min;
228 results[3] = lhs_max * rhs_max;
229 // If the result may be nan, we give up on calculating a precise type,
230 // because the discontinuity makes it too complicated. Note that even if
231 // none of the "results" above is nan, the actual result may still be, so we
232 // have to do a different check:
233 for (int i = 0; i < 4; ++i) {
234 if (std::isnan(results[i])) {
235 return cache_->kIntegerOrMinusZeroOrNaN;
236 }
237 }
238 double min = array_min(results, 4);
239 double max = array_max(results, 4);
240 Type type = Type::Range(min, max, zone());
241 if (min <= 0.0 && 0.0 <= max && (lhs_min < 0.0 || rhs_min < 0.0)) {
242 type = Type::Union(type, Type::MinusZero(), zone());
243 }
244 // 0 * V8_INFINITY is NaN, regardless of sign
245 if (((lhs_min == -V8_INFINITY || lhs_max == V8_INFINITY) &&
246 (rhs_min <= 0.0 && 0.0 <= rhs_max)) ||
247 ((rhs_min == -V8_INFINITY || rhs_max == V8_INFINITY) &&
248 (lhs_min <= 0.0 && 0.0 <= lhs_max))) {
249 type = Type::Union(type, Type::NaN(), zone());
250 }
251 return type;
252 }
253
ConvertReceiver(Type type)254 Type OperationTyper::ConvertReceiver(Type type) {
255 if (type.Is(Type::Receiver())) return type;
256 bool const maybe_primitive = type.Maybe(Type::Primitive());
257 type = Type::Intersect(type, Type::Receiver(), zone());
258 if (maybe_primitive) {
259 // ConvertReceiver maps null and undefined to the JSGlobalProxy of the
260 // target function, and all other primitives are wrapped into a
261 // JSPrimitiveWrapper.
262 type = Type::Union(type, Type::OtherObject(), zone());
263 }
264 return type;
265 }
266
ToNumber(Type type)267 Type OperationTyper::ToNumber(Type type) {
268 if (type.Is(Type::Number())) return type;
269
270 // If {type} includes any receivers, we cannot tell what kind of
271 // Number their callbacks might produce. Similarly in the case
272 // where {type} includes String, it's not possible at this point
273 // to tell which exact numbers are going to be produced.
274 if (type.Maybe(Type::StringOrReceiver())) return Type::Number();
275
276 // Both Symbol and BigInt primitives will cause exceptions
277 // to be thrown from ToNumber conversions, so they don't
278 // contribute to the resulting type anyways.
279 type = Type::Intersect(type, Type::PlainPrimitive(), zone());
280
281 // This leaves us with Number\/Oddball, so deal with the individual
282 // Oddball primitives below.
283 DCHECK(type.Is(Type::NumberOrOddball()));
284 if (type.Maybe(Type::Null())) {
285 // ToNumber(null) => +0
286 type = Type::Union(type, cache_->kSingletonZero, zone());
287 }
288 if (type.Maybe(Type::Undefined())) {
289 // ToNumber(undefined) => NaN
290 type = Type::Union(type, Type::NaN(), zone());
291 }
292 if (type.Maybe(singleton_false_)) {
293 // ToNumber(false) => +0
294 type = Type::Union(type, cache_->kSingletonZero, zone());
295 }
296 if (type.Maybe(singleton_true_)) {
297 // ToNumber(true) => +1
298 type = Type::Union(type, cache_->kSingletonOne, zone());
299 }
300 return Type::Intersect(type, Type::Number(), zone());
301 }
302
ToNumberConvertBigInt(Type type)303 Type OperationTyper::ToNumberConvertBigInt(Type type) {
304 // If the {type} includes any receivers, then the callbacks
305 // might actually produce BigInt primitive values here.
306 bool maybe_bigint =
307 type.Maybe(Type::BigInt()) || type.Maybe(Type::Receiver());
308 type = ToNumber(Type::Intersect(type, Type::NonBigInt(), zone()));
309
310 // Any BigInt is rounded to an integer Number in the range [-inf, inf].
311 return maybe_bigint ? Type::Union(type, cache_->kInteger, zone()) : type;
312 }
313
ToNumeric(Type type)314 Type OperationTyper::ToNumeric(Type type) {
315 // If the {type} includes any receivers, then the callbacks
316 // might actually produce BigInt primitive values here.
317 if (type.Maybe(Type::Receiver())) {
318 type = Type::Union(type, Type::BigInt(), zone());
319 }
320 return Type::Union(ToNumber(Type::Intersect(type, Type::NonBigInt(), zone())),
321 Type::Intersect(type, Type::BigInt(), zone()), zone());
322 }
323
NumberAbs(Type type)324 Type OperationTyper::NumberAbs(Type type) {
325 DCHECK(type.Is(Type::Number()));
326 if (type.IsNone()) return type;
327
328 bool const maybe_nan = type.Maybe(Type::NaN());
329 bool const maybe_minuszero = type.Maybe(Type::MinusZero());
330
331 type = Type::Intersect(type, Type::PlainNumber(), zone());
332 if (!type.IsNone()) {
333 double const max = type.Max();
334 double const min = type.Min();
335 if (min < 0) {
336 if (type.Is(cache_->kInteger)) {
337 type =
338 Type::Range(0.0, std::max(std::fabs(min), std::fabs(max)), zone());
339 } else {
340 type = Type::PlainNumber();
341 }
342 }
343 }
344
345 if (maybe_minuszero) {
346 type = Type::Union(type, cache_->kSingletonZero, zone());
347 }
348 if (maybe_nan) {
349 type = Type::Union(type, Type::NaN(), zone());
350 }
351 return type;
352 }
353
NumberAcos(Type type)354 Type OperationTyper::NumberAcos(Type type) {
355 DCHECK(type.Is(Type::Number()));
356 return Type::Number();
357 }
358
NumberAcosh(Type type)359 Type OperationTyper::NumberAcosh(Type type) {
360 DCHECK(type.Is(Type::Number()));
361 return Type::Number();
362 }
363
NumberAsin(Type type)364 Type OperationTyper::NumberAsin(Type type) {
365 DCHECK(type.Is(Type::Number()));
366 return Type::Number();
367 }
368
NumberAsinh(Type type)369 Type OperationTyper::NumberAsinh(Type type) {
370 DCHECK(type.Is(Type::Number()));
371 return Type::Number();
372 }
373
NumberAtan(Type type)374 Type OperationTyper::NumberAtan(Type type) {
375 DCHECK(type.Is(Type::Number()));
376 return Type::Number();
377 }
378
NumberAtanh(Type type)379 Type OperationTyper::NumberAtanh(Type type) {
380 DCHECK(type.Is(Type::Number()));
381 return Type::Number();
382 }
383
NumberCbrt(Type type)384 Type OperationTyper::NumberCbrt(Type type) {
385 DCHECK(type.Is(Type::Number()));
386 return Type::Number();
387 }
388
NumberCeil(Type type)389 Type OperationTyper::NumberCeil(Type type) {
390 DCHECK(type.Is(Type::Number()));
391 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
392 type = Type::Intersect(type, Type::NaN(), zone());
393 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
394 return type;
395 }
396
NumberClz32(Type type)397 Type OperationTyper::NumberClz32(Type type) {
398 DCHECK(type.Is(Type::Number()));
399 return cache_->kZeroToThirtyTwo;
400 }
401
NumberCos(Type type)402 Type OperationTyper::NumberCos(Type type) {
403 DCHECK(type.Is(Type::Number()));
404 return Type::Number();
405 }
406
NumberCosh(Type type)407 Type OperationTyper::NumberCosh(Type type) {
408 DCHECK(type.Is(Type::Number()));
409 return Type::Number();
410 }
411
NumberExp(Type type)412 Type OperationTyper::NumberExp(Type type) {
413 DCHECK(type.Is(Type::Number()));
414 return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
415 }
416
NumberExpm1(Type type)417 Type OperationTyper::NumberExpm1(Type type) {
418 DCHECK(type.Is(Type::Number()));
419 return Type::Number();
420 }
421
NumberFloor(Type type)422 Type OperationTyper::NumberFloor(Type type) {
423 DCHECK(type.Is(Type::Number()));
424 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
425 type = Type::Intersect(type, Type::MinusZeroOrNaN(), zone());
426 type = Type::Union(type, cache_->kInteger, zone());
427 return type;
428 }
429
NumberFround(Type type)430 Type OperationTyper::NumberFround(Type type) {
431 DCHECK(type.Is(Type::Number()));
432 return Type::Number();
433 }
434
NumberLog(Type type)435 Type OperationTyper::NumberLog(Type type) {
436 DCHECK(type.Is(Type::Number()));
437 return Type::Number();
438 }
439
NumberLog1p(Type type)440 Type OperationTyper::NumberLog1p(Type type) {
441 DCHECK(type.Is(Type::Number()));
442 return Type::Number();
443 }
444
NumberLog2(Type type)445 Type OperationTyper::NumberLog2(Type type) {
446 DCHECK(type.Is(Type::Number()));
447 return Type::Number();
448 }
449
NumberLog10(Type type)450 Type OperationTyper::NumberLog10(Type type) {
451 DCHECK(type.Is(Type::Number()));
452 return Type::Number();
453 }
454
NumberRound(Type type)455 Type OperationTyper::NumberRound(Type type) {
456 DCHECK(type.Is(Type::Number()));
457 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
458 type = Type::Intersect(type, Type::NaN(), zone());
459 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
460 return type;
461 }
462
NumberSign(Type type)463 Type OperationTyper::NumberSign(Type type) {
464 DCHECK(type.Is(Type::Number()));
465 if (type.Is(cache_->kZeroish)) return type;
466 bool maybe_minuszero = type.Maybe(Type::MinusZero());
467 bool maybe_nan = type.Maybe(Type::NaN());
468 type = Type::Intersect(type, Type::PlainNumber(), zone());
469 if (type.IsNone()) {
470 // Do nothing.
471 } else if (type.Max() < 0.0) {
472 type = cache_->kSingletonMinusOne;
473 } else if (type.Max() <= 0.0) {
474 type = cache_->kMinusOneOrZero;
475 } else if (type.Min() > 0.0) {
476 type = cache_->kSingletonOne;
477 } else if (type.Min() >= 0.0) {
478 type = cache_->kZeroOrOne;
479 } else {
480 type = Type::Range(-1.0, 1.0, zone());
481 }
482 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
483 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
484 DCHECK(!type.IsNone());
485 return type;
486 }
487
NumberSin(Type type)488 Type OperationTyper::NumberSin(Type type) {
489 DCHECK(type.Is(Type::Number()));
490 return Type::Number();
491 }
492
NumberSinh(Type type)493 Type OperationTyper::NumberSinh(Type type) {
494 DCHECK(type.Is(Type::Number()));
495 return Type::Number();
496 }
497
NumberSqrt(Type type)498 Type OperationTyper::NumberSqrt(Type type) {
499 DCHECK(type.Is(Type::Number()));
500 return Type::Number();
501 }
502
NumberTan(Type type)503 Type OperationTyper::NumberTan(Type type) {
504 DCHECK(type.Is(Type::Number()));
505 return Type::Number();
506 }
507
NumberTanh(Type type)508 Type OperationTyper::NumberTanh(Type type) {
509 DCHECK(type.Is(Type::Number()));
510 return Type::Number();
511 }
512
NumberTrunc(Type type)513 Type OperationTyper::NumberTrunc(Type type) {
514 DCHECK(type.Is(Type::Number()));
515 if (type.Is(cache_->kIntegerOrMinusZeroOrNaN)) return type;
516 type = Type::Intersect(type, Type::NaN(), zone());
517 type = Type::Union(type, cache_->kIntegerOrMinusZero, zone());
518 return type;
519 }
520
NumberToBoolean(Type type)521 Type OperationTyper::NumberToBoolean(Type type) {
522 DCHECK(type.Is(Type::Number()));
523 if (type.IsNone()) return type;
524 if (type.Is(cache_->kZeroish)) return singleton_false_;
525 if (type.Is(Type::PlainNumber()) && (type.Max() < 0 || 0 < type.Min())) {
526 return singleton_true_; // Ruled out nan, -0 and +0.
527 }
528 return Type::Boolean();
529 }
530
NumberToInt32(Type type)531 Type OperationTyper::NumberToInt32(Type type) {
532 DCHECK(type.Is(Type::Number()));
533
534 if (type.Is(Type::Signed32())) return type;
535 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
536 if (type.Is(signed32ish_)) {
537 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
538 Type::Signed32(), zone());
539 }
540 return Type::Signed32();
541 }
542
NumberToString(Type type)543 Type OperationTyper::NumberToString(Type type) {
544 DCHECK(type.Is(Type::Number()));
545 if (type.IsNone()) return type;
546 if (type.Is(Type::NaN())) return singleton_NaN_string_;
547 if (type.Is(cache_->kZeroOrMinusZero)) return singleton_zero_string_;
548 return Type::String();
549 }
550
NumberToUint32(Type type)551 Type OperationTyper::NumberToUint32(Type type) {
552 DCHECK(type.Is(Type::Number()));
553
554 if (type.Is(Type::Unsigned32())) return type;
555 if (type.Is(cache_->kZeroish)) return cache_->kSingletonZero;
556 if (type.Is(unsigned32ish_)) {
557 return Type::Intersect(Type::Union(type, cache_->kSingletonZero, zone()),
558 Type::Unsigned32(), zone());
559 }
560 return Type::Unsigned32();
561 }
562
NumberToUint8Clamped(Type type)563 Type OperationTyper::NumberToUint8Clamped(Type type) {
564 DCHECK(type.Is(Type::Number()));
565
566 if (type.Is(cache_->kUint8)) return type;
567 return cache_->kUint8;
568 }
569
NumberSilenceNaN(Type type)570 Type OperationTyper::NumberSilenceNaN(Type type) {
571 DCHECK(type.Is(Type::Number()));
572 // TODO(jarin): This is a terrible hack; we definitely need a dedicated type
573 // for the hole (tagged and/or double). Otherwise if the input is the hole
574 // NaN constant, we'd just eliminate this node in JSTypedLowering.
575 if (type.Maybe(Type::NaN())) return Type::Number();
576 return type;
577 }
578
BigIntAsUintN(Type type)579 Type OperationTyper::BigIntAsUintN(Type type) {
580 DCHECK(type.Is(Type::BigInt()));
581 return Type::BigInt();
582 }
583
CheckBigInt(Type type)584 Type OperationTyper::CheckBigInt(Type type) { return Type::BigInt(); }
585
NumberAdd(Type lhs,Type rhs)586 Type OperationTyper::NumberAdd(Type lhs, Type rhs) {
587 DCHECK(lhs.Is(Type::Number()));
588 DCHECK(rhs.Is(Type::Number()));
589
590 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
591
592 // Addition can return NaN if either input can be NaN or we try to compute
593 // the sum of two infinities of opposite sign.
594 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
595
596 // Addition can yield minus zero only if both inputs can be minus zero.
597 bool maybe_minuszero = true;
598 if (lhs.Maybe(Type::MinusZero())) {
599 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
600 } else {
601 maybe_minuszero = false;
602 }
603 if (rhs.Maybe(Type::MinusZero())) {
604 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
605 } else {
606 maybe_minuszero = false;
607 }
608
609 // We can give more precise types for integers.
610 Type type = Type::None();
611 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
612 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
613 if (!lhs.IsNone() && !rhs.IsNone()) {
614 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
615 type = AddRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
616 } else {
617 if ((lhs.Maybe(minus_infinity_) && rhs.Maybe(infinity_)) ||
618 (rhs.Maybe(minus_infinity_) && lhs.Maybe(infinity_))) {
619 maybe_nan = true;
620 }
621 type = Type::PlainNumber();
622 }
623 }
624
625 // Take into account the -0 and NaN information computed earlier.
626 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
627 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
628 return type;
629 }
630
NumberSubtract(Type lhs,Type rhs)631 Type OperationTyper::NumberSubtract(Type lhs, Type rhs) {
632 DCHECK(lhs.Is(Type::Number()));
633 DCHECK(rhs.Is(Type::Number()));
634
635 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
636
637 // Subtraction can return NaN if either input can be NaN or we try to
638 // compute the sum of two infinities of opposite sign.
639 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN());
640
641 // Subtraction can yield minus zero if {lhs} can be minus zero and {rhs}
642 // can be zero.
643 bool maybe_minuszero = false;
644 if (lhs.Maybe(Type::MinusZero())) {
645 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
646 maybe_minuszero = rhs.Maybe(cache_->kSingletonZero);
647 }
648 if (rhs.Maybe(Type::MinusZero())) {
649 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
650 }
651
652 // We can give more precise types for integers.
653 Type type = Type::None();
654 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
655 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
656 if (!lhs.IsNone() && !rhs.IsNone()) {
657 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
658 type = SubtractRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max());
659 } else {
660 if ((lhs.Maybe(infinity_) && rhs.Maybe(infinity_)) ||
661 (rhs.Maybe(minus_infinity_) && lhs.Maybe(minus_infinity_))) {
662 maybe_nan = true;
663 }
664 type = Type::PlainNumber();
665 }
666 }
667
668 // Take into account the -0 and NaN information computed earlier.
669 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
670 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
671 return type;
672 }
673
SpeculativeSafeIntegerAdd(Type lhs,Type rhs)674 Type OperationTyper::SpeculativeSafeIntegerAdd(Type lhs, Type rhs) {
675 Type result = SpeculativeNumberAdd(lhs, rhs);
676 // If we have a Smi or Int32 feedback, the representation selection will
677 // either truncate or it will check the inputs (i.e., deopt if not int32).
678 // In either case the result will be in the safe integer range, so we
679 // can bake in the type here. This needs to be in sync with
680 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
681 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
682 }
683
SpeculativeSafeIntegerSubtract(Type lhs,Type rhs)684 Type OperationTyper::SpeculativeSafeIntegerSubtract(Type lhs, Type rhs) {
685 Type result = SpeculativeNumberSubtract(lhs, rhs);
686 // If we have a Smi or Int32 feedback, the representation selection will
687 // either truncate or it will check the inputs (i.e., deopt if not int32).
688 // In either case the result will be in the safe integer range, so we
689 // can bake in the type here. This needs to be in sync with
690 // SimplifiedLowering::VisitSpeculativeAdditiveOp.
691 return Type::Intersect(result, cache_->kSafeIntegerOrMinusZero, zone());
692 }
693
NumberMultiply(Type lhs,Type rhs)694 Type OperationTyper::NumberMultiply(Type lhs, Type rhs) {
695 DCHECK(lhs.Is(Type::Number()));
696 DCHECK(rhs.Is(Type::Number()));
697
698 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
699 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
700
701 // Multiplication propagates NaN:
702 // NaN * x = NaN (regardless of sign of x)
703 // 0 * Infinity = NaN (regardless of signs)
704 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN()) ||
705 (lhs.Maybe(cache_->kZeroish) &&
706 (rhs.Min() == -V8_INFINITY || rhs.Max() == V8_INFINITY)) ||
707 (rhs.Maybe(cache_->kZeroish) &&
708 (lhs.Min() == -V8_INFINITY || lhs.Max() == V8_INFINITY));
709 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
710 DCHECK(!lhs.IsNone());
711 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
712 DCHECK(!rhs.IsNone());
713
714 // Try to rule out -0.
715 bool maybe_minuszero = lhs.Maybe(Type::MinusZero()) ||
716 rhs.Maybe(Type::MinusZero()) ||
717 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
718 (rhs.Maybe(cache_->kZeroish) && lhs.Min() < 0.0);
719 if (lhs.Maybe(Type::MinusZero())) {
720 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
721 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
722 }
723 if (rhs.Maybe(Type::MinusZero())) {
724 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
725 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
726 }
727
728 // Compute the effective type, utilizing range information if possible.
729 Type type = (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger))
730 ? MultiplyRanger(lhs.Min(), lhs.Max(), rhs.Min(), rhs.Max())
731 : Type::OrderedNumber();
732
733 // Take into account the -0 and NaN information computed earlier.
734 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
735 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
736 return type;
737 }
738
NumberDivide(Type lhs,Type rhs)739 Type OperationTyper::NumberDivide(Type lhs, Type rhs) {
740 DCHECK(lhs.Is(Type::Number()));
741 DCHECK(rhs.Is(Type::Number()));
742
743 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
744 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
745
746 // Division is tricky, so all we do is try ruling out -0 and NaN.
747 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
748 ((lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY) &&
749 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY));
750 lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
751 DCHECK(!lhs.IsNone());
752 rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
753 DCHECK(!rhs.IsNone());
754
755 // Try to rule out -0.
756 bool maybe_minuszero =
757 !lhs.Is(cache_->kInteger) ||
758 (lhs.Maybe(cache_->kZeroish) && rhs.Min() < 0.0) ||
759 (rhs.Min() == -V8_INFINITY || rhs.Max() == +V8_INFINITY);
760
761 // Take into account the -0 and NaN information computed earlier.
762 Type type = Type::PlainNumber();
763 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
764 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
765 return type;
766 }
767
NumberModulus(Type lhs,Type rhs)768 Type OperationTyper::NumberModulus(Type lhs, Type rhs) {
769 DCHECK(lhs.Is(Type::Number()));
770 DCHECK(rhs.Is(Type::Number()));
771
772 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
773
774 // Modulus can yield NaN if either {lhs} or {rhs} are NaN, or
775 // {lhs} is not finite, or the {rhs} is a zero value.
776 bool maybe_nan = lhs.Maybe(Type::NaN()) || rhs.Maybe(cache_->kZeroish) ||
777 lhs.Min() == -V8_INFINITY || lhs.Max() == +V8_INFINITY;
778
779 // Deal with -0 inputs, only the signbit of {lhs} matters for the result.
780 bool maybe_minuszero = false;
781 if (lhs.Maybe(Type::MinusZero())) {
782 maybe_minuszero = true;
783 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
784 }
785 if (rhs.Maybe(Type::MinusZero())) {
786 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
787 }
788
789 // Rule out NaN and -0, and check what we can do with the remaining type info.
790 Type type = Type::None();
791 lhs = Type::Intersect(lhs, Type::PlainNumber(), zone());
792 rhs = Type::Intersect(rhs, Type::PlainNumber(), zone());
793
794 // We can only derive a meaningful type if both {lhs} and {rhs} are inhabited,
795 // and the {rhs} is not 0, otherwise the result is NaN independent of {lhs}.
796 if (!lhs.IsNone() && !rhs.Is(cache_->kSingletonZero)) {
797 // Determine the bounds of {lhs} and {rhs}.
798 double const lmin = lhs.Min();
799 double const lmax = lhs.Max();
800 double const rmin = rhs.Min();
801 double const rmax = rhs.Max();
802
803 // The sign of the result is the sign of the {lhs}.
804 if (lmin < 0.0) maybe_minuszero = true;
805
806 // For integer inputs {lhs} and {rhs} we can infer a precise type.
807 if (lhs.Is(cache_->kInteger) && rhs.Is(cache_->kInteger)) {
808 double labs = std::max(std::abs(lmin), std::abs(lmax));
809 double rabs = std::max(std::abs(rmin), std::abs(rmax)) - 1;
810 double abs = std::min(labs, rabs);
811 double min = 0.0, max = 0.0;
812 if (lmin >= 0.0) {
813 // {lhs} positive.
814 min = 0.0;
815 max = abs;
816 } else if (lmax <= 0.0) {
817 // {lhs} negative.
818 min = 0.0 - abs;
819 max = 0.0;
820 } else {
821 // {lhs} positive or negative.
822 min = 0.0 - abs;
823 max = abs;
824 }
825 type = Type::Range(min, max, zone());
826 } else {
827 type = Type::PlainNumber();
828 }
829 }
830
831 // Take into account the -0 and NaN information computed earlier.
832 if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
833 if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
834 return type;
835 }
836
NumberBitwiseOr(Type lhs,Type rhs)837 Type OperationTyper::NumberBitwiseOr(Type lhs, Type rhs) {
838 DCHECK(lhs.Is(Type::Number()));
839 DCHECK(rhs.Is(Type::Number()));
840
841 lhs = NumberToInt32(lhs);
842 rhs = NumberToInt32(rhs);
843
844 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
845
846 double lmin = lhs.Min();
847 double rmin = rhs.Min();
848 double lmax = lhs.Max();
849 double rmax = rhs.Max();
850 // Or-ing any two values results in a value no smaller than their minimum.
851 // Even no smaller than their maximum if both values are non-negative.
852 double min =
853 lmin >= 0 && rmin >= 0 ? std::max(lmin, rmin) : std::min(lmin, rmin);
854 double max = kMaxInt;
855
856 // Or-ing with 0 is essentially a conversion to int32.
857 if (rmin == 0 && rmax == 0) {
858 min = lmin;
859 max = lmax;
860 }
861 if (lmin == 0 && lmax == 0) {
862 min = rmin;
863 max = rmax;
864 }
865
866 if (lmax < 0 || rmax < 0) {
867 // Or-ing two values of which at least one is negative results in a negative
868 // value.
869 max = std::min(max, -1.0);
870 }
871 return Type::Range(min, max, zone());
872 }
873
NumberBitwiseAnd(Type lhs,Type rhs)874 Type OperationTyper::NumberBitwiseAnd(Type lhs, Type rhs) {
875 DCHECK(lhs.Is(Type::Number()));
876 DCHECK(rhs.Is(Type::Number()));
877
878 lhs = NumberToInt32(lhs);
879 rhs = NumberToInt32(rhs);
880
881 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
882
883 double lmin = lhs.Min();
884 double rmin = rhs.Min();
885 double lmax = lhs.Max();
886 double rmax = rhs.Max();
887 double min = kMinInt;
888 // And-ing any two values results in a value no larger than their maximum.
889 // Even no larger than their minimum if both values are non-negative.
890 double max =
891 lmin >= 0 && rmin >= 0 ? std::min(lmax, rmax) : std::max(lmax, rmax);
892 // And-ing with a non-negative value x causes the result to be between
893 // zero and x.
894 if (lmin >= 0) {
895 min = 0;
896 max = std::min(max, lmax);
897 }
898 if (rmin >= 0) {
899 min = 0;
900 max = std::min(max, rmax);
901 }
902 return Type::Range(min, max, zone());
903 }
904
NumberBitwiseXor(Type lhs,Type rhs)905 Type OperationTyper::NumberBitwiseXor(Type lhs, Type rhs) {
906 DCHECK(lhs.Is(Type::Number()));
907 DCHECK(rhs.Is(Type::Number()));
908
909 lhs = NumberToInt32(lhs);
910 rhs = NumberToInt32(rhs);
911
912 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
913
914 double lmin = lhs.Min();
915 double rmin = rhs.Min();
916 double lmax = lhs.Max();
917 double rmax = rhs.Max();
918 if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
919 // Xor-ing negative or non-negative values results in a non-negative value.
920 return Type::Unsigned31();
921 }
922 if ((lmax < 0 && rmin >= 0) || (lmin >= 0 && rmax < 0)) {
923 // Xor-ing a negative and a non-negative value results in a negative value.
924 // TODO(jarin) Use a range here.
925 return Type::Negative32();
926 }
927 return Type::Signed32();
928 }
929
NumberShiftLeft(Type lhs,Type rhs)930 Type OperationTyper::NumberShiftLeft(Type lhs, Type rhs) {
931 DCHECK(lhs.Is(Type::Number()));
932 DCHECK(rhs.Is(Type::Number()));
933
934 lhs = NumberToInt32(lhs);
935 rhs = NumberToUint32(rhs);
936
937 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
938
939 int32_t min_lhs = lhs.Min();
940 int32_t max_lhs = lhs.Max();
941 uint32_t min_rhs = rhs.Min();
942 uint32_t max_rhs = rhs.Max();
943 if (max_rhs > 31) {
944 // rhs can be larger than the bitmask
945 max_rhs = 31;
946 min_rhs = 0;
947 }
948
949 if (max_lhs > (kMaxInt >> max_rhs) || min_lhs < (kMinInt >> max_rhs)) {
950 // overflow possible
951 return Type::Signed32();
952 }
953
954 double min =
955 std::min(static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << min_rhs),
956 static_cast<int32_t>(static_cast<uint32_t>(min_lhs) << max_rhs));
957 double max =
958 std::max(static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << min_rhs),
959 static_cast<int32_t>(static_cast<uint32_t>(max_lhs) << max_rhs));
960
961 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
962 return Type::Range(min, max, zone());
963 }
964
NumberShiftRight(Type lhs,Type rhs)965 Type OperationTyper::NumberShiftRight(Type lhs, Type rhs) {
966 DCHECK(lhs.Is(Type::Number()));
967 DCHECK(rhs.Is(Type::Number()));
968
969 lhs = NumberToInt32(lhs);
970 rhs = NumberToUint32(rhs);
971
972 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
973
974 int32_t min_lhs = lhs.Min();
975 int32_t max_lhs = lhs.Max();
976 uint32_t min_rhs = rhs.Min();
977 uint32_t max_rhs = rhs.Max();
978 if (max_rhs > 31) {
979 // rhs can be larger than the bitmask
980 max_rhs = 31;
981 min_rhs = 0;
982 }
983 double min = std::min(min_lhs >> min_rhs, min_lhs >> max_rhs);
984 double max = std::max(max_lhs >> min_rhs, max_lhs >> max_rhs);
985
986 if (max == kMaxInt && min == kMinInt) return Type::Signed32();
987 return Type::Range(min, max, zone());
988 }
989
NumberShiftRightLogical(Type lhs,Type rhs)990 Type OperationTyper::NumberShiftRightLogical(Type lhs, Type rhs) {
991 DCHECK(lhs.Is(Type::Number()));
992 DCHECK(rhs.Is(Type::Number()));
993
994 lhs = NumberToUint32(lhs);
995 rhs = NumberToUint32(rhs);
996
997 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
998
999 uint32_t min_lhs = lhs.Min();
1000 uint32_t max_lhs = lhs.Max();
1001 uint32_t min_rhs = rhs.Min();
1002 uint32_t max_rhs = rhs.Max();
1003 if (max_rhs > 31) {
1004 // rhs can be larger than the bitmask
1005 max_rhs = 31;
1006 min_rhs = 0;
1007 }
1008
1009 double min = min_lhs >> max_rhs;
1010 double max = max_lhs >> min_rhs;
1011 DCHECK_LE(0, min);
1012 DCHECK_LE(max, kMaxUInt32);
1013
1014 if (min == 0 && max == kMaxInt) return Type::Unsigned31();
1015 if (min == 0 && max == kMaxUInt32) return Type::Unsigned32();
1016 return Type::Range(min, max, zone());
1017 }
1018
NumberAtan2(Type lhs,Type rhs)1019 Type OperationTyper::NumberAtan2(Type lhs, Type rhs) {
1020 DCHECK(lhs.Is(Type::Number()));
1021 DCHECK(rhs.Is(Type::Number()));
1022 return Type::Number();
1023 }
1024
NumberImul(Type lhs,Type rhs)1025 Type OperationTyper::NumberImul(Type lhs, Type rhs) {
1026 DCHECK(lhs.Is(Type::Number()));
1027 DCHECK(rhs.Is(Type::Number()));
1028 // TODO(turbofan): We should be able to do better here.
1029 return Type::Signed32();
1030 }
1031
NumberMax(Type lhs,Type rhs)1032 Type OperationTyper::NumberMax(Type lhs, Type rhs) {
1033 DCHECK(lhs.Is(Type::Number()));
1034 DCHECK(rhs.Is(Type::Number()));
1035
1036 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1037 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1038
1039 Type type = Type::None();
1040 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1041 type = Type::Union(type, Type::NaN(), zone());
1042 }
1043 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1044 type = Type::Union(type, Type::MinusZero(), zone());
1045 // In order to ensure monotonicity of the computation below, we additionally
1046 // pretend +0 is present (for simplicity on both sides).
1047 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1048 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1049 }
1050 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1051 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1052 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1053 }
1054
1055 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1056 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1057 DCHECK(!lhs.IsNone());
1058 DCHECK(!rhs.IsNone());
1059
1060 double min = std::max(lhs.Min(), rhs.Min());
1061 double max = std::max(lhs.Max(), rhs.Max());
1062 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1063
1064 return type;
1065 }
1066
NumberMin(Type lhs,Type rhs)1067 Type OperationTyper::NumberMin(Type lhs, Type rhs) {
1068 DCHECK(lhs.Is(Type::Number()));
1069 DCHECK(rhs.Is(Type::Number()));
1070
1071 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1072 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return Type::NaN();
1073
1074 Type type = Type::None();
1075 if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
1076 type = Type::Union(type, Type::NaN(), zone());
1077 }
1078 if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
1079 type = Type::Union(type, Type::MinusZero(), zone());
1080 // In order to ensure monotonicity of the computation below, we additionally
1081 // pretend +0 is present (for simplicity on both sides).
1082 lhs = Type::Union(lhs, cache_->kSingletonZero, zone());
1083 rhs = Type::Union(rhs, cache_->kSingletonZero, zone());
1084 }
1085 if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
1086 !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
1087 return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
1088 }
1089
1090 lhs = Type::Intersect(lhs, cache_->kInteger, zone());
1091 rhs = Type::Intersect(rhs, cache_->kInteger, zone());
1092 DCHECK(!lhs.IsNone());
1093 DCHECK(!rhs.IsNone());
1094
1095 double min = std::min(lhs.Min(), rhs.Min());
1096 double max = std::min(lhs.Max(), rhs.Max());
1097 type = Type::Union(type, Type::Range(min, max, zone()), zone());
1098
1099 return type;
1100 }
1101
NumberPow(Type lhs,Type rhs)1102 Type OperationTyper::NumberPow(Type lhs, Type rhs) {
1103 DCHECK(lhs.Is(Type::Number()));
1104 DCHECK(rhs.Is(Type::Number()));
1105 // TODO(turbofan): We should be able to do better here.
1106 return Type::Number();
1107 }
1108
1109 #define SPECULATIVE_NUMBER_BINOP(Name) \
1110 Type OperationTyper::Speculative##Name(Type lhs, Type rhs) { \
1111 lhs = SpeculativeToNumber(lhs); \
1112 rhs = SpeculativeToNumber(rhs); \
1113 return Name(lhs, rhs); \
1114 }
1115 SPECULATIVE_NUMBER_BINOP(NumberAdd)
SPECULATIVE_NUMBER_BINOP(NumberSubtract)1116 SPECULATIVE_NUMBER_BINOP(NumberSubtract)
1117 SPECULATIVE_NUMBER_BINOP(NumberMultiply)
1118 SPECULATIVE_NUMBER_BINOP(NumberDivide)
1119 SPECULATIVE_NUMBER_BINOP(NumberModulus)
1120 SPECULATIVE_NUMBER_BINOP(NumberBitwiseOr)
1121 SPECULATIVE_NUMBER_BINOP(NumberBitwiseAnd)
1122 SPECULATIVE_NUMBER_BINOP(NumberBitwiseXor)
1123 SPECULATIVE_NUMBER_BINOP(NumberShiftLeft)
1124 SPECULATIVE_NUMBER_BINOP(NumberShiftRight)
1125 SPECULATIVE_NUMBER_BINOP(NumberShiftRightLogical)
1126 #undef SPECULATIVE_NUMBER_BINOP
1127
1128 Type OperationTyper::BigIntAdd(Type lhs, Type rhs) {
1129 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1130 return Type::BigInt();
1131 }
1132
BigIntSubtract(Type lhs,Type rhs)1133 Type OperationTyper::BigIntSubtract(Type lhs, Type rhs) {
1134 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1135 return Type::BigInt();
1136 }
1137
BigIntNegate(Type type)1138 Type OperationTyper::BigIntNegate(Type type) {
1139 if (type.IsNone()) return type;
1140 return Type::BigInt();
1141 }
1142
SpeculativeBigIntAdd(Type lhs,Type rhs)1143 Type OperationTyper::SpeculativeBigIntAdd(Type lhs, Type rhs) {
1144 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1145 return Type::BigInt();
1146 }
1147
SpeculativeBigIntSubtract(Type lhs,Type rhs)1148 Type OperationTyper::SpeculativeBigIntSubtract(Type lhs, Type rhs) {
1149 if (lhs.IsNone() || rhs.IsNone()) return Type::None();
1150 return Type::BigInt();
1151 }
1152
SpeculativeBigIntNegate(Type type)1153 Type OperationTyper::SpeculativeBigIntNegate(Type type) {
1154 if (type.IsNone()) return type;
1155 return Type::BigInt();
1156 }
1157
SpeculativeToNumber(Type type)1158 Type OperationTyper::SpeculativeToNumber(Type type) {
1159 return ToNumber(Type::Intersect(type, Type::NumberOrOddball(), zone()));
1160 }
1161
ToPrimitive(Type type)1162 Type OperationTyper::ToPrimitive(Type type) {
1163 if (type.Is(Type::Primitive())) {
1164 return type;
1165 }
1166 return Type::Primitive();
1167 }
1168
Invert(Type type)1169 Type OperationTyper::Invert(Type type) {
1170 DCHECK(type.Is(Type::Boolean()));
1171 CHECK(!type.IsNone());
1172 if (type.Is(singleton_false())) return singleton_true();
1173 if (type.Is(singleton_true())) return singleton_false();
1174 return type;
1175 }
1176
Invert(ComparisonOutcome outcome)1177 OperationTyper::ComparisonOutcome OperationTyper::Invert(
1178 ComparisonOutcome outcome) {
1179 ComparisonOutcome result(0);
1180 if ((outcome & kComparisonUndefined) != 0) result |= kComparisonUndefined;
1181 if ((outcome & kComparisonTrue) != 0) result |= kComparisonFalse;
1182 if ((outcome & kComparisonFalse) != 0) result |= kComparisonTrue;
1183 return result;
1184 }
1185
FalsifyUndefined(ComparisonOutcome outcome)1186 Type OperationTyper::FalsifyUndefined(ComparisonOutcome outcome) {
1187 if ((outcome & kComparisonFalse) != 0 ||
1188 (outcome & kComparisonUndefined) != 0) {
1189 return (outcome & kComparisonTrue) != 0 ? Type::Boolean()
1190 : singleton_false();
1191 }
1192 // Type should be non empty, so we know it should be true.
1193 DCHECK_NE(0, outcome & kComparisonTrue);
1194 return singleton_true();
1195 }
1196
1197 namespace {
1198
JSType(Type type)1199 Type JSType(Type type) {
1200 if (type.Is(Type::Boolean())) return Type::Boolean();
1201 if (type.Is(Type::String())) return Type::String();
1202 if (type.Is(Type::Number())) return Type::Number();
1203 if (type.Is(Type::BigInt())) return Type::BigInt();
1204 if (type.Is(Type::Undefined())) return Type::Undefined();
1205 if (type.Is(Type::Null())) return Type::Null();
1206 if (type.Is(Type::Symbol())) return Type::Symbol();
1207 if (type.Is(Type::Receiver())) return Type::Receiver(); // JS "Object"
1208 return Type::Any();
1209 }
1210
1211 } // namespace
1212
SameValue(Type lhs,Type rhs)1213 Type OperationTyper::SameValue(Type lhs, Type rhs) {
1214 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1215 if (lhs.Is(Type::NaN())) {
1216 if (rhs.Is(Type::NaN())) return singleton_true();
1217 if (!rhs.Maybe(Type::NaN())) return singleton_false();
1218 } else if (rhs.Is(Type::NaN())) {
1219 if (!lhs.Maybe(Type::NaN())) return singleton_false();
1220 }
1221 if (lhs.Is(Type::MinusZero())) {
1222 if (rhs.Is(Type::MinusZero())) return singleton_true();
1223 if (!rhs.Maybe(Type::MinusZero())) return singleton_false();
1224 } else if (rhs.Is(Type::MinusZero())) {
1225 if (!lhs.Maybe(Type::MinusZero())) return singleton_false();
1226 }
1227 if (lhs.Is(Type::OrderedNumber()) && rhs.Is(Type::OrderedNumber()) &&
1228 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1229 return singleton_false();
1230 }
1231 return Type::Boolean();
1232 }
1233
SameValueNumbersOnly(Type lhs,Type rhs)1234 Type OperationTyper::SameValueNumbersOnly(Type lhs, Type rhs) {
1235 // SameValue and SamevalueNumbersOnly only differ in treatment of
1236 // strings and biginits. Since the SameValue typer does not do anything
1237 // special about strings or bigints, we can just use it here.
1238 return SameValue(lhs, rhs);
1239 }
1240
StrictEqual(Type lhs,Type rhs)1241 Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
1242 CHECK(!lhs.IsNone());
1243 CHECK(!rhs.IsNone());
1244 if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
1245 if (lhs.Is(Type::NaN()) || rhs.Is(Type::NaN())) return singleton_false();
1246 if (lhs.Is(Type::Number()) && rhs.Is(Type::Number()) &&
1247 (lhs.Max() < rhs.Min() || lhs.Min() > rhs.Max())) {
1248 return singleton_false();
1249 }
1250 if (lhs.IsSingleton() && rhs.Is(lhs)) {
1251 // Types are equal and are inhabited only by a single semantic value,
1252 // which is not nan due to the earlier check.
1253 DCHECK(lhs.Is(rhs));
1254 return singleton_true();
1255 }
1256 if ((lhs.Is(Type::Unique()) || rhs.Is(Type::Unique())) && !lhs.Maybe(rhs)) {
1257 // One of the inputs has a canonical representation but types don't overlap.
1258 return singleton_false();
1259 }
1260 return Type::Boolean();
1261 }
1262
CheckBounds(Type index,Type length)1263 Type OperationTyper::CheckBounds(Type index, Type length) {
1264 DCHECK(length.Is(cache_->kPositiveSafeInteger));
1265 if (length.Is(cache_->kSingletonZero)) return Type::None();
1266 Type mask = Type::Range(0.0, length.Max() - 1, zone());
1267 if (index.Maybe(Type::MinusZero())) {
1268 index = Type::Union(index, cache_->kSingletonZero, zone());
1269 }
1270 if (index.Maybe(Type::String())) {
1271 index = Type::Union(index, cache_->kIntPtr, zone());
1272 }
1273 return Type::Intersect(index, mask, zone());
1274 }
1275
CheckFloat64Hole(Type type)1276 Type OperationTyper::CheckFloat64Hole(Type type) {
1277 if (type.Maybe(Type::Hole())) {
1278 // Turn "the hole" into undefined.
1279 type = Type::Intersect(type, Type::Number(), zone());
1280 type = Type::Union(type, Type::Undefined(), zone());
1281 }
1282 return type;
1283 }
1284
CheckNumber(Type type)1285 Type OperationTyper::CheckNumber(Type type) {
1286 return Type::Intersect(type, Type::Number(), zone());
1287 }
1288
TypeTypeGuard(const Operator * sigma_op,Type input)1289 Type OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type input) {
1290 return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
1291 }
1292
ConvertTaggedHoleToUndefined(Type input)1293 Type OperationTyper::ConvertTaggedHoleToUndefined(Type input) {
1294 if (input.Maybe(Type::Hole())) {
1295 // Turn "the hole" into undefined.
1296 Type type = Type::Intersect(input, Type::NonInternal(), zone());
1297 return Type::Union(type, Type::Undefined(), zone());
1298 }
1299 return input;
1300 }
1301
ToBoolean(Type type)1302 Type OperationTyper::ToBoolean(Type type) {
1303 if (type.Is(Type::Boolean())) return type;
1304 if (type.Is(falsish_)) return singleton_false_;
1305 if (type.Is(truish_)) return singleton_true_;
1306 if (type.Is(Type::Number())) {
1307 return NumberToBoolean(type);
1308 }
1309 return Type::Boolean();
1310 }
1311
1312 } // namespace compiler
1313 } // namespace internal
1314 } // namespace v8
1315